ROADMAP: scaffold complete; record the seven traps already paid for

Definition-of-ready is met: repo pushed to both remotes, CI green on all
three jobs, openmail.karti.ai live, and all three tier-1 crates pass
cargo publish --dry-run.

Two items left open on purpose and written down rather than dropped: no
x86_64 CI job while GitHub-hosted runners are unavailable for billing, and
the repo stays private until v0.1 closes the ingest loop per ADR 0004.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JkyvfNJGTshJNE9FtwPLk7

ROADMAP.md

@@ -33,10 +33,24 @@ finished and feature work can start without stopping to fix plumbing.
 - [x] Six decisions recorded as ADRs, each with its cost stated
 - [x] Multi-stage Dockerfile, non-root, no shell in the runtime image
 - [x] **OCI outbound port block measured, not assumed** — 25 blocked, 587/465/2525 open
-- [ ] Repo pushed to `karti-ai/openmail`
-- [ ] CI actually running (GitHub-hosted x86 + spark-1 aarch64 runner)
-- [ ] `openmail.karti.ai` live
-- [ ] `cargo publish --dry-run` clean on the three tier-1 crates
+- [x] Repo pushed to `karti-ai/openmail` (and mirrored to Gitea `OSS/openmail`)
+- [x] CI green — all three jobs on the spark-1 aarch64 runner
+- [x] `openmail.karti.ai` live
+- [x] `cargo publish --dry-run` clean on all three tier-1 crates
+
+**The scaffold is done. Feature work can start.**
+
+### Two things deliberately left open
+
+- **GitHub-hosted runners are unavailable on the account** — *"recent account
+  payments have failed or your spending limit needs to be increased."* Every
+  job runs on spark-1 instead, which is also the deployment architecture, so
+  this is not purely a workaround. An **x86_64 job should be added back** once
+  hosted runners work (or once the repo is public, which makes them free), to
+  catch width- and endianness-dependent bugs that aarch64-only CI cannot.
+- **The repo is still private.** ADR 0004 argues for going public once v0.1
+  closes the ingest loop, so the first impression is a working thing rather
+  than a scaffold.
 
 ---
 
@@ -113,3 +127,20 @@ and clean `extracted_text` back.
 4. **`pods` is not dead code.** It is the only thing keeping a future hosted
    offering migration-free.
 5. **Zero clippy warnings is the gate**, not an aspiration.
+
+---
+
+## Traps already paid for
+
+Recorded because each cost real time, and the next person (or the next
+session) should not pay again.
+
+| Trap | What happens | Rule |
+|---|---|---|
+| `Swatinem/rust-cache` on a **self-hosted** runner | Its post-step prunes `~/.cargo`, deleting the real toolchain. The first run passes, then every later run fails `exit 127`. | Never use it on self-hosted. Toolchain lives at `/opt/rust`. |
+| Runner `.path` / `.env` files | Were not applied by this runner. | Set `PATH`, `RUSTUP_HOME`, `CARGO_HOME` in the workflow `env:` block. |
+| Symlinking `cargo-clippy` into `/usr/local/bin` | Breaks clippy's sysroot resolution — `cargo clippy` silently behaves like `rustc` and rejects `--workspace`. | Use a full rustup install and put its `bin` on PATH; do not symlink individual toolchain binaries. |
+| `mail-auth`'s `generate` feature | Pulls in `rsa`, carrying RUSTSEC-2023-0071 (Marvin Attack, no fix available). | Don't enable it. Generate DKIM keys with `openssl genpkey`, out of process. |
+| cloud-2 Caddy without `bind 10.0.0.2` | Serves a valid certificate and an empty 200 — looks deployed, returns nothing. | Always include the bind; verify with `curl`, never by eye. |
+| GitHub push with a real email | `remote rejected … email privacy restrictions`. | Repo is configured with the `users.noreply.github.com` address. |
+| `git.karti.ai:2223` from amd-server | Times out; Gitea SSH is tailnet-only. | Use the `gitea` SSH alias (`gitea:OSS/openmail.git`). |