Feat settings cascade (#3)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

ROADMAP.md

@@ -1,6 +1,6 @@
 # Switchboard Core — Roadmap
 
-## Current: v0.1.0 — The Kernel
+## Current: v0.2.0 — SDK & Triggers
 
 Fork of chat-switchboard, gutted to a pure extension platform. All AI/chat
 features removed from the kernel. What remains is the minimum viable
@@ -16,7 +16,7 @@ platform that extensions build on.
 - **Realtime**: WebSocket hub, presence, multi-replica HA
 - **Ops**: audit log, notifications, maintenance goroutine
 
-### Phase 0 (in progress)
+### Phase 0 (complete)
 
 | Step | Status | Description |
 |------|--------|-------------|
@@ -31,32 +31,39 @@ platform that extensions build on.
 | 9. CI/CD + Dockerfile | ✅ | Single unified image, FE/BE split removed, DB names updated, k8s var alignment fixes (resource quantities, image name, rollout deployment name) |
 | 10. Smoke test | ✅ | K8s deploy live at switchboard.gobha.ai/test, nginx BASE_PATH fixed, login→admin flow verified, branding updated |
 
-## v0.2.0 — SDK & Triggers
+## v0.2.x — SDK & Triggers
 
 The contract that extensions build against. Three trigger primitives,
 SDK stabilization, and the first rebuilt extension (tasks).
 
+### v0.2.0 — RBAC + Settings Cascade (complete)
+
 | Step | Status | Description |
 |------|--------|-------------|
 | Admin → RBAC group | ✅ | `surface.admin.access` permission + Admins system group replaces `role == "admin"` checks. Admin bypass removed from permission middleware. |
-| Settings cascade | 🔲 | `user_overridable` flag, RBAC scope auth, resolution chain |
+| Settings cascade | ✅ | `user_overridable` flag, three-tier resolution (global → team → user), team settings API |
+| ~~Settings override model~~ | ✅ | Shipped with settings cascade above |
+
+### v0.2.1 — Default Surface + ICD
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Default surface routing | 🔲 | `/` redirects to configurable default surface. No surfaces → admin. First install becomes default. Changeable in admin settings. |
 | ICD (API contract) | 🔲 | OpenAPI spec from registered routes, kernel-only endpoint docs |
+
+### v0.2.2 — Event Bus + Triggers
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Event bus subscriptions | 🔲 | Extensions register match expressions at install time |
 | Trigger system | 🔲 | Time (cron), webhook (inbound HTTP), event (bus subscription) |
+
+### v0.2.3 — SDK + Task Extension
+
+| Step | Status | Description |
+|------|--------|-------------|
 | SDK stabilization | 🔲 | `sb.slots()`, `sb.actions`, `sb.api.ext()`, `sb.storage`, theme tokens, primitive UI |
-
-### Remaining v0.2.0 features
-
-- **Event bus subscriptions**: extensions register match expressions at install time
-- **Task extension**: first proof-of-concept — full task system rebuilt as a
-  Starlark extension using triggers + ext_data + notifications
-- **Settings override model**: RBAC controls scope auth (admin → global,
-  team-admin → team, user → personal). `user_overridable` flag on each setting
-  controls whether lower scopes can override higher. Resolution order:
-  user → team → global (first non-null wins, walking up if overridable).
-  Extension manifests declare `user_overridable` per setting key.
-- **Default surface routing**: `/` redirects to configurable default surface.
-  No surfaces installed → admin surface is default. First surface installed
-  becomes default. Changeable in admin settings.
+| Task extension | 🔲 | First proof-of-concept — full task system rebuilt as Starlark extension using triggers + ext_data + notifications |
 
 ## v0.3.0 — Editor Surface