diff --git a/docs/05-roadmap.md b/docs/05-roadmap.md
index b8b2a2a..d875414 100644
--- a/docs/05-roadmap.md
+++ b/docs/05-roadmap.md
@@ -235,3 +235,101 @@ P10 needs P5; 10b (MCP) is the priority; 10c (push/issue) is later and optional.
 ## Suggested first milestone (thin vertical slice)
 T1.1 → T1.2 → T1.5 → T1.6 → T2.1 → T2.2 → T2.4 gives a usable "record → live transcript → saved
 Markdown notes" loop — the smallest thing worth dogfooding.
+
+---
+
+## Remaining work — post-v0.2.0 execution plan
+
+As of **v0.2.0**, Phases 1–9 ship (capture incl. microphone, CPU/NPU/Vulkan transcription,
+diarization, storage/recovery, notes, local-LLM summaries, PST calendar, UX/a11y,
+templates/search/tags/export/reminders/encryption, WebDAV + OneDrive sync) in a single universal
+installer. What remains is **Phase 10 (external AI & agent handoff, ADR-0011)** plus a few
+breadth/reliability items. This section sequences that work by leverage, dependency, and the
+privacy invariant. Task IDs reference the Phase 10 list above; finer sub-tasks add a letter suffix.
+Traits/contracts for all of this already exist in `04-api-contracts.md` (`FeatureBriefBuilder`,
+`McpServer`, hosted `LlmProvider` impls, `AgentRunner`, `IssueTracker`); tests live in
+`06-test-strategy.md` (P10 + the cross-cutting egress gate).
+
+**Status snapshot (what's actually in the tree):**
+- **Built:** Phases 1–9; `OpenAiCompatProvider` (used as the Phase 5 "custom" endpoint).
+- **Stubbed** (commands return `Err(not_implemented(...))`): `create/list/get_feature_brief`,
+  `set_brief_exposed`, `mcp_status`, `set_mcp_enabled`, `set_mcp_scope`, `mcp_access_log`,
+  `run_agent`, `create_issue_from_brief`.
+- **Skeleton/absent:** `mcp/mod.rs` (trait + `todo!()` only); `AnthropicProvider` (returns
+  "isn't built yet"); MS Graph `CalendarSource`; multi-language selection; `DropboxTarget`/
+  `BoxTarget` (OAuth wired in `sync/oauth.rs`, upload impl missing); chunked/resumable upload.
+
+**Sequence:** M1 → M2 (briefs are the MCP payload); **M3 can run in parallel** with M1/M2; M4 is
+opportunistic; **M5 is last and optional**.
+
+### M1 — Feature briefs (do first; standalone value) → FR-MCP-4 (T10.6)
+Needs only the already-built LLM, delivers value before any MCP transport (view/copy a brief), and
+is the exact payload M2 serves. No new egress (uses the configured `LlmProvider`).
+- `[M1.1]` `FeatureBriefBuilder::build(meeting_id, target_repo)`: prompt-assemble transcript +
+  metadata → `{problem, desired_outcome, acceptance_criteria[], target_repo, context_excerpts[]}`
+  via the configured provider; tolerant parse with graceful fallback on a malformed model reply. **M**
+- `[M1.2]` Persist to `briefs/<id>.json` (schema-versioned per `03-data-model.md`); implement
+  `create_feature_brief`/`list_feature_briefs`/`get_feature_brief` (replace the stubs). **M**
+- `[M1.3]` UI: "Create feature brief" on a finished meeting; view/edit/copy; target-repo field. **M**
+- `[M1.4]` `set_brief_exposed` + persisted `exposed` flag (the scope foundation M2 reads). **S**
+- **Acceptance:** a golden transcript yields a schema-valid brief; it persists and re-opens; with the
+  LLM off/unreachable the command errors cleanly (no panic, no partial write).
+
+### M2 — MCP server (the differentiator) → FR-MCP-1/2/3/5/6/7 (T10.4/10.5/10.7/10.8/10.9)
+The unique capability (meeting → coding-agent handoff) and a privacy *reinforcement*: inbound on
+loopback, **zero added egress**.
+- `[M2.1]` `mcp` module on `rmcp`: loopback bind + token gate; Streamable HTTP (`/mcp`) + stdio
+  adapter; implement `McpServer::start/stop` (replace `todo!()`). **L** → FR-MCP-1/6, NFR-SEC-5
+- `[M2.2]` Tools-first surface: `list_recent_meetings`, `get_transcript`, `get_action_items`,
+  `get_feature_brief`. **M** → FR-MCP-2
+- `[M2.3]` Scope control `set_mcp_scope(none|selected|all)`; recordings never served unless
+  explicitly allowed; enforce in every tool handler. **M** → FR-MCP-3
+- `[M2.4]` Lifecycle: `mcp_status`/`set_mcp_enabled` (replace stubs); persist enabled/scope in
+  settings, **token in the OS credential store** (never `settings.json`). **M** → FR-MCP-1
+- `[M2.5]` Disclosure UI ("connected agents may forward data") + `mcp_access_log` rows /
+  `mcp://access` events on every tool read. **M** → FR-MCP-5
+- `[M2.6]` Privacy panel shows MCP state and confirms it adds no egress; extend
+  `privacy_self_check`. **S** → FR-MCP-7, FR-SEC-2
+- **Acceptance:** an in-process MCP client gets a schema-valid brief; server binds loopback only
+  (assert a non-loopback bind is refused) and requires a token; **the egress test is unchanged with
+  MCP on** (merge blocker, FR-MCP-7); recordings not served unless allowed; every read logged.
+- **Depends on:** M1 (a served tool). Guardrail: the cross-cutting egress gate must stay green.
+
+### M3 — Hosted AI providers (finish 10a) → FR-AI-1/2/3 (T10.1/10.2/10.3)
+Commodity but low-effort (OpenAI-compat already exists); gives a cloud-summary choice and pairs with
+M1 (a brief can be distilled by a hosted model). Adds allowlisted egress **by design**.
+- `[M3.1]` Implement `AnthropicProvider` (`/v1/messages`, `x-api-key`, streaming) behind
+  `LlmProvider`; `is_local() == false`. **M** → FR-AI-1
+- `[M3.2]` `set_llm_provider`: store the API key in the OS credential store via `credential_ref`
+  (never settings/DB); add the host to the settings-derived egress allowlist. **M** → FR-AI-2, NFR-SEC-4
+- `[M3.3]` Third-party "data leaves your device" banner + one-time acknowledgment; per-use provider
+  selection + active-provider display wherever a summary is generated. **S** → FR-AI-2/3
+- **Acceptance:** summaries route to mocked OpenAI-compat *and* Anthropic endpoints with correct
+  shapes; key read only from the credential store; host on the allowlist only when configured; banner
+  shown before first hosted use.
+
+### M4 — Reliability & breadth (opportunistic, by value)
+- `[M4.1]` **Chunked/resumable upload** (T9.2 refinement) — *top reliability item*: recordings are
+  now native-quality (~50–100 MB) and `put()` buffers the whole file in memory; OneDrive/Graph caps a
+  single PUT at 250 MB. Stream from disk in chunks (Nextcloud chunked upload + Graph upload session).
+  **M** → FR-SYNC-2/5
+- `[M4.2]` Multi-language transcription (T8.7): multilingual model option; whisper language param
+  (select/auto); persist per-meeting `language`; UI localization scaffold. **M** → FR-TRX-4
+- `[M4.3]` Dropbox/Box upload targets (T9.10): implement `DropboxTarget`/`BoxTarget` `SyncTarget`
+  impls (OAuth is already wired). **M** → FR-SYNC-9
+- `[M4.4]` *(Defer)* MS Graph calendar source (T8.9) behind `CalendarSource`, consented,
+  metadata-only. **L** → FR-CAL-6 (Could)
+
+### M5 — Push handoff (Layer 3, last & optional) → FR-AGENT-1/2 (Could) (T10.10/10.11)
+Only on demand — the MCP handoff (M2) already covers the agent use case (agents *pull* context).
+- `[M5.1]` `AgentRunner`: spawn `claude -p` / `codex exec` / `opencode run` / `copilot` headless
+  against a chosen repo from a brief; stream output (`run_agent`). **L** → FR-AGENT-1
+- `[M5.2]` `IssueTracker`: create a GitHub issue from a confirmed action item / brief; optional
+  Copilot-cloud assign (`create_issue_from_brief`). Third-party egress: off/labeled/allowlisted. **M**
+  → FR-AGENT-2
+
+**Privacy checkpoints (gate every milestone):** the egress self-test stays green (FR-SEC-1); enabling
+MCP adds **no** allowlist host (FR-MCP-7); hosted AI/agent handoff adds only the explicitly configured
+host; all secrets (AI keys, MCP token, OAuth tokens) live only in the OS credential store
+(NFR-SEC-4). Plus the standing gates: `cargo fmt`/`clippy -D warnings`, Prettier/ESLint/`tsc`, and a
+docs update whenever a command/event contract changes (CLAUDE.md).