diff --git a/AGENTS.md b/AGENTS.md
index 52b8c2d..5f952a7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7,6 +7,10 @@
- Write TSDoc/rustdoc comments for exported/public and contextually important symbols
for maintainers
- Helpers need more than 1 call-site to justify abstraction
+- Prefer the smallest end-to-end path through the shared document model before widening a
+ feature's surface. Verify save/reopen, undo/redo, merge, inspection, and export where they apply.
+- Add shared fixtures and regression coverage with feature work. Optimize from measured bottlenecks
+ rather than speculative architecture.
- Run the full test suite through the root `pnpm test` command, or run a package's
Vitest command from that package's directory.
- Do not invoke a package-local vitest from the repository root Vitest will miss the
diff --git a/ROADMAP.md b/ROADMAP.md
index 4b1efa8..659eb5d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -3,18 +3,14 @@
Inkfinite is a local-first infinite canvas for humans and agents. The desktop app, CLI, and
programmatic interfaces share one native document model and transaction engine.
-Active implementation work is in [TODO.md](TODO.md). Completed work is summarized in
-[CHANGELOG.md](CHANGELOG.md), with architecture and behavior documented on the
-[documentation site](apps/web/src/content/docs/).
-
## Current direction
### SVG round-trip
-Inkfinite has one validated Rust SVG pipeline across desktop, web, and CLI. Native paths,
-transforms, compound fills, imported hierarchy, static fallbacks, and deterministic rendering are
-implemented. The remaining work proves complete document workflows: save and reopen, edit and
-export, undo and redo, CRDT merge, CLI access, and visual stability of fallback content.
+Inkfinite has one validated Rust SVG pipeline across desktop, web, and CLI. It maps supported
+geometry into native shapes, preserves hierarchy, transforms, and compound fills, retains source
+assets, and reports unsupported content. The remaining work proves complete document workflows:
+save and reopen, edit and export, undo and redo, CRDT merge, and CLI access.
See [SVG import](apps/web/src/content/docs/internals/svg-import.md) and
[native path geometry](apps/web/src/content/docs/internals/native-path-geometry.md).
@@ -36,26 +32,6 @@ IPC, and MCP workloads on recorded reference hardware. Set regression budgets fr
Add indexes, caches, incremental materialization, or alternate rendering only when a representative
benchmark identifies the cost they address.
-## Completed foundation
-
-Inkfinite now has an Automerge-backed Rust document engine, generated TypeScript contracts,
-deterministic SVG rendering, native desktop files, browser WASM sessions, shared editor/runtime
-packages, unrestricted CLI file and live workflows, SVG import/export, and native hierarchical path
-editing.
-The changelog gives the release-level summary; the docs site owns implementation and usage detail.
-
-## Engineering principles
-
-- Rust owns the document model, validation, transaction engine, native persistence, and headless
- rendering.
-- TypeScript owns low-latency interaction, previews, browser input, and Canvas rendering.
-- All committed mutations use the validated transaction path.
-- Keep document correctness separate from caller authorization.
-- Complete save/reopen, undo/redo, merge, inspection, and export workflows before widening a
- feature's surface.
-- Prefer shared fixtures and measured optimization over duplicated assertions or speculative
- architecture.
-
## Later
Potential later work includes advanced vector operations, additional interchange formats, PWA and
diff --git a/TODO.md b/TODO.md
index 764225f..5d67d95 100644
--- a/TODO.md
+++ b/TODO.md
@@ -16,45 +16,11 @@ normalized structure where representation matters and rendered output where visu
- [ ] Verify opaque fallback content remains visually stable
- [ ] Add deterministic round-trip fixtures for these workflows
-## Direct CLI control
-
-### Remove agent-specific restrictions
-
-- [x] Audit all `Origin::Agent` behavior
- - CLI and IPC creation paths label transactions as agent-originated.
- The core engine uses that value to enforce `agent_editable` and hidden-layer mutation rules.
- Live proposal and apply entry points require it.
- General queries hide invisible-layer shapes without consulting origin.
- The [origin and authorization guide](apps/web/src/content/docs/internals/origin-and-authorization.md)
- records the findings, rationale, and migration boundary.
-- [x] Decide whether `Origin` remains provenance-only
- - Decision: keep `Origin` as provenance-only metadata for history and attribution.
- It must not grant or deny access. Agent authorization moves to MCP.
-- [x] Separate document invariants and ordinary locks from authorization
-- [x] Remove `agent_editable` restrictions from direct CLI operations
-- [x] Remove hidden-from-agent restrictions from direct CLI operations
-
-### Preserve document correctness
-
-- [x] Keep causal-head and record-version checks
-- [x] Keep transaction validation and atomic mutation
-- [x] Keep ordinary shape and layer locks
-
-### Simplify CLI and live control
-
-- [x] Remove Review/Direct authorization concepts from general CLI behavior
-- [x] Simplify live apply semantics
-- [x] Remove proposal behavior from the general CLI; reserve review for permissioned MCP
-- [x] Update capabilities, generated protocols, and schemas
-- [x] Update CLI help, documentation, and bundled skill guidance
-- [x] Replace permission-oriented CLI tests with direct-control tests
-- [x] Add regression coverage for unrestricted scripted mutation
-
## Permissioned MCP
### Server and discovery
-- [ ] Choose a Rust MCP implementation and add an `inkfinite-mcp` crate or binary
+- [ ] Add `inkfinite-mcp` crate with `rmcp` & its macros
- [ ] Start with stdio transport and expose Inkfinite capability metadata
- [ ] Reuse core query and transaction APIs rather than shelling out to the CLI
- [ ] Discover open sessions and accessible files
@@ -117,3 +83,13 @@ normalized structure where representation matters and rendered output where visu
- [ ] Add a web manifest, service worker, PWA installation, and stronger offline behavior
- [ ] Decide crates.io and desktop release packaging; automate release artifacts
- [ ] Revisit skill organization after SVG and MCP workflows stabilize
+
+### Polish
+
+- [ ] Export SVG as copyable code
+- [ ] Export PNG to clipboard
+- [ ] Move handle on the layer pane
+
+---
+
+- [ ] Direct Select could be clearer
diff --git a/apps/web/src/content/docs/concepts/transactions-and-sync.md b/apps/web/src/content/docs/concepts/transactions-and-sync.md
index 1636c86..a275fad 100644
--- a/apps/web/src/content/docs/concepts/transactions-and-sync.md
+++ b/apps/web/src/content/docs/concepts/transactions-and-sync.md
@@ -17,8 +17,9 @@ validation, history, and review tied to the user's request.
Preconditions can require specific document heads or record versions. Inkfinite rejects the whole
transaction when those expectations are stale, when a selector is ambiguous, or when an operation
-would cross a lock or agent-editability boundary. A rejected transaction does not partially modify
-the canonical file.
+would cross a shape or layer lock. A rejected transaction does not partially modify the canonical
+file. Permissioned integrations can apply caller policy before submitting a valid transaction.
+`agent_editable` is not a document-engine lock.
## Undo and redo
diff --git a/apps/web/src/content/docs/internals.md b/apps/web/src/content/docs/internals.md
index 83544f8..9cbfc3e 100644
--- a/apps/web/src/content/docs/internals.md
+++ b/apps/web/src/content/docs/internals.md
@@ -14,6 +14,26 @@ The boundary between them is intentional: the editor can keep pointer movement a
local, while completed desktop edits still commit through the same Rust transaction engine used by
the CLI.
+## Implemented foundation
+
+The current system includes:
+
+- an Automerge-backed Rust document engine with validated atomic transactions, history, undo and
+ redo, causal heads, sync, deterministic repair, and native file recovery
+- generated TypeScript contracts, semantic metadata, ordered layers, bindings, built-in shapes, and
+ stencils shared across interfaces
+- deterministic SVG and PNG rendering, static SVG import and export, and native path geometry with
+ hierarchy editing
+- native desktop files, browser WASM sessions, and shared editor, runtime, input, and renderer
+ packages
+- CLI workflows for file and live-session inspection, queries, validation, structured mutations,
+ dry runs, rendering, schemas, and machine-readable output
+
+The linked pages in this section describe these components in detail. Start with [Documents](/docs/concepts/documents/)
+for the record model, [Transactions and sync](/docs/concepts/transactions-and-sync/) for commits and
+merges, [SVG import](/docs/internals/svg-import/) for interchange, and [Native path geometry](/docs/internals/native-path-geometry/)
+for vector editing.
+
## Architecture
```text
diff --git a/apps/web/src/content/docs/introduction.md b/apps/web/src/content/docs/introduction.md
index 3b4d1f3..f0a0a00 100644
--- a/apps/web/src/content/docs/introduction.md
+++ b/apps/web/src/content/docs/introduction.md
@@ -31,7 +31,7 @@ command-line tools use file locks, atomic replacement, and recovery data to prot
- Use the [desktop editor](/docs/applications/desktop/) for native files and desktop menus.
- Use the [command-line interface](/docs/reference/cli/) to inspect, edit, validate, or render a
document from a script.
-- Use [agent workflows](/docs/reference/agents/) to propose document changes for review.
+- Use [agent workflows](/docs/reference/agents/) to inspect, validate, and apply scripted document changes.
## Where to go next
diff --git a/apps/web/src/routes/+page.svelte b/apps/web/src/routes/+page.svelte
index bdb8fc9..7b0539b 100644
--- a/apps/web/src/routes/+page.svelte
+++ b/apps/web/src/routes/+page.svelte
@@ -1,7 +1,7 @@
+
+
+
+
+
+
+ {#if isOpen}
+
+
+
+ Palette
+
+
+ {#each quickColors as quickColor}
+ {@const color = getPaletteColor(quickColor.family, quickColor.shade)}
+
+ {/each}
+
+
+
+
+
+
+
+ {activeFamily} shades
+
+
+ {#each activeShades as color, index}
+
+ {/each}
+