docs: finalize roadmap completion (#26)

README.md

@@ -38,6 +38,10 @@ If a change adds or updates dependencies, Actions, bundled binaries, or model ar
 If a change affects build, packaging, release, updater, bundled assets, or target-OS behavior, keep it aligned with the mandatory Windows and macOS build policy.
 If GitHub-specific execution is required and no repo exists yet, treat that as bootstrap work rather than a default blocker.
 
+## Current Status
+
+The core implementation backlog (Issue #26) has been successfully completed. BandScope now features a functioning local-first workflow, including audio intake, Python-based offline analysis, section/role extraction, manual user overrides, and CSV/JSON cue-sheet exports. The repository maintains 100% measured test coverage and 100% measured docstring coverage for the `services/analysis-engine` package and `apps/desktop` frontend components. TODO: Expand CI coverage threshold enforcement to all future sub-packages.
+
 ## Workspace layout
 
 - `apps/desktop` - Tauri + React desktop shell

docs/plans/2026-03-27-bandscope-roadmap-completion.md

@@ -0,0 +1,70 @@
+# BandScope Roadmap Completion (Issue #26)
+
+## Purpose
+
+This document records the completion of the "BandScope 구현 백로그: 기초 -> 고급 MECE 분해" roadmap defined in Issue #26.
+It summarizes the implementation phases that successfully elevated BandScope from an initial harness skeleton to a fully functional rehearsal-analysis product.
+
+## Completed Milestones
+
+1. **Shared Domain Contracts (#29)**
+   - Defined the core `song -> section -> role` domain model.
+   - Introduced the JSON-based IPC contract ensuring strict bounded contexts between the React UI and the Python engine.
+
+2. **Cross-Architecture Builds (#38)**
+   - Enabled robust Windows/macOS `arm64` and `amd64` packaging to adhere to cross-platform security and distribution policies.
+
+3. **Python Quality Gates (#40)**
+   - Enforced 100% test coverage and 100% docstring coverage for the Python analysis engine.
+
+4. **Local Analysis Orchestration & Audio Intake (#32, #33)**
+   - Implemented secure, local-first file intake.
+   - Built a subprocess orchestrator with zero network dependency to manage `bandscope-cli`.
+
+5. **Role, Section, and Cue Extraction (#35, #34, #31)**
+   - Engineered pipelines to parse section boundaries, extract specific instrument/vocal roles, and detect overlapping sections.
+   - Designed heuristic confidence metrics and ranges for each parsed role.
+
+6. **Rehearsal Workspace UI & Manual Overrides (#28, #27)**
+   - Delivered a "practical band mate" experience.
+   - Implemented manual overrides allowing users to fix automated analysis.
+   - Preserved `model-generated` vs. `user-confirmed` provenance.
+
+7. **Export & Workflow Support (#36, #30)**
+   - Added CSV (cue-sheet) and JSON (chart) export features.
+   - Implemented policy-constrained YouTube import with local audio fallback prompts, strictly avoiding bypass behavior.
+
+## Current State & Next Steps
+
+With the completion of these epics, the BandScope repository represents a robust, local-first desktop application with comprehensive test coverage, strict type checks, and secure IPC boundaries.
+
+Future work will transition from foundational pipeline engineering to:
+- Tuning analysis heuristics.
+- Expanding instrument-specific features (e.g., precise capo/tuning detection).
+- Enhancing playback and waveform visualization capabilities.
+
+## Security Notes
+
+### Attack Surface
+- Minimal footprint; the primary interface handles untrusted user-supplied local audio files and structured JSON IPC messaging.
+- Secondary footprint via policy-constrained YouTube metadata fetch endpoints.
+
+### Trust Boundary
+- Local IPC socket acts as a trust boundary between the React UI (untrusted) and the Python analysis engine (trusted).
+- Audio inputs from external sources are considered untrusted.
+
+### Mitigations
+- Strict schema validation for all IPC messages.
+- Subprocesses executed with `shell=False` to prevent injection.
+- Zero network dependency for core analysis workflows.
+
+### Test Points
+- 100% test coverage enforced on all analysis pipelines and orchestrator boundaries.
+- Negative tests for malformed JSON and corrupted audio inputs.
+
+### Realistic Threats
+- Maliciously crafted audio files triggering buffer overflows in underlying parsing libraries.
+- Privilege escalation via IPC injection (mitigated by strict schema).
+
+### Remaining Risk
+- Third-party library vulnerabilities in complex dependencies (e.g., ffmpeg or ML parsers), tracked via SBOM and dependency reviews.