docs(roadmap): define standalone Apple v0.2 architecture

[tcballard]

Summary

Implements WF-ROADMAP-0016 Phase 0 documentation.

Adds:

• the standalone native iPhone/iPad product and optional-pairing decision;
• the shared Rust routing-core and generated Apple bridge boundary;
• the provider, OAuth, Keychain, Apple Foundation Models, and execution-boundary design;
• the v0.2.0/v0.2.1 roadmap, Apple-platform capability matrix, and Kimi qualification;
• supersession links across the current macOS, Rust, Apple, ChatGPT, and historical v0.2 documents.

Scope

Included

• WF-ADR-0047: mobile independence and pairing-as-provider
• WF-ADR-0048: one pure Rust routing truth embedded on mobile
• WF-DESIGN-0019: typed authentication, provider, credential, and privacy contracts
• WF-ROADMAP-0016: phased v0.2.0 standalone release and v0.2.1 pairing sequence
• WF-QUAL-0001: Kimi account auth blocked pending provider approval
• iOS/iPadOS 18 deployment floor with separately gated Foundation Models support
• explicit stacked-PR relationship to the Rust-only cutover in feat(runtime): make Rust the sole Wayfinder runtime #114

Excluded

• Rust crate extraction or FFI implementation
• Xcode project/app shell
• Keychain, provider, OAuth, persistence, or Apple model code
• Kimi account authentication
• Mac pairing protocol or transport
• changes to macOS routing, credential brokers, ChatGPT/Codex, or Automatic defaults

Product / Architecture Decisions

• iPhone and iPad are independently useful products; no Mac or localhost gateway is required.
• A paired Mac is an optional provider and cannot own mobile threads, settings, credentials, or identity.
• Rust remains the sole routing authority; Swift never reimplements scoring, thresholds, exclusions, tie-breaks, or receipts.
• Mobile embeds an extracted pure routing core through generated bindings.
• iOS provider execution placement remains a measured Phase 0 choice between portable Rust HTTP and Swift URLSession.
• UniFFI is evaluated before a narrow generated C ABI.
• SwiftData versus SQLite remains a measured persistence choice.
• Provider executable logic is built in and reviewed; metadata cannot add code or auth behavior.
• Secrets are device-only Keychain data by default.
• OpenAI Platform and ChatGPT/Codex remain distinct; native iOS does not import or recreate the desktop helper.
• Kimi account auth is blocked until a permitted third-party client and execution contract is documented or approved.

User-Facing Contract

CLI

No CLI behavior changes.

Human Output

Defines the future mobile information architecture, onboarding choices, destination grouping, privacy postures, and compact route-receipt wording. No shipping UI changes in this PR.

JSON Output

No runtime JSON changes. JSON remains the shared golden-fixture/debug format rather than the broad FFI runtime.

Exit Codes

No exit-code changes.

Verification

Ran

git diff --check
git diff --cached --check
node -e '<changed-Markdown relative-link checker>'
rg -n '^id: WF-' decisions designs roadmaps docs
rg -n -i 'ios.*companion|companion.*ios|iphone.*requires.*mac|mobile.*requires.*mac' \
  README.md macos/README.md rust/README.md decisions designs roadmaps docs

The link checker inspected all 18 changed Markdown files; relative links resolve. Document IDs are unique. Every changed path is Markdown.

Primary contracts were checked against:

• Apple Foundation Models and SystemLanguageModel availability documentation;
• Apple ASWebAuthenticationSession;
• RFC 7636 PKCE and RFC 8628 device authorization;
• Kimi Code's documented kimi login flow, membership guidance, and official repository.

Covered

• standalone versus paired product ownership
• on-device, local-network, and hosted execution truth
• On-Device Only fail-closed behavior
• Mac-local versus cloud-via-Mac labelling
• API key, authorization-code, device-code, desktop-runtime, and paired-host auth classes
• ChatGPT/OpenAI separation
• Kimi third-party authorization uncertainty
• bridge, provider-execution, and persistence decision gates
• old LibreChat v0.2 roadmap supersession
• current macOS and Rust source-of-truth links

Review Path

1. decisions/WF-ADR-0047-native-mobile-independence.md
2. decisions/WF-ADR-0048-shared-routing-core-apple-embedding.md
3. designs/WF-DESIGN-0019-mobile-providers-accounts-and-credentials.md
4. roadmaps/WF-ROADMAP-0016-native-mobile-v0.2.md
5. capability matrix and Kimi qualification
6. supersession amendments in existing macOS/Rust documents

Notes For Reviewer

• This is intentionally stacked on codex/rust-only-cutover / feat(runtime): make Rust the sole Wayfinder runtime #114 so the mobile architecture describes the accepted Rust-only repository rather than the superseded coexistence state. Retarget to main after feat(runtime): make Rust the sole Wayfinder runtime #114 merges.
• This PR is documentation only, matching the first required PR boundary.
• Phase 1 must be routing-core extraction only. It must not include UI, providers, OAuth, Apple model execution, or pairing.