docs: record B2 completion

PROJECT_PLAN.md

@@ -26,24 +26,17 @@ Complete the Android/client contract pivot before implementing backend behavior.
 
 ## Beta path — upstream-connected MVP
 
-- [ ] **B2 — Direct gateway connection, authentication, and local-first routing UX**
-  - One logical Hermes gateway profile with optional local URL + required remote fallback URL.
-  - Validate URLs, store bearer/no-auth configuration securely, probe `GET /health`, and use optional `GET /v1/models` auth check.
-  - Automatically prefer the local URL when reachable; immediately fail over to remote when it is not. Re-evaluate on foreground, explicit reconnect, connectivity change, and request failure; never switch a stream mid-flight.
-  - Show active Local/Remote route and clear offline/unauthorized/retry state without logging tokens or silently sending credentials to untrusted LAN hosts.
-  - Verification: deterministic route-selection/retry tests, connection-state tests, and manual unhappy-path walkthrough.
-
 - [ ] **B3 — Direct gateway session contract and durable chat state**
   - Fetch/list/search/select/create sessions through repository contracts after upstream session routes are verified.
   - Restore selected session and protect against duplicate sends / lost drafts.
   - Verification: fake-repository UI tests; direct gateway compatibility checks where available.
 
- - [ ] **B4 — Direct gateway streaming, reconnects, and resilient long-running work**
+- **Queued after B3 — B4: Direct gateway streaming, reconnects, and resilient long-running work**
   - Stream event reducer: final response/token deltas first; tool lifecycle, session events, artifacts, cancel, and reconnect/backoff only where upstream capability is verified.
   - Preserve partial output and make recovery obvious and safe.
   - Verification: deterministic fake stream tests and real direct gateway exercise.
 
-- [ ] **B5 — Tool, artifact, and output experience**
+- **Queued — B5: Tool, artifact, and output experience**
   - Compact tool cards with lifecycle/status, expandable output, copy/share/save affordances.
   - Safe rendering for large logs and code; no unbounded nested scroll failures.
   - Artifact/file handoff only where upstream capability is actually supported.
@@ -51,24 +44,24 @@ Complete the Android/client contract pivot before implementing backend behavior.
 
 ## Beta hardening and release
 
-- [ ] **R1 — Adaptive/accessibility quality pass**
+- **Queued — R1: Adaptive/accessibility quality pass**
   - Small phone, normal phone, tablet/two-pane behavior; portrait/landscape.
   - Font scaling, TalkBack semantics, contrast, touch targets, reduced motion, IME behavior.
   - Verification: emulator/device matrix evidence documented in `docs/ROADMAP.md`.
 
-- [ ] **R2 — Beta packaging and install guide**
+- **Queued — R2: Beta packaging and install guide**
   - Version `v0.1.0-beta.1`, reproducible debug/beta APK build, install/run guide, known limitations.
   - Publish source commit, APK, release notes, and verification result.
   - Verification: clean install on a real device or emulator plus full required checks.
 
 ## V2 backlog
 
-- [ ] Multiple server profiles and fast switching.
-- [ ] Rich file/artifact workflows based on upstream capability.
-- [ ] Notifications for task completion.
-- [ ] Mature tablet/two-pane session + optional terminal/log pane.
-- [ ] Offline cache/search and diagnostic export with privacy controls.
-- [ ] Remove legacy companion Android routes and deprecate `apps/companion` install/runtime docs after direct gateway chat/session/streaming is verified.
+- Multiple server profiles and fast switching.
+- Rich file/artifact workflows based on upstream capability.
+- Notifications for task completion.
+- Mature tablet/two-pane session + optional terminal/log pane.
+- Offline cache/search and diagnostic export with privacy controls.
+- Remove legacy companion Android routes and deprecate `apps/companion` install/runtime docs after direct gateway chat/session/streaming is verified.
 
 ---
 
@@ -76,6 +69,14 @@ Complete the Android/client contract pivot before implementing backend behavior.
 
 _Move finished items here with date, commit, and verification. Keep this section factual; do not claim unverified work._
 
+- [x] **B2 — Direct gateway connection, authentication, and local-first routing UX** — 2026-07-24, commit `e5cc27e` (`feat: add local-first gateway routing`).
+  - Added one logical profile with optional Local HTTPS, required Remote HTTPS, Android-keystore-protected bearer/no-auth configuration, and active Local/Remote diagnostics.
+  - Added bounded redirect-disabled `GET /health` probes followed by bearer-authenticated `GET /v1/models`, deterministic Local preference/Remote fallback, and immutable request leases.
+  - Added foreground, explicit reconnect, connectivity-change, and request-failure re-evaluation hooks; removed Android calls to undocumented legacy companion `/api/*` routes without changing `apps/companion`.
+  - Recorded the upstream stable gateway identity-binding need in `docs/BLOCKERS.md`.
+  - Verification: direct Kotlin/JUnit execution of `ConnectionStateTest` and `GatewayHttpProbeTest` passed 12 tests; `GRADLE_USER_HOME=/root/hermes-mobile/.gradle-user ./gradlew --no-daemon -Pkotlin.compiler.execution.strategy=in-process :app:compileDebugUnitTestKotlin :app:assembleDebug` passed from `apps/mobile/android` with temporary restored sandbox-only Gradle socket shims (37 tasks, 6 executed); `git diff --check` passed.
+  - Unhappy paths verified deterministically: missing/cleartext/credential-bearing/path-bearing/duplicate URLs, missing bearer token, incompatible or offline Local fallback, Remote offline, unauthorized compatibility response, stored legacy HTTP rejection, and failed-route lease invalidation. Device UI walkthrough was attempted but ADB could not start because this sandbox prohibits local control sockets.
+
 - [x] **F0 — Audit and safely land existing work** — 2026-07-24, commit `da79d48` (`feat: land native mobile foundation`).
   - Reviewed existing Android and companion edits; preserved the native Android chat/workspace/settings work and companion chat hardening.
   - Confirmed generated build outputs are ignored and added ignores for `.gradle-user/` and `.dev/`.