update roadmap with completed milestones, trim SANDBOX.md to reference milestone files

docs/ROADMAP.md

@@ -29,11 +29,11 @@ Mosis is a **virtual smartphone OS** for VR games and applications. It provides
 |---|-----------|--------|-------------|
 | 1 | Cross-Platform Kernel | ✅ Complete | Desktop designer with shared kernel code |
 | 2 | Testing Framework | ✅ Complete | Automated UI testing and inspection |
-| 3 | Virtual Hardware | ❌ Not started | Camera, mic, speaker, filesystem APIs |
-| 4 | App Sandboxing | ❌ Not started | Lua/WASM runtime, package format |
+| 3 | Virtual Hardware | ✅ Complete | Camera, mic, speaker, filesystem APIs (via sandbox) |
+| 4 | App Sandboxing | ✅ Complete | Lua runtime, package format, 149 security tests |
 | 5 | WebRTC Bridge | ❌ Not started | Phone-to-phone communication |
 | 6 | System Apps | 🔶 75% | Core phone apps |
-| 7 | Game Integration | ❌ Not started | Unity/Unreal plugin polish |
+| 7 | Game Integration | 🔶 In Progress | Unity/Unreal plugins (Vulkan working) |
 
 ---
 
@@ -101,118 +101,48 @@ Mosis is a **virtual smartphone OS** for VR games and applications. It provides
 
 ---
 
-## Milestone 3: Virtual Hardware ❌ NOT STARTED
+## Milestone 3: Virtual Hardware ✅ COMPLETE
 
 **Goal**: Hardware-like APIs backed by game engine or real devices.
 
-### 3.1 Camera Interface
+Implemented as part of the Lua Sandbox system. See [SANDBOX_MILESTONES.md](SANDBOX_MILESTONES.md) for details.
 
-```cpp
-class ICamera {
-    virtual void RequestFrame(FrameCallback callback) = 0;
-    virtual void SetResolution(int width, int height) = 0;
-    virtual bool IsAvailable() const = 0;
-};
-```
+### Completed Components
 
-**Implementations**:
-- **Game Mode**: Receives texture from Unity/Unreal
-- **Desktop Mode**: System webcam (optional)
-- **Android Test Mode**: SharedTexture from MainActivity
-- **Mock Mode**: Test patterns
-
-### 3.2 Microphone Interface
-
-```cpp
-class IMicrophone {
-    virtual void StartCapture(AudioCallback callback) = 0;
-    virtual void StopCapture() = 0;
-    virtual bool IsAvailable() const = 0;
-};
-```
-
-### 3.3 Speaker Interface
-
-```cpp
-class ISpeaker {
-    virtual void PlayAudio(AudioBuffer buffer) = 0;
-    virtual void SetVolume(float volume) = 0;
-};
-```
-
-### 3.4 Filesystem Interface
-
-```cpp
-class IFileSystem {
-    virtual FileHandle Open(const std::string& path, Mode mode) = 0;
-    virtual std::vector<std::string> List(const std::string& dir) = 0;
-    virtual bool CreateDirectory(const std::string& path) = 0;
-    virtual bool Delete(const std::string& path) = 0;
-};
-```
-
-### 3.5 Network Interface
-
-```cpp
-class INetwork {
-    virtual HttpResponse Fetch(const HttpRequest& request) = 0;
-    virtual WebSocket Connect(const std::string& url) = 0;
-    virtual bool IsOnline() const = 0;
-};
-```
+| Component | Sandbox Milestone | Location |
+|-----------|------------------|----------|
+| Camera | Milestone 11 | `sandbox/camera_interface.cpp` |
+| Microphone | Milestone 12 | `sandbox/microphone_interface.cpp` |
+| Audio Output | Milestone 13 | `sandbox/audio_output.cpp` |
+| Location/GPS | Milestone 14 | `sandbox/location_interface.cpp` |
+| Sensors | Milestone 15 | `sandbox/sensor_interface.cpp` |
+| Bluetooth | Milestone 16 | `sandbox/bluetooth_interface.cpp` |
+| Filesystem | Milestone 7 | `sandbox/virtual_fs.cpp` |
+| Network/HTTP | Milestone 9 | `sandbox/network_manager.cpp` |
+| WebSocket | Milestone 10 | `sandbox/websocket_manager.cpp` |
 
 ---
 
-## Milestone 4: App Sandboxing ❌ NOT STARTED
+## Milestone 4: App Sandboxing ✅ COMPLETE
 
 **Goal**: Secure app runtime with defined package format.
 
-### 4.1 Runtime Decision
+Implemented with 20 sub-milestones covering security, APIs, and hardware interfaces. 149 security tests passing.
 
-| Aspect | Lua | WASM |
-|--------|-----|------|
-| Isolation | Weak | Strong |
-| Performance | Good for UI | Near-native |
-| RmlUi Integration | Native | Needs bridge |
-| Ecosystem | Small | Large |
+See:
+- [SANDBOX_MILESTONES.md](SANDBOX_MILESTONES.md) - Implementation milestones
+- [LUA-SANDBOX.md](LUA-SANDBOX.md) - Security features, permissions, APIs
+- [APP-MANAGEMENT.md](APP-MANAGEMENT.md) - Package format, manifest, lifecycle
 
-**Recommendation**: Hybrid approach
-- Lua for UI scripting (RmlUi integration)
-- WASM for app logic needing isolation (future)
+### Key Features
 
-### 4.2 Package Format (.mpkg)
-
-```
-myapp.mpkg/
-├── manifest.json        # Metadata, permissions, entry
-├── ui/
-│   ├── main.rml
-│   ├── styles.rcss
-│   └── scripts/
-├── assets/
-│   ├── icons/
-│   └── images/
-└── data/
-```
-
-### 4.3 Manifest Schema
-
-```json
-{
-  "id": "com.example.myapp",
-  "name": "My App",
-  "version": "1.0.0",
-  "permissions": ["camera", "network", "storage"],
-  "entry": "ui/main.rml",
-  "icon": "assets/icons/app.png"
-}
-```
-
-### 4.4 App Lifecycle
-
-```
-INSTALLED → LAUNCHING → RUNNING → PAUSED → STOPPED → UNINSTALLED
-```
+- **Lua Runtime**: Isolated `lua_State` per app with dangerous globals removed
+- **Resource Limits**: Memory (16MB), CPU (instruction hooks), timers (100 max)
+- **Permission System**: Normal/Dangerous/Signature categories with user gesture requirements
+- **Virtual Filesystem**: Per-app storage with 50MB quota
+- **SQLite Database**: Per-app with authorizer blocking dangerous operations
+- **Network Security**: HTTPS required, private IP blocking, domain whitelists
+- **Hardware Interfaces**: Camera, mic, location, sensors with mandatory indicators
 
 ---
 
@@ -420,24 +350,22 @@ cmake --build build --config Debug
 
 ---
 
-## Current Sprint: Complete Partial Tasks
+## Current Sprint: Next Steps
 
-### Priority 1: Testing Framework Completion ✅ DONE
-- [x] Action recording (capture interactions to JSON)
-- [x] Action playback (replay with timing)
-- [x] Screenshot diff (visual regression)
-- [x] GLFW input hooks for automatic recording
-
-### Priority 2: Remaining System Apps
+### Priority 1: System Apps Completion
 - [ ] Store app (UI only - browse, install)
-- [ ] Camera app (UI + shared texture from MainActivity)
+- [ ] Camera app (UI + game engine texture)
 - [ ] Music app (UI outline only)
 
-### Priority 3: App Data Persistence
-- [ ] JSON/SQLite storage layer
-- [ ] Contact CRUD operations
-- [ ] Message history
-- [ ] Settings persistence
+### Priority 2: Game Engine Integration
+- [x] MosisUnreal - Vulkan texture import working
+- [ ] MosisUnreal - Blueprint API polish
+- [ ] MosisVR (Unity) - Vulkan backend
+
+### Priority 3: WebRTC Bridge (Milestone 5)
+- [ ] libdatachannel integration
+- [ ] Phone-to-phone communication
+- [ ] Real smartphone bridge app
 
 ---
 
@@ -454,10 +382,11 @@ cmake --build build --config Debug
 
 ### Documentation
 
+All documentation is in `docs/`:
 - `CLAUDE.md` - Development guide
-- `TESTING.md` - Testing framework documentation
+- `SANDBOX_MILESTONES.md` - Sandbox implementation details
 - `ROADMAP.md` - This file
 
 ---
 
-*Last updated: 2026-01-16*
+*Last updated: 2026-01-19*