MVP scope

The MVP target is the smallest secure, operational, single-organization vault that works end to end through the tv CLI. For definitions of core concepts referenced throughout this scope, see Glossary.

Included

• Revocable email/password sessions with secure local credential storage.
• One organization with global_admin, admin, and user roles.
• Users, user-owned groups with invitations and roles, Root Folders, controlled custom metadata, and account invitations.
• Private object storage with short-lived operation-scoped authorization.
• Stable logical file IDs and immutable content versions.
• Separate immutable metadata revision history.
• Search by Root Folder, owner, filename, MIME type, dates, and exact custom metadata.
• Access-filtered results and file- or Root Folder-scoped grants.
• Reversible archive and restore instead of permanent deletion.
• Append-only security and transaction audit events.
• Human-readable CLI output plus stable --json automation output.
• Local Claude Code and Codex skill installation plus ChatGPT command-guidance export.
• Signed, standalone CLI artifacts with verified atomic updates and one-version rollback.
• A landing page, login page, and minimal authenticated account state.

Explicitly excluded

• A supported public API, API keys, service accounts, or SDKs.
• A desktop, mobile, or full web file-management client.
• Multi-organization tenancy, public links, or anonymous file access.
• Folder synchronization, mounted drives, offline mode, previews, OCR, or content indexing.
• General policy expressions, deny rules, and nested groups.
• File and Root Folder ownership transfer (group ownership transfer is supported).
• Permanent purge, retention automation, legal hold, or collaborative editing.
• MFA, SSO, SCIM, billing, quotas, analytics dashboards, and notifications.
• Hosted agent connectors, plugins, MCP servers, or direct cloud-to-vault execution.

Release boundary

The MVP is not complete merely when commands exist. It must demonstrate private storage, access-filtered discovery, immutable history, safe failure recovery, auditability, cross-platform installation, verified updates, rollback, and a non-production end-to-end flow involving at least two users.

The detailed acceptance criteria remain in the root PRD. See Current state for exactly which of the items above are still planned rather than shipped (the standalone release publication is the one "Included" item not yet shipped — implemented and tested, but blocked on operator actions).