v0,28,2

ROADMAP.md

@@ -1,5 +1,17 @@
 # RustProxy roadmap
 
+## 0.28.2 - External certificate hardening and least-privilege reload API
+
+Current direction: 0.28.1 -> 0.28.2
+
+- [x] Accept POSIX ACL-based read access for external certificate keys without requiring one exact chmod value.
+- [x] Reject unsafe world-readable private keys, group/world-writable external PEMs and untrusted/writable external-path parent directories.
+- [x] Validate both configured Certbot `live/` paths and their resolved `archive/` targets while keeping hot reload behavior.
+- [x] Scope Certificate API credentials to explicit certificate IDs, default new tokens to reload-only, block global reload for tokens and make deploy an explicit permission.
+- [x] Migrate existing Certificate API credentials to reload-only compatibility grants and move SQLite to schema 9.
+- [x] Document read-only systemd access plus POSIX ACL examples for `/etc/letsencrypt` and `/etc/ssl` in English and Polish.
+- [x] Keep the saved proxy configuration format and COLD format 3 unchanged.
+
 ## 0.28.1 - External certificate paths and certificate-source clarity
 
 Current direction: 0.28.0 -> 0.28.1