chore: record next rpc server slices

docs/current_roadmap.md

@@ -161,6 +161,20 @@ implementation state.
    - Completed: `wf-rpc-server --mcp-config wf_mcp.config.json` starts the
       JSON-RPC transport over an MCP-backed `WorkflowServer`, making the remote
       CLI path usable with MCP sources and desired source registry operations.
+- Next concrete platform slices:
+  - Manual product smoke: run `wf-rpc-server --mcp-config ...`, point
+    `wf --url ...` at it, and capture real CLI/server UX gaps before adding
+    more architecture.
+  - Source registry apply/reload: decide and implement how persisted registry
+    mutations affect the running source catalog. Prefer an explicit
+    apply/reload operation before automatic live remount.
+  - Persisted resume across server restart: prove an interrupted run can be
+    resumed after rebuilding the MCP-backed RPC server from the same stores and
+    pinned source environment.
+  - Auth/source secrets boundary: keep registry desired state separate from
+    upstream credentials, and surface missing auth as validation diagnostics.
+  - Run watch/progress: start with polling over existing inspect/trace APIs;
+    defer SSE/WebSocket/MCP progress until the polling UX is proven insufficient.
 - Cleanup candidate: consolidate store/source registry id validation patterns
       (`SOURCE_REGISTRY_ID_PATTERN`, `STORE_ID_PATTERN`) only after another package
       needs the same rule. Today they intentionally stay close to their stores.

docs/superpowers/specs/2026-06-03-long-lived-workflow-api-boundary.md

@@ -358,6 +358,25 @@ Possible providers:
 This slice should avoid making "source" mean "MCP connection." MCP is one
 source provider, not the source model.
 
+Current MCP-backed server status:
+
+- MCP-backed `WorkflowServer` construction is implemented.
+- `wf-rpc-server --mcp-config <path>` can serve JSON-RPC over that server.
+- Source registry read/mutation APIs are reachable remotely when the target
+  exposes `source_registry_admin`.
+
+Next implementation slices should be:
+
+1. Manual product smoke with the real CLI/server commands. Record UX/runtime
+   gaps before broadening architecture.
+2. Source registry apply/reload semantics. Registry mutation currently updates
+   desired persisted state; the next explicit decision is whether changes apply
+   only after restart, through an explicit reload/apply operation, or through
+   automatic live reconciliation. Prefer explicit reload/apply for v1.
+3. Persisted resume across server restart. Rebuild the MCP-backed RPC server
+   from the same stores and prove interrupted runs resume from the stored
+   checkpoint and pinned dependency environment.
+
 ### Slice 6: Auth and Tenancy
 
 Define who can read/write artifacts, deployments, runs, and auth records.