docs(project): record cloud control plane maturity

README.md

@@ -23,6 +23,10 @@ contracts.
 - `storage/`: timeline, task, and device configuration persistence.
 - `packages/cloud-platform/`: cloud scheduling, device pooling, plugins, and
   the Python cloud SDK as the `device-cloud-platform` workspace member.
+- `apps/cloud-api/`: deployable authenticated Cloud Control Plane with
+  PostgreSQL/SQLite persistence, scheduling, leases, and health endpoints.
+- `apps/device-host-agent/`: outbound Host Agent that synchronizes configured
+  devices and executes leased tasks through the existing Runtime/workflow.
 
 ## Python Workspace
 
@@ -44,6 +48,8 @@ Select one member when running package-specific commands:
 ```bash
 uv run --package device-agent-runtime python -c "import runtime"
 uv run --package device-cloud-platform python -c "import cloud"
+uv run --package device-cloud-api device-cloud-api --help
+uv run --package device-host-agent device-host-agent --help
 uv build --package device-agent-runtime
 uv build --package device-cloud-platform
 ```

docs/ROADMAP.md

@@ -83,8 +83,12 @@ execution across many devices.
 The packaging baseline is complete: `device-agent-runtime` remains the root uv
 workspace member, while the existing `cloud` modules and SDK are published by
 the one-way dependent `device-cloud-platform` member under
-`packages/cloud-platform`. A deployable control plane and Host Agent execution
-loop remain separate follow-up work.
+`packages/cloud-platform`. The deployable `apps/cloud-api` control plane and
+outbound `apps/device-host-agent` execution loop are implemented with scoped
+authentication, lease-backed scheduling, PostgreSQL/SQLite persistence,
+restart recovery, health checks, and public SDK status reporting. The supported
+deployment remains one scheduler-enabled control-plane process and provides
+at-least-once device-side-effect semantics.
 
 ## Long-Term Direction
 

openspec/changes/cloud-control-plane-integration/tasks.md

@@ -75,4 +75,4 @@
 - [x] 9.2 Run an end-to-end cloud submission through a Host Agent and fake device until the public SDK reports done and a failure case until it reports failed.
 - [x] 9.3 Verify existing local REST/MCP/console behavior and dependency-boundary tests remain unchanged.
 - [x] 9.4 Run OpenSpec validation for `cloud-control-plane-integration` and map automated tests to every new or modified scenario.
-- [ ] 9.5 Update the project index, architecture/deployment documentation, and runtime maturity memory after implementation verification.
+- [x] 9.5 Update the project index, architecture/deployment documentation, and runtime maturity memory after implementation verification.