tasks: decompose Phase 0b spec documents and Phase 0c review

Add 15 new tasks under tasks/architecture/ for Phase 0b (spec writing)
and Phase 0c (review):

Phase 0b — New specs (6):
  - spec-configuration: promote from research, cleanup, align with ADRs
  - spec-identity: carry from auth.md + services.md, canonical Identity
  - spec-secret-service: from research/services.md SecretProtocol
  - spec-storage: from research/storage.md, contract-level
  - spec-flowgraph: from research/flow.md, pure computation crate
  - spec-interface: new Layer 2 spec (highest risk new spec)
  - spec-services: irpc service layer + OperationEnv (broadest scope)

Phase 0b — Spec updates (6):
  - spec-update-overview: add crate structure, Layer 3, services
  - spec-update-auth: IdentityProvider vs AuthService relationship
  - spec-update-call-protocol: OperationEnv dispatch paths
  - spec-update-server: DynamicConfig, ForwardingPolicy, IdentityProvider
  - spec-update-napi: reload API, call protocol references
  - spec-update-open-questions: resolve OQs per ADR decisions

Phase 0b — Assembly (1):
  - spec-update-readme: add new docs and ADRs to tables

Phase 0c — Review (1):
  - review-spec-foundation: validate consistency checklist

Generation structure (6 total):
  Gen 1: 6 independent ADRs (parallel)
  Gen 2: adr-027, adr-028 (depend on adr-029)
  Gen 3: adr-033 + 6 spec docs + open-questions update (parallel)
  Gen 4: adr review + interface/services specs + 4 spec updates
  Gen 5: call-protocol update + readme update
  Gen 6: spec review

tasks/architecture/spec-update-open-questions.md

@@ -0,0 +1,58 @@
+---
+id: architecture/spec-update-open-questions
+name: Update open-questions.md — resolve questions per ADR decisions
+status: pending
+depends_on:
+  - architecture/adr-031-forwarding-policy
+  - architecture/adr-029-identity-core-type
+  - architecture/adr-028-auth-irpc-service
+  - architecture/adr-030-static-dynamic-config-split
+scope: narrow
+risk: low
+impact: component
+level: implementation
+---
+
+## Description
+
+Update `docs/architecture/open-questions.md` to record resolutions for the open questions that the new ADRs address.
+
+**Questions to resolve**:
+- **OQ-12** (Per-user forwarding scope vs global rules): Resolved per ADR-031 — start with global rules + principal matching. Per-user scope from peer_credentials.metadata.scopes via IdentityProvider.
+- **OQ-16** (Transport-specific forwarding policy): Resolved per ADR-031 — add TransportKind match in ForwardingRule. WebTransport clients can be restricted to alknet-* channels.
+- **OQ-18** (Source of Identity.scopes): Resolved per ADR-029 and ADR-031 — IdentityProvider owns scopes, ForwardingPolicy uses scopes from Identity.
+- **OQ-22** (Client streaming in call protocol): Resolved per integration plan — defer. Current model (single request, optional streaming response) covers all identified use cases.
+- **New** (irpc dependency: always or feature flag?): Resolved per ADR-027 — feature flag. Nodes that only do SSH tunneling don't need the service layer.
+- **New** (DNS control channel scope): Resolved per ADR-026 — call protocol frames only (no SSH over DNS).
+- **New** (alknet-storage and alknet-secret irpc dependency): Resolved per ADR-027 — independently.
+
+**Questions that remain open** (deferred):
+- **OQ-15** (TLS + WebTransport + iroh QUIC coexistence): Deferred to Phase 4 per integration plan.
+- **OQ-19** (Separate TLS identity for WebTransport): Deferred to Phase 4.
+- **OQ-20** (Worker registration and discovery): Still open per integration plan. Register on connect, cleanup on disconnect is the leading approach but needs spec in call-protocol.md.
+
+## Acceptance Criteria
+
+- [ ] OQ-12 marked as resolved with ADR-031 reference
+- [ ] OQ-16 marked as resolved with ADR-031 reference
+- [ ] OQ-18 marked as resolved with ADR-029/ADR-031 reference
+- [ ] OQ-22 marked as resolved (deferred) with note
+- [ ] New OQ (irpc feature flag) added and resolved with ADR-027 reference
+- [ ] New OQ (DNS control channel scope) added and resolved with ADR-026 reference
+- [ ] New OQ (storage/secret irpc dep) added and resolved with ADR-027 reference
+- [ ] OQ-15, OQ-19, OQ-20 remain open with notes on deferral
+- [ ] `last_updated` in YAML frontmatter updated
+- [ ] Format consistent with existing resolved entries (strikethrough priority, ADR reference)
+
+## References
+
+- docs/architecture/open-questions.md — current content
+- docs/research/integration-plan.md — "Open Questions to Resolve Before Phase 1" section
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion