amadan

carlos / contra Public

← Branches

intent

Tasks 1/25 done

  • DESIGN.md: key hierarchy, wraps, and the sealed schema Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Slice 1: rastrillo instance + client-shape web console Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Signup, passphrase sign-in, print-once recovery codes Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • The merciless greps: canary strings through every write path, SQLite + bucket Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Ledger publish-time screen: check every prompt against local vault-value hashes Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Daemon redaction choke point: scan all daemon-to-agent bytes for injected values Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Agent writes are create-only into quarantined staging; humans promote Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • 1PUX import, parsed and sealed entirely client-side Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Shared vaults: group key wrapped per member, forward rotation on removal Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Agent access: list / use-env / use-http via the local daemon Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Slice 2: native Mac app against the settled contract Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Slice 3: AutoFill Credential Provider extension (macOS) Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Golden vectors: Argon2id, every HKDF label, Crockford normalisation, checksum Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Bucket lifecycle policy: expire superseded object versions after 30 days Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Move the email pepper off the instance (routing layer or KMS) Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Quantise ciphertext sizes into 256-byte buckets Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Serve the web console from a separate static signed origin (SRI, PWA) Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Optional sign-in 2FA gating blob release Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Emergency Kit PDF: client-generated, two separated panels, QR per value, fold line Done operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Fresh-device ladder: handoff from enrolled device (Slopbox link pattern), QR scan, typed entry Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Reprint the kit: Account Key exact from device cache, recovery code regenerated Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Nag to enrol a second device, and to reprint a lost kit while a device remains Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Account Key card PDF: wallet-sized, QR, handle, 'useless without your passphrase' Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Recovery sheet PDF: archival framing, QR, 'never photograph this', where it should live Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local
  • Signup: print-both action, and no way past until both are confirmed Not started operated by paul@keymail.dev session 867323c2 · claude-code/2.1.252 · Pauls-MacBook-Pro.local