From 6ac40d2e15008a43c62dfa7ba8bec51ed747c27b Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Fri, 31 Jul 2026 17:35:06 -0400
Subject: [PATCH] TODO: the versioning constraint now describes what shipped

The intro still said entries carry no algorithm version, which stopped being
true when gen_version landed. Restates the rule in its permanent form -- never
alter the output of a version already in the wild -- rather than as a
description of a gap that is now closed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HtNMsKzzFTPURemX7tT19u
---
 TODO.md | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/TODO.md b/TODO.md
index e83c7789..d5196baf 100644
--- a/TODO.md
+++ b/TODO.md
@@ -10,9 +10,11 @@ uses `os.urandom` / `secrets`, and the `random` module is not imported anywhere
 
 **Read the compatibility constraint in that document before touching
 `core/password_generation.py`.** Passwords are never stored — they are re-derived on demand from
-`(seed, index, length, policy)`, and entries carry no algorithm version. Any change to
-`generate_password` silently changes every existing password in every vault, unrecoverably. All
-fixes land behind a new `gen_version` field; v1 output must stay byte-identical.
+`(seed, index, length, policy, gen_version)`. Entries now carry `gen_version`, and an absent field
+means v1. **The rule is permanent: never alter the output of a version that already exists in the
+wild.** v1 is frozen; a fix that changes derivation goes into a new version, never into an old one.
+`src/tests/test_entropy_integrity.py` enforces this with 18 v1 vectors — a failure there is never
+"update the expected value".
 
 - [x] **M4 (done)** — v1 password vectors frozen, plus fail-closed RNG tests, in
       `src/tests/test_entropy_integrity.py` (26 tests, inside the `--determinism-only` CI gate).