From dd60eabbcf355f7766d53bc4954a9543e3f813f5 Mon Sep 17 00:00:00 2001 From: thePR0M3TH3AN Date: Wed, 19 Aug 2026 11:19:09 -0400 Subject: [PATCH] docs: bring the cutover gate list back in line with what is actually ported MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Gate 5 still listed api, semantic, QR and index0 as exclusions, and the non-gates section still said TS "deliberately does not emit" index0 — all untrue as of today. Two exclusions remain, both choices rather than unfinished work: PGP RSA (not reproducible, so refusing beats diverging) and the Textual TUIs. Also marks the 2026-08-17 self-review blocker as done — all ten findings are closed, as are all seven from the 2026-08-18 audit — and notes that transport is no longer a blocker for the browser extension now that the API exists, leaving only the design question of whether an extension should talk to the API over loopback or embed the core. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN --- TODO.md | 12 +++++++++--- docs/typescript_cutover_plan.md | 34 +++++++++++++++++---------------- 2 files changed, 27 insertions(+), 19 deletions(-) diff --git a/TODO.md b/TODO.md index 96d7b71f..e92bf26e 100644 --- a/TODO.md +++ b/TODO.md @@ -149,9 +149,11 @@ everything still open, in the order it should be tackled. `js/packages/core/src/crypto`, `js/packages/core/src/derive`, and `js/packages/cli/src/agent.ts` first: a derivation bug does not throw, it quietly produces a secret that cannot be recovered. Blocks the merge below. -- [ ] **Fix the findings from the 2026-08-17 self-review** (next section). Do - these before handing the branch to an outside reviewer so their time goes - on what an author cannot see. +- [x] **(done 2026-08-17/18) Fix the findings from the 2026-08-17 + self-review** (next section) — all ten closed, plus all seven findings + from the 2026-08-18 independent audit (`js/SECURITY_AUDIT.md`). The + branch is ready to hand to an outside reviewer: their time now goes on + what an author cannot see. ### Findings from the 2026-08-17 self-review @@ -522,6 +524,10 @@ writes it (asserted by a test that scans every file in the app directory). started — `js/packages/` holds `core`, `cli` and `test-vectors` only. The branch is named for a web extension that does not exist yet; the CLI was the proving ground for the core. + **Transport is no longer a blocker for this:** the API is ported, so an + extension has something to talk to. The remaining question is whether a + browser should reach the API over loopback at all, or whether the + extension should embed the core directly — decide before starting M7. - [x] **(done 2026-08-19) The `api` surface is ported.** `seedpass-js api start` serves /api/v1 on `node:http` with no framework — the CLI ships one audited bundle with an empty production dependency list, and a web diff --git a/docs/typescript_cutover_plan.md b/docs/typescript_cutover_plan.md index 1aebaf98..ad18c061 100644 --- a/docs/typescript_cutover_plan.md +++ b/docs/typescript_cutover_plan.md @@ -17,7 +17,7 @@ P0 gate is green, Python remains the normative reference | Cross-implementation profile interop | green | | Sync protocol parity | green | | Agent security model | green (TS ahead of Python) | -| Feature parity for daily use | green for daily use; scoped exclusions below | +| Feature parity for daily use | green; two named exclusions below | | Interactive mode (TUI) | green — legacy (v1) menu tree ported | | Packaging + release | green | | Migration + rollback story | green | @@ -53,24 +53,25 @@ evidence for treating that as load-bearing rather than optional. in cross-impl phase F: Python publishes a snapshot through a real relay and the TS CLI restores it with secrets intact. **Green.** -5. **Feature parity for real daily use.** **Green for daily use**, with - scoped exclusions that are documented rather than hidden: +5. **Feature parity for real daily use.** **Green**, with two remaining + exclusions, both of which are choices rather than gaps in effort: - **PGP RSA keys** — unsupported by design. PyCryptodome's seeded prime search is not reproducible, so TS refuses the key type instead of deriving a different key. ed25519 PGP is at byte-for-byte parity. - - **`semantic`** (local vector search) — a derived index that can be - rebuilt; plan §8.5 rates it P2. - - **`api`** (FastAPI server) — a separate surface, not vault behavior. - - **TUI v2/v3** — interactive mode ports the legacy (v1) menu tree only. - - **QR display in the TUI** — no QR encoder in this build; the menu item - remains and offers the underlying value instead. + - **TUI v2/v3** — interactive mode ports the legacy (v1) menu tree only; + see `docs/tui_v2_cutover_decision.md`. - **Script checksum verify/generate** — covers the Python source tree; replaced by the release bundle's `.sha256`. - Recommendation: none of these blocks cutover. Each is a bounded, - named gap with the Python implementation still available for it, and the - migration guide tells users exactly that. Revisit if a real profile is - found to depend on RSA PGP entries. + Closed since this list was written (2026-08-19): the `api` surface, the + `semantic` retrieval index, QR display in the TUI, `index0`/atlas, agent + high-risk partitions, approval gates, job profiles and recovery split. + Every Python API endpoint now has a TypeScript equivalent. + + Recommendation: neither remaining exclusion blocks cutover. Both are + bounded and named, with the Python implementation still available, and the + migration guide says so. Revisit if a real profile is found to depend on + RSA PGP entries. Everything else is ported and cross-verified: all nine entry kinds, create/modify/archive/links, document import/export, both key @@ -102,9 +103,10 @@ evidence for treating that as load-bearing rather than optional. - Web app, browser extension, desktop app — these are new surfaces, not parity requirements. -- `_system.index0` / atlas content merge — Python-derived state, recomputed - on load; TS deliberately does not emit it and refuses to merge populated - index0 rather than corrupt it. +- ~~`_system.index0` / atlas content merge~~ — **ported 2026-08-19.** TS now + emits events on every mutation, rebuilds checkpoints and canonical views, + and merges both sides deterministically, with hashes byte-identical to + Python's. No longer a non-gate; it is covered by gate 5. - TUI v2/v3 — not ported. Interactive mode (`seedpass-js` with no subcommand) reproduces the **legacy v1** menu tree instead: the same eight main-menu items, nine entry types, eighteen settings under the same