From 522d81ec56fad80e31e657756a7784eab074bac9 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Tue, 11 Aug 2026 23:28:59 -0400
Subject: [PATCH] docs: record design-review note (assurance bar before
 promotion)

Outside review flagged BitLogin as highest-upside/highest-risk. Record the
guidance: external cryptographic review as a gate before 'use for real'
positioning; keep copy off impossibility claims; hold the passphrase-entropy
and Argon2id/AES-GCM choices.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BXQCvJPA6sVSQ5j8uBd9bB
---
 docs/TODO.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/docs/TODO.md b/docs/TODO.md
index 44f279b..d2f8ffe 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -434,3 +434,22 @@ how much they cost.
   (`BitLoginLoginEventDetail` etc. + `BitLoginEventMap`) in `src/events.ts`.
   Verified with a consumer conformance typecheck; README "TypeScript" section
   added.
+
+## Design review — external critique (2026-08-11)
+
+From an outside review of the BitBlocks stack. BitLogin was called the highest
+upside AND highest risk in the stack.
+
+- **[agree] Highest assurance bar.** A BitLogin failure is identity compromise,
+  not "the feed looked weird." Keep promotion conservative and the
+  alpha/unaudited labeling prominent until an outside cryptographic/security
+  review. Treat an external audit as a **gate** before any "use this for real"
+  positioning — this is the one block where marketing must trail assurance.
+- **[agree] No impossibility claims in copy.** Relay retention is best-effort;
+  our own docs already say to keep the recovery export. Keep the site's language
+  on "portable / no single operator controls," never "cannot be deleted." (See
+  the umbrella claim-precision note.)
+- The choices the review praised — high-entropy passphrase (not raw human
+  passwords), Argon2id + AES-256-GCM, `window.nostr` compatibility so Nostr
+  "disappears into the background" — are the right ones. Hold that line; don't
+  soften the passphrase-entropy stance for UX.