docs(coordination): v0.9.0 dev resume prompts after ~21h stall (D merged; A/B/C/E resume)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013Hc6Rvdz3DxLucqNtPE2iP

docs/superpowers/coordination/v0.9.0-dev-d-resume.md

@@ -0,0 +1,45 @@
+# Dev D — RESUME Prompt (v0.9.0 keyfile MINORS follow-up)
+
+Paste everything below the `---` into a **fresh** Claude Code terminal.
+
+---
+
+You are **RESUMING** the Dev-D keyfile stream for v0.9.0 — but your 5 plan tasks are **already MERGED to main** (`d649203`, two-review-clean). Your only remaining job is a small **minors follow-up** flagged by the merge-time security review, on a fresh branch off current main.
+
+## Resume setup
+
+```bash
+cd /home/alee/Sources/relicario
+git fetch origin
+git checkout main
+git pull                  # main should be at d649203 (your keyfile core/cli/wasm is here)
+git log --oneline -4      # confirm the keyfile merge (588495f) is present
+git worktree add /home/alee/Sources/relicario.v0.9.0-dev-d-minors -b fix/v0.9.0-keyfile-minors
+cd /home/alee/Sources/relicario.v0.9.0-dev-d-minors
+pwd                       # must print /home/alee/Sources/relicario.v0.9.0-dev-d-minors
+```
+
+(Your ORIGINAL worktree `/home/alee/Sources/relicario.v0.9.0-dev-d` still holds your merged branch — leave it.) Every subagent prompt MUST start with `cd /home/alee/Sources/relicario.v0.9.0-dev-d-minors`.
+
+## Read for full context
+
+- `docs/superpowers/coordination/v0.9.0-dev-d-prompt.md` — ORIGINAL prompt (ROLE, RELAY, STATUS formats). **IGNORE its Setup block and its 5 tasks — they're merged.**
+- Your merged code: `crates/relicario-core/src/keyfile.rs`, `crates/relicario-cli/src/{session.rs,commands/{init,backup,recovery_qr}.rs}`, `crates/relicario-cli/tests/keyfile_flows.rs`, `crates/relicario-wasm/src/lib.rs`.
+
+Relay up on `localhost:7331` (shim: `cd /home/alee/Sources/relicario/tools/relay && python3 call.py read_messages '{"for":"dev-d"}'`). PM is live.
+
+## YOUR WORK — the 3 minors (security-review findings, all non-blocking, now to be closed before the v0.9.0 tag)
+
+1. **Zeroize `keyfile_encode` output** — `crates/relicario-core/src/keyfile.rs`: `keyfile_encode` returns a plain `Vec<u8>` whose base64'd secret lands in non-zeroized heap. Return `Zeroizing<Vec<u8>>` (derefs fine for `fs::write`). One-liner, for Zeroizing-discipline consistency. Update callers + the WASM binding if the type change ripples.
+2. **Test the backup keyfile-vault error** — add a `keyfile_flows` case asserting `backup --include-image` on a key-file vault fails with the clear actionable message (currently correct but untested).
+3. **Integration test: malformed vs wrong** — add a test locking the two distinct paths: a malformed key file → `invalid_key_file` error; a well-formed-but-wrong secret → the opaque `decryption failed` AEAD error (no which-factor oracle).
+
+**Optional (defer if it grows): `backup --include-keyfile`** — a sibling to `--include-image` that bundles the `.relkey` into a backup. Flagged as a fast-follow; only do it if quick, else leave it for a later lift and note so.
+
+## Validation + ship
+
+`cargo test -p relicario-core -p relicario-cli`, `cargo clippy --all-targets -- -D warnings`, `cd /home/alee/Sources/relicario.v0.9.0-dev-d-minors/extension && npm run build:all` (the Zeroizing change touches a WASM-exported fn — type-check it). Simplify pass. Then `git push -u origin fix/v0.9.0-keyfile-minors` and post `Status: REVIEW-READY`. The PM merges it before the tag.
+
+## First action
+
+After setup, `read_messages(for="dev-d")` for my resume directive, post a `## STATUS UPDATE` (`Status: IN-PROGRESS`, `Task: keyfile-minors`) confirming the minors branch is up, then knock out the 3 minors via `superpowers:subagent-driven-development` (or directly — they're small).