relicario/docs/superpowers/coordination/v0.9.0-dev-d-resume.md

Dev D — RESUME Prompt (v0.9.0 keyfile MINORS follow-up)

Paste everything below the --- into a fresh Claude Code terminal.

---

You are RESUMING the Dev-D keyfile stream for v0.9.0 — but your 5 plan tasks are already MERGED to main (d649203, two-review-clean). Your only remaining job is a small minors follow-up flagged by the merge-time security review, on a fresh branch off current main.

Resume setup

cd /home/alee/Sources/relicario
git fetch origin
git checkout main
git pull                  # main should be at d649203 (your keyfile core/cli/wasm is here)
git log --oneline -4      # confirm the keyfile merge (588495f) is present
git worktree add /home/alee/Sources/relicario.v0.9.0-dev-d-minors -b fix/v0.9.0-keyfile-minors
cd /home/alee/Sources/relicario.v0.9.0-dev-d-minors
pwd                       # must print /home/alee/Sources/relicario.v0.9.0-dev-d-minors

(Your ORIGINAL worktree /home/alee/Sources/relicario.v0.9.0-dev-d still holds your merged branch — leave it.) Every subagent prompt MUST start with cd /home/alee/Sources/relicario.v0.9.0-dev-d-minors.

Read for full context

• docs/superpowers/coordination/v0.9.0-dev-d-prompt.md — ORIGINAL prompt (ROLE, RELAY, STATUS formats). IGNORE its Setup block and its 5 tasks — they're merged.
• Your merged code: crates/relicario-core/src/keyfile.rs, crates/relicario-cli/src/{session.rs,commands/{init,backup,recovery_qr}.rs}, crates/relicario-cli/tests/keyfile_flows.rs, crates/relicario-wasm/src/lib.rs.

Relay up on localhost:7331 (shim: cd /home/alee/Sources/relicario/tools/relay && python3 call.py read_messages '{"for":"dev-d"}'). PM is live.

YOUR WORK — the 3 minors (security-review findings, all non-blocking, now to be closed before the v0.9.0 tag)

1. Zeroize keyfile_encode output — crates/relicario-core/src/keyfile.rs: keyfile_encode returns a plain Vec<u8> whose base64'd secret lands in non-zeroized heap. Return Zeroizing<Vec<u8>> (derefs fine for fs::write). One-liner, for Zeroizing-discipline consistency. Update callers + the WASM binding if the type change ripples.
2. Test the backup keyfile-vault error — add a keyfile_flows case asserting backup --include-image on a key-file vault fails with the clear actionable message (currently correct but untested).
3. Integration test: malformed vs wrong — add a test locking the two distinct paths: a malformed key file → invalid_key_file error; a well-formed-but-wrong secret → the opaque decryption failed AEAD error (no which-factor oracle).

Optional (defer if it grows): backup --include-keyfile — a sibling to --include-image that bundles the .relkey into a backup. Flagged as a fast-follow; only do it if quick, else leave it for a later lift and note so.

Validation + ship

cargo test -p relicario-core -p relicario-cli, cargo clippy --all-targets -- -D warnings, cd /home/alee/Sources/relicario.v0.9.0-dev-d-minors/extension && npm run build:all (the Zeroizing change touches a WASM-exported fn — type-check it). Simplify pass. Then git push -u origin fix/v0.9.0-keyfile-minors and post Status: REVIEW-READY. The PM merges it before the tag.

First action

After setup, read_messages(for="dev-d") for my resume directive, post a ## STATUS UPDATE (Status: IN-PROGRESS, Task: keyfile-minors) confirming the minors branch is up, then knock out the 3 minors via superpowers:subagent-driven-development (or directly — they're small).