79284979c1
Generate the kickoff prompts for the v0.9.0 lift — two independent tracks sharing the tag, each internally sequenced: org track: dev-a (SW+WASM foundation) -> dev-b (read UI) -> dev-c (write) keyfile track: dev-d (core/cli/wasm) -> dev-e (extension + positioning) - PM prompt encodes start-order gating (A+D start now; C runs its GO/NO-GO signed-commit spike now; B holds for A; E holds for D; C-writes hold for A+B), the Gitea git-merge mechanism (gh is unusable here — merge via git --no-ff), per-stream judgment calls, and the pre-tag checklist incl. the release.js version-check caveat (relicario-server's independent 0.1.x line). - Each dev prompt: worktree setup, force-cd subagent rule, relay polling cadence, scope/out-of-scope partition, hard rules, final tests, push (no gh pr create). - v0.9.0-launch.sh: relay health-check + tmux session (pm + dev-a..dev-e). Relay already supports dev-a..dev-f (no queue.ts/server.ts change needed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pe8qw5KePDqAEBsAxnVQuJ
126 lines
7.2 KiB
Markdown
126 lines
7.2 KiB
Markdown
# Dev E Kickoff Prompt — v0.9.0 Plan E (key-file extension + positioning)
|
|
|
|
Paste everything below the `---` line into a fresh Claude Code terminal as the first user message.
|
|
|
|
---
|
|
|
|
You are a **senior developer** owning Plan E for the v0.9.0 "org GUI + key-file second factor" release.
|
|
|
|
**Your stream: key-file UX in the extension + the positioning pivot.** Let users choose a plain key file instead of a steganographic reference image as the vault's second factor during setup and unlock in the browser extension. Then re-position the project's docs around the durable two-factor KDF thesis, with steganography presented as one optional container rather than the headline. **You consume Dev-D's WASM bindings + params contract — no core/Rust work in this stream.**
|
|
|
|
**Dependency:** you depend on **Dev-D (keyfile core)**. Scaffold + write failing tests against D's published WASM signatures immediately, but **hold integration until the PM confirms Dev-D has merged.**
|
|
|
|
A PM in another terminal coordinates you with four other senior devs. Relay via `post_message` / `read_messages`; Python shim fallback below.
|
|
|
|
## Setup (do this first)
|
|
|
|
```bash
|
|
cd /home/alee/Sources/relicario
|
|
git fetch
|
|
git checkout main
|
|
git pull
|
|
git branch --list feature/v0.9.0-dev-e-keyfile-ext # ensure no collision; escalate if it exists
|
|
git worktree add /home/alee/Sources/relicario.v0.9.0-dev-e -b feature/v0.9.0-dev-e-keyfile-ext
|
|
cd /home/alee/Sources/relicario.v0.9.0-dev-e
|
|
pwd # must print /home/alee/Sources/relicario.v0.9.0-dev-e
|
|
```
|
|
|
|
**ALL subsequent work happens in `/home/alee/Sources/relicario.v0.9.0-dev-e`.** Every subagent prompt MUST start with `cd /home/alee/Sources/relicario.v0.9.0-dev-e` (project memory; a header is not enough). Non-negotiable.
|
|
|
|
Today: 2026-06-25. Project rules in `CLAUDE.md` apply.
|
|
|
|
## Relay server
|
|
|
|
`localhost:7331`: `post_message(from, to, kind, body)` (your `from` is `"dev-e"`), `read_messages(for)`, `list_pending(for)`. Recipients: `pm, dev-a, dev-b, dev-c, dev-d, dev-e`. Poll `read_messages(for="dev-e")` before each task; post to `pm`. Single-line `body`.
|
|
|
|
**Fallback:**
|
|
```bash
|
|
cd /home/alee/Sources/relicario/tools/relay
|
|
python3 call.py post_message '{"from":"dev-e","to":"pm","kind":"status","body":"..."}'
|
|
python3 call.py read_messages '{"for":"dev-e"}'
|
|
```
|
|
|
|
## Relay polling cadence — MANDATORY (do NOT go head-down)
|
|
|
|
Poll `read_messages(for="dev-e")` before/after each subagent, before each commit, at task boundaries, whenever heads-down a few minutes. **Your integrate signal (Dev-D merged) arrives as a relay directive** — head-down means you stall or build against an unmerged contract. `HOLD`/`RESCOPE` is an interrupt.
|
|
|
|
## Required reading (in order)
|
|
|
|
1. `CLAUDE.md` — project rules
|
|
2. `docs/superpowers/specs/2026-06-20-pluggable-second-factor-design.md` — spec (your scope is the **extension UX + positioning docs only**)
|
|
3. `docs/superpowers/plans/2026-06-20-v0.9.0-keyfile-ext-positioning.md` — your plan, execute task by task
|
|
|
|
## Execution mode
|
|
|
|
**subagent-driven-development** (`superpowers:subagent-driven-development`). Every subagent prompt MUST start with `cd /home/alee/Sources/relicario.v0.9.0-dev-e`. Poll between dispatches.
|
|
|
|
## Your scope and boundaries
|
|
|
|
**In scope (29 tasks):**
|
|
- Task 1: Wizard UI container choice (image / key-file)
|
|
- Task 2: SW `create_vault` key-file branch
|
|
- Task 3: Wizard "download `.relkey`" flow
|
|
- Task 4: SW unlock branches on the params hint
|
|
- Task 5: Attach-mode key-file picker (probe `params.json` during the connection-test step)
|
|
- Task 6: Positioning pivot — docs rewrite (`README.md`, `DESIGN.md`, `docs/CRYPTO.md`, `docs/FORMATS.md`, `docs/SECURITY.md`)
|
|
|
|
**Out of scope:** all Rust/core/CLI/WASM work (Dev-D); the org track (Dev-A/B/C). `## QUESTION TO PM` for out-of-scope trips.
|
|
|
|
**Hard rules:**
|
|
- **Consume Dev-D's contract verbatim:** WASM `keyfile_encode`/`keyfile_decode`/`unlock_with_secret`; `params.json` `second_factor: "image"|"keyfile"` (absent ⇒ image). Do NOT write core/Rust — if D's contract is missing something, file a `## QUESTION TO PM` for Dev-D.
|
|
- Binary (carrier image, `.relkey` bytes) crosses `chrome.runtime.sendMessage` **only** base64-enveloped via `shared/message-binary.ts` (shipped v0.8.2) — never add raw `ArrayBuffer` message fields.
|
|
- `keyfileBase64` is stored in the clear in `chrome.storage.local`, exactly like `imageBase64` today — document as **equivalent, not weaker**.
|
|
- A `/security-review` pass is **mandatory** before REVIEW-READY on: the key-file vs stego KDF equivalence path, armor-parsing robustness, and the honesty of the in-the-clear-storage documentation.
|
|
- Task 6 positioning docs: obey the living-docs scope-boundary + code-constant-pinning rules in `CLAUDE.md` (crypto details go in `docs/CRYPTO.md`, wire formats in `docs/FORMATS.md`, etc.). CLI/extension parity is a design philosophy — keep the extension UX aligned with Dev-D's CLI surface.
|
|
- **Hold integration until Dev-D merges.** Scaffold + write failing tests against D's published WASM signatures first.
|
|
- No merging to main (PM owns it). No `--force`/`reset --hard`/`branch -D`/`worktree remove` — ask first.
|
|
|
|
## Coordination protocol
|
|
|
|
Narrate. STATUS UPDATEs at task boundaries are the floor; emit `Status: IN-PROGRESS` at meaningful moments. `Notes` = WHAT + WHY, ≤3 sentences. Print locally AND post.
|
|
|
|
```
|
|
## STATUS UPDATE — DEV-E
|
|
Time: <iso8601>
|
|
Branch: feature/v0.9.0-dev-e-keyfile-ext
|
|
Task: <number / short name>
|
|
Status: STARTED | IN-PROGRESS | DONE | BLOCKED | REVIEW-READY
|
|
Last commit: <short sha + first line>
|
|
Tests: <green | red (which) | N/A>
|
|
Notes: <≤3 sentences>
|
|
```
|
|
|
|
```
|
|
## QUESTION TO PM — DEV-E
|
|
Time: <iso8601>
|
|
Context: <task, decision point>
|
|
Options: <A / B / C>
|
|
Recommended: <pick + rationale>
|
|
Blocker: yes | no
|
|
```
|
|
|
|
## Ship-it autonomy + simplify discipline
|
|
|
|
`.claude/settings.json`: broad allow + narrow destructive deny. Move fast. Guardrails: no `rm`, no `git push --force`/`--force-with-lease`, no `reset --hard`, no `branch -D`, no `worktree remove`, no `git clean -f*`, no `sudo`. Before every REVIEW-READY: `superpowers:simplify` (fix or justify). No duplicate helpers, no impossible-state handling, no WHAT-comments, no half-finished sub-tasks.
|
|
|
|
## Authority within the plan
|
|
|
|
Task-to-task autonomy within plan/spec. Escalate for: scope questions, a test you can't green honestly, a discovered bug, anything destructive, before REVIEW-READY, and before integrating against Dev-D's contract if unsure it merged.
|
|
|
|
## Final steps before REVIEW-READY
|
|
|
|
```bash
|
|
cd /home/alee/Sources/relicario.v0.9.0-dev-e/extension && npx vitest run && npm run build:all
|
|
```
|
|
Plus the mandatory `/security-review` pass (see Hard rules).
|
|
|
|
Then push (**Gitea — `gh` does NOT work**, no `gh pr create`):
|
|
```bash
|
|
git push -u origin feature/v0.9.0-dev-e-keyfile-ext
|
|
```
|
|
Post a `## STATUS UPDATE` with `Status: REVIEW-READY` + branch name. PM merges via `git merge --no-ff` (after Dev-D is in).
|
|
|
|
## First action
|
|
|
|
After reading: emit a `## STATUS UPDATE` confirming setup complete (worktree created, plan absorbed, on `feature/v0.9.0-dev-e-keyfile-ext`). Then **scaffold and write failing tests against Dev-D's published WASM contract, but HOLD integration until the PM confirms Dev-D merged.** Ask the PM for the contract if it hasn't been posted yet. Task 6 (positioning docs) can be drafted any time — it doesn't depend on D's code.
|