relicario/ROADMAP.md

Relicario Roadmap

Living document — update alongside STATUS.md when milestones shift. "Up next" items have specs; "Medium-term" items may have specs; "Long-term" items are direction, not committed scope.

Shipped

Version	Highlights
v0.9.0 (2026-06-27)	Org vault in the browser extension (read + write) + pluggable second factor (6d6e9f8, 5 streams under PM/relay coordination). Org GUI: Personal/<org> context switcher, grant-filtered browse + view of all 7 item types, add-org config flow, and add/edit/delete via ed25519-signed commits pushed over native git (git-receive-pack + an in-browser isomorphic-git packfile encoder — host-agnostic, Gitea and GitHub at any version; Gitea has no signature-carrying write REST API); org admin stays CLI-only. Pluggable second factor: a plain key file (.relkey) as an alternative to the stego reference image — same 256-bit secret + Argon2id KDF; CLI (init --key-file, RELICARIO_KEYFILE) + extension (wizard/unlock/attach); positioning re-led on the two-factor-KDF thesis. Device-key lifecycle completed (device private key persisted encrypted under the master key, restored into the WASM session at unlock, never crosses to JS). Extension 584/584; core/cli/wasm + extension → 0.9.0, relicario-server 0.1.1.
v0.8.2 (2026-06-25)	Extension vault-creation fix (938174b): binary-safe chrome.runtime.sendMessage transport (message-binary.ts — base64-envelopes ArrayBuffer/TypedArray payloads the channel otherwise drops, which had reduced carrier JPEGs to 0 bytes → opaque "no SOF marker found in JPEG", breaking vault create/attach) wired at all four message boundaries; carrier-image magic-byte guard with actionable errors; setup-wizard router allowlist (create_vault/attach_vault/generate_recovery_qr); vault-tab drawer/lock layout fixes. Extension-only (core/cli/wasm bumped 0.8.1→0.8.2 for tag consistency, relicario-server stays 0.1.1); 435/435 vitest.
v0.8.1 (2026-06-20)	Org item-type parity + collection-scoped attachments + grant-scoped hook (4c0a289, four parallel streams): relicario org add/edit now cover all 7 item types — Card/Key/Totp (Dev-B 6e73c5e) and Document (Dev-C 4c0a289) on the shared item_build foundation (Dev-A b09e0ce); org attachments stored collection-scoped at attachments/<slug>/<item-id>/<att-id>.enc with a default cap (Dev-C); relicario-server classify_path grant-scopes those attachment writes (Dev-D db4e05a, server 0.1.1 — requires pre-receive hook redeploy). Still deferred: extension org read/write (forward plan: docs/superpowers/specs/2026-06-20-extension-cli-parity-gap-analysis.md); org phase 2.
v0.8.0 (2026-06-20)	Enterprise org vault — backend complete (7392795): relicario-core org module (ECIES X25519 key wrap/unwrap, OrgRole/OrgMember/OrgManifest types, filter_for_member, schema_version: 1); relicario-server org hook (verify-org-commit: signature verification, path-scoped authz, enforce_owner_only_elevation on parent role, enforce_schema_monotonicity, generate-org-hook, new [lib] target); relicario-cli — all 19 relicario org subcommands: init, add-member/remove-member/set-role, create-collection/grant/revoke, rotate-key (re-encrypts all blobs), transfer-ownership, delete-org, status, audit, and item CRUD (add/get/list/edit/rm/restore/purge). Org item-type parity for Card/Key/Document/Totp shipped subsequently in v0.8.1; extension org parity + phase 2 (SSO/LDAP, read audit, per-collection subkeys, HTTP plane) remain deferred.
v0.7.0 (2026-06-01)	Extension restructure (Plan C) complete — Phases 3/4/6 merged via 3 parallel worktree streams under PM coordination: setup wizard crypto migrated into the SW (create_vault/attach_vault; setup.ts 1230→58 LOC + step registry); vault.ts split 1037→194 LOC into 5 focused + 2 support modules; vault_locked intercept lifted into shared/state.ts; get_vault_status SW message + sidebar status indicator closing the last relicario status CLI/extension parity gap
v0.6.0 (2026-05-30)	Security audit fixes; device authentication; backup/restore + LastPass import; fullscreen UX Phases 1+2A+2B; v0.5.1 Streams A/B/C (3-column vault layout + bottom-sheet picker + toast system; left-nav settings; Recovery QR end-to-end + setup wizard Style C); 1C-γ (attachments + Document type + device registration + trash + field history); Plan B multi-stream refactor (commands/ split, prompt_or_flag, core/WASM seam); vault-tab management surfaces revamp (settings synced/local split, devices fingerprint, trash purge countdown, field-history polish, item-history-index, #history/<id> routing); doc-structure redesign (rename to DESIGN/CRYPTO/docs/FORMATS, scope headers + Next: footers); GPL-3.0-or-later license
v0.2.0	Typed-item rewrite (Plans 1A/1B/1C-α/β₁/β₂)

See CHANGELOG.md for tagged-release detail and STATUS.md for the per-train commit list.

Up next

All three 2026-05-04 architecture-review specs are shipped; the enterprise org vault (backend v0.8.0/v0.8.1, extension read + write in v0.9.0) and the pluggable second factor (v0.9.0) are shipped. Pending items in rough priority order:

• v0.9.0 follow-ups — backup --include-keyfile (key-file vault backups); the gitea.ts putBlob latent bug (large attachments 404 on Gitea); Dev-A's M1 (one-time device-migration user notice) + M2 (corrupt device_key_enc recovery path); org-write m2 (TOCTOU manifest dual-read) + m5 (zero-grant +new button / push-rejection error copy)
• Personal-side extension gaps — favorites UI, group/tag/filter editing across all type forms, attachment-remove router wire + per-item purge UI, autofill registrable-domain matching (per the parity gap analysis)
• Phase 4: command palette — ⌘K global search + action dispatch across the vault tab (no spec yet)

Medium-term

(promote here once specced)

• Org vault phase 2 — SSO/LDAP federation, read audit log, per-collection subkeys (true cryptographic scope separation per collection), HTTP management plane

Long-term / backlog

• Relay server — encrypted WebSocket relay for multi-device sync without a shared git server Spec: docs/superpowers/specs/2026-05-02-relay-server-design.md Plan: docs/superpowers/plans/2026-05-02-relay-server.md (c0921b1) Code skeleton: crates/relicario-server/ exists but only houses the pre-receive hook today; the relay binary would either extend or replace it.
• Mobile — Rust core compiles to ARM; JNI wrapper for Android, Swift wrapper for iOS

Non-goals (explicitly deferred or cancelled)

• Reference-image rotation — changing the image factor without re-embedding. Back-burner, not cancelled.
• Per-entry subkeys — no real-world benefit at family-vault scale; see design rationale in docs/CRYPTO.md.
• libgit2 / gitoxide — shell-out to git is intentional; see crates/relicario-cli/ARCHITECTURE.md.