J3vbandClaude Opus 4.8 81a0b63e65 feat(e2ee): F3 identity/TOFU + W2-4/W3-3 hardening — checkpoint before F3 UI ...

WIP save point. Server + W2-4/W3-3 complete and gate-green; F3 voice E2EE
identity keys + TOFU implemented and MITM-verified-closed; the F3 voice-panel
UI (safety-number display, verified/mismatch badge, re-pin modal) is still TODO.

- W2-4 attachment link (coverage confirmed); W3-3a XFF CIDR pre-parse;
  W3-3b update-binary TOCTOU (single-handle verify + O_EXCL staging)
- F3 server: migration 017 identity_public_key, PATCH /users/me persist,
  ready/member_join/user_update carry key, signed voice_e2ee_announce
- F3 client: ECDSA identity keypair (keyring + pin store), publish wired into
  ready, verifyPeerAnnounce pin-before-legacy, rePinPeerIdentity recovery
- Gates: server full CI mirror green (-race/-deadlock/lint/4 build tags);
  client typecheck/lint/format + 3337 vitest green. Rust CI-verify only.

Next: build F3 voice-panel UI, then adversarial review, then finalize commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-23 21:07:09 +02:00

..

audit-2026-07-19-decisions.md

docs(audit): record D13 closure of A-2026-07-16

2026-07-23 14:45:42 +02:00

channel-visibility-unification.md

docs: close audit items 3 and 11 (channel-visibility + V2 dispatch)

2026-07-20 11:44:32 +02:00

http-tofu-proxy.md

feat(client): TOFU HTTP proxy for REST — close audit A-2026-07-02 (D5)

2026-07-19 14:26:25 +00:00

permission-middleware-consolidation.md

docs(audit): record D13 closure of A-2026-07-16

2026-07-23 14:45:42 +02:00

security-hardening-remediation.md

feat(e2ee): F3 identity/TOFU + W2-4/W3-3 hardening — checkpoint before F3 UI

2026-07-23 21:07:09 +02:00

security-scan-2026-07-22-remediation.md

feat(e2ee): F3 identity/TOFU + W2-4/W3-3 hardening — checkpoint before F3 UI

2026-07-23 21:07:09 +02:00

slash-commands.md

docs(audit): close plugin CRITICALs 1-4, accept #5 as residual risk

2026-07-20 14:10:15 +02:00

sqlc-adoption.md

refactor(server/db): delegate messages + reactions to dbgen; finalize D2

2026-07-19 15:48:39 +00:00

tauri-capability-narrowing.md

chore(client): remove dead files, exports, and unused dependencies

2026-07-23 15:29:01 +02:00

v2-dispatch-migration.md

docs: close audit items 3 and 11 (channel-visibility + V2 dispatch)

2026-07-20 11:44:32 +02:00