From a4cf07b6d0b2c6d6573cccef00434d172aca4e5c Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Thu, 20 Aug 2026 07:53:08 +0200 Subject: [PATCH 1/2] docs(native): correct false claim that desktop fs encryption exists today The roadmap stated issues #357/#359/#360/#361 describe gaps in "the current Tauri fs-backed encryption path" as if that path exists in production with bugs. It doesn't: desktop fs-backed project data has no encryption at all on main (fsCore.ts#encryptText/decryptText are dead code, zero call sites); API-key fs storage is disabled outright. The four issues actually describe gaps in a closed, unmerged reference design (fix/desktop-project-data-encryption, PR #356, closed 2026-08-18 as superseded, explicitly meant to be rebuilt from scratch on the Rust Core). All four issues remain real, valid inputs to the Wave 3-4 crypto design - only the "this exists today with bugs" framing was wrong. Same precedent as 2c83ea3c (docs(security): correct false desktop encryption claims, #352). Co-Authored-By: Claude Sonnet 5 --- docs/native/ROADMAP-QT-GPUI-DESKTOP.md | 42 +++++++++++++++++--------- 1 file changed, 28 insertions(+), 14 deletions(-) diff --git a/docs/native/ROADMAP-QT-GPUI-DESKTOP.md b/docs/native/ROADMAP-QT-GPUI-DESKTOP.md index a8474630..64ff9e3b 100644 --- a/docs/native/ROADMAP-QT-GPUI-DESKTOP.md +++ b/docs/native/ROADMAP-QT-GPUI-DESKTOP.md @@ -28,14 +28,23 @@ it was drafted against: guardrail (wired into `.github/workflows/ci.yml`, `pnpm run guardrail:desktop-imports`) all shipped via PR #384 and PR #385. See the Wave 1 entry below for the corrected status marker, and `docs/architecture/native-readiness.md` for the live scorecard. -2. **The R-15 desktop at-rest-encryption deliverable (§9) has concrete, already-tracked open gaps to - close**, not an abstract future risk: GitHub issues **#357** (atomic writes need fsync of temp - file + parent directory), **#359** (fs-data key-rotation migration not crash-resumable), **#360** - (fs reads/writes don't participate in the encryption-migration admission lock), and **#361** (fs - ciphertext has no AAD/identity binding, enabling cross-file substitution) are all open, Tauri- - scoped issues today. R-15 implementation work (Wave 3–4) must close them, not merely avoid - regressing them. **Issue #332** (a live, user-reported Tauri `.deb` sluggishness report) remains - open as the historical/ongoing performance baseline referenced throughout this document. +2. **The R-15 desktop at-rest-encryption deliverable (§9) has a concrete, already-tracked reference + design and gap list to build from**, not an abstract future risk — but correcting an overstatement + from this document's first draft: desktop fs-backed project data (`project.json`, snapshots, + Codex, images, RAG vectors) has **no encryption at all today** on `main` + (`services/fs/fsCore.ts#encryptText`/`decryptText` exist but are dead code — zero call sites + outside their own unit tests); desktop API-key fs storage is disabled outright + (`FsSettingsStore#saveApiKey` throws `"...use storageService instead"`). GitHub issues **#357** + (atomic writes need fsync of temp file + parent directory), **#359** (fs-data key-rotation + migration not crash-resumable), **#360** (fs reads/writes don't participate in the + encryption-migration admission lock), and **#361** (fs ciphertext has no AAD/identity binding, + enabling cross-file substitution) describe gaps in a **closed, unmerged reference design** + (`fix/desktop-project-data-encryption`, PR #356, closed 2026-08-18 as superseded, explicitly + meant to be rebuilt from scratch on the Rust Core) — not a live production path. All four issues + remain open and are real, valid inputs to the Wave 3–4 crypto design; only the "this exists today + with bugs" framing was wrong. **Issue #332** (a live, user-reported Tauri `.deb` sluggishness + report) remains open as the historical/ongoing performance baseline referenced throughout this + document. Everything else below is the roadmap as adopted, unmodified. @@ -648,7 +657,10 @@ Required properties: - tests for interruption and partial writes. **Concrete open gaps this must close (see Document status note above):** issues #357, #359, #360, -#361 — all open on the current Tauri fs-backed encryption path as of Wave 0. +#361 — all open, describing gaps in the closed/unmerged reference design (PR #356), not a live path. +Desktop fs-backed project data has no encryption at all on `main` today; this deliverable is a +from-scratch build informed by that reference design and by the mature, "Accepted and implemented" +IDB-side scheme (ADR-0018), not a bug-fix pass on existing production encryption. ## 8.2 Historical #359/#360/#361 requirements @@ -663,10 +675,11 @@ YES / NO Evidence: ``` -**Current status (2026-08-20):** all three issues are open on GitHub, each documenting a real, -unresolved correctness gap in the Tauri fs-backed encryption path (crash-resumability, admission-lock -participation, AAD/identity binding respectively). None are fixed by Wave 0 — they remain concrete -inputs to the future Core storage/crypto design. +**Current status (2026-08-20):** all three issues are open on GitHub, each documenting a real gap +(crash-resumability, admission-lock participation, AAD/identity binding respectively) in the closed, +unmerged reference design (PR #356) — not in a live production path, since desktop fs-backed +encryption does not exist on `main` today. None are fixed by Wave 0 — they remain concrete inputs to +the future Core storage/crypto design. ## 8.3 #332 @@ -2814,7 +2827,8 @@ Before the first Qt project-write path: - link those tests from native migration documentation. Historical closure does not remove their lessons. **Current status (2026-08-20): all three open on -GitHub, unresolved on the Tauri fs-backed encryption path. See §8.2.** +GitHub, describing gaps in the closed/unmerged reference design (PR #356) rather than a live path — +desktop fs-backed encryption does not exist on `main` today. See §8.2.** --- From 57cf0659b535b8f5ed97b795e61fb6cfb540bcb7 Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Thu, 20 Aug 2026 07:59:33 +0200 Subject: [PATCH 2/2] docs(native): fix markdownlint MD018 false-heading triggers (#361 line-start) Two spots had "#361" as the first token on a line, which markdownlint-cli2 parses as a malformed ATX heading (no space after hash). Merged into single physical lines instead of re-wrapping at the same width, which kept recreating the same line-start position. Co-Authored-By: Claude Sonnet 5 --- docs/native/ROADMAP-QT-GPUI-DESKTOP.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/docs/native/ROADMAP-QT-GPUI-DESKTOP.md b/docs/native/ROADMAP-QT-GPUI-DESKTOP.md index 64ff9e3b..01538067 100644 --- a/docs/native/ROADMAP-QT-GPUI-DESKTOP.md +++ b/docs/native/ROADMAP-QT-GPUI-DESKTOP.md @@ -656,8 +656,8 @@ Required properties: - secure deletion claims avoided unless actually supportable; - tests for interruption and partial writes. -**Concrete open gaps this must close (see Document status note above):** issues #357, #359, #360, -#361 — all open, describing gaps in the closed/unmerged reference design (PR #356), not a live path. +**Concrete open gaps this must close (see Document status note above):** issues #357, #359, #360, and #361 +are all open, describing gaps in the closed/unmerged reference design (PR #356), not a live path. Desktop fs-backed project data has no encryption at all on `main` today; this deliverable is a from-scratch build informed by that reference design and by the mature, "Accepted and implemented" IDB-side scheme (ADR-0018), not a bug-fix pass on existing production encryption. @@ -2812,8 +2812,7 @@ R-15 is promoted to an early native-program gate. Qt Stable is forbidden without the approved desktop at-rest encryption posture. -GPUI inherits the same implementation from Core. **Concrete tracked instances: #357, #359, #360, -#361 (see §8.1–8.2).** +GPUI inherits the same implementation from Core. **Concrete tracked instances: #357, #359, #360, and #361 — see §8.1–8.2.** ---