phase3: plan checkpoint

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

simon-pierre boucher committed 12 days ago (Jul 30, 2026) parent 3848fb2

Showing 1 changed file with +17 and −5

modified docs/PLAN.md +17 −5

		`@@ -45,12 +45,24 @@ stream_options, max_completion_tokens, enable_thinking, reasoning_content, citat`
45	45	use Swift Testing with `scripts/test.sh` wiring the CLT TestingMacros plugin + framework symlinks
46	46	(`make test`).
47	47
48		−## Phase 3 — SecureKeyStore (in progress)
	48	+## Phase 3 — SecureKeyStore ✅ (completed 2026-07-30)
49	49
50		−- [ ] AES-256-GCM vault via CryptoKit at `~/Library/Application Support/ZyquoCloud/vault.zq`
51		−- [ ] HKDF master key: random salt + IOPlatformUUID (IOKit) + home path + obfuscated compiled-in pepper
52		−- [ ] Vault format `[salt][nonce][ciphertext+tag]`, plaintext JSON dict of provider→key
53		−- [ ] Round-trip encrypt/decrypt test (phase gate) + tamper test + no-Keychain sweep
	50	+- [x] AES-256-GCM vault via CryptoKit at `~/Library/Application Support/ZyquoCloud/vault.zq`
	51	+- [x] HKDF master key: random salt + IOPlatformUUID (IOKit) + home path + obfuscated compiled-in pepper (XOR-assembled at runtime)
	52	+- [x] Vault format `[salt 32B][nonce+ciphertext+tag]`, plaintext JSON dict of provider→key, atomic writes, stable salt across saves
	53	+- [x] Round-trip encrypt/decrypt test (phase gate) + tamper test + machine-binding test + plaintext-leak test + no-Keychain sweep (clean)
	54	+
	55	+Phase 3 checkpoint summary: Vault gate passed — 17/17 tests green including encrypt/decrypt
	56	+round-trip, GCM tamper detection, cross-machine rejection (injected entropy), salt stability, and
	57	+a scan proving no key material or field names appear in the vault file. Zero Keychain/SecItem usage
	58	+in the codebase. Keys redact to `••••` + last 4 via `SecureKeyStore.redacted`.
	59	+
	60	+## Phase 4 — Design System & UI Spec (in progress)
	61	+
	62	+- [ ] `ZyquoTheme` tokens: colors (light flagship + dark derivation), typography, spacing, radii, shadows
	63	+- [ ] Reusable components: hairline, badges, hover states, buttons
	64	+- [ ] Appearance store (light/dark/system, accent choices, chat font size 12–18)
	65	+- [ ] Phase checkpoint: builds clean; tokens are the only color/size source (no raw hex in views)
54	66	## Phase 2 — Architecture (pending)
55	67	## Phase 3 — SecureKeyStore (pending)
56	68	## Phase 4 — Design System (pending)
57	69