# TODO

Working backlog of forward-looking items not yet scoped into a dedicated plan
doc. See [`ROADMAP.md`](ROADMAP.md) for the curated, public-facing direction.

## NPM certificate follow-up — reported 2026-10-01

- [ ] **NPM first certificate and renewal must work without manual repair.**
  Shorty's HTTP-01 404 exposed inconsistent active data/ACME paths between the
  manifest, legacy creation paths and host nginx bridge. Independent reviewer
  acknowledged the handoff. The 1.8.22 acceptance record reports migration and
  release checks; verify the remaining real renewal and legacy-upgrade evidence
  before treating this historical report as an open release blocker. See
  [repair evidence and required release tests](npm-certificate-handoff-20261001.md).
  Do not equate the live challenge-route repair with a tested release fix.

## Framework incident — closed with operator acceptance

- **CLOSED WITH OPERATOR ACCEPTANCE (2026-09-30): Framework LND startup /
  missing Receive address / false zero balance.** Startup, native balances,
  Cashu address and source integration were verified; the operator accepted the
  remaining display check and authorized release. See the incident record for evidence.
  See [incident evidence and closure criteria](incident-framework-lnd-startup.md)
  and the repository `AGENTS.md` session-start instructions.

## 1.8.22 release and unresolved follow-ups

The 1.8.22 OTA and ISO were published; use the
[acceptance record](release-1.8.22-acceptance.md) for shipped scope and limits.
The pre-release checklist is historical and remains in Git history. In
particular, its Gitea/Portainer, GitWorkshop/Nginx, app visibility and paid-file
release gates are not current blockers merely because old notes say "pending."

- [ ] **Angor full-chain indexing:** The app-store service shipped in 1.8.22,
  but real indexing still awaited development-node Bitcoin synchronization in
  the acceptance record. Recheck current sync and indexing before closing.
- [ ] Design durable recovery for an accepted payment whose response is lost.
  Preserve the truthful unconfirmed-refund warning and prevent automatic
  duplicate payment while that recovery work is outstanding.
- [ ] **SSH over mesh acceptance:** Reconcile the implemented
  `core/archipelago/src/fips/ssh_mesh.rs` with current UI/RPC state. On a real
  phone and node, verify LAN and away-from-LAN connection, toggle-off refusal,
  source-scope restriction, restart persistence and UI state after reload. The
  original August handoff and its failure details remain in Git history at
  `00888bda:docs/HANDOFF-2026-08-31-ssh-over-mesh.md`; do not infer a pass from
  the existence of source code.

## 1.8.21 repair and release tasks — completed 2026-09-30

See the [execution record](repair-release-20260929.md) for evidence and limits.

- [x] Fix Cashu paid-file redemption between dev and Shorty; test keyset IDs,
  mint errors, fees, and refund reporting before live validation.
- [x] Record Framework verification and the operator's acceptance of the
  remaining display check before release.
- [x] Replace the unavailable tx1138.com explorer default with mempool.space;
  migrate the old default with fresh consent and preserve custom/local explorers.
- [x] Offer pruning in the Bitcoin installation version modal, using the same
  pruning settings as automatic pruning even on large disks.
- [x] Explain Bitcoin warmup without raw RPC errors; gate LND unlock on Bitcoin
  RPC readiness and show install/start/sync waiting states with automatic recovery.
- [x] Test the completed changes on this development box, then publish a new
  signed OTA and raw ISO release. Record any remaining verification gaps.

## Dev & build process (priority)

- Formalize the contributor workflow: releases, CI, maintainers, automated
  builds, PR/issue flow, branch naming, and reproducible builds.

## Federation & peering

- Peering trust model — define tiers (trusted / public / private / peered)
  on top of the existing federation DID trust levels.
- Federation architecture built on the above peering model.

## Distributed git & OTA

- Nostr-hosted git for the alpha (see
  [`nostr-git-source-hosting.md`](nostr-git-source-hosting.md)).
- Distributed git beyond the nostr-hosting case.
- Distributed OTA / app delivery.

## Nostr integration

- Nostr signer integration.

## Platform / OS

- Source-availability ISO — define the build/distribution story.
- HW/OS update pipeline.
- Deeper OpenWRT integration.
- GrapheneOS integration — backups, attestation, profiles.

## App ecosystem

- Full pass testing every app in the catalog; expect issues across the board.
- App update strategy — finalize the update policy referenced in
  [`app-developer-guide.md`](app-developer-guide.md) (pinned vs. mutable
  tags, catalog-vs-disk precedence, rollout/rollback).
- App wishlist — candidates not yet packaged: Cashu wallet, phoenixd.
  (CLN is already shipped as `apps/core-lightning`.)

## Access & security

- SSH access strategy — define the access model (keys, rotation, recovery
  path, remote-support access).

## Observability

- Capture error logs to troubleshoot customer issues.
- Stats & visualization for traffic, blocked attacks, VPNs, routing.