archy/Release & Testing/Detailed Plans/03-Tasks-T00-T29.md

Sanitized detailed source transcription S03, captured 2026-10-24. Original planning steps, acceptance criteria and historical evidence are retained rather than condensed. Read current context and precedence first: dated holds, approvals, test counts and “latest” labels below belong to their original checkpoint and do not grant current execution/publication authority. Privacy replacements preserve roles and test semantics. See section coverage.

executor execution tasks

Authority: 02-Execution-Entry.md. Product requirements: parent completion plan plus 06-Approved-UX-and-Additions.md. Status and evidence: ledger.json. All tasks initially OPEN; prototype tests are not source implementation acceptance. Task dependencies below mean accepted prerequisite contracts/code at the stage needed, not invented UAT passes. T00 verifies current source before any implementation. Follow repository AGENTS.md at execution time.

Common task contract

For each task: select clean exact reviewed source; read mapped code and existing tests; record baseline/reproducer; implement smallest coherent slice; test the production code rather than copying fixture logic; review diff; update ledger with exact commits, commands, exit codes, artifacts/hashes and next gate. Maintain source, integration, artifact, live and operator evidence separately. Independent review is mandatory for money, identity, permissions, FIPS and migrations. Preserve data and existing approved UI. No broad cleanup, implicit spending, public events, radio flashing, force-push or release publication.

Operator-reported UX follow-ups

• OPEN — Alby embedded Copy button blocks the workflow: operator reports that a Copy button inside the embedded Alby interface did not copy. Reproduce in the actual embedding surface; identify browser, embedding origin and affected action without recording copied secrets. Investigate Clipboard API secure-context/user-activation requirements, iframe allow/sandbox attributes, ancestor Permissions-Policy and embedded-app errors. Our iframe configuration is a hypothesis, not an established cause. Apply the narrowest supported fix without broadening unrelated iframe privileges; if third-party restrictions cannot be changed safely, provide a usable explicit fallback. Exit: real embedded Copy action produces the expected clipboard value in supported browsers; denied/unavailable clipboard has actionable feedback or fallback; no wallet secrets in logs/screenshots. Track alongside external-wallet usability/installed acceptance; this operator-observed blocker is not cleared by unit tests alone. Source follow-up: both Archy app-launcher frames omitted clipboard delegation. Added write-only clipboard-write 'src'; Chromium reproduces the baseline policy denial and verifies exact fixture-byte copying with browser permission granted, while read/navigation/ancestor-policy denials remain. Archy frontend1608/198, types and build PASS. Existing Open in new tab fallback retained. NOT deployed or accepted against installed Alby; secure-context/browser-permission/third-party behavior still needs actual confirmation. Evidence: [private evidence label: alby-iframe-clipboard-20261019]. Remaining installed reproduction/acceptance effort is unestimated; do not silently absorb it into the existing forecast.

• WITHDRAWN — Mobile stepper/back-button spacing: operator identified this as a wrong-window request. Not an open executor/IndeeHub task; do not implement. No source changes were made for it.

T00 — Provenance, baseline and requirements reconciliation

• Depends: none. Covers: E01, E04. Batch: preparation.
• Read START-HERE, AUDIT, repository instructions, master regression checklist and current canonical proposal history. Candidate paths/commits in AUDIT are observations, not approved integration bases.
• Inventory clean/dirty trees without modifying them; resolve exact canonical accepted refs, app provenance and public release version. Create clean task worktrees. Trace every older checklist row to A–E or explicit follow-on, retaining historical evidence separately.
• Inspect package scripts/CI/backend isolation harness, then record exact runnable commands and baseline failures in 04-Qualification-Test-Contract.md. Capture current deployment inventory privately, read-only.
• Exit: ledger coverage verified, clean reviewed source pins, baseline and known failures recorded. Never copy dirty code to a worker.

T01 — Shared contracts and risk review

• Depends: T00. Covers: A01, A03, A04, A05, A06, A07, A10, A11, A12. Batch: preparation.
• Trace content_purchase*, content_lightning.rs, content_onchain*, registered_media*, rental_readiness.rs, rental_chunk_index.rs, media_stream.rs; IndeeHub registration/rents/payment/discovery modules.
• Specify stable film/media identities, scoped capabilities, native approval boundaries, durable buyer/seller operation IDs, total fee-inclusive ceilings, per-chunk receipts and pending reservations, entitlement start/expiry, tip classification, refunds/uncertainty, catalog/comment event schemas and migration compatibility.
• Resolve outstanding terms explicitly: chunk duration/price, multi-session ceiling scope, concurrency/reservation accounting, seek/replay retention, confirmation/reorg policy, mint interoperability, approved replica policy. Prototype numbers are NOT production defaults. Pin primary protocol revisions; do not label non-Lightning tips as NIP-57 receipts.
• Exit: reviewed schemas/state diagrams and failing production-path integration tests for all principal negative cases in 04-Qualification-Test-Contract.md. Unresolved policy blocks its affected feature, not unrelated work.

T02 — Reproducible build and guarded delivery scaffold

• Depends: T00. Covers: A09, E01, E02, D01, D02. Batch: preparation.
• Read managed update, drain, monetary-state fixture and ownership recovery documents. Replace hard-coded peer UAT build assumptions with reviewed discovery/configuration; no private topology in artifacts.
• Build pinned component/digest manifest; implement/reuse deployment preflight, backup verification, health/readiness and rollback journal. Rehearse commit and interrupted-update rollback using disposable nonempty/monetary fixtures.
• Exit: YAYA-UAT procedure specialized to verified tooling and candidate; backup/restore proofs; no live changes by workers.

T03 — Native identity and original UI preservation

• Depends: T01. Covers: A01, D10. Batch: Y1.
• Source: App.vue, AppHeader/BackstageHeader, MobileNav/BackstageMobileNav, ContentDetailModal.vue, ZapModal.vue, VideoPlayer.vue, native signer/auth hooks.
• Keep original shell, black modal surfaces, film details before payment, social actions, amount presets and player. Adopt flow changes only; never ship prototype shell/data or imitation native approval UI.
• Exit: account A→B, logout/reload, signer cancel/expiry and selected-key binding tests; mobile/desktop screenshots compared to original sources and approved prototype; keyboard/dialog focus/back navigation.

T04 — Backstage assets and publishing UX

• Depends: T03. Covers: A02. Batch: Y1.
• Source: ProjectEditor.vue, backstage ArchipelagoRegistration/Publication, backend project/media registration and workers.
• Retain approved details/assets/pricing/publish layout; existing navigation/elements. One Cloud/computer selection, durable draft, upload resume, readiness, price/capability validation. Keep old asset usable until replacement is ready; saving is never publishing.
• Exit: both asset routes, invalid/large files, cancel/retry/restart, permission denial, worker failure, tab/reload retention, private-master protection and readiness tests.

T05 — Stable film identity and distributed catalog

• Depends: T01, T04. Covers: A03. Batch: Y2.
• Source: backend/src/archipelago, native publication outbox/discovery adapter, catalog routes/library pagination.
• Signed creator-bound identity independent of local origin; revisions/withdrawal and late-node backfill. No fixed peer list, mock catalog fallback or auto-publication of drafts. Public metadata gives no management/media authority.
• Exit: isolated publisher P, buyer B and unrelated late C discover all explicitly published fixtures, recover partition and deduplicate updates; bad signature/revision rejected. Public testing remains separately authorized.

T06 — Discussion and social consistency

• Depends: T03, T05. Covers: A04, A11. Batch: Y2.
• Source: useNostr.ts, lib/nostr.ts, relay.ts, ContentDetailModal/CommentNode; tests for origin-derived IDs and local relay state.
• Stable film discussion key, safe legacy mapping, durable signed comments/replies, backfill/dedup, bounded threading and moderation. Preserve reactions, My List, sharing and profiles; canonical public listing links only.
• Exit: B→C→P comments/replies/counts across origins/restarts, offline/retry, stale signer, pagination, cycles/depth/size limits, XSS/markup and permissions; no duplicate reactions or erased legacy threads.

T07 — Cloud-aligned native/external checkout

• Depends: T01, T03, T04. Covers: A05, B01. Batch: Y3.
• Source: PeerFiles.vue, peerCashuPurchase/peerOnchainPurchase and Lightning lifecycle, RentalPurchaseConsent/useRentalPurchaseBridge, IndeeHub rents/payment services.
• Reuse green Cashu, yellow Lightning, amber external-wallet and orange on-chain icons/rows. Native Cashu/Lightning/on-chain plus external Lightning/on-chain. Enable only producer-supported and customer-usable methods, considering quote/mint/network/minimum/fees. External method does not require a local sending wallet. Customer/guest responses must not identify producer wallet presence/type/backend or distinguish unsupported from unconfigured/offline producer rails: disabled producer-side choices say only “Not offered.” Keep precise diagnostics producer/admin-only. Customer-side errors may describe only the customer's own wallet state.
• Durable operation before side effects; authoritative original-attempt recovery; no method switch while ambiguous. No new node-native BTCPay dependency. Preserve legacy entitlement/receipt migration.
• Exit: complete receiver/sender settlement for each rail in isolation; installed no-BTCPay boot and every enabled purchase entry point traced. Cloud purchase regression and exact-byte recovery must remain green.

T08 — Rental lifecycle, entitlement and expiry

• Depends: T07. Covers: A06, B01. Batch: Y3.
• Source: rental policy/store/readiness/chunk index, native rental bridge and original player integration.
• First authorized play starts window atomically once; preflight/payment do not. Preserve original transaction/receipt on restart; expired renewal requires fresh approval. Authorize ranges/segments/keys/cache on every protected path.
• Exit: paid-ready/watch-later, concurrent starts, seek/resume/session policy, restart, lost reply, clock boundary, expired cache/key denial, chain reorg and explicit renewal tests; never replay old incident payments.

T09 — Strict FIPS media and original player integration

• Depends: T05, T08. Covers: A07, B09. Batch: Y3.
• Source: media_stream/registered_media/resolver/proxies, ArchipelagoRentalPlayer and VideoPlayer.vue.
• Keep original controls/layout. Enforce authenticated FIPS centrally for remote manifests, variants, bytes, trailer/subtitles/keys and originals; own-node browser HTTP is presentation, not a prohibited remote hop. No direct URL/redirect/storage/Tor/CDN bypass.
• Exit: deny FIPS with alternate transports available → fail closed; restore → same entitlement without repayment. Real installed media decoding, range/seek/ABR, cancellation/backpressure, mobile/background and controlled load evidence.

T10 — Authorized replicas and availability

• Depends: T05, T09. Covers: A08. Batch: Y4.
• Reuse existing streaming/cache/snapshot primitives, add only missing creator-authorized replica policy, integrity, entitlement checks, quota/retention and bounded failover.
• Exit: publisher outage with authorized replica works; all sources unavailable is explicit; corrupted/unauthorized replica denied; no unapproved replication or hosting charge; load/resource budgets recorded.

T11 — Monetary-state packaging and upgrade acceptance

• Depends: T02, T06, T09, T26, T27. Covers: A09, D01, D02, E02. Batch: Y4.
• Pinned app/frontend/API/worker artifacts; nonempty drafts, jobs, comments, entitlements, unresolved purchases/chunks/zaps survive migration. Preserve uninstall decisions, identities and unrelated apps.
• Exit: exact managed update commit plus fault/rollback rehearsal; final image/source hashes; no running-container patch as deliverable. T10 may remain an explicit availability blocker; do not imply replica acceptance by packaging alone.

T12 — Cloud recovery and fee regressions

• Depends: T01, T07. Covers: B01, B02, B04, B05. Batch: Y3.
• Read AUDIT historical paid-file and phone acceptance first. Trace on-chain transaction engine and dynamic Fast/Bump UX; exercise real regtest signing/lease/broadcast/restart. Retain upload/viewer/source ownership and browser/native save protections.
• Exit: lost initial settlement response/restart with real isolated FIPS/service boundary, exact bytes/free repeat, cancellation/fee/rbf/cpfp/reorg, upload progress/background and trusted download failure coverage. Previously paid user files are recovered without repayment.

T13 — Independent Cloud connectors

• Depends: T00, T02. Covers: B03. Batch: Y5.
• Inspect existing candidate branches before writing Nextcloud/Immich adapters. Account-scoped APIs, pagination, revocation, source categories and correct authenticated download. No direct app-store mutations or File Browser dependency.
• Exit: isolated users and connectors with File Browser absent/stopped, expiry/revocation and permission tests; packaged browse/preview/download.

T14 — Public files and Mesh multi-file delivery

• Depends: T12, T13. Covers: B06, B07. Batch: Y6.
• Existing public pricing/marker design, explicit file/folder/child override semantics and unrelated-node discovery; private recipient-bound Mesh node/computer multi-picker, search/tree, retained selection, staging/progress/retry and free/paid attachments.
• Exit: no accidental public share, independent entitlement for paid items, cancelled/partial batch recovery, receiver exact bytes and preserved source permissions. Ship after final connection UX per retained sequence.

T15 — Shared media/private V4V and last artwork fix

• Depends: T09, T12. Covers: B08, B09, B10. Batch: Y7.
• Separate B08/B09 player/background work early; B10 notification artwork LAST in feature work after other lanes. Preserve private code/images and original attribution/destinations. Reuse one native media session/queue.
• Exit: physical Android lock/background/headset/PiP, logout/expiry/reconnect/process recreation, actual-track artwork; fixture image or browser rendering does not close artwork. Private image stays private.

T16 — Requests, Fleet and final connection UX

• Depends: T00, T02. Covers: C01, C02, C03. Batch: Y5.
• Existing durable encrypted requests, membership, provenance, metrics and bounded sync; repair only missing convergence/replay/outage/actions. Final map/mobile relationship UX follows ordinary backlog work.
• Exit: reciprocal request/removal, late replies, auth/spoof rejection, mixed versions, real bounded sync/partial state, unknown vs offline, mobile map/navigation. No trust escalation or all-complete claim from one integrated UI receipt.

T17 — App latency, monitoring, HTTPS and AI setup

• Depends: T00, T02. Covers: C04, C05, C06, C07. Batch: Y5.
• Reconcile accepted signer/gate/provider/disk fixes; measure useful-data latency, not spinner speed. Trusted hostname/session/cookie iframe/tab behavior; original AI backgrounds, saved/provider credentials and no unapproved inference.
• Exit: p50/p95 baseline/candidate comparison, session expiry/logout, physical companion grey-screen/background, monitoring nullable fields, provider failures/allowance and unsent prompt retention. Paid inference requires fresh authorization.

T18 — MeshCore interoperability and public message repairs

• Depends: T00, T28. Covers: C08, C10. Batch: Y6.
• Standard community public channel, official tooling, transport frame and encoding fixtures; no flash/reboot/RF change without explicit permission. Follow 11-Mesh-Investigation-and-Acceptance.md for garbled public text, sender/device header and icon-only audio replay.
• Exit: captured-frame reproducer fixed, standard-client two-way physical RF and reconnect/serial ownership tested where authorized. Source/simulation not hardware acceptance. Inspect the reported device's public messages read-only only with access; no claim they have already been inspected.

T19 — Firewall, tunnels and public routes

• Depends: T00, T02, T18. Covers: C09, D03, D07. Batch: Y6.
• Existing effective rules/routes/certs and repaired NPM state retained; scoped apply, browser vs raw TCP, external stage diagnosis, guest access and Cloud websites. Do not remove legitimate website transports under film-only FIPS policy.
• Exit: auth/public-management denial IPv4/IPv6, save/restart/rollback, WebSocket/ACL/client IP, real TLS trust and ACME separately; private test CA is not public issuance proof.

T20 — Lifecycle/container/app regressions

• Depends: T00, T02. Covers: D01, D02, D04, D05, D06, D08. Batch: Y5.
• Build itemized sub-checklist from retained master checklist: installed/stopped/removed/alias, store-owner cleanup, Git/Portainer namespaces/payload/LFS/registry/compose, Bitcoin/ecash apps, Angor, JustWorks/Gashboard/DATUM.
• Exit: each covered requirement's fresh focused regression or explicit blocker, no orphan resurrection/data loss/foreign-store deletion. Preserve separately accepted Angor missing-announcement limitation; never fabricate signatures. Merges and historical starts are not workflow UAT.

T21 — Terminal, developer contract and discovery UI

• Depends: T00, T02, T03. Covers: D09, D10, D11. Batch: Y5.
• Real PTY/tooling/bootstrap, auth/origin/session ownership, keys/scrollback/reconnect/offline/setup, actual starter-built app and source-driven hardware catalog. Describe owner shell privileges accurately.
• Exit: actual packaged terminal/tool payload and physical companion input, working generated app following design contract, no mock listings or unsupported hardware claims. Broad optional Omarchy parity stays deferred unless explicitly added.

T22 — Integrated frozen-candidate qualification

• Depends: T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21, T29. Covers: E02, E03, E04. Batch: final.
• Freeze reviewed component manifest, run TESTS complete matrix and multi-node soak, inspect resource caps/performance/security; document ignored/blocked tests. Final version selected from verified publication state.
• Exit: all mandatory automated/integration/artifact evidence, zero unresolved blockers; no blanket promise of failure-free networks. Missing physical checks remain blockers.

T23 — Installed artifacts and final operator UAT

• Depends: T22, T02. Covers: E03, E04. Batch: final.
• Fresh x86 booted install, genuine supported upgrade/app/OTA/APK, reboot and rollback. YAYA-UAT for final integrated candidate, then remaining explicitly authorized physical/peer acceptance.
• Exit: operator scenario sign-offs, exact served versions/hashes and preservation evidence. ARM source build does not substitute for x86 or physical Pi tests. New fix invalidates affected old evidence.

T24 — Release-owner handoff and metadata gap

• Depends: T23. Covers: E01, E02, E04. Batch: release-owner only.
• Missing 1.9.1 metadata diagnosis can proceed read-only earlier. Verify exact original tag/target/assets and release event resolution; never attach another release's APK/ISO (1.9.1 had no ISO). No publication by executor/CI.
• Exit: ngit proposal dispositions, exact accepted Gitea mirror refs/tag objects, signed-artifact request, hashes, release notes, limitations/UAT and approval packet. Owner separately authorizes merge/tag/sign/publish; immutable releases are never overwritten.

T25 — Chunked ecash streaming and scoped allowance

• Depends: T01, T07, T08, T09. Covers: A10, A06. Batch: Y4.
• Add overlay/button to ORIGINAL player; retain controls. Routstr-style explicit zero-off ceiling with spent/reserved/remaining history, fee-inclusive chunk rate and separate native consent. Cap increase preserves history; lowering/zero stops new purchases without erasing receipts.
• Atomic reservation per chunk/session prevents concurrent requests exceeding ceiling. Journal before spending; receipt bound to film revision, recipient, rate and chunk; paid chunk retries/seek reuse access within agreed policy. No buys while paused/stopped/background-disallowed/delivery-uncertain; reconcile in-flight effects honestly.
• Exit: unit/property plus real isolated Cashu/FIPS playback tests for exact cap, less-than-next-chunk remainder, concurrent viewers/tabs, multiple mints/fees, price change, seeking, pause, network loss, unknown settlement, receipt loss, restart and duplicate retry. Approved content only; external wallets must not be presented as automatic metered payers without a designed bounded protocol.

T26 — Original zap UI, all supported rails and receipts

• Depends: T01, T03, T07. Covers: A11, A05, A04. Batch: Y3.
• Follow 10-Film-Details-and-Zaps.md: original presets/custom amount/orange visual, method picker next; creator tip capabilities independent from rental selections. Cloud native/external rail semantics, distinct logical tip operation, explicit consent, correlated settlement and no BTCPay requirement.
• Exit: all rails, unavailable creator/wallet, amounts/minimums/fees, pending/cancel/restart/external exposure, duplicate receipts and count/attribution tests; no entitlement created. Enumeration/differential-error tests prove customer/guest responses cannot infer producer wallet presence, Archipelago-wallet status, provider or configuration beyond the intentionally offered method set. Native/external tip proof is not mislabeled NIP-57. Social features and dashboard ledger reconcile.

T27 — Networking Profits integration

• Depends: T01, T25, T26. Covers: A12. Batch: Y4.
• Source: Web5NetworkingProfitsSettings.vue, Web5QuickActions.vue, web5/types.ts and wallet.networking-profits/streaming.list-sessions backends. Extend existing Dashboard/Configure/cards/chart/sessions; no separate replacement dashboard.
• Expose confirmed streamed-film, fixed-sale, zap/tip and network-service income as nonoverlapping ledger categories; session subtotals are not additional income. Pending separate; no invented recipient splits or payer private allowances. Earnings gross vs net must be explicit.
• Exit: totals reconcile to durable unique receipts across source/type filters, time windows/timezones, pagination/truncated history, restart/retry/reorg; unavailable is not zero; UI/quick action/backend schema agree; live activity from actual bounded subscription/poll, never a simulated ticking rate.

T28 — Mesh rendering and replay UX investigation

• Depends: T00. Covers: C10. Batch: Y1 (read-only investigation first).
• Source and evidence recipe in 11-Mesh-Investigation-and-Acceptance.md. Obtain minimal redacted reported examples; differentiate wrong frame offset/binary-as-text/mojibake from valid Unicode. Names based on sender identity/device metadata, never channel ID or a generic colon split.
• Exit: reproducer + safe exact decode/name normalization tests, original messages preserved; pending meaning of voice-replay request confirmed before implementation. Icon-only visible control, accessible name, original supported playback path; actual-device test required for playback claim.

T29 — Public guest IndeeHub isolation and external access

• Depends: T01, T03, T05, T07, T08, T09, T26. Covers: A13, C06, D07. Batch: guest-security gate before external exposure.
• Read 09-Public-Guest-Security.md; threat-model public origin/gateway, guest principal and narrowly scoped entitlements, visitor-controlled payment/signing, session/recovery and resource budgets. Trace existing guest-access primitives without assuming a generic app proxy is safe.
• Implement separate public context and deny-by-default route manifest; no owner session, signer, wallet authority, Backstage, files/admin/API/bridge inheritance. Supported guest external payment must work with no owner credentials. All remote media retains FIPS enforcement. Guest metered mode stays disabled unless visitor-owned bounded payer protocol is independently qualified.
• Exit: complete public security matrix, two-guest/owner isolation, SSRF/XSS/CSRF/IDOR/replay/bridge/caching/path/Host negatives, authoritative payment recovery and bounded load; independent security review on exact installed artifact. Public mode off by default until acceptance and separate exposure authorization. No absolute-security claim.