Beta readiness

Evidence for Ownfold's public beta, intentionally paused work, and the external gates required before a stable production claim.

Ownfold is available as a public beta awaiting independent audit, not yet a stable production release. This page is the authoritative distinction between implemented behavior, paused ecosystem expansion, and evidence that code alone cannot provide.

Implemented beta scope

Capability	Current evidence
Ciphertext-only record boundary	Browser encryption and host record-store contracts carry versioned envelopes; transport-observation tests reject plaintext and recovery material.
Vault and recovery lifecycle	Creation, local Recovery Kit generation, verification, standalone replacement, lost-response reconciliation, lock, unlock, local-state destruction, restoration, JSON and binary round trips run in unit and browser tests.
Device lifecycle	Recovery enrollment, non-extractable local device keys, authenticated device envelopes, labels, activity metadata, optimistic revocation, expiring pairing, and two-browser flows are implemented.
Root-key rotation	Replacement-kit verification, resumable record-key rewrapping, device-envelope cutover, interruption recovery, V1-to-V2 migration, and a 4,097-record scale gate are implemented.
Browser hardening	Dedicated-worker key isolation, terminal worker failure handling, IndexedDB failure mapping, cross-tab locking, current-device removal, and configurable idle locking have deterministic coverage.
Performance	Worker-backed applications avoid eager main-thread sodium loading; production bundle and real crypto-operation budgets are enforced.
Persistence	In-memory, direct PostgreSQL, Drizzle, and generated Prisma Client implementations pass one shared lifecycle and rotation compliance suite against real PostgreSQL.
Headless React	Provider and hooks expose onboarding, recovery, lock state, devices, pairing, and rotation without UI or CSS. Application-owned example flows cover recovery, encryption, locking, reflow, keyboard access, and browser compatibility.
Compatibility	Immutable V1/V2 fixtures, strict versioned parsers, capability manifests, package API reports, migration rules, and rolling-release compatibility checks are release gates.
Release engineering	All 20 packed packages install, type-check, and runtime-import outside the workspace; moderate-or-higher full-graph dependency auditing, release-age and lifecycle-script policy, secret scanning evidence, README/license checks, Changesets, pull-request-only CI, manual OIDC publishing, rollback guidance, and incident response are implemented.

pnpm release:check is the aggregate evidence command. It is valid only with the disposable real PostgreSQL database configured by the repository test contract. Passing a narrower unit suite is not evidence for the complete beta release.

Deliberately paused

Framework-adapter expansion is paused for this sprint. Existing Next.js, Node/Express, Hono, TanStack Start, tRPC, Better Auth, Drizzle, Prisma, and PostgreSQL foundations remain in the tree, but broader framework, authentication-provider, and database coverage is not part of this readiness claim.

The following are also not implicit beta promises:

a second cryptographic suite before a dedicated primitive ADR and security review;
shared or group vaults, encrypted search, native/mobile secure storage, or streaming files;
SDK-controlled retention deletion for server metadata.

Revoked-device metadata retention is intentionally controlled by the host application. Legal, security-audit, and incident-response requirements differ by deployment, and Ownfold must not issue automatic destructive database operations. Adapters preserve revocation metadata; operators apply their documented retention schedule.

Stable release gates

The following must be completed before describing Ownfold as production-ready or releasing 1.0:

An independent cryptographic and application-security review covers primitives, authenticated data, key hierarchy, recovery, devices, rotation, worker boundaries, and supply-chain controls. Findings are resolved or published as explicit release blockers.
Manual assistive-technology testing signs off VoiceOver/Safari, NVDA/Firefox or Chromium, keyboard-only operation, 200% zoom, forced colors, reduced motion, and light/dark host themes.
The source repository is public, the @ownfold npm organization and trusted publishers are configured, and the protected manual release workflow produces verifiable npm provenance.
The documentation site has a canonical public HTTPS URL and the Blume deployment site value is set so canonical links and sitemaps are release-correct.
A clean release candidate passes pnpm release:check, is versioned through a reviewed Changesets pull request, and is installed and exercised from its actual npm tarballs in a clean consumer.
Representative real phones and laptops record Recovery Kit timing, storage-pressure behavior, background suspension, and private-browsing behavior within the supported browser matrix.

Until all six gates have recorded evidence, use public beta, not production-ready or independently audited.

The internal audit status records useful remediations and emulated browser evidence. It does not replace gates 1, 2, or 6.

Release decision

The release owner completes the production-beta evidence record with links to the security report, accessibility results, complete gate run, npm provenance, consumer smoke test, and unresolved exceptions. Missing or indirect evidence is a failed gate. A passing implementation test cannot substitute for an independent review or manual assistive-technology result. Use the independent review brief to commission the assessment against an exact candidate commit.