Roadmap

Delivery sequence from the cryptographic foundation through framework integration, devices, rotation, and migrations.

v0.1

Versioned formats, core contracts, libsodium engine, JSON and binary encryption, IndexedDB, password-based Recovery Kits, lock/unlock, restore, in-memory adapters, tests, and a browser demo. Standalone Recovery Kit replacement now changes the recovery secret without rotating the root key, uses optimistic server cutover, and reconciles a committed write after a lost response. IndexedDB now reports blocked upgrades and quota/write failures as actionable typed errors, closes connections on every path, preserves prior encrypted state on aborted writes, and rejects malformed records without silently deleting them.

Dedicated Web Worker cryptography is now implemented behind the stable engine contract. Root-key bytes remain worker-local, message boundaries are validated, failures are typed, and the full Recovery Kit browser matrix exercises the real worker bundle without a main-thread fallback. Timeouts, crashes, malformed responses, message-cloning failures, disposal, and late events now have deterministic adversarial coverage. Every terminal failure settles pending work, terminates the worker, and makes the failed engine reject later operations without posting more messages.

v0.2

headless React context and hooks, TanStack Start, tRPC, Better Auth, Drizzle, Prisma, PostgreSQL, SSR boundaries, and the private-journal example.

In progress: headless React hooks, distinct application examples, Web/fetch, tRPC, Next.js, Node/Express, Hono, TanStack Start, Better Auth, Drizzle, Prisma, and direct PostgreSQL foundations are implemented. A full-stack TanStack Start + Drizzle tracer now verifies that plaintext stops at the browser boundary. Additional production examples, real account onboarding, broader auth providers, and additional databases remain before the v0.2 milestone is complete.

The release gate now runs the shared direct PostgreSQL, Drizzle, and generated Prisma Client contracts against an actual PostgreSQL server in addition to PGlite. The Prisma lane generates its client from the packaged Ownfold schema fragment and proves structural compatibility at compile time before running the same lifecycle and rotation compliance suite.

v0.3

Per-device keys, registration, labels, revocation, recovery enrollment, pairing, cross-tab coordination, and automatic locking.

In progress: recovery-based browser enrollment, non-extractable X25519 device keys, authenticated per-device root-key envelopes, expiring existing-device pairing, atomic adapter persistence, listing, optimistic revocation, headless pairing operations, and full-stack Playwright coverage are implemented. Secret-free cross-tab coordination and configurable automatic idle locking are also implemented. Device private keys now use a WebKit-compatible protected local format with legacy read support. The application-owned journal flow and WCAG AA scan run across Chromium, Firefox, WebKit, and a mobile viewport. Pairing offers are available as typed values for host-selected transfer UI. Server-issued device last-active metadata is implemented across every storage and transport contract. Manual assistive-technology sign-off remains.

v0.4

In progress: rotation-friendly V2 envelopes, V1 migration, strict resumable rotation state, optimistic progress checkpoints, atomic in-memory cutover behavior, and transactional PostgreSQL, Drizzle, and Prisma persistence are implemented. Authenticated server, REST/fetch, and tRPC rotation boundaries are also complete. The browser now performs locally verified Recovery Kit replacement, resumable record-key rewrapping, cross-tab guarding, and atomic cutover. Headless React rotation actions and browser E2E coverage are complete. Detailed per-batch phase and processed-record progress is now exposed through browser and React APIs.

The compatibility suite now migrates real V1 records through the complete browser rotation flow. Failure injection covers saved-batch/lost-progress and committed-cutover/lost-response windows, with idempotent retry for both. The required scale gate rotates 4,097 records in 128-record batches, forces an interrupted restart, verifies every resulting envelope while preserving content ciphertext, decrypts boundary samples, and enforces a 30-second operation budget. Strict versioned crypto-capability documents, bidirectional compatibility checks, and the bridge-release migration contract now provide algorithm-suite rollout groundwork. A second approved suite and its migration remain deliberately unimplemented pending a separate primitive decision and security review.

The release gate now dry-runs all 20 publishable package tarballs, rejects accidental source/test files, verifies runtime entries, and enforces the no-explicit-.js TypeScript import policy. It also installs every real tarball into a clean external consumer, type-checks all public roots and subpaths, and imports their runtime entries without workspace resolution. Production browser bundle budgets, real sodium operation budgets, reload persistence, unavailable-storage handling, and storage-eviction recovery are now automated release evidence. Worker-backed applications lazily exclude the redundant main-thread sodium download from their initial bundle. Dedicated browser gates now cover 320 CSS-pixel reflow, dark color schemes, reduced motion, forced colors, and keyboard focus without accessibility-rule violations.

The non-framework implementation is now available as a public beta awaiting audit. Framework expansion is paused. Published-tarball consumer validation passes for all 20 exact beta versions. Independent security review, manual assistive-technology sign-off, public npm provenance, registry normalization, and canonical documentation deployment remain release gates rather than unimplemented SDK capabilities. Track exact evidence in Beta readiness.

See the current key-rotation contract.