From 5de3fe4b40f6e626962e2474bf0dea7cf42adad5 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Fri, 21 Aug 2026 09:18:51 -0400 Subject: [PATCH] Note secret sharing as a tabled tool, with the reasoning attached Evaluated a Password-Pusher-style service as a Tech Tool and tabled it. The note carries the decisions rather than just the idea, because those are what cost the time: it is NOT a Tools-plugin candidate as it stands (that plugin is browser only by design, with get_blueprint and get_models both empty), the sender must always be authenticated, a FILE recipient should be logged in too - which costs nothing on an intranet-only server where anyone who can resolve the link already has an account - and zero-knowledge encryption is right for a credential but questionable for a controlled document, where a server that cannot say what was shared is a liability rather than a feature. Intranet-only hosting is what makes the idea viable at all: a link mailed outside is dead and no ciphertext reaches a third party. Pointing staff at the public hosted instance instead would reinstate every problem this avoids. --- docs/ROADMAP.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 77a0097..4d457b7 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -39,6 +39,20 @@ The last big milestone before 1.0 is the legacy-ASP data import plus a productio - Pip-installable plugins (deferred per ADR-003 v2). Filesystem distribution stays the v1 model. - Event bus on `BasePlugin` (removed per ADR-001; add via new ADR if a real use case appears). - Frontend rebuild beyond Vue 3 + Pinia + Vite (the existing stack is fine). +- Secret and file sharing as a Tech Tool (tabled 2026-08-21). A one-view, + expiring link for handing someone a credential, in place of a chat message or + a sticky note. NOT a Tools-plugin candidate as it stands: that plugin is + browser-only by design (`get_blueprint` and `get_models` are both empty) and + this needs storage, expiry and an audit trail, so it would be its own plugin. + Decisions already reached, to save rediscovering them: the sender is always + authenticated; a FILE recipient should be logged in too, which costs nothing + on an intranet-only server where everyone with the link already has an + account; separate permissions for sharing a secret and sharing a file, because + the risk classes differ; and zero-knowledge encryption is right for a + credential but questionable for a controlled document, where "the server + cannot say what was in it" is a liability rather than a feature. Export + control should confirm internal link sharing in writing before it carries + drawings or NC programs. ## What 1.0.0 means