Loading…
Use this brief to prepare a concrete wallet implementation and its acceptance evidence. It is technical task guidance; repository contribution instructions remain in the root AGENTS.md and CONTRIBUTING.md. It does not authorize production data access, a deployment or a real-money transaction.
Implement a reviewed wallet backup and recovery flow for this repository.
First report the current key manager, how keys can be recovered after device
loss, the selected profile/network model, storage provider, product data outside
Wallet Toolbox, and exact installed package versions. Identify gaps before
claiming complete recovery. Use synthetic fixtures; do not request or log real
keys, shares, passphrases, manager snapshots, exports or production records.
Use TS Stack's wallet-backup-recovery, wallet-data-portability and
wallet-recovery-drill guides. Verify every helper against current declarations.
Use the appropriate Node/browser/mobile package. Remote StorageClient or
StorageMobile is not a concrete StorageProvider: implement and verify the local
copy or trusted export path before wiring exportBRC39 into UI. Do not invent
wallet.exportBRC39(), archive streaming, cancellation or snapshot guarantees.
Provide encrypted export for the selected profile with a recoverable passphrase,
confirmed file-save completion, freshness information and clear exclusions.
Preserve library format/KDF defaults and enforce tested resource limits. Keep
key recovery and wallet-data backup as separate statuses and instructions.
For import, recover the expected identity independently, decrypt/validate for
preview, compare identity and network, then confirm target and explicit mode.
Reject profile changes between preview and write. Restore into an isolated,
migrated empty provider without creating a user first; never clear an existing
wallet to make restore pass. Offer merge only as a separate tested flow with a
pre-import backup. Keep imported endpoint/sync metadata from silently changing
storage authority. Leave monitor/broadcast/cutover disabled until acceptance.
Add meaningful host-level tests for saved-file reopen, wrong password/corrupt
file, wrong profile/network, nonempty target, interruption, stale backups,
resource limits and clean-device/provider-loss recovery. Verify transaction and
derivation records, relationships, tombstones and binary data; balance alone is
insufficient. Exercise restart and a controlled synthetic/testnet spend. Test
each claimed runtime and cross-wallet direction with exact versions.
Deliver implementation, user instructions, recovery inventory, acceptance
evidence and explicit unresolved limits. Distinguish implemented, locally
tested, device-tested and released behavior. Follow this repository's review
and CI requirements; production recovery/cutover requires separate authority.Record results using the drill evidence template. For defects, supply the smallest synthetic reproduction through the root issue templates. Suspected vulnerabilities belong in the private security process, not public recovery examples.