theseus/SESSION-PROMPT-identity-wallet.md

# Session kickoff — identity + wallet work

Paste the block below into a fresh coding-CLI session started in
`D:\Dev\SilentMode`. Zero prior context needed.

---

You are picking up **identity + wallet** work on Silent Mode's **Theseus
Navigator** — the Electron browser with in-process BCNR resolution. Two
independent strands: **password manager** (phase 1 shipped, needs
autofill + Sia sync next) and **browser-integrated BCH wallet** (design
+ scaffold, then permissioned APIs). Both derive from the same BCH-style
seed via distinct hardened purpose subtrees.

**Read these first, in order, before touching anything:**
1. `HANDOFF.md` — session hand-off protocol + subproject index. Learn
   the `PENDING.md` per-subproject convention, the session-naming rule,
   and coordination guidance for concurrent sessions.
2. `TheseusNavigator/README.md` — scope + status of the browser.
3. `TheseusNavigator/PENDING.md` — current uncommitted work, grouped by
   session. Read the other session's group FIRST so you don't stomp.
4. `TheseusNavigator/GOTCHAS.md` — non-obvious traps (`build.files`,
   admin-terminal-for-first-build, native-select popup theme, DNS
   hosts-pin for Sia upload, etc.). Save yourself an hour.
5. `TheseusNavigator/ROADMAP-identity-wallet.md` — the full roadmap for
   both strands, sorted into small deliverables.
6. `TheseusNavigator/DESIGN-password-manager.md` — the crypto discipline
   + threat model. Any new derivation MUST reuse the "purpose subtree"
   pattern documented there.
7. If you'll touch the wallet strand: read
   `Argus/src/lib/register-tx.js` + `Argus/src/lib/wallet-web.js` to see
   how the existing signing works, and `site/register.html` for how the
   built-in wallet UI is currently invoked from a page.
8. `SESSION-CONTEXT.md` — the product context (BCNR terminology,
   resolver rules, hosting model, on-chain invariants).

**What is already shipped (Theseus 0.0.3, `9c09955e…`):**
- Password vault + deterministic derivation (`Argus/src/lib/password-vault.js`,
  12 tests passing).
- Settings > Passwords section: setup / locked / unlocked panels; add,
  reveal, copy, delete entries. No autofill yet — users copy from
  Settings and paste into sites.
- Everything from earlier UX rounds: shield security badge, three-tier
  engine catalog, download tracker, cache/history storage settings,
  fingerprint spoofing selects, theme cards.

**What has NOT been designed yet — flag these decisions before starting:**
- Wallet strand's permission model + API surface. Write
  `TheseusNavigator/DESIGN-integrated-wallet.md` before B.2+ code.
- The autofill contentScript's origin-binding rule details (eTLD+1 via
  public-suffix list — bundle the snapshot; do not fetch at runtime).
- Sia sync UX (user's own credentials vs operator relay). Design in the
  A.3 write-up before code.

**Coordination:**
- A parallel session (labeled `parallel:*` in PENDING.md) has been very
  active in this repo — mobile Ariadne, VPS infrastructure, docs, and
  frequent snapshot commits. Look at `git log --oneline -20` before
  touching a file to know if it recently changed. Commit small and often
  so your working tree isn't a shared bucket.
- Use session label `YYYY-MM-DD:identity-wallet` in `PENDING.md` for
  anything you leave uncommitted.
- Deploys are one-at-a-time. Check `PENDING.md` before starting one.

**Ship discipline (from `HANDOFF.md` and `GOTCHAS.md`):**
- Every new `WebContentsView` or `loadFile` — add the target file to
  `TheseusNavigator/package.json` `build.files`. Verify present in
  `dist-public/win-unpacked/resources/app.asar` after build (there's a
  one-liner probe in `GOTCHAS.md`).
- Build: from `TheseusNavigator/`, `SOURCE_DATE_EPOCH=<epoch>
  CSC_IDENTITY_AUTO_DISCOVERY=false npm run dist`. Admin terminal only
  the first time on a fresh machine (winCodeSign symlinks).
- Ship sequence: backup live to `/opt/silent-mode/dl/_prev/`, scp new
  `.exe`s + manifest, `node Argus/src/lib/sia-upload.js ../site
  bns/silentmode`. Rollback commands documented in `PENDING.md` under
  "Last shipment".
- On-chain `releases.silentmode.bch` publishes the manifest URL, not
  fixed hashes — you don't need a wallet spend to make new hashes
  reachable via BCNR unless the URL itself changes.

**Where to start (pick one, in order of user demand):**
1. **A.2 — password autofill.** The user-visible next step. Small enough
   to ship in one round. Users are currently copying passwords from
   Settings; autofill removes that friction. Design detail is in
   `ROADMAP-identity-wallet.md`.
2. **B.1 — wallet design doc.** No code yet. Write
   `DESIGN-integrated-wallet.md`, get user alignment on the permission
   model, then B.2 (injection scaffold + read-only APIs).
3. **A.3 — Sia backup.** Small feature, unlocks cross-device story.
   Blocks on user picking "own creds vs operator relay" default.

**Then tell me what you want to do.** If unspecified, start with A.2
(autofill) — it's the highest-leverage next step in Strand A and the
crypto foundation is already tested + shipped.

**Conventions:**
- Prefix shell commands with `rtk` (user convention, see
  `~/.claude/CLAUDE.md`).
- Windows + PowerShell primary; Bash tool available for POSIX.
- Chipnet only unless explicitly directed to touch mainnet.
- Never ship secrets (`Argus/wallets.json`, `sia-s3.json`,
  `ca/root-ca.key`). The build enforces this; don't weaken the check.
- Never put the operator's name or email in any file.
- Recovery phrases, elevated steps, captchas, and on-chain wallet
  spends are the user's to perform — hand off with exact commands.