70 lines
4.4 KiB
Markdown
70 lines
4.4 KiB
Markdown
# Persimmons 0.3.8 acceptance
|
|
|
|
Architecture A: account → install extension → link/create encrypted vault → ready.
|
|
The homepage presents only the current step. Installation instructions are in the
|
|
product at `/assets/install.html`. “Linked” means the extension has validated the
|
|
current account and host permission; locked/unlocked describes the separate
|
|
memory-only key session. Merely detecting the extension never means linked.
|
|
An unlocked empty vault explicitly says it is empty. A current installation has
|
|
neither Get nor Update. Settings visibility is unchanged.
|
|
|
|
Why not B now: the server derives ciphertext ownership from its authenticated
|
|
account cookie. The extension has a local, passphrase-wrapped encryption key, not
|
|
a server-authenticated device identity. B requires a separately designed device
|
|
registration and challenge/signature authentication protocol, server ownership
|
|
bound to that identity, revocation, and an explicit authenticated account-linking
|
|
transaction. Cross-profile use additionally requires an explicit wrapped-key
|
|
transfer design. None of these are implemented by treating a local hint or key as
|
|
server authority. This release adds no recovery or key sync.
|
|
|
|
Plain Enter submits the unlock form. A failed passphrase remains masked in the
|
|
open popup for retry; successful unlock, locking, closing, or lost authentication
|
|
clears it. The page receives only owner-validated connection/version and boolean
|
|
initialized/unlocked/empty metadata, never item metadata, secrets, or key material.
|
|
Existing origin checks, encryption, no-reveal, explicit save/fill, and timed
|
|
memory-only sessions remain in force.
|
|
|
|
## Single user retest script
|
|
|
|
1. In a fresh Chromium profile, open https://persimmons.app and follow the one
|
|
displayed next step: create account, install using the in-product instructions,
|
|
then open 🍊, **Link vault**, allow Persimmons access, choose a vault passphrase,
|
|
and press plain **Enter**. The popup says **Unlocked** and **Your vault is empty**.
|
|
2. In **Settings · Auto-lock**, select **After 15 minutes**, then unlock with Enter.
|
|
Close 🍊, wait 40 seconds, and reopen. It remains unlocked. Return to the homepage:
|
|
it says **Your vault is empty**, with no Get, Update, or unlock prompt.
|
|
3. On an allowed HTTPS login form (the disposable browser check uses
|
|
https://wp.phly.cloud/wp-login.php), open 🍊 → **Save for this site** and save a
|
|
disposable username/password. Select it and **Fill**: fields fill, without
|
|
submitting. **Delete** it: the vault becomes empty again.
|
|
4. **Lock vault**. Try a wrong passphrase with Enter: it remains masked in the
|
|
field with a retry message. Enter the correct one: unlock succeeds. Sign out
|
|
of Persimmons and reopen 🍊: it requires linking again and cannot fill.
|
|
|
|
Automation: `node tests/persimmons-host-browser.cjs` runs the same real Chromium
|
|
popup interactions against disposable live accounts, including logout, account
|
|
switch, host-permission revocation, and explicit contradictory-state assertions.
|
|
Requires Playwright and its Chromium; `PERSIMMONS_PLAYWRIGHT_MODULE` and
|
|
`PERSIMMONS_CHROMIUM` can select existing installations. `PERSIMMONS_LOCAL_UI=1`
|
|
uses candidate page assets with the real server transport before deployment.
|
|
Generated screenshots contain no secret field values.
|
|
|
|
## Candidate evidence — 2026-09-30
|
|
|
|
Canonical starting SHA: `97b445db4957d29f059c80f83d30af5da03a701d`,
|
|
fetched with ahead 0 / behind 0 and a clean worktree. No delegation.
|
|
All eight extension Node test files passed. Eleven Python host, packaging,
|
|
updater, ownership, encryption, and MCP no-reveal tests passed; the new install
|
|
asset also passed host serving checks. A worker regression test proves that
|
|
page status requests cannot cancel an in-progress unlock or lock another owner.
|
|
|
|
The final Chromium candidate run passed with a fresh profile, live authenticated
|
|
server transport, candidate page assets, and the actual extension action popup.
|
|
It asserted account → installation → linking, Enter unlock, retained wrong
|
|
passphrase, save/fill/delete with no form submission, default-close locking,
|
|
15-minute policy surviving real popup destruction plus 40 seconds idle,
|
|
unlocked-empty agreement between page and popup, absent Get/Update for the
|
|
current build, logout denial, account-switch denial, and revoked-permission denial.
|
|
Hero copy and the secondary 40px vault flow were checked in Chromium; the
|
|
screenshot was visually reviewed with emoji fonts installed.
|