# Tasks: note and secret-folder encryption design (roadmap 34)

Spec: `spec.md`. DESIGN ONLY: every OWNS path stays below this feature directory; no cargo/code/dependency edits. Tasks are sequential reviewable documents, individually checked against explicit cases. Existing source paths are inspection inputs, never writable in this phase.
**First tool call rule:** read at most three listed inputs in first call; write FIRST OWNS document in SECOND call with initial checklist, then complete it. Code-stub/failing-test rule intentionally replaced with document acceptance cases because no crypto code is authorized.
**Standing VERIFY:** resolve each referenced existing path with `rg --files`; compare document to spec acceptance matrix and cited primary sources; check no secret values/examples and no runnable crypto. Do not run cargo during this design phase.
**Standing DO NOT:** change code/Cargo/git state; add dependency; implement encryption/decryption/KDF/RNG; weaken unsafe policy; freeze algorithm/format without owner approval; claim secure erasure.

- [ ] 1. Threat model and trust boundaries.
  OWNS: `specs/plugins-parity/note-encryption/threat-model.md` (new, FIRST).
  FILES TO OPEN: `specs/plugins-parity/note-encryption/spec.md` D1; `crates/engine/src/vault/session.rs`; `crates/vault/src/lib.rs`.
  GOAL: asset/adversary/trust-boundary table for per-note and folder domains; separate locked/unlocked behavior, metadata and prior backups; explain local-at-rest vs sync E2EE; owner Q1/Q4 decision checklist with explicit pending status.
  TESTS: tabletop cases stolen locked vault, replayed old ciphertext, swapped object, hostile same-user process while unlocked, plaintext shared attachment, known filename and old snapshot; each maps protected/excluded/blocked plus reason.
  VERIFY: standing; D1 and acceptance 1/4 traced with no undocumented assumption.
  DO NOT: crypto snippets, promise zero knowledge or rollback protection, approve own threat model.
- [ ] 2. Container format and bounded parser design.
  OWNS: `specs/plugins-parity/note-encryption/format.md` (new, FIRST).
  FILES TO OPEN: spec D2; task 1 threat model; `crates/engine/src/vault/attachments.rs`.
  GOAL: byte-by-byte candidate envelope, endian/length encoding, AEAD associated-data byte layout, encrypted manifest/object identity, key-slot integrity, versioning and pre-KDF bounds. Record AES-GCM/Argon2id as proposed; list dependency/RNG review questions. No format claims frozen before independent review.
  TESTS: design vectors for truncation at every field, oversized lengths/KDF cost, nonce reuse across retries, object swap, tampered header/tag, missing manifest object, unknown suite and version; specify expected rejection stage.
  VERIFY: standing + field/length/AAD consistency review; RFC 9106 parameter rationale measured-plan required.
  DO NOT: choose unapproved crate or write toy crypto; pass arbitrary hostile KDF cost to runtime.
- [ ] 3. Key state machine and migration failure matrix.
  OWNS: `specs/plugins-parity/note-encryption/key-lifecycle.md` (new, FIRST), `specs/plugins-parity/note-encryption/migration.md` (new).
  FILES TO OPEN: spec D3–D4; `crates/engine/src/vault/buffers.rs`; `crates/engine/src/sync/worker.rs`.
  GOAL: unlock/lock state transitions, dirty save error/cancel, zeroization limits, rotation/key-slot recovery, idle/suspend races, session-only defaults and keychain/recovery alternatives; crash-safe atomic migration sequence and explicit plaintext removal authorization point.
  TESTS: tabletop wrong password, closed dirty tab, crash after every migration stage, low disk on lock, passphrase change interrupted, sync old key slot, forgotten password, OS lock during extraction; preserve work without claiming locked after failure.
  VERIFY: standing; each state transition names data retained/cleared and error behavior; key material never enters settings/logs/command params.
  DO NOT: guarantee wiping SSD/swap/backups; silently delete plaintext; implement keychain.
- [ ] 4. Leakage integration inventory and owner review package.
  OWNS: `specs/plugins-parity/note-encryption/integration-review.md` (new, FIRST), `specs/plugins-parity/note-encryption/approval-checklist.md` (new).
  FILES TO OPEN: spec acceptance/questions; `crates/engine/src/vault/find/content_search.rs`; `crates/engine/src/ai/assistant_gate.rs`; later inspect `crates/engine/src/vault/pdf_preview.rs`, `crates/engine/src/vault/attachments.rs`, `crates/engine/src/sync/worker.rs`.
  GOAL: input/output/cache/history/trash/preview/OCR/export/AI/plugin/share/capture matrix, verified source path per boundary, proposed locked behavior and future regression test. Prepare owner questions with exact proposed dependencies only after safe-Rust/security/license investigation. Future implementation must have new approved spec/tasks; if new crypto crate chosen, first task explicitly owns/registers `crates/crypto/Cargo.toml`, `crates/crypto/src/lib.rs`, root `Cargo.toml` workspace dependency and `xtask/src/layers.rs` layer entry.
  TESTS: known encrypted path via all external command surfaces while locked denied; worker late publication after lock; stale index/cache snippets; shared attachment reference leakage; encrypted sync conflicts. Each unresolved surface blocks implementation approval.
  VERIFY: standing; trace all five spec acceptance criteria and Q1–Q4 to checklist; no approvals inferred.
  DO NOT: implement future task, modify root docs/status as shipped, mark design approval granted.