July 13 Roadmap

Julien Béranger

+ Claude Sonnet 5

Issue/PR titles for w3pk, derived from SYNCING_ACROSS_DEVICES.md and IFRAME_IMPLEMENTATION_PLAN.md, following the project's PR naming convention (imperative, sentence case, backticks for code identifiers).

1. Remove AI inspection

  1. Remove AI inspection from the SDK

2. Syncing across devices

  1. Add PRF-based passwordless device sync
    • PRF key derivation in crypto.ts, prf encryption method for backup files, PRF payloads in exportForSync() and syncWalletWithPasskey
  2. Fix fresh-device sync flow
    • Wallet persistence when no local credential exists, remove login requirement from importFromSync, replace the dead-end login error with a typed SyncRequiredError

3. Cross-origin iframe wallet

  1. Add wallet origin with postMessage RPC transport
    • Static bundle at wallet.w3pk.w3hc.org, handshake + origin checks + nonces, SDK becomes a thin RPC client
  2. Move key custody into the wallet origin
    • WebAuthn under the wallet RP ID, HD derivation and EIP-7951 signing in-origin, remove key export from the cross-origin API, one-time credential re-registration flow
  3. Add policy engine and grant approval flow
    • Grant schema and per-origin storage, enforcement pipeline, hard rules for approve/permit and raw-hash signing, mode presets as grant templates, grant management screen
  4. Add confirmation popup
    • Calldata decoding and simulation, fresh WebAuthn assertion for approvals, popup-blocked redirect fallback
  5. Harden and release the wallet origin
    • CSP/COOP/frame-ancestors, onchain build verification of the wallet bundle, hostile-host test suite, service worker for availability, break-glass recovery mirror, SECURITY.md update