---
title: July 13 Roadmap
description: PR titles for w3pk's roadmap: AI inspection removal, passwordless device sync, and a cross-origin iframe wallet.
date: 2026-09-13
lang: en-US
author: Julien Béranger
model: Claude Sonnet 5
source: https://julienberanger.com/w3pk-july-13-roadmap
---

# July 13 Roadmap

Issue/PR titles for w3pk, derived from [SYNCING_ACROSS_DEVICES.md](SYNCING_ACROSS_DEVICES.md) and [IFRAME_IMPLEMENTATION_PLAN.md](IFRAME_IMPLEMENTATION_PLAN.md), following the project's PR naming convention (imperative, sentence case, backticks for code identifiers).

---

## 1. Remove AI inspection

1. Remove AI inspection from the SDK

## 2. Syncing across devices

2. Add PRF-based passwordless device sync
   - PRF key derivation in `crypto.ts`, `prf` encryption method for backup files, PRF payloads in `exportForSync()` and `syncWalletWithPasskey`
3. Fix fresh-device sync flow
   - Wallet persistence when no local credential exists, remove login requirement from `importFromSync`, replace the dead-end login error with a typed `SyncRequiredError`

## 3. Cross-origin iframe wallet

4. Add wallet origin with postMessage RPC transport
   - Static bundle at `wallet.w3pk.w3hc.org`, handshake + origin checks + nonces, SDK becomes a thin RPC client
5. Move key custody into the wallet origin
   - WebAuthn under the wallet RP ID, HD derivation and EIP-7951 signing in-origin, remove key export from the cross-origin API, one-time credential re-registration flow
6. Add policy engine and grant approval flow
   - Grant schema and per-origin storage, enforcement pipeline, hard rules for `approve`/`permit` and raw-hash signing, mode presets as grant templates, grant management screen
7. Add confirmation popup
   - Calldata decoding and simulation, fresh WebAuthn assertion for approvals, popup-blocked redirect fallback
8. Harden and release the wallet origin
   - CSP/COOP/frame-ancestors, onchain build verification of the wallet bundle, hostile-host test suite, service worker for availability, break-glass recovery mirror, SECURITY.md update