diff options
Diffstat (limited to 'tmp-decisions.md')
| -rw-r--r-- | tmp-decisions.md | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/tmp-decisions.md b/tmp-decisions.md index 347d771..76d33d2 100644 --- a/tmp-decisions.md +++ b/tmp-decisions.md @@ -11,10 +11,14 @@ | # | Decision | State | |---|---|---| | D1 | Does the hub keep serving the web UI? | ✅ **DECIDED 2026-08-13 — yes** | -| D2 | Browser extension, native desktop client, or both? | ✅ **DECIDED 2026-08-13 — native client, offered alongside the hub-served SPA** | -| D3 | Transport: aiortc primary, QUIC at parity, TCP+HTTP removed | ✅ Decided 2026-08-13 | +| D2 | Browser extension, native desktop client, or both? | ✅ **DECIDED 2026-08-13 — native client, offered alongside the hub-served SPA.** Shell revised 2026-08-17: **Electron**, see `docs/desktop-client-v1.md` | +| D3 | Transport: aiortc primary, QUIC at parity, TCP+HTTP removed | ✅ Decided 2026-08-13. Unchanged for the **node**; the desktop client uses Chromium's WebRTC rather than aiortc, and QUIC via a Python sidecar | | D4 | Hub minimization (old Phase 12) | ⏸️ **Deferred, may be dropped** | +> **2026-08-17 — the browser-extension options are no longer live.** 12.2 (signed digest +> of the served bundle) is what Option A needed, and it remains scheduled; nothing else +> from A or B is planned. The desktop client is the answer to T3 for users who want one. + **What was decided.** The hub keeps serving the web UI — that is the zero-install path and it stays. A native desktop client is offered *in addition*, not as a replacement. Hub minimization is off the critical path and may be dropped entirely. @@ -103,10 +107,24 @@ hub operator does not control**. Manifest V3 forbids remote code, which works in the structure enforces exactly what we want. Keys live in extension storage, isolated from page JS. Moderate effort. -**Option C — Native desktop client (pywebview + aiortc)** ← **CHOSEN** +**Option C — Native desktop client** ← **CHOSEN** Phase 13. Full control, durable keys in an OS keystore, QUIC, hub-less access, best UX. Highest effort, and the security argument depends on 18.7. +> **Shell revised 2026-08-17: Electron, not pywebview** (+ an optional Python sidecar for +> `group://` over QUIC). See `docs/desktop-client-v1.md` §2. The comparison table below +> was written against pywebview and **two of its rows are wrong for the chosen shell**: +> +> - *Browser sandbox* — Electron with `sandbox` and `contextIsolation` **keeps** the +> Chromium renderer sandbox. The row reads "❌ None (partial under Flatpak)"; that was +> WebKitGTK's property, not native's. +> - *Crypto available* — the client keeps WebCrypto **and** gains local Argon2id/ChaCha20 +> in the main process; the row implied WebCrypto is lost with the browser engine. +> +> The row that gets *worse*: **patch velocity**. "You own it" is more true of Chromium +> than of a distro-maintained WebKitGTK, and the renderer parses attacker-controlled +> content from nodes. That is the real cost and it is accepted deliberately. + ### Comparison | | Hub-served SPA (today) | A: extension verifies | B: extension ships UI | C: native desktop | |