Incogni

Build me a focused passwords, privacy and private networking workflow for the personal core of Incogni. Requirements:

- Use Rust, Tauri 2, React, SQLite, Argon2id, and audited cryptographic libraries. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Paid product context: Track manual data-removal requests and reminders without impersonating the user or bypassing identit. Build only this DIY scope: Track manual data-removal requests and reminders locally with strong encryption, never impersonating the user or bypassing identity checks, and without claiming to replace an audited service.
- For passwords, privacy and private networking, define the master credential, local threat boundary, and recovery path before importing secrets.
- Create, edit, lock, and unlock one encrypted vault using a maintained primitive and explicit key derivation settings.
- Search the unlocked vault and export an encrypted recovery copy with clear user action.
- Use a desktop window with source import, a work list, and result export. Required input or access: desktop OS; secure backup location.
- Recovery: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
- Acceptance: with one labelled sample, show the input, saved intermediate state, and exported result; verify this invariant: A wrong credential must reveal no record content; a recovery import must restore the same record IDs and values.
- Out of scope: broker network, legal authorization, repeated removals, support, and operational scale; independent security audits. Keep this a personal, inspectable workflow.
- Include a README with setup, a sample input, required keys or permissions, data location, and the supported scope.

# AGENTS.md — Build guide for Incogni

## Project scope
Track manual data-removal requests and reminders locally with strong encryption, never impersonating the user or bypassing identity checks, and without claiming to replace an audited service.

Catalogue verdict: no. A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For Incogni, track manual data-removal requests and reminders without impersonating the user or bypassing identity checks. The hard boundary is broker network, legal authorization, repeated removals, support, and operational scale, plus security assurance, infrastructure, and trust.
Use the implementation prompt below to define the deliverable. Complete each phase's acceptance checks before extending the scope.

## Working agreement
- Inspect the repository and its existing instructions before choosing paths, dependencies or commands. Keep one coherent stack and explain changes to the proposed architecture.
- Plan a vertical slice that accepts a real input and produces the useful output described below. Persist only the state the prompt calls for; respect memory-only and upstream-managed workflows. Use fixtures only when they are clearly labelled.
- After scaffolding, document the actual install, development, check and build commands in README and keep them synchronized with the package or project manifest. Do not report commands as successful unless they ran.
- Work in small steps. At handoff, list implemented flows, checks actually performed, remaining blockers, and any credentials or provider setup the owner must supply.
- Do not publish, spend money, contact customers, delete source data or run irreversible migrations without the project owner's authorization.

## Prerequisites
- desktop OS
- secure backup location
- modern cryptographic libraries
- careful review before real-world use

## Stack and architecture
- Use Rust, Tauri 2, React, SQLite, Argon2id, and audited cryptographic libraries.
- Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Interface for this passwords, privacy and private networking workflow: a desktop window with source import, a work list, and result export.

## Security and data integrity
- Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
- Validate imported records and file paths; keep user data within the storage location named in the prompt.
- State the practical limit: broker network, legal authorization, repeated removals, support, and operational scale.

## Agent implementation rules
- Project rule, data: Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Project rule, behavior: Keep all vault data encrypted with a master key derived through Argon2id and a unique salt.
- Project rule, recovery: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.

## Optional agent skills and references
No installable skill is listed for this guide; use the project rules and the stack documentation.

Read the linked SKILL.md and its dependencies before adding a skill. Select only the skills matching this project's runtime and task; their documentation does not supply API access, credentials or approval to perform external actions. Pin the reviewed revision where the tool supports it. Follow the chosen agent's documented project-level installation mechanism.

## Distribution ideas
These are optional planning notes. Obtain the owner's approval before publishing or contacting anyone.
- Demonstrate this passwords, privacy and private networking operation with sample or user-owned data: Keep all vault data encrypted with a master key derived through Argon2id and a unique salt.
- Show a concrete result or export: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
- State the practical limit: broker network, legal authorization, repeated removals, support, and operational scale.

## Engineering roadmap
1. Phase 1, architecture and data: Use Rust, Tauri 2, React, SQLite, Argon2id, and audited cryptographic libraries. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
2. Phase 2, implement: Keep all vault data encrypted with a master key derived through Argon2id and a unique salt.
3. Phase 3, implement: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
4. Phase 4, review and output: Track manual data-removal requests and reminders locally with strong encryption, never impersonating the user or bypassing identity checks, and without claiming to replace an audited service. Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
5. Phase 5, recovery and acceptance: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups. Verify this invariant with a saved fixture: A wrong credential must reveal no record content; a recovery import must restore the same record IDs and values. State the practical limit: broker network, legal authorization, repeated removals, support, and operational scale.

## Paid-product capabilities outside this build
- broker network, legal authorization, repeated removals, support, and operational scale
- independent security audits
- global relay infrastructure
- breach monitoring data
- account recovery and support

## Implementation prompt
Build me a focused passwords, privacy and private networking workflow for the personal core of Incogni. Requirements:

- Use Rust, Tauri 2, React, SQLite, Argon2id, and audited cryptographic libraries. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Paid product context: Track manual data-removal requests and reminders without impersonating the user or bypassing identit. Build only this DIY scope: Track manual data-removal requests and reminders locally with strong encryption, never impersonating the user or bypassing identity checks, and without claiming to replace an audited service.
- For passwords, privacy and private networking, define the master credential, local threat boundary, and recovery path before importing secrets.
- Create, edit, lock, and unlock one encrypted vault using a maintained primitive and explicit key derivation settings.
- Search the unlocked vault and export an encrypted recovery copy with clear user action.
- Use a desktop window with source import, a work list, and result export. Required input or access: desktop OS; secure backup location.
- Recovery: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
- Acceptance: with one labelled sample, show the input, saved intermediate state, and exported result; verify this invariant: A wrong credential must reveal no record content; a recovery import must restore the same record IDs and values.
- Out of scope: broker network, legal authorization, repeated removals, support, and operational scale; independent security audits. Keep this a personal, inspectable workflow.
- Include a README with setup, a sample input, required keys or permissions, data location, and the supported scope.

## Completion evidence
Demonstrate the prompt's acceptance scenarios against the scoped workflow. Include setup from a clean checkout and failure recovery. Check persistence across restart and export/restore only for the state the prompt says to store; for memory-only tools, confirm that temporary content is discarded as specified. Record actual results and remaining limitations. A detailed plan alone does not establish a working replacement.