NordPass

Build me a focused passwords, privacy and private networking workflow for the personal core of NordPass. Requirements:

- Use Rust, Tauri 2, React, SQLite, Argon2id, and audited cryptographic libraries. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Paid product context: Build a local encrypted vault and simple autofill without claiming audited security. Build only this DIY scope: Build a local encrypted vault with simple autofill, strong encryption, and explicit threat-model documentation, making no claim of replacing an audited password manager.
- For passwords, privacy and private networking, define the master credential, local threat boundary, and recovery path before importing secrets.
- Create, edit, lock, and unlock one encrypted vault using a maintained primitive and explicit key derivation settings.
- Search the unlocked vault and export an encrypted recovery copy with clear user action.
- Use a desktop window with source import, a work list, and result export. Required input or access: desktop OS; secure backup location.
- Recovery: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
- Acceptance: with one labelled sample, show the input, saved intermediate state, and exported result; verify this invariant: A wrong credential must reveal no record content; a recovery import must restore the same record IDs and values.
- Out of scope: security operations, cross-platform apps, breach scanning, recovery, and support; independent security audits. Keep this a personal, inspectable workflow.
- Include a README with setup, a sample input, required keys or permissions, data location, and the supported scope.

# AGENTS.md — Build guide for NordPass

## Project scope
Build a local encrypted vault with simple autofill, strong encryption, and explicit threat-model documentation, making no claim of replacing an audited password manager.

Catalogue verdict: no. A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For NordPass, build a local encrypted vault and simple autofill without claiming audited security. The hard boundary is security operations, cross-platform apps, breach scanning, recovery, and support, plus security assurance, infrastructure, and trust.
Use the implementation prompt below to define the deliverable. Complete each phase's acceptance checks before extending the scope.

## Working agreement
- Inspect the repository and its existing instructions before choosing paths, dependencies or commands. Keep one coherent stack and explain changes to the proposed architecture.
- Plan a vertical slice that accepts a real input and produces the useful output described below. Persist only the state the prompt calls for; respect memory-only and upstream-managed workflows. Use fixtures only when they are clearly labelled.
- After scaffolding, document the actual install, development, check and build commands in README and keep them synchronized with the package or project manifest. Do not report commands as successful unless they ran.
- Work in small steps. At handoff, list implemented flows, checks actually performed, remaining blockers, and any credentials or provider setup the owner must supply.
- Do not publish, spend money, contact customers, delete source data or run irreversible migrations without the project owner's authorization.

## Prerequisites
- desktop OS
- secure backup location
- modern cryptographic libraries
- careful review before real-world use

## Stack and architecture
- Use Rust, Tauri 2, React, SQLite, Argon2id, and audited cryptographic libraries.
- Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Interface for this passwords, privacy and private networking workflow: a desktop window with source import, a work list, and result export.

## Security and data integrity
- Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
- Validate imported records and file paths; keep user data within the storage location named in the prompt.
- State the practical limit: security operations, cross-platform apps, breach scanning, recovery, and support.

## Agent implementation rules
- Project rule, data: Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Project rule, behavior: Keep all vault data encrypted with a master key derived through Argon2id and a unique salt.
- Project rule, recovery: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.

## Optional agent skills and references
No installable skill is listed for this guide; use the project rules and the stack documentation.

Read the linked SKILL.md and its dependencies before adding a skill. Select only the skills matching this project's runtime and task; their documentation does not supply API access, credentials or approval to perform external actions. Pin the reviewed revision where the tool supports it. Follow the chosen agent's documented project-level installation mechanism.

## Distribution ideas
These are optional planning notes. Obtain the owner's approval before publishing or contacting anyone.
- Demonstrate this passwords, privacy and private networking operation with sample or user-owned data: Keep all vault data encrypted with a master key derived through Argon2id and a unique salt.
- Show a concrete result or export: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
- State the practical limit: security operations, cross-platform apps, breach scanning, recovery, and support.

## Engineering roadmap
1. Phase 1, architecture and data: Use Rust, Tauri 2, React, SQLite, Argon2id, and audited cryptographic libraries. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
2. Phase 2, implement: Keep all vault data encrypted with a master key derived through Argon2id and a unique salt.
3. Phase 3, implement: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
4. Phase 4, review and output: Build a local encrypted vault with simple autofill, strong encryption, and explicit threat-model documentation, making no claim of replacing an audited password manager. Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
5. Phase 5, recovery and acceptance: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups. Verify this invariant with a saved fixture: A wrong credential must reveal no record content; a recovery import must restore the same record IDs and values. State the practical limit: security operations, cross-platform apps, breach scanning, recovery, and support.

## Paid-product capabilities outside this build
- security operations, cross-platform apps, breach scanning, recovery, and support
- independent security audits
- global relay infrastructure
- breach monitoring data
- account recovery and support

## Implementation prompt
Build me a focused passwords, privacy and private networking workflow for the personal core of NordPass. Requirements:

- Use Rust, Tauri 2, React, SQLite, Argon2id, and audited cryptographic libraries. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Paid product context: Build a local encrypted vault and simple autofill without claiming audited security. Build only this DIY scope: Build a local encrypted vault with simple autofill, strong encryption, and explicit threat-model documentation, making no claim of replacing an audited password manager.
- For passwords, privacy and private networking, define the master credential, local threat boundary, and recovery path before importing secrets.
- Create, edit, lock, and unlock one encrypted vault using a maintained primitive and explicit key derivation settings.
- Search the unlocked vault and export an encrypted recovery copy with clear user action.
- Use a desktop window with source import, a work list, and result export. Required input or access: desktop OS; secure backup location.
- Recovery: Implement lock timeout, clipboard clearing, password generation, import, export, and encrypted backups.
- Acceptance: with one labelled sample, show the input, saved intermediate state, and exported result; verify this invariant: A wrong credential must reveal no record content; a recovery import must restore the same record IDs and values.
- Out of scope: security operations, cross-platform apps, breach scanning, recovery, and support; independent security audits. Keep this a personal, inspectable workflow.
- Include a README with setup, a sample input, required keys or permissions, data location, and the supported scope.

## Completion evidence
Demonstrate the prompt's acceptance scenarios against the scoped workflow. Include setup from a clean checkout and failure recovery. Check persistence across restart and export/restore only for the state the prompt says to store; for memory-only tools, confirm that temporary content is discarded as specified. Record actual results and remaining limitations. A detailed plan alone does not establish a working replacement.