# Workflow

- branch from `next`
- do the Next Step: the next open issue in the `1.0.0` milestone
- commit (`TODO.md` changes in the same commit as the work)
- push, and open a PR against `next`

# Status

pre-1.0. Open work is tracked on the issue tracker, which is authoritative.

# Next Step

Take the next open issue in the `1.0.0` milestone:
https://git.eeqj.de/sneak/secret/milestone/12

# Future Steps

- Implement version-number shell completion for the second arg of
  `secret version promote` and `secret version rm` (`internal/cli/version.go`).
- Cover mnemonic-vs-xprv identity consistency in `pkg/agehd/agehd_test.go`
  `TestMnemonicVsXPRVConsistency`.
- No macOS test runs in CI: `internal/secret/pgpunlock_test.go` builds only on
  macOS. A macOS runner would cover it.
- 1.0 critical security blockers:
    - Memory security: age writes an identity's private key out as a string in
      ordinary memory, and the copies it makes on the way stay there
      (`secret.IdentityToLockedBuffer` overwrites only the string itself).
- Medium priority:
    - Standardize error messages; stop leaking internals.
    - Split oversized CLI functions.
- Cleanups: read statedir from environment or default instead of passing it
  around.
- Enhancements: help examples, colored output, --quiet flag, name suggestions on
  miss, audit logging, hardware integration tests (GPG), naming consistency,
  vault export/import, batch operations, search, secret metadata (descriptions,
  tags).