# Vaultik 1.0 TODO

Remaining tasks before 1.0 release.

## Must-fix

1. Scanner uses bare `fmt.Printf` (bypasses `--cron` silence)
   - Route all user-facing output through a writer gated by progress/cron flags
   - Affects `internal/snapshot/scanner.go` (~24 bare print calls)

1. S3 client error type checking
   - `internal/s3/client.go:207` has a TODO for proper error type checking

1. Error message polish
   - Add actionable suggestions for common failures (missing config, bad
     storage URL, failed S3 auth, missing age key on restore/verify)
   - Only `restore.go` currently has the "did you set VAULTIK_AGE_SECRET_KEY?" hint

## Done

- [x] Rclone storage backend
- [x] Release process (goreleaser, CGO-free cross-compile, checksums)
- [x] End-to-end integration test (backup → restore → verify → byte-compare)
- [x] Restore integration tests
- [x] `--prune` flag on `snapshot create` (per-name retention + orphan blob cleanup)
- [x] Per-name purge retention (`--keep-latest` per snapshot name, `--snapshot` filter)
- [x] CLI surface dedup (removed top-level `purge` and `verify` duplicates)
- [x] Exit codes (create/restore now exit non-zero on failure)
- [x] Deep verify implemented and wired up
- [x] Shallow verify timestamp parsing fixed
- [x] Daemon mode removed
- [x] Makefile targets separated (`lint`/`test`/`fmt`/`check`)
- [x] CGO eliminated (pure-Go SQLite via modernc.org/sqlite)
- [x] Version set correctly in releases via goreleaser ldflags

## Post-1.0

1. Edge-case tests (empty dirs, symlinks, special chars, multi-GB files, 100k+ small files)
1. Error-condition tests (network failures, disk full, corrupted/missing blobs)
1. Parallel blob downloads during restore
1. Bandwidth limiting (`--bwlimit`)
1. Security audit of encryption (verify no plaintext leaks, correct hash computation)
1. Man pages / richer `--help` examples
1. Tag and release v1.0.0