M6 [P0]: Delete fabricated e2ee/ai/plugin modules (fake crypto verification) #244

New Issue

2026-07-31T14:40:25Z

KofTwentyTwo commented

2026-07-31 14:40:25 +00:00

(Migrated from github.com)

nuncio-core/src/e2ee.rs performs NO real crypto: verify_openpgp_signature returns Valid from signature.contains("BEGIN PGP SIGNATURE") && expected_fingerprint.len()>=8 (comment: 'Simulating ... verification logic'); verify_smime_signature returns Valid for ANY non-empty PKCS7 bytes, ignoring the payload — emitting 'SIGNED & ENCRYPTED'/'S/MIME VERIFIED' badges for unverified content. ai.rs returns canned summaries/replies with no Ollama call; plugin.rs is a sandbox that executes nothing. All three are the explicitly-deferred features (#79 E2EE, #81 AI, #80 plugins), pub-exported from lib.rs but wired nowhere, with tests asserting on the fabricated output.

Goal: DELETE all three modules + their lib.rs pub mod/pub use exports + their fabricated-output tests. Deferred features must be ABSENT, not fake-present. If any shared type (e.g. SecurityBadge) is referenced elsewhere, verify with a workspace grep first (audit found none). This removes the single most dangerous fabrication in the tree.

Source: full-tree audit 2026-07-30 (scratchpad/audit/AUDIT-SUMMARY.md). Follow docs/STORY-WORKFLOW.md: engine+proto(if surface)+CLI+offline E2E, mock-only tests, no fabricated data, comment convention, PR to dev, PO reviews before close.

`nuncio-core/src/e2ee.rs` performs NO real crypto: `verify_openpgp_signature` returns Valid from `signature.contains("BEGIN PGP SIGNATURE") && expected_fingerprint.len()>=8` (comment: 'Simulating ... verification logic'); `verify_smime_signature` returns Valid for ANY non-empty PKCS7 bytes, ignoring the payload — emitting 'SIGNED & ENCRYPTED'/'S/MIME VERIFIED' badges for unverified content. `ai.rs` returns canned summaries/replies with no Ollama call; `plugin.rs` is a sandbox that executes nothing. All three are the explicitly-deferred features (#79 E2EE, #81 AI, #80 plugins), `pub`-exported from lib.rs but wired nowhere, with tests asserting on the fabricated output. Goal: DELETE all three modules + their lib.rs `pub mod`/`pub use` exports + their fabricated-output tests. Deferred features must be ABSENT, not fake-present. If any shared type (e.g. SecurityBadge) is referenced elsewhere, verify with a workspace grep first (audit found none). This removes the single most dangerous fabrication in the tree. Source: full-tree audit 2026-07-30 (scratchpad/audit/AUDIT-SUMMARY.md). Follow docs/STORY-WORKFLOW.md: engine+proto(if surface)+CLI+offline E2E, mock-only tests, no fabricated data, comment convention, PR to dev, PO reviews before close.

KofTwentyTwo commented

2026-07-31 14:52:53 +00:00

(Migrated from github.com)

Delivered via PR #261 (squash-merged to dev). Deleted the fabricated e2ee/ai/plugin modules (fake PGP/S-MIME 'verification', canned AI, no-op plugin sandbox) + their lib.rs exports + their fabricated-output tests — 442 deletions, nothing added. Grep confirmed zero external references and no orphaned fixtures. The deferred features #79/#80/#81 are now honestly ABSENT rather than fake-present. Removes the most dangerous fabrication the audit found.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio#244