# TODO

Ordered backlog. `CURRENT.md` tracks the live session state.

## Where the project finished (2026-09-11)

- The validated core bridge is live: a fixed action list, input validation, structured errors, and a
  hard outbound rate limit. See `docs/core-bridge.md`.
- The daemon uses the core bridge. QR login, pacing, the trigger log, the trust list, the context
  cache, and the response policy work.
- Mock tests and a live test passed: state, DM send, and a synthetic trigger through the real event
  path.
- Repo note: use `zib/Veskslop-t` (remote `veskslop-t`) until the original repo's server hook is
  fixed. Pushes to the original land, but its UI and fetch path are broken.

## Deferred

- Voice join and leave, invite-link joins, audio in and out, and video streaming. Text features come
  first.
- Client lightening. Low priority. The client must stay stable.
- Web debug UI and remote client authentication.

## Text features

Done:

- Trusted-only triggers: direct messages and direct mentions.
- Context: the last 15 messages or 4000 characters, whichever is lower. File names only for videos
  and images. Incremental fetch with an old-message cache.
- Context cache in a tmp folder with a size limit.
- Response policy: reply in the origin channel or by DM. Sensitive commands default to DM.
- MCP tools for context and config.

Next:

- Notification parsing: edits, deletes, reactions, replies, and message references.
- Persistent trigger log with rotation.
- Per-user rate limit and command cooldowns.
- More commands: `ask`, `summarize`, `context`, and `config`.
- MCP event delivery for agents. Push or a stateful stream.
- Multi-identity: a read-only collector account beside the puppet.

## Open design questions

- MCP event delivery: the current Streamable HTTP mode is stateless, so the server cannot push
  events. Options are polling, SSE, or a stateful session.
- Untrusted interactions: ignored for now. The daemon keeps the 30-entry untrusted buffer for later.
- Context freshness: the daemon fetches on each mention. Add a TTL or a minimum gap if the query
  cost is too high.