TODO

Ordered backlog. CURRENT.md tracks the live session state.

Where the project finished (2026-09-13)

The validated core bridge is live: a fixed action list, input validation, structured errors, and a hard outbound rate limit. See docs/core-bridge.md.
The daemon uses the core bridge. QR login, pacing, the trigger log, trust tiers, context, the response policy, the continuation window, the persistent action log, and the read-only voice state all work.
Human pacing is live: a fast first send (30-200 ms), burst sends (500-2800 ms), and a variable 5-20 s burst reset. Reads take a small gap. See docs/daemon.md.
User search reads the client cache and guild members. voice.get searches all guilds without a guildId. voice.overview lists occupied channels per guild.
The web UI follows the Nocturne design handoff: the 7a debug shell with the guild rail, message view, voice membership, agent console, Takeover read-only gate, and a Settings slide-over for core process, login, visible guilds, and the action log. Messages fetch the latest 50 on open; attachments use CDN links; avatars and guild icons load from the CDN. Drafts survive reloads. Roadmap surfaces show as placeholders. See docs/webui.md.
dm.list lists cached DM and group DM channels. list_dms exposes it over MCP.
The daemon starts, stops, and restarts the client, and the Settings panel runs the QR login.
Mock end-to-end tests pass: tiers, continuation, sensitive replies, batch MCP, and voice state.
Repo note: use zib/Veskslop-t (remote veskslop-t) until the original repo's server hook is fixed.

The poll command. POLL_ENABLED is false in poc/src/puppet.ts. The parser and tests stay.
The setup command flow. The reaction-based multiple-choice design is on hold.
The LLM attachment and MCP event delivery. Parked by the owner.

Voice auto-leave, stay @user, invite-link joins, audio in and out, and video streaming. The plan is in docs/voice.md. The basic voice actions exist; auto-leave and audio do not.
Client lightening. Low priority. The client must stay stable.
Web UI authentication and remote accounts.

Voice auto-leave (voiceLeaveDelaySeconds) and the stay @user command.
Live verification on the audio host: TTS local + API, ducking, capture, voice.join/ voice.leave end to end, and a full QR approval.
Browser microphone puppeting: a mix sink so the browser mic and TTS share veskslop_mic, a pacat input path, and echo handling.
Speech to text: Vosk (small CPU model in poc/models/) is wired and verified; add more languages or a larger model when needed. VESKSLOP_STT_CMD/_API_URL stay available.
Notification parsing: edits, deletes, reactions, and message references.
Reply-to-puppet counts as a trigger.
Per-user rate limit and command cooldowns.
Collector account: stripped-down read-only modules. Use it when the puppet cannot find a user's voice channel or the channel members.

Ordered after the voice backend unless the owner asks first.

Favourites, presence dots, and real member counts.
MCP tool-call tracing in the console Tool calls tab.
Transcript tab fed by the audio capture and STT.
Yield (stop mid-line) for TTS when a human speaks.
DM scope in the header (the guild picker becomes "Direct messages").
Message editing, deletion, reactions, and history pagination.
The remaining mockup screens: 7b/7c console details, 6b history window, 4b group chat, 2c state legend, 1c phone layout.

Web UI auth. Accepted: no auth, LAN or Tailscale only. Revisit before any wider exposure.
MCP event delivery. Parked. Options when it returns:
1. Poll get_message_log and get_action_log with a since cursor. No new transport work.
2. A stateful Streamable HTTP session. The server can send notifications.
3. A separate local event stream over SSE or a WebSocket.
Untrusted logging. Untrusted interactions are ignored at this time. The separate 30-entry buffer exists but receives nothing. Decide whether to log untrusted DMs and mentions again.
Privacy pass. Only token-shaped and mfa. strings are redacted, and only in the persistent action log. Decide the fuller policy (retention, cache clearing, message redaction) later.