TODO

Ordered backlog. CURRENT.md tracks the live session state.

Where the project finished (2026-09-11)

The validated core bridge is live: a fixed action list, input validation, structured errors, and a hard outbound rate limit. See docs/core-bridge.md.
The daemon uses the core bridge. QR login, pacing, the trigger log, the trust list, the context cache, and the response policy work.
Mock tests and a live test passed: state, DM send, and a synthetic trigger through the real event path.
Repo note: use zib/Veskslop-t (remote veskslop-t) until the original repo's server hook is fixed. Pushes to the original land, but its UI and fetch path are broken.

Voice join and leave, invite-link joins, audio in and out, and video streaming. Text features come first.
Client lightening. Low priority. The client must stay stable.
Web debug UI and remote client authentication.

Done:

Trusted-only triggers: direct messages and direct mentions.
Context: the last 15 messages or 4000 characters, whichever is lower. File names only for videos and images. Incremental fetch with an old-message cache.
Context cache in a tmp folder with a size limit.
Response policy: reply in the origin channel or by DM. Sensitive commands default to DM.
MCP tools for context and config.

Notification parsing: edits, deletes, reactions, replies, and message references.
Persistent trigger log with rotation.
Per-user rate limit and command cooldowns.
More commands: ask, summarize, context, and config.
MCP event delivery for agents. Push or a stateful stream.
Multi-identity: a read-only collector account beside the puppet.

MCP event delivery: the current Streamable HTTP mode is stateless, so the server cannot push events. Options are polling, SSE, or a stateful session.
Untrusted interactions: ignored for now. The daemon keeps the 30-entry untrusted buffer for later.
Context freshness: the daemon fetches on each mention. Add a TTL or a minimum gap if the query cost is too high.