Repository navigation
Quick Unlock with Touch ID #12
Description
Unlock with Touch ID instead of typing the Master Password after every lock. This is the biggest daily cost left (ADR-0006), planned for v1.1.
Constraints (ADR-0003)
- Never use
.userPresence: it falls back to the Mac login password. Biometry only (BIOMETRY_CURRENT_SET). - Pick one design: a data-protection Keychain item created from Rust (
security-framework, needs a provisioning profile), or a small Swift helper holding a Secure Enclave key whose blob lives in our own file. - Needs a signed build and real hardware to test.
Mac first. Windows Hello comes later.
Delivery
Merged PR: #36. This delivered the design or validation runbook only. The implementation or physical/operational checks remain pending, so this issue stays open.
Activity
nniiovoo commentedon Oct 21, 2026
The implementation selects the local Secure Enclave file-blob option. The Rust custody, native-control and Swift adapter foundations are merged in PRs #60–62. The adapter uses biometric-current-set protected key agreement and wrapping; it creates no permanent Keychain item and needs no Apple Developer login, provisioning profile or hosted service. An ad-hoc local test build is used for development; that is not Developer ID distribution or notarization.
The live enrollment/unlock wiring is in draft PR #63. Its final runtime source passed 610 Rust tests, strict macOS/Windows-target Clippy, formatting, frontend and source checks, with independent native-callback review. Actual protected Secure Enclave release, finger acceptance/cancellation, lifecycle transitions and the remaining hardware matrix have not been established. This issue remains open for those observations. No real owner Vault or key was used.
nniiovoo commentedon Nov 2, 2026
Reopened. PR #103's description said not to close this issue, and GitHub read that wording as a closing keyword when the PR merged. The hand checks on a real Mac are still to do, so this stays open until they pass.