Rust desktop wallet: chat + compute + money in one app · wallet-app/README.md

Qal Wallet — the Qoll guards your coins

Created 2026-09-08 by qalcode (project: crypto_currency) · v2 2026-09-09 (desktop-first) · v3 2026-09-09 (messenger-grade chat + channels) · v5 2026-09-09 (Slack-class social: workspaces · threads · reactions · presence · search) · v7 2026-09-11 (passkey/WebAuthn login gate — graceful where the webview lacks WebAuthn)

A Rust Tauri 2 desktop wallet that unifies wallet + chat + compute: your B-QALS balance, your encrypted qalchat conversations (with ⚡ value-attached messages), and a live view of what your tokens do — compute on the Qals P2P marketplace at live prices.

User directive this app implements: "the message chat system could basically be one and the same with it. The compute section can show the value of this token as compute."

Desktop-first 3-pane layout (1280×800 min, resizable, maximise button), dark qalarc theme, vanilla HTML/CSS/JS — no npm, no frontend build step.

┌───────────┬──────────────────────────────┬──────────────────┐
│ SIDEBAR   │ MAIN COLUMN                  │ CONTEXT PANE     │
│ logo/nav  │ active tab content           │ selected peer's  │
│ service   │  (wallet, thread, contacts,  │ verification     │
│ pills     │   compute, files, agents)    │ state / job      │
│           │                              │ receipt+anchor / │
│ 🔒 lock   │                              │ my qoll code     │
│ @handle   │                              │                  │
│ qoll-code │                              │                  │
└───────────┴──────────────────────────────┴──────────────────┘
   src-tauri/src/main.rs — thin command layer:
     ureq HTTP ──► loopd :8823 (HMAC X-Sig) · relay :8830 · qmarket :8824
     std::process ─► qalchat/qalchat.py   (all chat/file crypto)
                   ├ qalchat/vault.py     (app password → AES-GCM vault)
                   └ seedkit/derive.py    (BIP-39 → qal-derivation v1)

Keyboard: Ctrl/Cmd 1–6 switch panes · Ctrl/Cmd L lock · Esc dismiss banner / close drawer · Enter sends.

qoll codes — the primary addressing UX

Every identity gets a short human code derived deterministically from its keys: qoll-XXXX-XX (lowercase). invites.id_code() reuses the exact qalchat-fp-v1 fingerprint preimage — a code is simply the first 6 base32 chars of the contact's fingerprint, lowercased, so code and fingerprint can never disagree (unit-tested byte-for-byte in Rust vs python).

• Your code is shown big: onboarding success screen ("your messaging code — share it, people find you with it"), the sidebar account card, and the context pane (click to copy).
• Add a person: type their handle → wallet resolves their keys via the relay keyserver → shows their code → pins with an explicit TOFU warning ("this key is whatever the keyserver answered FIRST — confirm the qoll code out-of-band"). Pasting a full qalchat://invite?… URI takes the stronger signed-invite path instead.
• Codes are an addressing/spot-check aid, not a security boundary — the full fingerprint + invite signature remain the verification instruments.

Value attached to messages, first-class

The composer has an attach menu (📎): 📷 Image · 📄 File · ⚡ Attach Qals · 🔒 Locked content. Attaching value is now exactly like attaching a picture: pick ⚡, set an amount (live doof equivalent shown — 1 QALS = 1,000,000 doof), hit Confirm & attach — a removable gold chip stages on the composer and the loopd transfer fires with your next message. In the thread it renders as the permanent gold value badge (⚡ 0.01 QALS) with the settle id — hover shows the doof equivalent. Plain ⚡ Pay from the same row sends payment-only, as before.

v3 — the Chat tab is a real messenger (Telegram/Signal-grade)

The chat tab is now a two-column shell inside the desktop 3-pane layout: a conversation rail + the open thread. Still vanilla JS, no npm.

Bubbles & thread

• Own messages right-aligned green-tinted, peer messages left; sender line, timestamps, #ctr and per-message hash in the meta row.
• Ticks: outgoing ✓ (delivered via relay) → ⚓ (included in an on-chain anchor) once you anchor the conversation.
• Day separators (Today / Yesterday / date), auto-scroll, and a "↓ new messages" pill when messages land while you're scrolled up.
• Composer: paperclip attach menu, 😀 emoji quick row, Shift+Enter newline, auto-growing input.

Attach menu (the Signal/Telegram model — value is just an attachment)

Locked content (qalpub protocol)

• Received locked messages (real qalpay.py send-locked manifests, or the mock marker) render as blurred preview cards: price badge (hover = doof), "Unlock for X Qals" button → qalpay.py buy-unlock <id> --as <me> (intent → pay → escrow redeem → decrypt → sha-verify → saved into your downloads) → card flips to unlocked inline (progress bar → success animation; images render in place, text files scroll inline).
• Outbound: Seal & send uploads blobs, registers the listing and drops a LOCKED-MANIFEST into the peer's thread — one button, priced content.

Media rendering

Received files (qalchat.py recv-files) hydrate into their message bubbles: images inline (bounded 4 MB reads, img-src data: CSP already allowed), everything else as sha256 file cards. Outbound attachments are remembered so your own sends render the same way.

Find / mute / unread

• 🔍 find-in-conversation (Enter cycles hits, current hit highlighted).
• 🔕 mute per conversation (kills unread badges; persisted in settings).
• Unread badges per conversation row + a total badge on the sidebar Chat item. Muted conversations don't count.

Channels (Discord-model, under Chat)

• Rail section Channels: browse the qalpub public index (# prefixed rows, topic, post count / member hint, anchored-digest badge showing the last digest tx).
• Open a channel → post timeline with author (loopd prefixes stripped), timestamps and sig ✓ / sig ⚠ verification chips (tampered posts are shown but marked), attachment posts render as file cards. Post with Enter. Context pane shows the channel's digest state. Note in the rail: "servers / roles coming".

qalpub protocol wiring — real vs mock

The full contract is wired for real; a --mock dev toggle keeps the UI alive when the qalpub server is down:

Mode toggle (Settings drawer → qalpub protocol): auto (default — real CLIs when detected, mock otherwise) / mock (force the in-app mock store: channels, posts and demo listings incl. a real-image unlock flip) / real (require the CLIs; pending states otherwise). Every degraded state is explicit in the UI (live / mock / pending chips) — never silent. QALPUB_HOME env overrides the qalpub dir (default: qalpub/ next to qalchat/).

v4 — the "qal-fly" design system (Firefly-derived UI, 2026-09-09)

User complaint: "UI of all the apps should be improved. some lines get cut and some displays are not good. Review and redo many of the app design features… Look at the repos with Firefly app for reference on design styles."

The whole UI was rebuilt against Firefly (IOTA's official wallet) — its design system lives in repos/firefly/packages/shared (tailwind.config.js, Tile/Box/Pill components, dashboard Sidebar). Extracted values are credited in the token block at the top of ui/styles.css:

Layout changes

• Sidebar: Firefly-style grouped nav — section labels WALLET / SOCIAL / MARKET / SYSTEM, icon+label items with blue active state, service pills, and an account chip at the bottom (avatar initial · @handle · qoll-code).
• Main area: page headers (title + subtitle + context actions) and content in a 12-col responsive grid (.cols2 spans 6/6, collapses to full width).
• Balance hero: Firefly dashboard-style summary card — big tabular balance, AU$ reserve badge, G-QALS line, and a quick-action tile row (Send / Mint / Buy compute).
• Context pane: detail panel with divider sections (.cx-card), key/value rows — no more boxes-in-boxes.
• Components: 36px buttons (teal primary / ghost / gold / destructive + focus rings), filled-dark inputs with focus glow, status badges/chips, toast system, skeleton loaders on async lists, empty states with CTA.

Cut-line fixes (the explicit complaint)

• Global anti-clip discipline: min-width: 0 on flex children holding text, overflow: hidden + text-overflow: ellipsis for one-liners, word-break: break-word for message bodies/titles — no fixed-height text containers anywhere (min-height only).
• .mono-trunc + JS mid() helper: hashes/fingerprints/tx ids render as middle-ellipsis 0x1234…abcd (full value on hover via title).
• font-variant-numeric: tabular-nums on balances, amounts, prices, timestamps — numbers no longer jitter or overflow their column.
• Chat polish: bubbles max-width 72% with 10-12px padding, consecutive messages grouped (.grp), meta row (time + ✓/⚓) moved outside the bubble edge, locked cards keep blur + lock overlay (unlock flips clear), attach menu is a floating popover, channel rows show # icon + digest-tx on hover, 30 inline styles in index.html replaced with utility classes.

Audit

bash wallet-app/ui/audit.sh (45 checks): token block present · zero inline styles in index.html · all 218 class references in app.js+index.html defined in styles.css · mono-trunc + mid() wired · anti-clip + tabular-nums rules present. Screenshot of the running app: ui/audit-v3.png. Prior UI files are archived at ui/archive/ (*_v3q_20260909.*).

v5 — Slack-class social layer (workspaces · threads · reactions · presence)

2026-09-09. Chat graduated from "channels" to a full Slack-class interface on the qalpub v2 backend (see qalpub/README.md § C). All new traffic rides three generic IPC bridges (qalpub_get/post/delete, native ureq → http://127.0.0.1:8832, path-locked to the local origin because the webview CSP forbids direct fetch). Signature-required writes (posts + thread replies) still go through the signed-CLI path (qalch_post, now with reply_to).

What the Chat tab does now

• Workspace switcher at the top of the rail: ⚑ name dropdown (persisted in settings) + ＋ → inline Create/Join row. A selected workspace scopes the channel tree (and search + context) to it; "— all channels —" keeps the legacy flat view.
• Channel tree with unread dots — posts_count tracked against a per-channel seen marker (S.chSeen); opening a channel marks it read. ＋ next to Channels creates a channel inside the active workspace.
• Threads — click any channel post → the right context pane becomes the thread: parent card (sig chip, reactions), replies list, and a reply composer with @mention autocomplete. Replies are real signed posts (--reply-to); reply counts show inline as a 💬 n replies badge.
• Reactions — hover a post → action bar (🙂 react · 💬 thread · 📌 pin). The picker offers 👍❤️😂🎯🔥👀 plus custom shortcodes :qoll: 🦘, :doof: 🎺, :qals: ⚡, :rocket: 🚀. Chips show count + who (title), mine highlighted; clicking a chip toggles (dup adds are 409-refused server-side, the UI pre-checks and DELETEs instead).
• Pins — 📌 on the hover bar toggles; pinned posts render in a pinned strip under the channel header; click a pin → opens its thread.
• @mention autocomplete — in the channel composer, DM composer, and thread composer: type @ → candidate list (workspace members + contacts + conversation peers), ↑↓/Tab/Enter/click to complete, esc closes. Mentions in rendered posts are highlighted (qalpub also parses them server-side into mentions[], queryable via /mentions).
• Search — a search box in the SOCIAL rail header (Enter): workspace- scoped public-post search → results drawer (channel, author, time, sig ✓/⚠, highlighted snippet). Clicking a result opens the channel AND its thread.
• Presence — green/amber/grey dots in the DM list and member lists (context pane + workspace card), fed by qalpub beacons (90 s TTL, polled every ~12 s). The wallet beacons its own liveness while you're on the Chat tab. Honest: relay-observed, not attested.
• Typing indicator (DMs) — typing in the DM composer sends 5 s-TTL beacons (throttled 3 s); the peer's thread header shows ✍ typing….

Files & tests

• ui/index.html — rail workspace bar + create/join rows, channel create row, pinned strip, mention popups (DM/channel/thread), reaction picker, search drawer, typing chip.
• ui/app.js — v5 social section (~450 lines): workspaces, threads, reactions, pins, search, presence/typing, autocomplete; rail/posts/context renderers extended.
• ui/styles.css — § 22 "v5 SOCIAL LAYER": all new components on --q-* tokens, same anti-clip discipline (ellipsis on chip/pin/member one-liners).
• src-tauri/src/main.rs — qalpub_get/qalpub_post/qalpub_delete (ureq bridge, QALPUB_URL env override) + qalch_post(..., reply_to).
• Tests green: ui/audit.sh 45 passed, 0 failed (253 classes checked) · smoke.sh 32 passed, 0 failed (192 ids wired, 37 chat contract ids) · cargo build green · backend suites test_workspaces.sh 54 green and test_qalpub.sh 42 green (no regression).
• Prior sources archived: wallet-app/archive/v5_20260909_*/ (main.rs, README) and ui/archive/*_v4q_20260909.* (app.js, index.html, styles.css).

v6 — unit convention + text-cutoff/panel sweep (2026-09-10)

2026-09-10. A full UI sweep that (a) locks in the network-wide unit convention and (b) closes every text-cutoff / panel-behaviour gap found in the audit. No features removed, no IDs renamed — smoke + audit contracts extend, never break.

The unit convention (enforced everywhere)

1 Qals = AU$1 = 100 cents = 1,000,000 doofs
1 cent = 0.01 Qals        1 doof = 0.000001 Qals

• PRIMARY display: X.XX Qals — 2 decimals, tabular-nums (helper qals(cents); hero pairs qalsN(cents) with the Qals unit label).
• SECONDARY dim line: = AU$X.XX (aud(cents)) wherever space allows (balance hero badge, send/topup toasts, job receipt, buy result).
• NEVER raw cents as money in the human UI — loopd speaks cents internally; conversion happens at display only.
• Doofs ONLY in tooltips/detail expanders for micro amounts (gas, per-unit pricing, locked-card prices), formatted ≈ N doofs (0.0000XX Qals) — helper doofs(cents).
• In-chat payment cards render ⚡ 2.50 Qals (never "250c").
• Balances render 512.40 Qals · reserve-backed ✓ = AU$512.40.

ui/app.js helpers (formatting section): qals(cents) · qalsN(cents) · aud(cents) · doofs(cents). Legacy fmtAU/fmtQ/listingPriceQ are gone; ui/audit.sh § 5 fails the build if any return. 27 qals() render sites, 7 doofs() tooltip sites.

Where units changed: wallet balance hero + badge + holds; activity feed; send/topup flows + toasts; compute price board (per-unit prices carry a doofs tooltip), buy estimate/result/toast, converter, job list + context receipt; agents balances/caps/spend; locked-content cards (price chip + Unlock button + toast); ⚡ payment bubbles; staged ⚡ chip; attach-Qals live doofs line; mock market-channel posts (0.9¢/frame → 0.009 Qals/frame (≈ 9,000 doofs)); ui/index.html labels/placeholders ("Qals balance", "Send Qals", "Qals (1 = AU$1)" inputs); brand prototype qal_wallet.html (hero, accounts, activity rows, hold math) and brand/index.html (unit convention card in § 4, "1-Qals coin" prose).

Text-cutoff sweep — found & fixed (worst offenders first)

1. Activity feed labels (.feed li grid) — the transaction label column had no overflow rule at all; long labels silently clipped mid-glyph. Now ellipsis + minmax(0,1fr) with the amount column widened to 96px so +512.40 Qals never truncates.
2. Find-in-conversation box (.th-search) — fixed 210px input could push the header's 🔔⚓✔ buttons out of the bar on narrow windows. Now flex: 0 1 auto + input width:100%, shrinking to a 150px floor.
3. Balance badge (.badge-green) — nowrap pill inside the hero's side column could overflow the card; now max-width:100% + ellipsis.
4. Payment settle ids (.pay-note) — now ellipsis so long settle ids can't widen the bubble.
5. Brand prototype rows (qal_wallet.html) — .row .t titles/subtitles, .appbar name/address, .acct cards, .netsel, .note pill: all got min-width:0 + ellipsis; amounts got tabular-nums.

Panel / layout sweep — found & fixed

• Plain Esc did nothing — the Esc handler sat behind the Ctrl/Cmd guard. Now plain Esc closes the top-most transient surface: banner → search drawer → reaction picker → attach/emoji rows → mention pops → settings drawer. Lock + onboarding overlays stay Esc-proof (security gate).
• Settings drawer had no outside-click close — added (button + drawer excepted).
• Orphan context header — switching tabs away from an open thread left cx-head reading "Thread · #x" over non-thread content; switchTab now resets it (and closes stale attach popovers on tab change).
• Context pane at narrow widths — was a fixed 304px column; now steps down at ≤1280px (272px) and ≤1100px (248px), and hides below 940px instead of squishing the main column.
• Attach-menu viewport overflow — clamped with max-height: min(340px, calc(100vh - 180px)) + scroll on short windows.
• Skeletons on async tabs — DM thread now ships a skeleton row (channel view already had "loading…"; rail lists, price board, jobs, contacts, files and agents already had them).
• Empty states — all present: no conversations / no channels (rail), no jobs, no contacts, no files; zero balance now renders an explicit "reserve-backed ✓ = AU$0.00 · top up to get started" badge state.
• Consistency — status colours unchanged and verified: green = success/backed, gold = Qals value, blue = info, red = danger, teal accent = live; bronze reserved for G-QALS (phase 1). All v6 additions use only --q-* tokens / the 8px grid / Firefly radius scale.

Manual checklist (v6 sign-off)

1. bash wallet-app/ui/audit.sh → 56 passed, 0 failed (§ 5 = units).
2. bash wallet-app/smoke.sh → 32 passed, 0 failed; cargo build green.
3. Balance hero: 512.40 Qals + reserve-backed ✓ = AU$…; zero-balance agent shows the top-up nudge; hero numbers don't jitter (tabular-nums).
4. Activity feed: long labels ellipsize, amounts read +2.50 Qals.
5. Send 2.5 Qals → toast sent 2.50 Qals (= AU$2.50) → @peer · receipt.
6. Attach ⚡ Qals → type 2.5 → doofs line ≈ 2,500,000 doofs (2.50 Qals); staged chip reads ⚡ 2.50 Qals attached; payment card in-thread is ⚡ 2.50 Qals with doofs on hover.
7. Locked card: price chip ⚡ 0.25 Qals, hover = doofs tooltip, Unlock button reads Unlock for 0.25 Qals.
8. Compute: price board X.XX Qals/unit (doofs on hover), converter = X.XX Qals of compute, estimate shows hold + settle in Qals.
9. Narrow the window: context pane steps 304 → 272 → 248 → hidden (≤940px); thread-head search shrinks, buttons never pushed out.
10. Esc closes (in order): banner, search drawer, reaction picker, attach menus, settings drawer; drawer also closes on outside click; tab switches leave no "Thread ·" header or floating popovers behind.
11. Resize hard / short window: attach menu scrolls instead of clipping.
12. Brand prototype (brand/wallet/qal_wallet.html): hero 512.40 Qals, = AU$512.40 below, activity rows carry Qals · … secondaries.

Files touched (v6):

• ui/app.js — units helpers + all money render paths; Esc/outside-click/ cx-head/zero-balance fixes.
• ui/index.html — unit labels + placeholders; thread skeleton.
• ui/styles.css — feed/th-search/badge-green/pay-note anti-clip; context collapse breakpoints; attach-menu clamp.
• ui/audit.sh — new § 5 units-convention gate (helpers present, qals() coverage, no ¢/fmtAU/fmtQ, hero unit, doofs format).
• brand/wallet/qal_wallet.html, brand/index.html — same convention.
• Prior sources archived: ui/archive/*_v6_20260910.*, brand/archive/*_v6_20260910.html.

v7 — passkey (WebAuthn) login gate (2026-09-11)

Settings → Security — passkey (WebAuthn) · optional "Protect with passkey" at the end of onboarding · passkey-first lock screen. Ship-green: smoke.sh 37/37 (new § 8 passkey contract) · ui/audit.sh 56/56 · cargo build + cargo test incl. 10 new wa_tests (CBOR/COSE parsing, real ES256 + Ed25519 assertion verification, tamper rejection).

Does WebAuthn work in the Tauri webview? (probed, not guessed)

On this build's platform (Linux) — NO, and that is a hard platform fact, not a design choice. Measured empirically on 2026-09-11 by driving the same engine Tauri/wry uses on Linux (WebKitGTK 2.50.4, loading tauri://localhost through a registered custom scheme, i.e. exactly how the wallet is served):

• the origin is a secure context (isSecureContext === true) — that part of the WebAuthn contract would be satisfied;
• but window.PublicKeyCredential and navigator.credentials are undefined: Arch builds webkit2gtk without WebAuthn support (its dependency list has no libfido2, which WebKitGTK's authenticator backend needs). There is no Linux OS platform-authenticator API for it to bind to either.

So on Linux the wallet ships the graceful state: Settings shows "passkeys unavailable here — password lock remains" (plus the upgrade path), the lock screen stays password-only, and onboarding hides the passkey option. Everything is runtime-probed (pkProbe()), so on builds where the webview does expose WebAuthn — macOS (WKWebView ≥ 13.3, Touch ID/password) or Windows (WebView2, Windows Hello; note Hello often picks RS256, which the verifier currently refuses at enroll — see below) — the identical UI activates without changes. The real upgrade for Linux is the tauri-plugin-authenticator plugin path (or a distro webkit2gtk built with WebAuthn + a roaming FIDO2 key); documented as the phase-1 option.

What shipped (Rust)

src-tauri/src/main.rs gains a self-contained local WebAuthn verifier — no server, no network, no new secrets:

And the gate: vault_unlock refuses ({"ok":false,"passkey_required": true}) when a passkey is enrolled and require_passkey is set, unless a verified assertion happened within the last 120 s. This is enforced at the IPC boundary in Rust, not just hidden in the UI. The token is consumed by every successful unlock, so each auto-lock cycle demands a fresh assertion (same 5-min idle timer as before).

What shipped (UI)

• Lock screen: with a passkey enrolled, "🔑 Unlock with passkey" is the primary action. Idle-lock within a live session → assertion alone unlocks in one step. Cold app start → assertion first, then the app password once (the vault KEK must come from the password — see the honest model below). With require_passkey on, the password field is hidden on the lock screen.
• Settings → Security: availability line, Add / Remove (presence-checked), "require passkey to unlock" toggle, honest hint text in every state.
• Onboarding: "Protect with passkey (recommended)" appears on the success step — only when a vault was actually created and the webview supports WebAuthn; fully skippable.

Security model — what the passkey does and does NOT do (honest)

A WebAuthn passkey never exposes key material. Assertions are possession+presence proofs with a signature — you cannot derive, unwrap, or wrap a vault key with one. So the passkey here is pure authentication:

The verifier is real: Rust-side unit tests sign with freshly generated P-256/Ed25519 keys and verify through the exact production path (wa_tests), including tampered-authData and tampered-signature rejection.

Files touched (v7): src-tauri/src/main.rs (WebAuthn module + gate + tests), src-tauri/Cargo.toml (p256, ed25519-dalek — verify-only crypto), ui/index.html (8 ids across lock/settings/onboarding), ui/app.js (§ v7 PASSKEYS: probe/enroll/assert + lock/settings/onboarding wiring), smoke.sh (§ 8 passkey contract). styles.css unchanged (reused classes only). vault.py untouched (the gate lives in Rust). Prior sources archived: wallet-app/archive/v7_20260911_passkey/, ui/archive/*_v7_20260911.*.

v2 — onboarding, vault, verification

Onboarding flow (first screen)

Existing installs (identities but no vault) get a one-click "Set an app password" path. The mnemonic is displayed ONCE and discarded from memory on the very next step — the wallet never writes a seed stub (the CLI's 0600 stub is vaulted too).

Password lock (vault)

• qalchat/vault.py — the app password derives a key (PBKDF2-HMAC-SHA256, 200 000 iterations, per-install 32-byte salt in data/vault.salt) that AES-256-GCM-encrypts qalchat/data/vault.bin holding every identity's secret fields (x25519_priv, ed25519_priv, loopd.api_secret, seed stubs).
• At rest (locked): identity files on disk keep public fields only; seed stubs are neutralized. Unlock decrypts in memory and re-materializes the files (0600) for the session so the qalchat CLI keeps working; lock re-seals (adopting identities created during the session) and strips again.
• Wrong password: 5 tries → 60 s cooldown, persisted in data/vault.state.json across restarts.
• Auto-lock after 5 min idle (configurable 1–120 min) + 🔒 sidebar lock.
• Settings → Export identity (encrypted): portable AES-GCM container in ~/Downloads with its own password; unwrap from onboarding → Import.
• Passwords travel stdin only (never argv, never logged). The frontend holds the password in a JS variable for the session (so LOCK can re-seal); never localStorage, scrubbed on lock.

Verification UI (Contacts)

• Contacts list: qoll codes + full fingerprints + pin source (invite / code / tofu) / relay / age.
• My invite: QR rendered by invites.py's own renderer (python qrcode → PNG → data-URL) + signed URI + fingerprint for the out-of-band check.
• Add a person box: handle-resolve (TOFU-warned) or paste invite URI (signed, verified before pinning). --force re-pin gated behind a checkbox.
• Key substitution = red app-wide banner: "⚠ contact key changed — communication blocked" — fired when any send/recv hits qalchat's exit 4. The relay is demoted to tamper detector; delivery is refused, never silently re-pinned.

Files tab

Encrypted transfer via qalchat (send-file ≤8 MB chunked, recv-files sha256-verified, auto-anchored on receive — the ⚓ tx renders inline per file and in the context pane). The tab probes the CLI at runtime (files_capable) and shows a graceful "files are coming online" stub if the subcommands are absent. Listing reads the canonical files --json index (fallback: download-dir scan).

Tabs

Settings (sidebar account card → drawer): loopd / multi-relay list / qmarket URLs, identity selector, auto-lock minutes, vault status, export identity.

Command surface (src-tauri → frontend)

svc_status            health of the three services (sidebar pills)
relay_probe           per-URL health for the multi-relay list
loopd_report  loopd_receipts  loopd_account
loopd_transfer        (signs w/ local identity secret — X-Sig over raw body)
loopd_topup           (paper-mode test cents, Phase 0)
loopd_revoke          (self-revoke only — needs the local secret)
market_providers  market_jobs  market_earnings  market_buy
relay_envelopes       (ciphertext fetch for a handle)
chat_send chat_recv chat_pay chat_anchor chat_verify   ── delegate to CLI
qalchat_cli           (raw passthrough, e.g. `recover --force`)
list_identities  owned_agent_ids  qalchat_home_info  read_history
── v2 ──
vault_status  vault_setup  vault_unlock  vault_lock     (passwords via STDIN)
seed_mnemonic         (seedkit/derive.py mnemonic — 12 words)
account_create        (qalchat init --mnemonic …; deterministic restore)
import_identity_json  import_identity_container  export_identity
my_id_code            (qoll-XXXX-XX + fingerprint — works while sealed)
list_contacts         (pins + fingerprints + codes, no subprocess)
contact_pin_code      (keyserver resolve → TOFU-warned code pin)
invite_create         (qalchat invite → URI + fingerprint + QR data-URL)
invite_accept         (qalchat accept; signature verified before pinning)
files_capable  file_send  files_recv  files_list  files_reveal
── v3: qalpub protocol + inline media ──
qalpub_capable  qalpay_listings  qalpay_buy_unlock  qalpay_send_locked
qalch_list  qalch_read  qalch_post  qalch_digest
resolve_received_path  file_data_url
── v7: passkey gate (local WebAuthn) ──
webauthn_state  webauthn_challenge  webauthn_register  webauthn_verify
webauthn_set_require  webauthn_remove        (vault_unlock gated by fresh assertion)

Security model — what protects what

All three are independent and all three matter: the password guards the device, the mnemonic guards against the device dying, the pins guard the wire. Losing any one costs exactly what it protects — nothing more. The qoll code is a presentation of the pin/fingerprint layer, not a fourth secret.

Unchanged from v1: the wallet holds no crypto of its own (all X25519/Ed25519/AES-GCM lives in qalchat.py, delegated via subprocess); chat is ciphertext-blind at the relay; loopd signing reads identity secrets only in-process and never returns them across the IPC boundary; revoke is self-service only.

Run

# dev (uses the static ui/ — no devUrl, no npm):
cd wallet-app/src-tauri && cargo tauri dev

# production debug build:
cd wallet-app/src-tauri && cargo tauri build --debug

# plain build (the acceptance test):
cd wallet-app/src-tauri && cargo build

# full smoke (binary + services + vault round-trip + unit tests
#               + v3 chat UI contract + qalpub protocol probe):
bash wallet-app/smoke.sh

Prereqs: loopd (:8823) + relay (:8830, python3 qalchat/qalchat.py serve) + qmarket (:8824); chain on :9000 only for anchor/verify (via qalpipe). QALCHAT_HOME locates the identity store; vault.py follows the same QALCHAT_DIR env var as qalchat.py.

Tests

• wallet-app/test_vault.py — sandboxed vault.py round-trip: setup → strip-at-rest → wrong-password counting → 5-try lockout → cooldown → unlock → re-seal with adoption → export/unwrap → status counts. 18 checks.
• cargo test — Rust fingerprint and qoll id_code must byte-match the python reference (invites.py), plus base64 vectors.
• wallet-app/smoke.sh — wires it all together (37 checks green as of v7): binary, services, --version, vault round-trip, cargo tests, v3 chat UI contract (every id app.js touches exists in index.html — 37 messenger-layout ids asserted), the qalpub protocol probe (listings / buy-unlock / read contracts against the real CLIs when present, explicit mock note otherwise) and the v7 passkey contract (8 lock/settings/onboarding ids, JS probe/enroll/assert wiring, Rust commands + vault_unlock gate, graceful no-WebAuthn fallback).
• v7 additionally: cargo test wa_tests — 10 checks: minimal-CBOR + authData + COSE parsing against hand-built attestationObjects, real ES256 + Ed25519 assertion signatures verified (and tamper-rejected) through the production wa_verify_signature path, base64url vectors, origin/rp.id parsing, RS256 rejection.
• v3 additionally verified headless (chromium): tab layering (a v2 bug where #tab-chat rendered over other tabs — fixed), attach menu, emoji insert, bubbles/day-separators/ticks, payment badge, real-format locked card with price parse, search highlight, staged ⚡ chip, channel render with sig chips.
• v2 sources preserved in wallet-app/archive/v2_20260909/ (v1 in archive/v1_20260909/).

Phase-0 architecture note (deliberate)

All crypto/chat operations delegate to the Python CLI via std::process::Command — wire compatibility with live identities/relay on day one. Native Rust crypto (x25519-dalek, hkdf, aes-gcm, ed25519-dalek) remains the phase-1 milestone. The Rust layer does native HTTP + HMAC (hmac + sha2) for loopd money rails. The vault is python-side (cryptography AESGCM + hashlib PBKDF2) so CLI and wallet share one implementation; the only Rust "crypto" is the sha256+b32 presentation layer for fingerprints/codes (unit-tested against the python reference).

Security notes

• The wallet holds no secrets of its own. Keys stay in qalchat identity files (0600 — and stripped to public fields whenever the vault is locked); loopd secrets stay in loopd / vault.bin. Secrets are read only to sign in-process and never returned across the IPC boundary.
• Chat is ciphertext-blind at the relay; the wallet renders decrypted local history only.
• Passwords/mnemonics are never logged, never in argv, never persisted.
• Revoke is self-service only. loopd_transfer signs exactly the bytes sent.
• Topup is unauthenticated by design in Phase 0 (paper-mode test cents; since 2026-09-15 a funded topup transfers from the issuer wallet qals:issuer).
• Known trade-offs (honest list): identity secrets are materialized at 0600 while unlocked (the CLI subprocess must read them); mnemonic restore passes words as argv to qalchat init --mnemonic (the CLI's interface) — momentary ps exposure on a single-user machine, removed in phase 1 when derivation moves in-process.