Build the Ratatui frontend as presentation and interaction only over crates/storage after milestone 01. Deliver a Mutt-inspired folder sidebar, authenticated structured viewer and in-process editor, shared configurable two-minute inactivity relock, keyboard-first workflows, and a complete colon-command surface. Every base pass and pass-otp operation must have a TUI element and colon command; ordinary operations also receive direct keys, while Git requires direct keys only for pull and push. The TUI must never invoke the CLI or implement storage behavior.
Build the cross-platform Iced desktop frontend over crates/storage. The app uses a two-pane tree-and-editor layout, the shared configuration and authentication lease, native macOS menus and conventions, an in-window menu bar on Linux and Windows, and a fuzzy command palette. It exposes the same password-store, Git-over-HTTPS, and pass-otp workflows as the terminal UI without duplicating storage rules or launching CLI tools or other processes.
Build the native iPhone app and its Apple Watch companion as presentation shells over crates/storage through crates/apple. The iPhone follows Gotcha's native tab-and-navigation design with Home remote activity and pull-to-refresh, hierarchical Passwords, a TOTP tab, and Preferences. It uses application-token HTTPS Git authentication, optional biometric access to the GPG key passphrase in iPhone Keychain, and QR transfer of ASCII-armored GPG keys. The Watch securely receives only explicitly shared TOTP entries and computes/displays codes through Rust. Swift must not own password-store, Git, GPG, OTP, secure-storage policy, or transfer-domain behavior, and neither app may launch external processes. Full CLI/TUI command parity, a command palette, and AutoFill are outside this milestone. The final issue prepares, notarizes, publishes, and verifies an install through AltStore PAL while documenting Apple's exclusion of watchOS apps from alternative-marketplace packages.
Add complete embedded Git transport over SSH for ssh:// and scp-like remotes. Keep all URL parsing, host verification, authentication, upload-pack/receive-pack protocol handling, cancellation, and errors in crates/storage with Rust-only crates and no local git, ssh, shell, credential helper, ProxyCommand, or transport process. Ship SSH as an optional Cargo feature enabled by default in the CLI, TUI, and desktop application, while the iPhone/Apple build remains HTTPS-only unless explicitly opted in later.
Implement the complete base pass command surface and pass-otp behavior in Rust, backed exclusively by crates/storage. Existing GPG-compatible key material is assumed. Git is embedded and HTTPS-only. Runtime may not invoke pass, git, gpg, shells, or helpers; the sole exception is apps/cli launching the configured editor for edit. Completion requires cross-compatible fixtures and an end-to-end CLI parity audit.