Requirements
Functional + non-functional requirements for Kimosabe.AI, mapped to the phases in the roadmap. Every requirement has a stable ID so tickets, tests, and ADRs can reference it.
ID convention:
FR-NN— functional requirementNFR-NN— non-functional requirementSR-NN— security requirementCR-NN— compliance requirement
Status legend: ✅ shipped · 🚧 in progress · ⏳ planned
Functional requirements
| ID | Requirement | Phase | Status |
|---|---|---|---|
| FR-01 | Email + password signup, no phone number required | 1 | ✅ |
| FR-02 | Username discovery (@handle, lowercase, 3–20 chars, unique) |
1 | ✅ |
| FR-03 | Identity ECDH P-256 keypair generated in browser at signup | 1 | ✅ |
| FR-04 | Recovery code (24-char base32, ~120 bits) shown once at signup | 1 | ✅ |
| FR-05 | Private key wrapped twice (password + recovery code) and stored as ciphertext | 1 | ✅ |
| FR-06 | 1:1 E2EE chat with realtime delivery | 1 | ✅ |
| FR-07 | Encrypted image attachments | 1 | ✅ |
| FR-08 | Per-conversation disappearing messages (off / 1d / 7d) | 1 | ✅ |
| FR-09 | Server-side purge of expired messages via pg_cron | 1 | ✅ |
| FR-10 | Settings: change password, rotate recovery key, export identity, delete account | 1 | ✅ |
| FR-11 | Passwordless recovery via recovery key (zero-knowledge edge function) | 1 | ✅ |
| FR-12 | Public threat model at /trust |
1 | ✅ |
| FR-13 | Installable PWA + offline shell | 1 | ✅ |
| FR-14 | Outbox queues sends made offline; flushes on reconnect | 1 | ✅ |
| FR-15 | Per-conversation opt-in delivery + read receipts | 1 | ✅ |
| FR-16 | Group chat E2EE via MLS (RFC 9420) | 2 | ⏳ |
| FR-17 | Encrypted voice notes | 2 | ⏳ |
| FR-18 | Safety numbers for out-of-band identity verification | 2 | ⏳ |
| FR-19 | Encrypted push notifications (ciphertext envelope, SW decrypts) | 2 | ⏳ |
| FR-20 | Sealed sender (1:1 first, then groups) | 3 | ⏳ |
| FR-21 | Optional onion / relay routing to hide IPs | 3 | ⏳ |
| FR-22 | Encrypted profile data (display name, avatar) wrapped to contacts only | 3 | ⏳ |
| FR-23 | Native client with Bluetooth + Wi-Fi-Direct mesh | 4 | ⏳ |
| FR-24 | Optional LoRa (Meshtastic-compatible) bridge | 4 | ⏳ |
| FR-25 | Encrypted feed ("Moments-style") to contact graph | 5 | ⏳ |
| FR-26 | P2P payments via regulated processor | 5 | ⏳ |
| FR-27 | Mini-app container with strict permission model | 5 | ⏳ |
| FR-28 | Agent SDK (@kimosabe/agent-sdk) and OpenAPI 3.1 contract |
6 | ⏳ |
| FR-29 | Per-conversation agent permissions (read-only / reply-only / full) | 6 | ⏳ |
Non-functional requirements
| ID | Requirement | Target | Phase |
|---|---|---|---|
| NFR-01 | Time-to-interactive on mobile (430px, 4G) | < 2.5s P75 | 1 |
| NFR-02 | Message send → recipient render | < 800ms P75 | 1 |
| NFR-03 | Cold-start decryption of 100-message thread | < 400ms | 1 |
| NFR-04 | Realtime reconnect after network blip | < 5s | 1 |
| NFR-05 | App works fully (read cached threads, queue sends) offline | 100% read, 100% queue | 1 |
| NFR-06 | Lighthouse PWA score | ≥ 95 | 1 |
| NFR-07 | Lighthouse Accessibility score | ≥ 95 | 1 |
| NFR-08 | WCAG 2.2 AA conformance, axe-core CI gate | 0 violations | 1 |
| NFR-09 | Backend P95 query latency | < 150ms | 1 |
| NFR-10 | Realtime fan-out P95 latency | < 250ms | 1 |
| NFR-11 | Uptime SLO (front + backend) | 99.9% | 2 |
| NFR-12 | Data residency | US (Lovable Cloud US region) | 1 |
Security requirements
| ID | Requirement | Spec | Phase |
|---|---|---|---|
| SR-01 | All tables have RLS enabled with deny-by-default policies | OWASP ASVS 4.0 V8 | 1 ✅ |
| SR-02 | Roles stored in separate user_roles table with has_role() security-definer function |
Lovable best practice | 1 ✅ |
| SR-03 | Password KDF: PBKDF2-SHA-256, 600,000 iters, 16-byte salt | NIST SP 800-132 | 1 ✅ |
| SR-04 | Body cipher: AES-GCM-256, 96-bit random IV, 128-bit tag | NIST SP 800-38D | 1 ✅ |
| SR-05 | Server never possesses plaintext private keys or message bodies | — | 1 ✅ |
| SR-06 | Recovery flow is zero-knowledge (server can't unwrap) | — | 1 ✅ |
| SR-07 | Account deletion purges messages, members, keys, roles, profile, auth row, storage objects | GDPR Art. 17 | 1 ✅ |
| SR-08 | Asynchronous handshake via X3DH | Signal X3DH | 2 |
| SR-09 | Forward secrecy + post-compromise security via Double Ratchet | Signal Double Ratchet | 2 |
| SR-10 | Group E2EE via MLS | RFC 9420 | 2 |
| SR-11 | Optional WebAuthn / Passkey second factor | W3C WebAuthn L3 | 2 |
| SR-12 | Sealed sender for 1:1 | Signal Sealed Sender | 3 |
| SR-13 | Annual third-party security audit | OWASP ASVS L2 | 3 |
| SR-14 | Vulnerability disclosure program with safe-harbor language | CVD best practice | 1 🚧 |
Compliance requirements
| ID | Requirement | Phase |
|---|---|---|
| CR-01 | Privacy policy and ToS published, plain-English summaries at the top | 1 |
| CR-02 | CCPA / CPRA "Do Not Sell or Share" honored by default (we never sell) | 1 ✅ |
| CR-03 | GDPR data subject rights: access (export identity), erasure (delete account), portability (export ciphertext + keys) | 1 |
| CR-04 | Cookie-less analytics or none at all | 1 ✅ |
| CR-05 | SOC 2 Type II readiness assessment | 5 |
| CR-06 | HIPAA BAA capability for Business tier | 5 |
Traceability
Tickets, PRs, and tests reference requirement IDs. Example commit message:
feat(messaging): MLS commit handling
Implements FR-16 / SR-10. Adds group commit pipeline behind the
mls-groups feature flag. ADR-0007 captures the decision to use
openmls-rs WASM in the browser.
A requirements-coverage.md report is generated each release listing which IDs ship, which are deferred, and which are at risk.