docs: remaining work 2026-04-10

help4bis-claude-notes/remaining-work.md

@@ -0,0 +1,46 @@
+## Remaining Work — Priority Order
+
+### P0 — LiveKit E2EE frame encryption (BLOCKING video calls)
+- [ ] Enable AES-GCM frame encryption in LiveKit Flutter SDK to match Element X
+- Element X publishes media with `encryption: GCM`, app2 publishes `encryption: NONE`
+- Without matching encryption, remote video renders as scrambled garbage
+- Check livekit_client docs for `E2EEOptions` / `FrameCryptorFactory` on web
+- May need to pass shared key material derived from the MatrixRTC session
+- **Start here next session**: read livekit_client 2.4.0 source for E2EE setup on web
+
+### P1 — Incoming call detection from Element X
+- [ ] Element X sends MSC3401 `org.matrix.msc3401.call.member` state events (already in hidden events list)
+- [ ] App currently listens for old `m.call.invite` events in matrixrtc_repository.dart
+- [ ] Need to detect call.member state changes and show incoming call overlay
+- The state event format includes `memberships[]` with `foci_active[].type: livekit`
+
+### P2 — Cleanup and polish
+- [ ] Remove debug logging from rooms_repository.dart (debugPrint of all rooms on every sync)
+- [ ] Fix avatar 404s — switch to authenticated media API (/_matrix/client/v1/media/)
+- [ ] Clean up 20 ghost devices for @try user on server (DELETE via admin API)
+- [ ] Remove diagnostic Olm logging from index.html (console.log statements)
+- [ ] Remove debug prints from auth_repository.dart (encryptionEnabled logging)
+
+### P3 — Voice calling
+- [ ] Test voice-only calls (same LiveKit flow, just no video track)
+- [ ] Likely same E2EE issue as video — fix P0 first
+
+### P4 — Cross-signing (Phase 2)
+- [ ] Device verification to remove red exclamation in Element
+- [ ] Profile screen hooks for verify/cross-sign
+
+### Build and deploy commands
+```bash
+cd /srv/wp-dev/pwa-sites/m8chat-app2
+dart analyze --fatal-infos
+flutter build web --release
+rsync -avz --delete --exclude='.htaccess' --exclude='.ftpquota' \
+  -e "ssh -p 2233 -i ~/.ssh/m8chat_prod" \
+  build/web/ m8chat@app.m8chat.au:public_html/app2.m8chat.au/
+```
+
+### Next session should start with
+1. Read these claude-notes
+2. Research LiveKit E2EE on Flutter web — check `livekit_client` package for `E2EEOptions`, `FrameCryptor`, `KeyProvider`
+3. Check if Element X derives the E2EE key from the MatrixRTC session or uses a separate mechanism
+4. Implement and test — the scrambled video fix is the most impactful single change