m8chat-app2/help4bis-claude-notes/remaining-work.md

Remaining Work — Priority Order

P0 — LiveKit E2EE frame encryption (BLOCKING video calls)

• Enable AES-GCM frame encryption in LiveKit Flutter SDK to match Element X
• Element X publishes media with encryption: GCM, app2 publishes encryption: NONE
• Without matching encryption, remote video renders as scrambled garbage
• Check livekit_client docs for E2EEOptions / FrameCryptorFactory on web
• May need to pass shared key material derived from the MatrixRTC session
• Start here next session: read livekit_client 2.4.0 source for E2EE setup on web

P1 — Incoming call detection from Element X

• Element X sends MSC3401 org.matrix.msc3401.call.member state events (already in hidden events list)
• App currently listens for old m.call.invite events in matrixrtc_repository.dart
• Need to detect call.member state changes and show incoming call overlay
• The state event format includes memberships[] with foci_active[].type: livekit

P2 — Cleanup and polish

• Remove debug logging from rooms_repository.dart (debugPrint of all rooms on every sync)
• Fix avatar 404s — switch to authenticated media API (/_matrix/client/v1/media/)
• Clean up 20 ghost devices for @try user on server (DELETE via admin API)
• Remove diagnostic Olm logging from index.html (console.log statements)
• Remove debug prints from auth_repository.dart (encryptionEnabled logging)

P3 — Voice calling

• Test voice-only calls (same LiveKit flow, just no video track)
• Likely same E2EE issue as video — fix P0 first

P4 — Cross-signing (Phase 2)

• Device verification to remove red exclamation in Element
• Profile screen hooks for verify/cross-sign

Build and deploy commands

cd /srv/wp-dev/pwa-sites/m8chat-app2
dart analyze --fatal-infos
flutter build web --release
rsync -avz --delete --exclude='.htaccess' --exclude='.ftpquota' \
  -e "ssh -p 2233 -i ~/.ssh/m8chat_prod" \
  build/web/ m8chat@app.m8chat.au:public_html/app2.m8chat.au/

Next session should start with

1. Read these claude-notes
2. Research LiveKit E2EE on Flutter web — check livekit_client package for E2EEOptions, FrameCryptor, KeyProvider
3. Check if Element X derives the E2EE key from the MatrixRTC session or uses a separate mechanism
4. Implement and test — the scrambled video fix is the most impactful single change