suaveplan/openspec/archive/2026-05-11-drive-plugin-chunks-inline-sig/tasks.md

tasks — drive-plugin-chunks-inline-sig

1. Error registry

• 1.1 Add INLINE_SIG_INVALID to CHUNKS_CODES.
• 1.2 Update error-codes.md (count + DTP-25 rationale).

2. Inline-hint module

• 2.1 Create src/inline/inline-hint.ts with InlineHint, LegacyInlineHint, AnyInlineHint, StorageHint, FileLocation, inlineSigningInput, signInlineHint, verifyInlineHint (injectable verifier), isLegacyInlineHint, upgradeLegacyInlineHint.
• 2.2 Create src/inline/inline-hint.md (≥200-word doc with all six required sections).
• 2.3 Create src/inline/index.ts barrel.
• 2.4 Wire exports through src/index.ts.

3. Tests

• 3.1 Required: inline file with valid sig reads successfully.
• 3.2 Required: inline file with bad sig throws INLINE_SIG_INVALID.
• 3.3 Required: old-format inline reads with warning AND rewrites with sig on next write.
• 3.4 fileId-replay rejection.
• 3.5 byte-tamper rejection.
• 3.6 wrong-public-key rejection.
• 3.7 signing-input canonicalisation property.
• 3.8 catch-arm via injectable throwing verifier.
• 3.9 isLegacyInlineHint discrimination including sig: undefined ambiguous case.

4. Gates

• 4.1 bunx turbo lint typecheck test --filter=@suaveplan/drive-plugin-chunks green.
• 4.2 bunx turbo test:coverage --filter=@suaveplan/drive-plugin-chunks at 100/100/100/100.
• 4.3 bun run docs:check reports 17/17 files.