ITISYOU 0.1.0-dev · Phase 1 of 4 · foundation complete

Public engineering trackerLive project data

Development progress

This page renders at build time from the project's real status file and event log — the same data the development process itself maintains. We show milestone counts and statuses, never invented percentages. Last updated 2026-09-02 14:10 UTC.

Version 0.1.0-dev channel: dev · no releases yet
Phase 1 milestones 17 / 17 completed · 0 in progress · 0 planned
Engine CEF 144 Chromium 144.0.7559.261
AI provider calls 0 AI disabled · off by default

Machine-readable: this data is served live at /api/status (raw JSON).

Implementation phases

Four phases, one honest ledger

Phase 1 of 4 Completed

Foundation / Browser Core

  • Repository & build architecturerepo-architecture Completed
  • Stitch design ZIP processed & inventorieddesign-processed Completed
  • Chromium integration decision (ADR-001)engine-decision Completed
  • Browser launches & renders real HTTPS pagesbrowser-boot Completed
  • Tab Mode shell (tabs, omnibox, navigation)tab-mode Completed
  • Internal New Tab pagenew-tab-page Completed
  • Workspace foundationworkspace-foundation Completed
  • Session persistence & recoverysession-recovery Completed
  • Local history foundationhistory-foundation Completed
  • Command palette foundationcommand-palette Completed
  • Permission policy boundarypermissions-boundary Completed
  • itisyou:// internal pagesinternal-scheme Completed
  • AI runtime present but disabledai-off Completed
  • Network-mode abstraction (standard only)network-abstraction Completed
  • Diagnostics & structured loggingdiagnostics-logging Completed
  • Tests & CI foundationtests-ci Completed
  • browse.itisyou.app deployed on Cloudflarewebsite-deployed Completed
Phase 2 of 4 Planned

Browser Services / Workspaces / Data Systems

Scope defined; milestones will be broken down when the phase begins. No dates are promised.

Phase 3 of 4 Planned

AI / Privacy / Security / Advanced Platform

Scope defined; milestones will be broken down when the phase begins. No dates are promised.

Phase 4 of 4 Planned

Production Hardening / Cross-Platform Release / Installers

Scope defined; milestones will be broken down when the phase begins. No dates are promised.

Engineering timeline

What actually happened, newest first

Every entry below is a real recorded event from progress/events.jsonl — with evidence pointers where they exist.

  1. bug_fixed phase 1 · permissions-boundary

    Embedding attack fixed at four layers: CEF_SCHEME_OPTION_DISPLAY_ISOLATED, frame-ancestors 'none' CSP, subframe itisyou:// navigation blocking, main-frame-only bindings/tier; exact-host privileged matching. New smoke regression step security.embed.blocked; full suite re-run green (24/24 + restore 2/2, unit 30/30).

  2. bug_found phase 1 · permissions-boundary

    Adversarial gate-audit workflow (5 agents, 21/22 gates PASS) found internal pages could be iframed by hostile sites, exposing the internal API tier (history/settings) to web content. All other gate groups fully passed.

    evidence: docs/security/threat-model.md

  3. test_passed phase 1 · tests-ci

    GitHub CI green on both lanes: fast (website tests, secret scan, schema validation) and browser-integration (pinned CEF fetch, sandboxed MSVC build, 30/30 unit tests on windows-latest, artifact uploaded). Earlier failures diagnosed and fixed (MinGW fallback -> ilammy/msvc-dev-cmd; stale routes guard).

  4. completed phase 1 · repo-architecture

    Phase 1 mandatory gates verified: repository+design+ADR, sandboxed browser build, 30/30 unit tests, smoke+restore green, security boundaries enforced, secret scan clean, website live with honest content, ledger current. Phase 1 marked completed.

    evidence: docs/reports/PHASE-1-COMPLETION.md

  5. implemented phase 1 · tests-ci

    Private GitHub remote created (leelaravind/itisyou-browser) and main pushed; CI lanes (fast/browser-integration/heavy) now armed on push.

  6. deployment phase 1 · website-deployed

    browse.itisyou.app LIVE on Cloudflare Workers + Static Assets: HTTPS verified, CSP/security headers verified, /api/status serving real project data, 16 pages, 1298 website checks green.

    evidence: https://browse.itisyou.app

  7. test_passed phase 1 · browser-boot

    Full browser smoke suite GREEN: 20 steps (real HTTPS navigation to example.com + wikipedia.org, back/forward/reload, tab create/switch/close/reopen, internal newtab, workspace create/switch with tab association, history recording, AI-off enforcement, session save) + restore verification (3 tabs restored, active tab correct). Evidence: out/smoke/*.json + screenshots.

  8. bug_fixed phase 1 · browser-boot

    Fixed 'Cannot add multiple Chrome style BrowserViews': window + all browser views moved to Alloy runtime style (view-hosting only; sandbox and Site Isolation unaffected). Content tabs now render. Added pending-navigation queueing for pre-browser-creation navigations.

  9. bug_found phase 1 · tests-ci

    First compile: 6 error classes (WindowOpenDisposition ambiguity, missing cef_parser/cef_app/box_layout includes, MSVC unicode-escape raw-string translation in test literal, try/catch under _HAS_EXCEPTIONS=0). All fixed same session.

  10. implemented phase 1 · browser-boot

    Browser C++ implemented: CEF-free core (json, url classifier, session/history/workspace/settings stores, command registry, AI-off runtime, network profiles, permission policy, JSONL logger with redaction) + CEF shell (Views window, per-tab browser views, itisyou:// scheme handler with CSP, origin-tiered API router, permission/download/popup/crash handlers, keyboard shortcuts, smoke driver). Unit test suite (30 tests) and CI lanes written.

  11. implemented phase 1 · repo-architecture

    Foundation committed (bcfaec5): audits, ADR-001, progress ledger, STORY.md, CLAUDE.md, fetch/scan tooling; design inventory (screens.md, component-map.md, design-tokens.json, website-content-notes.md) completed by design agent.

  12. completed phase 1 · engine-decision

    ADR-001 accepted: CEF binary distribution 144.0.34 (Chromium 144.0.7559.261), Chrome runtime style, Views framework, sandbox enabled via bootstrap.exe + app DLL pattern. Distribution downloaded and SHA1-verified.

    evidence: docs/architecture/ADR-001-browser-engine.md · apps/browser/third_party/cef_version.json

  13. decision phase 1 · engine-decision

    Environment qualified: MSVC 14.44 + CMake 3.31 + Ninja present; 29.7GB free on repo drive rules out Chromium source checkout. CEF selected.

    evidence: docs/audits/build-environment.md

  14. implemented phase 1 · design-processed

    Design ZIP safety-inspected (162 entries, no traversal), extracted to design/extracted (53 screens: 36 browser + 17 website), original preserved in design/source.

  15. implemented phase 1 · repo-architecture

    git init (branch main); monorepo skeleton created (apps/, design/, docs/, progress/, scripts/).

  16. started phase 1 · repo-architecture

    Part 1 autonomous run started. Repository audit: only implementation plan + design ZIP present; no git history.

Platforms

Platform status

Platform verification state
PlatformStatusVerifiedNotes
Windows In development yes Being developed and verified now; sandbox preserved via the bootstrap pattern.
Linux Architecture-ready not yet Wired in the CMake project; unverified until a Linux environment is available.
macOS Architecture-ready not yet Wired in the CMake project; unverified until a macOS environment is available.