Contract
What Latchkey is being built to do
Every clause of the product Latchkey is building toward, and how much of it the code does today. Judged from the code and tests, not from plans.
0 of 75 clauses done
100% (75)
- 0 done
- 0 partial
- 75 missing
Judged at commit f76451a ·
Published clauses
0 done · 0 partial · 0 missing
of 0
Target and push further
0 done · 0 partial · 75 missing
of 75
Product target
- Category
- Business password and secrets management
- Replaces
- 1Password Business, Bitwarden, Keeper, LastPass Business; challengers Passbolt, Proton Pass for Business and Infisical; also Dashlane Omnix, NordPass Business and Psono
- First buyer
- The IT or security lead or operations manager of a US company of 10–1,000 people using Google Workspace, Microsoft 365, Okta or Auth, facing a SOC 2, HIPAA or cyber-insurance requirement; USD and US operating norms
Progress by area
8 areasTarget and push further · 8 areas
- Foundation and owned operation0 done0 partial9 missing
- Vault and everyday clients0 done0 partial11 missing
- Sharing, identity and administration0 done0 partial13 missing
- Security visibility and follow-up0 done0 partial10 missing
- Switching and migration0 done0 partial11 missing
- Machine secrets and developer delivery0 done0 partial13 missing
- Product boundaries and handoffs0 done0 partial2 missing
- Agent remediation0 done0 partial6 missing
All clauses
Showing 75 of 75 clauses
| Clause | Title | Status | Evidence or gap |
|---|---|---|---|
| Foundation and owned operation 0 done · 0 partial · 9 missing | |||
| LKY-031target | Owner-run installation through Base | Missing | Gap: No implementation or public-door acceptance evidence exists for owner-run installation through base. |
| LKY-032target | Sign-in and server-side authority | Missing | Gap: No implementation or public-door acceptance evidence exists for sign-in and server-side authority. |
| LKY-033target | Whole-product encrypted archive and inactive restore | Missing | Gap: No implementation or public-door acceptance evidence exists for whole-product encrypted archive and inactive restore. |
| LKY-034target | Erasure with anonymized audit and replay fencing | Missing | Gap: No implementation or public-door acceptance evidence exists for erasure with anonymized audit and replay fencing. |
| LKY-035target | Agents are scoped credentials with human approval | Missing | Gap: No implementation or public-door acceptance evidence exists for agents are scoped credentials with human approval. |
| LKY-036target | US-first operation and explicit regional controls | Missing | Gap: No implementation or public-door acceptance evidence exists for us-first operation and explicit regional controls. |
| LKY-056target | Recover the vault service without losing the keys | Missing | Gap: No implementation or public-door acceptance evidence exists for recover the vault service without losing the keys. |
| LKY-074target | Defined managed edition and published USD buying terms | Missing | Gap: No implementation or public-door acceptance evidence exists for defined managed edition and published usd buying terms. Owner must choose the actual USD rates, commercial operator and BAA signer; no price or legal entity is invented. |
| LKY-075target | Agent fleet control, budgets and global pause | Missing | Gap: No implementation or public-door acceptance evidence exists for agent fleet control, budgets and global pause. |
| Vault and everyday clients 0 done · 0 partial · 11 missing | |||
| LKY-001target | Zero-knowledge vault and published security design | Missing | Gap: No implementation or public-door acceptance evidence exists for zero-knowledge vault and published security design. |
| LKY-002target | Complete item types, generator and history | Missing | Gap: No implementation or public-door acceptance evidence exists for complete item types, generator and history. |
| LKY-003target | Everyday apps, autofill and passkeys | Missing | Gap: No implementation or public-door acceptance evidence exists for everyday apps, autofill and passkeys. |
| LKY-004target | Unlock and device security | Missing | Gap: No implementation or public-door acceptance evidence exists for unlock and device security. |
| LKY-017target | Open export and self-hosting parity | Missing | Gap: No implementation or public-door acceptance evidence exists for open export and self-hosting parity. |
| LKY-027target | Personal and family accounts remain separate | Missing | Gap: No implementation or public-door acceptance evidence exists for personal and family accounts remain separate. |
| LKY-037target | Find, organize, archive and restore work | Missing | Gap: No implementation or public-door acceptance evidence exists for find, organize, archive and restore work. |
| LKY-038target | Offline continuity, conflicts and revocation policy | Missing | Gap: No implementation or public-door acceptance evidence exists for offline continuity, conflicts and revocation policy. |
| LKY-039target | Rollout, accessibility and support without disclosure | Missing | Gap: No implementation or public-door acceptance evidence exists for rollout, accessibility and support without disclosure. |
| LKY-050target | Hide-my-email aliases with a real forwarding provider | Missing | Gap: No implementation or public-door acceptance evidence exists for hide-my-email aliases with a real forwarding provider. |
| LKY-073target | Desktop quick access, native app fill and wearable codes | Missing | Gap: No implementation or public-door acceptance evidence exists for desktop quick access, native app fill and wearable codes. |
| Sharing, identity and administration 0 done · 0 partial · 13 missing | |||
| LKY-005target | Private vaults, groups and effective permissions | Missing | Gap: No implementation or public-door acceptance evidence exists for private vaults, groups and effective permissions. |
| LKY-006target | Internal, guest and one-time sharing | Missing | Gap: No implementation or public-door acceptance evidence exists for internal, guest and one-time sharing. |
| LKY-007target | Admin console, policies and travel mode | Missing | Gap: No implementation or public-door acceptance evidence exists for admin console, policies and travel mode. |
| LKY-008target | Directory, SSO unlock and provisioning | Missing | Gap: No implementation or public-door acceptance evidence exists for directory, sso unlock and provisioning. |
| LKY-009target | Recover accounts without vendor access | Missing | Gap: No implementation or public-door acceptance evidence exists for recover accounts without vendor access. |
| LKY-010target | Offboarding and credential hand-back | Missing | Gap: No implementation or public-door acceptance evidence exists for offboarding and credential hand-back. |
| LKY-025target | Consent-based unmanaged credential discovery | Missing | Gap: No implementation or public-door acceptance evidence exists for consent-based unmanaged credential discovery. |
| LKY-026target | Device posture before vault unlock | Missing | Gap: No implementation or public-door acceptance evidence exists for device posture before vault unlock. |
| LKY-028target | MSP and multi-company operations | Missing | Gap: No implementation or public-door acceptance evidence exists for msp and multi-company operations. |
| LKY-051target | Recovery governance and hardware authenticators | Missing | Gap: No implementation or public-door acceptance evidence exists for recovery governance and hardware authenticators. |
| LKY-055target | Transparent MSP and company commercial records | Missing | Gap: No implementation or public-door acceptance evidence exists for transparent msp and company commercial records. |
| LKY-058target | People signals and IT ticket fulfillment | Missing | Gap: No implementation or public-door acceptance evidence exists for people signals and it ticket fulfillment. |
| LKY-069target | Manual people management and planned offboarding | Missing | Gap: No implementation or public-door acceptance evidence exists for manual people management and planned offboarding. |
| Security visibility and follow-up 0 done · 0 partial · 10 missing | |||
| LKY-011target | Password health with private comparisons | Missing | Gap: No implementation or public-door acceptance evidence exists for password health with private comparisons. |
| LKY-012target | Breach and dark-web monitoring | Missing | Gap: No implementation or public-door acceptance evidence exists for breach and dark-web monitoring. |
| LKY-013target | Security insights and adoption reporting | Missing | Gap: No implementation or public-door acceptance evidence exists for security insights and adoption reporting. |
| LKY-014target | Tamper-evident activity and SIEM delivery | Missing | Gap: No implementation or public-door acceptance evidence exists for tamper-evident activity and siem delivery. |
| LKY-015target | Access reviews and compliance reports | Missing | Gap: No implementation or public-door acceptance evidence exists for access reviews and compliance reports. |
| LKY-030target | Security assurance and verifiable builds | Missing | Gap: No implementation or public-door acceptance evidence exists for security assurance and verifiable builds. |
| LKY-040target | Reminders, escalation and accountable follow-up | Missing | Gap: No implementation or public-door acceptance evidence exists for reminders, escalation and accountable follow-up. |
| LKY-054target | Reusable security rules and evidence-grounded actions | Missing | Gap: No implementation or public-door acceptance evidence exists for reusable security rules and evidence-grounded actions. |
| LKY-059target | Evidence connectors with no vault contents | Missing | Gap: No implementation or public-door acceptance evidence exists for evidence connectors with no vault contents. |
| LKY-062target | Federal and validated-cryptography extension | Missing | Gap: No implementation or public-door acceptance evidence exists for federal and validated-cryptography extension. |
| Switching and migration 0 done · 0 partial · 11 missing | |||
| LKY-016target | Import and switching with exact reconciliation | Missing | Gap: No implementation or public-door acceptance evidence exists for import and switching with exact reconciliation. |
| LKY-041target | 1Password Business migration | Missing | Gap: No implementation or public-door acceptance evidence exists for 1password business migration. |
| LKY-042target | Bitwarden and machine-secret migration | Missing | Gap: No implementation or public-door acceptance evidence exists for bitwarden and machine-secret migration. |
| LKY-043target | Keeper Business and MSP migration | Missing | Gap: No implementation or public-door acceptance evidence exists for keeper business and msp migration. |
| LKY-044target | LastPass Business migration without silent folder loss | Missing | Gap: No implementation or public-door acceptance evidence exists for lastpass business migration without silent folder loss. |
| LKY-045target | Passbolt migration and cryptographic handover | Missing | Gap: No implementation or public-door acceptance evidence exists for passbolt migration and cryptographic handover. |
| LKY-046target | Proton Pass for Business migration | Missing | Gap: No implementation or public-door acceptance evidence exists for proton pass for business migration. |
| LKY-047target | Infisical secrets migration in mid-deployment | Missing | Gap: No implementation or public-door acceptance evidence exists for infisical secrets migration in mid-deployment. |
| LKY-048target | Dashlane, KeePass, NordPass, Psono and browser migration | Missing | Gap: No implementation or public-door acceptance evidence exists for dashlane, keepass, nordpass, psono and browser migration. |
| LKY-049target | Pilot, delta cutover and rollback without double authority | Missing | Gap: No implementation or public-door acceptance evidence exists for pilot, delta cutover and rollback without double authority. |
| LKY-071target | Employee private-vault migration and cutover roster | Missing | Gap: No implementation or public-door acceptance evidence exists for employee private-vault migration and cutover roster. |
| Machine secrets and developer delivery 0 done · 0 partial · 13 missing | |||
| LKY-018target | Secrets manager for machines and applications | Missing | Gap: No implementation or public-door acceptance evidence exists for secrets manager for machines and applications. |
| LKY-019target | CI, infrastructure and cloud-secret integrations | Missing | Gap: No implementation or public-door acceptance evidence exists for ci, infrastructure and cloud-secret integrations. |
| LKY-020target | Verified rotation and short-lived credentials | Missing | Gap: No implementation or public-door acceptance evidence exists for verified rotation and short-lived credentials. |
| LKY-021target | SSH keys and verified Git signing | Missing | Gap: No implementation or public-door acceptance evidence exists for ssh keys and verified git signing. |
| LKY-022target | Leak scanning and source-owned remediation | Missing | Gap: No implementation or public-door acceptance evidence exists for leak scanning and source-owned remediation. |
| LKY-023target | Privileged shared-account checkout and break-glass | Missing | Gap: No implementation or public-door acceptance evidence exists for privileged shared-account checkout and break-glass. |
| LKY-024target | Credentials for AI agents without disclosure | Missing | Gap: No implementation or public-door acceptance evidence exists for credentials for ai agents without disclosure. |
| LKY-029target | Documented API, CLI, webhooks and MCP | Missing | Gap: No implementation or public-door acceptance evidence exists for documented api, cli, webhooks and mcp. |
| LKY-052target | Connector reliability and least-privilege credentials | Missing | Gap: No implementation or public-door acceptance evidence exists for connector reliability and least-privilege credentials. |
| LKY-053target | Provider-supported key management and consumer graph | Missing | Gap: No implementation or public-door acceptance evidence exists for provider-supported key management and consumer graph. |
| LKY-057target | Trusted fill-broker and runtime boundaries | Missing | Gap: No implementation or public-door acceptance evidence exists for trusted fill-broker and runtime boundaries. |
| LKY-070target | Ordinary-vault secret references and 1Password rewrite | Missing | Gap: No implementation or public-door acceptance evidence exists for ordinary-vault secret references and 1password rewrite. |
| LKY-072target | Biometric shell authentication and editor secret replacement | Missing | Gap: No implementation or public-door acceptance evidence exists for biometric shell authentication and editor secret replacement. |
| Product boundaries and handoffs 0 done · 0 partial · 2 missing | |||
| LKY-060target | Separate siblings with accountable handoffs | Missing | Gap: No implementation or public-door acceptance evidence exists for separate siblings with accountable handoffs. |
| LKY-061target | Specialist boundaries without shrinking the credential job | Missing | Gap: No implementation or public-door acceptance evidence exists for specialist boundaries without shrinking the credential job. |
| Agent remediation 0 done · 0 partial · 6 missing | |||
| LKY-063push further | Rotation agent changes and verifies the locks | Missing | Gap: No implementation or public-door acceptance evidence exists for rotation agent changes and verifies the locks. |
| LKY-064push further | Offboarding agent closes the entire exposure set | Missing | Gap: No implementation or public-door acceptance evidence exists for offboarding agent closes the entire exposure set. |
| LKY-065push further | Hygiene agent improves the actual vault state | Missing | Gap: No implementation or public-door acceptance evidence exists for hygiene agent improves the actual vault state. |
| LKY-066push further | Secrets agent removes exposure from working systems | Missing | Gap: No implementation or public-door acceptance evidence exists for secrets agent removes exposure from working systems. |
| LKY-067push further | Agent-access broker enforces the sponsoring person | Missing | Gap: No implementation or public-door acceptance evidence exists for agent-access broker enforces the sponsoring person. |
| LKY-068push further | Remediation coordinator follows proof and human decisions | Missing | Gap: No implementation or public-door acceptance evidence exists for remediation coordinator follows proof and human decisions. |
How statuses are judged
- Done
- It ships in the default install, and a cited test or journey exercises it.
- Partial
- Some of it ships, it ships only behind an opt-in, or there is code with no requirement-level test.
- Missing
- There is no implementation.