Replace all implementation stubs with real functionality

[jeremymanning]

Overview

The codebase contains implementation stubs (TODO comments, placeholder returns, "not yet implemented" messages) across several modules. These stubs allowed the safety hardening spec (#4, #6) to be implemented with correct architecture and passing tests, but need to be replaced with real functionality before deployment.

422 tests pass with stubs in place — the stubs are structured to be safe-by-default (reject, deny, return error) rather than silently accepting.

Categories

CLI wiring (main.rs + cli/)

All 5 CLI command groups print "not yet implemented." The subcommand structs exist in src/cli/ but aren't wired into main.rs.

• Wire donor CLI subcommands into main.rs #8 Wire donor CLI subcommands
• Wire job CLI subcommands into main.rs #9 Wire job CLI subcommands
• Wire cluster CLI subcommands into main.rs #10 Wire cluster CLI subcommands
• Wire governance CLI subcommands into main.rs #11 Wire governance CLI subcommands
• Wire admin CLI subcommands into main.rs #12 Wire admin CLI subcommands

Sandbox VM lifecycle

VM drivers have real process management structure but actual hypervisor API calls are TODOs.

• Firecracker API socket configuration and VM setup #13 Firecracker API socket configuration
• Apple Virtualization.framework Swift FFI bridge #14 Apple VZ Swift FFI bridge
• WASM module loading from CID store #15 WASM module loading from CID store

Attestation & crypto

Structural verification works but full certificate-chain validation is pending.

• Full Ed25519 signature verification in policy engine #16 Full Ed25519 signature verification in policy engine
• TPM2/SEV-SNP/TDX root-of-trust certificate chain validation #17 TPM2/SEV-SNP/TDX root-of-trust certificate chain validation
• Apple Secure Enclave DeviceCheck attestation #18 Apple Secure Enclave DeviceCheck attestation

Identity & verification

BrightID integration is structured but needs HTTP client.

• BrightID HTTP client integration #19 BrightID HTTP client integration
• OAuth2 provider adapters (email, GitHub, Google, Twitter) #20 OAuth2 provider adapters (email, GitHub, Google, Twitter)
• Phone/SMS verification provider integration #21 Phone/SMS verification provider
• See also: Explore additional proof-of-personhood providers beyond BrightID #5 (explore additional proof-of-personhood providers)

Infrastructure

• Sigstore Rekor transparency log integration #22 Sigstore Rekor transparency log integration
• OpenTelemetry OTLP exporter wiring #23 OpenTelemetry OTLP exporter wiring
• Coordinator Raft consensus via openraft #24 Coordinator Raft consensus (openraft integration)

Network

• NAT detection (real implementation) #25 NAT detection (real implementation)
• DNS seed nodes for bootstrap discovery #26 DNS seed nodes for bootstrap discovery