The Glyph timelock feature has no production entry point — 684 lines, 3 test files, nothing calls it (crypto half resolved in #560)

[Zyrtnin]

Surfaced by closing a hole in test_reachability_shipped_callers.py (#553): __all__ entries were being counted as references, so any symbol could be made to look reachable by exporting it. Closing that exposed 26 symbols. Eleven of them are one feature.

What is unreachable

module	lines
glyph/timelock.py	290
glyph/timelock_reveal_tx.py	394
crypto/aead.py	220
crypto/kem.py	207

Internally connected — kem imports aead, timelock_reveal_tx imports timelock — and not reached from anywhere outside itself.

Flagged symbols: add_timelock_to_metadata, get_unlock_remaining, is_unlocked, verify_cek_reveal, create_reveal_proof, parse_reveal_proof_script, validate_reveal_proof, encrypt_chunked, decrypt_chunked, wrap_cek_x25519, unwrap_cek_x25519.

The only outside reference is prose

glyph/encrypted_content.py:236:

Construct via :func:pyrxd.glyph.timelock.build_timelock_mint

A docstring, not a call. build_timelock_mint has no caller either, so the mint side is as unreachable as the reveal side. crypto.kem has zero importers anywhere.

Why this matters more than an unused module

There are five test files — test_glyph_timelock.py, test_glyph_timelock_e2e.py, test_glyph_timelock_reveal_tx.py, test_crypto_aead.py, test_crypto_kem.py. The feature is built and covered, so it reads as shipped. What it lacks is any path a user can reach: no CLI command, no GlyphClient method, no export in the curated pyrxd namespace.

That is the reachability class at subsystem scale — "a test that constructs the input by hand proves the mechanism; at least one test must reach the code through the production entry point" — and it stayed invisible because the scanner's registry rule swallowed __all__.

Not proposing a fix

Three defensible outcomes and the choice is a product one, not a code one:

1. Wire it — a CLI command and/or a GlyphClient method, which is what the docstring already promises users.
2. Export it — deliberate __init__ exports if it is an SDK-only surface, which also clears the allowlist entries.
3. Delete it — if timelocked content was superseded, ~1,100 lines and five test files stop being maintained.

Recorded in the allowlist as debt in the meantime, deliberately loud. crypto/aead and crypto/kem may deserve separate treatment: they are general primitives that could have callers beyond this feature.

[Zyrtnin]

Crypto half resolved in #560 (merged). This stays open for the timelock half, which is the part that needs a product decision.

Done — option 2 for the primitives

crypto/aead and crypto/kem are now exported from the top-level package. They took option 2 rather than waiting on the feature decision for two reasons:

• they are general primitives whose fate is not coupled to the timelock feature's. Stronger than I first wrote here: nothing in src/ imports them at all — not even the timelock modules, which share only the scheme name strings via encrypted_content.py. kem imports aead, timelock_reveal_tx imports timelock, and the two pairs never meet outside tests/test_glyph_timelock_e2e.py. The "feature" is a coherent whole only in a test file, which is this issue's own finding stated one level sharper;
• they are byte-compatible with Photonic Wallet (packages/lib/src/encryption.ts, verified against the draft-irtf-cfrg-xchacha-03 Appendix A.3.1 vector). Encrypting Glyph content with pyrxd and decrypting it in Photonic is the actual use case, which is what makes a public surface right rather than incidental.

The exported set is chosen to be usable, not merely to clear the allowlist: encrypt_chunked → ChunkedCiphertext → decrypt_chunked, wrap_cek_x25519 → WrappedCEK → unwrap_cek_x25519, plus x25519_public_key because a caller cannot otherwise produce a recipient key. Exporting the four flagged functions alone would have cleared the allowlist and left the entry point unreachable in practice — this issue's own defect, reintroduced by the fix for it. A test drives the full round trip using nothing but top-level names, and was verified by planting: dropping the x25519_public_key export fails it while every per-name check still passes.

Four allowlist entries removed; the stale-entry ratchet was verified to fire by re-adding one.

Open — the timelock half, ~700 lines and three test files

glyph/timelock.py and glyph/timelock_reveal_tx.py are still unreachable. Their seven allowlist entries no longer say "needs triage" — they now record the decision explicitly: kept unwired on purpose, pending a choice between

1. wire it — a CLI command and/or a GlyphClient method, which is what encrypted_content.py:236's docstring already promises users; or
2. delete it — if timelocked content was superseded, ~700 lines and three test files stop being maintained.

Option 2 (export) is not on the table for this half the way it was for the primitives: build_timelock_mint and the reveal-proof builders are a workflow, not a primitive, and exporting a workflow no path reaches would restate the problem rather than solve it.

Nothing here is urgent — it is maintained, tested code that does nothing. Recorded loudly so it stays visible rather than settling into the allowlist as background noise.

---

Edited to correct a claim about the code: this comment and #560's description originally said the crypto primitives were consumed by the timelock feature. They are not — nothing in src/ imports them. The split is more clearly right for it, but the original wording asserted a dependency that does not exist.

[Zyrtnin]

Tracker audit — retitled, because the title's numbers are now wrong. Verified against origin/main (558e49e).

The title said "~1,100 lines, 5 test files, nothing calls it". After #560 that describes neither half:

	status
crypto/aead.py (220) + crypto/kem.py (207)	RESOLVED — 7 names exported from pyrxd/__init__.py (encrypt_chunked, decrypt_chunked, ChunkedCiphertext, wrap_cek_x25519, unwrap_cek_x25519, WrappedCEK, x25519_public_key)
glyph/timelock.py (290) + glyph/timelock_reveal_tx.py (394)	OPEN — still no production caller. The only outside reference remains prose: glyph/encrypted_content.py:33,236

So the surviving scope is 684 lines and three test files, not 1,100 and five. Title updated to match.

The body's framing that the eleven symbols "are one feature" is also superseded — see the correction in the comment above: nothing in src/ imports the crypto pair at all, and the two groups meet only in tests/test_glyph_timelock_e2e.py.

Still needs a product decision (wire it, or delete it), not a code change.

[Zyrtnin]

Decision: WIRE it. (Maintainer, 2026-09-01.)

The Glyph timelock feature gets a production entry point rather than being deleted. It stays open until that lands.

Scope, per the split already recorded above: the crypto primitives are exported (#560). What needs wiring is glyph/timelock.py (add_timelock_to_metadata, is_unlocked, get_unlock_remaining, verify_cek_reveal) and glyph/timelock_reveal_tx.py (create_reveal_proof, parse_reveal_proof_script, validate_reveal_proof) — 684 lines, 3 test files.

Two halves, and they are not equally urgent:

• Read side (is_unlocked, get_unlock_remaining, verify_cek_reveal) — what a holder of someone else's timelocked token needs. pyrxd already ingests the on-chain format (encrypted_content.TimelockSpec is reachable, and glyph_inspect classifies these tokens), so this is connecting a shipped read path to tested helpers.
• Mint and reveal side (build_timelock_mint, the reveal-proof builders) — this publishes a CEK on-chain. Real, and it has never had a production caller or a real-value run.

The allowlist entries stay until the wiring lands, and their reason line will move from "kept unwired on purpose" to the PR that closes this.