diff --git a/docs/superpowers/specs/2026-05-21-mypass-design.md b/docs/superpowers/specs/2026-05-21-mypass-design.md
index 746badb..0bc9272 100644
--- a/docs/superpowers/specs/2026-05-21-mypass-design.md
+++ b/docs/superpowers/specs/2026-05-21-mypass-design.md
@@ -46,18 +46,21 @@ MyPass (Main App Target)  ──links──► MyPassCore
 ├── BiometricAuthService  — LAContext wrapper
 └── ClipboardService      — copy with 30 s expiry
 
-AutoFillExtension (App Extension Target)  ──links──► MyPassCore
+AutoFill (App Extension Target)  ──links──► MyPassCore
 ├── ASCredentialProviderViewController subclass
 ├── CredentialListView    — filtered by serviceIdentifier URL/domain
 └── UnlockView (mini)     — Face ID → password fallback
 
-Shared App Group (group.com.christophevila.mypass)
+Shared App Group (group.org.antiloop222.mypass)
 ├── UserDefaults          — security-scoped bookmark, last-opened vault, settings
-└── Keychain Access Group — master password, biometric token
+└── Keychain Access Group — master password, biometric token (org.antiloop222.mypass)
 ```
 
 **External dependencies (SPM)**
-- A KDBX parsing library (to be confirmed during implementation — evaluate available Swift/ObjC options supporting KDBX 3.1 and 4.0 with Argon2 KDF)
+- KDBX parsing: KeePassKit (Objective-C, MIT). No upstream SPM support, so vendored locally as a git submodule (`Vendor/KeePassKit`) with a hand-written `Package.swift`. This pulled in the same problem three more times — none of the following had clean drop-in SPM support either, so all are vendored the same way:
+  - KissXML (`Vendor/KissXML`) — XML parsing KeePassKit depends on
+  - Argon2 (nested git submodule inside `Vendor/KeePassKit`) — KDBX4 key derivation
+  - ChaCha20 / TwoFish — cipher implementations already bundled in KeePassKit's own source tree, wired into the SPM target
 - Apple CryptoKit (built-in)
 - LocalAuthentication (built-in)
 - AuthenticationServices (built-in)
@@ -231,8 +234,8 @@ Entry URL field is matched against the `serviceIdentifier` using host comparison
 
 ---
 
-## Open Questions (resolved at implementation time)
+## Open Questions
 
-1. **KDBX library:** Evaluate Swift Package Manager options that support KDBX 3.1 + 4.0 with Argon2. Fallback: KeePassKit (Objective-C via bridging header).
+1. ~~**KDBX library:** Evaluate Swift Package Manager options that support KDBX 3.1 + 4.0 with Argon2. Fallback: KeePassKit (Objective-C via bridging header).~~ **Resolved:** no SPM-native option was found; KeePassKit is used, vendored locally (see External dependencies above).
 2. **macOS AutoFill:** `ASCredentialProviderExtension` on macOS 13+ has reduced scope vs iOS — verify which apps support third-party fill on macOS and document limitations.
 3. **Associated Domains:** For bundle-ID-based AutoFill matching, an associated domains file may be needed for first-party apps. Evaluate at implementation time.