The daemon branched on AUTHSOME_DEPLOYMENT_MODE and ran two parallel
implementations of nearly every ownership concept. "Local and hosted
behave the same" was asserted in prose (ADR 0006) but never enforced in
code, so the paths were free to drift, and the synthetic local principal
let a second local identity silently inherit the admin principal.
Collapse to one flow, identical for every deployment: authsome init
registers an identity and gets back a browser claim URL; the user
registers email+password (first principal becomes admin); that principal
confirms the claim; PoP calls are then authorized.
- Remove AUTHSOME_DEPLOYMENT_MODE, get_deployment_mode(),
LOCAL_PRINCIPAL_EMAIL, the Local*/Hosted* resolver and bootstrap
classes, and the AuthService(deployment_mode=...) parameter.
- OwnershipResolver and IdentityBootstrapService become single concrete
classes (the former hosted, claim-based implementations).
- Admin gating is purely role-based: non-admin principals are blocked in
every deployment (previously implicitly allowed in local mode).
- The server UI always requires a hosted browser session; remove the
vestigial HealthResponse.mode field.
- CLI ensure_identity_ready was already mode-agnostic; it now prints the
claim URL to stderr for headless use.
Add ADR 0007 recording the decision; amend ADR 0006 and CONTEXT.md.
BREAKING CHANGE: existing local installs have an unclaimed identity under
local@authsome.internal and are rejected until the user registers a
principal (email+password) and claims the identity.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Entire-Checkpoint: d31cf246f6f2
Replaces the flat FernetEncryptionWrapper + EncryptionConfig model with a
proper envelope encryption scheme:
- MasterSecretResolver: unified resolution order (env → file → keyring →
auto-generate) under a single AUTHSOME_MASTER_KEY env var; no separate
passphrase vs raw-key distinction — both go through Argon2id
- DekManager: generates a random 256-bit DEK, wraps it with an
Argon2id-derived KEK (AES-256-GCM), and stores the wrapped record in the
KV store under __vault_meta__:__dek__ so it works with any KV backend
- AesGcmEncryptionWrapper: drop-in BaseEncryptionWrapper using AES-256-GCM
per-value encryption via closure; replaces FernetEncryptionWrapper
- Vault: simplified — no longer owns crypto or lifecycle; receives an
already-encrypted AsyncKeyValue; close() removed (caller manages store)
- EncryptionConfig removed from ServerConfig and models __all__
- Health route updated to report crypto_source from Vault properties
- Tests rewritten with fixtures and SimpleStore (in-memory); no DiskStore
BREAKING CHANGE: existing Fernet-encrypted vaults cannot be read back;
migration requires re-importing credentials.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: a778dfa71075
- Add ClaimStatus enum (PENDING/ACCEPTED/REJECTED) to IdentityClaimRecord
with accept_claim() and reject_claim() on IdentityClaimRegistry
- HostedOwnershipResolver.resolve() now gates vault access on ACCEPTED;
PENDING raises 403, REJECTED raises 403 with distinct message
- ensure_claimed_identity() auto-accepts on UI form submission — the form
IS the approval act in this release; PENDING is transit state only
- Remove AuthService vault_id fallback (vault_id or identity); _coll now
raises ValueError if vault_id is None, making missing wiring explicit
- /ready endpoint resolves vault_id via ownership_resolver instead of
constructing AuthService with the identity handle as a stopgap
- create_auth_service() requires explicit vault_id parameter
- Rewrite ADR 0003 and update UBIQUITOUS_LANGUAGE.md to reflect opaque
VaultId design (single segment, not principal_handle/vault_handle)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 8f56337e3615
- Fix `health.py` import from non-existent `authsome.identity` to
`authsome.actors` where `current_from_home` is defined
- Add missing `ConnectionRecord`, `AuthType`, `ConnectionStatus` imports
in test_pop_auth.py
- Use `vault=` (not `identity=`) in `build_store_key` so the stored key
matches the `vault:` prefix that `list_connections` searches
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: f4892f79b920
Make the daemon identity registry authoritative for protected PoP requests and remove implicit default-profile identity behavior.
Store daemon-owned state under server/ while keeping CLI signing identity files under identities/.
BREAKING CHANGE: Existing implicit default-profile installs must run authsome init again; profile:default credentials are not migrated.
Entire-Checkpoint: 557455816515
Ankit Ranjan