aaronrene / knowtation public
main #96 / 100
AI Agent git-import/068377df · 66 days ago · Jul 1, 2026 · Diff

Phase 8 P1b-a — freeze offline-locked auth spec (Thinking)

Freeze the offline-locked auth design for Knowtation so P1b-b can build mechanically against a fixed spec (RULE #8 + SD-3 Thinking→Auto split). Design only — no implementation files beyond this spec.

Mirrors Muse commit sha256:9aece8b0... on feat/phase-8-p1b-offline-locked-auth-spec.

Closes precondition P1b (OPEN per Phase 8-a §1) at the design layer.

Highlights (see spec for full contract): - env gate KNOWTATION_OFFLINE_LOCKED_AUTH=enabled (default off; fail-closed on misconfig) - local credential store: DATA_DIR/hub_local_credentials.json, Argon2id OWASP 2024 - first-admin bootstrap: setup-token + CLI interactive - JWT sub=local:<userId>, provider=local, role-store parity with hub_roles.json - OAuth strategies never registered when gate on; every OAuth route returns 403 before any network egress - rate limiting, lockout, 8 audit events, no-secret log rule - CLI/MCP token issuance path - seven-tier test matrix with file names - Scooling impact: sign_in_auth cell flips in P1b-verify (5c), not here

Non-goals: no production code, no env flip, no Scooling posture flip, no SD-8, no bundling with Phase 2F-b or Track C. Hosted path unaffected.

Tier 1 commit (Knowtation AGENTS.md pre-authorizes feature-branch commits). No PR to main (SD-11 — docs-only). Merge waits for P1b-b code bundle or operator request.

sha256:0e469cb915336c8dd512d56bce2b24c0e9897ab31c36261a8bd40c5fcaf5dc47 sha
sha256:05d888fe388fe50898bb74c368acff72caf144b47ddd5d663c22115ff7889c57 parent
sha256:bd978cf1070bd762e1200ae3051b1d1a1321d04b71ee852c741c610eeab52472 snapshot
Older Merge pull request #253 from aaronrene/feat/7d-l2-grants-blob-sync sha256:05d888fe388fe50898bb74c368acff72caf144b47ddd5d663c22115ff7889c57 All commits Newer Phase 8 P1b — offline-locked auth spec + inert build (P1b-a + P1b-b). sha256:9f277c1b65d68faef097c598436c3eb89bab1a1e843d48d501027bd07757dfff

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:0e469cb915336c8dd512d56bce2b24c0e9897ab31c36261a8bd40c5fcaf5dc47 --body "your comment"