aaronrene / knowtation public
BREAKING feat/phase-8-p1b-offline-locked-auth-spec #1 / 2
aaronrene · 22 days ago · Jul 1, 2026 · Diff

Phase 8 P1b — offline-locked auth spec + inert build (P1b-a + P1b-b).

Frozen spec and mechanical implementation: Argon2id credential store, bootstrap, local login routes, CLI auth commands, OAuth fail-closed wiring. Gates remain hard-false (OFFLINE_LOCKED_AUTH_CODE_SHIPPED=false; env unset). 29/29 seven-tier tests green.

sha256:7cf3c4d68aca19c174709e8978de9673e1c88721315107a139a968591ccdafb3 sha
sha256:9aece8b053e178f55c512cea977bede27dd67132ce3427e74497ff5cc40f44c8 parent
+79 ~8 symbols
sha256:3610eda25d9e75d96017ae866bd449eb435554960d2a0c398dd0af3b34c8eb7a snapshot
+79
symbols added
~8
symbols modified
0
dead code introduced
Semantic Changes 87 symbols
~ docs/OVERSEER-HANDOVER.md .md 10 symbols added
+ Overseer Handover — Knowtation (Phase 8 P1b) section Overseer Handover — Knowtation (Phase 8 P1b) L1–84
+ Change log section Change log L78–84
+ table section table L80–84
+ Next step at a glance (2026-07-01) section Next step at a glance (2026-07-01) L10–23
+ table section table L12–20
+ Next-chat prompt — P1b-c compile-time flag flip · Model: Auto (Tier 3) section Next-chat prompt — P1b-c compile-time flag flip · Model: Auto (Tier 3) L49–78
+ code[text] variable variable code[text] L53–75
+ Verified snapshot (P1b-b) section Verified snapshot (P1b-b) L23–49
+ code[bash] variable variable code[bash] L37–46
+ table section table L25–34
+ hub/lib/breached-passwords-sha1.txt .txt
~ hub/lib/breached-passwords.mjs .mjs 3 symbols added
+ isBreachedPassphrase function function isBreachedPassphrase L36–40
+ loadBreachedPasswordSha1Set function function loadBreachedPasswordSha1Set L20–30
+ validatePassphraseStrength function function validatePassphraseStrength L47–57
~ hub/lib/local-auth-audit.mjs .mjs 2 symbols added
+ appendLocalAuthAudit function function appendLocalAuthAudit L14–26
+ requestAuditMeta function function requestAuditMeta L32–41
~ hub/lib/local-auth-bootstrap.mjs .mjs 17 symbols added
+ bootstrapAdminCli function async_function bootstrapAdminCli L325–337
+ bootstrapPath function function bootstrapPath L50–52
+ checkBootstrapRateLimit function function checkBootstrapRateLimit L190–205
+ consumeSetupToken function async_function consumeSetupToken L222–312
+ generateSetupToken function function generateSetupToken L146–163
+ hashSetupToken function function hashSetupToken L58–60
+ isBootstrapped function function isBootstrapped L343–345
+ loadBootstrapRecord function function loadBootstrapRecord L83–91
+ loadConsumedTokenHashes function function loadConsumedTokenHashes L22–32
+ markTokenHashConsumed function function markTokenHashConsumed L38–44
+ normalizeUsernameCompare function function normalizeUsernameCompare L314–316
+ parseExpiresInMs function function parseExpiresInMs L126–137
+ pruneExpiredBootstrapRecord function function pruneExpiredBootstrapRecord L109–119
+ resetBootstrapRateLimitForTests function function resetBootstrapRateLimitForTests L208–211
+ saveBootstrapRecord function function saveBootstrapRecord L97–103
+ verifySetupTokenHash function function verifySetupTokenHash L68–77
+ withBootstrapMutex function function withBootstrapMutex L173–180
~ hub/lib/local-auth-cli.mjs .mjs 7 symbols added
+ getOpt function function getOpt L93–99
+ onData function function onData L31–55
+ parseTokenExpiresIn function function parseTokenExpiresIn L74–85
+ promptPassphraseTTY function function promptPassphraseTTY L20–58
+ resolveCliDataDir function function resolveCliDataDir L64–67
+ runAuthCli function async_function runAuthCli L91–196
+ shortOpt function function shortOpt L100–106
~ hub/lib/local-auth-feature-flag.mjs .mjs 1 symbol added
+ isOfflineLockedAuthActive function function isOfflineLockedAuthActive L17–27
~ hub/lib/local-auth-gate.mjs .mjs 2 symbols added
+ readOfflineLockedAuthEnvGate function function readOfflineLockedAuthEnvGate L11–14
+ resolveOfflineLockedAuthPosture function function resolveOfflineLockedAuthPosture L21–26
~ hub/lib/local-auth-oauth-guard.mjs .mjs 2 symbols added
+ logBootstrapInstructionOnce function function logBootstrapInstructionOnce L37–45
+ oauthDisabledGuard function function oauthDisabledGuard L14–30
~ hub/lib/local-auth-role.mjs .mjs 3 symbols added
+ effectiveRoleForHub function function effectiveRoleForHub L56–62
+ hasBootstrappedAdmin function function hasBootstrappedAdmin L35–47
+ resolveLocalAuthRole function function resolveLocalAuthRole L17–28
~ hub/lib/local-auth-routes.mjs .mjs 2 symbols added
+ localAuthProvidersHandler function function localAuthProvidersHandler L158–163
+ registerLocalAuthRoutes function function registerLocalAuthRoutes L28–151
~ hub/lib/local-auth.mjs .mjs 24 symbols added
+ assertArgon2ParamsFloor function function assertArgon2ParamsFloor L68–74
+ authenticateLocalUser function async_function authenticateLocalUser L363–403
+ checkAccountLocked function function checkAccountLocked L286–292
+ checkGlobalLoginRateLimit function function checkGlobalLoginRateLimit L334–347
+ chmod0600 function function chmod0600 L60–62
+ clearLoginAttempts function function clearLoginAttempts L322–324
+ createLocalCredential function async_function createLocalCredential L202–226
+ credentialStoreHasAdmin function function credentialStoreHasAdmin L232–240
+ credentialsPath function function credentialsPath L45–47
+ findCredentialByUsername function function findCredentialByUsername L133–140
+ hasAnyCredential function function hasAnyCredential L246–249
+ hashPassphrase function async_function hashPassphrase L146–151
+ issueCliLocalToken function async_function issueCliLocalToken L413–417
+ issueLocalToken function function issueLocalToken L179–192
+ loadCredentialStore function function loadCredentialStore L96–108
+ loadLoginAttempts function function loadLoginAttempts L255–264
+ loginAttemptsPath function function loginAttemptsPath L53–55
+ normalizeUsername function function normalizeUsername L36–39
+ parsePhcParams function function parsePhcParams L81–90
+ recordLoginFailure function function recordLoginFailure L298–316
+ resetGlobalLoginRateLimitForTests function function resetGlobalLoginRateLimitForTests L350–353
+ saveCredentialStore function function saveCredentialStore L114–126
+ saveLoginAttempts function function saveLoginAttempts L270–276
+ verifyPassphrase function async_function verifyPassphrase L159–170
+ test/data-integrity/phase8-p1b-store-persistence.test.mjs .mjs
+ test/e2e/phase8-p1b-airgapped-walkthrough.test.mjs .mjs
~ test/helpers/phase8-p1b-local-auth-harness.mjs .mjs 4 symbols added
+ bootstrapTestAdmin function async_function bootstrapTestAdmin L112–114
+ createLocalAuthTestApp function async_function createLocalAuthTestApp L51–106
+ enableOfflineLockedTestEnv function function enableOfflineLockedTestEnv L38–45
+ makeTempDataDir function async_function makeTempDataDir L21–33
~ test/integration/phase8-p1b-local-login-flow.test.mjs .mjs 1 symbol added
+ bridgeEffectiveRole function function bridgeEffectiveRole L18–24
+ test/performance/phase8-p1b-argon2id-latency.test.mjs .mjs
+ test/security/phase8-p1b-bootstrap-replay.test.mjs .mjs
~ test/security/phase8-p1b-no-secrets-and-fail-closed.test.mjs .mjs 1 symbol added
+ avg function function avg L81–81
+ test/stress/phase8-p1b-lockout-and-bootstrap-contention.test.mjs .mjs
+ test/unit/phase8-p1b-local-credential-store.test.mjs .mjs
~ cli/index.mjs .mjs 1 symbol modified
~ main
~ docs/PHASE-8-P1B-OFFLINE-LOCKED-AUTH-SPEC.md .md 3 symbols modified
~ table@L608
~ table@L627
~ Phase 8 P1b-a — Offline-Locked Auth Spec (Frozen Thinking Outline)
~ hub/gateway/server.mjs .mjs 1 symbol modified
~ roleForSub
~ hub/server.mjs .mjs 3 symbols modified
~ effectiveRole
~ issueAccessTokenForSub
~ issueToken
~ package-lock.json .json
~ package.json .json
Older Phase 8 P1b-a — freeze offline-locked auth spec (Thinking) sha256:9aece8b053e178f55c512cea977bede27dd67132ce3427e74497ff5cc40f44c8 All commits
Newer → Latest on feat/phase-8-p1b-offline-locked-auth-spec

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:7cf3c4d68aca19c174709e8978de9673e1c88721315107a139a968591ccdafb3 --body "your comment"