aaronrene / knowtation public
feat/phase-8-p1b-offline-locked-auth-spec #2 / 2
aaronrene · 23 days ago · Jul 1, 2026 · Diff

Phase 8 P1b-a — freeze offline-locked auth spec (Thinking)

Freeze the offline-locked auth design for Knowtation so P1b-b can build mechanically against a fixed spec (RULE #8 + SD-3 Thinking→Auto split). Design only — no implementation files beyond this spec.

Closes precondition P1b (OPEN per Phase 8-a §1) at the design layer.

Deliverables (per handover prompt): - docs/PHASE-8-P1B-OFFLINE-LOCKED-AUTH-SPEC.md (681 lines, 12 sections) - §1 gap recap + owner - §2 env gate KNOWTATION_OFFLINE_LOCKED_AUTH=enabled (default off; fail-closed on misconfig) - §3 local credential store: DATA_DIR/hub_local_credentials.json, Argon2id OWASP 2024 params (t>=3, m>=64MiB, p=4), timing-safe verify, 0600 perms - §4 first-admin bootstrap: setup-token (Mechanism A) + CLI interactive (Mechanism B) - §5 JWT sub=local:<userId>, provider=local, role-store parity with hub_roles.json; self-hosted empty-roleMap default-admin DISABLED for offline-locked - §6 gateway+bridge route parity; OAuth strategies never registered when gate on; every OAuth route returns 403 before any network egress - §7 rate limiting (5/15min per username + 20/min global), lockout, 8 audit events, no-secret log rule (passphrase/hash/token/jwt never in logs) - §8 CLI/MCP token issuance (auth token command); MCP OAuth 2.1 limitation documented - §9 seven-tier test matrix with file names - §10 Scooling impact note: src/phase8/offlineConnectedMatrices.ts sign_in_auth cell flips open_precondition→available in P1b-verify (5c), not here - §11 env gate + compile-time OFFLINE_LOCKED_AUTH_CODE_SHIPPED flag (double-lock)

Non-goals: no production code, no env flip, no Scooling posture flip, no SD-8, no bundling with Phase 2F-b or Track C. Hosted path unaffected.

Branch: feat/phase-8-p1b-offline-locked-auth-spec off Muse main @ sha256:8f2c3eae... Tier 1 commit (Knowtation AGENTS.md pre-authorizes feature-branch commits). No PR to main (SD-11 — docs-only). Merge waits for P1b-b code bundle or operator request.

Stop here and ask operator for Tier 3 merge approval per handover prompt.

sha256:9aece8b053e178f55c512cea977bede27dd67132ce3427e74497ff5cc40f44c8 sha
sha256:8f2c3eae2c95f694f95c8e306187fcf29fd080ab54433d8c52d81feba878ca3f parent
+60 symbols
sha256:27ef71ee5a16d2ffb40292a6d93167a992ec911954b6898b529de52db9c2e2a3 snapshot
+60
symbols added
0
dead code introduced
Semantic Changes 60 symbols
~ docs/PHASE-8-P1B-OFFLINE-LOCKED-AUTH-SPEC.md .md 60 symbols added
+ Phase 8 P1b-a — Offline-Locked Auth Spec (Frozen Thinking Outline) section Phase 8 P1b-a — Offline-Locked Auth Spec (Frozen Thinking Outline) L1–682
+ Acceptance (P1b-a — this Thinking step) section Acceptance (P1b-a — this Thinking step) L636–652
+ Branch section Branch L674–682
+ Governance sync (both docs together, per RULE #8) section Governance sync (both docs together, per RULE #8) L665–674
+ Non-goals (P1b-a) section Non-goals (P1b-a) L652–665
+ §0 — Scope reminder (P1b-a Thinking only) section §0 — Scope reminder (P1b-a Thinking only) L15–42
+ §1 — Precondition + gap recap (why P1b is OPEN) section §1 — Precondition + gap recap (why P1b is OPEN) L42–76
+ table section table L46–49
+ §10 — Scooling impact note section §10 — Scooling impact note L554–603
+ code[typescript] variable variable code[typescript] L559–566
+ §11 — Posture constants (all hard-false until a separate Tier 3 authorization) variable section §11 — Posture constants (all hard-false until a separate Tier 3 authorization) L603–636
+ table@L608 section table@L608 L608–611
+ table@L627 section table@L627 L627–630
+ §2 — Deployment mode + env gate section §2 — Deployment mode + env gate L76–118
+ 1 Env gate section §2.1 Env gate L78–92
+ code[bash] variable variable code[bash] L80–83
+ 2 Where the gate is read section §2.2 Where the gate is read L92–104
+ 3 Fail-closed on misconfiguration section §2.3 Fail-closed on misconfiguration L104–118
+ §3 — Local credential store contract section §3 — Local credential store contract L118–200
+ 1 Store location + file format section §3.1 Store location + file format L120–151
+ code[json] variable variable code[json] L126–141
+ 2 Argon2id parameters (OWASP 2024 — frozen) section §3.2 Argon2id parameters (OWASP 2024 — frozen) L151–170
+ code variable variable code L155–164
+ 3 Verification flow section §3.3 Verification flow L170–187
+ code variable variable code L172–180
+ 4 At-rest protection section §3.4 At-rest protection L187–200
+ §4 — First-admin bootstrap on air-gapped install section §4 — First-admin bootstrap on air-gapped install L200–258
+ 1 Mechanism A — Setup token (one-time, out-of-band) section §4.1 Mechanism A — Setup token (one-time, out-of-band) L206–234
+ code[bash] variable variable code[bash] L208–213
+ 2 Mechanism B — CLI bootstrap (interactive, on-host) section §4.2 Mechanism B — CLI bootstrap (interactive, on-host) L234–258
+ code[bash] variable variable code[bash] L236–241
+ §5 — JWT sub format + role-store parity section §5 — JWT sub format + role-store parity L258–332
+ 1 JWT payload shape section §5.1 JWT payload shape L260–296
+ code[javascript] variable variable code[javascript] L274–291
+ table section table L265–273
+ 2 Role-store parity section §5.2 Role-store parity L296–316
+ code[javascript] variable variable code[javascript] L301–309
+ 3 Self-hosted default-admin parity section §5.3 Self-hosted default-admin parity L316–332
+ §6 — Gateway + bridge route parity + fail-closed OAuth blocking section §6 — Gateway + bridge route parity + fail-closed OAuth blocking L332–419
+ 1 New local login route (mounted only when gate on) section §6.1 New local login route (mounted only when gate on) L334–356
+ code variable variable code L336–348
+ 2 Bootstrap route (mounted only when gate on) section §6.2 Bootstrap route (mounted only when gate on) L356–377
+ code variable variable code L358–370
+ 3 Fail-closed OAuth blocking (when gate on) section §6.3 Fail-closed OAuth blocking (when gate on) L377–403
+ table section table L382–394
+ 4 Bridge parity section §6.4 Bridge parity L403–419
+ §7 — Rate limiting, lockout, audit events (no secrets in logs) section §7 — Rate limiting, lockout, audit events (no secrets in logs) L419–469
+ 1 Per-username rate limit section §7.1 Per-username rate limit L421–435
+ 2 Global rate limit section §7.2 Global rate limit L435–441
+ 3 Audit events (frozen event names) section §7.3 Audit events (frozen event names) L441–461
+ table section table L446–456
+ 4 Setup-token rate limit section §7.4 Setup-token rate limit L461–469
+ §8 — CLI / MCP token issuance path for offline-locked mode section §8 — CLI / MCP token issuance path for offline-locked mode L469–526
+ 1 The gap section §8.1 The gap L471–481
+ 2 CLI token issuance command section §8.2 CLI token issuance command L481–505
+ code[bash] variable variable code[bash] L483–495
+ 3 MCP usage of the token section §8.3 MCP usage of the token L505–516
+ 4 Token revocation section §8.4 Token revocation L516–526
+ §9 — Seven-tier test matrix (test file names, not impl) section §9 — Seven-tier test matrix (test file names, not impl) L526–554
+ table section table L533–542
← Older Oldest on feat/phase-8-p1b-offline-locked-auth-spec
All commits Newer Phase 8 P1b — offline-locked auth spec + inert build (P1b-a + P1b-b). sha256:7cf3c4d68aca19c174709e8978de9673e1c88721315107a139a968591ccdafb3

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:9aece8b053e178f55c512cea977bede27dd67132ce3427e74497ff5cc40f44c8 --body "your comment"