A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live
I1201
An identity provider is a declarative object, and Google and Facebook are two of them
Where it stands
devtask.issue- Readiness
- ready no dependency and no gate holds it; nobody has started it
- Status
- READY
- Can start
- startable
- Milestone
- Milestone status
- PLANNED
- Wave
0- Waiting on
- none
- Holds back
- Behind it in all
7- Evidence
0of3
Moves
plan.transitionWhat it is
- Objective
- Introduce the identity-provider kind: a JSON Schema, an entry in share/kinds.yaml, the generated allow-list, a directory contract under .ai/repo/identity/providers/, and the first two objects — google and facebook — each stating its issuer, its endpoints or discovery document, the scopes it is asked for, the claim that carries a stable subject, the environment variable names its client id and client secret arrive in, its display name and its order in the sign-in offer.
- Why
- The provider set is expected to change, and the operator has said both of the first two may be struck. A provider that is a file is struck by deleting the file; a provider that is a match arm is struck by a release. Every other fact of this repository is already declared once and projected, and identity is not an exception to that.
- Now
- There is no identity kind, no .ai/repo/identity directory and no notion of a provider anywhere in the layer or the executable.
- Wanted
- share/kinds.yaml carries an identity-provider kind with a schema, the allow-list is generated from that schema by majordomus generate, .ai/repo/identity/providers/ has its README chain and its two objects, and the index reports them like any other kind.
- Done when
- unknown: the record declares no `completion`
- Risk
- A schema shaped around Google will need an escape hatch for Facebook the same day. The schema is written against the OpenID Connect flow, and any field only one provider can fill is evidence the shape is wrong.
Acceptance
- The schema expresses one flow shape, and both objects validate against it without a per-provider escape hatch
- Credentials are named, never carried: each object states the environment variable names and holds no value
- The directory satisfies the recursive README and front-matter doctrine of the layer
- The allow-list is generated from the schema by majordomus generate rather than written by hand
- majordomus doctor reports the new kind and both objects with no diagnostic
- Validation
majordomus generate --checkbin/majordomus doctorbash test/run.sh- Evidence required
schema_addedobjects_validateallow_list_generated- Evidence present
- unknown: the record carries no `evidence` entries
Scope
- Touches
.ai/repo/identityshare/kinds.yamlshare/schemasshare/allowshare/skeleton- Not
Any Rust code that reads the objects, which is I1202A client secret, a client id or any credential value in any file of the repositoryA provider-specific field that only one of the two objects can use- Depends on
- unknown: the record declares no `depends_on`
- Priority
- p0
- Profile
- implementation
- Parallel safe
- false
- Owner
- unknown: the record declares no `owner`
The work so far
- Branches
- none
- Merged
- none
- Commits
0- Trunk
- master
- Sessions
- none
- Created
- 2026-09-08
- Updated
- 2026-09-08
- Started
- unknown: the record declares no `started_at`
- Verified
- unknown: the record declares no `verified_at`
- Completed
- unknown: the record declares no `completed_at`
Synchronisation
- Adapter
scripts/github-sync- Repository
- unknown: the derived plan's header carries no repository
- External issue
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
- State there
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
Findings
| Level | Code | Message | Reproduce |
|---|---|---|---|
| WARN | scope_conflict | shares share/schemas with I1900; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares share/schemas with I1980; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares share/skeleton with I1990; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares share/skeleton with I1999; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares share/schemas with I2410; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares share/skeleton with I2412; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares share/schemas with I2670; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares share/schemas with I2742; they may not run concurrently | majordomus plan validate |