A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live
web-sign-in
The deployed surfaces know who is asking, and the identity providers are data
8issuesdevtask.milestone
1readydevtask.milestone
7blockeddevtask.milestone
0activedevtask.milestone
0completedevtask.milestone
The milestone
devtask.milestone- Title
- The deployed surfaces know who is asking, and the identity providers are data
- Outcome
- One canonical identity-provider kind under .ai/repo/identity/providers/ describes each provider as data: its issuer, its endpoints or its discovery document, the scopes requested, the claim that carries a stable subject and the environment variable names its credentials arrive in. A single OpenID-Connect-shaped flow in the executable serves every provider in that directory; Google and Facebook are two objects, not two code paths. Sessions are cookie-borne, signed, short and revocable; identity is attached to a request once, in the router, and every surface — HTTP, Cockpit, OpenAPI, MCP — reads it from the same place. The capability registry's effect classification, not a per-route list, decides what an anonymous reader may do, and the OpenAPI document and the Cockpit both state that decision because both project it from the registry. Striking a provider is deleting one file and regenerating.
- Status
- PLANNED
- Rank
0- Depends on
- unknown: the record declares no `depends_on`
- Waiting on
- none
- Holds back
- none
- Record
.ai/repo/project/milestones/web-sign-in.yaml- Its issues
- Every issue of this milestone
Where the work is
- Ready
- Blocked
- Waiting
- —
- Active
- —
- In review
- —
- Completion blocked
- —
- Complete
- —
- Cancelled
- —
What holds the most back
What may run at the same time
| Wave | Together | Serialised by scope |
|---|---|---|
| 0 | — |
Every issue
| Readiness | Status | Issue | Title | Wave | Priority | Waiting on | Holds back |
|---|---|---|---|---|---|---|---|
| ready | READY | I1201 | An identity provider is a declarative object, and Google and Facebook are two of them | 0 | p0 | — | 7 |
| blocked | BLOCKED | I1202 | One typed provider model reads the objects, and no code names a provider | 1 | p0 | 6 | |
| blocked | BLOCKED | I1203 | One flow serves every provider, and it refuses everything it did not start | 2 | p0 | 5 | |
| blocked | BLOCKED | I1204 | The session is signed, short, and revocable from the server | 3 | p0 | 4 | |
| blocked | BLOCKED | I1205 | Identity is resolved once, in the router, and every surface reads it from there | 4 | p1 | 2 | |
| blocked | BLOCKED | I1206 | What an anonymous reader may do is derived from the effect classification, not from a list | 5 | p1 | 1 | |
| blocked | BLOCKED | I1207 | No credential reaches any output, and hostile provider metadata renders safely | 4 | p0 | 0 | |
| blocked | BLOCKED | I1208 | Adding a provider is one file, removing one is one deletion, and both are executed rather than described | 6 | p1 | 0 |
Findings
| Level | Code | Message | Reproduce |
|---|---|---|---|
| WARN | scope_conflict | I1201: shares share/schemas with I1900; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | I1201: shares share/schemas with I1980; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | I1201: shares share/skeleton with I1990; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | I1201: shares share/skeleton with I1999; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | I1201: shares share/schemas with I2410; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | I1201: shares share/skeleton with I2412; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | I1201: shares share/schemas with I2670; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | I1201: shares share/schemas with I2742; they may not run concurrently | majordomus plan validate |