Define HTTP authentication threat model and capability contract

## What changed - add a checked-in HTTP authentication threat model covering protected assets, attacker profiles, trust boundaries, credential disclosure, authorization failures, availability abuse, audit, secret lifecycle, development bypass, CORS, and residual risks - add the previously missing KV lease trust boundary: lease assets, authenticated principal/actor/scope binding, atomic acquire-renew-release, fencing generations, TTL/time handling, replay resistance, direct-KV bypass controls, library-caller context, failure behavior, abuse controls, audit, residual risks, and required tests - define principal classes for human users, API clients, service instances, actor components, and administrators - define the v0.1 opaque API-key format and future OIDC/mTLS adapter contracts - define credential hashing, pepper rotation, creation, key rotation, revocation, bootstrap, and recovery requirements - define closed capabilities, tenant/dataset/actor/target scopes, grants, explicit denies, route mapping, bulk authorization, search isolation, and target/actor rules - define safe authentication and authorization error envelopes, audit context, caching constraints, startup validation, migration order, and the required test matrix - link all security-design documents from the documentation index and mark them clearly as design-only, not implemented ## Acceptance audit - [x] principal types: human, API client, service, actor, administrator - [x] v0.1 API key plus explicit future OIDC and mTLS adapters - [x] opaque high-entropy key with non-secret identifier and secret material - [x] one-way verifier, salt, pepper version, rehash, pepper and key rotation - [x] required document, target, search, and admin capabilities - [x] tenant, dataset, actor, target, and resource scopes - [x] authentication failures, rate limits, abuse throttling, lockout policy, and audit - [x] secret storage, bootstrap, creation, rotation, revocation, and recovery - [x] HTTP, RabbitMQ, CouchDB, KV lease, configuration, and imported-library trust boundaries - [x] protected assets, attacker profiles, flows, boundaries, failure modes, and residual risks - [x] default deny - [x] no credential or bearer material in logs or errors - [x] explicit multi-condition development bypass that cannot run on a non-loopback listener ## Merge gates - all repository CI workflows must pass on the final head - all new local Org links must resolve to checked-in paths - the acceptance audit above must remain complete after review - PR stays draft until those gates pass Fixes #26

lost-rob0t commented

2026-07-31 00:16:21 +00:00

(Migrated from github.com)

What changed

add a checked-in HTTP authentication threat model covering protected assets, attacker profiles, trust boundaries, credential disclosure, authorization failures, availability abuse, audit, secret lifecycle, development bypass, CORS, and residual risks
add the previously missing KV lease trust boundary: lease assets, authenticated principal/actor/scope binding, atomic acquire-renew-release, fencing generations, TTL/time handling, replay resistance, direct-KV bypass controls, library-caller context, failure behavior, abuse controls, audit, residual risks, and required tests
define principal classes for human users, API clients, service instances, actor components, and administrators
define the v0.1 opaque API-key format and future OIDC/mTLS adapter contracts
define credential hashing, pepper rotation, creation, key rotation, revocation, bootstrap, and recovery requirements
define closed capabilities, tenant/dataset/actor/target scopes, grants, explicit denies, route mapping, bulk authorization, search isolation, and target/actor rules
define safe authentication and authorization error envelopes, audit context, caching constraints, startup validation, migration order, and the required test matrix
link all security-design documents from the documentation index and mark them clearly as design-only, not implemented

Acceptance audit

principal types: human, API client, service, actor, administrator
v0.1 API key plus explicit future OIDC and mTLS adapters
opaque high-entropy key with non-secret identifier and secret material
one-way verifier, salt, pepper version, rehash, pepper and key rotation
required document, target, search, and admin capabilities
tenant, dataset, actor, target, and resource scopes
authentication failures, rate limits, abuse throttling, lockout policy, and audit
secret storage, bootstrap, creation, rotation, revocation, and recovery
HTTP, RabbitMQ, CouchDB, KV lease, configuration, and imported-library trust boundaries
protected assets, attacker profiles, flows, boundaries, failure modes, and residual risks
default deny
no credential or bearer material in logs or errors
explicit multi-condition development bypass that cannot run on a non-loopback listener

Merge gates

all repository CI workflows must pass on the final head
all new local Org links must resolve to checked-in paths
the acceptance audit above must remain complete after review
PR stays draft until those gates pass

Fixes #26

Rows
Columns

Define HTTP authentication threat model and capability contract #84

What changed

Acceptance audit

Merge gates