docs: add the login/self-service-accounts prompt and the ZITADEL deploy slice prompt #10

Merged

nsaspy merged 1 commit from docs/login-and-oidc-prompts into main

2026-09-06 23:50:22 +00:00

nsaspy commented

2026-09-06 23:50:21 +00:00

Owner

Operator goal: let others create accounts on quasar.starintel.actor. Two prompts, two paths, both honest about which one retires the other:

self-service-accounts.md — the interim password path: a minimal public /login page with bridge-mediated registration against the existing CouchDB-backed user store (least-privilege server credential, per-IP rate limits, fixed default scopes). Opens ONLY /login + the two auth endpoints through path-aware mallcop gating; the SPA stays behind the gateway gate until quasar #71, and the page says so. Prerequisites: the quasar scope capability, transport hardening, and logging hygiene prompts.
oidc-zitadel-deploy.md — the end-state path, executing section 1 of oidc-finalization.md as its own infra slice: ZITADEL live at auth.starintel.actor (currently a 404 placeholder, verified), self-service registration per topology policy, secrets via the established deploy material pattern. OIDC natively answers account self-service and retires the interim path.

Local verification: six slice prompts pass the section-contract + no-credential-material + no-environment-address scan; quasar-auth suite 36 checks 0 failures; prolog-verify check passed (observations recorded at f99ad75).

Operator goal: let others create accounts on quasar.starintel.actor. Two prompts, two paths, both honest about which one retires the other: - **self-service-accounts.md** — the interim password path: a minimal public /login page with bridge-mediated registration against the existing CouchDB-backed user store (least-privilege server credential, per-IP rate limits, fixed default scopes). Opens ONLY /login + the two auth endpoints through path-aware mallcop gating; the SPA stays behind the gateway gate until quasar #71, and the page says so. Prerequisites: the quasar scope capability, transport hardening, and logging hygiene prompts. - **oidc-zitadel-deploy.md** — the end-state path, executing section 1 of oidc-finalization.md as its own infra slice: ZITADEL live at auth.starintel.actor (currently a 404 placeholder, verified), self-service registration per topology policy, secrets via the established deploy material pattern. OIDC natively answers account self-service and retires the interim path. Local verification: six slice prompts pass the section-contract + no-credential-material + no-environment-address scan; quasar-auth suite 36 checks 0 failures; prolog-verify check passed (observations recorded at f99ad75).

nsaspy added 1 commit

2026-09-06 23:50:21 +00:00

docs: add the login/self-service-accounts prompt and the ZITADEL deploy slice prompt f99ad75498

self-service-accounts.md is the interim password path: a minimal public
/login page with bridge-mediated registration against the existing
starintel-server user store, opening only the three auth paths while
the SPA stays gated until quasar #71. oidc-zitadel-deploy.md executes
section 1 of oidc-finalization.md as its own infra slice: ZITADEL live
at auth.starintel.actor (currently 404) with self-service
registration. The interim path is explicitly retired by OIDC.

nsaspy merged commit 89702b97fd into main

2026-09-06 23:50:22 +00:00

nsaspy referenced this pull request from a commit

2026-09-06 23:50:23 +00:00

Merge pull request 'docs: add the login/self-service-accounts prompt and the ZITADEL deploy slice prompt' (#10) from docs/login-and-oidc-prompts into main