Repository navigation
id: design: hosted provisioning + SSO→ID binding spec — account/binding records, challenge ceremony, delayed rebind, metering, export (from #2045) #2258
Description
From the #2045 investigation (hosted data option)
Investigation #2045 (queue task 3354, result posted on that issue 2026-10-29) designed the hosted offer on top of #2044's Workers fit: lazy per-user Durable Object provisioning with structural isolation, R2 for blobs, the Google sub → Iroh ID binding ceremony (key-signed challenge; sign-in alone never binds), a deliberately slow delayed-rebind recovery path, shape comparison (static/local, per-user DO, per-world DO, containers rejected as a tier), and cost guardrails (idle = $0, per-user metering, ephemeral-container rule, signed-object export). This issue is the implementation spec. Spec only — no permanent feature on an unreviewed investigation (program rule, epic #2056).
Spec to produce (doc in pkgs/id/doc/ per repo convention, linked from this issue)
- Account + binding records: schemas keyed on Google
sub; binding record format (key-signed challenge proof + service attestation); device-grant linkage to the existing groups layer. - Binding ceremony flow: challenge issuance/verification, in-browser and from-own-node variants, failure and retry semantics.
- Delayed-rebind protocol: request, notification, waiting period, publication of the rebind record; what the old key can do to cancel it.
- Provisioning + metering: lazy DO creation, schema bootstrap, per-user request/storage metering, budget ceilings and graceful-degradation behaviour (read-only + export prompt at cap).
- Export format: full store export as signed objects + binding record, and the corresponding import verification on a self-hosted node.
Acceptance criteria
- Spec doc landed in
pkgs/id/doc/and linked from this issue, covering all five points - The client-side-encryption option is specified (what is encrypted, what hosted features degrade), even though its default is a id: design: ID serverless edition v1 (Cloudflare Workers) #2046/Drew decision
- Open parameters (tier numbers, rebind waiting period) are listed for id: design: ID serverless edition v1 (Cloudflare Workers) #2046, not silently defaulted
- Implementation work, if any, is filed as its own issue(s) — this issue delivers the spec only
Program: ID platform expansion, epic #2056. Parent investigation: #2045. Related: #2044 (Workers fit), #2046 (serverless edition v1 synthesis — inputs now complete), #2032 (budgets), #2030.
Activity
developing-today commentedon Oct 29, 2026
CODE-1121
dezren39 commentedon Oct 30, 2026
🤖 Agent note · picked up
dezren39 commentedon Oct 30, 2026
🤖 Agent note · done (triage)
pkgs/id/doc/exists on current main as the doc location the issue names. No spec doc exists there yet; no hard-stop labels on this issue.pkgs/id/doc/, link it here, and file any implementation work as separate issues. This issue stays open against that task.20 remaining items
dezren39 commentedon Oct 30, 2026
🤖 Agent note · parked
7ac34395(MERGEABLE/CLEAN, doc-only, no CI workflows triggered). Round-1 Codex review completed with 4 P2 findings — challenge transcript not exported, monotonic storage counters, fresh-binding bypass during rebind_pending, blob contents unverified at import — all four fixed in7ac34395, each thread replied to and resolved.@codex reviewrequested 2026-10-30T23:12Z; re-review still running at park time. Resume: read the completed re-review, disposition any new findings, then squash-merge (closes this issue). Implementation: id: implement hosted provisioning + SSO→ID binding (from spec #2258) #2852.chatgpt-codex-connector commentedon Oct 30, 2026
To use Codex here, create an environment for this repo.
dezren39 commentedon Oct 30, 2026
Resumed by repo queue worker (lane E) as queue task 3955 — reading the Codex re-review of PR #2853 head 7ac3439 and fresh check state; merge if no undispositioned findings and checks are green.
id spec: permit reclaiming deletes at storage cap; regenerate service…
Merge pull request #2853 from developing-today/queue/3955-2258-hosted…
dezren39 commentedon Oct 30, 2026
Done — PR #2853 merged (merge commit f666f18). Resumed at the Codex gate: round-2 re-review had two undispositioned P2 findings; both were fixed in 1556094 (§5.4 now permits space-reclaiming user-confirmed deletes at the storage cap; §1.2/§4.2 now require
service_attestationregeneration on every binding-record mutation) and answered on their threads. Codex round-3 review of the new head completed with zero findings.id: hosted account + ID binding ceremony (spec §§1,3) (#3808)