Repository navigation
id: keyset/authorization log — device keys, revocation, bindings as signed records (identity substrate) #2380
Description
Follow-up from the key-recovery investigation on #2060 (doc: investigations/key-recovery.md in the ID program workspace, §1/§3/§7). Parent epic: #2056.
Problem
pkgs/id identity is a single Iroh Ed25519 secret key (src/local.rs: SecretKey::generate() / open_with_key); the public key IS the account (invites name it directly, src/invite.rs). There is no indirection for device keys, revocation, IdP bindings, or rotations — so a lost key is a lost identity and a second device is a second account.
Proposal
Design (then implement) a signed keyset/authorization log as the identity substrate: an identity identifier plus an append-only chain of signed records — device-key enrolment/revocation, hosted IdP claim bindings (#2044 §4.3 option 1), guardian sets (see social-recovery follow-up), and key rotations. Group membership and directory records bind to the identity, not to one key. Keyset-admin operations (add/revoke device, change guardians) are narrower-scoped than everyday signing.
Acceptance
- Design doc section or ADR covering record formats, fold/verification rules, and the identity identifier derivation.
- Enrolment + revocation of a second device key via QR/invite-style pairing (
src/qr.rs,src/invite.rssurfaces exist). - Existing group-encryption per-device sessions (
src/encryption/) consume device keys from the keyset. - Old single-key accounts migrate via a genesis keyset record signed by the existing key.
Activity
developing-today commentedon Oct 29, 2026
CODE-1207
dezren39 commentedon Nov 3, 2026
🤖 Agent note · triaged (still live, design-first; follow-up enqueued)
repo-worker-code), lanecode-mFresh verification (2026-11-03T16:35Z,
gh, current main):pkgs/id/srclisting showslocal.rs,invite.rs,qr.rs,encryption/,hosted_binding.rs,idset.rs— no keyset / authorization-log module; code search for "keyset" in this repo hits only unrelatedpkgs/identity/web/web.go; no PR in any state mentions keyset. The issue's premise stands: identity is still the single Iroh Ed25519 key insrc/local.rs, with invites naming the public key directly.Scoping / ordering:
qr.rs/invite.rssurfaces →src/encryption/per-device sessions consuming keyset device keys → genesis keyset migration for existing single-key accounts.Triage task 7904 completes as triaged; the fix path is task 8502.
37 remaining items
dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 4, 2026
agent-note:v1
event: picked_up (resume)
task: 8502 (repo-health-code-pilot; openchamber-scheduled-lane 7b47536b-c162-444c-be8a-3a9538cc4cb5)
state: claimed; fresh verification: #2380 OPEN, no related open PR found, no hard-stop labels present; issue is assigned to Drew. Resuming the saved design-first checkpoint: ADR record-format choices require Drew input before finalization.
next: confirm the decision blocker from current issue/context, then escalate and block if still genuinely Drew-owned.
dezren39 commentedon Nov 4, 2026
agent-note:v1
event: blocked (escalated)
task: 8502 (repo-health-code-pilot; openchamber-scheduled-lane 7b47536b-c162-444c-be8a-3a9538cc4cb5)
state: blocked; reason class: escalated-to-user.
blocker: Drew must select or approve the keyset/authorization-log record format and signing/fold rules before the ADR is finalized. The saved resume checkpoint identifies this as Drew input; #2380 currently has no recorded decision.
resume: when Drew records the decision or asks the worker to propose a default for review, continue the ADR and implementation packet scoping. No branch/worktree was created.