id: implement hosted provisioning + SSO→ID binding (from spec #2258)

Implementation tracking for the hosted provisioning + SSO→ID binding spec (#2258).

Spec: pkgs/id/doc/2026-10-30T22-45-00Z_design_hosted_provisioning_sso_binding.md (in the #2258 spec PR). Source investigation: #2045; platform fit: #2044.

Gate: slices are sequenced after the #2046 synthesis accepts the spec's §8 open parameters (tier numbers, rebind waiting period, encryption default, Shape-C attribution). Do not implement against unaccepted parameters.

Slices (from the spec's §9):

(1) Account + binding records and the binding ceremony (spec §1, §3) — registry keyed on Google sub, challenge ceremony in-browser + own-node variants, failure/retry semantics as specified
(2) Delayed-rebind protocol (spec §4) — request, notification, old-key cancel/approve, published rebind record
(3) Lazy provisioning + metering + budget ceilings (spec §5) — idFromName(binding_id) DO, schema bootstrap, per-DO metering, read-only + export prompt at cap
(4) Export/import (spec §6) — signed-object export with manifest, import verification incl. the unkeyed_export path
Client-side-encryption option (spec §7) as a flag through all four slices

Each slice lands as its own PR referencing this issue and the spec section it implements. This issue delivers nothing by itself — it is the tracked implementation link for the #2258 spec (NOTHING SITS SILENTLY: a spec without an implementation link is not finished work).

Program: ID platform expansion, epic #2056. Parent spec: #2258. Synthesis gate: #2046.

Acceptance criteria

No slice is implemented against unaccepted spec parameters: the id: design: ID serverless edition v1 (Cloudflare Workers) #2046 synthesis acceptance of spec id: design: hosted provisioning + SSO→ID binding spec — account/binding records, challenge ceremony, delayed rebind, metering, export (from #2045) #2258 §8 parameters is recorded before slice work starts.
Each §9 slice lands as its own PR referencing this tracker, with the spec section it implements named.
The binding ceremony behaves as specified for both in-browser and own-node variants, including the failure/retry semantics in spec §1/§3.

Intake review

Related: spec #2258, source investigations #2045/#2044, gate #2046. Risks: implementing against unaccepted §8 parameters (tier numbers, rebind waiting period, encryption default, Shape-C attribution) would bake in guesses — the gate is the point of this tracker. Suggested approach: wait for the #2046 synthesis acceptance, then work the §9 slices in order, one PR per slice.

— Fleet monitor intake enrichment (protocol §5): verified still live this run (no merged PR resolves it), labels normalized, acceptance criteria appended. Marked meta/enriched.

id: hosted account + ID binding ceremony (spec §§1,3) (#3808)

agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane code-h
Session / ID: task 7988 (attempt 1, direct lane)
Found via: queue claim
Task: Triage of issue id: implement hosted provisioning + SSO→ID binding (from spec #2258) #2852 (id: implement hosted provisioning + SSO→ID binding, from spec id: design: hosted provisioning + SSO→ID binding spec — account/binding records, challenge ceremony, delayed rebind, metering, export (from #2045) #2258) — checking its named gate: the id: design: ID serverless edition v1 (Cloudflare Workers) #2046 synthesis acceptance of spec id: design: hosted provisioning + SSO→ID binding spec — account/binding records, challenge ceremony, delayed rebind, metering, export (from #2045) #2258 §8 parameters, fresh at current main.
Expectation: findings posted on issue id: implement hosted provisioning + SSO→ID binding (from spec #2258) #2852 and task 7988 driven to a terminal state this shift.
Links: n/a yet

🤖 Agent note · triage findings (task 7988, lane code-h)

Agent: queue worker (repo-worker-code), lane code-h
Session / ID: task 7988 (attempt 1, direct lane)
Found via: queue claim — triage at current main 1c1aa4a79

Verdict: the gate this tracker waits on has CLEARED; slices 1–2 are merged, slices 3–4 are tracked and queued. The status/waiting-dependency label is stale and is being removed in this pass.

Gate (§8 parameters): SATISFIED. Issue id: design: ID serverless edition v1 (Cloudflare Workers) #2046 is still open for other v1 work, but its RULING (2026-11-03T09:22:09Z, Muse acting for Drew under delegated authority, on the decision-ready synthesis) decides every §8 parameter this tracker names: (1) CSE default ON at binding; (2) rebind wait 30 days with notice + old-key cancellation; (3) quotas — low metered free cap, paid caps below provider ceilings, numeric prices after the cost review and explicitly not gating the v1 slices; (4) Shape-C lapse attribution deferred with shared-world hosting. The acceptance "synthesis acceptance recorded before slice work starts" is met; the code already cites it (pkgs/id/src/hosted_binding.rs:119-122, REBIND_WAITING_PERIOD_SECS = 30 days, "the id: design: ID serverless edition v1 (Cloudflare Workers) #2046 ruling").
Slice 1 (§§1,3 binding ceremony) — landed: PR id: hosted account + ID binding ceremony (spec §§1,3) (#3808) #4854 merged (id: implement hosted account + ID binding ceremony (from #2046/#2852 slice 1) #3808). Note id: implement hosted account + ID binding ceremony (from #2046/#2852 slice 1) #3808 itself is still OPEN with an in-progress close-out (status/in-progress, work/assigned) — that close-out belongs to its owner task.
Slice 2 (§4 delayed rebind) — landed: PR id: delayed ID-key rebind protocol — spec §4 (#3809) #4885 merged (id: implement delayed ID-key rebind protocol (from #2046/#2852 slice 2) #3809, now CLOSED).
Slice 3 (§5 provisioning + metering) — tracked: issue id: implement hosted Worker API + per-user DO provisioning and metering (from #2046/#2852 slice 3) #3811 OPEN, queued as a small_fix. It currently carries status/blocked + queue/blocked — if that block is the §8 gate, it is now stale and its owner/fleet monitor should re-evaluate it against the ruling above.
Slice 4 (§6 export/import) — tracked: issue id: implement signed-object export/import for hosted ID stores (from #2046/#2852 slice 4) #3810 OPEN, queued as a small_fix, same blocked-label caveat as id: implement hosted Worker API + per-user DO provisioning and metering (from #2046/#2852 slice 3) #3811.
CSE flag (§7): the default is decided (ON); carrying it through the remaining slices is part of id: implement signed-object export/import for hosted ID stores (from #2046/#2852 slice 4) #3810/id: implement hosted Worker API + per-user DO provisioning and metering (from #2046/#2852 slice 3) #3811's scopes.

This tracker stays open until #3810/#3811 land; no new follow-up is enqueued from this triage — the remaining slices already have issues and queue tasks.

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane code-h
Session / ID: task 7988 (attempt 1, direct lane)
Found via: queue claim
Task: Triage of issue id: implement hosted provisioning + SSO→ID binding (from spec #2258) #2852 — complete. Findings above (comment 6611128041): the id: design: ID serverless edition v1 (Cloudflare Workers) #2046 ruling of 2026-11-03T09:22:09Z cleared the §8 gate; slices 1–2 merged (PR id: hosted account + ID binding ceremony (spec §§1,3) (#3808) #4854, PR id: delayed ID-key rebind protocol — spec §4 (#3809) #4885); slices 3–4 tracked as id: implement hosted Worker API + per-user DO provisioning and metering (from #2046/#2852 slice 3) #3811/id: implement signed-object export/import for hosted ID stores (from #2046/#2852 slice 4) #3810 with live queue tasks. Stale status/waiting-dependency removed; tracker stays open until the slices land.

feat(id): hosted data-plane scaffold — binding-backed per-user Durabl…

Navigation Menu

Repository navigation

id: implement hosted provisioning + SSO→ID binding (from spec #2258) #2852

Acceptance criteria

Intake review

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: implement hosted provisioning + SSO→ID binding (from spec #2258) #2852

Description

Acceptance criteria

Activity

dezren39 commented on Oct 31, 2026

Intake review

developing-today commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions