Skip to content

id: design: encrypted shares & key distribution (from #5672) #5801

New issue
New issue
Open
Open
id: design: encrypted shares & key distribution (from #5672)#5801
Assignees
dezren39
Labels
app/idPackage/app: id (pkgs/ or apps/ in this repo)status/triagedTriaged and routed (see agent note)status/waiting-dependencyWaiting on a dependencytask/triageQueue packet kind: verify, reproduce, and route this item

Description

@dezren39
dezren39
opened on Nov 5, 2026

Summary

Follow-on design ticket from #5672 — its decomposition sketch names this as a separate design, and the parent's acceptance requires these tickets to be filed and linked. Filed in the 2026-11-04 gap pass (WS-F) so the design work exists and can be prioritised on its own merits; implementation timing is a separate decision, possibly months out.

What this design must settle

Encrypted shares and their key distribution, composed with the sensitivity classification: who holds keys, how they rotate, and what a share recipient can prove.

Context from the parent

The parent design fixes the selective-sharing grants model, the existence-privacy rule, and the foreign data-store adapter contract. The parent issue carries the surrounding decisions this ticket must not re-decide; where this ticket's answer would change a parent decision, record that explicitly rather than silently forking it.

Decision record expected

Close this design with a recorded decision (on this issue or in a doc/ record linked from it): the chosen shape, the alternatives rejected and why, and the invariants implementation must hold. If the design splits further, file the splits and link them here rather than growing this issue.

Relations

Parent: #5672. Programme: epic #2056. Filed by WS-F (2026-11-04 ID design gap & expansion pass).

Activity

  1. dezren39
    added
    app/idPackage/app: id (pkgs/ or apps/ in this repo)
    on Nov 5, 2026

  2. developing-today commented on Nov 5, 2026

    @developing-today
    developing-todayBot
    on Nov 5, 2026 – with developing.today
    Contributor

    CODE-1484

  3. dezren39
    added
    queue/queuedHas a queued task in the Supabase agent queue
    task/triageQueue packet kind: verify, reproduce, and route this item
    work/assignedQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    status/in-progressQueue worker lifecycle state
    and removed
    queue/queuedHas a queued task in the Supabase agent queue
    on Nov 5, 2026

  4. dezren39 commented on Nov 5, 2026

    @dezren39
    dezren39
    on Nov 5, 2026
    MemberAuthor

    🤖 Agent note · done (triage)

    Triage findings for issue #5801 (task 10204)

    Verified current (2026-11-05, fresh gh reads): issue #5801 is OPEN, filed 2026-11-05T01:51:22Z in the WS-F gap pass, carrying only task/triage + queue/queued + app/id at claim time — no hard-stop labels (held, user/owned, do-not-merge, do-not-auto-edit), no competing PR or branch, and no other issue references issue #5801 yet (search of 5801 in:body returns nothing), so no duplicate or superseding work exists.

    Routing: follow-on design ticket, ordered behind its parent. Issue #5801 is a decomposition child of issue #5672 — the parent's acceptance required it to be filed and linked, which is satisfied. Its body is explicit that the parent fixes the inputs this design must compose with (the selective-sharing grants model, the existence-privacy rule, the foreign data-store adapter contract) and must not re-decide them. Issue #5672 is still OPEN and itself only queued (task/triage, queue/queued) — its design has not closed with a decision record yet.

    Ordering recorded:

    1. Issue id: design: ID selective sharing and foreign data-store adapters v1 #5672 design closes first (or records its grants-model / existence-privacy / adapter-contract decisions), because encrypted-share key distribution — who holds keys, how they rotate, what a recipient can prove — is defined against that grants model and the sensitivity classification it composes with.
    2. Then the design pass on issue id: design: encrypted shares & key distribution (from #5672) #5801, closing with the decision record its body requires (chosen shape, alternatives rejected and why, invariants implementation must hold; further splits filed and linked here if it splits).
    3. No implementation issue is filed now: the body itself states implementation timing is a separate decision, possibly months out. Filing one in this triage would scope against an unclosed parent design.

    The issue stays open under programme epic issue #2056, labelled triaged + waiting-dependency to mirror this ordering. No code change in this triage.

  5. dezren39
    added
    status/triagedTriaged and routed (see agent note)
    status/waiting-dependencyWaiting on a dependency
    and removed
    status/in-progressQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    work/assignedQueue worker lifecycle state
    on Nov 5, 2026
  6. github-actions
    assigned
    dezren39
    on Nov 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

app/idPackage/app: id (pkgs/ or apps/ in this repo)status/triagedTriaged and routed (see agent note)status/waiting-dependencyWaiting on a dependencytask/triageQueue packet kind: verify, reproduce, and route this item

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions