oficina / home Public

Align assertion draft with Home owner session dependencies

Paul Campbell pushed by paul@keymail.dev 1 month ago 1acce98f6cce8aa65e7bfb6bd697a7e72d09736f parent 4072621

1 file changed, +16 −1

diff --git a/docs/superpowers/plans/2026-09-07-suite-assertion-contract.md b/docs/superpowers/plans/2026-09-07-suite-assertion-contract.md

index 342b039..f2a9932 100644

--- a/docs/superpowers/plans/2026-09-07-suite-assertion-contract.md

+++ b/docs/superpowers/plans/2026-09-07-suite-assertion-contract.md

@@ -6,13 +6,18 @@ canary and deployment. Original Home owner remains informed in discussions 3/9.

## Provenance and scope

-Home origin/main 4a442a1 supersedes the old Ed25519/JWS implementation

+Home origin/main 7d68e87 includes 4a442a1, which supersedes the old Ed25519/JWS implementation

recommendation. Home's binding design §5.3 still says Ed25519 and fetched keys.

Rastrillo origin/main 2c3ae782 includes the merged 2026-08-31 assertion design,

PR 128, discussion 1: its status is explicitly NOT RULED. Its primitive is

implemented, but the assertion package is not. Merged text is not an approved

wire protocol. This plan proposes one reconciliation, never a competing verifier.

+The original owner's 7d68e87 coordination note confirms that the SSO/OIDC work

+does not implement or supersede assertions. Its `sso-saml` branch supplies the

+proposed stable session Provider and sessions.Handle/Lookup/Revoke seam; these

+remain integration dependencies, not APIs available on the current Home pin.

Keep the existing blind index, person refs, all existing secrets and fresh-session

passkey enrolment. Directory self-exchange is already settled by Home §4/§10.

Home supplies identity; instance grants and the separately pulled roster decide

@@ -84,6 +89,16 @@ max_age bound. This implements the already triggered roster-write step-up;

no amr or role claim is added. Framework's proposed AuthTime=iat must be corrected

before the adapter is used for fresh-session checks.

+Keep authentication provenance in the framework's proposed stable Provider,

+`assertion:<issuer>`, once its reviewed session API lands. Do not infer provider,

+issuer or authentication strength from Session.Method: passkey step-up rewrites

+that field, including to bare `passkey`. Freshness still depends on validated

+auth_time and the required ceremony, not a provider label. Use the shared

+Handle/Lookup/Revoke seam for session lifecycle; do not build a Home-only twin

+while the SSO branch is pending. Verify the actual merged API and compatible

+module pin before implementation. Test provenance across passkey and recovery

+step-up and revocation through that seam.

## Key selection and distribution

Recommend fixed key input in the shared verifier and a Home-specific fetch adapter,