Implement ADR 005 by routing audit events through OpenTelemetry with a server-owned SQLite exporter and query endpoint. Implement ADR 006 by persisting principal roles, assigning first principal admin, and enforcing admin-only routes at the FastAPI dependency layer.
Entire-Checkpoint: df60966364f1
Phases A–I of TODOS.md:
- Move all five registry classes (IdentityRegistry, PrincipalRegistry,
VaultRegistry, IdentityClaimRegistry, PrincipalVaultBindingRegistry) from
identity/ to server/registries.py. Domain model types stay in identity/.
- Break identity/local.py → cli/ coupling: inline _read/_write_active_identity_handle
helpers so identity/ imports nothing from cli/.
- Remove VaultRegistry + get_server_home imports from auth/service.py; refactor
revoke() to accept explicit vault_ids from the server layer.
- Move proxy_routes() and _build_route_entry() out of AuthService into
server/proxy_catalog.py; proxy route delegates to build_proxy_routes().
- Move AuthService from auth/service.py to server/credential_service.py so
auth/ becomes a true leaf (no vault/, audit/, or server/ imports). Update
all 10+ import sites in server/, cli/ test files, and the top-level __init__.
- Remove global AuthService(identity="server") from app.py. Refactor /ready
to resolve the local identity at request time and use app.state.vault directly.
- Remove vault.home property from Vault; replace all callers with store.home.
- Update AGENTS.md architecture table to reflect new file locations.
All 293 tests pass. ruff and ty clean.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 5c8526a4e7d2
- Add ClaimStatus enum (PENDING/ACCEPTED/REJECTED) to IdentityClaimRecord
with accept_claim() and reject_claim() on IdentityClaimRegistry
- HostedOwnershipResolver.resolve() now gates vault access on ACCEPTED;
PENDING raises 403, REJECTED raises 403 with distinct message
- ensure_claimed_identity() auto-accepts on UI form submission — the form
IS the approval act in this release; PENDING is transit state only
- Remove AuthService vault_id fallback (vault_id or identity); _coll now
raises ValueError if vault_id is None, making missing wiring explicit
- /ready endpoint resolves vault_id via ownership_resolver instead of
constructing AuthService with the identity handle as a stopgap
- create_auth_service() requires explicit vault_id parameter
- Rewrite ADR 0003 and update UBIQUITOUS_LANGUAGE.md to reflect opaque
VaultId design (single segment, not principal_handle/vault_handle)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 8f56337e3615
Make the daemon identity registry authoritative for protected PoP requests and remove implicit default-profile identity behavior.
Store daemon-owned state under server/ while keeping CLI signing identity files under identities/.
BREAKING CHANGE: Existing implicit default-profile installs must run authsome init again; profile:default credentials are not migrated.
Entire-Checkpoint: 557455816515
beubax