Record reviewed authentication design and implementation plan

docs/BACKLOG.md

@@ -76,6 +76,14 @@ This file is the day-to-day queue for design and implementation gaps.
 
 ## Post-v1
 
+- [ ] `P2` Design coordinated Arbiter clusters and multi-endpoint clients.
+      Future work, excluded from the current authentication design delivery.
+      Cover configuration and credential-state synchronization, shared artifact
+      storage and one-time consumption, cluster management, failover and migration
+      availability for one logical server identity. Define safe authority handoff
+      and operation-replay behavior before choosing replication or storage tooling.
+      Context: [authentication design](authentication/design.md).
+
 - [ ] `P2` Research IMAP search bottlenecks and search performance options.
       Current `imap:search_messages` behavior can be slow enough to hit client
       or server operation deadlines on real mailboxes. Acceptance checks:
@@ -394,6 +402,27 @@ This file is the day-to-day queue for design and implementation gaps.
       sidecars, per-user workers, OAuth delegation, PKI-mediated secret release,
       and confidential-computing/enclave designs; and document what each option
       does and does not protect from the Arbiter operator.
+      Note (2026-10-16): owner explicitly deferred implementation; retain this
+      as longer-term research, separate from near-term authentication work.
+      Scope clarification (2026-10-18): current authentication is single-owner.
+      Multi-owner hosting depends on a credible path for hosting others' secrets.
+      Each future owner must have their own policies, and their agents must see
+      only that owner's listed accounts, subject to the agent's account grants.
+      Preserve the existing account-to-policy flow; do not introduce a second
+      policy layer for the current single-owner design.
+      A candidate is a user-provided unlock key delivered only after independent
+      verification of an enclave's attestation. Credential use, request
+      authorization, policy enforcement and upstream TLS must stay inside the
+      protected boundary, rather than returning decrypted passwords to the host
+      or agent. Assess trusted-client provisioning, approved-code updates,
+      encrypted storage, restart/unlock and recovery, tenant isolation, and
+      engineering and operating costs before choosing a platform. AWS Nitro
+      Enclaves is an example, not a selected dependency: the parent can relay
+      encrypted network traffic over vsock. Linux image builds and QEMU
+      emulation permit local development; real Nitro attestation and isolation
+      require supported EC2 infrastructure. See
+      [AWS enclave image builds](https://docs.aws.amazon.com/enclaves/latest/user/cmd-nitro-build-enclave.html)
+      and [QEMU's emulation limitations](https://www.qemu.org/docs/master/system/nitro.html#emulated-nitro-enclaves).
 
 - [ ] `P2` Finish the installation security evaluator.
       Reploy now has `doctor` and `install` checks for generated deployment

docs/README.md

@@ -18,6 +18,7 @@ planning, assessments and design records.
 
 | Document | Status |
 | --- | --- |
+| [Authentication and enrollment](authentication/README.md) | Requirements, HLD and eleven-PR implementation plan stamped after actual DBB and SWE reviews. Next is operator authority/local control implementation; no code slice has started. |
 | [IMAP folder policy](imap-folder-policy-design.md) | Much of the policy is implemented; the proposed client policy-check surface remains design work. |
 | [Discovery surface](info-surface.md) | Mixes implemented discovery with proposed diagnostics. Public references describe current behavior. |
 | [Transport and identity](future/transport-and-identity.md) | Future identity direction; its earlier HTTP transport proposal is superseded by native HTTPS. |

docs/archive/README.md

@@ -5,6 +5,7 @@ instructions or API references.
 
 | Document | Why archived | Current reference |
 | --- | --- | --- |
+| [Authentication design history](authentication-and-enrollment/README.md) | Byte-preserved pre-consolidation draft/interview; contains superseded proposals and historical progress claims. | [Current authentication documentation](../authentication/README.md). |
 | [Native HTTP protocol](protocol.md) | Initial protocol sketch; later implementation and error-contract changes supersede it. It also proposes artifact uploads that are not implemented. | [Client](../../website/docs/reference/client.md), [server](../../website/docs/reference/server.md) and [errors](../../website/docs/reference/errors.md). |
 | [Generic deployment tool](generic-deploy-tool-design.md) | Early proposal to build Reploy inside Arbiter. Reploy is now an external dependency. | [Deployment preparation](../../website/docs/operate/deployment/1-docker-prepare.md). |
 

docs/archive/authentication-and-enrollment/README.md

@@ -0,0 +1,27 @@
+# Authentication design history
+
+Captured 2026-10-20 before consolidation. These files are historical evidence,
+not the current contract or instructions to execute old questions/workflows.
+
+| Snapshot | Original path | Preserved size |
+| --- | --- | --- |
+| [Original draft](draft-2026-10-20.md) | `docs/authentication-and-enrollment.md` | 2,933 lines |
+| [Original interview](interview-2026-10-20.md) | `temp/design-interviews/docs-authentication-and-enrollment.md` | 3,669 lines |
+
+Both snapshots retain their original bytes. The [manifest](manifest.json)
+records SHA-256 hashes, sizes and source-line positions for D1–D104. Snapshot
+relative links retain their original spelling and may need resolving against
+the original path above; do not rewrite these evidence files to repair links.
+The current evidence index provides usable paths for the required review inputs.
+
+Use the [current overview](../../authentication/README.md),
+[requirements](../../authentication/requirements.md),
+[HLD](../../authentication/high-level-design.md) and
+[decision/evidence index](../../authentication/evidence.md).
+The working interview record is now a compact checkpoint, not a new question run.
+
+Later decisions supersede some early text: D77 replaces short-code pairing,
+D78 replaces proxy-readable native traffic, D33 revises identity provisioning
+order, and D38 removes a second manual fingerprint handoff. The current package
+records those distinctions without deleting the original approvals or research.
+Historical percentages and prior completion claims are not readiness evidence.