[authentication/1.2] Add role-separated credential profiles by omry · Pull Request #44 · omry/arbiter

omry · 2026-10-20T17:23:59Z

Add fixed P-256 X.509 profiles for owner issuers, server authorities, portable agents, per-server access and inner server TLS. Validate exact purpose, URI identity, issuer, validity and size bounds through standard cryptography primitives, and report malformed credential inputs through controlled errors.

Offline authority setup creates three separate signing credentials atomically in its private SQLite transaction. Status verifies setup coherence without exposing keys; unreleased schema-1 prototypes are refused without overwriting identities. Publish public Python/Go profile vectors and document the profiles and renewal schedules.

Plan slice: arbiter-authentication/1.2. Runtime caller authentication and actual renewal are delivered by later slices.

Validation: complete Python suite (1,225 passed, 9 skipped), minimum cryptography 42.0.8 credential suite (38 passed), full Black/Pyrefly, Go tests and independent certificate-chain/malformed-vector probe, website build. Native platform CI remains a required PR-cycle gate.

Add fixed P-256 X.509 profiles for owner issuers, server authorities, portable agents, per-server access and inner server TLS. Validate exact purpose, URI identity, issuer, validity and size bounds through standard cryptography primitives, and report malformed credential inputs through controlled errors. Offline authority setup creates three separate signing credentials atomically in its private SQLite transaction. Status verifies setup coherence without exposing keys; unreleased schema-1 prototypes are refused without overwriting identities. Publish public Python/Go profile vectors and document the profiles and renewal schedules. Plan slice: arbiter-authentication/1.2. Runtime caller authentication and actual renewal are delivered by later slices. Validation: complete Python suite (1,225 passed, 9 skipped), minimum cryptography 42.0.8 credential suite (38 passed), full Black/Pyrefly, Go tests and independent certificate-chain/malformed-vector probe, website build. Native platform CI remains a required PR-cycle gate.

gitar-bot · 2026-10-20T17:25:40Z

Code Review ✅ Approved

🔴 High risk · Authority setup now stores private signing credentials and rejects schema-1 databases, potentially making existing prototype identities inaccessible to authority tooling.

Adds fixed P-256 X.509 credential profiles for owner issuers, server authorities, portable agents, per-server access, and inner server TLS, with validation of purpose, URI identity, issuer, validity, and size bounds. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry · 2026-10-20T17:30:24Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:b3cf9cacb4c5ce0e3a77a3f8aaf4a7ffa85a2dbfb3d589c0a767668624119f89",
    "evidence": {
      "attestations": [
        {
          "baseline_identity": "sha256:95080c8129b4da2db4db318d829532ce16d721ef805c4a756c90a714c0262483",
          "closure_identity": "sha256:25aeb43f8189ba15f54730a7d9d8e7d1462414ccc396fa60330596c0e3568747",
          "document_identity": "sha256:b6511414b3a9b485542df83c8f7abfc499dc8d06e522819b48e162a562d21c57",
          "sidecar_identity": "sha256:79c904f72e578226e1651232379c453990fac14a2735deda6b872acf2cd1d28c"
        },
        {
          "baseline_identity": "sha256:ad1ec634421f4d4b16b5cb61c07844e945fa11d0737e7e59757b3b3aabbf21ce",
          "closure_identity": "sha256:25aeb43f8189ba15f54730a7d9d8e7d1462414ccc396fa60330596c0e3568747",
          "document_identity": "sha256:c576091af919c3ec99f0e0edb5795cf4e7bd37a44415ae24742393822317ad3d",
          "sidecar_identity": "sha256:3c969d1c7722b7db806221b23c15d19e577c5e6ad472ba56f7714af25d9cba19"
        },
        {
          "closure_identity": "sha256:25aeb43f8189ba15f54730a7d9d8e7d1462414ccc396fa60330596c0e3568747",
          "document_identity": "sha256:d56e92a7cb01f131ba499650c4a5d7b2c8d17adf2cdc7d612eee7c5f53d07929",
          "sidecar_identity": "sha256:b02245b52befcecf939bd2373a16912cad483a5a100c7f5733856cd39b4921b5"
        }
      ],
      "candidate_revision_fingerprint": "sha256:b3cf9cacb4c5ce0e3a77a3f8aaf4a7ffa85a2dbfb3d589c0a767668624119f89",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118776533469
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 118776519018
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 118776519012
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 118776519170
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 118776519064
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 118776519023
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 118776518977
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 118776519306
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 118776519015
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 118776519078
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 118776519296
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 118776519491
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 118776518759
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:18e795019b341199dd03ca7176ef79f1855a11ccea84298c491b9691b88f4122",
      "review_request": {
        "body_digest": "sha256:7194c8ec36050e8a85a90c89437acd0118a5c7739d357c7dd840e8a6596228a8",
        "id": 6297176400
      },
      "review_result": {
        "body_digest": "sha256:0d64f7f9e107b807b5ef4a91bf66f5d55733e46a2f03d78ae00dbbf78ca270b8",
        "id": 6297235364
      }
    },
    "evidence_fingerprint": "sha256:240a318fe3b152d0fa1c87b2ff2b8aac87fbfee8b1904f88fc242238546ccb45",
    "head_sha": "4171405ab94283ee3ac55f0ada45ee3d649e29f2",
    "operation_identity": "sha256:18e795019b341199dd03ca7176ef79f1855a11ccea84298c491b9691b88f4122",
    "review_request_id": 6297176400,
    "review_result_id": 6297235364,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:b3cf9cacb4c5ce0e3a77a3f8aaf4a7ffa85a2dbfb3d589c0a767668624119f89",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 118776533469
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Linux arm64",
      "run_id": 118776519018
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Linux x64",
      "run_id": 118776519012
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Windows arm64",
      "run_id": 118776519170
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Windows x64",
      "run_id": 118776519064
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform macOS arm64",
      "run_id": 118776519023
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform macOS x64",
      "run_id": 118776518977
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.10",
      "run_id": 118776519306
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.11",
      "run_id": 118776519015
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.12",
      "run_id": 118776519078
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.14",
      "run_id": 118776519296
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python lint",
      "run_id": 118776519491
    },
    {
      "conclusion": "SUCCESS",
      "name": "Website",
      "run_id": 118776518759
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118776533469,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/118776533469"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 118776519018,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776519018"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 118776519012,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776519012"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 118776519170,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776519170"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 118776519064,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776519064"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 118776519023,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776519023"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 118776518977,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776518977"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 118776519306,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776519306"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 118776519015,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776519015"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 118776519078,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776519078"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 118776519296,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776519296"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 118776519491,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776519491"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 118776518759,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/39465738099/job/118776518759"
        }
      ],
      "head_sha": "4171405ab94283ee3ac55f0ada45ee3d649e29f2",
      "id": "sha256:9e6e703b896cdc497520e94398188d8082393a477e94453d719fb44940ab33bc",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr41",
    "base_sha": "422dabebbdb266d05b6e186cf914e2da593aee01",
    "body_digest": "sha256:adc557dd5f7fffebc73b8ed8bb510b09a583074efb7eae68e37489c90ef6620b",
    "diff_digest": "sha256:e953186bc27cd0db6b094d76d2c29210f6d49490917735aa58d0bb9bbb36a39c",
    "head_ref": "pr42",
    "head_sha": "4171405ab94283ee3ac55f0ada45ee3d649e29f2",
    "pr": 44,
    "repository": "omry/arbiter",
    "scope_authority": [
      {
        "digest": "sha256:b6511414b3a9b485542df83c8f7abfc499dc8d06e522819b48e162a562d21c57",
        "path": "docs/authentication/high-level-design.md"
      },
      {
        "digest": "sha256:c576091af919c3ec99f0e0edb5795cf4e7bd37a44415ae24742393822317ad3d",
        "path": "docs/authentication/implementation-plan.md"
      },
      {
        "digest": "sha256:d56e92a7cb01f131ba499650c4a5d7b2c8d17adf2cdc7d612eee7c5f53d07929",
        "path": "docs/authentication/requirements.md"
      }
    ],
    "title_digest": "sha256:656b4caa10f49c787b515aee8e7a8fb785c64101134ee1b4f3eed6db38a4b838"
  },
  "record_version": 4,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-20T17:24:03Z",
      "base_ref": "pr41",
      "base_sha": "422dabebbdb266d05b6e186cf914e2da593aee01",
      "body_digest": "sha256:7194c8ec36050e8a85a90c89437acd0118a5c7739d357c7dd840e8a6596228a8",
      "created_at": "2026-10-20T17:37:50Z",
      "head_sha": "4171405ab94283ee3ac55f0ada45ee3d649e29f2",
      "id": 6297176400,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr41",
      "base_sha": "422dabebbdb266d05b6e186cf914e2da593aee01",
      "body_digest": "sha256:0d64f7f9e107b807b5ef4a91bf66f5d55733e46a2f03d78ae00dbbf78ca270b8",
      "commit_id": "4171405ab94283ee3ac55f0ada45ee3d649e29f2",
      "id": 6297235364,
      "inline_message_ids": [],
      "request_comment_id": 6297176400,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-20T17:40:41Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:b3cf9cacb4c5ce0e3a77a3f8aaf4a7ffa85a2dbfb3d589c0a767668624119f89",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:e953186bc27cd0db6b094d76d2c29210f6d49490917735aa58d0bb9bbb36a39c",
      "finding_ids": [],
      "invariants": [
        "Exact role-separated credential profile conforms to stamped authentication slice1.2; no runtime authentication activation"
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "4171405ab94283ee3ac55f0ada45ee3d649e29f2",
      "review_observation_id": null,
      "review_request_id": 6297176400,
      "review_result_id": 6297235364,
      "reviewed_head": "4171405ab94283ee3ac55f0ada45ee3d649e29f2",
      "root_cause": "No findings in exact-head remote review; full local validation, exact-byte independent Sol review, DBB final validation and all13CIchecks pass. No source correction or synchronization required.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-10-20T17:35:33Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T17:40:43.221547Z	`4171405`	Manual request
🔒 Security Review	✅ Completed 2026-10-20T17:40:25.789103Z	`4171405`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

omry · 2026-10-20T17:37:50Z

@codex, regular review 4171405

chatgpt-codex-connector · 2026-10-20T17:40:41Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 4171405ab9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry changed the base branch from main to pr41 October 20, 2026 17:24

omry added this pull request to stack #43 October 20, 2026 17:24

omry marked this pull request as ready for review October 20, 2026 17:35

omry added the approved PR passed review and required checks label Oct 20, 2026

This was referenced Oct 20, 2026

[authentication/1.3] Keep operator recovery keys outside server state #47

Open

[authentication/1.4] Publish durable authority generations and own the instance lock #48

Open

Navigation Menu

Repository navigation

[authentication/1.2] Add role-separated credential profiles - #44

[authentication/1.2] Add role-separated credential profiles#44
omry wants to merge 1 commit into
pr41from
pr42

omry commented Oct 20, 2026 •

edited

Loading

Uh oh!

gitar-bot Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

omry commented Oct 20, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitar-bot Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 20, 2026 •

edited

Loading

gitar-bot Bot commented Oct 20, 2026 •

edited

Loading

omry commented Oct 20, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 20, 2026 •

edited

Loading