docs: note auth.md decision (right shape, wait for adoption) - #38
Closed
utsengar wants to merge 1 commit into
Closed
docs: note auth.md decision (right shape, wait for adoption)#38utsengar wants to merge 1 commit into
utsengar wants to merge 1 commit into
Conversation
Captures the reasoning behind not migrating to WorkOS's auth.md agent-verified flow yet. The spec is the right shape — (iss, sub) is stable per-human across sessions, same role github_user_id plays today — but no major agent runtime has shipped issuer-side ID-JAG issuance, so there'd be nothing to verify against. Trip-wire TODO points future-us at the migration when an issuer ships. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
🚀 Cloudflare previewURL: https://0ab7c06d-htmlbin.utkarsh2012.workers.dev Built from commit
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
auth.mdagent-verified flow yet.iss+subclaims, wheresubis "an opaque user identifier" stable per-human across sessions — the same rolegithub_user_idplays today. One human running N agent sessions still resolves to one account, abuse moat preserved./auth.md+/agent/authendpoint would advertise a flow no agent can complete.TODO(auth.md)insrc/github-oauth.tsreferences the CLAUDE.md note. When an issuer ships, the migration is small: keepusers, add(iss, sub)columns alongsidegithub_user_id, accept either as identity, keep GitHub OAuth as fallback.What this PR is
CLAUDE.mdgets a new paragraph under the Auth model section.src/github-oauth.tsgets a TODO comment in the top-of-file rationale block.Watch list (so we know when to revisit)
🤖 Generated with Claude Code