andy
3de6e53ab0
Foundation for the persistent, inspectable cognitive runtime: README, implementation plan with phases and risk register, architecture, security model, threat model, contributing guide, eight ADRs covering the global workspace, event immutability, memory representation, LLM abstraction, capability system, authentication, frontend and storage. Includes Makefile, env example, compose stack (pgvector) and Dockerfile skeleton, plus a record of the development environment assumptions.
1.3 KiB
ADR-0006: Local authentication design
Date: 2026-09-14
Status: Accepted
Context
The admin interface controls a system that can act on infrastructure. It needs strong local authentication first, with room for OIDC.
Decision
Argon2id (64 MiB, t=3, p=2, 16-byte salt) password hashes; opaque 256-bit session tokens stored as SHA-256 hashes with idle and absolute expiry; cookies HttpOnly; SameSite=Lax; Path=/ and Secure outside development; per-session CSRF token checked on all state-changing cookie-authenticated requests plus Origin check; login limiter per IP (token bucket) and per account (exponential backoff persisted in the database); optional TOTP (RFC 6238, implemented with stdlib HMAC) with hashed recovery codes; session listing and revocation; roles administrator, operator, observer enforced by route middleware. Personal API tokens (hashed, role-bound) authenticate noemactl and scripts. auth.Authenticator is an interface so OIDC can be added.
Consequences
- No third-party auth dependencies beyond
x/crypto. - First-run bootstrap admin from environment or
noemactl user create.
Alternatives considered
- OIDC-only: blocks single-operator deployments.
- JWT sessions: revocation and listing become awkward; opaque tokens are simpler and safer.