Repository navigation
Design account-wide devices: the Relay keeps no device list - #1473
Merged
Merged
Conversation
Issue #331 asked for an account-wide device list. The root constraint is the trust model: the ACL lives only on each Burrow and the Relay never sees a Client static or lists a deliveryId, so no Relay-held directory can name a Burrow's records without reversing those rules. Record the design under remote-security-model.md ## Future as part of remote-trust-followups, built on the Burrow-local revocation entry point: the managed identities stay the passkey (account-wide, Relay-held) and the ACL record (per Burrow), never merged; stage 1 makes Hosted's existing passkey removal reach every Burrow's ACL as a revoke-only answer to the credential ids the Burrow asks about; stage 2 lists and revokes records from Pocket over protocol-v1 on reachable Burrows, behind a fresh proof. Whether stage 1 carries a passkey assertion is left for a decision, with the reasoning in the rationale. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ned decided a Relay-named revocation needs no passkey assertion: revocation fails safe, unlike approving a connection, which fails dangerously. State it as the rule and move the reasoning to the rationale. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deploying mouseterm with
|
| Latest commit: |
b41f7f1
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://c0e5aa67.mouseterm.pages.dev |
| Branch Preview URL: | https://issue-331-account-device-dir.mouseterm.pages.dev |
Take #1459's Revocation propagation text, since BurrowService.revoke now exists, and keep this branch's Account-wide devices design after it. Resolve scripts/spec-word-budgets.json by taking the larger budget per spec, then ratchet docs/specs/remote-security-model.md, since both sides added words. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Revocation shipped (#1459) as BurrowService.revoke with a Client-static or passkey target, a REVOCATION_REQUESTERS member, and a revoked log entry. Point the design at it instead of describing a hypothetical one: stage 1 is the passkey target's first non-test caller, stage 2 revokes by the shipped deviceIdFor id as dor remote revoke does (dropping the invented per-response index), and last seen is the access log's. Revocation propagation now points at the stages rather than restating the caller. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dormouse-bot
left a comment
dormouse-bot
left a comment
Collaborator
There was a problem hiding this comment.
The new section has two cross-spec links that a reader following them would find broken or circular; details inline.
Review found two broken links in the design. Revocation propagation and Account-wide devices pointed at each other as prerequisite and stager, though they are one design: fold the former into the latter, list it once in the remote-trust-followups scope, and repoint every link to the removed heading (the Reserved line under Revocation, and security.md's passkey-removal accepted risk). Stage 2's protocol-v1 messages pointed at remote-api.md's Future, which had no stage for them and whose shipped scope is terminal-only: add stage 10 there, owning only the wire half and pointing back for what the list carries and what a revoke proves. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dormouse-bot
reviewed
Nov 1, 2026
dormouse-bot
left a comment
dormouse-bot
left a comment
Collaborator
There was a problem hiding this comment.
Merged with current main, remote-security-model.md no longer fits the budget this push lowered to 6550. main added a clause to the running-Burrow revocation bullet in 4573922 (the VS Code broker-window case), so the merged spec is 6559 words and pnpm lint:specs fails with 6559 words exceeds its 6550-word budget. The PR head alone passes, which is why the drop looked safe. Merging main and running node scripts/spec-lint.mjs --ratchet docs/specs/remote-security-model.md lands on 6600; suggestion inline.
Main's 4573922 added a clause to the running-Burrow revocation bullet, so the merged spec is 6559 words, over the 6550 this branch set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nedtwigg
marked this pull request as ready for review
November 1, 2026 20:43
This was referenced Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Design only: this adds the account-wide devices design under
## Futureindocs/specs/remote-security-model.md, folding the old Revocation propagation item into it as one design in theremote-trust-followupsscope, and stages its protocol-v1 messages as stage 10 ofdocs/specs/remote-api.md'sremote-api-remainder. No code changes.BurrowService.revoke(shipped in Revoke a paired phone live, and keep an owner-local access log #1459) under a requester of its own.deviceIdForid, behind a fresh presence proof.Refs #331
🤖 Generated with Claude Code