IDENTITY CONTROL PLANE / K21

先让每枚令牌知道由谁签发，再把轮换收进有界窗口

K21 已在生产部署 active kid、双密钥验证槽和 24 小时 no-kid 兼容截止线。当前是 Phase A：沿用原生产 secret，不触发 OTP，也不把“轮换基础已上线”冒充为“secret 已完成轮换”。

BOUNDED KEY-RING LIVE新 JWT 带 active kid，旧 no-kid 令牌只兼容到 2026-07-18 05:22:28Z

unknown kid、改写 kid 和截止线后的 no-kid 全部 fail closed；Auth 的 session registry 负责在线存活判断，但当前公网元数据未公开其 backend，Portal 合同保持阻断。Phase B secret 轮换和生产 OTP synthetic 需要独立授权窗口。

PHASE B APPROVAL REQUIRED

EXACT RELEASE157b859source = production

CONTROLS3510 K17 + 8 K18 + 6 K19 + 5 K20 + 6 K21

SOURCE CHECKS54contracts + witness assertions

KEY MATRIX7active · previous · legacy · revoked

PRODUCT UI PROVEN0G5 remains blocked

CURRENT RELEASE TRACE

代码、迁移、权限、运行与外网回执绑定到一个版本

只有明确核实的生产事实进入 CURRENT。生产迁移使用 operator 身份；运行账户只有 SELECT / INSERT / UPDATE / DELETE，没有 DDL 或授权权限。

01GITEA MAIN157b859

session code + migration

→

02MYSQL2 tables

sessions + append-only events

→

03RUNTIME127.0.0.1:8095

least privilege · loopback

→

04READINESSUPSTREAM 2 / 2

Portal adapter · session registry contract BLOCKED

→

05PUBLIC EDGEauth.reits.tech

TLS · HSTS · no-store

打开生产安全元数据打开生产 readiness 读取机器证据读取实时真值

K21 KEY ROTATION WORKBENCH

把密钥槽、兼容窗口、验证矩阵和回滚边界放进一张生产控制台

上半部分只展示 auth.reits.tech 的安全元数据与已验证发布事实；Phase B/C 是操作合同，不是已执行状态。secret 永远不在浏览器、API、日志或证据中出现。

LIVE RUNTIME TRUTHCHECKING LIVE STATUS

CHECKED AT2026-07-17 11:47:54ZACTIVE KIDk21-20260717-aPREVIOUSNOT CONFIGUREDLEGACY NO-KIDACCEPTED · BOUNDEDDEADLINE / AUTHORITY2026-07-18 05:22:28ZNOT_EXPOSED · PRODUCTION SAFE

ROTATION RUNBOOK / FOUR PHASES

当前只执行到 Header migration

safe metadata only

A
Header migrationCURRENT
同 secret + active kid；兼容 no-kid
WINDOW
NOW → 2026-07-18 05:22Z
EXIT
无 kid deadline elapsed
B
Secret rotationAPPROVAL REQUIRED
old active → previous；生成 new active
WINDOW
OPERATOR WINDOW
EXIT
new active issuing + old kid verifies
C
Previous retirementPENDING
清空 previous pair
WINDOW
+ 1 REFRESH TTL
EXIT
retired kid rejected
D
Asymmetric targetTARGET
ES256 signer + public JWKS + cache contract
WINDOW
A6
EXIT
consumer migration evidence

NON-NEGOTIABLE INVARIANTS6

01只有 active key 可以签发；previous 永远只验证

02未知 kid 与改写 kid 均 fail closed

03无 kid 兼容窗口不能配置超过一个 refresh TTL

04签名通过后仍必须通过 MySQL session liveness

05元数据、日志与证据不得包含 secret 或 secret fingerprint

06HS256 key ring 不是 JWKS；ES256/JWKS 仍属于 A6

Token classPhase A · headerPhase B · overlapPhase C · retired

active kid + active signatureACCEPTACCEPTACCEPT

previous kid + previous signatureN/AACCEPTREJECT

unknown kidREJECTREJECTREJECT

rewritten kid + stale signatureREJECTREJECTREJECT

no kid before deadlineACCEPTN/AN/A

no kid at / after deadlineREJECTREJECTREJECT

valid signature + revoked sidREJECTREJECTREJECT

IDControlRuntime decisionEvidenceStatus

AUTH-KEY-01Explicit issuing kid

每个新 JWT 的受保护 header 写入 active kid

157b859 · token tests · production safe smokePASS

AUTH-KEY-02Bounded two-key ring

active 签发/验证；最多一个 previous 仅验证

active/previous/unknown matrixPASS

AUTH-KEY-03Legacy no-kid deadline

只在 2026-07-18 05:22:28Z 前接受，配置上限为一个 refresh TTL

production cutoff 1784352148PASS

AUTH-KEY-04KID redirect resistance

header 先选定精确 key，再做常量时间签名比较；改写 kid 无法重定向

negative unit suitePASS

AUTH-KEY-05Secret-safe operations

meta 只发布算法、ID 和阶段；secret/fingerprint 不进日志与证据

metadata redaction + deployment outputPASS

AUTH-KEY-06Session authority preserved

密码学验证后继续查 MySQL active sid；有效签名不能复活撤销会话

K18/K20 contracts + K21 matrixPASS

RESIDUAL BLOCK / DO NOT OVERSTATE4

!Phase B 实际 secret 轮换需要独立 operator window 与回滚确认

!生产邮箱 OTP synthetic 未获授权，未触发

!OpenSDK 与其他资源服务器尚未进入统一 consumer matrix

!ES256/JWKS、MFA、设备联邦和产品安全中心仍未实现

K20 REVOCATION JOURNEY CONSOLE

一张可以复跑、审计和定位失败步骤的真实旅程工作台

UI 直接绑定本次跨进程运行证据：Auth、Open Platform 与 Booking 都是精确仓库代码；只有用户身份与凭证使用合成数据。生产 OTP 未发送，因此 G8 仍保持 PARTIAL。

EXECUTION LANES

从签发到下一请求拒绝

positive cache 0s

Open Platform Developer APIfa9283d · developer-portal · developer:write

PASS

1ISSUESESSIONpreview providerdev_code absent

→

2BEFOREALLOWauthorizedreal consumer

→

3AUTHREVOKEevt_a9301caa4f1a7c…receipt persisted

→

4NEXT REQUESTDENYsession_inactiverefresh also 401

Booking member / merchant API83d31a0 · order-web · order:write

PASS

1ISSUESESSIONpreview providerdev_code absent

→

2BEFOREALLOWauthorizedreal consumer

→

3AUTHREVOKEevt_ad97528be984cc…receipt persisted

→

4NEXT REQUESTDENYauth_session_inactiverefresh also 401

EVIDENCE INSPECTOR

17 assertions

VERIFIED

auth.loopback-livenesscontrolled process live

✓

developer-portal.challengepreview challenge created

✓

developer-portal.secret-redactiondev_code absent

✓

developer-portal.issuedurable session issued

✓

order-web.challengepreview challenge created

✓

order-web.secret-redactiondev_code absent

✓

order-web.issuedurable session issued

✓

subject.same-principalsame synthetic im_core_uid

✓

open-platform.allow-beforedeveloper-portal + developer:write

✓

booking.allow-beforeorder-web + order:write

✓

open-platform.deny-aftersession_inactive

✓

client-isolationorder-web remained active after developer-portal revoke

✓

booking.deny-afterauth_session_inactive

✓

developer-portal.auth-introspect-denyactive=false

✓

developer-portal.refresh-deny401 reauthentication_required

✓

order-web.auth-introspect-denyactive=false

✓

order-web.refresh-deny401 reauthentication_required

✓

CREDENTIAL RESIDUE

persisted: FALSE
logged: FALSE
in evidence: FALSE
targets: LOOPBACK

IDControlRuntime decisionEvidenceStatus

AUTH-JRN-01Exact cross-process code

启动 reits-auth 89acdf1，并调用两个仓库中的真实消费端实现，而不是复制策略 mock

witness source revisions + 17 assertionsPASS

AUTH-JRN-02Two client sessions

同一合成主体分别签发 developer-portal 与 order-web 会话；audience/scope 不跨客户端复用

same principal + two session refsPASS

AUTH-JRN-03Allow → revoke → deny

每条 lane 先得到 ALLOW，再写入 revoke receipt，随后下一次消费端请求得到 typed deny

2 allow + 2 receipts + 2 denyPASS

AUTH-JRN-04Client isolation

撤销 developer-portal 会话后，order-web 会话仍保持 active，直到自身被撤销

client-isolation assertionPASS

AUTH-JRN-05No credential residue

仅允许 loopback HTTP；token 不持久化、不记录、不进入证据；challenge 不暴露 dev_code

loopback guards + redaction assertionsPASS

K19 CONSUMER AUTHORIZATION WORKBENCH

把一次保护请求拆成可检查、可拒绝、可追踪的五步判定

K19 的单请求判定蓝图继续保留，用于产品实现 client、scope、subject 与 object 的逐层解释；K20 控制台则负责真实跨进程撤销证据。

AUTHORIZATION DECISION / TRACE

Publish miniapp release

req_k19_A71C

01
Resolve route policy
developer-portal + developer:write
MATCH
02
Introspect Auth session
active · sid ses_k19 · no positive cache
ACTIVE
03
Bind principal
uid 42 + email → developer account
BOUND
04
Authorize object
app.owner_id = account.id
OWNER
05
Execute + receipt
publish only after every guard passes
ALLOW

✓

FINAL DECISIONALLOW

所有边界通过后才调用 publish handler；对象 owner 规则没有被 scope 替代。

latency: fixture 34 ms
receipt: dec_demo_91B2

Consumer / releaseClientRead / writeSubject bindingObject boundaryRevocation / readinessState

Open Platform Developer APIsource fa9283d · runtime fb1a1b4developer-portaldeveloper:readdeveloper:write

im_core_uid + email → developer account

app.owner_id

K20 allow→revoke→next-request denyMySQL + Auth

DEPLOYED

Booking member / merchant API83d31a0order-weborder:readorder:write

email or stored im_core_uid

member → project / tenant / owner

K20 allow→revoke→deny; bounded refreshAuth session authority

DEPLOYED

OpenSDK bot / host integrationse50cb8aindependent bot tokenconsumer-specificconsumer-specific

not reits-auth user session

host/app binding

separate credential lifecyclenot in K19 first slice

NOT-AUDITED

Other resource servers—must be registeredmust be declaredmust be declared

must be bound

tenant + resource owner

must introspect or consume revoke eventmust include Auth when protected

TARGET

K19 CONSUMER CONTROL MATRIX

六项消费端控制已经从代码走到公网运行

PASS 只覆盖本刀选择的 Open Platform 与 Booking；不会外推成 OpenSDK 或所有资源服务器都已完成。

ID / serviceControlRuntime decisionEvidenceStatus

AUTH-CON-01Open PlatformPer-request active session

每个受保护请求直连 Auth introspection；正向缓存 0 秒

fa9283d · no-cache contract · K20 cross-process witnessPASS

AUTH-CON-02Open PlatformExact client + route scope

client=developer-portal；GET apps 需 developer:read；所有 create/upload/publish 需 developer:write

route middleware + wrong-client/scope negativesPASS

AUTH-CON-03Open PlatformAccount + app ownership

Auth subject 映射 developer account；presign/upload/publish 继续校验 app owner

request context subject + ensureOwnerPASS

AUTH-CON-04BookingLocal session cannot outlive Auth

本地 tok_* 先解析但不信任；Auth active 后才进入 member/project/tenant owner 规则

83d31a0 · member preflight · K20 cross-process witnessPASS

AUTH-CON-05BookingBounded refresh + subject binding

过期 access 最多刷新一次；client=order-web；GET/HEAD 需 order:read，写请求需 order:write；email/IM UID 防漂移

9 Node contract results · production invalid-token sidecarPASS

AUTH-CON-06Edge / readinessDependency-aware fail closed

inactive=401、client/scope/subject=403、Auth unavailable=503；公共只读接口不被身份故障拖垮

openapi/order ready · Nginx public readiness · exact releasePASS

SESSION REGISTRY WORKBENCH

真正可开发的会话管理 UI，而不是概念卡片

参考成熟云控制台的信息密度与破坏性操作分层：先展示当前会话和会话边界，再通过确认层执行撤销，最后给出可复制的审计回执。这里使用确定性样例来定义 UI，不代表生产已有用户数据。

UI FIXTURE · NOT PRODUCTION DATA

生产审计时 auth_sessions = 0、auth_session_events = 0；未执行真实邮箱 OTP，因此下方两个会话仅用于设计与开发验收。

boundary 1784259900

PERSONAL SECURITY / SESSIONS

设备与会话

查看当前应用会话，并撤销不再使用的会话。撤销后，下一次 Auth 校验立即拒绝。

当前客户端Open Platformsubject + client 隔离

活跃会话2 / 20超额自动撤销最旧记录

最长边界24hrefresh 不延长总边界

数据来源Auth设备字段尚未联邦关联

活跃会话仅显示当前 subject 与 client

搜索 session ID

●

当前浏览器Open Platform · ses_7F2A

创建刚刚剩余23h 58mCURRENT

◇

设备信息待联邦关联Open Platform · ses_1C9D

创建昨天 09:42剩余6h 14mACTIVE

为什么没有设备名、IP 和浏览器？

当前 Auth API 不采集这些字段。目标产品必须通过受控联邦适配器关联 im-core DeviceSession；不得从 User-Agent 猜测并写成 CURRENT。

查看字段与证据 Gate →

01READY

真实密度、当前会话、操作边界

02EMPTY

解释没有活跃记录，不制造设备

03CONFIRM

对象、影响、保留项与二次确认

04SUCCESS

回执、结果和下一步可见

05DEPENDENCY-ERROR

registry 不可用时禁止撤销与刷新

K18 SESSION CONTROL MATRIX

八项会话变化从代码一路追到生产

PASS 表示 Auth 服务控制已实现；消费端覆盖以 K19 独立矩阵为准，也不会把本页设计稿当成产品 UI。

ID / domainControlBeforeCurrentEvidenceStatus

AUTH-SES-01RegistryDurable session liveness

JWT 自证存活

auth_sessions 是 refresh/introspect/me 的在线权威；缺失、撤销、过期或不可用均 fail-closed

MySQL migration + API testsPASS

AUTH-SES-02IssuancePersist before token return

签名后直接返回

会话成功持久化后才向调用方返回 JWT

issue/store failure testsPASS

AUTH-SES-03RevocationImmediate Auth propagation

只能等待 token 到期

单会话、当前会话和其他会话撤销立即作用于 refresh/introspect/me

revoke propagation testsPASS

AUTH-SES-04IsolationSubject + client inventory boundary

无会话列表

只列出当前 subject 与 client 的会话；不臆造设备、IP、UA

ownership/client negative testsPASS

AUTH-SES-05AuditAppend-only safe receipts

无撤销回执

create/revoke/noop 写入 auth_session_events；不记录 token、IP 或 User-Agent

event table + idempotency testsPASS

AUTH-SES-06CapacityActive-session bound

会话数量无上限

每 subject + client 最多 20 个；始终保留最新并自动撤销最旧超额会话

cap concurrency testsPASS

AUTH-SES-07MigrationBounded K17 enrollment

上线会使全部已有会话失效

只允许边界后的 K17 完整 claim 首次自注册；旧 Preview token 永不补录

boundary/legacy negative testsPASS

AUTH-SES-08OperationsLeast-privilege runtime

运行身份与迁移职责未分离

DDL 由 operator 执行；Auth 账户仅 SELECT/INSERT/UPDATE/DELETE；readiness 检查 registry

production grants + sidecar + external smokePASS

K17 SECURITY FOUNDATION

展开十项底层安全控制

Preview fail-closed、OTP abuse bound、JWT boundary、readiness 与 immutable release。

＋

ID / domainControlBeforeCurrentEvidenceStatus

AUTH-CFG-01RuntimeProduction configuration preflight

单个开关可启用 preview

环境、监听、上游、密钥、TTL、preview 组合不安全即拒绝启动

Config.Validate + ExecStartPrePASS

AUTH-CFG-02RuntimeLoopback-only service

*:8095

127.0.0.1:8095，只通过 Nginx TLS 暴露

EC2 socket + exact releasePASS

AUTH-OTP-01ChallengePreview bypass removal

allow/override/dev_code/fixed code 全开

production 四项全部关闭，phone/wallet preview unavailable

/v1/meta + negative smokePASS

AUTH-OTP-02ChallengeChallenge abuse bound

无创建频率与失败次数上限

每 client/kind/subject 5 次/10 分钟；单 challenge 最多 5 次失败

race tests + external negativePASS

AUTH-JWT-01TokenIssuer / audience / client binding

仅验 HS256 签名与 exp

固定 header、iss、aud=client、registered client、subject、sid、iat/exp

cross-audience negative testPASS

AUTH-JWT-02TokenBounded session refresh

过期 access token 可无明确边界刷新

1h access、24h refresh_exp，刷新保留 sid/auth_time 且不能延长总边界

refresh boundary testsPASS

AUTH-API-01APISafe request/response envelope

query token、宽松 JSON、内部 URL metadata

Bearer/POST only、strict JSON、no-store、request ID、内部 URL 脱敏

handler negative tests + public metaPASS

AUTH-API-02APICompatibility profile binding

caller header 可参与 profile 选择

route 固定 client/kind；显式 browser Origin 必须在 client allowlist

profile escalation negative testPASS

AUTH-OPS-01OperationsLiveness / readiness split

health 同时混入上游状态

/healthz 只测进程；/readyz 同时要求 im-core 与 session-registry

local + external smokePASS

AUTH-OPS-02OperationsHardened release runtime

可变 current 目录、弱 systemd sandbox

immutable release、配置备份、回滚目录、systemd sandbox、HSTS

release 157b859 + service journalPASS

IDENTITY SCREEN READINESS

七张 UI 按能力逐页归位

PARTIAL CURRENT 表示后端能力存在，不表示目标 UI 已在产品仓实现。会话页本刀新增的是开发蓝图，G5 仍 fail-closed。

platform-auth-signin

统一登录选择

PARTIAL CURRENT

CURRENT IMPLEMENTATION

真实 im-core 邮箱 OTP
client/kind/origin 边界
生产 Preview fail-closed

MISSING / TARGET

企业身份
多身份选择 UI
完整返回上下文 consumer evidence

platform-auth-otp

OTP 验证

PARTIAL CURRENT

CURRENT IMPLEMENTATION

challenge create/verify
600s TTL
创建限流与五次失败锁定

MISSING / TARGET

持久化/多实例 challenge
真实 OTP E2E artifact
重发/倒计时/a11y UI fixture

platform-auth-mfa

强认证

TARGET ONLY

CURRENT IMPLEMENTATION

没有可登记的产品能力。

MISSING / TARGET

Passkey
认证器
可信设备确认
恢复码
高风险动作 step-up

platform-auth-sessions

设备与会话

PARTIAL CURRENT

CURRENT IMPLEMENTATION

MySQL durable Session Registry
会话列表与 current/single/others revoke
撤销事件回执与 20 会话上限
K17 有界迁移
Booking / Open Platform 下一请求传播
K20 受控跨进程 allow→revoke→deny 见证
K21 active kid + bounded previous/no-kid verifier

MISSING / TARGET

产品会话管理 UI
设备/IP/UA 与 im-core 联邦关联
其他资源服务器传播
Phase B 实际 secret 轮换
经授权的生产邮箱 OTP 会话旅程

platform-auth-recovery

账号恢复

TARGET ONLY

CURRENT IMPLEMENTATION

没有可登记的产品能力。

MISSING / TARGET

可信设备恢复
安全等待期
人工复核
恢复状态与保留策略

platform-forbidden

无权限与受限资源

PARTIAL CURRENT

CURRENT IMPLEMENTATION

issuer/audience/client 拒绝
Origin 拒绝
撤销/缺失 session_inactive
安全 401/403/503 envelope
Open Platform app owner + Booking project/tenant owner

MISSING / TARGET

统一 AuthorizationDecision schema
访问申请
组织角色关系
全资源服务器覆盖

EXECUTABLE FLOWS

七条链路定义安全边界

Production email OTP

Client + allowed route
subject limiter
im-core send/check
login-user
persist session
bound JWT

Durable issue / refresh

Verify claims
Find active session
Match client/subject/scopes
Enforce refresh_exp
Cap new exp
Return bounded JWT

Inventory / revoke

Authenticate current session
List same subject + client
Confirm impact
Revoke one/current/others
Append receipt
Deny next Auth use

Release / rollback

Exact Gitea SHA
Operator migration
Least-privilege preflight
Side-port checks
Atomic current switch
External smoke

Consumer authorization

Resolve client + route scope
Introspect active session
Bind local subject
Check tenant / object owner
Execute or typed deny

Cross-process revocation witness

Start exact Auth binary
Issue two client sessions
Run real consumer allow
Revoke each session
Run next-request deny
Verify refresh/introspection deny

Bounded key rotation

Publish active kid
Bound legacy no-kid
Move old active to previous
Issue with new active
Wait refresh boundary
Retire previous

G1–G8 EVIDENCE

六道通过，一道部分，一道阻断

G4 已加入 K21 七行 key matrix 与 K20 17/17 跨进程断言；G5 仍没有产品仓 UI 证据，G8 的 Phase B 和真实 OTP 仍需授权，因此 Identity 不能标成 production proven。

G1PASS

Scope

K20 controlled journey · Auth + 2 consumer repos · 7 Screen ID impact

G2PASS

Static

K21 gofmt · go vet · static build · config/store check

G3PASS

Unit

18 Auth top-level tests / 37 results under race · key ring/registry/revoke negatives

G4PASS

Contract

K21 7-row key verification matrix + K20 17/17 cross-process assertions

G5BLOCKED

Experience

本页为 UI fixture；7 个产品 UI 九态、visual、a11y、interaction 尚未接入

G6PASS

Security

unknown/rewritten kid、expired no-kid、revoked sid 与 preview/audience/origin negatives

G7PASS

Release

157b859 exact SHA · safe smoke · config/store preflight · atomic rollback

G8PARTIAL

Production

Phase A safe meta/readiness/unknown-kid 401 已验证；Phase B 与真实邮箱 OTP 仍需授权

NEXT KNIFE / K22

Operator-approved Rotation & Production Synthetic

在独立 operator window 中执行 Phase B active→previous secret 轮换，并在明确授权和清理回执下执行生产邮箱 OTP synthetic；其余资源服务器继续进入同一 client/scope/subject/object/revocation matrix。

打开 Session Packet