Repository navigation
docs(f3): an account is a credential, and it is minted for nobody who can object - #108
Merged
Merged
Conversation
… can object F3-R39 closed the sheet a reader mints for themselves and F3-R40 the two writes an owner makes into a partner's account. The third is one step further out again: the owner creates the account, choosing its first password, on owner authority and nothing else. Creating is not rewriting, and the argument has to be made rather than borrowed. There is no standing credential of the new account to prove knowledge of. The reader who will hold it cannot consent, because they do not exist. What is left is the owner's authority, which is what the rule has been the whole way down — so the owner's own password is the proof here too, and F3-R41 asks for it. What comes out is durable in the same way a sheet is. The owner changing their own password afterwards does not revoke the account, and unlike the partner writes nobody is signed out and puzzled, because there is nobody yet to notice. The first account on an install stays exempt, and the requirement says so rather than leaving it to be read in: there is no owner then, so there is no authority to prove and nothing to prove it with. Spec: F3-R41 Signed-off-by: Wessel Verheij <info@nightworks.io>
lessevv
enabled auto-merge (squash)
September 13, 2026 10:48
|
github-actions
Bot
added
awaiting-maintainer
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third and last of the shape.
F3-R39closed the sheet a reader mints for themselves;F3-R40the two writes an owner makes into a partner's account. This is one step further out again: the owner creates the account, choosing its first password, on owner authority and nothing else.Creating is not rewriting, so the argument is made rather than borrowed
F3-R41asks for it.The consequence is the same durability
The owner changing their own password afterwards does not revoke the account. And unlike the partner writes, nobody is signed out and puzzled — there is nobody yet to notice.
The first account stays exempt, explicitly
The requirement says so rather than leaving it to be read in: on a fresh install there is no owner, so there is no authority to prove and nothing to prove it with. That keeps it off signup and the mobile import bootstrap, which are a different act.
The implementation PR in
beatraxcites this id and follows.Spec: F3-R41