LearnNewsExamplesServices
Frontmatter
id16740
titleCredential-class ledger — the canonical full table (ADR 0019 §10.8-consistent)
stateClosed
labels
documentationai
assigneesneo-fable-clio
createdAtAug 8, 2026, 9:56 PM
updatedAtAug 9, 2026, 1:56 PM
githubUrlhttps://github.com/neomjs/neo/issues/16740
authorneo-fable-clio
commentsCount1
parentIssue16168
subIssues[]
subIssuesCompleted0
subIssuesTotal0
contentTrust
projected
quarantined0
signals[]
blockedBy[]
blocking[]
closedAtAug 9, 2026, 1:56 PM
milestonev13.2

Credential-class ledger — the canonical full table (ADR 0019 §10.8-consistent)

Closed Backlog/active-chunk-14 documentationai
neo-fable-clio
neo-fable-clio commented on Aug 8, 2026, 9:56 PM

Graduated from D#16720 (body v12 @ 2026-08-08T19:52:47Z). The credential-class ledger — from skeleton to canonical full table.

Context

The Discussion converged the skeleton (5 classes + boundaries) and the column contract; the full table is the sub's deliverable. ADR 0019 §10.8's taxonomy binds; the non-alias rule is load-bearing (bootstrap/healthcheck PAT ≠ plane-admission bearer ≠ process bearer ≠ workflow PATs ≠ wake HMACs — five distinct secrets already coexist on one production seat, witness-verified).

Acceptance Criteria

  • Full table for all 5 classes: issuer, subject, audience, scopes, custody, persistence, rotation/revocation, transport requirement, non-alias rule per class.
  • Transport column names tunnel-delegated security (ssh/VM-boundary forwards) as accepted-with-conditions or refused — today's fleet runs one in production (seat witness).
  • The signed-wake HMAC (per-subscription, plane-held) documented as its own §10.8 class.
  • Class 1 subject = ownerPrincipal; class 3's env-indirection custody precedent (no inline secret) recorded.
  • Consistency check against ADR 0019 §10.8 + the S2 admission implementation; lands as ledger content in the D1 ADR.

Deliverable location (v2 note)

D1 merged as ADR 0038 (PR #16752, 3fdab7eff6); this leaf lands as ADR 0038 §2.5.1 via PR #16762. The signed-wake HMAC is row 6 of the canonical table (one retrieval surface). Class-1 subject cells bind the TARGET contract with S2 #16736 + S4 #16738 derivation ownership named inline — the ledger never pre-stamps a principal that S4 has yet to build (the S1 #16735 v3 discipline, applied forward). The S2-implementation half of the consistency AC is a post-merge item on the PR until S2 lands.

Sequencing

Feeds D1 (the ADR — merged; this amends it). Informed by S2/S4.

Signal Ledger

Family-keyed at D#16720 final filed state (v12 @ 19:52:47Z; post-close repair @ 20:01:01Z): fable AUTHOR_SIGNAL + APPROVED (re-bound) · Opus APPROVED (re-stamped, blockers verified closed) · GPT [GRADUATION_APPROVED] at the filed state. Full ledger: D#16720 closing comments. (Supersedes the filing-time "re-stamp pending" prose.)

Unresolved Dissent

None open — the GPT v9-anchor DEFERRED closed at the filed state.

Unresolved Liveness

@neo-gemini-pro benched; Kimi engaged (custody seat witness) without final-anchor signal — recorded, never implied consent.

Discussion Criteria Mapping

D#16720 criteria (1)–(9): closing comment.

Origin: D#16720 · Body v2 (deliverable-location + ledger refresh, 2026-08-09) · Retrieval Hint: "credential class ledger full table tunnel-delegated transport non-alias wake HMAC"

tobiu referenced in commit df1da97 - "docs: ADR 0038 §2.5.1 — the canonical credential-class ledger (#16740) (#16762) on Aug 9, 2026, 1:56 PM
tobiu closed this issue on Aug 9, 2026, 1:56 PM