I2 Household identity & single sign-on

Requirements

1. I2-R1acceptedMUST

   Household identity MUST be issued by a self-hosted, open-source identity provider, and MUST NOT depend on a proprietary or hosted identity plane.

   locked by

   0.22.0 ○ open

2. I2-R2acceptedMUST

   The provider MUST issue exactly one identity per household member, usable across the services that trust it.

   locked by

   0.22.0 ○ open

3. I2-R3acceptedMUST

   Apps that support a standard single-sign-on protocol MUST authenticate against the provider directly.

   locked by

   0.22.0 ○ open

4. I2-R4acceptedMUST

   Administrative apps with no native single-sign-on MUST be protected by forward-authentication at the bundled reverse proxy, and MUST NOT be exposed unauthenticated.

   locked by

   0.22.0 ○ open

5. I2-R5acceptedMUST

   A household member MUST experience a single account — their existing media login — and MUST NOT be required to register with or manage the provider separately.

   locked by

   0.22.0 ○ open

6. I2-R6acceptedMUST

   A household member's identity MUST NOT grant access to any administrative surface; operator and member identities MUST be distinct.

   locked by

   0.22.0 ○ open

7. I2-R7acceptedMUST

   Members, groups and route-to-identity mappings MUST be file-configured as code, not held only in an app's local store.

   locked by

   0.22.0 ○ open

8. I2-R8acceptedMUST

   The tool MUST drive a real login round-trip and assert that the redirect-to-provider-then-authenticated-back flow completes and a session or token is issued — a present configuration MUST NOT be reported as working authentication.

   locked by

   0.22.0 ○ open

9. I2-R9acceptedMUST

   The tool MUST assert that a protected administrative route refuses an unauthenticated request and admits an authenticated one.

   locked by

   0.22.0 ○ open

10. I2-R10acceptedMUST

    If the identity provider is unreachable, protected routes MUST fail closed and MUST NOT fall through to unauthenticated access.

    locked by

    0.22.0 ○ open

11. I2-R11acceptedMUST

    Remote exposure of a protected surface MUST be refused until authentication is configured (I1, C6).

    locked by

    0.22.0 ○ open

12. I2-R12acceptedMUST

    Credentials and identities MUST be rotatable through the same secret-management path as other secrets (A7), and rotation MUST invalidate prior sessions.

    locked by

    0.22.0 ○ open

13. I2-R13acceptedMUST

    Provider provisioning, member enrolment, and credential issue and rotation MUST each be reachable non-interactively.

    locked by

    0.22.0 ○ open

14. I2-R14acceptedMUST

    A failed login proof or gate proof MUST be distinguished from success, and each failure MUST carry a remedy (G4).

    locked by

    0.22.0 ○ open