Merged repository and test evidence exists; this does not by itself prove a production deployment.
ores.shared-auth.capability-ledger.v1 · 2026-09-05
Build broad IAM. Claim only what is proven.
Shared Auth is becoming a first-party IAM and CIAM control plane for hosted authentication, account security, organizations, enterprise federation, directory lifecycle, policy, audit, and resilient deployment. This ledger separates merged evidence, bounded primitives, work in review, roadmap targets, and blocked prerequisites.
Evidence policy
This is an evidence ledger, not a blanket parity claim. A feature becomes available only when its independent interface authorities, persistence, authorization, audit, tests, deployment, and failure-state UX agree.
IAM/CIAM delivery ledger
UI and backend authority land together.
A visible control is not supported until its independent TypeSpec and JSON Schema authorities, persistence, authorization, replay protection, audit, tests, deployment evidence, and failure-state UX agree.
A bounded primitive exists, but the complete product workflow or operational evidence does not.
Implementation is on a pull request and must not be represented as deployed.
The capability is in scope but no authoritative implementation is claimed.
A prerequisite contract, security boundary, persistence model, or control-plane verification is missing.
01available
Token exchange, verification, and JWKS
Provider-token exchange, access-token verification, issuer and audience enforcement, and public key discovery.
Repository evidence
shared-auth-api-server.rsshared-auth-clientsshared-auth-interfaces
Next fail-closed gate
Keep issuer, audience, algorithm, expiry, replay, and key-rotation fixtures current across every supported SDK.
02available
Protected introspection and explicit assurance
Resource servers can require exact audience, scopes, AAL or ACR, AMR, and revocation-aware token state.
Repository evidence
shared-auth-api-server.rsshared-auth-clients
Next fail-closed gate
Certify every production resource server with negative audience, scope, credential, revocation, timeout, and stale-key canaries.
03partial
Hosted sign-in, sign-up, passwordless, and social identity
Provider exchange plus email and SMS challenge primitives exist; complete hosted journeys, linking, recovery, and callback UX are not certified.
Repository evidence
shared-auth-api-server.rsshared-auth-clients
Next fail-closed gate
Publish typed sign-up, recovery, OAuth callback, identity-linking, abuse-control, consent, and accessibility contracts.
04partial
MFA, TOTP, OTP, 3FA, and step-up
Factor listing, TOTP enrollment and confirmation, email and SMS challenges, and assurance-bearing step-up primitives exist.
Repository evidence
shared-auth-clients3FA-app
Next fail-closed gate
Add tenant policy, recovery approvals, reset audit, anti-enumeration, rate limits, and complete customer and admin workflows.
05partial
Passkeys and WebAuthn
Registration and authentication ceremonies carry opaque credential JSON without taking custody of biometric templates.
Repository evidence
shared-auth-clientsshared-auth-api-server.rs
Next fail-closed gate
Certify RP-ID and origin policy, discoverable credentials, device naming, recovery, deletion, attestation policy, and replay-negative fixtures.
06in review
Customer account and security center
MASH, Leptos SSR, and Dioxus SSR views read live identity, factor, and capability evidence while unsupported mutations remain disabled.
Repository evidence
shared-auth-web-server.rs#11
Next fail-closed gate
Pass format, clippy, tests, authorization, cookie, dependency, image, Cloud Run, and Kubernetes admission gates before promotion.
07planned
Organizations, tenants, invitations, RBAC, and ABAC
Organization switching, invitation lifecycle, memberships, groups, roles, permissions, and tenant policy are requirements, not shipped claims.
Repository evidence
No implementation is claimed.
Next fail-closed gate
Define TypeSpec and JSON Schema as independent peer authorities, normalize and cross-check them, then add ORM, audit, and authorization tests.
08planned
Enterprise SSO and identity brokering
SAML and enterprise OIDC connections, verified domains, JIT enrollment, metadata rotation, and test-IdP flows are not available yet.
Repository evidence
No implementation is claimed.
Next fail-closed gate
Land protocol, connection lifecycle, domain ownership, signing, encryption, rollback, and conformance contracts before exposing setup controls.
09blocked
SCIM and directory synchronization
Provisioning, deprovisioning, groups, role mapping, cursor state, retries, quarantine, and reconciliation UI remain disabled.
Repository evidence
No implementation is claimed.
Next fail-closed gate
Publish SCIM 2.0 and directory connector authorities with idempotency, tombstones, replay handling, audit, and dead-letter recovery.
10planned
Sessions, devices, trusted-device policy, and global logout
A complete session and device inventory with bounded search, revocation, compromise response, and cross-region propagation is not exposed.
Repository evidence
No implementation is claimed.
Next fail-closed gate
Define device identifiers, privacy retention, trust state, revocation fan-out, event ordering, and read-after-write verification.
11blocked
Conditional access, risk signals, and adaptive challenges
No deterministic, versioned policy decision and explanation contract is currently available to customer or admin interfaces.
Repository evidence
No implementation is claimed.
Next fail-closed gate
Specify policy inputs, outputs, exceptions, safe degradation, privacy constraints, simulation, and rollback before enforcement controls appear.
12partial
Lifecycle, audit log, webhooks, and compliance export
Idempotent admin-operation primitives exist, but immutable identity event search, webhook delivery, replay, retention, and signed export views do not.
Repository evidence
shared-auth-admin-api-server.rsshared-auth-admin-web-server.rs
Next fail-closed gate
Add retention-aware projections, delivery state, signed exports, privacy filters, redaction tests, and bounded replay authorization.
13in review
Isolated IAM administration
The private MASH, Leptos, and Dioxus console exposes an evidence ledger behind Shared Auth, product grants, and trusted-network admission.
Repository evidence
shared-auth-admin-web-server.rs#6
Next fail-closed gate
Pass repository-native gates and certify separate admin identities, secrets, database roles, origins, ingress, and audit in both runtimes.
14partial
SDKs, machine identities, webhooks, and test environments
Typed clients span several languages, while service-account lifecycle, API credential rotation, webhook tooling, and test-tenant UX remain incomplete.
Repository evidence
shared-auth-clientsshared-auth-interfaces
Next fail-closed gate
Version machine-principal contracts, credential rotation, webhook signatures, test clocks, fixtures, and generated client parity.
15partial
Hosted and headless UI, branding, localization, and accessibility
HTML-first SSR shells exist, but theme tokens, localization catalogs, accessibility conformance, and embeddable headless component contracts are incomplete.
Repository evidence
shared-auth-web-server.rsshared-auth-admin-web-server.rs
Next fail-closed gate
Add WCAG gates, keyboard and focus suites, localization contracts, CSP-safe theming, and versioned component APIs.
16in review
Cloudflare, Cloud Run, and Kubernetes resilience
Exact-host routing and four-service desired state are in review; the production DNS, revisions, workloads, failover, and rollback are not control-plane certified.
Repository evidence
shared-auth-infra#26shared-auth-infra#41oresoftware/k8s-cluster#1452shared-auth-e2e#34
Next fail-closed gate
Promote immutable digests only after exact-head tests, then prove DNS, TLS, private origin admission, readiness, failover, non-replayed writes, and rollback read-after-write.
Multi-cloud runtime
Cloudflare exact-host router. Four isolated services.
Google Cloud Run is the intended primary runtime andORESoftware/k8s-cluster is the intended fallback. Customer and administrator identities, service accounts, secrets, database roles, and origins stay separate. Safe reads may fail over; writes are never replayed after an origin may have received them.
customer webcustomer APIadmin webadmin API
Static marketing origin
shared-auth.github.io remains the credential-free GitHub Pages origin and review URL. Cloudflare owns the canonical apex and mobile public hosts and may proxy only safe static methods to that artifact.
Exact authority contract
Twelve hosts. No wildcard fallback.
Unknown authorities fail before origin traffic. The apex and mobile host are static-only; only auth can inherit the legacy authentication pool. Both admin API spellings reach one authority directly so mutations are never redirected and replayed.
| Host | Purpose | Service / pool | Static | State |
|---|---|---|---|---|
ores-shared-auth.com | Canonical public marketing site | marketing / static | yes | in review |
auth.ores-shared-auth.com | Hosted authentication journey | auth / auth | no | partial |
app.ores-shared-auth.com | Application selector and authenticated handoff | app / web | no | partial |
user.ores-shared-auth.com | Individual login, account, and security UI | user / web | no | in review |
org.ores-shared-auth.com | Organization login, membership, and tenant UI | org / web | no | planned |
m.ores-shared-auth.com | Mobile-first user and organization entry selector | mobile / static | yes | in review |
api.ores-shared-auth.com | Customer identity and account API | api / api | no | partial |
admin.ores-shared-auth.com | Operator IAM console | admin / admin-web | no | in review |
api-admin.ores-shared-auth.com | Canonical operator IAM command API | admin-api / admin-api | no | partial |
admin-api.ores-shared-auth.com | Direct compatibility alias for the operator IAM command API | admin-api / admin-api | no | partial |
quote.ores-shared-auth.com | Public quote intake handoff | quote / web | no | partial |
pre-interest.ores-shared-auth.com | Public early-access interest handoff | pre-interest / web | no | partial |
Production activation gate
DNS records, Worker Custom Domains, certificates, Cloud Run revisions, Kubernetes workloads, private-origin admission, health failover, and rollback become active only after read-after-write evidence from the actual Cloudflare, Google Cloud, and Kubernetes control planes. Repository code alone does not satisfy this gate.
Feature taxonomy inputs
Learn broadly. Copy nothing blindly.
These products inform feature discovery. Shared Auth keeps its own contracts, implementation, product language, security boundaries, and evidence thresholds; inclusion here is not a compatibility claim.