Add owner-assisted account recovery

2026-09-03 23:56:42 -04:00
parent 59827bf641
commit 6f0b597943
12 changed files with 611 additions and 21 deletions
@@ -65,3 +65,11 @@ application concern belongs in the shared module.
  optimistic extension serializes on the active administrator membership,
  rechecks the exact state bound into the passkey assertion, applies team and
  direct-binding consequences, and writes the audit in one transaction.
+- Human-assisted recovery cannot safely be expressed as a root command behind
+  an HTTP button. Preview 18 adds a distinct owner-assisted protocol: the
+  application performs the human review and fresh operation-bound passkey
+  ceremony, while the SQLite transaction rechecks an active direct owner,
+  invalidates every old account authenticator, stores only the grant digest,
+  and writes identity plus organization audits. Grant completion installs the
+  replacement password, passkey, and recovery-code set atomically and never
+  issues a session.