Axiom

AUTH gates scope access. GitHub identity is KYC anchor. Scope-level readers/writers.

Constraints

MUST:     GitHub account identity as sole KYC anchor
MUST:     Scope-level access — readers/writers declared in each scope's CANON.md
MUST:     Fail-closed — PRIVATE scope with no matching reader = deny
MUST:     Session tokens server-side (KV-backed, not client-only)
MUST:     Ledger all auth events via append-only chain (login, logout, grant, deny)
MUST:     Hash-chain integrity on auth ledger (id + prev per entry)
MUST:     Auth events are INTEL — backpropagate to LEARNING.md
MUST NOT: Store GitHub tokens in client localStorage
MUST NOT: Use loose KV keys for auth events — append-only ledger only
MUST NOT: Gate public (SHOP) projections
MUST NOT: Hardcode user lists outside CANON.md
MUST:     Every surface with privacy: PRIVATE declares auth: required in frontmatter
MUST:     Compiler validates: CANON.md privacy: PRIVATE → page has auth: required
MUST NOT: Serve PRIVATE content without authenticated session

Capabilities

AUDIT_LEDGER, FAIL_CLOSED, GITHUB_OAUTH, SCOPE_GATING, SESSION_MANAGEMENT

COVERAGE: 255/255

SPEC

Purpose

AUTH is the gate. GitHub identity in, session token out. Every scope access checked. Fail-closed.

AUTH controls who sees what. GitHub OAuth provides the identity anchor (KYC). Sessions live in Cloudflare KV. Scope grants are resolved at query time from CANON.md readers and writers fields. Public content passes freely. Private content requires a valid session with matching grants. No session, no access.

Structure

Root AUTH domains: none currently (leaf service scope).

Required closure artifacts per scope: CANON.md, README.md, AUTH.md, VOCAB.md, ROADMAP.md, COVERAGE.md, LEARNING.md.

Learning lane per governed scope: LEARNING.md at the scope root is terminal and SHALL NOT nest further LEARNING/.

Routes

POST /auth/github      Exchange GitHub OAuth code for session token
GET  /auth/session     Validate session token, return user identity
POST /auth/logout      Delete session from KV
GET  /auth/grants      Check if session user can access scope X

Session Contract

{
  user:             GitHub username (KYC anchor)
  github_uid:       GitHub numeric user ID
  org:              hadleylab (ORG membership = permission boundary)
  scopes_granted:   [] (resolved at query time from CANON.md readers)
  ts:               session creation timestamp
  expires:          session expiry timestamp
}

Gate Logic

IF privacy = PUBLIC (or omitted)  → no gate, everyone sees it
IF privacy = PRIVATE:
  IF readers = *                  → all authenticated users
  IF readers declared             → check session.user against readers list
  IF no readers declared          → ORG members only (fail-closed to public)
writers:                          → same pattern, controls write/contribute access

CANON.md Extension

Any scope’s CANON.md MAY declare:

privacy: PRIVATE
readers: iDrDex, yanabeda, ir4y
writers: iDrDex
github: username

Fields:

• privacy: — PUBLIC (default) or PRIVATE
• readers: — comma-separated GitHub usernames granted read access
• writers: — comma-separated GitHub usernames granted write/contribute access
• github: — on USER principal CANON.md, binds identity to GitHub account

Ecosystem Connectivity

1. Upstream: SERVICES governance contracts and hadleylab-canonic scope inheritance.
2. Runtime: Cloudflare Worker (api.canonic.org) + TALK_KV for sessions.
3. Frontend: DESIGN.js auth flow, talk.js auth headers, magic.js scope gating.
4. Ledger plane: all auth events (login, grant, deny) ledgered to TALK_KV.

Pages

Default: Overview.

INTEL

Auth Architecture

API Routes

Principal Registry

Gate Logic Intelligence

Risk Assessment

Test

Secret Rotation Playbook

Enforcement: CI gate key-status checks Ed25519 key age (365-day window). API token age is not currently automated — track via calendar.

LEARNING

ROADMAP

Now

Later

VOCAB

INHERITANCE CHAIN

SERVICES

SERVICES compose primitives — INTEL + CHAT + COIN. Every service governed. Every scope discovered.

MUST:     Maintain TRIAD integrity (CANON.md + VOCAB.md + README.md)
MUST:     Treat SPEC as scope identity (`{SCOPE}` directory), not as a file
MUST:     Every SERVICE scope include ROADMAP.md, COVERAGE.md, LEARNING.md, and `{SCOPE}.md` as governed content surfaces
MUST:     Discover SERVICE scopes from filesystem only (no manual catalog)
MUST:     Keep http:// and magic:// on the same namespace (transport differs, scope path matches)
MUST:     CANON.md = axiom + universal constraints (no service names, no paths, no implementation)
MUST:     README.md = how to run the CANON (nothing else)
MUST:     {SCOPE}.md = SPEC — the interface (purpose, routes, projections, ecosystem)
MUST:     SHOP.md = public projection file (per scope, filesystem-discoverable)
MUST:     VAULT.md = private projection file (per scope, filesystem-discoverable)
MUST:     Runtime implementation remains under ~/.canonic; this workspace is governance-first
MUST NOT: Hardcode service names in CANON constraints (law speaks universals)
MUST NOT: Define ungoverned terms outside VOCAB.md
MUST NOT: Treat `{SCOPE}.md` as SPEC identity
MUST NOT: Move architecture/lifecycle into README
MUST NOT: Leak private projections to public surfaces
MUST NOT: Maintain duplicate mapping tables outside generated manifest outputs
MUST NOT: Add runtime jargon to governance contracts
MUST:     Ledger-consuming services declare source ledgers, scope filters, and closure gates
MUST:     Learning governance remains live — closure claims require fresh DISCOVER → GENERATE → RELINK evidence

hadleylab-canonic

HADLEYLAB ships software. Every app, book, paper, deal, and patent is PROOF that MAGIC works. COIN = WORK. LEARNING = COMPUTE.

MUST:     Every app, book, paper, deal, or patent is evidence of MAGIC
MUST:     All scopes inherit canonic-canonic/CANONIC.md governance
MUST:     All users governed under USERS/ via SERVICES/USER
MUST:     Cross-index INTEL across users (INTEL.md)
MUST:     Shared events propagate to ALL affected user dashboards
MUST:     Maintain governance workspace purity (.md files only)
MUST:     Ledger all COIN (validated work) through MAGIC 255
MUST:     Compile all INTEL from governed sources
MUST:     Keep frontend/runtime implementation under ~/.canonic (hidden runtime)
MUST:     Surface governed TALK, Library, and SERVICES scopes (no orphan content)
MUST:     Derive nav labels from governed scope names (no hardcoded strings)
MUST NOT: Publish without governance (CANON.md required)
MUST NOT: Duplicate primitives — compose from INTEL, CHAT, COIN
MUST NOT: Silo intelligence inside a single user when multiple are affected
MUST NOT: Expose VAULT contents outside NDA scope
MUST NOT: Store runtime artifacts in governance workspace

canonic-canonic

SPEC is governance. `canonic-canonic/` is the spec root.

MUST:     Keep this repo governance-only (.md/.pdf)
MUST:     Publish workspace mapping in CANONIC.git (no hardcoded repo lists)
MUST:     Preserve three primary lanes: FOUNDATION, INDUSTRIES, MAGIC
MUST NOT: Commit runtime artifacts here (runtime belongs in ~/.canonic/)
MUST:     Sell MAGIC tiers — the product, not the proof (proof is hadleylab-canonic)
MUST NOT: Embed beta-test app URLs in platform page content