The Ward

At the circle's edge, a voice gives its name.

Recognizing a speaker draws only the first mark of a salt circle. Current policy and revocation must close it around this exact effect. Ward is LychD's singular Core-coupled authority for caller authentication and authorization.

Remote Ward is Designed, with its boundary owned by State of Work. The implemented local Sigil and scope floor is Partial: protected contained requests must present the dedicated local HTTP Basic credential before receiving the fixed, secret-free magus:* Sigil. This possession check does not distinguish people. Scope guards and consent preauthorization exist; separate User accounts and the remote IAM path below remain Designed.

One instance, different people and working views

A personal instance may admit friends; a household may share an instance administered by a parent; a company may give employees different application views through browser or mobile clients. A person or organization may also use several instances, with independently admitted accounts and permissions in each. Users need not run a LychD themselves. IAM's account and instance contract owns these relationships.

An assigned profile may offer one person a task form and another a review screen for the same work. Ward determines permitted access; the application owns the working views, Spellweaver the workflow, and the client their presentation. A profile can package those choices without merging their authorities. Follow profiles and working interfaces and the deployment examples.

The marks inside the circle

A Credential is revocable evidence of possession; a Principal names the immutable human, service, peer, or owned node to whom acts and objects belong. After verification, Core would issue a secret-free Sigil carrying that Principal and bounded claims through one request or Run. An Authority Grant is the current decision over Principal, action, object, audience, lifetime, policy generation, and delegation chain. Historical scopes are evidence, not live policy. An authentication session remains distinct from all four and from a Bridge conversation.

In the designed Ward, provider adapters verify evidence without minting Sigils or becoming policy authorities. Admission validates protocol, issuer, audience, expiry, replay, revocation, and assurance; resolves one enrolled Principal; then authorizes the route and named object in an ownership-aware query. The decision records credential, policy, and revocation generations. Unknown credentials, unresolved Principals, and caller-supplied identity or scope headers receive zero authority. No Extension may remove Ward from a protected surface.

Authority at the moment of consequence

Sessions, Runs, consents, streams, artifacts, memories, tasks, leases, and administrative records carry an owner or explicit sharing policy in the persistence query. Filtering after an unrestricted read is too late.

Immediately before a protected tool or effect, its handler rechecks the current Principal, action, object, assurance, delegation, consent or preauthorization, policy generation, and revocation epoch. It checks again after queueing, worker claim, Stasis, consent, resume, or another wait. Narrowing the tools visible to an Agent helps; the handler remains the lock.

Revocation must invalidate Credentials, sessions, cached grants, and affected pending or sleeping work. Recovery begins at zero authority: no universal remote Master token or ambient fallback exists.

The current preauthorization floor

The current preauthorization floor rechecks enabled state, source presence, database time expiry, and remaining use budget in the conditional consumption write immediately before granting the effect. Startup synchronization marks removed Rune-owned policies source_present = false without overwriting operator enable/disable or usage state; a later exact reappearance can restore source presence. Budget consumption and its consent record share one PostgreSQL transaction, with rollback tested against injected insert failure and removal/expiry races.

No borrowed authority

Veil terminates TLS and canonicalizes hostile traffic; Tether narrows reachability. Their headers, addresses, certificates, signatures, or Tether arrival may contribute evidence, but never mint a Sigil or application authority. Mirror preserves operative identity and attribution; Ward authenticates and authorizes the initiating or approving Principal. Intercom peer scopes likewise cannot enter a local Sigil unchanged.

Keep the Vessel and Altar on same-host loopback. Do not proxy, tunnel, port-forward, or remotely publish them. ADR 38 owns Ward law; Security owns the wider boundary.