feat(runtime): PRF-sealed provision custody with the scope-down split (#127)

* feat(runtime): PRF-sealed provision custody with the scope-down split

A provision-scoped ticket is store administration by possession, so it
no longer persists under the silent device key. Enrollment splits it:
the node's scope-down exchange mints a derived sync ticket that becomes
the declared sink (silent at rest, transport-only by the gate's scope
enforcement), and the provision bearer URL is only held in memory.
Sealing it at rest is a separate, explicit passkey ceremony that wraps
it under a prf slot — attempted, never capability-detected; the
envelope records the credential that actually evaluated the PRF and
whether it roams. Unlocking is the same ceremony; locking forgets the
memory copy and keeps the sealed record. On devices whose authenticator
cannot evaluate PRF nothing persists: the capability is memory-only and
the durable copy is the ticket in the user's password manager.

authenticateAndDerivePrfSecret runs assertion and PRF evaluation in one
user-verifying get(), so sealing and unlocking cost one prompt. The
enrollment form (preact TicketEnrollForm) is shaped for password
managers — a current-password field with a label-as-username companion
and an explicit credentials.store offer — so the manager saves the
ticket on first paste and autofills it later. Exchange failures
(a node predating the endpoint, network errors, unusable responses)
fall back to enrolling the ticket exactly as pasted.

Part of #123 (A3 phase 2).

* docs: cover the sealed sink record and the at-rest decision

sync-and-recovery and tickets-explained now state the declaration
persists only as a sealed envelope, with the exact scope of that
protection (at rest, not same-origin script). Troubleshooting gains the
partially-cleared-site-data path: an unopenable record deliberately
runs local-only and re-enrollment resumes under the same account.
seed.md's PRF field-encryption item is promoted from stretch to
required per the owner decision, pointing at the #126 scope split.
Decision record 0001 captures the envelope design, the capability
split, the attempt-don't-detect PRF posture, the no-PRF custody
fallback, and the rejected alternatives.

Part of #123 (A3 phase 1 + C2).

* docs: describe the provision split, sealing ceremony, and custody fallback

sync-and-recovery gains the split bullet: a provision ticket becomes a
derived sync sink plus in-memory admin capability, sealed behind a
passkey only through an explicit ceremony, with the password-manager
copy as the durable one on no-PRF devices. auth.md documents the
attempt-don't-detect posture and the combined assert+derive ceremony.
store-provisioning points browser flows at the capability custody for
the provision URL. tickets-explained tells the user-facing version of
the split. Decision record 0001's follow-up reflects phase 2 landing.

Part of #123 (A3 phase 2).

commit

efb03946d6d06bd287ad59f902383f71c9ae0980

parent

799188a471466fd2176f5beac9205a644b65bacd

author

FelineStateMachine <dami.etoile@gmail.com>