feat: pair controller accounts over outbound HTTPS

.traceweaver/account-pairing-20261028/authority.json

@@ -0,0 +1,86 @@
+{
+  "baseline_id": "PAIR-20261028-01",
+  "baseline_hash_sha256": "9b80ccd96837cae1dd63723fa10ce8390dc4305fcc9e65f303a4868a917dc922",
+  "owner_approval": "Approve. We should not rely on vpn access to link an deployment and cryptolabs.co.za user account",
+  "approved_scope": "Minimum shared outbound account pairing, existing WordPress plugin plus standalone IPMI/local DC controller adapters; existing credentials and policies preserved.",
+  "scope_quality": "Astra requirements-review and root two-clarification receipt retained by parent; no new owner decision",
+  "protocol_file": "contract.json",
+  "protocol_sha256": "abd8b95925c92e7a70f6bdd5f0f7d2bcb2e5cbdcf822699397c5e130d6b3aa70",
+  "approved_requirements": [
+    {
+      "id": "REQ-PAIR-001",
+      "statement": "A deployment administrator shall be able to link IPMI Monitor or the DC Overview/Watchdog controller to an existing or newly created CryptoLabs account using outbound HTTPS to the existing public CryptoLabs WordPress service for account pairing. Existing product service validation may use its existing approved HTTPS endpoint. Provider VPN access, an inbound deployment callback and per-deployment hostname admission shall not be prerequisites.",
+      "authority_status": "owner_approved_scope_quality_ready",
+      "trace_id": "TRACE-PAIR-001",
+      "verification_id": "VER-PAIR-001",
+      "validation_id": "VAL-PAIR-001"
+    },
+    {
+      "id": "REQ-PAIR-002",
+      "statement": "The public linking flow shall require signed-in account consent through a nonce-protected POST for the matching displayed one-time user code. Opening a link, signing up or presenting a payment-success parameter alone shall not authorize a deployment.",
+      "authority_status": "owner_approved_scope_quality_ready",
+      "trace_id": "TRACE-PAIR-002",
+      "verification_id": "VER-PAIR-002",
+      "validation_id": "VAL-PAIR-002"
+    },
+    {
+      "id": "REQ-PAIR-003",
+      "statement": "Pending linking attempts shall expire after 300 seconds, enforce bounded issuance, approval guesses and polling, and permit only one successful redemption through atomic persistent transitions across workers. Secret device codes shall remain backend-only and shall not be stored in plaintext by WordPress.",
+      "authority_status": "owner_approved_scope_quality_ready",
+      "trace_id": "TRACE-PAIR-003",
+      "verification_id": "VER-PAIR-003",
+      "validation_id": "VAL-PAIR-003"
+    },
+    {
+      "id": "REQ-PAIR-004",
+      "statement": "A deployment shall accept a result only for the initiating current local administrator and session. It shall stage and verify the authoritative result before an intentional commit, consume the local attempt once, and preserve an existing working link on failure, denial, cancellation, expiry, session change or account mismatch. A first link may save verified WordPress identity with no paid grant when service validation fails; an existing different working credential/configuration shall not be replaced by a candidate that fails service validation. A same-key re-link shall not newly assert paid readiness on validation failure.",
+      "authority_status": "owner_approved_scope_quality_ready",
+      "trace_id": "TRACE-PAIR-004",
+      "verification_id": "VER-PAIR-004",
+      "validation_id": "VAL-PAIR-004"
+    },
+    {
+      "id": "REQ-PAIR-005",
+      "statement": "The new flow shall deliver only the existing product account credential and allowlisted authoritative identity/status fields over a backend HTTPS response. It shall preserve current service entitlement/quota decisions, worker-scoped credentials and local administration/update authority. Pairing shall not grant a new paid entitlement, change retention/outage policies, or give the provider host access.",
+      "authority_status": "owner_approved_scope_quality_ready",
+      "trace_id": "TRACE-PAIR-005",
+      "verification_id": "VER-PAIR-005",
+      "validation_id": "VAL-PAIR-005"
+    },
+    {
+      "id": "REQ-PAIR-006",
+      "statement": "The implementation shall preserve existing working links and legacy clients, keep the current pinned WordPress package/publisher boundary, and deliver installed product updates through accepted DC Overview Fleet Management. Deployment and paid-service acceptance shall remain held until observed in the intended environment.",
+      "authority_status": "owner_approved_scope_quality_ready",
+      "trace_id": "TRACE-PAIR-006",
+      "verification_id": "VER-PAIR-006",
+      "validation_id": "VAL-PAIR-006"
+    }
+  ],
+  "implementation_paths": [
+    "src/cryptolabs_proxy/auth.py",
+    "src/cryptolabs_proxy/account_link.py"
+  ],
+  "verification_policy": "Lean TDD, reviewed preproduction RED, actual PHP emitter/Flask/SQL boundaries and required CI. Local GREEN does not prove installed acceptance.",
+  "validation_question": "Can an owner link a local deployment through public signup/login and explicit code consent without provider VPN, inbound callback or manual domain registration, while keeping existing links/workers/paid decisions safe?",
+  "publication_boundaries": {
+    "feature_base": "dev",
+    "feature_pr_target": "dev",
+    "release_target": "main",
+    "central_delivery": "existing pinned WordPress publisher",
+    "installed_delivery": "accepted DC Overview Fleet only"
+  },
+  "must_not_change": [
+    "Existing paid plans, grace/retention, worker tokens, local administrator/Fleet authority",
+    "Dirty primary checkouts and unrelated worktrees",
+    "Build pool authority, publisher secrets and privileged bootstrap"
+  ],
+  "held_claims": [
+    "Source changes verified locally and independently reviewed; protected CI required before merge",
+    "Actual public signup/email verification and installed no-VPN account-link acceptance remain held",
+    "Installed delivery requires accepted Fleet channel; backend AI inference and actual payment acceptance remain separately held"
+  ],
+  "protocol_freeze": {
+    "sha256": "abd8b95925c92e7a70f6bdd5f0f7d2bcb2e5cbdcf822699397c5e130d6b3aa70",
+    "status": "Frozen for current implementation; contract original-status label is historical. Existing-key-only selected under optional MAY issuance; wire unchanged."
+  }
+}