0006. id is the OIDC provider; no shared cookie

Status: accepted, 2026-10-09

Context

Each service has its own panel on its own host. pages signed people in itself (passkeys with RP ID pages.xvii.network). A shared cookie on .<d> would be sent to every user site under *.pages.<d>.

Decision

id is an OpenID Connect provider and the only place that handles passkeys, with RP ID = <d>.
Panels are OIDC clients (code + PKCE) and keep host-only session cookies.
The CLI uses the device authorization grant; CI uses API tokens or OIDC job token exchange.
Access tokens are short JWTs verified by services through JWKS; API tokens are opaque and introspected.

Consequences

Existing pages passkeys are dropped; the one existing user re-enrolls (agreed).
Every service depends on id being up for new sign-ins; existing sessions keep working while their access tokens last, and services cache JWKS.