Approve from the web with a passkey delegated by your Oxygen identity issue #237
open andymccall opened this · 0 comments
andymccall
Andy (2026-10-16): stay on the website to approve a sealed gate (issue #235), with the same cryptographic proof as oxy seal --flow. Decided: after issue #211 (Postgres).
Design:
Register once. Settings > Keys registers a passkey (WebAuthn: platform authenticator or security key, user verification required). The person delegates it once from the CLI with a new scope, approve (oxy identity delegate add --scope approve <passkey>), so their signed identity lists it as a delegate that may approve and nothing else. Oxygen spec 14.2: a delegate whose key is a WebAuthn P-256 credential; agents' delegations never carry approve.
Approve. The run page shows what is approved (job, plan blob, environment) and computes the statement hash in the browser from what it fetched; Approve calls navigator.credentials.get with that hash as the challenge; the hub verifies the assertion (webauthn-rs), that the credential is delegated with approve by an identity linked to an account with the role, and that it covers exactly the job's statement, then releases the job as for a seal.
Keep the proof. The assertion (authenticatorData, clientDataJSON, signature) and the credential's public key are kept in the repository beside seals, so anyone can check it signs that statement and that the person's identity delegated that passkey; the token's approval claim names it.
Limits to state plainly: on the web the person sees what the hub's page shows; a compromised hub could show one plan and ask to sign another. Mitigations: the statement hash computed in the page from the fetched plan, an enforced CSP (issue #227), and an option per environment to require the CLI or a hardware security key (attestation).
Andy (2026-10-16): stay on the website to approve a sealed gate (issue #235), with the same cryptographic proof as
oxy seal --flow. Decided: after issue #211 (Postgres).Design:
approve(oxy identity delegate add --scope approve <passkey>), so their signed identity lists it as a delegate that may approve and nothing else. Oxygen spec 14.2: a delegate whose key is a WebAuthn P-256 credential; agents' delegations never carryapprove.approveby an identity linked to an account with the role, and that it covers exactly the job's statement, then releases the job as for a seal.Limits to state plainly: on the web the person sees what the hub's page shows; a compromised hub could show one plan and ask to sign another. Mitigations: the statement hash computed in the page from the fetched plan, an enforced CSP (issue #227), and an option per environment to require the CLI or a hardware security key (attestation).