Expand description
Stable identity → user_key pinning (nghr ec3e0622).
ROOT DEFECT CLASS (owner ruling 2026-09-14): the per-user namespace key
used to be RECOMPUTED from token claims on every request (humans:
preferred_username || sub). Any claim mutation — a routine IdP group/
role/scope change, or fallback flicker when a claim appears/disappears
(the 16D migration itself) — silently rotated users/{user_hash(key)}
and stranded config + session history in an empty new home, masked by
the sibling global-token shadowing bug (92a36073).
ROOT-CAUSE FIX: derive ONCE per principal, PIN it, never recompute.
- first sighting of a
subpins the 16D-derived key; - every later request resolves through the pin — claims may gate PERMISSIONS (Cedar) but never the namespace;
- agents are unaffected (their key is already the immutable
sub; the carve-out lives in the auth-side resolution, not here); - THQ-materialized profiles were already claim-independent (keyed by profile id); this registry brings the human personal lane to the same guarantee.
Storage: ~/.trustee/users/identity_map.json — { "pins": { sub: key } }.
BTreeMap for deterministic serialization. Values NEVER logged (a user_key
is not secret, but the file is identity data — keep it 0600).