Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/architecture/adr/0049-named-operator-keys.md

@@ -0,0 +1,30 @@
+# ADR-0049: Named operator keys and bounded Console access
+
+Status: accepted for RC-01, 2026-09-08. Online managed identities extend this deployment-owned
+provider under ADR-0052; its distinct ownership and recovery contract supersede only the online
+identity-administration limitation below. The deployment registry contract remains unchanged.
+
+Support a small deployment-owned registry of named human credentials as the first attributable
+viewer/operator/admin authentication provider. Each immutable deployment record identifies a
+credential, subject, role, SHA-256 digest and required UTC-aware expiry. Generate keys with 256 bits
+of randomness and the distinct `mfop_` namespace. Validate the complete bounded registry at startup;
+reject duplicate JSON fields, credential IDs, digests, conflicting roles and reserved subjects.
+Rotation may temporarily retain two records for the same subject and role. Removing a record takes
+effect when the API is recreated with the replacement configuration. This is a deployment operation,
+not an online secret-management API. There is no new database state or migration.
+
+Keep the legacy administrator header and bootstrap key compatible. Named credentials use that header
+but never fall back to bootstrap privileges, including after expiry/revocation. Machine keys and
+single-use enrollment tokens cannot authenticate as humans. The existing role dependencies remain
+the authorization authority, and audit writers receive the authenticated subject and correlation ID.
+An installation may disable bootstrap access once it has an unexpired named administrator.
+
+The Console verifies identity before loading protected data, exposes subject, role and key expiry,
+and clears its memory-only key on manual lock, reload, credential refusal or after at most fifteen
+minutes. This local lock deadline is distinct from server-enforced key expiry. Protected responses
+carry `Cache-Control: no-store`; requests do not use cookies. Stale responses cannot restore data or
+invalidate a newly unlocked session. A dependency outage and a forbidden operation are not logout.
+
+OIDC/Authentik, server-issued browser sessions, online identity administration and an audited
+write-only deployment-secret lifecycle remain explicit RC limitations. This provider establishes
+real least privilege and attribution without claiming enterprise IAM or SSO completion.