chore: initial commit

2026-06-25 00:34:34 +08:00
commit 3cce1be162
295 changed files with 30971 additions and 0 deletions
@@ -0,0 +1,35 @@
+# ADR 0004: Device Auth Persistence Port Ownership
+
+## Status
+
+Accepted
+
+## Context
+
+Device authentication persists long-lived key material and runtime JWT/backoff
+state. The bytes are meaningful only to the authentication policy, but the
+storage location also needs legacy migration names and must stay off the
+generic platform key/value API at upper layers.
+
+## Decision
+
+- `platform` owns only opaque blob key/value primitives and NVS mechanics.
+- `domain` owns the narrow auth persistence port: the public auth record slot
+  enum, mapping to storage namespaces/keys, legacy migration target names, and
+  atomic load/save adapter.
+- `control_plane` owns the serialized auth key/state schemas, challenge/response
+  policy, JWT refresh policy, retry/backoff state transitions, and factory
+  rotation behavior.
+- Upper layers must not call generic storage adapters for auth records. They
+  must use `domain_runtime_auth_store_load_record()` and
+  `domain_runtime_auth_store_save_record()`.
+
+## Consequences
+
+- Auth persistence has one facade declaration without exposing platform storage
+  types to `control_plane`.
+- Changing the serialized record layout remains a `control_plane` migration
+  concern.
+- Changing NVS namespace/key migration names remains a `domain` adapter concern.
+- A future secure-element or encrypted-storage backend can replace the platform
+  blob primitive without changing auth policy contracts.