ident

3.0 KB

1. # Decisions — ident.worldapi.org
3. <!-- generated by the antcolony librarian (antcolony-scheduler: ./colony librarian) from librarian/decisions.json — do not edit by hand, it is rewritten -->
5. The creator's decisions for **ident.worldapi.org** — current state only (superseded ones: `DECISIONS-archive.md` beside this file).
6. **A decision here overrides anything else; ask only if it is not decided here.**
7. Each entry: date · the creator's exact words in quotes · where it was said · "means" = a READING (the librarian's or the architect's), not the creator's words — when in doubt, the quote counts.
9. ## Contents
10. - [avatar](#avatar) — 1
11. - [ident concept](#ident-concept) — 1
12. - [login session](#login-session) — 2
13. - [notifications](#notifications) — 1
15. ## avatar
17. - 2026-09-24 · **"image upload needed"** · [ident.worldapi.org #15 — Identities get an avatar that apps can show](https://tickets.worldapi.org/projects/ident.worldapi.org/15)
18. - means (the librarian's reading, not the creator's words): Avatar must be uploadable as an image file in ident, not only set by pasting a picture URL. The URL-only result of ident#15 is rejected; add image upload.
20. ## ident concept
22. - 2026-09-24 · **"ok"** · [ident.worldapi.org #10 — UUID primary keys and storage/mpackdb/](https://tickets.worldapi.org/projects/ident.worldapi.org/10)
23. - means (the librarian's reading, not the creator's words): The creator accepted the mission 009 result and its open points. Per-app identity ids stay 32 random hex, not UUIDs, because mpackdb ids are time-based and guessable. Connections of deleted identities stay as gone:<id>. In-flight codes are migrated. The old .scratch/dev-m006 may be deleted.
25. ## login session
27. - 2026-09-25 · **"the logout is to be done properly. all active sessions receive a logout event through their websockets, all files a re deleted immediately."** · [ident.worldapi.org #17 — Question: delete old sessions at once on 'sign out everywhere'?](https://tickets.worldapi.org/projects/ident.worldapi.org/17)
28. - means (the librarian's reading, not the creator's words): 'Sign out everywhere' must not rely on an epoch counter with lingering files: push a logout event over every active session's websocket and delete all of the account's session files immediately (build the session enumeration needed).
29. - 2026-09-24 · **"the login is 365 days"** · [ident.worldapi.org #16 — Question: how long should an ident login last?](https://tickets.worldapi.org/projects/ident.worldapi.org/16)
30. - means (the librarian's reading, not the creator's words): An ident login session lasts 365 days; set IDENT_SESSION_TTL_MS's default to 365 days instead of 14 days, with no forced daily or weekly re-authentication.
32. ## notifications
34. - 2026-09-24 · **"yes"** · [ident.worldapi.org #13 — Question: may notification icons come from anywhere?](https://tickets.worldapi.org/projects/ident.worldapi.org/13)
35. - means (the librarian's reading, not the creator's words): Notification icons may come from any URL, not only the app's registered origins. Action links may be any link too. No origin restriction on icons.