On-network first
Challenge–response between the Rune agent, your IdP, and Saga on the LAN. Everyday suite access does not require a multi-tenant SaaS identity hop.
ᚱ · Rune Token · suite core
One sign-in. Full suite.
Rune Token roots identity in the workstation you trust. Saga and every suite app open as the same person — no public-cloud identity landlord.
Mark: ᚱ. Offline-capable. Device proofs. Suite SSO without secrets in the page. Yours.
The path
1
Rune Token login
User authenticates at the site IdP (device trust and/or OTP).
2
Saga session
Required console mints app-scoped suite activation.
3
Open expansions
Stella, Thala, and other RPs receive HttpOnly BFF cookies — same person, app-scoped rights.
4
Scoped session
Sensitive actions use short-lived server sessions — secrets are not left in browser JavaScript.
When the WAN fails
Built for sites that must work when the link is slow, locked, or gone. Keys on metal you control.
Device trust, not password theatre
Ed25519 device proofs bind sessions to hardware the organisation already provisioned. Email OTP remains a fallback — not the only path.
Suite SSO without secret sprawl
After Rune unlocks the person, app-scoped BFF cookies open Stella, Thala, Skjal, and Skarð. Sensitive work stays in short-lived server sessions.
Why Rune wins
- Sovereign perimeter — Unlike hosted IdPs that own your login path, Rune and suite identity deploy on your infrastructure with clear product boundaries.
- Air-gap friendly direction — Issuance, attestation, and revocation are designed for LAN and ceremony workflows — not only browser redirects to a global CDN.
- Operator-grade sessions — Console and fleet tools get scoped, short-lived authority instead of shared admin passwords and eternal API keys.
- One person, many apps — Sign out of Saga ends suite SSO cleanly across open suite apps — disciplined session lifecycle, not orphan tabs.
Long-term hardware trust (roadmap)
National-scale eID proved the model. We may go further: hardware-rooted, offline-capable attestation for high-assurance fleets.
Hardware-rooted trust
TPM 2.0 / secure enclave binding, FIDO2 passkeys, measured boot — identity lives in silicon you control, not a SaaS directory.
Post-quantum ready
Hybrid classical + ML-DSA / SLH-DSA signatures and CRYSTALS-Kyber key exchange — crypto agility baked in before harvest-now-decrypt-later becomes urgent.
Offline ZK attestations
Prove role, clearance, or fleet membership with zero-knowledge proofs on air-gapped Stella nodes — no PII broadcast, no central verifier required.
Mesh revocation
Issuance and CRL sync across your Thala fleet over LAN-only channels — instant lockout without internet, without trusting a third-party OCSP.
Architecture principles
- Air-gap issuance ceremonies — USB / NFC operator workflow, no cloud enrollment
- Continuous integrity attestation within your perimeter only
- Separation of identity, authorization, and session — short-lived scoped tokens
- Open Rust reference implementation — auditable, deployable on your metal
- Interoperable with Stella ops gate and Thala fleet policies
Related modules (in repo)
stech::token::identity
DeviceAnchor — TPM EK hash, measured boot PCRs, optional FIDO2 cred binding.
stech::token::crypto
HybridKeyPair — ML-DSA / SLH-DSA + classical agility interfaces.
stech::token::attest
ZkAttestor — offline membership proofs for fleet and clearance claims.
stech::token::revoke
RevocationMesh — LAN CRL sync target for Thala fleet distribution.
Phase 1 live: suite sign-in and short-lived operator sessions. Rune agent for air-gap device login. Phase 2 roadmap: hardware bind options — not required for current SKUs.