docs: decide multi-person ZK sharing ADR; reconcile jwt/encryption docs (#4) #10

Merged

alvaro merged 1 commit from docs/3-4-encryption-persona-docs-reconciliation into main

2026-07-19 09:47:19 +00:00

alvaro commented

2026-07-19 09:43:40 +00:00

Owner

Summary

The doc-reconciliation work from earlier in the session — stranded on this branch and never merged. Phase A1 (#6) and A2 (#9) both built on main, which does not currently contain the multi-person-sharing ADR their code comments reference. This PR lands the decided design and the corrected docs.

docs/adr/multi-person-sharing.md (NEW) — the decided ADR for per-profile DEK + X25519 envelope sharing. All five original open questions resolved 2026-07-18. Covers divorced-parents, pets, graduation, elderly-parent care; adds an admin permission tier. This is the design Phase A1/A2 implement and Phase B will build on.
docs/product/encryption.md — full rewrite to the implemented wrapped-DEK / Web Crypto model (the old version described ZK encryption as 'planned').
docs/adr/jwt-authentication-decision.md — rewritten to match the implementation (PBKDF2 not bcrypt, no Redis, token_version revocation, real Claims). Original aspirational content preserved in a History section.
docs/product/PERSONA_AND_FAMILY_MANAGEMENT.md — 'Current reality' section added, old 'Implementation Status' marked superseded, encryption section corrected.
docs/product/ENCRYPTION_UPDATE_SUMMARY.md → archived to docs/archive/.
docs/adr/README.md — index updated.

Closes #4. Refs #3 (the ADR is the design of record for the sharing work tracked there).

Note

This branch was authored before A1/A2. It touches only docs, so there should be no merge conflicts with the code changes in #6/#9. If any of the doc rewrites contradict what A1/A2 actually shipped, I'll reconcile in a follow-up — but the ADR itself was written first and A1/A2 were implemented to match it.

## Summary The doc-reconciliation work from earlier in the session — stranded on this branch and never merged. Phase A1 (#6) and A2 (#9) both built on `main`, which does not currently contain the multi-person-sharing ADR their code comments reference. This PR lands the decided design and the corrected docs. ## Contents - **`docs/adr/multi-person-sharing.md` (NEW)** — the decided ADR for per-profile DEK + X25519 envelope sharing. All five original open questions resolved 2026-07-18. Covers divorced-parents, pets, graduation, elderly-parent care; adds an admin permission tier. This is the design Phase A1/A2 implement and Phase B will build on. - **`docs/product/encryption.md`** — full rewrite to the implemented wrapped-DEK / Web Crypto model (the old version described ZK encryption as 'planned'). - **`docs/adr/jwt-authentication-decision.md`** — rewritten to match the implementation (PBKDF2 not bcrypt, no Redis, token_version revocation, real Claims). Original aspirational content preserved in a History section. - **`docs/product/PERSONA_AND_FAMILY_MANAGEMENT.md`** — 'Current reality' section added, old 'Implementation Status' marked superseded, encryption section corrected. - **`docs/product/ENCRYPTION_UPDATE_SUMMARY.md`** → archived to `docs/archive/`. - **`docs/adr/README.md`** — index updated. Closes #4. Refs #3 (the ADR is the design of record for the sharing work tracked there). ## Note This branch was authored before A1/A2. It touches only docs, so there should be no merge conflicts with the code changes in #6/#9. If any of the doc rewrites contradict what A1/A2 actually shipped, I'll reconcile in a follow-up — but the ADR itself was written first and A1/A2 were implemented to match it.

alvaro added 1 commit 2026-07-19 09:43:40 +00:00

docs: decide multi-person ZK sharing ADR; reconcile jwt/encryption docs

Lint and Build / format (pull_request) Successful in 37s

Details

Lint and Build / clippy (pull_request) Successful in 1m40s

Details

Lint and Build / build (pull_request) Successful in 3m44s

Details

Lint and Build / test (pull_request) Failing after 0s

Details

e322145ffb

Rewrite the encryption/persona/JWT docs to match the implemented code and
record the multi-person sharing design.

- multi-person-sharing.md (NEW): ADR for per-profile DEK + X25519 envelope
  sharing. All five original open questions resolved 2026-07-18. Covers
  divorced-parents, pets, graduation, and elderly-parent care; adds an
  admin permission tier for owner-incapacity. Decided, not yet implemented.
  (#3)
- encryption.md: full rewrite to the implemented wrapped-DEK / Web Crypto
  model; the old version described ZK encryption as 'planned'. (#4)
- jwt-authentication-decision.md: rewritten to match implementation
  (PBKDF2 not bcrypt, no Redis, token_version revocation, real Claims).
  Original aspirational content preserved in a History section. (#4)
- PERSONA_AND_FAMILY_MANAGEMENT.md: 'Current reality' section added, old
  'Implementation Status' marked superseded, encryption section corrected. (#4)
- ENCRYPTION_UPDATE_SUMMARY.md: archived (changelog for a rewrite that
  itself went stale). (#4)
- ADR README index updated for the new + reconciled entries.