feat(identity): PetalNet Identity, first slice

[returnsvoidjanet]

First slice of PetalNet Identity, running against the live Authentik on 10.10.10.14.

Not a nicer Authentik UI. It reports three separate states for every access relationship and treats their disagreement as the product:

• Intended — what the role graph says should be true
• Configured — what Authentik's bindings say
• Evaluated — what Authentik answers when asked about a specific named person

Authentik stays the authentication source of truth. Nothing here reimplements sessions, MFA or OAuth, and every call in this slice is a GET.

What it does today, on real data

792 access checks, verified 15s ago in 14.5s
Creating a person is blocked — 1 application currently permits every authenticated account: ldap
Findings: 1 — UNBOUND APPLICATION, PetalNet LDAP
People: 11, with roles and how many applications each actually reaches
Applications: 72, what each is bound to, and who reaches it

The "reaches" number is not group membership. It is Authentik's own answer for that named person against every application.

The Evaluated layer

check_access/?for_user=<pk> gives a truthful per-person answer for every SSO application, with no connector work and no impersonation. That is weaker than probing the application itself and much stronger than reading configuration and hoping, so it is labelled as its own state rather than being passed off as a probe. Real probes and local-account discovery are the next slice, and they are the only way to see a local-auth bypass.

Resolver

Deny beats allow at every distance: explicit-direct-deny → inherited-deny → direct-allow → inherited-allow → default-deny. If allow could win by being nearer, an exception carved high in the tree would be silently defeated by any leaf grant.

Breadth-first role walking, so a role reachable both directly and through a long chain counts as direct. Cycle detection is a separate depth-first pass, because BFS with a seen set cannot distinguish a cycle from a diamond, and a diamond is legal. Cycles throw with the cycle named, and are caught even in a branch nobody holds yet.

Verification

27 tests, including the design's own worked examples: "why can Parker access Grafana", "why can Cooper not access Paperless", and the give Cooper Friends preview computing gains PetalNotes / keeps Jellyfin and Glovebox / still denied Grafana, Paperless, Dawarich.

The suite has teeth, proven rather than assumed. Deleting the detectCycles call turns exactly four tests red; restoring it turns them green.

Rendered against live Authentik after every refactor, not just typechecked.

Three defects found by running it

1. 36-second page. It asked Authentik about all 792 person-application pairs sequentially. A worker pool got 15 seconds, and that was still the wrong fix — the error was treating a reconciliation cycle as a rendering step. It now runs off the request path and the page reads the cached result in ~15ms. The header states the check count, duration and age, which is the evidence model the design wanted anyway: a result verified 15 seconds ago and one verified 19 days ago are different claims.
2. A failed check was recorded as a denial. That manufactures BROKEN_ACCESS findings out of network errors. unknown is now its own state and never counts as deny; a failed read of Authentik renders a loud error rather than an empty dashboard that reads as a clean bill of health.
3. "1 application currently permit" — plural on the noun, not the verb, on the one screen whose whole job is to be believed.

knip and lint findings, fixed at the root

knip was right on all of it, so nothing is suppressed:

• subjectsWithAccess duplicated whoReaches. Two functions answering "who can reach this" is how two answers start disagreeing — deleted.
• reconciliationFindings was written, then never called, while the load function already held exactly the evidence it needs. Now wired up, so three-state disagreements appear in the findings list.
• orphanIdentityFindings, mfaFindings, isMachine needed data this slice does not collect. Speculative API is dead code — removed; they return with the connector work, written against real data.
• The public surface of resolve.ts shrank to explainAccess and renderExplanation. Tests now drive the public API, so they assert on behaviour a caller can observe.
• state.ts was fetching /core/groups/ and never reading it — a wasted round trip to the lab's authentication service.
• Six .sort() → toSorted(); two of them were sorting arrays that get returned.
• Two no-await-in-loop, both restructured as recursion rather than waived. In the worker pool and in pagination the sequencing is inherent, and recursion states that instead of hiding it in a loop body.

check, lint:impeccable, test, manypkg, typesync:check, lint:knip, lint:knip:prod all pass on this app.

lint:impeccable reports 34 anti-patterns repo-wide, all inside apps/storybook/storybook-static, a gitignored build artifact. Pre-existing and unrelated; flagging rather than fixing.

Deployment

Needs AUTHENTIK_URL and AUTHENTIK_TOKEN. Both are required with no defaults — the app returns a 500 naming the missing variable rather than rendering an empty dashboard.

Not built yet, deliberately

Jellyfin discovery, the Migration Center, real access probes, bulk invite, rollback, the graph view and the command palette. Reconcilers with 22 connectors are where this class of project dies; the gate and the explanation engine come first so that filling in accounts is a safe operation, not just a fast one.