id(web): registered identities are kept forever — no delete, expiry or cap at any layer, and the register handler is unthrottled

Problem

Every POST /api/identity/register creates a client identity that is kept forever, everywhere it is stored: there is no delete, eviction, expiry, or cap for identities anywhere in the web identity store — and the registration handler has no rate limiting. Tokens expire after 30 days, but the identity record itself does not, and /api/identity/me refreshes a presented token indefinitely, so neither side of the store ever shrinks.

Evidence (developing-today/code @ `9874fe5`, `pkgs/id/src/web/identity.rs` unless noted)

register (:180-214) persists the identity first (IdentityDb::create, :541), then inserts it into the in-memory clients map (:198-201) and creates a watch::channel inserted into name_watchers (:205-209). Nothing bounds the count.
IdentityDb offers only open / load / read_all / create / update (:483, :516, :529, :541, :556) — there is no delete operation at the storage layer, and IdentityStore has no removal method (grep for clients.remove / retain / any deregister path across pkgs/id/src returns nothing).
Token expiry is not identity expiry: decode_token rejects tokens older than TOKEN_MAX_AGE_SECS (30 days, :65, :379-383), but verify_and_refresh (used by GET /api/identity/me, routes.rs:2886) mints a fresh token on every visit, and the underlying ClientIdentity row is never aged out regardless.
Startup cost grows with the total ever registered: IdentityStore::new loads every record and builds both maps plus one watch channel per identity (:140-148).
The handler (web/routes.rs:2858-2881) calls register directly — no per-client rate limit, counter, or cap (compare SaveRateLimiter for file saves). Registration is reachable by any client that can reach the web UI: the default bind is loopback, but --bind to a non-loopback address is a supported, documented mode (cli.rs:333-339) where the only protection is the optional --web-token (absent it, serve.rs:1138 merely warns).

Verification (this run)

Grep audit (above): no deletion/eviction path exists at any layer — handler, store, or DB.
Laptop probe ~/git/fleet/probe-2026-10-28-laneA-identity-growth/ mirroring register's insert shapes (clients map + watcher slot per identity, sealed-record size as nonce + JSON plaintext + GCM tag): 100,000 registrations → both maps hold 100,000 entries and ≥13.8 MB of persisted sealed records, monotonically — nothing in the code can ever reduce any of the three.

Why it matters

A long-lived id serve accumulates one permanent identity per browser profile, device, test run, or script that ever registered — plus one encrypted on-disk record and a startup reload of all of them — with no operator-visible count, no cleanup verb, and no bound. On a non-loopback bind without a web token, a remote caller can grow the store and the on-disk .identity.redb at request speed. This is the same unbounded-growth family as #1732 (directory_auth codes), #1713 (SaveRateLimiter) and #1726 (outbox), in the one store that also persists to disk.

Acceptance criteria

Identities have a bounded lifecycle — triage pins the policy (e.g. expiry of identities whose tokens have all aged out, an operator delete verb, a registration cap, and/or rate limiting on the register handler) — and the pinned bound is implemented at the store and DB layers (a real IdentityDb delete).
Startup no longer retains records the pinned policy considers dead (they are pruned on load or by a sweep), and clients / name_watchers stay consistent with the DB after pruning.
The register handler's abuse surface is addressed per the pinned policy (rate limit and/or cap), without breaking first-visit registration for a legitimate new browser.
Regression tests: registering past the bound / past the expiry leaves the store at or under the bound, in memory and on disk; a still-active identity is never pruned.
Existing identity tests pass (laptop or CI).

CODE-716

🤖 Agent note · filed

Agent: new-issue-creator job (new-issue-creator-code-a)
Session / ID: new-issue-creator-code-a run 2026-10-28 13:05 CDT
Found via: filed this run
Task: Filed after verifying on current main (9874fe5) that web identity registrations have no delete/expiry/cap at any layer (handler, IdentityStore, IdentityDb) and the register handler is unthrottled; laptop probe (probe-2026-10-28-laneA-identity-growth) quantified monotone growth. Triage packet enqueued to repo-health-code-pilot.
Expectation: effort/s — triage pins the lifecycle policy (expiry / delete verb / cap / rate limit), then the bounded fix + regression tests in the issue's acceptance criteria.
Links: evidence + probe details in the issue body

🤖 Agent note · escalated / blocked

Agent: OpenChamber scheduled lane (repo-worker-code)
Session / ID: OpenCode session ses_e5e63a78b40ffes3qws91ae2el; queue task 4795
Fresh read: id(web): registered identities are kept forever — no delete, expiry or cap at any layer, and the register handler is unthrottled #1766 remains OPEN and assigned to dezren39. Its task-bound PR feat(id/web): non-destructive identity registration admission bound (#1766) #4143 remains OPEN, non-draft, authored by dezren39 (Drew) at 537e1d7201b084c6e4e3cbb844776bcf8f01f54e. No PR contents, worktree, tests, or edits were touched.
Decision required from Drew: explicitly release ownership of feat(id/web): non-destructive identity registration admission bound (#1766) #4143, or close/merge it, before this task can proceed. The queued scope is not a parallel edit against Drew-owned work.
Resume: after that ownership decision, revalidate the issue and PR metadata fresh.

Merge pull request #4143 from developing-today/queue/4795-1766-identi…

🤖 Agent note · picked up (OpenChamber scheduled lane)

Agent: repo-worker-code · lane c29174f1-48e0-4b13-b4ff-9b73ab67e9ab · task 4795
Fresh revalidation: issue id(web): registered identities are kept forever — no delete, expiry or cap at any layer, and the register handler is unthrottled #1766 OPEN, assigned dezren39; task-bound PR feat(id/web): non-destructive identity registration admission bound (#1766) #4143 MERGED at 2026-11-02T15:39:30Z (merge 2b7b246), head 537e1d7, base main. Merge commit is ancestor of current main (1e3763f). Prior Drew-owned open-PR hard stop is cleared — resume condition (PR close/merge) met. No worktree edits made; verifying merged implementation on main.
Next: verify admission-bound code + targeted tests on main, then terminal complete. Issue id(web): registered identities are kept forever — no delete, expiry or cap at any layer, and the register handler is unthrottled #1766 stays open per acceptance.
Links: id(web): registered identities are kept forever — no delete, expiry or cap at any layer, and the register handler is unthrottled #1766 · feat(id/web): non-destructive identity registration admission bound (#1766) #4143

🤖 Agent note · done (OpenChamber scheduled lane)

Agent: repo-worker-code · lane c29174f1-48e0-4b13-b4ff-9b73ab67e9ab · task 4795
Outcome: fixed_merged. Task-bound PR feat(id/web): non-destructive identity registration admission bound (#1766) #4143 MERGED 2026-11-02T15:39:30Z (merge 2b7b246, head 537e1d7); merge verified as ancestor of main 1e3763f. Issue id(web): registered identities are kept forever — no delete, expiry or cap at any layer, and the register handler is unthrottled #1766 stays OPEN per packet acceptance (lifecycle deletion is separate design).
Verification on main: 4/4 admission-bound tests pass — at_and_beyond_limit, concurrent_race (16-way/5 slots), refresh_at_capacity_still_works, restart_at_bound_serves_existing_refuses_new (+1 unrelated world capacity test also pass). Implementation present: IdentityStore max_identities, ID_WEB_MAX_IDENTITIES config (default 10_000), 503 identity_capacity_reached handler, verify_and_refresh ignores bound.
CI note: PR head 537e1d7 check-runs recorded failures (nix flake check, native arm64 determinism, guard PR check list) but Drew merged; local targeted tests pass on current main.
Labels: removed status/in-progress, queue/claimed, work/assigned. user/escalated left for Drew.
Links: feat(id/web): non-destructive identity registration admission bound (#1766) #4143 · id(web): registered identities are kept forever — no delete, expiry or cap at any layer, and the register handler is unthrottled #1766

Navigation Menu

Repository navigation

id(web): registered identities are kept forever — no delete, expiry or cap at any layer, and the register handler is unthrottled #1766

Problem

Evidence (developing-today/code @ `9874fe5`, `pkgs/id/src/web/identity.rs` unless noted)

Verification (this run)

Why it matters

Acceptance criteria

195 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id(web): registered identities are kept forever — no delete, expiry or cap at any layer, and the register handler is unthrottled #1766

Description

Problem

Evidence (developing-today/code @ 9874fe5, pkgs/id/src/web/identity.rs unless noted)

Verification (this run)

Why it matters

Acceptance criteria

Activity

developing-today commented on Oct 28, 2026

dezren39 commented on Oct 28, 2026

195 remaining items

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Evidence (developing-today/code @ `9874fe5`, `pkgs/id/src/web/identity.rs` unless noted)