Runtime state
Registration pending
The v2 code path is staged. Existing local authentication remains available until the relying-party registration is acknowledged and deployed.
Identity provenance
One identity boundary. Verifiable passage.
StatVault is migrating to Obelisk Passport v2, VaultSpark Studios' unified identity plane. The current implementation uses OpenID Connect authorization code flow with Proof Key for Code Exchange (PKCE), exact relying-party origins, scoped tokens, and asymmetric signature verification.
Auth receipts
Not connected
No receipt-store connection is present in this environment.
Chain head
No receipt yet
Appears after the first recorded event.
What v2 changes
- • Authorization codes replace session tokens in callback URLs.
- • PKCE binds every code exchange to the initiating browser.
- • The backend accepts ES256 tokens for StatVault's exact audience.
- • Logout revokes the refresh token before ending the shared session.
Migration honesty
Before activation, StatVault still stores one-way password hashes for legacy accounts. It does not claim otherwise. After the registered client is enabled, local sign-up, login, reset, refresh, and password APIs fail closed by default. Rollback is a named, temporary operator action—not an invisible second login.
Related: Merkle history · Trust pulse · Security