DICC CLUSTER: eyedbase-web :1700 | docs :1701
Account Authority: [email protected] (Port 5560) | 0% TrueNAS (TNSB-001)
Eyedbase Logo
EYEDBASE ENCLAVE
Zero-Trust Identity Provider & Cryptographic Enclave
SOVEREIGN IDENTITY SUBSTRATE • FIDO2 PASSSKEYS

Zero-Trust Identity Provider
& Cryptographic Enclave for the AI Stack

Hardware-bound WebAuthn passkeys, sub-150ms biometric verification, and centralized OIDC 2.0 federation across autonomous agent fleets. Zero shared secrets in transit.

Explore Passkey Sandbox
Enclave State
Active (Live)
WebAuthn / FIDO2 Enclave
Assertion Latency SLA
0.142 ms
Sub-150ms Target Verified
Session Lease Boundary
300s TTL
Fail-Closed Eviction
Storage Compliance
0% TrueNAS
TNSB-001 Local NVMe Validated
FIDO2 / WEBAUTHN DEMONSTRATION

Interactive Cryptographic Enclave Ceremony

Experience asymmetric biometric key derivation in real-time. Secrets never traverse the network or land in backend databases.

4-Step Ceremonial Flow

READY FOR ASSERTION
1

Challenge Issued

32-byte cryptographic random nonce generated by Relying Party (eyedbase.com).

2

Biometrics Attested

Touch ID / YubiKey / Windows Hello TPM attestation completes locally in hardware enclave.

3

Key Enclave Derived

Asymmetric assertion signature verified using COSE algorithms (-7 ES256 / -8 EdDSA / -257 RS256).

4

Token Minted & Dual-Written

JWT issued with 300s TTL. Dual-writes to __WIDGET_CONFIG__ & __SK_CONFIG__ (DFG-001).

Real-Time JWT Claims Inspector

Algorithm: ES256 (-7)
{ "iss": "https://eyedbase.com/realms/ai-stack", "sub": "usr_sec_enclave_7f901bca28014e", "aud": "eyedbase-ai-stack-2026-v1", "accountAuthority": "[email protected]", "amr": [ "fido2", "user_presence", "user_verification", "hardware_enclave" ], "authenticator": "Apple Secure Enclave (Touch ID)", "cose_alg": -7, "iat": 1727140000, "exp": 1727140300, "ttl_remaining_sec": 300, "scopes": [ "openid", "profile", "uow:workplan:execute", "fleet:process:contain", "dipp:evidence:write" ], "dualWriteTarget": { "canonical": "window.__WIDGET_CONFIG__", "legacy": "window.__SK_CONFIG__" }, "storageIntegrity": { "applianceStorage": "0% TrueNAS / QNAP (TNSB-001 Compliant)", "prodDatastore": "LINDEBPSGPRD501 / 13.NVME_CRUCIAL_3.64TB_00" } }
✓ Signature Verified: Sub-150ms SLA Passed (0.142ms) RFC 7519 Compliant
CENTRALIZED IDENTITY FEDERATION (ASPB-001)

Multi-Agent AI Stack Portfolio Integration

Eyedbase provides sovereign, zero-trust token issuance across the five core autonomous fleet domains.

Autonomous Fleet Domain Production Canonical URL Audience URN Discrete Authorized Scopes Status
Mechscrum (Workplan & UoW) mechscrum.com urn:sk:audience:devops-control-plane uow:workplan:execute, uow:lease:acquire FEDERATED
Fleetboots (Process Control & DICC) fleetboots.com urn:sk:audience:fleet-manager fleet:process:contain, dicc:task:launch FEDERATED
EyeParity (Visual QA & Parity) eyeparity.com https://api.eyeparity.com eyeparity:proof:publish, dipp:evidence:write SCOPED
MailGenie (Outreach Delivery Engine) mailgenie.com https://api.mailgenie.com mailgenie:campaign:dispatch SCOPED
Memboots (Long-Term Memory Enclave) memboots.com https://api.memboots.com memboots:memory:store, memboots:memory:search FEDERATED
ENGINEERING INTEGRITY & GOVERNANCE

Four Foundational Pillars

Engineered to eliminate single points of failure, credential harvesting, and cross-tenant pollution.

🔒

Zero Shared Secrets

Passkeys rely exclusively on public-key cryptography. Raw biometrics and passwords never traverse the wire or land in databases.

⚡

Dual-Write Parity (DFG-001)

Synchronous population of canonical __WIDGET_CONFIG__ and legacy __SK_CONFIG__ eliminates cross-fleet breakages.

⏱️

Fail-Closed 300s Leases

Strict 300-second session TTL ceilings guarantee prompt session invalidation and instantaneous token revocation.

🛡️

0% TrueNAS Storage (TNSB-001)

Databases reside on dedicated local NVMe PCIe datastores (LINDEBPSGPRD501 (172.16.31.181:5432)). Zero TrueNAS/QNAP appliance usage.

SDK INTEGRATION

Developer Quickstart in 3 Minutes

Add sovereign zero-trust passkey authentication to any client or server workload.

Step 1: Install the canonical client library

npm install @eyedbase/auth-client

Step 2: Initialize the authentication enclave and dual-write widget configuration

import { createAuthHook, setupWidgetAuth } from '@eyedbase/auth-client'; // 1. Initialize client hook pointing to canonical Eyedbase issuer const auth = createAuthHook({ issuer: 'https://eyedbase.com', clientId: 'mechscrum-orchestrator', redirectUri: 'https://mechscrum.com/callback' }); // 2. Perform WebAuthn biometric passkey assertion ceremony const token = await auth.loginWithPasskey(); // 3. Dual-write to canonical and legacy configurations (DFG-001) setupWidgetAuth(token); // window.__WIDGET_CONFIG__ = { widgetAccessToken: token }; // window.__SK_CONFIG__ = { widgetAccessToken: token };
PROD CONSOLE Eyedbase Sovereign Enclave
Database: LINDEBPSGPRD501 (172.16.31.181:5432) • 0% TrueNAS Storage (TNSB-001) • Mode: High-Availability Enclave
Active User Sessions
42 Active
Strict 300s Enclave Leases
M2M Service Principals
6 Authorized
Non-Wildcard Scopes Enforced
Enrolled Hardware Passkeys
128 Keys
COSE -7 / -8 / -257 Enclaves
Account Authority
[email protected]
Port 5560 Binding Verified
DEV CONSOLE Eyedbase Development Enclave
Database: LINDEBPSGDEV501 (172.16.31.180:5432) • Isolated Sandbox • Stage Test Telemetry

Development Sandbox Status

Development sessions operate on an isolated database socket to prevent cross-environment pollution with production. All token issuance in this environment is labeled stage-dev with mocked WebAuthn credentials for automated testing.

Eyedbase Architecture & Identity Foundation

Eyedbase serves as the authoritative Centralized Identity Provider and Zero-Trust Authentication Enclave for the SpreadKnowledge AI stack portfolio. It is designed to eliminate passwords, prevent credential harvesting, and provide deterministic machine-to-machine (M2M) authorization across autonomous agent swarms.

Core Architectural Commitments

1. Asymmetric Cryptography: Eyedbase strictly rejects passwords. Every human credential uses FIDO2 WebAuthn asymmetric public-key cryptography bound to hardware security enclaves.

2. Dual-Write Compatibility (DFG-001): During the enterprise transition from legacy architectures to the unified SPA shell, authentication helpers dual-write to both window.__WIDGET_CONFIG__ and window.__SK_CONFIG__.

3. Fail-Closed Session Leases: Downstream APIs enforce 300-second maximum token lifetimes. Revoked credentials fail closed immediately.

4. Zero TrueNAS Storage (TNSB-001): All database backings run on dedicated physical ESXi NVMe block storage (LINDEBPSGPRD501 (172.16.31.181:5432)). TrueNAS and QNAP appliances are 100% prohibited.

OIDC Discovery Endpoints

GET https://eyedbase.com/.well-known/openid-configuration GET https://eyedbase.com/realms/ai-stack/protocol/openid-connect/certs POST https://eyedbase.com/realms/ai-stack/protocol/openid-connect/token