docs(auth): reconcile passkey classification with module catalog (HT-76)

[zaridan]

Summary

• specs/auth/agents-and-auth.md (2026-07-18) classified passkey login as a marketplace-only add-on. It predates the module catalog decision made the same day (specs/modules/catalog.md §1/§2.2, HT-66), which made passkey login core — permanently free security hygiene, distinct from paid Enterprise Auth (SAML/OIDC SSO, SCIM, 2FA policy).
• Flagged by CodeRabbit during review of PR docs(modules): reclassify KB and portal to paid, close 71-module gap audit (HT-75) #82 as out of scope there since it predates that PR.
• Reclassifies passkey throughout agents-and-auth.md (§1, §3.2, §11, Changelog): passkey is core, just not yet built — it lands as a second core auth provider on the existing §4 provider seam, wired the same way PasswordAuthProvider is, never through the marketplace path. Google SSO, magic-link, and SAML/enterprise SSO remain marketplace, unchanged.
• The agent_auth_identities provider-abstraction architecture is untouched — it already supports multiple core providers, not just marketplace ones, so no schema/migration change was needed.
• specs/modules/catalog.md and CHARTER.md were not touched — they already state the correct line.

Test plan

• Verified catalog.md §1/§2.2 and CHARTER.md free/paid line match the new wording in agents-and-auth.md
• Confirmed no other references to passkey-as-marketplace remain (grep -n -i passkey specs/auth/agents-and-auth.md)
• Human spec review (per repo convention: every substantive change gets real review before merge)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Clarified authentication-provider classifications, including passkeys (WebAuthn) as a core security capability.
  • Documented that passkey support is not included in the current increment.
  • Updated authentication identity guidance, scope details, status notes, and the changelog to reflect these clarifications.

[coderabbitai]

📝 Walkthrough

Walkthrough

The authentication specification updates its draft status and identity contract, classifies passkey/WebAuthn as a core provider not built in this increment, revises marketplace-provider examples and scope language, and records the change in the draft.6 changelog.

Changes

Auth provider specification

Layer / File(s)	Summary
Provider boundary and identity contract specs/auth/agents-and-auth.md	Updates the draft scope and documents passkey/WebAuthn as a core provider rather than a marketplace provider, including its identity-row behavior and examples.
Scope and changelog alignment specs/auth/agents-and-auth.md	Revises scope exclusions and adds the draft.6 changelog entry describing the passkey reclassification.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• Helpthread/helpthread#69: Establishes the core-versus-licensed-provider seam and identity model referenced by this specification update.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main doc change: reconciling passkey classification with the module catalog.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/ht-76-passkey-core-reconciliation

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@specs/auth/agents-and-auth.md`:
- Around line 3-8: Update the introductory contract description to consistently
use “Agent management” for human support-staff administration and
“Agent-management UX” for the modeled experience. Replace the existing “user
management” and “user-management UX” references, while preserving the
distinction between Agents and Assistants.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8eaf1a0f-3922-40cb-98d5-e1625a9e6d6b

📥 Commits

Reviewing files that changed from the base of the PR and between 071f715 and b4ebaa3.

📒 Files selected for processing (1)

• specs/auth/agents-and-auth.md

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Use “Agent management” terminology consistently.

“User management” and “user-management UX” are ambiguous here because this document describes human support staff. Rename these references to “Agent management” / “Agent-management UX” to preserve the repository’s vocabulary contract.

As per coding guidelines, human support staff must be referred to as “Agents” and AI actors as “Assistants”.

Proposed wording

- real per-Agent identity, login, and user management, replacing the single shared operator
+ real per-Agent identity, login, and Agent management, replacing the single shared operator
...
- (black-box observation only — never their source), rendered entirely in Helpthread's own
+ (black-box observation only — never their source), rendered entirely in Helpthread's own

Also replace “user-management UX” with “Agent-management UX” on Line 6.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@specs/auth/agents-and-auth.md` around lines 3 - 8, Update the introductory
contract description to consistently use “Agent management” for human
support-staff administration and “Agent-management UX” for the modeled
experience. Replace the existing “user management” and “user-management UX”
references, while preserving the distinction between Agents and Assistants.

Source: Coding guidelines