docs: redesign agent identity modes

[pando85]

Summary

Define a coherent redesign of the Passless agent feature around two explicit identity modes that share one daemon WebAuthn pipeline:

• same-user: a fully trusted agent uses the existing human passkeys and backend.
• isolated: an agent uses a separate credential namespace and revocation lifecycle.

Autonomy is modeled as operation policy rather than credential ownership. Either mode can be autonomous, supervised, denied, or mixed by RP and action.

What changed

• Add ADR 0007, which defines:
  • the same-user and isolated trust boundaries;
  • a complete CredentialBackendHandle selected as one storage/provider/verification/lock unit;
  • short-lived agent sessions with one-shot WebAuthn operation intents;
  • independent authorization, user-presence, and user-verification providers;
  • fully autonomous agent UP/UV and optional human approval/PIN forwarding;
  • shared authentication and registration services;
  • credential discovery and deterministic selection;
  • extension, origin, audit, and replay-security invariants.
• Add a phased implementation plan with module boundaries, migration strategy, proposed PR sequence, rollout gates, and definition of done.
• Add a detailed verification matrix covering configuration, backend isolation, sessions, replay, UP/UV, authentication, registration, browser behavior, TPM, audit, and real-RP E2E scenarios.

Core decision

In an explicitly configured autonomous profile, Passless treats the bound agent session as the authenticator user. This allows the daemon to satisfy RP-required UP and UV without ceremony-time human interaction. It is not represented as human PIN or biometric verification: audit records must identify agent-derived evidence, although the RP sees ordinary WebAuthn flags and cannot distinguish the evidence source.

Human approval and human PIN/platform verification remain available by configuration. The human secret never crosses into the agent or browser.

Why

The merged implementation has the browser extension and daemon endpoints, but it currently has no same-user mode and does not yet provide safe shared-backend semantics:

• human backend inputs are not used by the agent runtime;
• sign/register handlers use profile storage and a hardcoded software provider;
• UV can be derived from the request rather than resolved evidence;
• grants are reusable rather than ceremony-one-shot;
• registration/authentication and origin/browser semantics remain incomplete.

Restoring the old UHID delegated-session path or pointing isolated storage at the human path would preserve the wrong architecture.

Impact

This PR changes documentation only. Runtime implementation remains gated for future PRs. Ordinary human behavior and current isolated runtime behavior are unchanged.

Validation

• Reviewed the proposal against the current master implementation at 06722884.
• Cross-checked the UV and authenticator-data requirements against WebAuthn Level 3.
• Verified the branch is three commits ahead of master and changes only the three ADR/plan documents.

Follow-up implementation order

1. Configuration and backend abstraction.
2. Short-lived sessions and one-shot operation state.
3. Agent/human evidence providers.
4. Unified authentication, migrating isolated first.
5. Same-user authentication.
6. Unified registration.
7. Origin and browser lifecycle correctness.
8. Portable-TPM and real-RP release gates.
9. Documentation migration and old-path cleanup.