WIP: docs(adr): propose ADR-0006, a print station runs as its own identity (no person's sign-in) #36

2026-11-10T23:56:09Z

james.maes commented

2026-11-10 23:56:09 +00:00

Draft, documentation only: one new file, docs/adr/0006-print-station-identity.md. No code, no build input changes.

Why

The service prints with nobody at the computer but authenticates as the person who signed in on it, and renews that session every five minutes. Hosts are adopting automatic logoff after user inactivity (15 minutes without a real user action, 12 hours at most). A station has no user action to report, so it would stop 15 minutes after every sign-in, and inactivity logoff cannot be enabled while stations use people's sessions.

What the record proposes

A second authorization mode per server, station, beside the unchanged person mode:

enroll with a one-use station code (enroll-station --server URL, or a wizard choice) and no sign-in;
store the station's credential like the session file: DPAPI under the service account, in the server's directory, readable by SYSTEM and Administrators only; access tokens in memory only;
obtain short access tokens from the identity provider (client credentials for the station's service account) and send them as Authorization: Bearer with the existing device headers, on HTTP and on the socket upgrade;
reconnect the socket when the token changes (the path a rotated session token already takes);
on revocation stop printing and say "This station must be enrolled again"; never ask a person to sign in for a station.

It also lists the threat model rows that change with the implementation and the tests that must exist before it counts as implemented.

Depends on

The server contract in QRun-IO/qbit-printing#37 (docs/STATION-IDENTITY.md, printing extension 2.5.0), which is itself a draft. Implementation should not start until that contract is accepted. A signed release is required before any station can use it.

Gate

Not run: the change is one Markdown file and touches nothing build/Verify.ps1 builds or tests.

🤖 Generated with Claude Code

Draft, documentation only: one new file, `docs/adr/0006-print-station-identity.md`. No code, no build input changes. ## Why The service prints with nobody at the computer but authenticates as the person who signed in on it, and renews that session every five minutes. Hosts are adopting automatic logoff after user inactivity (15 minutes without a real user action, 12 hours at most). A station has no user action to report, so it would stop 15 minutes after every sign-in, and inactivity logoff cannot be enabled while stations use people's sessions. ## What the record proposes A second authorization mode per server, **station**, beside the unchanged **person** mode: - enroll with a one-use station code (`enroll-station --server URL`, or a wizard choice) and no sign-in; - store the station's credential like the session file: DPAPI under the service account, in the server's directory, readable by SYSTEM and Administrators only; access tokens in memory only; - obtain short access tokens from the identity provider (client credentials for the station's service account) and send them as `Authorization: Bearer` with the existing device headers, on HTTP and on the socket upgrade; - reconnect the socket when the token changes (the path a rotated session token already takes); - on revocation stop printing and say "This station must be enrolled again"; never ask a person to sign in for a station. It also lists the threat model rows that change with the implementation and the tests that must exist before it counts as implemented. ## Depends on The server contract in QRun-IO/qbit-printing#37 (`docs/STATION-IDENTITY.md`, printing extension 2.5.0), which is itself a draft. Implementation should not start until that contract is accepted. A signed release is required before any station can use it. ## Gate Not run: the change is one Markdown file and touches nothing `build/Verify.ps1` builds or tests. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 1 commit 2026-11-10 23:56:09 +00:00

docs(adr): propose ADR-0006, a print station runs as its own identity 281c4fba67

An unattended station authenticates today as the person who signed in on it
and renews that session every five minutes. Under automatic logoff after user
inactivity it would stop 15 minutes after every sign-in, and everything it
does is recorded as that person.

ADR-0006 proposes a second authorization mode per server: the station redeems
a one-use station enrollment code (no sign-in), stores the identity's
credential under the service account's DPAPI, obtains short access tokens from
the identity provider and sends them as a bearer credential with the existing
device headers. Person mode is unchanged. The record names the enrollment
paths, what is stored, the token rules, the failure behaviour, the threat
model rows and the tests that must exist before it counts as implemented.

Proposal only: no code, and the server contract it depends on is itself a
draft (qbit-printing docs/STATION-IDENTITY.md).

Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

This pull request is marked as a work in progress.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin docs/2.0-station-identity-20261110:docs/2.0-station-identity-20261110

git checkout docs/2.0-station-identity-20261110

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-print-agent#36