Workflows

These diagrams describe the canonical flows in abadge. Each one is implemented in code and exercised by tests; if a diagram and the implementation disagree, the implementation wins.

​

System overview

​

User authentication

​

Dashboard login

​

CLI device authorization

​

Social login (Google / GitHub)

​

Agent lifecycle

​

Agent registration

​

Agent enrollment (public key)

​

Agent session exchange

​

Agentic registration (auth.md anonymous → user-claimed)

An agent can self-register a placeholder personal account a human later claims via emailed OTP. The abu_ credential authenticates the personal account’s management surface only; it never reaches access.*.

​

Profile and item management

​

Zero-knowledge profile bootstrap

​

Creating a zero-knowledge item

​

Creating a server-managed item

​

Permission and access control

​

Grant permission

Capabilities are read and use; a grant targets either a single item or a whole profile (profile grants cover every item added later). Legacy read_ciphertext / reveal_plaintext / mount_env / mount_file are still accepted on the wire and map to read / use.

​

Full access decision flow

​

Environment injection (abadge run)

​

File mounting (abadge mount)

​

MCP tool execution