feat(keystone): add persistent user identity and access

Cargo.toml

@@ -1,17 +1,21 @@
 [workspace]
 # The 12 Robonix system components live one-per-directory under `system/`.
-# Four currently have a Rust implementation:
+# Rust implementations currently included in the workspace:
 #   - atlas    (capability discovery)
 #   - executor (capability orchestration; embeds sentinel for v0.1)
+#   - keystone (user identity and access-control core)
 #   - liaison  (human-machine interaction)
 #   - pilot    (planning + decision + memory + world model)
+#   - scribe   (logging facade)
+#   - soma     (body model and package bring-up)
 # Repo-side dev tooling lives under `tools/` (rbnx CLI + codegen).
 # Python-only system components (scene) and reference service implementations
 # (services/{memsearch,voiceprint,speech}) are managed by uv and not part of
 # this Cargo workspace.
 members = [
     "system/atlas",
     "system/executor",
+    "system/keystone",
     "system/liaison",
     "system/pilot",
     "system/scribe",
@@ -60,6 +64,12 @@ protoc-bin-vendored = "3.2"
 # UUID
 uuid = { version = "1", features = ["v4"] }
 
+# Identity persistence and authentication
+argon2 = "0.5"
+base64 = "0.22"
+rand = "0.9"
+rusqlite = { version = "0.37", features = ["bundled"] }
+
 # OpenAI-compatible VLM client
 async-openai = "0.34.0"
 

Makefile

@@ -7,7 +7,7 @@
 # managed by uv from this same root.
 
 .PHONY: help build release install clean fmt check pyrightconfig \
-        build-atlas build-pilot build-executor build-liaison build-soma build-vitals
+        build-atlas build-pilot build-executor build-keystone build-liaison build-soma build-vitals
 .DEFAULT_GOAL := help
 
 BUILD_MODE ?= debug
@@ -22,6 +22,7 @@ help:
 	@echo "    make build-atlas     - Install robonix-atlas to ~/.cargo/bin"
 	@echo "    make build-pilot     - Install robonix-pilot to ~/.cargo/bin"
 	@echo "    make build-executor  - Install robonix-executor to ~/.cargo/bin"
+	@echo "    make build-keystone - Install robonix-keystone to ~/.cargo/bin"
 	@echo "    make build-liaison   - Install robonix-liaison to ~/.cargo/bin"
 	@echo "    make build-soma      - Install robonix-soma to ~/.cargo/bin"
 	@echo "    make build-vitals    - Install robonix-vitals to ~/.cargo/bin"
@@ -51,6 +52,9 @@ build-pilot:
 build-executor:
 	cargo install --force --path system/executor --bin robonix-executor $(CARGO_FLAGS)
 
+build-keystone:
+	cargo install --force --path system/keystone --bin robonix-keystone $(CARGO_FLAGS)
+
 build-liaison:
 	cargo install --force --path system/liaison  --bin robonix-liaison  $(CARGO_FLAGS)
 
@@ -72,6 +76,7 @@ install:
 	cargo install --force --path system/atlas    --bin robonix-atlas    $(CARGO_FLAGS)
 	cargo install --force --path system/pilot    --bin robonix-pilot    $(CARGO_FLAGS)
 	cargo install --force --path system/executor --bin robonix-executor $(CARGO_FLAGS)
+	cargo install --force --path system/keystone --bin robonix-keystone $(CARGO_FLAGS)
 	cargo install --force --path system/liaison  --bin robonix-liaison  $(CARGO_FLAGS)
 	cargo install --force --path system/soma     --bin robonix-soma     $(CARGO_FLAGS)
 	cargo install --force --path system/vitals   --bin robonix-vitals   $(CARGO_FLAGS)

capabilities/lib/keystone/msg/User.msg

@@ -0,0 +1,11 @@
+string user_id
+string username
+string display_name
+string email
+bool enabled
+string[] roles
+bool voice_guard_enabled
+bool voiceprint_enrolled
+bool password_change_required
+uint64 created_at_ms
+uint64 updated_at_ms

capabilities/lib/keystone/srv/AdminDeleteUser.srv

@@ -0,0 +1,3 @@
+string session_token
+string target_user_id
+---

capabilities/lib/keystone/srv/AdminResetVoiceprint.srv

@@ -0,0 +1,4 @@
+string session_token
+string target_user_id
+---
+keystone/User user

capabilities/lib/keystone/srv/AdminUpdateUser.srv

@@ -0,0 +1,7 @@
+string session_token
+string target_user_id
+bool enabled
+string[] roles
+bool voice_guard_enabled
+---
+keystone/User user

capabilities/lib/keystone/srv/ChangePassword.srv

@@ -0,0 +1,4 @@
+string session_token
+string current_password
+string new_password
+---

capabilities/lib/keystone/srv/GetProfile.srv

@@ -0,0 +1,3 @@
+string session_token
+---
+keystone/User user

capabilities/lib/keystone/srv/GetSystemConfig.srv

@@ -0,0 +1,3 @@
+string session_token
+---
+bool signup_enabled

capabilities/lib/keystone/srv/GetVoiceprintPreview.srv

@@ -0,0 +1,6 @@
+string session_token
+---
+bool available
+uint8[] audio_data
+uint32 sample_rate_hz
+uint64 updated_at_ms

capabilities/lib/keystone/srv/ListUsers.srv

@@ -0,0 +1,3 @@
+string session_token
+---
+keystone/User[] users

capabilities/lib/keystone/srv/Login.srv

@@ -0,0 +1,6 @@
+string username
+string password
+---
+string session_token
+uint64 expires_at_ms
+keystone/User user

capabilities/lib/keystone/srv/Logout.srv

@@ -0,0 +1,2 @@
+string session_token
+---

capabilities/lib/keystone/srv/Register.srv

@@ -0,0 +1,8 @@
+string username
+string display_name
+string email
+string password
+---
+string session_token
+uint64 expires_at_ms
+keystone/User user

capabilities/lib/keystone/srv/ReplaceVoiceprint.srv

@@ -0,0 +1,6 @@
+string session_token
+uint8[] audio_data
+uint32 sample_rate_hz
+string voiceprint_provider_id
+---
+keystone/User user

capabilities/lib/keystone/srv/UnbindVoiceprint.srv

@@ -0,0 +1,3 @@
+string session_token
+---
+keystone/User user

capabilities/lib/keystone/srv/UpdateProfile.srv

@@ -0,0 +1,5 @@
+string session_token
+string display_name
+string email
+---
+keystone/User user

capabilities/lib/keystone/srv/UpdateSystemConfig.srv

@@ -0,0 +1,4 @@
+string session_token
+bool signup_enabled
+---
+bool signup_enabled

capabilities/lib/keystone/srv/VerifyVoice.srv

@@ -0,0 +1,7 @@
+string session_token
+string external_subject_id
+float32 confidence
+float32 minimum_confidence
+---
+keystone/User user
+bool verified

capabilities/lib/liaison/srv/SetHandsfree.srv

@@ -2,6 +2,7 @@
 bool enabled
 string mic_provider_id
 string speaker_provider_id
+string session_token           # Keystone login session that owns hands-free turns
 ---
 bool ok
 bool enabled

capabilities/lib/liaison/srv/StartVoiceSession.srv

@@ -11,5 +11,6 @@ string  voiceprint_node_id      # ""
 string  tts_node_id             # ""
 string  speaker_node_id         # ""
 string  context_json            # extra fields merged into Task.context_json
+string  session_token           # opaque Keystone login session; never forwarded to Pilot
 ---
 liaison/VoiceEvent event        # streamed

capabilities/lifecycle/driver.v1.toml

@@ -0,0 +1,17 @@
+# Shared lifecycle interface implemented by every managed provider.
+# Providers keep their own provider_id and namespace; this contract is shared
+# so package authors do not need to duplicate an identical driver TOML.
+# Package manifests normally omit Driver; current codegen and runtime select
+# this shared contract automatically. Explicit shared and legacy namespace
+# selections remain supported. Old generated artifacts may fall back only to
+# their exact namespace Driver. No package may declare both forms.
+[contract]
+id              = "robonix/lifecycle/driver"
+version         = "1"
+kind            = "service"
+idl             = "lifecycle/srv/Driver.srv"
+description     = "Initialize, activate, deactivate, or shut down a managed provider."
+cross_namespace = true
+
+[mode]
+type = "rpc"

capabilities/system/keystone/admin_delete_user.v1.toml

@@ -0,0 +1,9 @@
+[contract]
+id = "robonix/system/keystone/admin_delete_user"
+version = "1"
+kind = "service"
+idl = "keystone/srv/AdminDeleteUser.srv"
+description = "Delete a user account as an administrator."
+
+[mode]
+type = "rpc"