ADR-031: The User

Date: 2026-08-18 Status: Stub — the statements below are made. Nothing beyond them is decided.

Statements

• A User is a human being.
• A User's id is an ASUID under the US prefix (ADR-010). The name segment is a snapshot taken at minting; the random suffix is what makes it unique, so renaming does not re-identify anyone.
• A User holds keys and accounts. laye mints a key per browser, an authenticator derives one per device, and a provider names an account its own way. A User holds several of each, so none of them is the User.
• A User has a first name, a last name, any number of email addresses, and any number of phone numbers.
• auth.root_identities lists ways to reach a User, not Users (ADR-030).
• There is one ROOT User. A SUPER User is created by it and by nobody else (ADR-027).
• The first User to prove they hold a root identity is the first User, and the first User is always the ROOT User. Proving a listed route is what creates them — there is no separate act, and nothing has to be seeded ahead of it.
• Every User has provenance: the record names the User that created it, whatever the level. The ROOT User is to name the node that signed its first admission — a node is the one thing that exists before any User does.
• A User carries the signed binding for each account it holds. Storing a binding is not storing a verdict — the binding names its own signer, and auth.binding_signers is asked about that signer every time it is used, so striking a signer out still reaches bindings already written down.
• A User is enabled or disabled, and a disabled User still exists. ROOT or SUPER disables one and enables it again. Data never leaves, and a person is not an exception.
• A disabled User cannot log in, and what they minted stops with them — a token speaks for whoever minted it (ADR-025), so it is disabled by the same switch.
• That switch is why revoking a person is one act. Striking a route out of auth.root_identities closes one way in, and a User holds several; disabling the User is the person, not the door.
• A User reaches namespaces through permission, and permission is a relation.
• Only a SUPER User owns namespaces.
• Ownership is recorded on the namespace, not on the User. The namespace's own record is what refuses a second create; a list on the User would be a second answer.
• A User record lives in system, where the token objects already are (ADR-027).
• No User is visible below SUPER, because system is not (ADR-026). An ATTESTOR sees no User record: not another's, and not their own. There is no directory of people at that level. What an ATTESTOR sees inside a namespace is what signed something, and by is the signer (ADR-026) — never the person behind it.

The name

A User has a display_name, and it is a name rather than half a login. Not unique, never asked for at a door, no password beside it. What identifies a User is a key they hold or an account they proved.

"display_name of root cannot be changed anymore when set"

"if display_name of root is unset, it becomes root"

"regardless of root_identity setting it or not, root is never an available display name except for the one root identity user, they dont need to set their display name as root"

So the ROOT User is root from the moment they exist, without choosing it, and root is the one name no other User may take.

What is recorded

A User is one object per person under <location>/system/users/ on the parquet backend, holding an id, a display_name, any number of emails, the level, the keys it holds and the accounts that reach it. A sqlite deployment keeps none, the way it keeps no tokens.

POST /auth/user/arrive is where a person says a name and an email, and requires neither. The name is settled once; an email that arrives later is added rather than refused, because a User has any number of them.

You claim the ROOT User by proving you own a root identity. It happens once and cannot happen again, so it is attested as node:claimed. Recording never fails the thing it records (ADR-030), which makes this the one attestation whose loss cannot be made up later.

Not done

A User holds no last name and no phone number.

A User reaches namespaces through permission, and nothing records which yet.

A namespace's owner is a string, and so is a credential's admitted_as.

created_by is empty on ROOT. The node that signed the first admission is written down — node:claimed names it — but on the attestation rather than on the User, so the provenance is a record to go and find instead of a field to read.

system holds the User records, and only the parquet backend has namespaces at all (ADR-026, "Not done") — so on SQLite there is nowhere for them to go yet.