Citizen Multi-device SSO (HMI)

Objective

Define one identity experience for citizens, collaborators, and internal teams across PC, notebook, tablet, smartphone, and gadgets, while preserving human-decision traceability (HILT) and auditable evidence.

Adopted architecture decision

Option A (self-hosted OIDC broker) is the baseline:

1. Central self-hosted IdP (for example Keycloak) as identity broker.
2. oauth2-proxy as the web access gateway for governed apps.
3. Claims by role + audience + device + risk to route portal views.
4. Mandatory HILT for high|critical risk levels.

HMI map by device

Code	Device	Recommended flow
D1	Personal smartphone	OIDC + MFA + compact mobile directives
D2	Institutional laptop	OIDC + MFA + documentary evidence
D3	Technical workstation	OIDC + least privilege + hardening
D4	Local server/cluster	Bastion + federated OIDC + runtime traces
D5	Cloud infrastructure	Federated IAM + centralized audit
D6	Classroom tablet/device	MDM + guided onboarding + managed profiles

Governance matrix by role

Canonical source files:

1. knowledge/datasets/citizen-role-device-risk-matrix.tsv
2. knowledge/datasets/citizen-device-taxonomy.tsv
3. knowledge/datasets/citizen-evidence-catalog.tsv
4. knowledge/datasets/citizen-hmi-ux-contract.tsv
5. knowledge/datasets/citizen-repo-permission-routing.tsv

Local-first validation:

python3 scripts/verify/citizen_role_device_risk_guard.py
python3 scripts/verify/citizen_hmi_ux_guard.py
python3 scripts/verify/citizen_repo_permission_routing_guard.py

UXUI contract by actor and device

citizen-hmi-ux-contract.tsv defines, for every role + device pair:

1. HMI surface (mobile_web, desktop_web, workstation_console, bastion_cli, tablet_classroom).
2. Navigation mode (guided, taskboard, evidence-first, ops-first, narrative).
3. Content density and accessibility profile (WCAG/keyboard/screen-reader).
4. Authentication friction by risk (silent-sso, mfa, step-up-mfa).
5. HILT prompt style for high|critical risk operations.

This turns UX from subjective preference into a GitOps-governed, auditable contract.

Repository permission routing (same URL entrypoint)

The portal routes from the same URL using the permission claim:

Permission	Default destination
read	portal/institutional-onboarding/
write	portal/github-collaboration-hub/
maintainer	portal/tech-people-context-steward-quickstart/
admin	portal/human-decision-protocol/ (or personal VDI if claim is present)
owner	Personal VDI (atq_vdi_url or fallback /vdi/<username>/)

Outcome: one entrypoint with adaptive routing by permission + role + device + risk.

Onboarding integration

The onboarding wizard now captures:

1. Initial citizen role.
2. Primary device (D1..D6).
3. Citizen SSO preference.

This enables day-1 personalization of route, narrative, and controls.

Guardrails

1. No decision closure without evidence_codes.
2. high|critical risk requires explicit HILT.
3. Experience router never grants privilege by default.
4. Every role/device change must be traceable in issue/PR evidence.

Proprietary CLI Framework (Human-first Operations)

Canonical entrypoint to translate the SSO contract into human-readable CLI operations:

scripts/proxmox/device_sso_cli_framework.sh (ATQ-CLI-SSO-DEVICE-V1)

Capabilities:

1. Audience narrative (ops|exec|legal|onboarding).
2. Language mode colloquial|technical.
3. Explicit professional contexts: public-admin, education-center, vocational-student.
4. ASCII mindmap for layers/hops and Linux process-management coaching.
5. OEM + overlay profiles through HOSTPROXMOX gateway and mesh-node registration for decentralized community compute.

Quick example:

bash scripts/proxmox/device_sso_cli_framework.sh describe \
  --audience onboarding \
  --professional-context public-admin \
  --language colloquial

Mesh node registration example:

bash scripts/proxmox/device_sso_cli_framework.sh mesh \
  --audience ops \
  --mesh-profile mesh-laptop-collab \
  --write-mesh