Community identity / trusted handoff
GitHub sign-in remains centralized at Hara Identity. World exchanges a short-lived, PKCE-bound code for its own host-only session before it accepts a profile proposal.
Central identity
The shared account control is reading the central GitHub-backed Hara session.
id.hara-lang.orgWorld session
World is checking for its audience-bound local session.
Git-reviewed profile
Your stable GitHub ID, current login, reviewed roles, and existing verified links are supplied server-side. The form cannot override them.
The browser carries only a short-lived authorization code bound to a PKCE verifier. World exchanges it directly with Identity.
World signs its own two-hour host-only cookie. It never receives the central Identity session-signing secret.
Profile edits create draft pull requests through a narrowly scoped GitHub App. Merge remains the publication event.
A GitHub identity is not automatically linked to a newsletter email or to package-publishing authority.