Give identity its due: native enrollment, honest deletion, and sign-in that stays home

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8
2026-08-24 18:55:38 -04:00
parent 5a0643357f
commit 4ec8bd94d9
25 changed files with 4713 additions and 407 deletions
@@ -59,9 +59,13 @@ declare -A OWNED=(

 # Handoffs that are correct despite naming an owned panel, with the reason.
 # Anything here must be justified, not merely tolerated.
+#
+# The Users entry is gone: fingerprint enrollment was the only thing sending
+# people to GNOME's Users panel, and Panama drives fprintd's EnrollStart itself
+# now, so the door has nothing behind it. fingerprint-contract pins the
+# inverse -- that the page does NOT open a GNOME panel.
 declare -A ALLOWED=(
-    ["OnlineAccountsPage.qml:online-accounts"]="adding an account requires GOA's own dialog"
-    ["UsersPage.qml:system-users"]="fingerprint enrollment requires fprintd's guided capture flow, and GNOME's Users panel carries the only good dialog for it"
+    ["OnlineAccountsPage.qml:online-accounts"]="OAuth sign-in (Google, Microsoft) runs inside libgoa-backend, which Fedora ships without a GIR binding, so the provider's own dialog is the only way to obtain the token; Nextcloud and IMAP are added on the page itself"
 )

 # The leaves: a tabless category is a page in its own right, and every tab is