feat(access): replace password discovery with access tokens

.gitattributes

@@ -1,5 +1,7 @@
-fixtures/metaserver-directory-v1.json text eol=lf
-fixtures/metaserver-directory-v1/* text eol=lf
+fixtures/metaserver-directory-v2.json text eol=lf
+fixtures/metaserver-directory-v2/* text eol=lf
+fixtures/access-resolve-v1/*.json text eol=lf
+fixtures/access-resolve-v1/*.der binary
 
 # Large binary assets use Git LFS.
 *.png filter=lfs diff=lfs merge=lfs -text

Cargo.toml

@@ -25,7 +25,7 @@ atrinik-actions = { path = "crates/atrinik-actions", version = "=0.1.0" }
 atrinik-config-cache = { path = "crates/atrinik-config-cache", version = "=0.1.0" }
 atrinik-directory = { path = "crates/atrinik-directory", version = "=0.1.0" }
 atrinik-platform = { path = "crates/atrinik-platform", version = "=0.1.0" }
-atrinik-protocol = "=0.1.0"
+atrinik-protocol = "=0.2.0"
 atrinik-protocol-adapter = { path = "crates/atrinik-protocol-adapter", version = "=0.1.0" }
 atrinik-scene-adapter = { path = "crates/atrinik-scene-adapter", version = "=0.1.0" }
 atrinik-session = { path = "crates/atrinik-session", version = "=0.1.0" }
@@ -35,6 +35,8 @@ httpdate = "1.0.3"
 sdl3 = { version = "0.20.0", default-features = false, features = ["build-from-source-static"] }
 sha2 = "0.11.0"
 ureq = { version = "3.4.0", default-features = false, features = ["gzip", "rustls"] }
+x509-cert = { version = "0.3.0", default-features = false, features = ["std"] }
+zeroize = "1.9.0"
 
 [workspace.lints.rust]
 unsafe_code = "deny"

PROVENANCE.md

@@ -41,6 +41,19 @@ interoperability facts. No protocol implementation, classic source, or
 historical client code was copied. The language-neutral fixture manifest is
 retained byte-for-byte and independently digest-pinned.
 
+The directory-v2, access-resolution, GP1 access-policy, and certificate trust
+consumers are newly authored from the public MIT `atrinik/protocol` access-token
+candidate fixture revision `1584053ee5f5bb1d96b59ff85f4035579bc17617` and
+the service-origin clarification at
+`b7c8d22ed9acd53bf31818bca5eda10a6f51d3e2`. The relevant normative
+specification has SHA-256
+`1f09123f8432b6bbfb0bfed35ebe7e00df9dbe822e5126cd363f8c681553d872`.
+The shared client access-offer validator is consumed from reviewed protocol
+candidate revision `e48902dc3cb7051e589c48fdb448af3433c12ac6`.
+Generated Rust bindings remain an external dependency and require an immutable
+published `atrinik-protocol` 0.2.0 release before pull-request readiness; no
+protocol implementation or historical client source was copied.
+
 `provenance/identity-reference.synthetic.json` demonstrates the canonical
 privacy-preserving identity reference workflow for issue #386. It is newly
 reviewer-signed synthetic evidence only: it grants no permission for real

SECURITY.md

@@ -9,6 +9,12 @@ media types are bounded before commit. Server-selected executable formats,
 plugins, shaders, and native libraries are forbidden. Credentials, trust,
 settings, layout, cache, logs, screenshots, and crashes never share a root.
 
+Access codes and their derived route capabilities, nonces, one-use grants, and
+private resolve bodies are ephemeral connection-attempt state. They are never
+placed in URLs, caches, logs, diagnostics, or serialized client models. Secret
+types omit printing and serialization traits, and owned buffers are cleared on
+drop as a best-effort reduction of their process-memory lifetime.
+
 The session remains server-authority preserving: local intent cannot claim
 gameplay success, hidden state is not reconstructed, and malformed/stale input
 cannot partially mutate the visible snapshot.

THIRD_PARTY_NOTICES.md

@@ -10,6 +10,8 @@ Resolved versions are recorded only in `Cargo.lock`.
 | `sdl3` | SDL 3.4.18 | `MIT AND Zlib` | https://crates.io/crates/sdl3 |
 | `sha2` | none | `MIT OR Apache-2.0` | https://crates.io/crates/sha2 |
 | `ureq` | none | `MIT OR Apache-2.0` | https://crates.io/crates/ureq |
+| `x509-cert` | none | `Apache-2.0 OR MIT` | https://crates.io/crates/x509-cert |
+| `zeroize` | none | `Apache-2.0 OR MIT` | https://crates.io/crates/zeroize |
 
 Cargo.lock and each release SBOM contain the complete transitive graph. Bundled
 authored assets: none. This summary does not replace upstream license texts.

crates/atrinik-directory/Cargo.toml

@@ -7,10 +7,12 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
+atrinik-protocol.workspace = true
 atrinik-protocol-adapter.workspace = true
 httpdate.workspace = true
 sha2.workspace = true
 ureq.workspace = true
+zeroize.workspace = true
 
 [lints]
 workspace = true