Implement Guardian identity + device trust foundations with fail-closed security fallbacks

[Copilot]

Summary

Implements the P1 foundation gaps called out in the Genesis IRP review by adding concrete Identity and Device Trust service layers and wiring them into Guardian startup. Also adds P2 fail-closed behavior for auth/vault failure paths so security-critical failures degrade safely.

• Identity Service (IdentityService.kt)

  • Adds core models: User, UserRole, Credential, AuthSession
  • Implements provisioning, credential create/rotate/revoke, and session validate/revoke
  • Uses PBKDF2-based credential hashing and vault-backed credential reference storage
  • Includes production hardening TODOs (MFA/biometric enrollment, immutable audit trails, hardware key wrapping)

• Device Trust Engine (DeviceTrustEngine.kt)

  • Adds trust signal model (malwareRisk, anomalyScore, networkRisk, attestationPassed)
  • Implements weighted trust scoring and thresholded decisions
  • Introduces TrustDecision + enforcement actions (FULL_ACCESS, RESTRICTED_MODE, MINIMAL_IU, DENY_ACCESS)
  • Adds attestation integration stub with explicit TODOs for Play Integrity/SafetyNet + GDPR telemetry boundaries

• Guardian fail-closed integration (GuardianService.kt)

  • Boots and wires Identity + Device Trust services into Guardian lifecycle
  • Publishes security events on critical failures via SecurityRepository.publishEvent(...)
  • Enforces fail-closed admin behavior when auth is unavailable or vault state is unsafe
  • Blocks protected flows when trust policy denies access

• Policy + build wiring

  • Extends system/security/guardian/policy/policies.json with trust thresholds and minimal-IU enforcement policy
  • Updates Guardian Make build inputs to compile new identity/ and trust/ Kotlin sources

val trustDecision = deviceTrustEngine.evaluateTrust(
    deviceId = DEFAULT_DEVICE_ID,
    signal = TrustSignal(
        malwareRisk = if (malwareDetected) 90 else 10,
        anomalyScore = if (anomalyDetected) 80 else 15,
        networkRisk = if (networkThreatDetected) 75 else 10,
        attestationPassed = attestationPassed
    )
)

Type

• feat
• fix
• docs
• ci
• security
• chore

Validation

• dotnet build / dotnet test locally or CI green
• OpenAPI updated if HTTP surface changed
• No secrets in diff
• Migrations synced across irp / infrastructure / installer init (if SQL changed)

Risk

• Low
• Medium
• High — describe rollback

Checklist

• Linked issue (if any)
• Docs updated

[AcingTime420]

Superseded by #40, which reconstructs the unique identity/device-trust changes on the current validated master branch, resolves the obsolete-branch conflicts, and runs the full modern CI/security/SBOM gate set.