Merge Authority
Isolation.

HMAC_KEY = HKDF-SHA256(masterSecret, salt="sentinel-oracle-v1", info=serverFingerprint)

function GenerateChallenge(prNumber: number, sessionId: string): Challenge {
  nonce = crypto.getRandomValues(new Uint8Array(32))   // 256-bit random
  payload = JSON.stringify({
    pr:     prNumber,
    nonce:  hex(nonce),
    sessionId,
    ttl:    Date.now() + 45_000,      // 45 second validity window
  })
  signature = HMAC-SHA256(HMAC_KEY, payload)
  return { payload, signature }
}

challengeId = SHA256(payload + signature).slice(0, 16)   // 8-byte challenge ID
qrPayload = JSON.stringify({
  v:     1,                              // protocol version
  cid:   challengeId,                     // challenge identifier
  sig:   hex(signature),                  // HMAC signature
  host:  "https://100.x.y.z:3443",        // oracle server Tailscale IP
})

// QR is displayed on the workstation dashboard as an HTML canvas QR code.
// The phone scans it via the device camera using a WebRTC-based QR scanner.

// On the phone, after scanning the QR:
assertion = await navigator.credentials.get({
  publicKey: {
    challenge:      new Uint8Array(challengeId),           // bound to challenge
    allowCredentials: [{ id: credentialId, type: "public-key" }],
    userVerification: "required",                          // forces biometric
    timeout:          40_000,                              // 40 second window
  }
})

// The assertion is sent to the oracle server:
POST https://100.x.y.z:3443/api/authorize
Content-Type: application/json

{
  "challengeId": "a1b2c3d4e5f6a7b8",
  "credentialId": hex(assertion.id),
  "authenticatorData": base64(assertion.response.authenticatorData),
  "clientDataJSON": base64(assertion.response.clientDataJSON),
  "signature": base64(assertion.response.signature),
  "prNumber": 42
}

function HandleAuthorize(req): MergeResult {
  // 1. Look up challenge by challengeId
  challenge = db.challenges.get(req.challengeId)
  if (!challenge)                return { error: "challenge not found" }
  if (challenge.consumed)         return { error: "challenge already used" }
  if (Date.now() > challenge.ttl) return { error: "challenge expired" }

  // 2. Verify HMAC integrity
  expected = HMAC-SHA256(HMAC_KEY, challenge.payload)
  if (!constantTimeEqual(expected, challenge.signature))
    return { error: "challenge integrity check failed" }

  // 3. Verify WebAuthn assertion
  assertionOk = VerifyWebAuthnAssertion(req.assertion, challengeId)
  if (!assertionOk) return { error: "WebAuthn assertion invalid" }

  // 4. Verify PR binding
  payload = JSON.parse(challenge.payload)
  if (payload.pr !== req.prNumber)
    return { error: "PR number mismatch" }

  // 5. Mark challenge consumed (atomic)
  db.challenges.markConsumed(challengeId)

  // 6. Execute GitHub merge
  result = github.mergePullRequest({
    owner:  config.ghOwner,
    repo:   config.ghRepo,
    prNumber: req.prNumber,
    mergeMethod: "squash",
  })

  return { success: true, mergeResult: result }
}

git clone https://github.com/javier20dev25/sentinel-oracle.git
cd sentinel-oracle
npm install
npm run build

# Create config file manually or let the server generate defaults on first run:
mkdir -p ~/.sentinel-oracle
cat > ~/.sentinel-oracle/config.json << 'EOF'

# Option A: PAT mode
{
  "githubToken": "github_pat_...",
  "githubOwner": "your-org",
  "githubRepo": "your-repo"
}

# Option B: GitHub App mode (recommended)
{
  "githubAppId": "123456",
  "githubInstallationId": "654321",
  "githubPrivateKeyPath": "/home/sentinel/.sentinel-oracle/key.pem",
  "githubOwner": "your-org",
  "githubRepo": "your-repo"
}
EOF

# Set secrets via environment variables (recommended):
export ORACLE_MASTER_SECRET="$(openssl rand -hex 32)"

npm start

# Server listens on https://100.x.y.z:3443
# Open in browser on your phone via Tailscale to register a passkey.

# /etc/systemd/system/sentinel-oracle.service
[Unit]
Description=Sentinel Oracle - Merge Authority Isolation Server
After=network-online.target tailscaled.service
Requires=tailscaled.service

[Service]
Type=simple
User=sentinel
Group=sentinel
WorkingDirectory=/opt/sentinel-oracle
Environment=NODE_ENV=production
Environment=GITHUB_TOKEN=ghp_xxxx...
Environment=ORACLE_MASTER_SECRET=$(cat /opt/sentinel-oracle/secret.key)
ExecStart=/usr/bin/node /opt/sentinel-oracle/dist/server.js
Restart=always
RestartSec=10
TimeoutStopSec=30

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now sentinel-oracle
sudo systemctl status sentinel-oracle

nssm install SentinelOracle "C:\Program Files\nodejs\node.exe"
nssm set SentinelOracle AppParameters "C:\sentinel-oracle\dist\server.js"
nssm set SentinelOracle AppDirectory "C:\sentinel-oracle"
nssm set SentinelOracle AppEnvironmentExtra NODE_ENV=production GITHUB_TOKEN=... ORACLE_MASTER_SECRET=...
nssm set SentinelOracle Start SERVICE_AUTO_START
nssm start SentinelOracle

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.sentinel.oracle</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/local/bin/node</string>
    <string>/opt/sentinel-oracle/dist/server.js</string>
  </array>
  <key>WorkingDirectory</key>
  <string>/opt/sentinel-oracle</string>
  <key>EnvironmentVariables</key>
  <dict>
    <key>NODE_ENV</key>
    <string>production</string>
    <key>GITHUB_TOKEN</key>
    <string>ghp_xxxx...</string>
    <key>ORACLE_MASTER_SECRET</key>
    <string>xxxx</string>
  </dict>
  <key>KeepAlive</key>
  <true/>
  <key>RunAtLoad</key>
  <true/>
</dict>
</plist>

# Install Termux from F-Droid (not Play Store)
pkg update && pkg upgrade
pkg install nodejs git tailscale

git clone https://github.com/javier20dev25/sentinel-oracle.git
cd sentinel-oracle
npm install && npm run build

# Keep the phone plugged in and the screen on
# Use termux-wake-lock to prevent CPU sleep

# On each device:
sudo tailscale up --authkey tskey-xxxx

# Verify all devices are visible:
tailscale status
#   100.1.2.3   workstation    linux   active; direct
#   100.1.2.4   phone-iphone   iOS     active; direct
#   100.1.2.5   oracle         linux   active; direct

# Test connectivity:
curl -k https://100.1.2.5:3443/api/status