Break-Glass Account Operations — SUPERSEDED

This document described a mechanism that does not exist. Do not follow it. The procedure you want is docs/runbooks/authority/authority-break-glass-recovery.md.

What was wrong with it

Until 2026-08-18 this page documented a stella auth break-glass command group (break-glass, break-glass extend, break-glass terminate), a POST /auth/break-glass endpoint, a break-glass session lifecycle and a dedicated audit stream. None of it shipped.

docs/modules/authority/architecture.md has said so explicitly for some time:

The complete but unregistered BreakGlassSessionManager design was removed in Sprint 20260731_003; there is no break-glass endpoint, CLI command, Console surface, or session audit stream.

An operator reaching this page during an incident — which is exactly when they would reach it, since it is linked from operations/backup-restore.md, operations/bootstrap-modes.md and the module README.md — would have typed commands that do not resolve and looked for an endpoint that returns 404, while the estate’s real recovery path sat one directory away under a different name. Rewritten rather than deleted so those three links keep resolving and land on this correction instead of a 404.

What actually exists

Authority’s break-glass path is the CLI tool stella admin users password-set --confirm-authority-access, run as the one-shot docker-compose.authority-password-tool.yml container. It opens Authority’s database directly and resets one existing user’s credential.

As of SPRINT_20260722_016 AUTH-11 it is audited (authority.break_glass_events, written in the same transaction as the credential change and before it), time-boxed (the credential expires — 15 minutes by default, configurable and stamped into the audit row), restricted to structural tenants, requires a --reason, and is exercised by a recovery drill against a real database. An unreconciled use drives doctor.authority.break-glass.unreconciled to Critical until an operator acknowledges it.

Full procedure, including reconciliation: docs/runbooks/authority/authority-break-glass-recovery.md

Design and the security argument for why hardening the existing path beat building a listener-shaped alternative: docs/modules/authority/break-glass-access-design.md