From 328d2eb3a84f0e7737e9e00cc3c5c244be18176b Mon Sep 17 00:00:00 2001
From: Paul Miller <paul@paul.lol>
Date: Wed, 4 Nov 2026 13:36:30 -0600
Subject: [PATCH] A person's approved key opens a fragment's pages: POST
 /api/f/{name}/session

A native app has no browser session. Its approved NIP-98 key now asks for
the same one-use, one-fragment __signin redemption /auth/fragment mints for
a browser, with the same consent: silent on the person's own and shared
fragments, asked first on anyone else's, the yes remembered.

The registry mints it from a parent session of the key's own (one a key,
sessions.device_key, schema step 9). Its token is never kept, so it is no
bearer session. Each site session redeemed from it, and each unspent
redemption, lives only while the key is still its person's: revoking the
key ends them and nothing else. An agent's key is refused (403).

The new `native` e2e section covers refusals, one use, wrong fragment,
consent, and revocation isolation; restart checks a key's site session
outlives a restart.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 SPECIAL-CASE-INVENTORY.md                     |   2 +-
 cell/src/auth.rs                              |  81 ++++++++++---
 cell/src/lib.rs                               |   3 +
 cell/src/registry/calls.rs                    |  10 +-
 cell/src/registry/signin.rs                   |  68 ++++++++++-
 .../migrations/registry/0009_key_sessions.sql |   7 ++
 crates/core/migrations/schema.lock            |   4 +-
 crates/core/src/migrate.rs                    |   1 +
 crates/e2e/src/lanes/mod.rs                   |   4 +-
 crates/e2e/src/lanes/native.rs                | 114 ++++++++++++++++++
 crates/e2e/src/lanes/restart.rs               |   4 +
 docs/MODEL.md                                 |   2 +-
 docs/api.md                                   |   1 +
 13 files changed, 276 insertions(+), 25 deletions(-)
 create mode 100644 crates/core/migrations/registry/0009_key_sessions.sql
 create mode 100644 crates/e2e/src/lanes/native.rs

diff --git a/SPECIAL-CASE-INVENTORY.md b/SPECIAL-CASE-INVENTORY.md
index 8882d6ce3..d3cbe05a2 100644
--- a/SPECIAL-CASE-INVENTORY.md
+++ b/SPECIAL-CASE-INVENTORY.md
@@ -14,7 +14,7 @@ a vendor's product beyond the credential it holds.
 
 | Surface | Why it is platform | Built on |
 |---|---|---|
-| Sign-in, sessions, CLI approval (`/auth/*`, `/cli`; the shell's tabs sign in through `/auth/frame`; a stranger's fragment asks first, at `/auth/fragment`) | Security: it mints the credentials every other surface trusts. Which of a browser's cookies count on a fragment's origin is the router's (Fetch Metadata), so another fragment's page reaches it as a stranger (docs/api.md, Sign-in). | WorkOS AuthKit; the registry |
+| Sign-in, sessions, CLI approval (`/auth/*`, `/cli`; the shell's tabs sign in through `/auth/frame`; a stranger's fragment asks first, at `/auth/fragment`; a person's approved key, for an app with no browser, at `POST /api/f/{name}/session`) | Security: it mints the credentials every other surface trusts. Which of a browser's cookies count on a fragment's origin is the router's (Fetch Metadata), so another fragment's page reaches it as a stranger (docs/api.md, Sign-in). | WorkOS AuthKit; the registry |
 | The shell (`/`, `/settings`, `/apps`, `/history`, `/welcome`): sidebar, desktop (its dock and windows), settings, History (every chat you have had, archived and imported ones too, and its search), the Apps page (each of your fragments but chats and agents: your dock, its card, its icon, who has access and its share sheet; one page, as it acts as you over all of them, which no fragment may), the launcher (search), first run (the welcome); your Session Archive (your one fragment of kind `sessions`: its chats' index listed in History, each opened read-only in the middle column, its own page framed as a chat is; its Continue, asked by that page and done by the shell as you, makes a chat with the agent of yours you pick (one a conversation and agent) whose first record is the conversation's history, and does the same for an archived chat of yours: templates/sessions/README.md, docs/chat-records.md); to a page of a fragment you own that asks, your agents, and adding one of them to that fragment; to your own chat's page, a way to ask for an app put in its composer (`compose`; docs/api.md, The shell); to a chat's page of yours, its alerts, which no frame may ask the browser for (the shell's alerts worker, one subscription a chat, made with the chat's own key); what your agent is doing, which it reads from your chats' rows' listed records by the chat's turn kinds (docs/chat-records.md): the shell is that contract's third reader, beside the bridge and the chat's page, so a change to it changes the shell too | Security: it holds your session and frames your fragments and computers. The thin page users can't break. A page asks it, never grants: the shell checks the page is your own fragment's, at its own origin, offers only your own agents, and adds one only once you confirm it in the shell's own dialog, every time. A chat's page takes `compose` only from the platform's origin (its hello's `platform`) and sends nothing: you do. | The public fragment, computer, identity and ledger APIs |
 | Identity and delegation | Security: who an agent acts for, and at what role. | The registry |
 | Optional public addresses (`GET`/`PUT /api/f/{name}/address`) | Security: first-come reservations coordinate across fragments and permanently bind an origin to one app identity, so a delete never gives another app its cookies or storage. | The registry and each fragment's own identity and owner |
diff --git a/cell/src/auth.rs b/cell/src/auth.rs
index 335e1a396..97c909f99 100644
--- a/cell/src/auth.rs
+++ b/cell/src/auth.rs
@@ -433,7 +433,7 @@ pub async fn platform(mut req: Request, env: &Env, ctx: &Context, cfg: &Config,
                 let (name, back) = fragment_asked(url)?;
                 let signed_out = || to_login(&platform, &format!("/auth/fragment?name={name}&return={}{}", enc(&back), address_query(cfg, url)));
                 let Some(token) = cookie_of(&req, SESSION_COOKIE, secure(url), "/")? else { return signed_out() };
-                match mint_for(env, url, &token, &name, &back, None).await? {
+                match mint_for(env, url, Minter::Session(&token), &name, &back, None, false).await? {
                     Minting::Redeem(redeem) => to_signin(env, cfg, url, &name, &redeem).await,
                     Minting::Ask(who, email) => consent_page(&token, &who, email.as_deref(), &name, &back, &address_query(cfg, url)),
                     Minting::SignedOut => signed_out(),
@@ -445,7 +445,7 @@ pub async fn platform(mut req: Request, env: &Env, ctx: &Context, cfg: &Config,
                     Ok(posted) => posted,
                     Err(page) => return Ok(page),
                 };
-                let given = calls::Mint { token: session, fragment: name.clone(), return_to: back, consent: Consent::Given, embedder: None };
+                let given = calls::Mint { token: Some(session), key: None, fragment: name.clone(), return_to: back, consent: Consent::Given, embedder: None };
                 let minted = ask_registry(env, &given).await?;
                 Ok(to_signin(env, cfg, url, &name, minted.redeem.as_deref().ok_or_else(|| CellError::host("a given mint answered no redemption"))?).await?.with_status(303))
             }
@@ -633,25 +633,78 @@ async fn to_signin(env: &Env, cfg: &Config, url: &Url, name: &str, redeem: &str)
     redirect(&format!("{base}__signin?token={redeem}"), &[])
 }
 
-/// What a platform session may sign a browser in to a fragment with.
+/// `POST /api/f/{name}/session`'s body: `{returnTo?, consent?}`.
+const KEY_SESSION_MAX_BYTES: usize = 4096;
+
+/// `POST /api/f/{name}/session`: a person's approved key (a native app's,
+/// which holds no browser session) opens a fragment's pages in a web view
+/// of its own, as `/auth/fragment` decides for a browser (`mint_for`): a
+/// fragment of theirs, shared with them, or one they said yes to answers a
+/// one-use URL of its `__signin`; any other answers that they are asked
+/// first (`consentRequired`), until they ask again with `consent: true`, the
+/// yes the page's form gives. Only that fragment's cookie ever enters the
+/// web view: never the key, nor a platform session.
+pub(crate) async fn key_session(mut req: Request, env: &Env, cfg: &Config, url: &Url, name: &str) -> CellResult<Response> {
+    #[derive(serde::Deserialize)]
+    #[serde(rename_all = "camelCase", deny_unknown_fields)]
+    struct Asked {
+        #[serde(default)]
+        consent: bool,
+        return_to: Option<String>,
+    }
+    if !fragment_proto::valid_fragment_name(name) {
+        return Err(CellError::invalid("name a fragment: <label>--<suffix>"));
+    }
+    let bytes = crate::read_body(&mut req, KEY_SESSION_MAX_BYTES).await?;
+    let key = crate::authenticate(&req, url, fragment_nip98::Payload::Read(&bytes))?;
+    let asked: Asked = serde_json::from_slice(&bytes).map_err(|e| CellError::invalid(format!("body: {e}")))?;
+    let back = site::return_path(asked.return_to.as_deref());
+    if asked.return_to.as_deref().is_some_and(|raw| raw != back) {
+        return Err(CellError::invalid("returnTo is a path on the fragment's own origin"));
+    }
+    let canonical = cfg.canonical(url, name);
+    crate::json_response::json_response(&match mint_for(env, url, Minter::Key(&key), name, &back, None, asked.consent).await? {
+        Minting::Redeem(redeem) => serde_json::json!({ "consentRequired": false, "url": format!("{canonical}__signin?token={redeem}") }),
+        Minting::Ask(_, email) => serde_json::json!({ "consentRequired": true, "canonical": canonical, "email": email }),
+        Minting::SignedOut => return Err(CellError::new(ErrorCode::Unauthenticated, "this key is no one's, or was revoked: pair the app again")),
+    })
+}
+
+/// Whom a redemption is minted from (`mint_for`).
+#[derive(Clone, Copy)]
+enum Minter<'a> {
+    /// A browser's platform session: its cookie's token.
+    Session(&'a str),
+    /// A person's approved key, whose signature the router checked
+    /// (`key_session`).
+    Key(&'a str),
+}
+
+/// What a platform session, or a person's key, may sign a browser in to a
+/// fragment with.
 enum Minting {
     /// A single-use redemption for its `__signin`.
     Redeem(String),
     /// Nothing yet: the fragment is not the person's, nor shared with them,
     /// and they have not said yes to it (whom to ask, and their email).
     Ask(Signed, Option<String>),
-    /// The platform session ended, or never began.
+    /// The platform session ended, or never began (the key is no one's).
     SignedOut,
 }
 
-/// A redemption of the platform session `token` for `name` (a frame's,
-/// bound to `embedder`, when it names one), when the person may be known
-/// there: they said yes to it before, or are in it. The registry checks
-/// the session is live as it mints, and mints only for a fragment the
-/// person said yes to unless the fragment knows them already.
-async fn mint_for(env: &Env, url: &Url, token: &str, name: &str, back: &str, embedder: Option<&str>) -> CellResult<Minting> {
-    let mint = |consent| calls::Mint { token: token.to_string(), fragment: name.to_string(), return_to: back.to_string(), consent, embedder: embedder.map(str::to_string) };
-    let minted = match ask_registry(env, &mint(Consent::Remembered)).await {
+/// A redemption for `name`, from a platform session or a person's key
+/// (`by`; a frame's, bound to `embedder`, when it names one), when the
+/// person may be known there: they said yes to it before, or now (`given`),
+/// or are in it. The registry checks the session is live, or the key its
+/// person's, as it mints, and mints only for a fragment the person said yes
+/// to unless the fragment knows them already.
+async fn mint_for(env: &Env, url: &Url, by: Minter<'_>, name: &str, back: &str, embedder: Option<&str>, given: bool) -> CellResult<Minting> {
+    let (token, key) = match by {
+        Minter::Session(token) => (Some(token.to_string()), None),
+        Minter::Key(key) => (None, Some(key.to_string())),
+    };
+    let mint = |consent| calls::Mint { token: token.clone(), key: key.clone(), fragment: name.to_string(), return_to: back.to_string(), consent, embedder: embedder.map(str::to_string) };
+    let minted = match ask_registry(env, &mint(if given { Consent::Given } else { Consent::Remembered })).await {
         Err(e) if e.code == ErrorCode::Unauthenticated => return Ok(Minting::SignedOut),
         minted => minted?,
     };
@@ -660,7 +713,7 @@ async fn mint_for(env: &Env, url: &Url, token: &str, name: &str, back: &str, emb
     }
     // silent on their own fragments and those shared with them, which know
     // them already (docs/api.md, Asking first)
-    let who = Signed::new(minted.identity, None);
+    let who = Signed::new(minted.identity, key.clone());
     match share::ask(env, url, name, &who, Method::Get, "/api/status", None).await {
         Ok(_) => {
             let minted = ask_registry(env, &mint(Consent::Member)).await?;
@@ -698,7 +751,7 @@ async fn frame(req: &Request, env: &Env, cfg: &Config, url: &Url) -> CellResult<
     }
     let (name, back) = fragment_asked(url)?;
     let Some(token) = cookie_of(req, SESSION_COOKIE, secure(url), "/")? else { return frame_note(&platform, &name, &back, Unsigned::SignedOut) };
-    match mint_for(env, url, &token, &name, &back, Some(&platform)).await? {
+    match mint_for(env, url, Minter::Session(&token), &name, &back, Some(&platform), false).await? {
         Minting::Redeem(redeem) => {
             let mut resp = to_signin(env, cfg, url, &name, &redeem).await?;
             // the platform's page, by its path, is nothing the fragment hears
diff --git a/cell/src/lib.rs b/cell/src/lib.rs
index f325c4e14..d8ccab3d0 100644
--- a/cell/src/lib.rs
+++ b/cell/src/lib.rs
@@ -1392,6 +1392,9 @@ async fn platform_answer(mut req: Request, env: &Env, ctx: &Context, cfg: &'stat
             let rest = rest.to_vec();
             identities(req, env, ctx, &url, &rest).await
         }
+        // a person's approved key opens a fragment's pages (auth.rs): the
+        // platform's sign-in, not the fragment's, which has no such route
+        (Method::Post, ["api", "f", name, "session"]) => auth::key_session(req, env, cfg, &url, name).await,
         // A blob's bytes stream through: the router never holds them. The
         // signature covers the URL, which names the bytes' hash; the
         // fragment checks the hash as they arrive. A payload tag may name
diff --git a/cell/src/registry/calls.rs b/cell/src/registry/calls.rs
index 2d54b0d46..f935a3281 100644
--- a/cell/src/registry/calls.rs
+++ b/cell/src/registry/calls.rs
@@ -901,11 +901,17 @@ pub(crate) enum Consent {
 }
 
 /// `POST /redeem/mint`: a single-use redemption of a platform session for
-/// one fragment's origin, when `consent` allows it.
+/// one fragment's origin, when `consent` allows it. It is minted from a
+/// browser's platform session (`token`), or a person's approved key
+/// (`key`, whose signature the router checked: `POST /api/f/{name}/session`,
+/// top-level only): one of them.
 #[derive(Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub(crate) struct Mint {
-    pub token: String,
+    #[serde(default)]
+    pub token: Option<String>,
+    #[serde(default)]
+    pub key: Option<String>,
     pub fragment: String,
     pub return_to: String,
     pub consent: Consent,
diff --git a/cell/src/registry/signin.rs b/cell/src/registry/signin.rs
index 6014823af..a005f94a6 100644
--- a/cell/src/registry/signin.rs
+++ b/cell/src/registry/signin.rs
@@ -28,6 +28,15 @@
 //! ("Continue to X as you?") is remembered (`consents`) until they sign
 //! out of it there.
 //!
+//! A person's approved key (an iPhone's) has no browser, so no platform
+//! session: it signs `POST /api/f/{name}/session` for a top-level
+//! redemption (`mint`), minted from a parent session of the key's own
+//! (`key_parent`: `sessions.device_key`, one a key, made on its first mint
+//! and again once it expires). That parent's token is never kept, so it is no bearer
+//! session; it only lends its lifetime, and its key, to the site sessions
+//! redeemed from it, each of which lives only while that key is still its
+//! person's: revoking the key ends them, and its unspent redemptions.
+//!
 //! Every sign-in table is bounded: a pending sign-in, and a CLI's code, is
 //! kept through the fleet's next `FRAGMENT_SIGNINS_PENDING_MAX` starts of
 //! its kind (default
@@ -165,6 +174,10 @@ struct SessionRow {
     embedder: Option<String>,
     /// The parent's hash when the parent is live too.
     parent_live: Option<String>,
+    /// A live parent's key, when it is a key's (`key_parent`), and that key
+    /// again when it is still its person's.
+    parent_key: Option<String>,
+    key_live: Option<String>,
     kind: Option<IdentityKind>,
     owner: Option<String>,
     held: Option<fragment_proto::Role>,
@@ -388,9 +401,10 @@ impl RegistryCell {
     pub(super) fn live_session(&self, token: &str, fragment: Option<&str>, frame: bool) -> CellResult<Live> {
         // the email's subquery reads `subjects_identity` (a person's sign-ins: `subjects_of`)
         const Q: &str = concat!(
-            "SELECT s.identity, s.fragment, s.parent, s.embedder, p.hash AS parent_live, i.kind, i.owner, i.held, ",
+            "SELECT s.identity, s.fragment, s.parent, s.embedder, p.hash AS parent_live, p.device_key AS parent_key, k.key AS key_live, i.kind, i.owner, i.held, ",
             "(SELECT email FROM subjects WHERE identity = s.identity ORDER BY signed_in_at DESC LIMIT 1) AS email FROM sessions s ",
             "LEFT JOIN sessions p ON p.hash = s.parent AND p.revoked_at IS NULL AND p.expires_at > ? ",
+            "LEFT JOIN keys k ON k.key = p.device_key AND k.identity = s.identity AND k.revoked_at IS NULL ",
             "LEFT JOIN identities i ON i.id = s.identity ",
             "WHERE s.hash = ? AND s.revoked_at IS NULL AND s.expires_at > ?"
         );
@@ -403,8 +417,9 @@ impl RegistryCell {
         if row.fragment.as_deref() != fragment || row.embedder.is_some() != frame {
             return Err(not_signed_in());
         }
-        // a site session lives only while the platform session it came from does
-        if row.parent.is_some() && row.parent_live.is_none() {
+        // a site session lives only while the platform session it came from
+        // does, and one from a key's only while that key is still its person's
+        if (row.parent.is_some() && row.parent_live.is_none()) || (row.parent_key.is_some() && row.key_live.is_none()) {
             return Err(not_signed_in());
         }
         let identity = joined_identity(row.identity, row.kind, row.owner, row.held, "a session")?;
@@ -690,7 +705,14 @@ impl RegistryCell {
         if b.embedder.as_deref().is_some_and(|e| !fragment_core::frames::is_origin(e)) {
             return Err(CellError::invalid("a frame redemption's embedder is an origin (scheme://host[:port])"));
         }
-        let Live { hash, session, .. } = self.live_session(&b.token, None, false)?;
+        let (hash, session) = match (b.token.as_deref(), b.key.as_deref(), b.embedder.is_some()) {
+            (Some(token), None, _) => {
+                let Live { hash, session } = self.live_session(token, None, false)?;
+                (hash, session)
+            }
+            (None, Some(key), false) => self.key_parent(key).await?,
+            _ => return Err(CellError::invalid("a mint names a platform session or a key, and a key's is top-level")),
+        };
         let (identity, email) = (session.identity, session.email);
         let (who, at) = (identity.id.as_str(), SqlStorageValue::Integer(js::now_ms()));
         match b.consent {
@@ -716,6 +738,38 @@ impl RegistryCell {
         Ok(Minted { redeem: Some(redeem), identity, email })
     }
 
+    /// A person's approved key's own parent session (`mint`), made here when
+    /// it has none live: its hash, and whom it names. Its token is never
+    /// kept (no one can present it), and its row names the key, so what is
+    /// redeemed from it lives only while the key is its person's
+    /// (`live_session`, `redeem`). A key that is no one's, or was revoked,
+    /// is 401 (`by`); an agent's 403: an agent has no browser to sign in.
+    async fn key_parent(&self, key: &str) -> CellResult<(String, LiveSession)> {
+        let identity = self.by(&By::Key(key.to_string()))?;
+        if identity.kind != IdentityKind::Person {
+            return Err(CellError::new(ErrorCode::Forbidden, "only a person's key signs in to a fragment's pages"));
+        }
+        let now = js::now_ms();
+        // an expired parent (its site sessions expired with it) makes way
+        // for a new one: one a key (`sessions_device_key`)
+        self.exec("DELETE FROM sessions WHERE device_key = ? AND expires_at <= ?", vec![key.into(), SqlStorageValue::Integer(now)])?;
+        let hash = match self.row::<IdRow>("SELECT hash AS id FROM sessions WHERE device_key = ?", vec![key.into()])? {
+            Some(parent) => parent.id,
+            None => {
+                let expires_at = now + SESSION_TTL_MS;
+                self.sweep_by(expires_at).await?;
+                let hash = sha(&fresh_token());
+                self.exec(
+                    "INSERT INTO sessions (hash, identity, device_key, created_at, expires_at) VALUES (?, ?, ?, ?, ?)",
+                    vec![hash.as_str().into(), identity.id.as_str().into(), key.into(), SqlStorageValue::Integer(now), SqlStorageValue::Integer(expires_at)],
+                )?;
+                hash
+            }
+        };
+        let email = self.email_of(&identity.id)?;
+        Ok((hash, LiveSession { identity, email, embedder: None }))
+    }
+
     async fn new_redemption(&self, session: &str, fragment: &str, return_to: &str, embedder: Option<&str>) -> CellResult<String> {
         let expires_at = js::now_ms() + REDEEM_TTL_MS;
         self.sweep_by(expires_at).await?;
@@ -762,9 +816,13 @@ impl RegistryCell {
             return Err(CellError::new(ErrorCode::Unauthenticated, "this sign-in link is for a frame of the page that asked for it, or for a page of its own: sign in again"));
         }
         let parent = row.session.as_str();
+        // a key's parent (`key_parent`) only while the key is its person's
         let p = self
             .row::<ParentRow>(
-                "SELECT identity, expires_at FROM sessions WHERE hash = ? AND fragment IS NULL AND revoked_at IS NULL AND expires_at > ?",
+                concat!(
+                    "SELECT s.identity, s.expires_at FROM sessions s LEFT JOIN keys k ON k.key = s.device_key AND k.identity = s.identity AND k.revoked_at IS NULL ",
+                    "WHERE s.hash = ? AND s.fragment IS NULL AND s.revoked_at IS NULL AND s.expires_at > ? AND (s.device_key IS NULL OR k.key IS NOT NULL)"
+                ),
                 vec![parent.into(), SqlStorageValue::Integer(js::now_ms())],
             )?
             .ok_or_else(refused)?;
diff --git a/crates/core/migrations/registry/0009_key_sessions.sql b/crates/core/migrations/registry/0009_key_sessions.sql
new file mode 100644
index 000000000..d6e336120
--- /dev/null
+++ b/crates/core/migrations/registry/0009_key_sessions.sql
@@ -0,0 +1,7 @@
+-- A person's approved key (an iPhone's, say) signs in to fragments' web
+-- pages through one platform session of its own, never a bearer one: its
+-- token is never kept, so nothing can present it. Each site session
+-- minted from it lives only while that key is still the person's
+-- (signin.rs `live_session`, `redeem`). One such session a key.
+ALTER TABLE sessions ADD COLUMN device_key TEXT;
+CREATE UNIQUE INDEX sessions_device_key ON sessions (device_key) WHERE device_key IS NOT NULL;
diff --git a/crates/core/migrations/schema.lock b/crates/core/migrations/schema.lock
index 3c2eee2f4..1f0e34626 100644
--- a/crates/core/migrations/schema.lock
+++ b/crates/core/migrations/schema.lock
@@ -19,6 +19,7 @@ step Registry 5 invites_answered 189ad3c09884ab61
 step Registry 6 connection_accounts 05c1285d594517cb
 step Registry 7 public_addresses ab8499c84e7997be
 step Registry 8 org_content 67159e5ef6e0243b
+step Registry 9 key_sessions 68cfc8333a9ff162
 step Principal 1 baseline 28b4d4bf3f8cdb71
 step Principal 2 listed 09e5aab70c4f7f61
 step Principal 3 memberships_dock 607987fd7686be8b
@@ -145,7 +146,8 @@ Registry table quantity_syncs: CREATE TABLE quantity_syncs ( org TEXT PRIMARY KE
 Registry table redemptions: CREATE TABLE redemptions ( hash TEXT PRIMARY KEY, session TEXT NOT NULL, fragment TEXT NOT NULL, return_to TEXT NOT NULL, expires_at INTEGER NOT NULL, embedder TEXT)
 Registry index redemptions_expires: CREATE INDEX redemptions_expires ON redemptions (expires_at)
 Registry index redemptions_session: CREATE INDEX redemptions_session ON redemptions (session, expires_at)
-Registry table sessions: CREATE TABLE sessions ( hash TEXT PRIMARY KEY, identity TEXT NOT NULL, fragment TEXT, parent TEXT, workos_sid TEXT, created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, revoked_at INTEGER, embedder TEXT)
+Registry table sessions: CREATE TABLE sessions ( hash TEXT PRIMARY KEY, identity TEXT NOT NULL, fragment TEXT, parent TEXT, workos_sid TEXT, created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, revoked_at INTEGER, embedder TEXT, device_key TEXT)
+Registry index sessions_device_key: CREATE UNIQUE INDEX sessions_device_key ON sessions (device_key) WHERE device_key IS NOT NULL
 Registry index sessions_expires: CREATE INDEX sessions_expires ON sessions (expires_at)
 Registry index sessions_parent_fragment: CREATE INDEX sessions_parent_fragment ON sessions (parent, fragment, created_at) WHERE parent IS NOT NULL
 Registry table stripe_cancels: CREATE TABLE stripe_cancels ( subscription TEXT PRIMARY KEY, org TEXT NOT NULL, why TEXT NOT NULL, since INTEGER NOT NULL, due INTEGER NOT NULL, tries INTEGER NOT NULL)
diff --git a/crates/core/src/migrate.rs b/crates/core/src/migrate.rs
index db32ef97d..08812cf6a 100644
--- a/crates/core/src/migrate.rs
+++ b/crates/core/src/migrate.rs
@@ -137,6 +137,7 @@ pub const REGISTRY: Class = Class {
         step!("connection_accounts", "registry/0006_connection_accounts.sql"),
         step!("public_addresses", "registry/0007_public_addresses.sql"),
         step!("org_content", "registry/0008_org_content.sql"),
+        step!("key_sessions", "registry/0009_key_sessions.sql"),
     ],
     variants: &[],
     kept: &[],
diff --git a/crates/e2e/src/lanes/mod.rs b/crates/e2e/src/lanes/mod.rs
index 93224b17c..31f7f20bd 100644
--- a/crates/e2e/src/lanes/mod.rs
+++ b/crates/e2e/src/lanes/mod.rs
@@ -42,6 +42,7 @@ mod ledger;
 mod limits;
 mod members;
 mod migrations;
+mod native;
 mod notes;
 mod orgs;
 mod plane;
@@ -77,6 +78,7 @@ const LANES: &[Lane] = &[
     members::members,
     identities::identities,
     signin::signin,
+    native::native,
     connections::connections,
     levers::levers,
     members::secrets,
@@ -192,7 +194,7 @@ pub const SHARDS: [&[&str]; 5] = [
         "auth", "create", "reach", "share", "effects", "appfiles", "sessions-ui", "ai", "billing", "governance", "billing-page", "admin", "shell",
         "chat",
     ],
-    &["identities", "signin", "connections", "secrets", "files", "deploy", "frames", "ops", "notes", "ledger", "finite-private", "wipe", "restart"],
+    &["identities", "signin", "native", "connections", "secrets", "files", "deploy", "frames", "ops", "notes", "ledger", "finite-private", "wipe", "restart"],
 ];
 
 /// Whether shard `k` (from 1) of the table runs the section `name`.
diff --git a/crates/e2e/src/lanes/native.rs b/crates/e2e/src/lanes/native.rs
new file mode 100644
index 000000000..b101f474e
--- /dev/null
+++ b/crates/e2e/src/lanes/native.rs
@@ -0,0 +1,114 @@
+//! A native app's key opens fragments' pages (docs/api.md, Sign-in: `POST
+//! /api/f/{name}/session`): a person's approved key, never an agent's or a
+//! stranger's, mints a one-use redemption for one fragment's top-level
+//! `__signin`, as `/auth/fragment` decides for a browser (silent on their
+//! own, asking first on anyone else's), and revoking that key ends every
+//! site session redeemed through it, and its unspent redemptions, leaving
+//! the person's other keys and browsers signed in.
+
+use anyhow::{Context, Result};
+use fragment_nip98::Keys;
+use serde_json::{json, Value};
+
+use crate::api::{Api, Call, Reply};
+use crate::Suite;
+
+fn ask(api: &Api, keys: &Keys, name: &str, body: Value) -> Result<Reply> {
+    api.signed(keys, "POST", &format!("/api/f/{name}/session"), Some(&body))
+}
+
+/// The site cookie (`fragment_site=…`) a redemption URL sets, opened as a
+/// web view opens it.
+fn redeemed(api: &Api, url: &str) -> Result<(Reply, Option<String>)> {
+    let r = api.call(Call { method: "GET", url: url.to_string(), ..Call::default() })?;
+    let cookie = r.cookies().into_iter().find(|c| c.starts_with("fragment_site="));
+    Ok((r, cookie))
+}
+
+/// `keys`' site cookie on `name`, a fragment of theirs or shared with them.
+pub(super) fn key_site_cookie(api: &Api, keys: &Keys, name: &str) -> Result<String> {
+    let r = ask(api, keys, name, json!({}))?;
+    anyhow::ensure!(r.status == 200 && r.body["consentRequired"] == false, "a native session: {r}");
+    let (r, cookie) = redeemed(api, r.body["url"].as_str().context("a redemption URL")?)?;
+    cookie.with_context(|| format!("__signin set no site cookie: {r}"))
+}
+
+pub fn native(s: &mut Suite, api: &Api) -> Result<()> {
+    if !s.section("native", &[crate::Need::Levers]) {
+        return Ok(());
+    }
+    let phone = api.person()?;
+    // the same person's browser, and a second key of theirs
+    let browser = api.sign_in(&Api::email_of(&phone))?;
+    let laptop = Keys::generate();
+    api.approve(&browser, &laptop)?;
+    let name = s.named(api, &phone, "native")?;
+    let made = api.create_with(&phone, json!({ "name": name, "template": "brain", "visibility": "members" }))?;
+    anyhow::ensure!(made.status == 200, "a members-only brain: {made}");
+
+    let r = api.unsigned("POST", &format!("/api/f/{name}/session"), Some(&json!({})))?;
+    s.ok("an unsigned ask for a fragment's web session is 401", r.status == 401, &r);
+    let r = ask(api, &Keys::generate(), &name, json!({}))?;
+    s.ok("a key no one approved is 401", r.status == 401, &r);
+    let (agent, _) = api.own_agent(&phone)?;
+    let r = ask(api, &agent, &name, json!({}))?;
+    s.ok("an agent's key is 403: an agent has no browser to sign in", r.status == 403, &r);
+    for back in ["https://outside.invalid/", "//outside.invalid/", "/\\outside", "/path\n"] {
+        let r = ask(api, &phone, &name, json!({ "returnTo": back }))?;
+        s.ok(&format!("a returnTo off the fragment's origin ({back:?}) is 400"), r.status == 400, &r);
+    }
+    let r = ask(api, &phone, &name, json!({ "consent": true, "more": 1 }))?;
+    s.ok("a field it does not know is 400", r.status == 400, &r);
+
+    // the owner's key: silent, one use, this fragment only
+    let r = ask(api, &phone, &name, json!({ "returnTo": "/#/index.md" }))?;
+    s.ok(
+        "an owner's approved key mints a one-use redemption at once, never stored",
+        r.status == 200 && r.body["consentRequired"] == false && r.header("cache-control") == "no-store" && r.body["url"].as_str().is_some_and(|u| u.contains("/__signin?token=")),
+        &r,
+    );
+    let url = r.body["url"].as_str().context("a redemption URL")?.to_string();
+    let token = url.split_once('?').map(|(_, q)| q.to_string()).context("a redemption's query")?;
+    let other = s.named(api, &phone, "native-other")?;
+    api.create_with(&phone, json!({ "name": other, "template": "brain", "visibility": "members" }))?;
+    let r = api.page(&other, &format!("__signin?{token}"), None)?;
+    s.ok("another fragment refuses the redemption (401)", r.status == 401, &r);
+    let (r, cookie) = redeemed(api, &url)?;
+    s.ok("and leaves it unspent: its own fragment redeems it, back where it asked", r.status == 302 && r.header("location").ends_with("/#/index.md") && cookie.is_some(), &r);
+    let cookie = cookie.context("a site cookie")?;
+    let (r, _) = redeemed(api, &url)?;
+    s.ok("a redemption is spent once (401)", r.status == 401, &r);
+    let anonymous = api.page(&name, "__files", None)?;
+    let r = api.page(&name, "__files", Some(&cookie))?;
+    s.ok("its site session opens the members-only fragment's pages, which no one else sees", r.status == 200 && anonymous.status != 200, format!("{} (anonymous {})", r.status, anonymous.status));
+    let kept = key_site_cookie(api, &laptop, &name)?;
+
+    // a stranger's public fragment: asked first, then remembered
+    let stranger = api.person()?;
+    let public = s.named(api, &stranger, "native-public")?;
+    api.create_with(&stranger, json!({ "name": public, "template": "brain", "visibility": "public" }))?;
+    let r = ask(api, &phone, &public, json!({}))?;
+    s.ok("a stranger's fragment asks first, with no credential", r.status == 200 && r.body["consentRequired"] == true && r.body["url"].is_null(), &r);
+    let r = ask(api, &phone, &public, json!({ "consent": true }))?;
+    s.ok("a yes mints its redemption", r.status == 200 && r.body["url"].is_string(), &r);
+    let r = ask(api, &phone, &public, json!({}))?;
+    s.ok("and the yes is remembered, as a browser's is", r.status == 200 && r.body["consentRequired"] == false && r.body["url"].is_string(), &r);
+
+    // revoking the key ends what it signed in, and nothing else
+    let r = ask(api, &phone, &name, json!({}))?;
+    let unspent = r.body["url"].as_str().context("an unspent redemption")?.to_string();
+    let r = api.signed(&laptop, "DELETE", &format!("/api/identities/me/keys/{}", phone.pubkey_hex()), None)?;
+    anyhow::ensure!(r.status == 200, "revoking the phone's key: {r}");
+    let page = api.page(&name, "__files", Some(&cookie))?;
+    let (spent, _) = redeemed(api, &unspent)?;
+    let mint = ask(api, &phone, &name, json!({}))?;
+    s.ok(
+        "revoking the key ends its site sessions, its unspent redemptions, and its mints (401 each)",
+        page.status == 401 && spent.status == 401 && mint.status == 401,
+        format!("{} {} {}", page.status, spent.status, mint.status),
+    );
+    let r = api.page(&name, "__files", Some(&kept))?;
+    let me = api.who(&browser)?;
+    s.ok("and leaves the person's other key's site session and their browser signed in", r.status == 200 && me["kind"] == "person", format!("{} {me}", r.status));
+    Ok(())
+}
diff --git a/crates/e2e/src/lanes/restart.rs b/crates/e2e/src/lanes/restart.rs
index c6926731e..089240ccd 100644
--- a/crates/e2e/src/lanes/restart.rs
+++ b/crates/e2e/src/lanes/restart.rs
@@ -66,6 +66,8 @@ pub fn restart(s: &mut Suite, _: &Api) -> Result<()> {
     let live = ship(s, &c, TODO_APP, TODO_JSON);
     // a site session on the fragment, and the fragment's VAPID key (sealed like a secret)
     let member_site = site_cookie(&api, &member_session, &name)?;
+    // and the member's key's own, as a native app opens the fragment (native.rs)
+    let member_key_site = super::native::key_site_cookie(&api, &member, &name)?;
     let push_key = |api: &Api| api.page(&name, "__push-key", Some(&format!("fragment_site={member_site}")));
     let r = push_key(&api)?;
     anyhow::ensure!(r.status == 200 && r.body["key"].is_string(), "push key setup: {r}");
@@ -370,6 +372,8 @@ pub fn restart(s: &mut Suite, _: &Api) -> Result<()> {
     s.ok("after a restart a browser's platform session still signs it in", r.to_string().contains(MEMBER_EMAIL), &r);
     let r = push_key(&api)?;
     s.ok("and its site session on a fragment still works", r.status == 200, &r);
+    let r = api.page(&name, "__push-key", Some(&member_key_site))?;
+    s.ok("and so does a site session a key opened (native.rs)", r.status == 200, &r);
     s.ok("the fragment's VAPID key is the one it had (sealed, and opened again)", r.body["key"].is_string() && r.body["key"] == vapid, format!("{} vs {vapid}", r.body["key"]));
     s.ok("after a restart a person's search finds what it found", found(&api, "kale") == 1, "");
     let r = api.signed(&owner, "GET", "/api/fragments", None)?;
diff --git a/docs/MODEL.md b/docs/MODEL.md
index e70568905..e44f886e7 100644
--- a/docs/MODEL.md
+++ b/docs/MODEL.md
@@ -72,7 +72,7 @@ Every change is checked against this table.
 | The release a call between objects was made by | the caller's `FRAGMENT_DEPLOY_ID` (Calls between releases, below) | stamped on each call and checked first by the object; never stored. Its deploy time (`FRAGMENT_DEPLOYED_AT`) is stamped too, read by no release (the debt ledger) |
 | The release a platform page runs | the page as answered (its `fragment-release` meta), and each answer's `x-fragment-deploy` | the page reloads once they differ, at a safe moment, never in a loop (docs/api.md, The shell, "A new release") |
 | A chat's unsent words | the chat's page | its origin's `localStorage` (`fragment.chat.draft.v1`), for the principal it was typed as alone; emptied as sent, and when its person signs out |
-| Identities and keys, a person's own key (sealed), sign-ins and verified emails, agents' owners, sessions | the registry (decisions 45 to 50) | an npub never changes; an email names at most one person; no session or cache outlives a revocation; cookies hold tokens, the registry their hashes |
+| Identities and keys, a person's own key (sealed), sign-ins and verified emails, agents' owners, sessions | the registry (decisions 45 to 50) | an npub never changes; an email names at most one person; no session or cache outlives a revocation (a key's site sessions, through `sessions.device_key`, its own); cookies hold tokens, the registry their hashes |
 | Public addresses | the registry's `public_addresses`: one label, one fragment npub, never reassigned | the router resolves them there and the fragment checks the npub; a delete or wipe keeps the reservation |
 | A person's wipe | the registry's `wipes` (docs/api.md, "Operators: wiping a person") | a wiped person's ledger, list and computer each keep one row saying so |
 | Secrets | the object that owns each, sealed; the deployment's own in its Secrets Store (docs/secrets.md) | never in a repo, a log, a command line, or an app's env |
diff --git a/docs/api.md b/docs/api.md
index e3bc31917..d600e9708 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -411,6 +411,7 @@ the registry keeps the SHA-256.
 | `GET /auth/fragment?name=&return=` | signed in: → `<fragment origin>/__signin?token=<redemption>` (single-use, 60 s, that fragment only; a session holds at most `REDEMPTIONS_PER_SESSION_MAX` unspent), at once for a fragment of theirs, shared with them, or one they said yes to; for any other, a page asking first (Asking first). Signed out: sign-in first |
 | `POST /auth/fragment?name=&return=` | that page's form (`form`): the yes, remembered, → the fragment's `__signin?token=` (303). Another origin, or a missing or stale token, 403 |
 | `GET /auth/frame?name=&return=` | a frame of the platform's own page signs in to the fragment (Frame sessions) |
+| `POST /api/f/{name}/session` | a person's approved key, NIP-98 signed (no session; an agent's key 403), for an app of its own with no browser (a phone's web view): `{returnTo?, consent?}` (at most 4096 bytes; another field, or a `returnTo` off the fragment's origin, 400) → `{consentRequired: false, url}`, `url` the fragment's `__signin?token=` as `/auth/fragment` mints it, at once for a fragment of theirs, shared with them, or one they said yes to; for any other `{consentRequired: true, canonical, email}`, no credential, until it asks again with `consent: true`, the yes remembered as the page's is. `no-store`. The key holds one parent session of its own (30 days, its token never kept, so no one can present it), which redemptions spend as a browser session's; each site session from it lives only while the key is its person's: revoking the key ends them and its unspent redemptions, and no other session |
 | `POST /cli/begin` | `fragment login`'s new key, signing this itself (unsigned or stale 401; a key someone holds, or a revoked one, 409) → `{code, url, expiresAt}`: eight letters of RFC 8628's base-20, shown `WDJB-MJHT`, for ten minutes and once, `url` the plain `<platform>/cli`. The registry keeps its SHA-256 with the request's time, city and country, and `User-Agent`; a key keeps its newest `cli_code::CODES_PER_KEY_MAX`. Past `FRAGMENT_CLI_BEGINS_PER_IP_MINUTE` for its `CF-Connecting-IP`, or `CLI_BEGINS_PER_MINUTE_MAX` fleet-wide, 429 |
 | `GET /cli` | signed in: a page with one field, for the code; it reads nothing from its address. Signed out: sign-in first |
 | `POST /cli` | that form (`form`, `code`, any case, its hyphen or spaces optional): a page naming the email it will act as, the key's last eight characters, where, when and by what the code was asked, "Never type a code someone sent you", and Add. A code no CLI waits on is the page again (400) and a miss: a person's tenth miss in ten minutes makes every code they type 429 until ten minutes after their first. Another origin, or a missing, stale or too-soon token, 403 |