The clinical app has no route to the internet and still knows who you are

The nurse-station app runs in a container with type: block networking. No egress, so no call to an identity provider on every login. HIPAA still wants a uniquely identified user before the chart opens.

Hoody signs an identity claim at login: an ED25519 bundle: kid, payload_b64, signature_hex: carrying sub, username, iat, exp. The app verifies it against the public key from GET /api/v1/meta/public-key, fetched once and cached. Verification is offline: seven checks, no round-trip. Re-issue it audience-bound and a claim minted for the imaging viewer is rejected by the pharmacy module: aud must match in both directions.

The identity layer and the container substrate share one signing key, so the segmented app authenticates users without opening a hole in the segment. The claim expires. The segment stays closed.

The clinical app has no route to the internet and still knows who you are.