Copied auth code drifts. A licence verifier that ships can be forged.
Two problems, one answer. On the web, a portfolio of apps each carried its own copy of the same auth code: similar session services, similar database queries, similar cookie helpers, all slightly drifted, so a bug fixed in one stayed broken in the others. On the desktop, software that checks a licence runs on hardware the customer controls. Ship the logic that decides a user is licensed and it is trivially defeatable; ship the signing capability with it and it becomes a route to minting fakes.
frozen-border answers both with one piece of design DNA: a swappable storage seam, parameterised SQL, and a pure verification core. The web tier becomes the one place the session primitives live, depended on as a private file-path library. The native tier ships only the public half of an Ed25519 keypair and an offline routine: enough to recognise a licence, never enough to issue one.
Enough to recognise a licence, never enough to forge one.
The native verifier runs where anything can be inspected, so it ships only the public half and a pure, offline routine. The private half, the signing tool, and the service that records active devices stay admin-side, in a separate repository.
One question, is this allowed, answered at two borders.
The web gate runs on a server the operator controls. The native gate runs on hardware the customer controls. Same question, opposite trust model, one verdict.
Two domains, the same discipline.
The two crates never share code. A web session and a device licence are different problems that share a stance: ship contracts, not just helpers, and defend the boundary the same way on both sides.
A client can recognise a genuine credential, never mint one.
The asymmetry is the whole design. Ship both halves and the client holds everything it needs to forge; ship only the public half and a cracked binary still comes back empty.