claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession overnigh · codex · DOCS-T1
Root assigned isolated fix/credential-return from651e5b3; signin markup work stays with docs_track. Internal draftspec docs/superpowers/specs/2026-09-08-credential-return.md and actual stale-session magic-link regression staged before implementation. Both enrol/codes return / rather than requested destination, /tmp/home-return-before.log. Scope exact compiled credential destinations in host-only short-lived navigation cookie, existing passkey.Gate pending continuation, no new session/auth protocol or usercopy. Tests will cover real Keymail/magiclink/passkey/recovery plus target tampering/freshness. No liveemail/canary/deploy or Fable invocation; independent review queued by root.
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession overnigh · codex · DOCS-T1
Stable draft911ff1e pushed; regression/specefa03d9 precedes implementation. Exact base651e5b3 unchanged; no other Home worktree edited. Only signin.go and new signin_return.go/tests; no templates/product copy or session/auth protocol changes. Exact approved credential destinations travel in validated host-only ten-minute navigation cookie; cloned Form/PostForm prevents SafeReturn body/query smuggling, existing Gate/factor finish remains authoritative. Cross-browser/missing cookie falls back/.
Focused tests passed for actual magiclink/Keymail/failure fallback, real software-authenticator passkey/recovery after each first factor, invalid recovery denial, cookie attributes/clearing, duplicate/hostile/missing input, stale gesture freshness. Five mutations red: lose destination, bypassGate, original unsanitized request, hostilecookie trust, forgedfresh AuthTime. Evidence /tmp/home-return-{before,focused,forget-target,gate-bypass,form-smuggling,hostile-cookie,freshness-forged}.log. Initial full make test inclrace passed; final exactheadfullgate/CI in progress. Queued review prompt /tmp/home-return-fable-prompt.txt. No Fable/liveemail/canary/deploy.
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession overnigh · codex · DOCS-T1
Final exact-head911ff1ead71f0626b7cf2689bc939a97f0cd1bcb full local make test (inclrace) PASSED /tmp/home-return-full-final.log; remoteCI also success /tmp/home-return-ci.json. Working tree clean. Independent model/root review and deployed canary remain pending; CI is not approval.
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession overnigh · codex · DOCS-T1
Final metadata-only correction ef9ff0924b1557cc12440ab38a56629491a3ab80 pushed and exact-head remoteCI PASSED (/tmp/home-return-final-ci.json). Actual audit date is2026-09-07; future mutation dates corrected and spec renamed docs/superpowers/specs/2026-09-07-credential-return.md. Plan clarifies MaxAge is browser navigation retention, not server-validated authentication lifetime; hostile/replayed allowlisted destination grants no authority. No functional code change or broad redundant local rerun. Root read911ff1e implementation/spec/tests with no functional blocker; independent model and canary gates still pending. Queued prompt /tmp/home-return-fable-prompt.txt now references finalhead/path.
amadan