Fresh assertion authentication for Docs linking and roster changes open
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession oficina- · codex · DOCS-T1
Continuing user-prioritized team-aware entry after merged/enabled Home exchange0dc863c (preview eaefda9). Previous turn changed deployed authoritative state and completed independent code/CI/canary evidence, classified as progress.
New branch feat/home-fresh-assertion, isolated worktree overnight-home-fresh, draft fb470be at implementation/fresh-assertion.md. Fable5 design review currently running through Command Code. Proposed explicit max_age=300, original-subject binding, actual email/second-factor reauthentication and unchanged original AuthTime. Ordinary SSO remains unchanged. Sensitive consumers must check actual AuthTime themselves; this issuer-only stage is not full Docs linking or roster authorization.
Additional source inspection found Rastrillo0.23 sessions.Fresh does not itself refuse a future timestamp. The existing assertion signer refuses auth_time after iat, but the new freshness decision should explicitly reject future verified times before signing rather than crediting a future authentication. Will resolve this in the reviewed design before implementing. User team-name/label clarification still pending; no production cutover or data rewrite.
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession oficina- · codex · DOCS-T1
Design4b184e7 APPROVED by configured Claude Fable5. Implementation47301e8 pushed; full make test and actual hub CI passed. Three Go overlay mutations remove freshness, original-subject binding and server-side forced mail respectively; each fails the intended behavioral test for the right reason. Subject binding uses sessions.From deliberately because the credential router has no middleware stash. Explicit tests cover MaxAge0 keeping Keymail, invalid age/intent refusal, future authentication, original-account switch refusal, real captured-email continuation and Keymail+recovery qualifying as a completed fresh credential. Temporary classifier-cache/mail-capture fixture failures were fixed and the focused/full gate rerun.
Fable whole-code review currently running as oficina-home-fresh-code-review-20260908.service, source frozen47301e8. No deployment yet. Local actual-browser fresh-email continuation is under test; initial browser run failed to reach /signin/sent, now collecting sanitized request-path/status diagnostics in a fresh local-only fixture. This failure is not reported as passing. Existing Home preview remains eaefda9.
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession oficina- · codex · DOCS-T1
Whole-code47301e8 APPROVED by configured Claude Fable5. Full actual CI green. Eight local Chromium/WebKit JS-on/off width320/1280 runs now pass actual stale-session → forced captured email → confirmation → assertion → directory → signout. Evidence /tmp/oficina-home-fresh-browser/results.json and server-r3.log. Earlier browser attempts correctly hit the 5-per-address limiter at the sixth case; fixture now uses one distinct synthetic address per case and leaves production budgets unchanged. All browser traffic remains on the local-only proxy; no real emails sent.
Reviewer advisory about future AuthTime on ordinary assertions is contradicted by existing pure-core code: assertion.validate at assertion.go274 rejects AuthTime > IssuedAt before signing, so ordinary issuance cannot forward it. Do not clamp a future time to now, which would invent freshness. Consumer freshness also needs its own nonfuture check, as the accepted Docs design states. Intent cookie clearing is not server-side single use; shared pending/replay store supplies that property.
Preview deployment of47301e8 is underway after approval. No final live evidence or merge claim yet.
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession oficina- · codex · DOCS-T1
DEPLOYED preview47301e8295f0c1f4a8a7b8c2b853a72bf395b24d. Both canonical API bodies AND headers match after exact-host supported restarts; initial credential response correctly exposed old body/new header before convergence. Receipt /tmp/oficina-home-fresh-release/verified.json. Eight live Chromium/WebKit script/width cases pass ordinary entry, explicit fresh maxage=300 acceptance, maxage=0 refusal, secure pending/intent cookies and both actual versions. Results /tmp/oficina-home-fresh-release/browser/results.json. No real emails or live authenticated completion claimed. User notified with Home preview URL and exact under-the-hood scope; production unchanged.
Final canary-evidence review attempt ended permission_denied while reaching for unrelated external assertion sources, no verdict. Corrected evidence-only review now runs under oficina-home-fresh-canary-r2-20260908.service, with all browser scripts/results/probe/verification receipts provided inline and no tools required. Original code APPROVE remains valid. Branch/task stays open until actual canary review verdict and merge.
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession oficina- · codex · DOCS-T1
Final provided-canary-evidence review APPROVED by configured Claude Fable5. Receipt /tmp/oficina-home-fresh-review/canary-r2-review.ndjson (final result). Actual CI rechecked success for47301e8. Merge scope remains issuer fresh-auth preview only.
Record evidence limits explicitly: live maxage acceptance is parameter handling; actual stale-session enforcement is proven by the local actual-handler browser and integration tests. The unit TestFreshAssertionUsesFreshSessionAndBindsOriginalPerson explicitly proves a fresh session succeeds without reauthentication; the live matrix does not. Local fixture was run with OFICINAASSERTIONBROWSERPROBE=1 and -run '^TestLocalAssertionBrowserProbe$' in the recorded root command; plain package ok log alone cannot distinguish a skip. Browser handshake/results and actual mail/redirect requests supply the additional evidence. Screenshots exist at /tmp/oficina-home-fresh-browser and live browser subdirectory but were not attached to the inline evidence review. No live email/production-readiness claim.
amadan