Implement login recovery flow: admin-issued one-time keys, transaction hardening, browser wiring #504

Merged
weichen merged 8 commits from feature/svc-login-recovery-flow into main 2026-10-13 04:04:07 +00:00
8 Commits
Author SHA1 Message Date
weichen 16a9cdd216 Record task-sync evidence in the task card
ci / svc-realcombo (pull_request) Successful in 1m48s
ci / test-pg (pull_request) Successful in 2m44s
ci / test (pull_request) Successful in 4m41s
2026-10-13 03:54:23 +00:00
weichen ed6dd79fd5 Record the sync checkpoint
Why: bind the task validation checkpoint to the latest integration baseline.

Evidence: SELF recursive component checks; sync_base=3fb8210f6495a78e70a67af3661bdfe9c00fb9de; candidate=b7dbd91d41b7ba4f45a2f9a6d5270e0fad952f68.

Impact: task metadata only.

Refs: .task/feature-svc-login-recovery-flow.md
2026-10-13 03:54:23 +00:00
weichen b7dbd91d41 Record the sync checkpoint
Why: bind the task validation checkpoint to the latest integration baseline.

Evidence: SELF recursive component checks; sync_base=3fb8210f6495a78e70a67af3661bdfe9c00fb9de; candidate=192795cc97f698c1f3f20531cecc5cef533ef1b1.

Impact: task metadata only.

Refs: .task/feature-svc-login-recovery-flow.md
2026-10-13 03:53:45 +00:00
weichen 192795cc97 Record build evidence in the task card 2026-10-13 03:53:18 +00:00
weichen e4d9eda8e7 Record composite test evidence in the task card 2026-10-13 03:52:54 +00:00
weichen deb675fb6d Pin backend and frontend to the login recovery implementation
Why: The Dev composite must carry the exact backend (467718a) and
frontend (9fc7da2) commits implementing the login recovery contract.

Evidence: component branches pushed to their origins; make test runs in
this task worktree validate the composite (receipts in task card).

Impact: gitlink bump only; no other Dev tree changes.

Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md
2026-10-13 03:44:03 +00:00
weichen f35c3bfdad Add login recovery contract and task card baseline
Why: The 2026-10-13 login flow plan requires a frozen contract record
(three adjudications against the r2 proposal) and a traceable task card
before implementation merges.

Evidence: doc-only commit; acceptance matrix cites backend/frontend test
files added in companion commits (SELF).

Impact: docs/svc-deploy/2026-10-13-login-recovery-contract.md becomes
the authoritative login-recovery contract; task card records user
authorization and requirement table L1-L9.

Refs: modules/documents/docs/proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2
2026-10-13 03:43:49 +00:00
weichen 4c01ec52a1 Record the task card for feature-svc-login-recovery-flow
Why: establish the authorized task workspace and its initial baseline.

Evidence: preserved precheck receipt in .task/feature-svc-login-recovery-flow.md; R0=3fb8210f6495a78e70a67af3661bdfe9c00fb9de.

Impact: task metadata only; the feature workspace starts at 3fb8210f64.

Refs: .task/feature-svc-login-recovery-flow.md
2026-10-13 03:19:45 +00:00