Why: Login recovery contract requires the real-browser acceptance spec (admin issue -> key-only redeem -> forced set-password -> relogin) in-tree; changepw spec needed the same deterministic gate synchronization.
Evidence: Both specs pass on an isolated auth-on instance (backend=467718a+frontend=9fc7da2), receipts be7ae9a2/b3a9e691 bound to Dev HEAD 268ef29 (SELF); committed files byte-identical to the validated copies.
Impact: New e2e/login-key.playwright.ts (env-guarded skip); changepw login() waits for the gate heading and success page, fixing a stale-fill race.
Refs: Dev PR #504; Dev contract doc section acceptance matrix.
Why: Login recovery contract requires the real-browser acceptance spec (admin issue -> key-only redeem -> forced set-password -> relogin) in-tree; changepw spec needed the same deterministic gate synchronization.
Evidence: Both specs pass on an isolated auth-on instance (backend=467718a+frontend=9fc7da2), receipts be7ae9a2/b3a9e691 bound to Dev HEAD 268ef29 (SELF); committed files byte-identical to the validated copies.
Impact: New e2e/login-key.playwright.ts (env-guarded skip); changepw login() waits for the gate heading and success page, fixing a stale-fill race.
Refs: Dev PR #504; Dev contract doc section acceptance matrix.
Why: The login recovery contract requires a real-browser acceptance
spec covering admin issue -> key-only redeem -> forced set-password ->
relogin, and the changepw spec needed the same deterministic gate
synchronization.
Evidence: Both specs pass against an isolated auth-on instance
(serve --auth on, binary backend=467718a+frontend=9fc7da2); receipts
be7ae9a2/b3a9e691 bound to Dev HEAD 268ef29 (SELF). changepw-form also
passes (5.9s) alongside login-key (12.2s) on a reused instance,
proving idempotency.
Impact: New e2e/login-key.playwright.ts (skip-guarded like existing
suites); changepw login() waits for the gate heading and success page
before returning to login, fixing a stale-fill race that submitted
empty gate fields.
Refs: Dev docs/svc-deploy/2026-10-13-login-recovery-contract.md; Dev PR #504.
weichen
merged commit 698fffd929 into main2026-10-13 04:57:57 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: Login recovery contract requires the real-browser acceptance spec (admin issue -> key-only redeem -> forced set-password -> relogin) in-tree; changepw spec needed the same deterministic gate synchronization.
Evidence: Both specs pass on an isolated auth-on instance (backend=467718a+frontend=9fc7da2), receipts be7ae9a2/b3a9e691 bound to Dev HEAD 268ef29 (SELF); committed files byte-identical to the validated copies.
Impact: New e2e/login-key.playwright.ts (env-guarded skip); changepw login() waits for the gate heading and success page, fixing a stale-fill race.
Refs: Dev PR #504; Dev contract doc section acceptance matrix.