Repository navigation
Document verified staging MFA session recovery and handoff - #715
Merged
Merged
Conversation
✅ Deploy Preview for luminous-fox-7c393f ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
Author
|
Delegated self-review at exact head ef7323d: nine Markdown files only; no runtime, Rules, IAM, billing, client, workflow or production mutation. Actual diff preserves safeguards, original release anomaly, specialist-only setup and both old bookmark targets; adds only the genuinely hosted-tested expired-session recovery and matching map. Local allowlist/procedure/bookmark/diagram and whitespace checks passed. No actionable source findings. Dave explicitly authorized self-review/admin merge as sole maintainer; all six exact-head CI jobs and their steps remain required before the override. No protected-environment or deployment bypass. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Expired-session MFA recovery and the final no-terminal handoff are now verified in disposable staging. Documents now give the tested sign-out/fresh-authenticator steps and preserve both old checklist bookmarks.
Officer impact: supervised staging officers can restore an expired session without terminal work. Ordinary officer provisioning, lost-authenticator recovery, real dues and production remain unavailable.
Officer documentation: OFFICER_START_HERE.md; docs/officers/{README,STAGING_COMMUNITY,SYSTEM_MAPS}.md; root architecture/security/operations/plan/backlog status.
Deployment evidence: existing Functionv2/native archive85,371bytes/d7169008 and Hosting57261ae verified afresh; Node22/min0/max2/256MB/30s, native MFA and Auth/Firestore App Check unchanged. Real expiry623s denied old session; actual UI cleared and fresh TOTP sign-in restored it. Independently renewed native App Check/fresh Auth200; old Auth/new attestation403; unchanged capability, then owner revocation403. Exact one account/two document cleanup verified twice, browser local access OFF, receiver/tabs/private kernels closed. No runtime or website deployment, production or real-payment action.
Proof: #711 (comment) . Historical release-command anomaly remains disclosed. Redacted diagnostic corrections are in that receipt, not hidden or treated as product fixes.
Validation: documentation-only nine-file allowlist; git diff --check; recovery procedure/required fields/old-new bookmark and diagram checks. Existing required exact-head CI remains a merge gate; no new workflow/dependency/build requirement. No schema or runtime migration.
Self-review/admin merge override is explicitly authorized by Dave as sole maintainer. Review the actual diff and all six exact-head CI jobs and steps before merge; no deployment bypass is authorized. #711 closes only after this final handoff merge/CI readback. #114/#115 and production policy remain separate.