P15 — Authentication, OAuth and Account

[Techshrr]

P15 — Authentication, OAuth and Account

Parent tracker: #1
PR: #38 — merged
Base integration commit: 9258cb0f3f913b37b03aa8cf3c2938711314d3aa (P14)
Branch: develop/p15-authentication-oauth-account
Product-contract authority: 9ba89a42281709087b40cdcf0cb2eebd54952a99
Pre-sign implementation SHA: 1625c01164cecd1a5060997265f5c1fe004ca0ee
Signed exact HEAD: 6f39d87f1d94f71590fd79d4551cdd1cea652a76
Integration commit: dd70eacf02d4dd79fe82063f3d43610ab11885e8

Final status

COMPLETED / SIGNED EXACT-HEAD CLOSURE PASS / MERGED

• Frozen cases: P15-T001..P15-T029
• P15-T001..P15-T029: PASS on signed exact HEAD
• T028 exact-head coherence: PASS
• T029 accountable closure: PASS
• closure.json: status=PASS, phase=signed, merge_authoritative=true
• Input evidence: 28/28
• Required affected exact-head matrix: 50/50 SUCCESS
• P0: 0
• P1: 0
• DECISION REQUIRED: 0

Signed closure authority

• Final closure run: 32931945354
• Closure artifact: 9593689993
• Closure digest: sha256:5a43c87ea26f86081523d371de260e100a20c5c05b3581f48223fb70e68cd233
• T028 artifact: 9593683987
• T028 digest: sha256:7ce9b27d7d35dd1895f352b5b87a5d5f2c3836d73df53ee1fad705349077359c
• Signed-head contract guard artifact: 9593504107
• Signed-head contract guard digest: sha256:eb03fda16468c9d2867a8a51ec6205d437e75c0af9066083e88363aad8fe8e7e

The signed child is exactly one commit after reviewed pre-sign implementation SHA 1625c01164cecd1a5060997265f5c1fe004ca0ee and changes only artifacts/v10/P15/review.md. The signed revision itself reran all seven P15 producer workflows, T028 and the complete required 50-workflow affected matrix before T029 became merge-authoritative.

Closed P15 ownership

• CAP-AUTH P15 contribution: complete.
• CAP-OAUTH P15 contribution: complete.
• Authentication-facing CAP-TURNSTILE contribution: complete; later P17 ownership remains separate.
• Server-side credential/session authority, verification/recovery/login-email grants, CSRF/Origin/rate controls and account-enumeration-safe recovery: complete.
• OAuth providers are exactly google, facebook, github, qq, wechat, rainbow; state/PKCE/handoff/social registration and connected-account bind/unbind: complete.
• Account settings /app/settings/profile, /app/settings/security, /app/settings/sessions, /app/settings/connected-accounts: complete.
• Auth route, Workspace account and Admin OAuth browser authority: complete.
• P14 mail queue/template/native-mailworker authority remains inherited; P15 introduced no parallel SMTP authority.
• AUTH-INVITE remains P12-owned.
• Administrator/role/permission lifecycle remains P17-owned.

Handoff

P16 — Trust, Destination Risk and Abuse — is now active under Issue #39 / Draft PR #40 using integration base dd70eacf02d4dd79fe82063f3d43610ab11885e8. P16 must inherit this signed P15 authentication/OAuth/account authority without reinterpretation.

[Techshrr]

P15 implementation checkpoint — T001/T002 exact-head authority

Current exact implementation HEAD: 01ac4ddf2a474e6718c03fb6e2863beb081ba2fb.

• Frozen product-contract authority remains 9ba89a42281709087b40cdcf0cb2eebd54952a99.
• P15 contract guard run 32851650412 — PASS on the current descendant; repository-wide go test ./... passed inside the guard.
• P15 Real Authentication Integration run 32851650560 — PASS.
• Exact-head artifact: 9564607966 (p15-t001-t002-real-auth-01ac4ddf2a474e6718c03fb6e2863beb081ba2fb).
• Artifact digest: sha256:30dc80758b422cf282d52ee1f9139409be5d2943f1a2b95f682ce09a7bbe8559.
• P15-T001 — PASS: durable identity/session schema and correlation evidence against real MySQL 8.4.11.
• P15-T002 — PASS: registration validation, normalized-account uniqueness, pending-verification account creation, expiry-bound/hash-only verification grant, key identity, audit correlation, and inherited P14 versioned mail queue/template integration.

Failed intermediate attempts remain historical and non-authoritative; they were not rewritten or hidden. No P15 Exit/merge claim exists.

Current focus: P15-T003 — Email verification expiry and replay. Implement single-use verification consumption, expiry/replay fail-closed behavior, activation only on valid consumption, and evidence with no raw verification material.

[Techshrr]

P15 implementation checkpoint — T003 exact-head authority

Current exact implementation HEAD: 38b06a1d0192a76680c9d1c0411efb8ae7995319.

• Frozen product-contract authority remains 9ba89a42281709087b40cdcf0cb2eebd54952a99.
• P15 contract guard run 32852628939 — PASS; repository-wide native compile/unit boundary passed.
• P15 Real Authentication Integration run 32852628912 — PASS.
• Exact-head artifact: 9564901337 (p15-t001-t003-real-auth-38b06a1d0192a76680c9d1c0411efb8ae7995319).
• Artifact digest: sha256:216546ca70c15bc9a9532323f94a8b141123bd122f24aeb26afa6c776832a905.
• P15-T001 — PASS.
• P15-T002 — PASS.
• P15-T003 — PASS: valid email verification consumes the grant exactly once and activates the pending account; invalid input fails without mutation; expired grants are invalidated/denied; reused grants return replay and cannot mutate terminal user/grant state. Evidence contains no raw verification material.

No P15 Exit/merge claim exists; PR #38 remains Draft.

Current focus: P15-T004 — Password login authority and account states.