Remove duplicate sign-in and render truthful device consent #37

Activity

1. adrianwebb commented on Aug 27, 2026

   

   adrianwebb

   on Aug 27, 2026

   ContributorAuthor

   More actions

   Follow-up acceptance found and corrected stale standards scene steps that still modeled credential entry on /auth/sign-in. PRs #39 and #40 now make the catalog match the implemented browser BFF: the sign-in page only continues to /auth/authorize, where credentials are entered once.

   Managed generation 69 evidence with the corrected catalog: API identity/team verifier 6/6; Admin/Reviewer browser circuits desktop 20/20, tablet 20/20, mobile 20/20. Admin 0.12.59-rc.16 publication is in progress.
2. adrianwebb commented on Aug 27, 2026

   

   adrianwebb

   on Aug 27, 2026

   ContributorAuthor

   More actions

   Follow-up acceptance from live device-login validation:

   • The authenticated path must land directly on the final CLI approval presentation.
   • The unauthenticated path must be sign in -> final CLI approval, with no Continue interstitial and no separate first-party Admin consent screen.
   • The credential form must complete the existing sealed PKCE/state/exact-callback treeseed-admin BFF transaction; API remains the credential and authorization authority.
   • /auth/authorize remains the explicit approval/denial boundary for clients that actually request account authorization.
   • Device permission and code presentation remain on the final approval page.

   This makes the observable device flow exactly Approve or Sign in -> Approve without introducing a generic first-party redirect exemption.
3. adrianwebb commented on Aug 27, 2026

   

   adrianwebb

   on Aug 27, 2026

   ContributorAuthor

   More actions

   Final managed evidence: Admin 0.12.59-rc.17 is active as component 0.12.59~rc17-1, image sha256:c53e7aa91582331dc35069fddec3fdd911bf67a97905b429b1702e05d573a6b7, on known-good receipt receipt-1787861393566. /healthz reports API ready. A real managed device exchange proved signed-out Sign in -> Approve, signed-in Approve, credentials entered once, no legacy Continue interstitial, successful one-use token exchange, and revocation cleanup. The exact active login guarantee passed with 1 passed / 0 failed / 0 blocked.
4. adrianwebb

   closed this as not plannedon Oct 7, 2026