Objective
During Platform #501 live acceptance, an API startup outage caused discovery to fail before refresh-token submission, but the CLI erased the session. Preserve the encrypted session for failures before refresh begins. Keep ambiguous or rejected refresh fail-closed to avoid reuse of possibly rotated credentials.
Inputs and interfaces
Current staging 3127d76; createControlPlaneClient and updateServerSession serialized custody transaction. No token output or credential configuration changes.
Acceptance
- Discovery failure preserves session and team selection.
- No token refresh is attempted when discovery fails.
- Ambiguous refresh still clears only the selected session.
- Concurrent refresh, team selection and logout remain serialized.
- Unit tests and Actions on exact PR head; live development rebuild.
Dependencies / rollback
Independent repair during source isolation acceptance. Revert application commit if necessary; no schema migration. An already deleted session requires browser login; do not recover tokens from logs or backups.
Evidence
| Gate |
Evidence |
Status |
| Implementation |
Pending PR |
In progress |
| Tests / Actions |
Pending exact-head verification |
Pending |
Implementation evidence
Head 251a50e, PR 194. Resource discovery, issuer discovery, and ambiguous refresh tests all pass; four existing encrypted custody/concurrency/logout tests pass. Strict TypeScript and architecture checks pass. Local development distribution rebuilt. Required Actions remain the merge gate. Caller invalidation predicate is evaluated inside the same custody lock only after refresh starts; no credential-bearing request is made by failed discovery.
Accepted staging fix
PR #194 merged badc74f after Actions runs34551483971 and34551536699 passed. Local CLI distribution includes the fix. Existing cleared sessions still require user browser sign-in; no secret recovery or credential bypass was attempted.
Objective
During Platform #501 live acceptance, an API startup outage caused discovery to fail before refresh-token submission, but the CLI erased the session. Preserve the encrypted session for failures before refresh begins. Keep ambiguous or rejected refresh fail-closed to avoid reuse of possibly rotated credentials.
Inputs and interfaces
Current staging 3127d76; createControlPlaneClient and updateServerSession serialized custody transaction. No token output or credential configuration changes.
Acceptance
Dependencies / rollback
Independent repair during source isolation acceptance. Revert application commit if necessary; no schema migration. An already deleted session requires browser login; do not recover tokens from logs or backups.
Evidence
Implementation evidence
Head 251a50e, PR 194. Resource discovery, issuer discovery, and ambiguous refresh tests all pass; four existing encrypted custody/concurrency/logout tests pass. Strict TypeScript and architecture checks pass. Local development distribution rebuilt. Required Actions remain the merge gate. Caller invalidation predicate is evaluated inside the same custody lock only after refresh starts; no credential-bearing request is made by failed discovery.
Accepted staging fix
PR #194 merged badc74f after Actions runs34551483971 and34551536699 passed. Local CLI distribution includes the fix. Existing cleared sessions still require user browser sign-in; no secret recovery or credential bypass was attempted.