feat: MFA challenge + trusted-device grants (#1005 slice 3) - #1009

Merged

milkway merged 12 commits into

mainfrom

Jul 18, 2026

feat: MFA challenge + trusted-device grants (#1005 slice 3)

milkway
and
claude
committed
fix: strip MFA cookies from proxied requests + honest revoke-all label (#1005 slice 3 review)

milkway
and
claude
committed
fix: security epoch closes the revocation/challenge race (#1005 slice 3 review r2)

milkway
and
claude
committed
fix: per-grant epoch + immutable 0029 (#1005 slice 3 review r3)

milkway
and
claude
committed
fix: transactional grant issuance — recovery rollback + cookie rotation (#1005 slice 3 review r4)

milkway
and
claude
committed
fix: read-order in evaluate + TOTP step inside the issue tx (#1005 slice 3 review r5)

milkway
and
claude
committed
fix: recovery-code challenges work without the master key (#1005 slice 3 review r6)

milkway
and
claude
committed
fix: consistent lock order + exclusive grant rotation (#1005 slice 3 review r7)

milkway
and
claude
committed
fix: one grant per browser-session via UPSERT (#1005 slice 3 review r8)

milkway
and
claude
committed
feat: enrollment establishes the initial device proof (#1005 slice 3, from slice-4 review)

milkway
and
claude
committed
fix: lock the factor row on every issuance + sweep expired grants (#1005 slice 3 review r9)

milkway
and
claude
committed
fix: write-lock the epoch check + parent-before-child lock order (#1005 slice 3 review r10)

milkway
and
claude
committed

Provide feedback