stwaidele/dorfteich

#296: remove the unsubscribe-token dual-verify window early #299

Merged

fable-5 merged 1 commits from issue-296-remove-legacy-verify into main

2026-07-31 23:19:43 +02:00

Author	SHA1	Message	Date
Claude Fable 5	1f56f34113	#296 : remove the unsubscribe-token dual-verify window early All checks were successful CD / Smoke tests against Test (push) Successful in 1m25s Details CD / Promote to Int (push) Successful in 12s Details Release / Build release images and notes (push) Successful in 3m31s Details Release / Release-candidate operations QA (push) Successful in 46s Details CI / Build container images (push) Has been skipped Details Prod deploy / Deploy the released images to Prod (push) Successful in 58s Details CI / Import/export fidelity gate (push) Successful in 59s Details CI / Lint, typecheck, test (push) Successful in 6m40s Details CI / Auth e2e pack (push) Successful in 8m21s Details Restore drill / Restore the latest backup into a scratch stack (push) Successful in 1m18s Details CI / Build container images (pull_request) Successful in 2m53s Details CI / Auth e2e pack (pull_request) Successful in 8m34s Details CI / Lint, typecheck, test (pull_request) Successful in 6m22s Details CI / Import/export fidelity gate (pull_request) Successful in 59s Details CD / Build and push images (push) Successful in 19s Details CD / Deploy to Test (push) Successful in 14s Details Operator decision at the ADR 0020 acceptance: verification is subkey-only now instead of waiting for the stated 2026-11-01 expiry. Links in digest mails sent before the #188 key separation stop working; recipients use the in-app notification settings. A regression test pins that the legacy derivation (root key + purpose prefix) can never verify again; security.md records the removal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8	2026-07-31 23:03:03 +02:00