Claude Fable 5
214e707102
All checks were successful
CI / Build container images (pull_request) Successful in 3m27s
CI / Auth e2e pack (pull_request) Successful in 7m51s
CI / Lint, typecheck, test (pull_request) Successful in 4m49s
CI / Import/export fidelity gate (pull_request) Successful in 1m1s
CD / Build and push images (push) Successful in 19s
CD / Deploy to Test (push) Successful in 13s
CD / Smoke tests against Test (push) Successful in 1m19s
CD / Promote to Int (push) Successful in 12s
CI / Lint, typecheck, test (push) Successful in 4m54s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 7m51s
CI / Import/export fidelity gate (push) Successful in 54s
The tampered-token case flipped the LAST base64url character of the signature. Its low bits are padding that decoders ignore, so whenever a signature ends in 'A' (~1/16 of tokens) the flip to 'B' decodes to the same bytes and the token verifies — jose compares decoded bytes, unlike the pre-#188 homegrown code that compared encoded strings. Reproduced deterministically (20/20 A-ending signatures accepted the flip); CI run 477 and one local full-suite failure were this, not load. Flipping the first character makes the tamper always significant. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ |
||
|---|---|---|
| .. | ||
| testing | ||
| access-listener.db.test.ts | ||
| access-listener.test.ts | ||
| access-listener.ts | ||
| auth.test.ts | ||
| db.ts | ||
| health.test.ts | ||
| health.ts | ||
| index.ts | ||
| logger.ts | ||
| maintenance-listener.test.ts | ||
| maintenance-listener.ts | ||
| persistence.db.test.ts | ||
| persistence.test.ts | ||
| persistence.ts | ||
| restore-listener.db.test.ts | ||
| restore-listener.ts | ||
| server.test.ts | ||
| server.ts | ||
| session-registry.db.test.ts | ||
| session-registry.ts | ||
| task-toggle-listener.ts | ||
| version-store.db.test.ts | ||
| version-store.ts | ||
| yjs-content.ts | ||