Conversation
… just written
STACK.md decided on 2026-09-01 that our own products federate to
OrangeCat and keep no users, passwords or reset flows. The rule lived in
prose, and prose does not stop drift. Measured 2026-09-24 from each
product's live /api/auth/providers:
loki OrangeCat + email-password, github, google, local,
user-password, x-1a (seven ways in)
datacat + credentials
evig + credentials
petvity + credentials, google
surf-your-life + credentials, google
solon, heidi, substrata OrangeCat only
Each extra path is a second identity for the same person, a second reset
flow to secure, and a second place for a sign-out to miss.
own-product-signin-audit.mjs reads the same public endpoint the origin
audit already probes, so it judges what is DEPLOYED — no source parsing,
no secret, no quota. Who counts as ours comes from loki's /api/fleet/map
(owner = org, live, not a demo, not OrangeCat itself). The first draft
read apps.conf and could not see Loki at all: apps.conf omits the
handcrafted services, which is the same reason product-identity-audit
moved to the map. Client apps are never judged — their users belong to
the client, and STACK.md gives them their own auth.
Today's deviations are a RATCHET (own-product-signin.baseline):
- HELD rows print on every run, never read as a pass;
- a NEW provider fails even beside a baselined one;
- a baselined provider that is gone fails until its row is deleted;
- a row for something no longer an own product fails too.
Non-next-auth products SKIP and say this check cannot see them (today:
revamp-info, wild-spirit) — a stated blind spot, not a pass. A 5xx SKIPs
here because nextauth-origin-audit already fails it; paging twice for one
fault teaches people to ignore one of the two.
Runs daily as two steps in nextauth-origin.yml (if: !cancelled(), so a
red origin audit cannot hide it); its self-test also runs in ci.yml.
The Telegram alert text now names both findings.
Self-test: 17 checks, no network. Proved by mutation — tolerating every
extra provider turns three of them red. check-workflows.sh: 25 workflows
parse, 105 run blocks are shell.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
STACK.md decided on 2026-09-01 that our own products federate to OrangeCat and keep no users, passwords or reset flows. The rule lived in prose. Measured 2026-09-24 from each product's live
/api/auth/providers:What it reads: the same public endpoint the origin audit already probes — so it judges what is deployed. No source parsing, no secret. Ownership from loki's
/api/fleet/map(owner = org, live, not a demo, not OrangeCat itself). The first draft readapps.confand could not see Loki — apps.conf omits the handcrafted services. Client apps are never judged.Ratchet (
own-product-signin.baseline): HELD rows print every run; a new provider fails even beside a baselined one; a baselined provider that's gone fails until its row is deleted.Stated blind spot: non-next-auth products SKIP and say so (revamp-info, wild-spirit today).
Runs daily in
nextauth-origin.yml(if: !cancelled(), so a red origin audit can't hide it); self-test also inci.yml. 17 checks, no network, proved by mutation.check-workflows.sh: 25 workflows parse.🤖 Generated with Claude Code