Add OAuth login

GH-42

surfaced · 3 threads woven

◆ braid claim GH-423 threads dispatched from here, disjoint scopes

thread_afailed

Backendsrc/auth/

Intent — replay-safe token exchange under concurrent logins

agent_start · Claude Code

edit + go test ×9

2 attempts rejected

verify failed · 12/14

thread_bpassed

Frontendweb/login/

Intent — sign-in page that starts OAuth + handles callback

agent_start · Codex

build login page

kept: rendered sign-in

verify passed · e2e

thread_cpassed

Teststest/oauth/

Intent — cover valid / expired / replayed / malformed codes

agent_start · Claude Code

table-driven tests

kept: exchange + errors

verify passed · 14/14

Promote → octopus-merge b + c

thread_a woven in as evidence (not merged) · sign · decision record

Add OAuth login

GH-42

Braid state

surfaced3 threadspromotion ready

Execution

4agents636ktokens$7.03cost18mwall-clock

thread / agents

0 3m 6m 9m 12m 15m 18m

tokens · cost

thread_afailed

Backend src/auth/

2 agentsCCCC

Claude Code · refresh-token rotation

Claude Code · single-token reuse

347k $4.57

142k + 205k

thread_bpassed

Frontend web/login/

1 agentCx

Codex · login page · redirect flow

168k $1.34

1 agent

thread_cpassed

Tests test/oauth/

1 agentCC

Claude Code · table-driven tests

121k $1.12

1 agent

Timeline shows agent wall-clock by thread; the right column keeps tokens and cost visible.

Claude Code Codex verify dropped approach

Converged at 16m

octopus-merge b + c · $7.03 total · thread_a retained as evidence

Add OAuth login

GH-42

Work intent

local draft

Set out to do

Ship OAuth redirect/callback and prove token exchange stays replay-safe.

Agents did

Ran backend, frontend, and test threads; kept the failed backend attempt as evidence.

Why

Popup auth and optimistic token reuse failed; redirect flow and table tests survived.

Promote the verified candidate?

Gate statusAll gates clear · 5/52 workstreams passed · 0 violations.

Will not shipthread_a backend exchangeFailed 12 of 14 tests · evidence only.

Follow-upGH-49 · durable token storeResolve before the backend exchange ships.

Choose a disposition.

Signed events: Intent · Attempt · Decision · Verification.

✗

Backend · token exchange

src/auth/CClaude Code · Arjun

verify failed

IntentIntent

Server-side token exchange must stay replay-safe across simultaneous device logins.

ApproachesAttempt ×2

rejectedIn-memory refresh-token rotation

Concurrent-login race; failed test.

rejectedOptimistic single-token reuse

Replay succeeded; failed assertion.

No approach held; kept as evidence. Follow-up: GH-49.

VerdictVerification

verify failed · 12 / 14 tests

✓

Frontend · login page

web/login/xCodex · Arjun

verify passed

IntentIntentDeclaration

Add a sign-in page that kicks off the OAuth flow and handles the provider callback.

ApproachesAttempt ×2 · Decision

rejectedPopup-window flow

The auth popup is blocked by default in Safari and loses state on mobile browsers. Dropped.

chosenFull-page redirect + callback route

Works across every browser with no popup permission, carrying state in the OAuth state param. Chosen for cross-browser reliability over the popup's smoother feel.

VerdictVerification

verify passed · e2e green

✓

Tests · integration

test/oauth/CClaude Code · Arjun

verify passed

IntentIntentDeclaration

Cover the token-exchange endpoint across valid, expired, replayed and malformed codes.

ApproachesAttempt ×2 · Decision

rejectedOne test function per case

Five near-identical functions duplicated the exchange setup — harder to extend as cases grow.

chosenTable-driven cases

Single setup, one row per code state — trivial to add cases. Chosen to keep the suite maintainable as OAuth grows.

VerdictVerification

verify passed · 14 / 14 · coverage 91%

caching

GH-51

Review focusContinue spending on this run?Last event was 48s ago; thread_b is running and thread_c remains queued.

active · 1 running$4.80 open spend

Decision needed

Renew consent or stop the run

Work intent

running

Set out to do

Add caching for hot config reads and invalidate stale entries when writes land.

Agents did

Read-through cache passed verification; tag-based invalidation is running; cache tests are queued behind that API.

Why

TTL-only expiry was rejected because related keys would stay stale until timeout instead of invalidating on write.

Threads

Reconstructed live from each thread's signed event stream. thread_b is still emitting Attempt events; thread_c hasn't started.

✓

Cache layer · read-through

src/cache/CClaude Code · Arjun

verify passed

IntentIntentDeclaration

Add a read-through cache for hot config lookups so repeated reads don't hit the database.

ApproachesAttempt ×2 · Decision

rejectedWrite-through on every read

Writes back to the store on each hit — hammers the DB under read-heavy load, defeating the point.

chosenRead-through with lazy load

Populate on miss, serve from cache on hit. Chosen for the read-heavy config-access pattern.

VerdictVerification

verify passed · 9 / 9 tests

Invalidation · tag-based

src/cache/invalidate/xCodex · Arjun

running

IntentIntentDeclaration

Evict stale entries on write; support both TTL and tag-based invalidation.

ApproachesAttempt · in progress

rejectedTTL-only expiry

Simplest, but can't target related keys on a single write — stale reads until the TTL lapses.

runningTag-based reverse index

Building a tag→keys map so a write can evict every related entry. Agent is mid-implementation.

Verdictpending

running · agent active · no verdict yet

⋯

Tests · cache suite

test/cache/CClaude Code · Arjun

queued

IntentIntentDeclaration

Cover hit / miss / evict paths plus TTL-expiry behaviour.

Statusqueued

Queued — waiting on thread_b's invalidation API before the eviction tests can be written. No agent dispatched yet.

rate limits

GH-38

Review focusDecision record verifiedAll three implementation threads merged and the promoted architecture is sealed.

promoted3 threads · sealed

Decision recordedResolved · promoted

Work intent

sealed

Set out to do

Add route-aware rate limits with a token-bucket core, middleware integration, and coverage for burst behavior.

Agents did

Three threads passed: limiter core, per-route middleware, and the rate-limit test suite.

Why

Fixed-window counting was rejected because window boundaries permit a double burst; token-bucket refill gives smoother enforcement.

Threads

Reconstructed from each thread's signed event stream. This braid is promoted — its provenance is sealed in the decision record.

✓

Limiter core · token-bucket

src/ratelimit/CClaude Code · Arjun

verify passed

IntentIntentDeclaration

Add a token-bucket rate limiter with smooth refill, so bursts are absorbed without spiking at window edges.

ApproachesAttempt ×2 · Decision

rejectedFixed-window counter

Cheap, but allows a double burst across the window boundary — 2× the limit in a short span. Dropped.

chosenToken-bucket with refill

Smooths bursts by refilling tokens over time. Chosen for even rate enforcement under spiky traffic.

VerdictVerification

verify passed · 11 / 11 tests

✓

Middleware · per-route

src/middleware/xCodex · Arjun

verify passed

IntentIntentDeclaration

Wrap HTTP handlers with per-route limits that read from the limiter core.

ApproachesAttempt · Decision

chosenPer-route middleware

Each route declares its own limit; the middleware keys the bucket by route + client. Chosen over a single global limiter for granularity.

VerdictVerification

verify passed · e2e green

✓

Tests · limit suite

test/ratelimit/CClaude Code · Arjun

verify passed

IntentIntentDeclaration

Cover burst absorption, steady-state throughput and limit-exceeded responses.

ApproachesAttempt · Decision

chosenTable-driven cases

One row per traffic shape (burst, steady, over-limit). Chosen to make new limit policies trivial to test.

VerdictVerification

verify passed · 18 / 18 · coverage 94%

Decision record

The sealed provenance record created on promote. It stays local-first while the team iterates, then can be published from the same evidence when the workflow hardens.

local record a1c9f7d✓ ed25519 verified

{
  "braid":       "braid_0190e7c2",
  "issue":       "GH-38",
  "title":       "rate limits",
  "state":       "promoted",
  "contributor": "962e8001…",
  "merge_commit":"a1c9f7d",   // octopus-merge a + b + c
  "threads": [
    { "id":"a", "scope":"src/ratelimit/",  "harness":"claude-code", "verdict":"passed", "tests":"11/11" },
    { "id":"b", "scope":"src/middleware/", "harness":"codex",       "verdict":"passed", "tests":"e2e" },
    { "id":"c", "scope":"test/ratelimit/", "harness":"claude-code", "verdict":"passed", "tests":"18/18" }
  ],
  "events":       14,
  "cost_usd":     3.81,
  "promoted_at":  "2026-07-05T09:12:04Z",
  "signature":    "ed25519:3f9a2b…c1"
}

Gates & guards

✓Scope-disjoint

✓All threads terminal

✓≥1 passed

✓0 violations

✓Goal not pending

Provenance

events 16 signed

contributor 962e8001…

on promote decision record

✗ thread_a src/auth/

token.go ± exchange.go ±

✓ thread_b web/login/

LoginPage.tsx + callback.ts +

✓ thread_c test/oauth/

exchange_test.go +

Add OAuth login

GH-42

The diff, traced back to the braid. Every hunk shows which thread wrote it and whether that thread's verdict held — so you read what changed and why it survived in one place.

src/auth/token.goevidence · not mergedthread_a — 2 attempts rejected, verify failed

- func Exchange(code string) (*Token, error) {- t := refreshInMemory(code) // race under concurrent logins- return t, nil- }

web/login/LoginPage.tsxmergedthread_b — kept, e2e passed

+ export function LoginPage() {+ return <SignInButton onSuccess={handleCallback} />+ }

test/oauth/exchange_test.gomergedthread_c — 14/14

+ func TestExchange_ReplaySafe(t *testing.T) {+ // table-driven: valid, expired, replayed, malformed+ }

⌕ main · braidkit/Prototype

Judgment queue

3 judgments need attention · $11.83 recorded cost

!

Replay-safe token storeGH-49needs humanstale 1d

Reconfirm GH-49 before work starts?

The goal is one day old and no scopes have been dispatched.

RecommendedReconfirm the goal and proposed scope.If deferredGH-42's replay-safety follow-up remains unresolved.

✓

Add OAuth loginGH-42surfaced · ready to promoteall gates clear

Promote GH-42 with thread_a kept as evidence?

Three threads are terminal: two passed and one rejected approach remains useful evidence.

RecommendedPromote the braid and preserve thread_a.If deferredThe verified candidate remains surfaced but unsealed.

◆

cachingGH-51active · 1 running$4.80 open spend

Continue GH-51 after 48s without an event?

thread_b is running, thread_c is queued, and the braid has $4.80 in open spend.

RecommendedInspect activity before allowing more spend.If deferredCost may continue while consent remains ambiguous.

Scratch

Unsigned local work waiting to attach into a braid.

3 sessions · explicit attach

⌕ local · unsigned

Scratch to attach

3

◆

CSV export work

src/reports · web/reports · test/reports — grouped by repo and adjacent work.

CC

Generate report CSV scratch

src/reports/export/ · 980 events · 14m ago · reverted once

ses_a1b2c3 · Claude Code · local, unsigned

Cx

Add the Export button scratch

web/reports/ · 610 events · 22m ago

ses_b4d5e6 · Codex · local, unsigned

CC

CSV formatting tests scratch

test/reports/ · 430 events · 5m ago

ses_c7f8a9 · Claude Code · local, unsigned

3 selectedchoose target braid before signing · no auto-attach

All braids

Full braid inventory across active, surfaced, promoted, and dropped lifecycle states. Scratch lives separately until attached.

4 braids · 1 ready

⌕ main · braidkit/Prototype

Issue

Lifecycle

Threads

Gate

Activity

caching GH-51

src/cache · invalidation thread running, tests queued

active3 of 5

3 threads

1 passed · 1 running · 1 queued

blockedterminal boundary open

48s ago

382k · $4.80 open spend

Add OAuth login GH-42

web/login · callback flow · failed backend evidence retained

surfaced4 of 5

3 threads

2 passed · 1 evidence

readyall promote gates clear

18m ago

636k · $7.03

Replay-safe token store GH-49

follow-up discovered from GH-42 thread_a

claimed1 of 5

0 threads

dispatch not started

reconfirmgoal pending

1d ago

4 events · $0.00

rate limits GH-38

src/ratelimit · middleware · tests merged with decision record

promoted5 of 5

3 threads

3 passed · merged

sealedrecord verified

3d ago

376k · $3.81

Add OAuth login

caching

Replay-safe token store

rate limits

caching

Replay-safe token store

Add OAuth login

rate limits

Add OAuth login

Work intent

Promote the verified candidate?

caching

Work intent

Replay-safe token store

Work intent

rate limits

Work intent

Add OAuth login

caching

Replay-safe token store

rate limits

Judgment queue

Scratch

Scratch to attach

All braids

Confirm decision

Full intent trace