Add OAuth login

GH-42

surfaced · 3 threads woven

◆ braid claim GH-423 threads dispatched from here, disjoint scopes

thread_afailed

Backendsrc/auth/

Intent — replay-safe token exchange under concurrent logins

agent_start · Claude Code

edit + go test ×9

2 attempts rejected

verify failed · 12/14

thread_bpassed

Frontendweb/login/

Intent — sign-in page that starts OAuth + handles callback

agent_start · Codex

build login page

kept: rendered sign-in

verify passed · e2e

thread_cpassed

Teststest/oauth/

Intent — cover valid / expired / replayed / malformed codes

agent_start · Claude Code

table-driven tests

kept: exchange + errors

verify passed · 14/14

Promote → octopus-merge b + c

thread_a woven in as evidence (not merged) · sign · decision record

Add OAuth login

GH-42

Braid state

surfaced3 threadspromotion ready

Execution

4agents636ktokens$7.03cost18mwall-clock

thread / agents

0 3m 6m 9m 12m 15m 18m

tokens · cost

thread_afailed

Backend src/auth/

2 agentsCCCC

Claude Code · refresh-token rotation

Claude Code · single-token reuse

347k $4.57

142k + 205k

thread_bpassed

Frontend web/login/

1 agentCx

Codex · login page · redirect flow

168k $1.34

1 agent

thread_cpassed

Tests test/oauth/

1 agentCC

Claude Code · table-driven tests

121k $1.12

1 agent

Timeline shows agent wall-clock by thread; the right column keeps tokens and cost visible.

Claude Code Codex verify dropped approach

Converged at 16m

octopus-merge b + c · $7.03 total · thread_a retained as evidence

Add OAuth login

GH-42

Work intent

local draft

Set out to do

Ship OAuth redirect/callback and prove token exchange stays replay-safe.

Agents did

Ran backend, frontend, and test threads; kept the failed backend attempt as evidence.

Why

Popup auth and optimistic token reuse failed; redirect flow and table tests survived.

StatusReady for decisionTwo workstreams verified; the failed backend exchange remains evidence.

surfaced · ready2 passed · 0 violations

Decision neededPromote thread_b and thread_c?

Signed events: Intent · Attempt · Decision · Verification.

✗

Backend · token exchange

src/auth/CClaude Code · Arjun

failed

IntentIntent

Server-side token exchange must stay replay-safe across simultaneous device logins.

ApproachesAttempt ×2

rejectedIn-memory refresh-token rotation

Concurrent-login race; failed test.

rejectedOptimistic single-token reuse

Replay succeeded; failed assertion.

No approach held; kept as evidence. Follow-up: GH-49.

VerdictVerification

failed · 12 / 14 tests

✓

Frontend · login page

web/login/xCodex · Arjun

verified

IntentIntentDeclaration

Add a sign-in page that kicks off the OAuth flow and handles the provider callback.

ApproachesAttempt ×2 · Decision

rejectedPopup-window flow

The auth popup is blocked by default in Safari and loses state on mobile browsers. Dropped.

chosenFull-page redirect + callback route

Works across every browser with no popup permission, carrying state in the OAuth state param. Chosen for cross-browser reliability over the popup's smoother feel.

VerdictVerification

verified · e2e green

✓

Tests · integration

test/oauth/CClaude Code · Arjun

verified

IntentIntentDeclaration

Cover the token-exchange endpoint across valid, expired, replayed and malformed codes.

ApproachesAttempt ×2 · Decision

rejectedOne test function per case

Five near-identical functions duplicated the exchange setup — harder to extend as cases grow.

chosenTable-driven cases

Single setup, one row per code state — trivial to add cases. Chosen to keep the suite maintainable as OAuth grows.

VerdictVerification

verified · 14 / 14 · coverage 91%

caching

GH-51

StatusRun in progressthread_b running · thread_c queued · last signed event 48s ago.

active · 1 running$4.80 open spend

Decision needed

Continue this run?

Work intent

running

Set out to do

Add caching for hot config reads and invalidate stale entries when writes land.

Agents did

Read-through cache passed verification; tag-based invalidation is running; cache tests are queued behind that API.

Why

TTL-only expiry was rejected because related keys would stay stale until timeout instead of invalidating on write.

Threads

Reconstructed live from each thread's signed event stream. thread_b is still emitting Attempt events; thread_c hasn't started.

✓

Cache layer · read-through

src/cache/CClaude Code · Arjun

verified

IntentIntentDeclaration

Add a read-through cache for hot config lookups so repeated reads don't hit the database.

ApproachesAttempt ×2 · Decision

rejectedWrite-through on every read

Writes back to the store on each hit — hammers the DB under read-heavy load, defeating the point.

chosenRead-through with lazy load

Populate on miss, serve from cache on hit. Chosen for the read-heavy config-access pattern.

VerdictVerification

verified · 9 / 9 tests

Invalidation · tag-based

src/cache/invalidate/xCodex · Arjun

running

IntentIntentDeclaration

Evict stale entries on write; support both TTL and tag-based invalidation.

ApproachesAttempt · in progress

rejectedTTL-only expiry

Simplest, but can't target related keys on a single write — stale reads until the TTL lapses.

runningTag-based reverse index

Building a tag→keys map so a write can evict every related entry. Agent is mid-implementation.

Verdictpending

running · agent active · no verdict yet

⋯

Tests · cache suite

test/cache/CClaude Code · Arjun

pending

IntentIntentDeclaration

Cover hit / miss / evict paths plus TTL-expiry behaviour.

Statuspending

Pending — waiting on thread_b's invalidation API before the eviction tests can be written. No agent dispatched yet.

rate limits

GH-38

StatusPromotedToken-bucket core, route middleware, and tests are sealed together.

promoted3 threads · sealed

DecisionPromoted recorded

Work intent

sealed

Set out to do

Add route-aware rate limits with a token-bucket core, middleware integration, and coverage for burst behavior.

Agents did

Three threads passed: limiter core, per-route middleware, and the rate-limit test suite.

Why

Fixed-window counting was rejected because window boundaries permit a double burst; token-bucket refill gives smoother enforcement.

Threads

Reconstructed from each thread's signed event stream. This braid is promoted — its provenance is sealed in the decision record.

✓

Limiter core · token-bucket

src/ratelimit/CClaude Code · Arjun

verified

IntentIntentDeclaration

Add a token-bucket rate limiter with smooth refill, so bursts are absorbed without spiking at window edges.

ApproachesAttempt ×2 · Decision

rejectedFixed-window counter

Cheap, but allows a double burst across the window boundary — 2× the limit in a short span. Dropped.

chosenToken-bucket with refill

Smooths bursts by refilling tokens over time. Chosen for even rate enforcement under spiky traffic.

VerdictVerification

verified · 11 / 11 tests

✓

Middleware · per-route

src/middleware/xCodex · Arjun

verified

IntentIntentDeclaration

Wrap HTTP handlers with per-route limits that read from the limiter core.

ApproachesAttempt · Decision

chosenPer-route middleware

Each route declares its own limit; the middleware keys the bucket by route + client. Chosen over a single global limiter for granularity.

VerdictVerification

verified · e2e green

✓

Tests · limit suite

test/ratelimit/CClaude Code · Arjun

verified

IntentIntentDeclaration

Cover burst absorption, steady-state throughput and limit-exceeded responses.

ApproachesAttempt · Decision

chosenTable-driven cases

One row per traffic shape (burst, steady, over-limit). Chosen to make new limit policies trivial to test.

VerdictVerification

verified · 18 / 18 · coverage 94%

Decision record

The sealed provenance record created on promote. It stays local-first while the team iterates, then can be published from the same evidence when the workflow hardens.

local record a1c9f7d✓ ed25519 verified

{
  "braid":       "braid_0190e7c2",
  "issue":       "GH-38",
  "title":       "rate limits",
  "state":       "promoted",
  "contributor": "962e8001…",
  "merge_commit":"a1c9f7d",   // octopus-merge a + b + c
  "threads": [
    { "id":"a", "scope":"src/ratelimit/",  "harness":"claude-code", "verdict":"passed", "tests":"11/11" },
    { "id":"b", "scope":"src/middleware/", "harness":"codex",       "verdict":"passed", "tests":"e2e" },
    { "id":"c", "scope":"test/ratelimit/", "harness":"claude-code", "verdict":"passed", "tests":"18/18" }
  ],
  "events":       14,
  "cost_usd":     3.81,
  "promoted_at":  "2026-07-05T09:12:04Z",
  "signature":    "ed25519:3f9a2b…c1"
}

Gates & guards

✓Scope-disjoint

✓All threads terminal

✓≥1 passed

✓0 violations

✓Goal not pending

Provenance

events 16 signed

contributor 962e8001…

on promote decision record

✗ thread_a src/auth/

token.go ± exchange.go ±

✓ thread_b web/login/

LoginPage.tsx + callback.ts +

✓ thread_c test/oauth/

exchange_test.go +

Add OAuth login

GH-42

The diff, traced back to the braid. Every hunk shows which thread wrote it and whether that thread's verdict held — so you read what changed and why it survived in one place.

src/auth/token.goevidence · not mergedthread_a — 2 attempts rejected, verify failed

- func Exchange(code string) (*Token, error) {- t := refreshInMemory(code) // race under concurrent logins- return t, nil- }

web/login/LoginPage.tsxmergedthread_b — kept, e2e passed

+ export function LoginPage() {+ return <SignInButton onSuccess={handleCallback} />+ }

test/oauth/exchange_test.gomergedthread_c — 14/14

+ func TestExchange_ReplaySafe(t *testing.T) {+ // table-driven: valid, expired, replayed, malformed+ }

⌕ main · braidkit/Prototype

Judgment queue

4 judgments need attention · $58.83 recorded cost

Replay-safe token storeGH-49needs human · not startedstale 1d

Reconfirm GH-49 before work starts?

The goal is one day old and no scopes have been dispatched.

cachingGH-51active · 1 running$4.80 open spend

Continue GH-51 after 48s without an event?

thread_b is running, thread_c is pending, and the braid has $4.80 in open spend.

Dashboard reliabilityJIRA-5102surfaced · 2 unresolved~$47 recorded

Set the retry cap and resolve session-state ownership?

The note narrows 400-agent work to two decisions that still block shipping.

Add OAuth loginGH-42surfaced · readyall gates clear

Promote GH-42 with thread_a kept as evidence?

Three workstreams are terminal: two verified and one failed workstream remains evidence.

Scratch

Unsigned local work. Nothing enters braid history until you attach it.

3 sessions · local only

⌕ local · unsigned

Attachment queue

3

Review focuslocal · unsigned

Decision needed Attach these sessions as one work unit?

They share the CSV export goal and touch adjacent report scopes.

Consequence Create one draft braid

The selected sessions become signed evidence only after target confirmation.

3 selected · 2,020 events · 3 scopes

Selected sessionslocal provenance

Generate report CSV

src/reports/export/ · Claude Code · 14m ago

ses_a1b2c3 · 980 events · reverted once

review revert

Add the Export button

web/reports/ · Codex · 22m ago

ses_b4d5e6 · 610 events

unsigned

CSV formatting tests

test/reports/ · Claude Code · 5m ago

ses_c7f8a9 · 430 events

unsigned

All braids

Full braid inventory across active, surfaced, promoted, and dropped lifecycle states. Scratch lives separately until attached.

4 braids · 1 ready

⌕ main · braidkit/Prototype

Issue

Lifecycle

Threads

Gate

Activity

caching GH-51

src/cache · invalidation running, tests pending

active3 of 5

3 threads

1 verified · 1 running · 1 pending

blockedterminal boundary open

48s ago

382k · $4.80 open spend

Add OAuth login GH-42

web/login · callback flow · failed backend evidence retained

surfaced4 of 5

3 threads

2 verified · 1 failed evidence

readyall promote gates clear

18m ago

636k · $7.03

Replay-safe token store GH-49

follow-up discovered from GH-42 thread_a

claimed1 of 5

not started

0 dispatched workstreams

reconfirmgoal pending

1d ago

4 events · $0.00

rate limits GH-38

src/ratelimit · middleware · tests merged with decision record

promoted5 of 5

3 threads

3 verified · merged

sealedrecord verified

3d ago

376k · $3.81

Dashboard reliability JIRA-5102

retry behavior · session-state conflict · 2 findings need judgment

surfaced4 of 5

400 agents

2 workstreams need close review

blocked2 unresolved decisions

6h run

18.4M tokens · about $47

Add OAuth login

caching

Replay-safe token store

rate limits

caching

Replay-safe token store

Add OAuth login

rate limits

Add OAuth login

Work intent

caching

Work intent

Replay-safe token store

Work intent

rate limits

Work intent

Add OAuth login

caching

Replay-safe token store

rate limits

Judgment queue

Scratch

Attachment queue

All braids

Choose where this work belongs

Confirm decision

Full intent trace