Add OAuth login

GH-42

surfaced · 3 threads woven

◆ braid claim GH-423 threads dispatched from here, disjoint scopes

thread_afailed

Backendsrc/auth/

Intent — replay-safe token exchange under concurrent logins

agent_start · Claude Code

edit + go test ×9

2 attempts rejected

verify failed · 12/14

thread_bpassed

Frontendweb/login/

Intent — sign-in page that starts OAuth + handles callback

agent_start · Codex

build login page

kept: rendered sign-in

verify passed · e2e

thread_cpassed

Teststest/oauth/

Intent — cover valid / expired / replayed / malformed codes

agent_start · Claude Code

table-driven tests

kept: exchange + errors

verify passed · 14/14

Promote → octopus-merge b + c

thread_a woven in as evidence (not merged) · sign · decision record

Add OAuth login

GH-42

4 agents3 threads636k tokens$7.03 cost18m wall-clock

Timeline shows agent wall-clock by thread; the right column keeps tokens and cost visible.

Claude Code Codex verify dropped approach

thread / agents

0 3m 6m 9m 12m 15m 18m

tokens · cost

thread_afailed

Backend src/auth/

2 agentsCCCC

Claude Code · refresh-token rotation

Claude Code · single-token reuse

347k $4.57

142k + 205k

thread_bpassed

Frontend web/login/

1 agentCx

Codex · login page · redirect flow

168k $1.34

1 agent

thread_cpassed

Tests test/oauth/

1 agentCC

Claude Code · table-driven tests

121k $1.12

1 agent

Converged at 16m

octopus-merge b + c · $7.03 total · thread_a retained as evidence

Add OAuth login

GH-42

✓ Ready to promote

Gates clear · 2 passed · 1 evidence thread · 0 scope violations.

Work intent

local draft

Set out to do

Ship OAuth redirect/callback and prove token exchange stays replay-safe.

Agents did

Ran backend, frontend, and test threads; kept the failed backend attempt as evidence.

Why

Popup auth and optimistic token reuse failed; redirect flow and table tests survived.

Needs human

Promote this braid; GH-49 carries the replay-safe storage follow-up.

What next

Seal the decision record, then continue token storage as a separate braid.

Threads

Thread evidence from signed events: Intent · Attempt · Decision · Verification.

✗

Backend · token exchange

src/auth/CClaude Code · Arjun

verify failed

IntentIntent

Server-side token exchange must stay replay-safe across simultaneous device logins.

ApproachesAttempt ×2

rejectedIn-memory refresh-token rotation

Concurrent-login race; failed test.

rejectedOptimistic single-token reuse

Replay succeeded; failed assertion.

No approach held; kept as evidence. Follow-up: GH-49.

VerdictVerification

verify failed · 12 / 14 tests

✓

Frontend · login page

web/login/xCodex · Arjun

verify passed

IntentIntentDeclaration

Add a sign-in page that kicks off the OAuth flow and handles the provider callback.

ApproachesAttempt ×2 · Decision

rejectedPopup-window flow

The auth popup is blocked by default in Safari and loses state on mobile browsers. Dropped.

chosenFull-page redirect + callback route

Works across every browser with no popup permission, carrying state in the OAuth state param. Chosen for cross-browser reliability over the popup's smoother feel.

VerdictVerification

verify passed · e2e green

✓

Tests · integration

test/oauth/CClaude Code · Arjun

verify passed

IntentIntentDeclaration

Cover the token-exchange endpoint across valid, expired, replayed and malformed codes.

ApproachesAttempt ×2 · Decision

rejectedOne test function per case

Five near-identical functions duplicated the exchange setup — harder to extend as cases grow.

chosenTable-driven cases

Single setup, one row per code state — trivial to add cases. Chosen to keep the suite maintainable as OAuth grows.

VerdictVerification

verify passed · 14 / 14 · coverage 91%

caching

GH-51

◆ Active — 1 of 3 threads done

thread_a passed · thread_b running · thread_c queued · promote blocked until all threads are terminal.

Work intent

running

Set out to do

Add caching for hot config reads and invalidate stale entries when writes land.

Agents did

Read-through cache passed verification; tag-based invalidation is running; cache tests are queued behind that API.

Why

TTL-only expiry was rejected because related keys would stay stale until timeout instead of invalidating on write.

Needs human

Open spend is $4.80 and the last event is 48s old; decide whether consent still stands or drop the running work.

What next

Let thread_b finish or drop it. Promotion stays blocked until every thread reaches a terminal verdict.

Threads

Reconstructed live from each thread's signed event stream. thread_b is still emitting Attempt events; thread_c hasn't started.

✓

Cache layer · read-through

src/cache/CClaude Code · Arjun

verify passed

IntentIntentDeclaration

Add a read-through cache for hot config lookups so repeated reads don't hit the database.

ApproachesAttempt ×2 · Decision

rejectedWrite-through on every read

Writes back to the store on each hit — hammers the DB under read-heavy load, defeating the point.

chosenRead-through with lazy load

Populate on miss, serve from cache on hit. Chosen for the read-heavy config-access pattern.

VerdictVerification

verify passed · 9 / 9 tests

Invalidation · tag-based

src/cache/invalidate/xCodex · Arjun

running

IntentIntentDeclaration

Evict stale entries on write; support both TTL and tag-based invalidation.

ApproachesAttempt · in progress

rejectedTTL-only expiry

Simplest, but can't target related keys on a single write — stale reads until the TTL lapses.

runningTag-based reverse index

Building a tag→keys map so a write can evict every related entry. Agent is mid-implementation.

Verdictpending

running · agent active · no verdict yet

⋯

Tests · cache suite

test/cache/CClaude Code · Arjun

queued

IntentIntentDeclaration

Cover hit / miss / evict paths plus TTL-expiry behaviour.

Statusqueued

Queued — waiting on thread_b's invalidation API before the eviction tests can be written. No agent dispatched yet.

rate limits

GH-38

✓ Promoted

All 3 threads passed · merged to main · decision record sealed · promoted 3d ago.

Work intent

sealed

Set out to do

Add route-aware rate limits with a token-bucket core, middleware integration, and coverage for burst behavior.

Agents did

Three threads passed: limiter core, per-route middleware, and the rate-limit test suite.

Why

Fixed-window counting was rejected because window boundaries permit a double burst; token-bucket refill gives smoother enforcement.

Needs human

No open judgment. The promote decision is complete and the decision record is verified.

What next

Build on the promoted work; the sealed record keeps the evidence, merge point, and thread provenance together.

Threads

Reconstructed from each thread's signed event stream. This braid is promoted — its provenance is sealed in the decision record.

✓

Limiter core · token-bucket

src/ratelimit/CClaude Code · Arjun

verify passed

IntentIntentDeclaration

Add a token-bucket rate limiter with smooth refill, so bursts are absorbed without spiking at window edges.

ApproachesAttempt ×2 · Decision

rejectedFixed-window counter

Cheap, but allows a double burst across the window boundary — 2× the limit in a short span. Dropped.

chosenToken-bucket with refill

Smooths bursts by refilling tokens over time. Chosen for even rate enforcement under spiky traffic.

VerdictVerification

verify passed · 11 / 11 tests

✓

Middleware · per-route

src/middleware/xCodex · Arjun

verify passed

IntentIntentDeclaration

Wrap HTTP handlers with per-route limits that read from the limiter core.

ApproachesAttempt · Decision

chosenPer-route middleware

Each route declares its own limit; the middleware keys the bucket by route + client. Chosen over a single global limiter for granularity.

VerdictVerification

verify passed · e2e green

✓

Tests · limit suite

test/ratelimit/CClaude Code · Arjun

verify passed

IntentIntentDeclaration

Cover burst absorption, steady-state throughput and limit-exceeded responses.

ApproachesAttempt · Decision

chosenTable-driven cases

One row per traffic shape (burst, steady, over-limit). Chosen to make new limit policies trivial to test.

VerdictVerification

verify passed · 18 / 18 · coverage 94%

Decision record

The sealed provenance record created on promote. It stays local-first while the team iterates, then can be published from the same evidence when the workflow hardens.

local record a1c9f7d✓ ed25519 verified

{
  "braid":       "braid_0190e7c2",
  "issue":       "GH-38",
  "title":       "rate limits",
  "state":       "promoted",
  "contributor": "962e8001…",
  "merge_commit":"a1c9f7d",   // octopus-merge a + b + c
  "threads": [
    { "id":"a", "scope":"src/ratelimit/",  "harness":"claude-code", "verdict":"passed", "tests":"11/11" },
    { "id":"b", "scope":"src/middleware/", "harness":"codex",       "verdict":"passed", "tests":"e2e" },
    { "id":"c", "scope":"test/ratelimit/", "harness":"claude-code", "verdict":"passed", "tests":"18/18" }
  ],
  "events":       14,
  "cost_usd":     3.81,
  "promoted_at":  "2026-07-05T09:12:04Z",
  "signature":    "ed25519:3f9a2b…c1"
}

Gates & guards

✓Scope-disjoint

✓All threads terminal

✓≥1 passed

✓0 violations

✓Goal not pending

Provenance

events 16 signed

contributor 962e8001…

on promote decision record

✗ thread_a src/auth/

token.go ± exchange.go ±

✓ thread_b web/login/

LoginPage.tsx + callback.ts +

✓ thread_c test/oauth/

exchange_test.go +

Add OAuth login

GH-42

The diff, traced back to the braid. Every hunk shows which thread wrote it and whether that thread's verdict held — so you read what changed and why it survived in one place.

src/auth/token.goevidence · not mergedthread_a — 2 attempts rejected, verify failed

- func Exchange(code string) (*Token, error) {- t := refreshInMemory(code) // race under concurrent logins- return t, nil- }

web/login/LoginPage.tsxmergedthread_b — kept, e2e passed

+ export function LoginPage() {+ return <SignInButton onSuccess={handleCallback} />+ }

test/oauth/exchange_test.gomergedthread_c — 14/14

+ func TestExchange_ReplaySafe(t *testing.T) {+ // table-driven: valid, expired, replayed, malformed+ }

Developer dashboard

Judgment queue · 1 intervention · 1 ready to promote · 1 running spend check.

⌕ main · braidkit/Prototype

Judgment queue

$11.83 open spend · 3 decisions

!

Replay-safe token store GH-49needs human

reconfirm goalstale 1dfollow-up from GH-42 thread_a · no scopes dispatched

✓

Add OAuth login GH-42ready

all gates clear3 threads terminal · 2 passed · 1 evidence thread · $7.03

◆

caching GH-51running

open spend $4.80thread_b running · thread_c queued · no event for 48s

Scratch

Unsigned local work waiting to attach into a braid.

3 sessions · explicit attach

⌕ local · unsigned

Scratch to attach

3

◆

CSV export work

src/reports · web/reports · test/reports — grouped by repo and adjacent work.

CC

Generate report CSV scratch

src/reports/export/ · 980 events · 14m ago · reverted once

ses_a1b2c3 · Claude Code · local, unsigned

Cx

Add the Export button scratch

web/reports/ · 610 events · 22m ago

ses_b4d5e6 · Codex · local, unsigned

CC

CSV formatting tests scratch

test/reports/ · 430 events · 5m ago

ses_c7f8a9 · Claude Code · local, unsigned

3 selectedchoose target braid before signing · no auto-attach

All braids

Full braid inventory across active, surfaced, promoted, and dropped lifecycle states. Scratch lives separately until attached.

4 braids · 1 ready

⌕ main · braidkit/Prototype

Issue

Lifecycle

Threads

Gate

Activity

caching GH-51

src/cache · invalidation thread running, tests queued

active

3 threads

1 passed · 1 running · 1 queued

blockedterminal boundary open

48s ago

382k · $4.80 open spend

Add OAuth login GH-42

web/login · callback flow · failed backend evidence retained

surfaced

3 threads

2 passed · 1 evidence

readyall promote gates clear

18m ago

636k · $7.03

Replay-safe token store GH-49

follow-up discovered from GH-42 thread_a

active

0 threads

dispatch not started

reconfirmgoal pending

1d ago

4 events · $0.00

rate limits GH-38

src/ratelimit · middleware · tests merged with decision record

promoted

3 threads

3 passed · merged

sealedrecord verified

3d ago

376k · $3.81