Hare
f17b5212c7
Fence displayed identity and native prompt generations, classify secret-free outcomes, recover atomic addition receipts without restoring old credentials, and expose truthful own-key verification metadata. Preserve required verifier and enrollment authority boundaries. Include real-store, production browser, native CTAP2 and visible responsive regressions. Validation: root check/fmt; API 115; passkey security 25; Web unit 712/component 605; auth/entry/activation/hosting browsers; product auth E2E 8 and two explicit browser suites. Server suite: 1262 lib+12 CLI, 3 ignored and 2 environment-specific exclusions. State-name checker retains 15 byte-identical baseline findings; no new exceptions. Physical keys/mobile and hosted CI remain unverified.
server-api
HTTP contract shared by Workspace Server and Rust clients. Owns public DTOs, API declarations, and generated client/server adapters. workspace-server determines persistent resource authorization and state transitions; worker-runtime determines Runtime execution state.
Contract entry points
- [
ServerApi] — HTTP operations and transport metadata - [
ServerRequestContext] — Request context passed to Server authentication adapters - [
RequestActor] — Human identity and authentication method - [
WorkerRestoreRequest] / [WorkerRestoreResult] — Observation-based Restore intent and result