I1204 — The session is signed, short, and revocable from the server

BLOCKED wave 3 · p0 · implementation profile · runs alone

Part of web-sign-in — The deployed surfaces know who is asking, and the identity providers are data.

Objective

Issue the session as a signed cookie carrying an opaque identifier, keep the server-side record needed to revoke it, set HttpOnly, SameSite and Secure according to how the surface is served, expire it, and implement sign-out as a server-side revocation rather than a cleared cookie.

Why

A cookie that only the browser can invalidate cannot be signed out of, and a session that carries claims in its payload cannot be revoked when the provider set changes underneath it.

Current state

No cookie, no session, no signing key handling.

Desired state

A session exists as long as it is meant to, survives a restart only if that is the stated decision, and is gone from the server the moment sign-out is called.

Scope

• apps/majordomus-cli/src/identity
• apps/majordomus-cli/src/http
• apps/majordomus-cli/tests

Out of scope

• A session store shared between deployments
• Remembering anything about the reader between sessions

Dependencies

• I1203BLOCKED One flow serves every provider, and it refuses everything it did not start

What waits on this

• I1205BLOCKED Identity is resolved once, in the router, and every surface reads it from there
• I1207BLOCKED No credential reaches any output, and hostile provider metadata renders safely

Acceptance criteria

• The cookie is signed with a key that comes from the environment and is absent from every artifact
• Secure is set whenever the surface is served over anything but loopback, and the decision comes from the surface rather than from a constant
• Sign-out revokes server-side, and a revoked session is refused even if the cookie is replayed
• Expiry is enforced on the server, not only in the cookie's attributes

Validation

• cargo test --workspace --all-features
• bash test/run.sh

Evidence required

• cookie_attributes
• revocation_proved
• key_from_environment

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

A signing key with a compiled-in default is a signing key that ships. Its absence is a refusal to issue sessions, not a fallback.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I1204.yaml. Read it back with majordomus plan show I1204.