mikebrandon/here-telemetry-rnd
1
0
Fork 0
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

Sign the session's start, on the row and on the log, with the same signature #20

Merged
LNK merged 1 commit from claude/session-signature into main 2026-09-04 21:45:46 +00:00
Conversation 0 Commits 1 Files changed 11 +107 -14
LNK commented 2026-09-04 21:45:45 +00:00
Contributor
Copy link

The session row's signature column was always null and the session-start record was unsigned; consent could not be back-dated but the session it belonged to could.

What changes. The session-start record names its device and is signed by the device key over its canonical JSON, and the same signature is stored on the session row, so row and record vouch for each other. It is written when the start goes on the log, which is the moment there is consent to record it under. The server checks session-start lines the way it checks consent lines.

Proof. The record on the log verifies against the store's key and carries the row's signature; a moved start time verifies against nothing; the adapter accepts a signed start and refuses a moved one. A journal that does not sign fails the test. Linux verifier green on the pinned toolchain; 67 adapter tests pass. Known window: a client built between the device key and this change sends an unsigned start under a keyed header and has that one line refused until updated.

The session row's `signature` column was always null and the session-start record was unsigned; consent could not be back-dated but the session it belonged to could. **What changes.** The session-start record names its device and is signed by the device key over its canonical JSON, and the same signature is stored on the session row, so row and record vouch for each other. It is written when the start goes on the log, which is the moment there is consent to record it under. The server checks session-start lines the way it checks consent lines. **Proof.** The record on the log verifies against the store's key and carries the row's signature; a moved start time verifies against nothing; the adapter accepts a signed start and refuses a moved one. A journal that does not sign fails the test. Linux verifier green on the pinned toolchain; 67 adapter tests pass. Known window: a client built between the device key and this change sends an unsigned start under a keyed header and has that one line refused until updated. 
The session row had a `signature` column that was always null, and the session-start record
on the log had no signature at all. Consent could no longer be back-dated; the session it
belonged to could. A signed agreement inside an unsigned session is a lock on a door in an
open wall.

The session-start record now names its device and is signed by the device key over its
canonical JSON, the way consent is, and the same signature is stored on the session row —
so the row and the record vouch for each other, and moving the start time on either leaves
neither verifying. It is written when the session's start goes on the log, which since
consent became an act is the moment there is consent to record it under. The server checks
session-start lines the way it checks consent lines: under a header that names the device's
key, one that does not verify is refused.

Tests: the session-start record on the log names its device, verifies against the store's
key, and carries the same signature as the row; a moved start time verifies against nothing;
the adapter accepts a signed session start and refuses one whose start time moved. The
verify test fails against a journal that does not sign the record — checked, by removing the
signature.

A client built between the device key and this change sends its session start unsigned under
a header that names its key; the server refuses that line, once, until the client is
updated. That window is one day of builds and is stated rather than papered over.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
LNK merged commit 4300129227 into main 2026-09-04 21:45:46 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
mikebrandon/here-telemetry-rnd!20
No description provided.