ahmed mohammedandClaude Opus 4.7
8b42a0931c
kb/ is its own wiki root: 34 pages across 7 categories, index.md catalog, log.md, AGENTS.md schema layer, and raw/ holding copies of README, the spec, the 13-task plan, the design master and the SDD ledger. Every page cross-references 3 to 6 others and all 107 wikilinks resolve except two [["list"]] artefacts inside JSON snippets in the copied plan. Kept separate from the repository root on purpose: its generated graph lands in kb/.ua/ instead of overwriting the code graph. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
745 B
745 B
Session cookie rules
The session cookie holds a 32-byte random token; only its hash is stored, and the expiry is enforced in SQL.
httpOnly and sameSite: lax always.
Secure is set from the request, not the build: only when X-Forwarded-Proto reports https, or when
COOKIE_SECURE=1 is set for a direct TLS deploy. The previous rule (secure: NODE_ENV === "production") meant a
production build on plain http://localhost asked browsers for a Secure cookie. Chromium allows that on localhost;
Safari refuses to store it at all, so every page after signup looked signed-out and the wizard appeared to sign
users out. A Chromium-only suite could never observe it.
Related: WebKit in QA, First-run gate, Running locally.