2 Commits

Include renames

Author	SHA1	Message	Date
araharah-executor	af691ae40e	fix(02-bot-skeleton-initdata-security): WR-03 honest rotate-on-new invariant + best-effort post-mint reconciliation (fold in IN-01b dead branch, IN-01c Phase-4 notes)	2026-10-22 20:21:11 +08:00
araharah-executor	e9aec5833b	feat(02-02): TTL-only KV sessions with rotate-on-new + PRIV-02 storage gates (D-06/D-07/D-08/D-14) ... - sessions.ts: mintSession (crypto.randomUUID opaque token, T-02-05), rotate-on-new deletes prior session record via chat pointer (D-07), both puts carry expirationTtl: SESSION_TTL_SECONDS on the call line (PRIV-02) - SESSION_TTL_SECONDS = 900 pairs the session envelope with the D-13 freshness window - SessionClaim is exactly D-08: user_id, chat_id, issued_at, language_code — nothing else serializes to storage - sessions.test.mjs: in-memory KV fake asserting finite expirationTtl on every put; D-08 key-set equality; rotate removes old token; expired-token → null (D-14 class) - privacy.test.mjs: PG1 same-line expirationTtl source gate (auto-tightens to webhook.ts when plan 03 adds it) + PG2 no persistence-shaped exports - 18/18 PASS across initdata + sessions + privacy suites; full plan GREEN	2026-10-22 11:43:20 +08:00