araharah-executor e9aec5833b feat(02-02): TTL-only KV sessions with rotate-on-new + PRIV-02 storage gates (D-06/D-07/D-08/D-14) ...

- sessions.ts: mintSession (crypto.randomUUID opaque token, T-02-05), rotate-on-new deletes prior session record via chat pointer (D-07), both puts carry expirationTtl: SESSION_TTL_SECONDS on the call line (PRIV-02)
- SESSION_TTL_SECONDS = 900 pairs the session envelope with the D-13 freshness window
- SessionClaim is exactly D-08: user_id, chat_id, issued_at, language_code — nothing else serializes to storage
- sessions.test.mjs: in-memory KV fake asserting finite expirationTtl on every put; D-08 key-set equality; rotate removes old token; expired-token → null (D-14 class)
- privacy.test.mjs: PG1 same-line expirationTtl source gate (auto-tightens to webhook.ts when plan 03 adds it) + PG2 no persistence-shaped exports
- 18/18 PASS across initdata + sessions + privacy suites; full plan GREEN

2026-10-22 11:43:20 +08:00

..

harness.mjs

test(02-01): hand-rolled harness + RED initdata vector suite (D-12, TDD RED)

2026-10-22 11:38:06 +08:00

initdata.test.mjs

test(02-01): hand-rolled harness + RED initdata vector suite (D-12, TDD RED)

2026-10-22 11:38:06 +08:00

privacy.test.mjs

feat(02-02): TTL-only KV sessions with rotate-on-new + PRIV-02 storage gates (D-06/D-07/D-08/D-14)

2026-10-22 11:43:20 +08:00

runner.mjs

test(02-01): hand-rolled harness + RED initdata vector suite (D-12, TDD RED)

2026-10-22 11:38:06 +08:00

sessions.test.mjs

feat(02-02): TTL-only KV sessions with rotate-on-new + PRIV-02 storage gates (D-06/D-07/D-08/D-14)

2026-10-22 11:43:20 +08:00