glass beadian 643fbb94bc feat: OIDC phase 2 — session-bound refresh tokens, server-side logout ... Hub sessions gain an optional sid backed by auth_sessions (login/reissue write the row; POST /auth/logout revokes it; pre-phase2 tokens are refused at reissue so revocation applies from the next epoch bump). The OIDC provider issues rotating refresh tokens (oidc_refresh_tokens, SHA-256 at rest, family-wide revocation on reuse detection) that live and die with the consenting Hub session — an oCIS session can no longer outlive the sign-in that minted it, and Hub logout propagates at the next refresh instead of the next silent-authorize. Discovery advertises refresh_token. Migration 034; RLS via the audit_append definer pattern for the unauthenticated token-endpoint lookup.		2026-10-14 11:33:47 +00:00
..
api	feat: OIDC phase 2 — session-bound refresh tokens, server-side logout	2026-10-14 11:33:47 +00:00
archive-bot	Phase B: encrypted archive export bundles (age), power-level-gated export command, encryption-state linter	2026-10-12 12:46:56 +00:00
media-worker	Tactical Media Broadcast Hub — initial release	2026-10-10 11:56:42 +00:00
scheduler	feat: per-connection publish governance — auto, 1-admin, majority, consensus	2026-10-14 08:04:56 +00:00
web	feat: per-connection publish governance — auto, 1-admin, majority, consensus	2026-10-14 08:04:56 +00:00