Author	SHA1	Message	Date
Heimdall	1259911632	Step-up assertion: audit a flood once per window, budget the not-permitted branch, base64url nonce, honest nonce retention and precondition docs ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-13 20:13:13 +00:00
Heimdall	33a83c34c4	App-asserted step-up: POST /v1/apps/{app}/step-up mints a same-session access token with step_up_at and step_up_method ... App secret plus the member's live bearer for that app, a per-profile grant and method allowlist (bifrost only), a nonce spent once per session through the existing oauth_state_uses claim (no schema change), an in-process fixed-window rate per account and per app, and an audit row per assertion or post-secret refusal. Provider step-up sign-ins now label their proof provider:<name>. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-13 19:59:26 +00:00