Heimdall

Step-up assertion: pin per-app not-permitted budget and the 10.5 min prune horizon, name the tripped budget in the audit row, correct validation-order and audit docs

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

6ed6d8fa0d

2026-11-13 20:19:41 +00:00

Heimdall

Step-up assertion: audit a flood once per window, budget the not-permitted branch, base64url nonce, honest nonce retention and precondition docs

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

1259911632

2026-11-13 20:13:13 +00:00

Heimdall

Docs: app-asserted step-up route, step_up_method claim, Bifrost profile grant, architecture note, evidence line

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2f93809a29

2026-11-13 20:01:46 +00:00

Heimdall

App-asserted step-up: POST /v1/apps/{app}/step-up mints a same-session access token with step_up_at and step_up_method

App secret plus the member's live bearer for that app, a per-profile grant and method allowlist (bifrost only), a nonce spent once per session through the existing oauth_state_uses claim (no schema change), an in-process fixed-window rate per account and per app, and an audit row per assertion or post-secret refusal. Provider step-up sign-ins now label their proof provider:<name>.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

33a83c34c4

2026-11-13 19:59:26 +00:00

App-asserted step-up route: Bifrost asserts a native strong proof, Heimdall mints step_up_at + step_up_method #15

2026-11-13