Personal Harness

Sign in

Sign in

Your harness sends you a code instead of asking for a password. There is no password to lose.

We will send a six-digit code to this address.

Technical detail

The code is verified by verifyLogin in packages/auth, unchanged — the same function the OAuth consent flow calls, against the same login_challenges table (§5.2). What differs is only what happens afterwards: that flow hands the result to oidc-provider to mint a token; this one calls issueSession to set a cookie.

The session cookie is HttpOnly, Secure over HTTPS, SameSite=Lax, Path=/ and carries no Domain. Its token is 256 bits from the CSPRNG, stored only as a keyed HMAC under SESSION_SECRET (§11.3). Every page in this shell is rendered on the server, so the cookie is never handed to browser JavaScript.

There is no self-serve account creation yet (§19.1 line 1245 is Phase 7). An account is created with pnpm harness:create-person.