fix: converge retained approval ttl

Author: misunders2d

README.md

@@ -567,6 +567,14 @@ from its immutable scope rows without replacing the scope or minting broader
 authority. Exact five-unit schema-v7 markers from v0.1.45 through published
 v0.1.50 may upgrade directly to v0.1.51.
 
+The v0.1.50→v0.1.51 transition also recognizes only the retained one-hour
+Approval hotfix shape. Before loading Approval, setup journals its exact
+configuration, restores the ordinary approval deadline to 600 seconds, keeps
+the communication-scope ceremony ceiling at 3600 seconds, and atomically
+replaces the file. A crash resumes from the journal; any other TTL or
+configuration shape fails closed, and pre-commit rollback restores the exact
+source bytes.
+
 
 Git tag `v0.1.23` reached the staging workflow, but CI stopped before npm
 staging because one hermetic interruption test mocked `/usr/bin/useradd` on a

RELEASE_MANIFEST.json

@@ -538,11 +538,11 @@
   "release_inputs": {
     "README.md": {
       "path": "README.md",
-      "sha256": "f0f4718b80cf5c71832918408e595b035456897ef7fdf0cd63315771ebc978bc"
+      "sha256": "f38316f7057642c892656ab0285341d9ceb9d8badd92e40e9875c48bc57eaac4"
     },
     "REQUIREMENTS_STATUS.md": {
       "path": "REQUIREMENTS_STATUS.md",
-      "sha256": "d6cf7dca30791edff1b30f0e7183c8ac0feb0581a09fa503652604a516e6e2da"
+      "sha256": "4902bed53dbcbd4416bbb09d3fe0d3d1a905eaa27e8c48c9861d7636f3d2a028"
     },
     "deploy/Dockerfile": {
       "path": "deploy/Dockerfile",
@@ -562,7 +562,7 @@
     },
     "docs/GATE_EVIDENCE.md": {
       "path": "docs/GATE_EVIDENCE.md",
-      "sha256": "3a77ff9ed6c5f704b2861c15e32cac37c9a0e28f9fbcdc8b6ce0bed650a9bb79"
+      "sha256": "6cc8a0d89e7eaa80f807d379f7217fb6aca41e579142886013b92a1bc70e2d97"
     },
     "docs/RELEASE_MANIFEST.md": {
       "path": "docs/RELEASE_MANIFEST.md",
@@ -602,13 +602,13 @@
     },
     "scripts/verify_release.py": {
       "path": "scripts/verify_release.py",
-      "sha256": "f15de21c614416d8225782a708bee8d6d5a30dab680ce79daae10f12f23e3512"
+      "sha256": "889d1031c819a77aac205d52337cfe0758c6978486166c687fccede7d098603b"
     }
   },
   "release_source_tree": {
     "algorithm": "sha256(path NUL bytes NUL)",
     "path": "src",
-    "sha256": "aecd5b67cf567f94eb68a983d534b7e4038638d941929ae880c2da36cf76492b"
+    "sha256": "29eca3e8579a1dcad12e3d94500157fd854e804a6cf29bddc17d3182d8685395"
   },
   "runtime": {
     "implementation": "CPython",

REQUIREMENTS_STATUS.md

@@ -438,10 +438,15 @@ published and historical release evidence:
   activation now materializes the complete schema-v7 collaboration projection
   atomically with scope commitment, while a committed legacy scope is repaired
   idempotently from its server-held source rows without replacement or generic
-  entitlement minting. The focused recovery lane reports **232 passed**; the
-  broad releasable-source lane reports **2210 passed and 22 expected
+  entitlement minting. The exact v0.1.50→v0.1.51 path additionally journals
+  and atomically normalizes only the retained one-hour generic Approval hotfix
+  to the bounded 600-second ordinary and 3600-second communication-scope TTL
+  split; retries resume and pre-commit rollback restores the source bytes,
+  while any other shape fails closed. The focused recovery lane reports
+  **237 passed**; the
+  broad releasable-source lane reports **2225 passed and 22 expected
   platform/dedicated-PostgreSQL skips**; and source plus two recursive packed
-  generations each report **2237 passed and 22 expected skips**. Two independent
+  generations each report **2252 passed and 22 expected skips**. Two independent
   builds are byte-identical, packaged local message/obligation processing
   reaches `recipient_committed`, and a fresh installed npm package passes exact
   endpoint routing with zero sibling reactions or residue. Dedicated

docs/ARCHITECTURE.md

@@ -911,6 +911,14 @@ secret is removed from the journal immediately after the signer file is
 durably installed and before authority mutation; either durable copy can
 resume the prepared phase, while a missing or mismatched copy fails closed.
 
+That same v0.1.50→v0.1.51 boundary recognizes the exact retained Approval
+hotfix that raised the generic request TTL to one hour. Setup records the
+Approval configuration in upgrade journal v3 before mutation, restores the
+ordinary request ceiling to 600 seconds, and preserves the distinct
+communication-scope ceiling at 3600 seconds. The write uses compare-and-swap;
+interruption resumes from the journal, pre-commit rollback restores the exact
+source bytes, and every non-matching configuration fails closed.
+
 Communication-scope completion and legacy-scope repair share one schema-v7
 single-scope materializer. Completion invokes it inside the transaction that
 commits the scope, entitlements, revoke powers, members, audit record, and

docs/GATE_EVIDENCE.md

@@ -84,7 +84,7 @@ Gate statuses used here:
 | Candidate npm `0.1.48` canonical post-C0 credential correction | Completed-C0 terminal credentials now resolve through the exact domain/principal-bound harness plus credential epoch; unknown or mismatched identity state remains fail-closed. Adds only the exact forward-only `0.1.47→0.1.48` five-unit marker edge and no database migration. | Focused lane: `547 passed, 5 skipped`; broad releasable-source lane: `2155 passed, 21 skipped`; recursive packed-package and installed-host upgrade evidence pending. | H-only correction evidence; no gate promotion. Affected IDs: `ID-006`, `ID-009`, `SEC-007`, `OPS-003`. |
 | Candidate npm `0.1.49` completed-C0 communication recovery | Permanent communication activation resolves the exact completed C0 pair; only the authenticated ordinary server harness may advance to its current active credential, while the C0 peer remains pinned to its enrolled credential absent separately verified succession. Terminal pre-commit retries converge without replacing committed authority. Signed message send, inbox, and acknowledgement requests bind the exact collaboration scope. Adds only the forward-only `0.1.48→0.1.49` five-unit marker edge and no database migration. | Focused lane: `645 passed, 5 skipped`; broad releasable-source lane: `2166 passed, 21 skipped`; recursive packed-package and installed-host upgrade evidence pending. | H-only correction evidence; no gate promotion. Affected IDs: `ID-001`, `ID-002`, `ID-004`, `ID-006`, `AUTH-001`, `AUTH-002`, `AUTH-003`, `AUTH-004`, `AUTH-007`, `AUTH-009`, `COM-001`, `COM-002`, `COM-003`, `COM-006`, `COM-009`, `COM-011`, `AVL-003`, `AVL-005`, `AVL-006`, `SEC-003`, `SEC-005`. |
 | Candidate npm `0.1.50` setup-usability, direct-upgrade, and communication-scope approval path | One guided server command over the strict request/plan/apply protocol; one server-origin-only guided laptop command with authenticated discovery defaults; content-free named phases; ten-minute server and five-minute laptop bounds; resumable blocker output; exact direct allowlist from v0.1.45–v0.1.49 schema-v7 five-unit markers; installed separate-process local communication/obligation roundtrip added to packed verification; explicit one-hour Approval request ceiling limited to `authorization.communication_scope.approve`, with all other approvals retaining the five-minute ceiling and short-lived WebAuthn challenges | Focused release lane: `681 passed, 5 skipped`; broad releasable-source lane: `2180 passed, 21 skipped`; source and two recursive packed generations: `2207 passed, 21 skipped` each; two byte-identical release builds; release manifest verifier passed; installed tarball journey passed from an unrelated prefix; installed-host, fresh-machine, and same-commit CI evidence pending | H/L-shaped local candidate evidence only. No production, owner-policy, external, privileged-host, or gate promotion. Affected IDs: `ID-006`, `AUTH-004`, `AUTH-007`, `COM-001`, `COM-002`, `COM-003`, `COM-006`, `COM-009`, `AVL-003`, `AVL-005`, `AVL-006`, `UX-001`, `UX-002`, `SEC-003`, `SEC-005`, `OPS-003`, `OPS-006`. |
-| Corrective v0.1.51 canonical-owner, schema-v7 projection, and expired-member replacement recovery | Exact enrolled-Core plus pinned-Approval-OIDC owner selection; transactional Approval owner/passkey adoption; current receipt-signer replacement; strict resumable signer/config journal; journaled Core OIDC/approver cutover; single-scope schema-v7 projection shared by atomic activation and idempotent legacy repair; separately approved same-principal expired-member replacement requires the exact scope owner, preserves role, tombstones the former harness, activates the enrolled replacement, increments membership/scope revisions once, recomputes canonical digests, cuts authorization over to current schema-v7 membership, and permits exact committed replay after request expiry; ambiguity, cross-principal/domain, replay, tamper, drift, partial-row, and conflicting-row rejection | Replacement-focused SQLite lane: `62 passed`; PostgreSQL contract collection: `82 passed, 8 dedicated-database skips`; `npm run check` source plus two recursively packed generations: `2247 passed, 22 skipped` each; release manifest, installed-byte local communication, exact-endpoint routing, and packaged v0.1.45 journey passed | Current source/package H/L-shaped evidence only. Dedicated PostgreSQL replacement execution, same-commit CI, installed-host setup/upgrade, and live server/laptop reliability evidence remain pending. No requirement or gate promotion. Affected IDs: `ID-001`, `ID-002`, `ID-005`, `ID-006`, `ID-009`, `AUTH-001`, `AUTH-002`, `AUTH-003`, `AUTH-004`, `AUTH-005`, `COM-001`, `COM-002`, `COM-009`, `AVL-003`, `AVL-005`, `AVL-006`, `SEC-003`, `SEC-005`, `SEC-007`, `OPS-003`, `OPS-006`. |
+| Corrective v0.1.51 canonical-owner, schema-v7 projection, retained-TTL, and expired-member replacement recovery | Exact enrolled-Core plus pinned-Approval-OIDC owner selection; transactional Approval owner/passkey adoption; current receipt-signer replacement; strict resumable signer/config journal; journaled Core OIDC/approver cutover; exact v0.1.50 one-hour generic Approval hotfix normalization to separate 600-second ordinary and 3600-second communication-scope ceilings under compare-and-swap, resume, and rollback; single-scope schema-v7 projection shared by atomic activation and idempotent legacy repair; separately approved same-principal expired-member replacement requires the exact scope owner, preserves role, tombstones the former harness, activates the enrolled replacement, increments membership and scope revisions once, recomputes canonical digests, cuts authorization over to current schema-v7 membership, and permits exact committed replay after request expiry; ambiguity, cross-principal/domain, replay, tamper, drift, partial-row, and conflicting-row rejection | Recovery-focused lane: `237 passed`; replacement-focused SQLite lane: `62 passed`; PostgreSQL contract collection: `82 passed, 8 dedicated-database skips`; broad releasable-source lane: `2225 passed, 22 skipped`; `npm run check` source plus two recursively packed generations: `2252 passed, 22 skipped` each; release manifest, installed-byte local communication, exact-endpoint routing, and packaged v0.1.45 journey passed | Current source/package H/L-shaped evidence only. Dedicated PostgreSQL replacement execution, same-commit CI, installed-host setup/upgrade, and live server/laptop reliability evidence remain pending. No requirement or gate promotion. Affected IDs: `ID-001`, `ID-002`, `ID-005`, `ID-006`, `ID-009`, `AUTH-001`, `AUTH-002`, `AUTH-003`, `AUTH-004`, `AUTH-005`, `COM-001`, `COM-002`, `COM-009`, `AVL-003`, `AVL-005`, `AVL-006`, `SEC-003`, `SEC-005`, `SEC-007`, `OPS-003`, `OPS-006`. |
 
 | OIDC validated-address transport repair | `UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q tests/identity/test_oidc_enrollment.py tests/operations/test_fail_closed_config.py tests/production/test_deployment_config.py` | 53 passed, 0 failed on 2026-07-15 | H only: includes the real `_PinnedHTTPSConnection` socket path under a validation-to-connect DNS-answer change, exact TCP address/SNI/Host assertions, proxy/tunnel and redirect denial, response bounds, unsafe address-class rejection, invalid resolver type handling, private IPv4/IPv6 pins, configuration, and deployment wiring. No real IdP/TLS service or independent approval boundary is claimed. |
 | Independent WebAuthn-UV approval component | `UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q tests/approval`; approval-consumer lane; non-gate full regression below | 12 focused passed; 144 approval/consumer passed; included in 1049-pass broad lane on 2026-07-15 | H only: strict owner-only config/key custody, exact SQLite catalog/tamper rejection, UV-required maintained-library call contract, exact display/digest, bounded duplicate-rejecting HTTP, one-receipt response-loss retry, committed denial/expiry audits, rejection, credential revocation, loopback serving, and non-authorizing provisioning. WebAuthn verification is seam-controlled in hermetic tests; no real authenticator, independent host/device/operator, TLS proxy, rotation/recovery drill, or owner decision is claimed. |

docs/SCHEMAS_INTERFACES.md

@@ -837,6 +837,16 @@ Approval-owned signer file is durably installed and before owner authority is
 mutated; a retry reconstructs the file from the journal or verifies the exact
 existing signer.
 
+Upgrade journal v3 is reserved for the exact v0.1.50→v0.1.51 Approval TTL
+normalization. It extends the standard forward-only journal with one
+`previous_configs.approval_config` payload under the existing root-only
+custody and size bounds. Only a journaled source with
+`request_ttl_seconds=3600` and an absent or 3600-second
+`communication_scope_request_ttl_seconds` is normalized to the target
+600/3600 split. Compare-and-swap replacement, exact resume, and exact rollback
+use that retained payload; unknown keys, values, versions, or bytes fail
+closed.
+
 The schema-v7 communication projection has one canonical single-scope mapping.
 Both normal activation and repair write the exact collaboration scope, two
 active member rows, five entitlements, and five revoke powers from server-held

docs/implementation-guide.md

@@ -393,6 +393,16 @@ success. Unsupported identity, OIDC, signer, row-shape, revision, or file drift
 requires operator investigation; email equality alone is never recovery
 authority.
 
+The retained v0.1.50 live hotfix may have
+`request_ttl_seconds: 3600` and no separate communication-scope field. Do not
+edit that file manually. The exact v0.1.50→v0.1.51 setup path journals the
+source Approval configuration before loading the service, changes the generic
+deadline to 600 seconds, and writes
+`communication_scope_request_ttl_seconds: 3600`. Rerun the same approved
+command after interruption. Any other TTL/configuration shape blocks as
+`approval_config`; a failure before marker commit restores the journaled
+source bytes.
+
 The same setup pass repairs an already committed communication scope that lacks
 its schema-v7 collaboration projection. It materializes only the exact
 committed scope and member authority from server-held rows. It does not replace