Go to file

tegwick 52d44daec2 refactor(local-identity): post-Stage4 cleanups and micro-fixes

- audit: chmod only on file creation, not every append (TOCTOU fix)
- jwt_utils: add extract_unverified_payload() helper
- cli: use extract_unverified_payload + JWTError instead of inline decode
- keys: extract _public_key_bytes() helper, import _b64url from jwt_utils
- security: FileNotFoundError try/except instead of path.exists() (TOCTOU fix)
- serve: cache JWK response at server init instead of per-request recompute

138 tests passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-02 08:25:21 +01:00

docs

feat(local-identity): Stage 4 — security hardening (NK-WP-0002-T04)

2026-03-02 08:06:56 +01:00

local-identity

refactor(local-identity): post-Stage4 cleanups and micro-fixes

2026-03-02 08:25:21 +01:00

wiki

Add CLAUDE.md, wiki protoplans, and NK-WP-0001 workplan

2026-02-28 17:21:51 +01:00

workplans

chore(workplan): mark NK-WP-0002 fully complete (all 4 stages done)