Historical device-login and token-revocation tests

The public summary as JSON. These are the same reviewed fields shown in Read.

{
  "schemaVersion": 1,
  "publicSummaryVersion": "2026-09-30",
  "classification": "PUBLIC",
  "title": "Historical device-login and token-revocation tests",
  "summary": "On 30 August 2026, laboratory tests completed the client’s device-login flow, bound the resulting token to the approving account and verified that revocation took effect on the next request. Expired and mismatched approval codes were rejected. The inspected logs and database did not contain the fixture token; it appeared only in the tested client credential store. This exercised the Linux storage path. The macOS keychain path was not tested here, and the result is not a general claim that no token can ever leak.",
  "date": "30 August 2026",
  "scope": "Laboratory or bench evidence; production behavior is not inferred from it.",
  "result": "On 30 August 2026, laboratory tests completed the client’s device-login flow, bound the resulting token to the approving account and verified that revocation took effect on the next request. Expired and mismatched approval codes were rejected. The inspected logs and database did not contain the fixture token; it appeared only in the tested client credential store. This exercised the Linux storage path. The macOS keychain path was not tested here, and the result is not a general claim that no token can ever leak.",
  "sections": [],
  "currentDeployment": "Not independently verified by this historical evidence.",
  "canonical": "/evidence/phase-cp-2"
}

Download this public summary

This derivative has its own digest. It is not the original transcript or a new test. Historical original records are preserved privately.

Download public JSON →

SHA-256 4530775c77edfd4b4fa1053b4e2445eca4a901335c2bd6c59c915aa8112e4591