step: SESSION-DURABILITY-b-KN model: Auto date: 2026-08-28 branch: feat/session-durability-b-kn bv_verdict: pass bv_round: 2

SESSION-DURABILITY-b-KN — build verification pass

Frozen spec: ~/scooling/docs/reviews/2026-08-28-session-durability.md (§§4, 6, 7)
Freeze Muse revision: sha256:2ca4f221375666abf174c8a09de11e109d53f38150039610e841d8b55534ef47
Freeze artifact SHA-256: 0294db66e399d72024ec41d33b9e48aaecb2f1cce9dc225da4472cdd8ef12f9f

Verdict

Independent BV round 2 = pass (thinking-high). Round 1 findings BV1–BV4 fixed and re-verified.

Tests

node --test \
  test/session-durability-b-kn.test.mjs \
  test/auth-establish-refresh.test.mjs \
  test/hub-api-no-retry-flag.test.mjs \
  test/gateway-session-introspection.test.mjs \
  test/gateway-auth-refresh-wiring.test.mjs \
  test/auth-session.test.mjs \
  test/auth-refresh-wiring.test.mjs

93/93 pass. test_output sha256: 1ea413828a3eaef640a1b755954dfca1b4ba984bf638736698fbddf51690dd02

Shipped (KN boundary only)

• hub/lib/human-session-admission.mjs — type:session + iat/exp + 3h–24h; SESSION_EXPIRED vs SESSION_INVALID; HUB_JWT_EXPIRY parser; Origin allowlist; CLI Accept helper
• Hosted gateway introspection + integer JWT expiry + establish-refresh browser/CLI split
• Hub UI durable bootstrap warning, ensureFreshHumanSession, hubApiResponse, copy + agent credential paths
• CLI hub-session-auth.mjs vendor Accept + mode-0600 preserved
• Gateway README documents the delivery modes

Explicitly not done here

• No Scooling SESSION-DURABILITY-b implementation
• No production env/auth deploy, secrets, consent apply, main merge, or feature→GitHub-main PR