Audit baseline: 0cc18b8, verified against current master on 2026-09-10.
Evidence and impact. On a JWKS fetch failure, the verifier returns cached keys regardless of their age, despite a comment describing an hourly bound. A synthetic one-year-old key set was returned. A revoked/compromised signing key can remain trusted for as long as refresh continues to fail. Separately, the refresh timestamp is recorded only after the fetch and is not serialized: six concurrent test requests caused six fetch calls despite the one-per-minute intent. See cache refresh. Tests stubbed network access and exercised the actual function; they did not use a real revoked key or flood a portal.
Fix or defer. Keep handoff disabled for the preview. If it is required, enforce a maximum stale-key age, serialize/reserve refresh before network I/O, and reject when the stale budget expires. Existing Basic authentication supplies a recovery path when portal verification fails.
Acceptance. Expired cached keys fail after the documented grace period; six simultaneous requests cause at most one refresh. P2 assumes portal is outside preview scope; it becomes a release gate if portal sign-in is advertised as supported.
Priority: P2 while portal handoff remains optional/off; gate support for portal sign-in on this fix.
Scope: agent-box owns this integration and its fix. Do not change vendored/upstream behavior that already matches its documented contract.
Audit baseline: 0cc18b8, verified against current master on 2026-09-10.
Evidence and impact. On a JWKS fetch failure, the verifier returns cached keys regardless of their age, despite a comment describing an hourly bound. A synthetic one-year-old key set was returned. A revoked/compromised signing key can remain trusted for as long as refresh continues to fail. Separately, the refresh timestamp is recorded only after the fetch and is not serialized: six concurrent test requests caused six fetch calls despite the one-per-minute intent. See cache refresh. Tests stubbed network access and exercised the actual function; they did not use a real revoked key or flood a portal.
Fix or defer. Keep handoff disabled for the preview. If it is required, enforce a maximum stale-key age, serialize/reserve refresh before network I/O, and reject when the stale budget expires. Existing Basic authentication supplies a recovery path when portal verification fails.
Acceptance. Expired cached keys fail after the documented grace period; six simultaneous requests cause at most one refresh. P2 assumes portal is outside preview scope; it becomes a release gate if portal sign-in is advertised as supported.
Priority: P2 while portal handoff remains optional/off; gate support for portal sign-in on this fix.
Scope: agent-box owns this integration and its fix. Do not change vendored/upstream behavior that already matches its documented contract.