[deku2026]

[AF-CTR-03] Device and session products and the arcforges-web browser session document

Contracts part of Plan task AF-CTR-03 (Accounts, sessions and devices on the center). ArcForges-Design AD-0021 §7
(Design #43, merge 3392d02) binds every account session and node credential to a device installation: a node's
credential to its arcforges-node installation, a phone's session to its arcforges-mobile installation and a
browser's own cookie session to an arcforges-web installation. The Contracts validations admitted only the branded
products arcscope and companion.

Commits

1. e7d9fe8 Admit arcforges-node, arcforges-mobile and arcforges-web as device and session products
   • public/proto/constraints/con-07-identity.json: product enum of InstallationClaim, SessionSummary,
     InstalledProduct, DeviceServiceRegisterRequest gains the three values (arcscope and companion stay).
     Application product IDs (ApplicationScope, ApplicationTarget, history records) unchanged.
   • Regenerated: aggregate public/proto/constraints.json and ProtoValidation.g.cs. No proto, descriptor or Go
     binding change.
   • fixtures/public/con-07-identity.json: one accepted case per new value for each of the four messages.
   • eng/policy/product-names.json + eng/check_naming.py: closed installationProducts list with its own Design
     reference (ArcForges-Design 3392d02, AD-0021); wire values only, never branded or retired IDs. The P2-019 pin is
     unchanged (the DesktopPlatform derived declaration is bound to it).
   • tests/tooling/test_naming_policy.py, README.md.
   • The published closed documents public/http/v1/browser.schema.json and native-auth.schema.json are NOT changed
     (see "CON.17 window" below).
2. 71badd3 Add the WebBrowserSession document for arcforges-web browser sessions
   • public/http/v1/web-browser.schema.json, title WebBrowserSession, x-arcforges-schema-version "1": derived
     textually from the frozen BrowserSession document and held to its meaning by a test. Differences only:
     definition names WebBrowser*, route ids webBrowser.*, paths /session/v1/web/*, the description, and
     WebBrowserInstallationClaim.product = arcscope, companion, arcforges-web (not node/mobile).
   • eng/generate_shapes.py (mapping, namespace ArcForges.Contracts.PublicApi.Http.V1.WebBrowser) and
     eng/contract-packages.json (owned by ArcForges.Contracts.PublicApi only; the retired api-client row unchanged).
   • Generated: 14 models + WebBrowserSessionRoutes (PublicApi), 14 validators (Validation).
   • Fixtures: all 109 BrowserSession HTTP vectors mirrored on the new roots (same bytes, same outcome), product
     vectors (arcforges-web accepted by the new begin authentication/recovery requests; arcforges-node and
     arcforges-mobile refused there; arcforges-web refused by the frozen document), the WebBrowserSession route table.
   • Tests: tests/tooling/test_identity_http.py (independent interpreter over the new document, a mirror test,
     routes, single package owner), tests/StructureTests/IdentityCases.cs (generated C# codecs and route catalogue),
     tests/tooling/test_naming_policy.py.
3. 952acd9 Bind access, provenance and dependency records
   • eng/policy/contract-access.json: 29 new distribution rows with declared types, ProtoValidation hash, the new
     build input, refreshed build inputs (contract-packages.json, aggregate constraints, con-07 shard); sourceCommit
     71badd3, reviewedOn 2026-10-28.
   • Provenance successor contract-bindings-af-ctr-03-r1 (supersedes contract-bindings-af-con-01-r1): 383 targets
     kept, 1 hash refreshed, 29 added (412); input/generator snapshot moved to 71badd3 with refreshed evidence digests
     and the new document among the inputs; files.json and NOTICE.txt.
   • Dependency receipt af-ctr-03-r1 (previousReceipt af-ctr-01-r1); closure unchanged.
4. 700d825 Allow the exact reviewed public digest rows of receipt af-ctr-03-r1
   • .gitleaks.toml: two exact-row blocks (1 + 4 rows) for the 6 generic-api-key findings of the pinned scan;
     tests/tooling/test_dependency_admission.py: count pin 99 -> 101, per-block counts, new exact-tuple test.
5. 640f072 Count the WebBrowserSession strict JSON contexts in the serialization policy test
   • tests/tooling/test_serialization_policy.py: exact pin of strict System.Text.Json contexts 97 -> 111 (the 14
     root contexts of the new document); the gate is unchanged.

CON.17 window and the document choice

• eng/compatibility/later-services-window.json pins the closed CON.07-CON.16 documents by hash and version; any
  content or version change in place fails check_compatibility.py --window. Both frozen documents stay
  byte-identical; no check was changed.
• native-auth.schema.json: unchanged. A version-1 NativeTokenResponse must never list an arcforges-*
  installation (Cloud A1 records whether it filters them or leaves native token documents unserved). The node and
  mobile native flows bring their own versioned document with AF-CTR-04 and AF-CLD-02.
• New document under public/http/v1/ with routes under /session/v1/web/, not public/http/v2/ with
  /session/v2/*: the generator's route guard (eng/generate_shapes.py route_catalogue, pinned by
  tests/tooling/test_con07_generator_guards.py) admits only /session/v1/... paths, and the change is additive under
  contract major 1 (a v2 name would announce a breaking major). Generated model and file names are unique per output
  root, so the definitions are renamed in any layout.
• No $id: no Contracts document declares one; a document's identity is its path, title, namespace and
  x-arcforges-schema-version, all distinct here.
• No new window row: the window pins documents of CON.07-CON.16 by the published candidate they first appeared in
  (identicalSince must be a recorded candidate with its publication run and retained archive, and
  test_closed_schemas_are_pinned_with_their_first_publication holds the per-task path sets). The new document is
  unpublished and belongs to AF-CTR-03; a later window opened at the candidate that publishes it can pin it.
• Cloud A2 serves only the webBrowser.* routes; the Design companion PR with A2 records the browser-session document
  choice.

Linux leg

python3 eng/verify.py run --rev HEAD at 640f0728f743d871882774feb08cec16df722a30 (base 7205743, 51 changed
paths, profile full, 19 steps, 546 s): LEG PASS (logs
.git/arcforges-verify/logs/20261029-053022-640f0728f743-linux).

pass clone-identity, secret-scan (5 commits, no leaks), restore, dependency-admission, naming, provenance,
contract-access-test, format-audit, pack (167 s, including check_compatibility.py --window: both frozen documents
unchanged), go-generate-drift, go-static, go-test, go-exchange, go-vulncheck, tooling-tests (550 tests OK),
clean-tree, security-build, security-naming, architecture-gate (214 s).

Earlier runs on this branch: the first shape (both frozen HTTP documents widened in place) failed pack on the
CON.17 window; it was replaced by the commits above (the branch was never pushed). The run at 700d825 failed only
tests/tooling/test_serialization_policy.py (strict JSON context pin 97, now 111: commit 5).

Local checks run in the worktree

• python3 eng/contracts.py generate / generate --check (exit 0).
• dotnet build ArcForges.Contracts.slnx -c Release --no-restore -p:ArcForgesBuildId=local (0 warnings, 0 errors);
  StructureTests: "CON.07: 3 services, 49 operations, 1096 shape and 298 HTTP exception vectors passed."
• python3 eng/check_provenance.py --owner Contracts --base origin/main --write-notice: passed (1299 files, 606
  reused).
• node eng/check_contract_access.mjs: passed (3311 distribution files).
• python3 eng/dependency_admission.py: passed (58 dependencies, 235 inputs).
• python3 -m unittest dependency_admission, identity_http, naming_policy, compatibility_matrix,
  con07_generator_guards, json_shape_unions: 170 tests OK.
• Pinned gitleaks v8.30.1 (image c00b6bd0aeb3) on a scratch clone, range 7205743..952acd9: 6 generic-api-key findings
  (dependency-policy.json lines 15, 1020; af-ctr-03-r1.json lines 35, 103, 172, 240), allowlisted by commit 4.

Windows

Contracts has only a Linux leg. Nothing in this change is Windows-specific: data, generated C# models and validators,
C# and Python tests. The new C# types reach Windows consumers only when they bump ArcForges.Contracts.PublicApi and
.Validation.

Scope notes

• .gitleaks.toml is a supporting file outside the task write paths (allowlist rows for the new receipt only).
• Companion rows for the Design PR carried with Cloud A1 (DC-14): auth.token_expired and auth.credential_revoked
  transport rows (listed in the Cloud A1 PR body).

🤖 Generated with Claude Code

https://claude.ai/code/session_01H6Cf6pFe7uHMuN6zEgDLmW

[deku2026]

Review record: Contracts #121

Reviewer: the independent AF-CTR-03 reviewer, a delegated agent that did not author this PR.

Verdict: approve at 640f072. The code was approved as it stands. The one process finding (F1, the task's write scope) is resolved by Plan #77, which widens AF-CTR-03's Contracts paths and scope.

Checks

• Product domain. Exactly 4 device and session product fields are widened in con-07, and the aggregate and ProtoValidation match. Application product IDs (ApplicationScope and others) deliberately stay branded. installationProducts pins Design 3392d02, and check_naming is not weakened.
• WebBrowserSession. An independent rename diff against the frozen BrowserSession document shows only the description, +arcforges-web, and the route ids and paths changed. The mirror test failed under 7 mutations. Vectors: 109 copies plus 7 product vectors. The generator guard is unchanged.
• Frozen documents. browser.schema.json and native-auth.schema.json are byte-identical to main. check_compatibility.py --window passes, and an in-place widening still fails, as it should.
• Records. contract-access, the provenance successor contract-bindings-af-ctr-03-r1 (412 targets), files.json, NOTICE and receipt af-ctr-03-r1 were recomputed, and all hashes match.
• gitleaks. The pinned v8.30.1 scan finds 6 public-digest findings with main's configuration and 0 at the head. The new rows are exact-line and path-anchored.
• Test pins. 101 allowlist rows and 111 strict JSON contexts; both checks are unchanged.
• Generated code. Full regeneration leaves the tree clean.
• Compatibility. The wire and the Go and npm contents are unchanged; the PublicApi and Validation additions are additive.
• Leg. arcforges/linux succeeds at 640f072 (19 steps, 513 s).

Residual risks

• Older Validation packages reject arcforges-* values. Consumers update to this cohort.
• WebBrowserSession should be pinned in a later window at the candidate that first publishes it.
• Cloud A2 must refuse any browser product it does not serve.

---

Generated by Claude Code