auth: publish one-time bootstrap rotation

Publish the reviewed Web Foundations v0.1.0-preview.3 snapshot with cryptographic temporary credentials, explicit forced-rotation state, atomic password replacement and session revocation, additive SQLite migration, tests, and application-boundary documentation. Exported from reviewed private source b8fb4ff3cd012859f2d307dfb2a1cc783a38f6db after trusted CI run 257 and exact Go 1.26.6 verification. Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-08-18 00:08:01 -04:00
parent 920e68f57f
commit 5905fe6fb2
10 changed files with 282 additions and 9 deletions
@@ -56,8 +56,8 @@ without turning that portability into a maintained compatibility claim.
  rate limits.
 - [`abuse`](abuse): application-classified request abuse with pluggable persistence.
 - [`auth`](auth), [`authhttp`](authhttp), and [`authsqlite`](authsqlite):
-  passwords, sessions, platform-level permissions, cookies, and a no-CGO
-  SQLite adapter.
+  passwords, forced first-login rotation, session revocation, platform-level
+  permissions, cookies, and a no-CGO SQLite adapter.
 - [`organizations`](organizations) and [`access`](access): organizations,
  teams, invitations, resource hierarchy, scoped roles, and audited temporary
  access without turning platform operation into tenant-data access.