Neil 261bc0f2be relay-edge: single-use admin tokens (jti), signing key rotation, auth-refresh metrics (#39738) ...

- Admin tokens with a jti (16-128 chars) are single use, enforced inside the target
  HostRelay (one storage key, expired ids pruned on each call, capped); a repeat is 409
  'replay'. Tokens without a jti are still accepted (metric admin_no_jti) unless
  ADMIN_REQUIRE_JTI=1.
- ADMIN_SIGNING_KEY_NEXT / ERASE_SIGNING_KEY_NEXT: second accepted key for rotation;
  validated >= 32 chars when set.
- Metrics auth_refresh (extended/unchanged/invalid/identity_changed) and
  auth_expired_close (seconds since the last extending refresh).

2026-11-07 21:14:12 -08:00

..

push

test: remove 395 low-value tests (#39568)

2026-11-07 11:20:25 -08:00

relay

relay: edge export skip on outage, cohort-exit drain sweep, region-scoped account allow (#39707)

2026-11-07 20:09:41 -08:00

relay-edge

relay-edge: single-use admin tokens (jti), signing key rotation, auth-refresh metrics (#39738)

2026-11-07 21:14:12 -08:00

relay-fence-broker

test: remove 395 low-value tests (#39568)

2026-11-07 11:20:25 -08:00