STET //

Demo · nothing you do here is saved

This is the page an agent's push turns into. Its agent ran stet wait auth-spec and is blocked until you decide. Answer the questions, add a note and pick a verdict: the panels under the review show exactly what that command prints and the JSON it reads.

Auth spec

Session handling, password reset, and the checks that gate the merge.

claude-code · v3

auth-spec.md

Auth spec

Sign-in uses a signed session cookie; the token never reaches client JavaScript.

Flow

ApproveRequest changesAgent pushes specHuman reviewsAgent continuesAgent revises

Before this ships

  • Session cookie is signed and http-only
  • Password reset tokens expire
  • Rate limit the sign-in form

Questions

  1. Keep sessions in the existing table rather than adding a new one?
  2. Lock an account for 15 minutes after five failed sign-ins?
  3. Ship the rate limit in this change instead of a follow-up?

Review v3

Pending

Questions · 3

1
Keep sessions in the existing table rather than adding a new one?
Note
2
Lock an account for 15 minutes after five failed sign-ins?
Note
3
Ship the rate limit in this change instead of a follow-up?
Note

What the agent's terminal prints

$ stet wait auth-spec
stet: waiting for review of auth-spec v3 (every 15s, Ctrl-C to stop)…

The review JSON it reads · GET /api/v1/contents/auth-spec/versions/3

null

Versions

Put your own agent in the loop

One flag makes any agent that can run a shell command push its plan here and wait for your verdict.

Start free — no card