CedarCopilot wants to merge 2 commits into staging from fix/skip-agent-runs-for-warmup-traffic
Live on prod, no production signal yet
Post-deploy production telemetry contains 0 matching spans or CloudWatch log lines for GET /two-factor, GET /mail, TWO_FACTOR_REQUIRED, two-factor/verify-totp, or two-factor/verify-backup-code. The only related API telemetry was 2 GET /api/auth/get-session spans (200, 0.
Verification reached its budget before a verdict.
Since 2026-08-30T00:51:52Z, OTEL and CloudWatch showed no telemetry for verifyTotp, verifyBackupCode, two-factor verification, or equivalent verification routes. The only related auth evidence was 2 successful GET /api/auth/get-session spans from 1 user; no successful.
Verification reached its budget before a verdict.
Since 2026-08-30T00:51:52Z in prod, telemetry shows 59 successful process_calendar_event_sync_only spans (2 users; p95 91.8 ms), 3 successful calendar.events.list.incremental spans (1 user; p95 888.2 ms), and one successful canvas.getCanvases request chain (1 user; server p95.
Since 2026-08-30T00:51:52Z in prod, telemetry shows 59 process_calendar_event_sync_only spans (2 users, p95 91.8 ms) and 3 calendar.events.list.incremental spans / 3 successful GET /calendar/v3/calendars/primary/events requests (1 user, p95 888.2 ms). There are 0 calendar.
internal_only
Libra has verdicts on 0 of 17 tracked behaviors on prod; 17 are still being checked. Libra checks hourly for 3 days after each deploy.
This branch has accumulated twelve commits since staging. The load-bearing one is the security fix; the rest are feature work and reported-bug fixes across the board, calendar, composer and documents.
Security , the 2FA gate had a bypass. /api/auth/two-factor/ was allowlisted as a prefix, so an unverified session could reach two endpoints that defeat the gate outright:
enable deletes the account's two_factor row, mints a fresh secret and returns its totpURI , a stolen cookie could enrol a factor the attacker controls, verify it, and walk in, with the real user's factor destroyed.disable flips two_factor_enabled off, which is exactly the flag requiresTwoFactor keys on for a self-enrolled user.Neither is gated by a password=[redacted] is on because Cedar has no passwords, so better-auth's shouldRequirePassword relaxes for every Cedar user, and disable's sensitiveSessionMiddleware asks only for a valid session, not a fresh one.
The gate now classifies a path into allow / allow-if-not-enrolled / block, deny-by-default. Enrollment is the only conditional rung, and it stays open for the one case the gate exists to serve , an allowlisted user being walked into setup for the first time. That check reads two_factor_enabled from the user row, not from session.user: the 30-day cookie cache can answer getSession() with a stale false, which would reopen enable to an unverified session. Unknown users read as enrolled, so it fails closed.
Task board. The sort_order seed was guarded row-wise on sort_order = 0, which looks idempotent and is not , 0 is a value the placement function legitimately produces (a user's first unpinned task, and next - 1 whenever the top card sits at 1). Re-running the migration would have re-stamped exactly those rows by due date and undone wherever they had been placed. The guard is now per user on bool_and(sort_order = 0) AND bool_and(NOT sort_order_pinned). The list view also now sorts through the shared compareTasks, so manual stops silently falling through to due-asc, and the three optimistic task literals carry the two new columns.
Slack backfill. A container-id retry resolved the id and then threw it away, writing a row with container_id = NULL , unreachable by every reader and un-deduplicable, because the unique index it conflicts on is partial (WHERE container_id IS NOT NULL). The retry now keeps what it resolves.
Plus: calendar event composition on its own block with free/busy, Zoom meeting creation, pipeline and inbox filters that survive a refresh, recipient-badge drag from where the badge actually sits, in-document call playback seeked to the moment under discussion, and coaching-row and Drive-folder fixes.
TASK_REORDERING_HANDOFF.md is added alongside the design doc , it records what is live in the database, and one open defect worth reading before phase 3: placement is not concurrency-safe (29 collision groups / 26 due-date inversions measured on staging), currently masked in the browser only by a stable sort landing back on due-date order.
pnpm run autofix:local , green. Mail Jest: 299 suites, 2826 tests. Server Vitest: 734 files, 7873 tests.origin/staging (67 files, clean merge) , still green, including the eight test files the merge brought in.classifyPathForUnverifiedSession is asserted to allow the two verify endpoints, return allow-if-not-enrolled for enable only, and block for disable, generate-backup-codes, get-totp-uri, tRPC data reads and /api/auth/token.🤖 Generated with Claude Code
This PR hardens the two-factor challenge boundary and delivers broad fixes across calendar composition, task orde
Libra has not measured any production surfaces for this change yet.