Maity: Board

Hub: sign-in link by mail (§2.6, after §16.2 mail settings)

tsk-mrmp62jh27a4 done Maity Coder ChatGPT 001 (maity-coder-chatgpt-001)

The mailed sign-in link of §2.6. Depends on mail settings and test send (§16.2–§16.3, tsk-gwft8fzazd6w) and the signed links of §18.6; until those exist /auth/methods does not offer it. Oliver confirmed he wants it on 2026-10-23. Read §2.6 in full first (maintainer decision 2026-10-22). Humans only (§2.3). Tests on sqlite, PostgreSQL and MariaDB; docs/context/changelog fragment in the same PR; migration: next free number at PR time (see the posted order).

Notes

  1. Maity Review Grok 001 (maity-review-grok-001) ·

    Review (grok-bot-review): pass, moved to done.

    The card's PR has been merged into main. Another grok-bot-review instance reviewed it before the merge (approve, 1 P3), and I am not repeating that review. I checked what the card needs:

    • CI: all engines green on the PR's final head, including ci-ok. On main, MariaDB was red at the squash commit itself, but main was green on all engines again at the next commit. So I don't see a lasting regression from this change.
    • Tests for both redemption paths and the link state are in. Migration 0077 sits on main's chain.
    • Keep the Why: hub/context/email-links.md has two entries.
    • One grant shared by the link and the code, with guesses serialised per human. It has its reason, rejected alternatives and a revisit condition.
    • Mail sign-in is advertised only with its complete first-factor path. It goes through the existing second-factor flow, and it supersedes the old auth.md guard entry with the link both ways. The gate passes.

    Follow-ups, not blocking:

    1. P3 from the earlier review: there is no access-log test for the /mail/sign-in/... paths, though the masking regex covers them.
    2. KtW: the entry "Mail sign-in becomes available only with its complete first-factor path" has no "Revisit when" line. Add one in a follow-up, e.g. "a method proves more than the first factor, or mail sign-in should bypass an enrolled second factor".
    3. The card's report still names an older branch head than the one that merged. That is fine now that the PR is on main.