[rafiki270]

Google sign-in completed successfully, but /internal/admin/session then returned 401. Admin cookie storage shortened the refresh family after its immutable authentication proof had been issued, so live proof validation rejected the session.

Establish the admin family deadline before issuing either original or inherited proof, using JWT whole-second precision. Cookie storage now only writes the private handle. Debug redemption keeps the source ancestry and deadline; ordinary product refresh lifetimes and proof validation remain unchanged. No UI source or database schema changes.

Validation

• Reproduced the failure through the production Google browser journey and confirmed INVALID_SESSION_ASSURANCE in Cloud Run logs.
• Added an HTTP integration regression covering Google callback → PKCE exchange → admin session → debug redemption → source logout and descendant revocation. It failed with 401 before the fix and passes afterward.
• On Windows Maxis: 16 tests across six focused files passed, including existing admin/debug and product Google flows plus timestamp-boundary tests.
• API typecheck, build, changed-file ESLint and git diff --check passed.
• All PR CI checks passed, including the full DB-less and PostgreSQL API suites and dependency audit.
• Production deployment passed. Cloud Run revision uoa-auth-00349-fxk serves 100% of traffic. On 2026-10-25 at 17:43 UTC, the real Google browser journey reached /admin/dashboard, and the session remained valid after a reload.
• Native apps were not built because their source and build inputs are unchanged.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.