Bug: 1Password did not save the passkey at owner setup (PRF response shape?) #43
Open
opened 2026-10-07 05:14:00 +00:00 by kayg
·
18 comments
No Branch/Tag specified
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
kayg/infraternal#43
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Owner report (2026-10-07 morning): "somehow 1p didn't save my passkey" during owner setup on https://infraternal.kayg.org (deploy 2.1). The data dir was reset at the owner's request (old data kept as
~/.local/share/infraternal.bak-20261007T051326Zon monitor01, for diagnosis).Lead: the 1Password browser extension (Chrome and Firefox) returns the WebAuthn PRF extension result as a plain Array instead of an ArrayBuffer/ArrayBufferView (1Password community thread "browser extension webauthn prf extension not spec compliant"; Safari is reported fine). If
apps/tracer/src/auth.tsassumes an ArrayBuffer, registration or unwrap could fail after or around the create() call.To do:
navigator.credentials.createoptions for anything that blocks third-party providers (authenticatorAttachment, hints);Device and browser: asking the owner.
Owner: iOS 27, Safari. The orchestrator inspected the old DB (copied locally, then deleted):
none;The 1Password extension's PRF Array bug does not apply on iOS (1Password is a system credential provider there).
Likely explanations: iOS saved it with a different provider (iCloud Keychain), or 1Password reported success without persisting it.
Actions:
none, the AAGUID is still in authData; webauthn-rs exposes it at registration time), and show "saved to " after setup, so this is diagnosable and visible.Starting fix-prf at base
4daf8c0. Read issue and all comments; no parent linked. Scope: auth binary boundary and non-secret diagnostics, nullable AAGUID storage and session provider label, auth tests. UI belongs to concurrent onboarding job. Additive response proposal: session passkey_provider (nullable label), sourced from verified registration metadata; unknown/zero AAGUID remains unlabeled.Failing-test evidence: auth-binary.spec.ts on baseline: 3 passed / 3 failed (4.5s). Array PRF throws unlock error; DataView rawId serializes empty rather than AAEC. Auth binary outputs now use one strict copy boundary; diagnostic code AUTH_BINARY_INVALID contains field, fixed shape and length only. webauthn-rs 0.5.5 Passkey does not retain AAGUID for none attestation: must extract authData metadata only after successful verifier completion, using the existing serde_cbor_2 engine (no verifier change).
Provider/UI handoff: session and unlock-session will add passkey_provider: string|null, bound to the credential used for that session (also enrollment). Welcome UI can call checkSession() after finishRegistration() and display Saved to <passkey_provider> only when non-null. Scope excludes onboarding/sign-in UI files. Community source: https://github.com/passkeydeveloper/passkey-authenticator-aaguids/blob/main/aaguid.json . Zero AAGUID (including privacy-redacted iCloud credentials) cannot reliably identify a provider.
Additional baseline reproduction: iframe cross-realm ArrayBuffer PRF silently becomes 32 zero bytes in old copyBytes; stronger content assertion fails on
4daf8c0(realm-before.log). Full Playwright first run: 27 passed, 2 failed / 3.2m: motion-audit copy feedback timing; terminal probe p99 27.8ms vs <20ms. Linux x86_64, 8 cores, shared load 27.42 during Rust/native compilation. Will rerun after builds; no UI/terminal changes made. Normalizer microbench (50-input batch, 100000 copies) native fast path 0.626us vs old 0.450us; correctness cost <0.2us/copy locally, not pinned perf-VM evidence.Step 1 committed
053f424: production-module binary regression tests (ArrayBuffer, views including Uint16/DataView and cross-realm iframe views, arrays, malformed outputs, metadata-only diagnostics). Baseline array/DataView/realm run red. Fast gate PASS: fmt, VT native fmt, clippy, test, cargo-deny, static builds; protocol 7 pass / 0 fail / 34390 assertions; differential 134 streams / 11439 schedules / zero divergences. Fixed boundary browser tests green; dedicated auth code commit gate running.Step 2 committed
847ef85: one strict binary copy boundary for PRF first/second and rawId/clientDataJSON/attestationObject/authenticatorData/signature/userHandle, including login wrap lookup and fallback allow-list. Length remains 32; diagnostic AUTH_BINARY_INVALID logs field/shape/length only. Fast gate all PASS; full Playwright rerun TRACER_TEST_PORT=4541: 31 passed (2.7m). Terminal 500-key write-callback p99 15.3ms; no UI or terminal source edited. Both previous suite failures disappeared after cold compilation ended.Server test-first evidence: 0 passed / 2 failed in 0.50s before implementation. Real v8 migration upgrade and verified none-attestation registration tests both fail with no such column: aaguid. Additive migration will preserve old rows with NULL AAGUID and NULL session credential identity. Tests are explicitly ignored only in the specification commit, then activated by implementation commits.
Step 3 committed 346_pending: server specifications for verified none-attestation AAGUID, provider bound to actual enrollment/login credential, second passkey, legacy v8 upgrade, unknown/redacted provider and rejection without writes. Tests run red first (0 passed / 2 failed / 0.50s), then explicitly ignored until implementation. Fast gate all PASS; wire differential 134 streams / 11439 schedules / zero divergences. Next: promote the already-pinned serde_cbor_2 dependency for metadata extraction; no new engine or version.
Correction: step 3 SHA is
c5a7139; the prior comment included an unfinished SHA placeholder.Step 4 committed
e5f612b: existing pinned serde_cbor_2 moved to runtime dependencies; no new library/version or lockfile change. Fast gate all PASS; static binary sizes unchanged (x86_64 16096816 bytes). Next migration 0009 adds nullable passkeys.aaguid and sessions.passkey_id and activates the real v8 upgrade regression.Step 5 committed
faf2aa3: migration 0009 adds nullable AAGUID/session-credential columns without backfill. Recorded v8 upgrade test activated and PASS, old credential/PRF-input/session fields intact. Fast gate all PASS. After schema, the registration test still fails: stored AAGUID None vs expected 1Password UUID (0 passed / 1 failed / 0.90s). Next extracts metadata only after successful webauthn-rs verification and inserts it in the same transaction/query.Step 6 committed
2de91db: AAGUID extracted from authData only after successful verification and persisted in the same registration insert/transaction. Zero is NULL. Fast gate all PASS; malformed CBOR corpus 1024 inputs PASS. Static x86_64 grows 21600 bytes / 0.13%. Regression now passes stored UUID assertion and fails only missing session label: Null vs 1Password (0 passed / 1 failed / 0.46s). Next binds enrollment/login sessions to verified credential and returns nullable passkey_provider in session/unlock-session; all pending regressions activated.Final response slice: all provider/migration/corpus tests passed; initial fast run found doc URL syntax and registration function line-count lints. Fixed without lint suppression; standalone clippy PASS; full fast rerun in progress. Post-change Playwright: 30 passed / 1 failed, terminal p99 36.5ms vs <20ms while static linking (auth scenarios PASS). Earlier quiet full run: 31 passed / 2.7m. Will run the full suite once compilation is complete.
Step 7 committed
92e7d2e: session/unlock-session passkey_provider nullable label, tied to verified enrollment/login credential; static map covers 1Password, iCloud Keychain (managed AAGUID), Google Password Manager, Bitwarden and 3 Windows Hello IDs. Unknown/redacted/legacy NULL. All regressions activated: 71 server tests PASS; fast all PASS; native browser 4 scenarios PASS; full Playwright 31 passed / 3.0m on port 4541. UI handoff remains on this issue (no UI edits). Extra production-UI/Rust harness found a fixture bug before identity entry: valid setup-check HTTP 204 parsed as JSON -> EOF, then fixture exits. Fixing only the pipe fixture, preserving HTTP status and emitting null in the IPC envelope. Failing run recorded in production-auth.log.Step 8 committed
53c9e21: pipe fixture preserves empty HTTP 204 with null IPC body. Native auth 4 scenarios and fast all PASS. Production UI now completes setup and empty-storage discoverable login/DEK unwrap with 1 native prompt. That extra harness also exited on a missing optional vendored asset (__vite-browser-external-2447137e.js) after auth assertions passed. Its static asset route now returns normal HTTP 404 on ENOENT (other errors still fail), no renderer/UI changes. Full real-Rust production auth harness now exits 0; separate test-harness commit gate running.Finished auth lane at
01a29a04faon fix-prf (base4daf8c0), 9 atomic commits; no push, deploy, merge or issue closure.Binary outputs normalized through one strict copy boundary; PRF first/second retain 32-byte validation and metadata-only diagnostic AUTH_BINARY_INVALID. Verified-registration AAGUID nullable column and credential-bound nullable passkey_provider session field are ready for the separate welcome UI lane (handoff above). All 5 provider names/7 IDs have cited static-map tests; zero/unknown/legacy remain null.
Gates: fast all PASS (71 server tests, 6 intentional measurement ignores; wire 7 pass/0 fail, 34390 assertions, 134 streams/11439 schedules/zero divergences); tracer tsc PASS; TRACER_TEST_PORT=4541 full Playwright 31 passed (3.0m), 500-key probe p99 18.60ms; native browser 4 scenarios PASS; production UI + real Rust setup/empty-storage discoverable login/DEK unwrap PASS with 1 native prompt on Chromium 149.0.7827.55. No physical Safari/1Password extension run available; owner should retest after integration.
Self-review B1/S1/S2/N1: authority/ingress checks unchanged; metadata projected after verification and never grants authority; session lookup checks credential AND user; PRF outputs stripped from proofs and copies wiped independently; migration preserves v8 rows; module/invariant docs present; no terminal hot-path or periodic-work changes.
Local diagnostics on Linux x86_64/8 cores (shared load 8.78 before, 8.44 after; not pinned perf-VM budget proof): 100000 copies in 50-input batches old 0.122us / normalized 0.129us. 50-device session query: before 1000 samples p50 166.781us / p99 4545.343us; after 3x1000 samples p50 189.687/203.067/252.949us, p99 1233.745/664.998/2646.913us. Median after p50 adds 36.286us against one noisy baseline; requested provider diagnostics justify the indexed lookup within the same query, no extra round trip. Session struct 120 bytes, extra 16 bytes x 50 = 800 bytes for static label references (existing String heaps excluded). Static x86_64 16120912 bytes (+24096 / 0.15%); aarch64 13539528 (+24448); both have no PT_INTERP.
Evidence: /tmp/fix-prf-evidence/ (gate and failure logs); production-build screenshots remain in apps/tracer/test-results/ from the 31-test run, including onboarding-setup-recovery--906cd--match-the-browser-contract/ and terminal-first-run-passkey-29742-esume-and-the-latency-probe/. Screenshots mask setup/recovery capabilities; no UI quality judgment made.
How to test after integration: sign in on desktop with the synced 1Password passkey; verify the account key unwraps. For new setup, the separate UI lane displays Saved to only for a known non-null passkey_provider. On malformed output, capture AUTH_BINARY_INVALID shape/length only, never credential or PRF bytes.
Final fast gate output, verbatim, head
01a29a04fa:kayg referenced this issue2026-10-28 17:53:56 +00:00