Unified, greyscalethe change is the brightest thing; only a failing hunk takes a mark
src/auth/refresh.py +42−17 againstmaincommita41f2c0
@@ -118,7 +118,9 @@ def refresh(token: Token) -> Token:
118118 now = time.time()
119− if token.expires_at < now:
119+ # refresh a little early so a slow network never hands out a dead token
120+ if token.expires_at - EARLY_REFRESH_S < now:
120121 return _issue(token.subject, now)
121− return token
122+ return token.with_checked_at(now)
SK Sean14:09

with_checked_at allocates a new token on every call. Mutate in place or cache the check; this path runs per request.

Sent to the agent with your next message
122123
@@ -140,6 +142,10 @@ def _issue(subject: str, now: float) -> Token:test 38 of 41 points here
140142 claims = {"sub": subject, "iat": int(now)}
143+ claims["exp"] = int(now + TTL_S)
144+ claims["nbf"] = int(now) - 1
145+ claims["checked_at"] = now
146+ assert claims["exp"] > claims["nbf"]
141147 return Token(subject, claims, signed=_sign(claims))
12 unchanged lines
In a listthe stat alone, as keyed data or in a file header
tests/test_refresh.py+9−0
src/auth/tokens.py+3−3