Correct Auth lifecycle, token, and cache behavior

docs/plans/2026-07-12-0900-framework-coroutine-state-lifecycle-audit.md

@@ -1018,7 +1018,7 @@ Add one row only for a shared finding or changed lower-level assumption that ano
 | `container-05` | `container` | `context` (revalidation complete) | `Coordinate shared container construction and complete current contextual resolution`; finding `container-05` |
 | `container-06` | `container` | `context` (revalidation complete) | `Coordinate shared container construction and complete current contextual resolution`; finding `container-06` |
 | `container-08` | `container` | `auth`, `cache`, `log`, `routing`, `support`; later full consumer audits | `Coordinate shared container construction and complete current contextual resolution`; finding `container-08` |
-| `container-09` | `auth`, `cache`, `log` | `container`, `cache`, and `log` (revalidation complete); later full `auth` audit | `Coordinate shared container construction and complete current contextual resolution`; finding `container-09` |
+| `container-09` | `auth`, `cache`, `log` | `container`, `auth`, `cache`, and `log` (revalidation complete) | `Coordinate shared container construction and complete current contextual resolution`; finding `container-09` |
 | `container-10` | `log` | `container` and `log` (revalidation complete) | `Coordinate shared container construction and complete current contextual resolution`; finding `container-10` |
 | `context-01` | `context` | `container` and `foundation` (revalidation complete) | `Correct explicit coroutine context targeting`; finding `context-01` |
 | `context-04` | `context` | `foundation` and `database` (revalidation complete) | `Correct explicit coroutine context targeting`; finding `context-04` |
@@ -1053,9 +1053,9 @@ Add one row only for a shared finding or changed lower-level assumption that ano
 | `queue-11` | `queue` | `events`, `queue`, and `broadcasting` (revalidation complete) | `Correct event dispatch, queued-consumer isolation, and queue interoperability`; finding `queue-11` |
 | `queue-12` | `bus`, `queue` | `events`, `bus`, `queue`, and `broadcasting` (revalidation complete) | `Correct event dispatch, queued-consumer isolation, and queue interoperability`; finding `queue-12` |
 | `foundation-01` | `foundation` | `support` and `foundation` (revalidation complete) | `Correct event dispatch, queued-consumer isolation, and queue interoperability`; finding `foundation-01` |
-| `support-02` | `support` | `auth`, `broadcasting` (revalidation complete), `bus` (revalidation complete), `cache` (revalidation complete), `concurrency`, `console` (revalidation complete), `container`, `contracts`, `cookie`, `database` (revalidation complete), `events`, `filesystem` (revalidation complete), `foundation` (revalidation complete), `hashing` (revalidation complete), `horizon` (revalidation complete), `inertia`, `jwt`, `log`, `mail`, `notifications` (revalidation complete), `permission`, `pipeline`, `queue` (revalidation complete), `redis` (revalidation complete), `reverb` (revalidation complete), `routing`, `sanctum`, `scout`, `session` (revalidation complete), `socialite`, `telescope`, `testbench`, `translation`; later full consumer audits | `Normalize framework enum identifiers at string boundaries`; finding `support-02`; sibling findings `translation-01` and `reverb-03`; linked detail plan `2026-07-15-0920-framework-enum-identifier-contracts.md` |
+| `support-02` | `support` | `auth` (revalidation complete), `broadcasting` (revalidation complete), `bus` (revalidation complete), `cache` (revalidation complete), `concurrency`, `console` (revalidation complete), `container`, `contracts`, `cookie`, `database` (revalidation complete), `events`, `filesystem` (revalidation complete), `foundation` (revalidation complete), `hashing` (revalidation complete), `horizon` (revalidation complete), `inertia`, `jwt`, `log`, `mail`, `notifications` (revalidation complete), `permission`, `pipeline`, `queue` (revalidation complete), `redis` (revalidation complete), `reverb` (revalidation complete), `routing`, `sanctum`, `scout`, `session` (revalidation complete), `socialite`, `telescope`, `testbench`, `translation`; later full consumer audits | `Normalize framework enum identifiers at string boundaries`; finding `support-02`; sibling findings `translation-01` and `reverb-03`; linked detail plan `2026-07-15-0920-framework-enum-identifier-contracts.md` |
 | `macroable-03` | `macroable` | `cookie`, `log`, and `notifications` (revalidation complete); later full `jwt` audit | `Complete Macroable callable and test-state handling`; finding `macroable-03` |
-| `auth-01` | `support`, `auth` | later full `auth` audit | `Correct Support utility boundaries and authentication timing isolation`; finding `auth-01` |
+| `auth-01` | `support`, `auth` | `auth` (revalidation complete) | `Correct Support utility boundaries and authentication timing isolation`; finding `auth-01` |
 | `encryption-03` | `encryption` | `contracts`, `support`, `filesystem`, and `foundation` (revalidation complete) | `Harden encryption rotation, key publication, and global lifecycle state`; finding `encryption-03` |
 | `sanctum-01` | `sanctum` | `encryption`; later full `sanctum` audit | `Harden encryption rotation, key publication, and global lifecycle state`; finding `sanctum-01` |
 | `process-02` | `process` | `concurrency` (revalidation complete) | `Make Process callbacks and pools failure-safe`; finding `process-02` |
@@ -1078,7 +1078,8 @@ Add one row only for a shared finding or changed lower-level assumption that ano
 | `console-02` | `console` | `foundation` and `console` (revalidation complete) | `Complete Foundation runtime lifecycles and safe publication`; finding `console-02` |
 | `queue-14` | `foundation`, `queue` | `foundation` and `queue` (revalidation complete) | `Complete Foundation runtime lifecycles and safe publication`; finding `queue-14` |
 | `http-03` | `http`, `foundation` | `contracts`, `foundation`, and `http` (revalidation complete) | `Complete Foundation runtime lifecycles and safe publication`; finding `http-03` |
-| `auth-02` | `auth` | `foundation` (revalidation complete); later full `auth` audit | `Complete Foundation runtime lifecycles and safe publication`; finding `auth-02` |
+| `auth-02` | `auth` | `foundation` and `auth` (revalidation complete) | `Complete Foundation runtime lifecycles and safe publication`; finding `auth-02` |
+| `auth-12` | `auth` | `fortify` (revalidation complete); later full `fortify` audit | `Complete Auth correctness, lifecycle, and current parity`; finding `auth-12` |
 | `database-03` | `database` | `foundation` and `database` (revalidation complete); later full `testbench` audit | `Complete Foundation runtime lifecycles and safe publication`; finding `database-03` |
 | `foundation-17` | `foundation` | `foundation` and `scout` (revalidation complete) | `Complete Scout current parity, queue, and search lifecycles`; finding `foundation-17` |
 | `foundation-18` | `foundation` | `foundation` and `scout` (revalidation complete) | `Complete Scout current parity, queue, and search lifecycles`; finding `foundation-18` |
@@ -1109,7 +1110,7 @@ Add one row only for a shared finding or changed lower-level assumption that ano
 | `telescope-01` | `telescope` | `redis` (revalidation complete); later full `telescope` audit | `Complete Redis pooling, subscriber transport, topology, parity, and lifecycle safety`; finding `telescope-01` |
 | `telescope-02` | `telescope` | `redis` (revalidation complete); later full `telescope` audit | `Complete Redis pooling, subscriber transport, topology, parity, and lifecycle safety`; finding `telescope-02` |
 | `sentry-01` | `sentry` | `redis` (revalidation complete); later full `sentry` audit | `Complete Redis pooling, subscriber transport, topology, parity, and lifecycle safety`; finding `sentry-01` |
-| `cache-04` | `cache` | `auth`, `sanctum`, and `testbench` (revalidation complete); later full consumer audits | `Complete Cache parity, cleanup, permanence, and tagged ownership`; finding `cache-04` |
+| `cache-04` | `cache` | `auth` (full-audit revalidation complete), `sanctum` and `testbench` (revalidation complete); later full remaining consumer audits | `Complete Cache parity, cleanup, permanence, and tagged ownership`; finding `cache-04` |
 | `filesystem-12` | `filesystem` | `session` (revalidation complete) | `Complete Session lifecycles, persistence, and current Laravel parity`; finding `filesystem-12` |
 | `session-23` | `cache` | `session` (revalidation complete) | `Complete Session lifecycles, persistence, and current Laravel parity`; finding `session-23` |
 | `contracts-09` | `contracts` | `foundation` and `broadcasting` (revalidation complete) | `Complete Queue pooling, payload durability, and current Laravel parity`; finding `contracts-09` |
@@ -1252,7 +1253,7 @@ The order is lower-level first where practical. Hypervel has cross-cutting depen
 
 ### Application and domain packages
 
-- [ ] `auth`
+- [x] `auth`
 - [ ] `validation`
 - [ ] `routing`
 - [ ] `view`

docs/plans/2026-07-12-0915-framework-coroutine-state-lifecycle-audit-ledger.md

@@ -1678,6 +1678,32 @@ Append package entries in checklist order. Keep each entry compact but complete
 - **Validation and review:** Every changed test file and affected Mail, Integration Mail, Support, Notification, Console, Validation, Filesystem, facade, and metadata group passed during implementation. The authoritative `composer fix` gate passed formatting, both PHPStan configurations, the complete parallel suite, Testbench package mode, and dogfood. `git diff --check`, facade regeneration, stale-reference scans, and fresh caller/callee, queue, storage, fake-state, API, coroutine, retained-state, hot-path, dead-code, and overengineering review are complete. Independent review verified every correction and signed off with no remaining finding.
 - **Assessment:** Mail is current, coroutine-safe, queue- and fake-truthful, bounded for long-lived workers, and complete at its package boundaries. The result removes more stale behavior and false metadata than it adds, introduces no workaround or speculative abstraction, and has no meaningful performance regression or unintended Laravel API break.
 
+### Complete Auth correctness, lifecycle, and current parity
+
+- **Status and inspected surface:** Implementation, focused validation, the authoritative gate, fresh self-review, and independent code review are complete. The audit covered Auth source, unit and integration tests, Foundation configuration, Fortify's Auth config consumer, Contracts, generated Support facades, Boost verification guidance, split metadata, current Laravel Auth source and integration tests, and the carried `auth-01`, `auth-02`, `container-09`, `support-02`, and `cache-04` decisions. The detailed design is recorded in [`2026-08-05-1615-auth-correctness-lifecycle-and-current-parity.md`](2026-08-05-1615-auth-correctness-lifecycle-and-current-parity.md).
+
+| Findings | Final decision |
+|---|---|
+| `auth-03`, `auth-04` | Make TokenGuard's explicit validation honor configured hashing and storage keys, accept only non-empty strings at every ordered request boundary, preserve string zero, and stop after the first valid source. |
+| `auth-05`, `auth-17` | Reflect every valid Gate callable through `Closure::fromCallable()`, weakly cache object-callable guest metadata by original identity, and reset the lazy WeakMap to its null sentinel. |
+| `auth-06`, `auth-07` | Refresh already-resolved concrete password brokers when the event dispatcher is rebound, preserve custom broker contracts, and construct observational Auth events only when targeted listeners or fakes exist. |
+| `auth-08` | Keep AuthorizationException's current falsey-code normalization; no supported falsey string-code caller or observable failure justifies a divergence. |
+| `auth-09`, `auth-10` | Restore the caller model's timestamp setting after remember-token saves, including failure, and make the configured model authoritative for cache keys and retained invalidation descriptors. |
+| `auth-11` | Accept unit and backed enums, including integer zero, at password-broker identifiers and Auth's guard-owned cache-clear boundary; preserve null defaulting, names, and generated facade metadata. |
+| `auth-12` | Give shipped verification-expiry and timebox settings one Foundation owner, remove duplicate top-level fallbacks, and retain local defaults only inside intentionally replaceable nested application configuration. |
+| `auth-13` | Declare the split Auth package's complete direct runtime dependency set and provider discovery metadata, with executable metadata coverage. |
+| `auth-14` | Revalidate the existing Auth README and user-cache guidance without changing already-correct documentation. |
+| `auth-15`, `auth-16` | Add focused current-Laravel integration coverage for dispatcher rebinding, password reset, real rehashing, and callable forms, and redact the exact eleven credential or key-bearing parameters. |
+
+- **Worker and coroutine ownership:** AuthManager, resolved guards, Gate, password brokers, and providers remain worker-lifetime objects. Guard selection, broker overrides, user state, and timed operation state remain coroutine- or operation-local. Event rebinding updates existing owners without resolving unused managers, and retained Eloquent descriptors contain immutable keyspace data rather than provider instances. Broker rebinding and enum normalization complete existing package patterns; the concrete broker check preserves the manager's protected custom-resolution extension point.
+- **Important rejected concerns:** Do not add a callable parser, unbounded string cache, generic Auth event helper, dispatcher registry, broker reconstruction, listener unregistration, cache-descriptor refcounts, provider ownership objects, settings object, token normalizer, compatibility wrapper, or broad integration-suite clone. Do not mark Recaller sensitive without a demonstrated exception trace, move the reset-link event after custom callbacks, or change AuthorizationException without a supported failing caller.
+- **Implementation and boundaries:** Token validation, callable reflection, optional event dispatch, event-fake restoration, remember-token cleanup, provider model switching, enum identifiers, configuration ownership, sensitive parameters, metadata, facades, and verification guidance now have one truthful owner. Optional-event guards comply with the repository's required `hasListeners()` convention. Superseded guest-closure and cached-model fields, duplicate top-level defaults, stale types, and false split metadata are removed.
+- **Cross-package revalidation:** `auth-01`, `auth-02`, `container-09`, `support-02`, and `cache-04` remain satisfied by the final Auth design. Auth owns `auth-12`; Fortify's two-factor credential path now consumes the shipped top-level hashing default without duplicating it and retains later full-package audit eligibility. No consumer-local workaround or deferred Auth item remains.
+- **Regression tests:** Deterministic coverage proves hashed and zero-valued tokens, ordered lazy token sources, every callable family, weak-cache cleanup, listener and fake event paths, broker rebinding and restoration, timestamp restoration with original failure identity, old and new model-keyspace invalidation, enum identity and defaulting, config replacement semantics, split metadata, sensitive attributes, real reset wiring, session-dispatcher rebinding, password rehashing, and supported custom-driver callables.
+- **Performance and complexity:** Ordinary token and enum boundaries add only bounded local type branches; Gate adds one existing cached-listener lookup and avoids unused event allocation and dispatch; password-broker events do the same; cached user lookup keeps one model-string read; and timestamp restoration surrounds an existing database write. No request path gains a lock, retry, extra I/O, serialization layer, network round trip, context slot, container-resolution loop, or unbounded worker-retained state.
+- **Laravel-facing result:** Supported Auth signatures, named arguments, guard and broker APIs, protected resolution extension points, event behavior, and facade entry points remain compatible. Current enum and integration parity is restored. TokenGuard's native boundary and Eloquent's cached-model defect are Hypervel-owned corrections; they reject only malformed native inputs or behavior that already contradicted the guard's configured contract.
+- **Validation and review:** Every changed and new focused test, the Auth unit and integration groups, Redis-backed Auth cache serializers, affected Fortify coverage, facade generation and linting, PHPStan, and `git diff --check` passed. The authoritative `composer fix` gate passed formatting, both PHPStan configurations, the complete parallel components suite, Testbench package mode, and dogfood. Fresh caller/callee, named-argument, event-rebind, cache-key, config-merge, coroutine, retained-state, hot-path, dead-code, and overengineering review is complete. Independent review verified the final implementation and records and signed off with no remaining finding.
+- **Assessment:** Auth is coroutine-safe, worker-lifecycle-aware, current at the audited Laravel surface, failure-truthful, and bounded. Every accepted finding is fixed at its owning boundary without a workaround, speculative abstraction, meaningful hot-path regression, unresolved defect, TODO, or stale superseded path.
 ### Complete Notifications correctness, Slack parity, and reentrant failure ownership
 
 - **Status and inspected surface:** Complete; implementation, focused validation, the authoritative gate, fresh self-review, and independent code review are signed off. The audit covered every Notifications source, unit, and integration file; Slack Block Kit and transport surfaces; Mail, Queue, Database, Horizon, Support, and Contracts consumers; split/root metadata and public docs; current Laravel Framework, Slack channel, Horizon, and documentation sources plus originating pull requests; and carried `notifications-07`, `notifications-08`, `queue-41`, `support-02`, and `macroable-03`. The detailed design is recorded in [`2026-08-04-2030-notifications-correctness-slack-parity-and-reentrant-failure-ownership.md`](2026-08-04-2030-notifications-correctness-slack-parity-and-reentrant-failure-ownership.md).