mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-27 05:57:27 +00:00
pulse-triage[bot]
ee07be5a53
Reuse the existing admitted cookie session only after a cookie-only request validates it against the current backend. Keep explicit session and token tests independent, reject revoked state, and propagate unexpected probe failures. The registration journey uses its documented cookie/CSRF authentication so removing a dedicated host token cannot invalidate its removal observer. Retain both the HTTP-success and removed-resource assertions, add behavioral adverse controls and run them in ordinary E2E CI. Contract-Neutral: Test fixtures reuse validated cookie sessions and select documented cookie auth; production authentication budgets, token revocation, API and tenant contracts are unchanged. Change-source: pulse-maintainer