Reproduce / Examine / Limit
I wrote up three small, AI-assisted experiments around replay protection, retries and refresh-token rotation. The test results are local, and the source repositories are private for now.
Local tests / Experiment 1
Action and principal binding, expiry, one-time consume, and a burst of scheduled calls.
Observed result
One acceptance out of 200 local Promise-scheduled attempts; five test cases pass.
What this does not prove
One event loop, one process. Not a distributed replay-store or attestation test.
Local tests / Experiment 2
Operation key reuse, request fingerprint mismatches, tenant isolation and retained uncertain outcomes.
Observed result
One side-effect callback under 100 concurrent scheduled requests; six test cases pass.
What this does not prove
No real database, network latency, process crash or external payment tested.
Local tests / Experiment 3
Single-use token family, replay rejection, expiry, and bounded-state revocation.
Observed result
One refresh successor under 200 local scheduled uses; five test cases pass.
What this does not prove
In-memory reference, not a production authentication service.
The useful next step would be trying these cases across real workers with shared storage. For now they're good at illustrating the problem, not proving a production deployment safe.
