[mrchypark]

Add opt-in Rhiza v0.21.2 standalone-local init recovery and remove the vulnerable JOSE v3 runtime dependency through a versioned Fosite fork.

Changes

• Pin Rhiza v0.21.2 (8acb6da35a4c6fc83fa14ecec2fe2b64370fa4bd), verify required Go SDK artifacts, and build GoAuthy-owned init/main from the same image.
• Add the shared-DataDir singleton standalone-local overlay, lifecycle/recovery/receipt controls and incompatible-backup guards. Existing profile defaults remain unchanged; this does not automatically migrate existing archives or convert HA to Local.
• Replace canonical Fosite imports with mrchypark/fosite v0.49.0-goauthy.1, commit 06741a29e6f11260e9d6fe45222eedc00cb38959, using official JOSE v4.1.6. No local source copy, scanner exception or checksum bypass remains.
• Add malicious JWK and valid RSA client-authentication regression controls. Install Git only in build stages for normal module-fetch fallback.

Validation

• Rhiza v0.21.2 focused storage/init normal/race controls pass: abrupt exit, full DataDir loss, acknowledged SQL/original receipt recovery, subsequent writes and changed-history rejection.
• Pinned Floci S3/GCS/Azure SDK archive-adoption/ACK-tail contracts passed without skips. This is not per-provider init/main application or production-cloud qualification.
• Fosite fork full normal/race suites and independent review passed. Final GoAuthy focused normal/race authentication/security controls and module verification passed.
• Actual linux/amd64 final-image build passed. Grype v0.118.0, High cutoff, only-fixed=false: zero matches and ignored matches. All four binary inventories identify JOSE v4.1.6 with no linked v3, and identify the versioned Fosite replacement. Temporary image/container/extracted binaries were removed.
• Public Go proxy and sum.golang.org now resolve the fork tag to the expected commit and pinned module hashes; the earlier propagation 404 is resolved.
• Exact head 6dbb3d5 automatic CI: https://github.com/mrchypark/goauthy/actions/runs/41266269447 . Browser, Unit, Vet and Manifest SUCCESS; Race still in progress at preparation. Older-head CI is not credited to this head.

Review and operational limits

Independent scoped reviews are clean; final integration readback is being confirmed. No unresolved GitHub review threads were found. Main is an ancestor of this head; strict Unit/Race/Vet protection and administrator enforcement remain enabled. No merge, release or deployment is performed by this preparation.

Preserve issuer, identities, master keys and existing archives. First Local-profile adoption requires a fresh namespace and external old-writer fencing; one replica is not fencing and emptyDir is lost with its Pod. Earlier native browser recovery evidence used v0.21.1, not a v0.21.2 full browser journey. No live Kubernetes, HA, live cloud or production qualification is claimed.

Fork release: https://github.com/mrchypark/fosite/releases/tag/v0.49.0-goauthy.1
Upstream contribution: ory/fosite#892
Return to official Fosite after a compatible fixed release passes equivalent tests and image scan; PR merge alone is not sufficient.

[mrchypark]

Fosite security remediation is implemented at 6dbb3d5.

• Versioned fork: https://github.com/mrchypark/fosite/releases/tag/v0.49.0-goauthy.1 (06741a29e6f11260e9d6fe45222eedc00cb38959); canonical imports retained, local source replacement removed.
• Upstream PR: fix: migrate go-jose to v4.1.6 ory/fosite#892. Return to official Fosite only after a compatible fixed release and equivalent tests/image scan pass.
• Fork full normal/race suites and independent review passed. Final GoAuthy focused security/auth normal 3.533s and race 17.714s passed; go mod verify passed.
• Actual linux/amd64 final-image build passed after adding Git to builder stages. Grype v0.118.0 High cutoff, only-fixed=false: zero matches/ignored matches. All four binary inventories identify JOSE v4.1.6, no linked v3; Fosite replacement is versioned. Own image/container/extracted binaries cleaned.
• Fresh-cache sum.golang.org lookup still returned unknown-revision 404 despite published tag; pinned-sum root resolution and Docker build passed. No checksum bypass/ignore added. New environments remain a verification caveat until public checksum propagation is confirmed.
• Exact new-head automatic CI is pending; prior-head CI is not credited to this commit. No merge, release, or deployment performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T03:12:38.483971Z	6dbb3d5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.