Changelog - Dev - 06.23.2026

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

---

[Unreleased] - 2026-06-23

Added

• External OTP verification and app-controlled UID bootstrap: Implements Slice 2 of the flag-gated external OTP provider (Prelude), adding the verify endpoint and UID bootstrap flow. The feature ships dormant by default (OTP_PROVIDER flag) and includes ban-check enforcement before minting new user identities, with full phone-number verification support. (#619) enhancement security

Changed

• Refactor phone OTP router for per-route App Check: Consolidates phone OTP authentication into a single default-export router with per-route App Check enforcement, improving security posture and maintainability of the OTP endpoint structure. (#619) enhancement security

Fixed

• Address pre-PR adversarial review findings in OTP verification: Hardens the verify-otp endpoint with ban-check validation, prevents role-account reuse, requires pepper in proof generation, and guards signup verification against double-submit attacks. (#619) enhancement security
• Hold step-4 spinner through signup handoff to prevent flicker: Improves signup UX by maintaining the loading spinner through the handoff from OTP verification to account creation, eliminating a brief confirm state flicker. (#619) enhancement security

Security

• Enforce verified phone-number bans and bootstrap security controls: Adds phone-number ban enforcement during OTP verification, requires signed OTP proof (otpProof) for user creation, and stages OTP_PROOF_SECRET for secure bootstrap minting. Includes comprehensive documentation of the two-stage identity bootstrap process and subpoena-resistant phone hash flows. (#619) enhancement security