Pillar: P4 Forge in a link (#590). One run. After #575 (pull #704).
Outcome. A claim link looks like https://child/claim#<token>. The secret never reaches a server, edge, proxy or access log on the way in. Only the claim form posts it, in the body.
The path: the person opens the link. The page reads the fragment and checks it with a POST. They see the same "This forge is yours" form and claim as today.
Acceptance.
[ ] claimUrl uses a fragment. GET /claim serves the page with no secret in the request. A small inline script moves the fragment into the form's hidden field and removes it from the address bar.
[ ] Validation (used, expired, unknown) happens on POST, so the page shows the same plain states.
[ ] Without JavaScript, the page says the link needs JavaScript and offers a paste box for the token.
[ ] The old /claim/:token path keeps working for links already sent (or the pull says it was never released).
[ ] Refusing tests: the access log line of a claim request holds no token. A cross-origin POST is refused.
[ ] Done means reachable: the page, the tests, and a look. No MCP tool applies, because claiming is a person's act.
Start from: src/web/pages/claim.ts, src/spawn/claim.ts, src/actions/spawn.ts, the access log in src/http/server.ts.
Must not touch: the release workflow, the chart, the edge rules.
Pillar: P4 Forge in a link (#590). One run. After #575 (pull #704).
Outcome. A claim link looks like
https://child/claim#<token>. The secret never reaches a server, edge, proxy or access log on the way in. Only the claim form posts it, in the body.The path: the person opens the link. The page reads the fragment and checks it with a POST. They see the same "This forge is yours" form and claim as today.
Acceptance.
claimUrluses a fragment.GET /claimserves the page with no secret in the request. A small inline script moves the fragment into the form's hidden field and removes it from the address bar./claim/:tokenpath keeps working for links already sent (or the pull says it was never released).Start from: src/web/pages/claim.ts, src/spawn/claim.ts, src/actions/spawn.ts, the access log in src/http/server.ts.
Must not touch: the release workflow, the chart, the edge rules.