# Review brief: console email sign-in spec (rev 1)

Repo: carlos/platform, branch `email-signin`, commit 49eaacf0.
Spec: `docs/superpowers/specs/2026-10-21-console-email-signin-design.md`.

You are an independent reviewer. Read the spec, then read the code it
changes to check every claim against it: `internal/console/server.go`
(handleContinue, handleSignin, handleCallback, handleConfirm,
handleInvite, handleInvitePage, handleAcceptInvite, session, setCookie),
`internal/console/stepup.go`, `internal/console/keymail.go`,
`internal/console/keymailfed.go`, `internal/console/consolemail.go`,
`internal/console/authcli.go` (device flow, clientIP, notifyCLIIssued),
`internal/console/store.go` (sessions, confirmations, invites),
`internal/console/store_gate.go` (claimSQLTables), `cmd/console/main.go`
(consoleMailer wiring), `infra/modules/region-host` (console_mail_*).

Rulings R1-R4 in §2 are Paul's and fixed. Do not re-argue them; report
only mechanisms that fail to honour them.

Report, ranked P1 (security hole or will not work) / P2 (real defect) /
P3 (worth fixing):
- security holes: session fixation, login CSRF, downgrade of Keymail
  sessions to email re-confirmation, oracles (account existence, Keymail
  mailbox existence, rate limiting), token/code brute force, link
  scanners consuming tokens, open redirects via `next`, the pending
  action being swapped or replayed, mail-cannon abuse;
- places the spec contradicts the code or would break an existing flow
  (Keymail sign-in, the Apps-inbox confirmation, invites, CLI login,
  claim-mode gates);
- missing pieces a builder would trip over.

For each finding: the spec section, the code location (file:line) that
proves it, the failure scenario, and a suggested fix. Verify every code
citation. Do not edit files. Do not spawn Anthropic-model reviewers or
subagents of your own. Do not run the full test suites.