Verification Matrix
The core authentication paths of the logi server are covered by automated tests, and major releases were confirmed by measurements in production. End-to-end checks on physical devices and features that are off by default are still outside verification. This page shows that boundary for each feature.
How to read this page
- Verified: behavior with automated tests, or behavior confirmed in production after a release, with a date.
- Outside verification: no code yet, code that is off by default, or no record of a check on the real path.
- "Not verified" does not mean it is broken. It means there is no record of a check.
- Automated tests are run manually when something changes. This table does not guarantee that the full suite passes on any particular version.
- As of: 2026-09-28.
Matrix by feature
| Feature | Verified | Outside verification |
|---|---|---|
| OAuth 2.0 / OIDC core | Automated tests for authorize, token, refresh rotation, revocation, introspection, userinfo, JWKS, and discovery. Automated tests for rejecting tokens issued to another client (audience binding), pairwise sub, and RFC 8707 resource. Production smoke test of redirect-loop protection (2026-06-30) | resource binding on the app-to-app (native) path is not implemented. Requests on that path that carry resource are rejected (fail-closed). Redirect URI trust tiers are at the design stage |
| Passkeys | Automated tests for registration, authentication, challenge concurrency, and assertion verification. Production health check after release (2026-06-23) | End-to-end biometric authentication on physical devices is not verified |
| Push login approval | Automated tests for fan-out, dismissing the prompt on other devices, the fallback hint when a prompt goes unacknowledged, the response contract, enumeration protection, and audit records. Real delivery and tap handling of agent approval pushes measured (2026-08-11) | The real-delivery check was run once on a narrow scope. There is no continuous monitoring. The unacknowledged-prompt fallback has tests, but its production release and real delivery are not verified |
| Consent screen, QR login, anonymous account upgrade | Automated tests for the consent flow, per-item consent, the consent form nonce round trip, QR authorization, and anonymous account creation and swap. Account-switch dialog confirmed on a physical device (2026-08-30) | Android parity for account switching is incomplete. End-to-end anonymous upgrade on physical devices is not verified |
| Back-channel logout and sessions | Automated tests for logout token issuance, RP fan-out, and the session logout cascade. Successful real request confirmed in production logs (2026-08-05) | Device slot eviction (device mode) has code but is off by default, with no check on the real path |
| Connected apps and recommended apps | Automated tests for the connected apps list, disconnect, and recommended apps | Landing in the app store is not covered by automated checks (not verified) |
| SDKs and CLI | Automated tests for CLI commands. CLI end-to-end run in live mode (2026-07-07). CLI releases update RubyGems and Homebrew together from a tag | Whether each platform SDK has automated tests is not verified in this table. The confidential RP split flow is not implemented |
| Zero Trust | Automated tests for the admin screen and for security event (SSF) issuance, delivery, and concurrency. Phase 1 released to production (2026-07-12) | Login-method enforcement runs in observe mode, so the blocking path has no check on the real path. Continuous-verification event delivery has code but is turned off |
| Mobile apps | Android unit tests and screenshot regression goldens. Maestro cross-platform UI flows | Both suites run manually. The last Maestro run on iOS (2026-05-26) passed 7 of 10 flows with 3 failures, and no full pass has been confirmed since. No native end-to-end UI test on iOS. The App Clip biometric gate and the mac Gatekeeper path are not verified on physical devices |
| RP health alerts | Automated tests that run the RP health check in sequence and count alerts. An alert fires only when an app with a prior healthy record first becomes unreachable | Whether operator alerts reach a real channel is not verified |
| Email verification link records | Tests that simulate the production environment check, for the email verification paths under test, that logs and job arguments carry no token and that raw mail is not written to logs. Automated test for concurrent requests for the same address | No measurement against production logs |
| MCP approval server | 13 automated tests (tool list, input schema constraints, decision wait timeout, idempotency key, cancel) | Calls against a real server are not verified |
| Agent run outcome records | Automated tests that go over HTTP from approval consumption through outcome reporting to the wallet view (success, failure, unknown outcome, blocking other users and other apps, idempotent resend, audit chain tamper detection). Automated test for concurrent processing of the same report | Outcomes are self-reported by the RP, so logi cannot confirm the action actually ran. On-device rendering of the app screens is not verified |
| Local mock IdP | 26 automated tests for logi dev mock: discovery, authorize, token, userinfo, revoke, JWKS, PKCE, refresh rotation, webhook signatures | The adb reverse path for the Android emulator is not verified |