{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[880eb778] Harden auth: fail-closed votes, mock OAuth gate, Secure cookies.\n\nAlso show the current alias in the top nav and pin durable by rev.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/AGENTS.md b/AGENTS.md\nindex babb889d6fbfb1fa7176c9e6b7544ae17b61dd2e..6e0fd8ebb65d665c9c1438e3275971d62b98fd95 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -10,11 +10,11 @@ Single Rust web app **`sorter2-server`**: pairwise voting, rank-centrality ranki\n \n - **Bootstrap script**: `./scripts/cursor-env-install.sh` (also run via `.cursor/environment.json` on Cloud Agent boot) installs Playwright Chromium, Babashka, bbin, `clj-paren-repair`, and warms the RocksDB build.\n - **Rust 1.88+** is required (`rust-toolchain.toml`). The Cloud Dockerfile and `cursor-env-install.sh` install **rustup** 1.88.0 first so `cargo` works while Playwright/Clojure bootstrap continues. Do not rely on `/usr/local/cargo` (often missing or stale).\n-- **RocksDB / `durable`**: Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS=\"-C linker=g++\"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.\n+- **RocksDB / `durable`**: `durable` is an external git dependency (`tommy-mor/durable`, pinned by rev in `server/Cargo.toml`). Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS=\"-C linker=g++\"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.\n - **System packages** for builds: `build-essential`, `g++`, `clang`, `libclang-dev`, `pkg-config`, `libssl-dev`, `openjdk-21-jre-headless` (for `reqwest` / OpenSSL, `librocksdb-sys`, `zstd-sys` / bindgen, and **bbin** / Clojure JVM). The bootstrap sets **`JAVA_HOME`** when Java is present.\n - **Clojure CLI 1.12.0.1530** (used in CI): install from https://clojure.org/guides/install_clojure — needed for `./scripts/clj-test.sh` / Kaocha tests.\n - **Babashka / bbin / clj-paren-repair**: installed by `cursor-env-install.sh` into `~/.local/bin` (bb tasks in `bb.edn`, delimiter repair for Clojure edits).\n-- **Playwright** (Spel browser tests in `test/vote_compare.clj`): Chromium via `clojure -M -e \"(com.microsoft.playwright.CLI/main ...)\"` — run once after clone or use the bootstrap script.\n+- **Playwright** (Spel browser tests in `test/vote_compare.clj` / `test/auth_login.clj`): Chromium via `clojure -M -e \"(com.microsoft.playwright.CLI/main ...)\"` — run once after clone or use the bootstrap script.\n \n ### Commands (see also `TEST.sh`)\n \n@@ -34,13 +34,17 @@ Environment variables (defaults in `server/src/state.rs`):\n - `PORT` — default `8080`\n - `SORTER2_DATA_DIR` — default `./data` (created on startup)\n - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`\n+- `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)\n+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)\n+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)\n \n Health check: `GET /healthz` → `ok`.\n \n-Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Example vote:\n+Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Votes require a session cookie (sign in via `/login`). Example vote:\n \n ```bash\n curl -sf -X POST http://127.0.0.1:8080/ui \\\n+  --cookie \"sorter2_session=...\" \\\n   --data-urlencode '__rpc__={\"action\":\"record_vote\",\"a\":\"alpha\",\"b\":\"beta\",\"ratio_left\":2,\"ratio_right\":1}'\n ```\n \ndiff --git a/Cargo.lock b/Cargo.lock\nindex aa02997ad85777195f135bfd9456bcee0fc9a590..1f8690f3e486d099577a32c2ece48caf57ea7160 100644\n--- a/Cargo.lock\n+++ b/Cargo.lock\n@@ -414,7 +414,7 @@ dependencies = [\n [[package]]\n name = \"durable\"\n version = \"0.2.0\"\n-source = \"git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n+source = \"git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n dependencies = [\n  \"ciborium\",\n  \"durable-derive\",\n@@ -426,7 +426,7 @@ dependencies = [\n [[package]]\n name = \"durable-derive\"\n version = \"0.2.0\"\n-source = \"git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n+source = \"git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n dependencies = [\n  \"proc-macro2\",\n  \"quote\",\ndiff --git a/server/Cargo.toml b/server/Cargo.toml\nindex dfa39beddecfa37dcdeaa602cb30f4b547528fbb..bd88687fb0ba47d68f2c08eb5e11d0e08b7c4398 100644\n--- a/server/Cargo.toml\n+++ b/server/Cargo.toml\n@@ -25,7 +25,7 @@ futures-util = { version = \"0.3\", default-features = false, features = [\"std\"] }\n rand = \"0.8\"\n urlencoding = \"2\"\n url = \"2\"\n-durable = { git = \"https://github.com/tommy-mor/durable.git\", branch = \"main\" }\n+durable = { git = \"https://github.com/tommy-mor/durable.git\", rev = \"a6c14eaa809693140eea0c22b07ef24d8e74adaf\" }\n \n [dev-dependencies]\n reqwest = { version = \"0.12\", features = [\"json\"] }\ndiff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs\nindex b86581b1f337650564274254d840e8a75b49524d..9da62ffbed07eb28729aa3160bf33b07ce0d7945 100644\n--- a/server/src/api/ui_html.rs\n+++ b/server/src/api/ui_html.rs\n@@ -71,10 +71,16 @@ pub async fn post_ui_html(\n                 return resp;\n             }\n             let parent = parent_from_scope(&scope);\n-            let actor = resolve_vote_actor(\n+            let actor = match resolve_vote_actor(\n                 state.projection_store.db(),\n                 session_id_from_jar(&jar).as_deref(),\n-            );\n+            ) {\n+                Ok(actor) => actor,\n+                Err(_) => {\n+                    return vote_auth_redirect(&state, &jar)\n+                        .unwrap_or_else(|| login_redirect_js().into_response());\n+                }\n+            };\n             if let Err(e) = state\n                 .record_vote(&parent, &a, &b, ratio_left, ratio_right, &actor)\n                 .await\ndiff --git a/server/src/auth/config.rs b/server/src/auth/config.rs\nindex a1f042c655bf3e5234eeb87a7d889f64592807fb..a5976af9a52ea207b35ae87bd1fe927c47a477ca 100644\n--- a/server/src/auth/config.rs\n+++ b/server/src/auth/config.rs\n@@ -1,9 +1,42 @@\n pub const AUTH_RETURN_COOKIE: &str = \"sorter2_auth_return\";\n \n+/// Allow `mock_user` on `/auth/github` (test harness only).\n+pub fn mock_oauth_allowed() -> bool {\n+    matches!(\n+        std::env::var(\"SORTER2_ALLOW_MOCK_OAUTH\").as_deref(),\n+        Ok(\"1\") | Ok(\"true\") | Ok(\"TRUE\")\n+    )\n+}\n+\n+/// Set the Secure flag on auth cookies when serving over HTTPS.\n+pub fn cookies_secure() -> bool {\n+    std::env::var(\"SORTER2_BASE_URL\")\n+        .map(|u| u.starts_with(\"https://\"))\n+        .unwrap_or(false)\n+}\n+\n pub fn sanitize_return_to(raw: &str) -> String {\n     let s = raw.trim();\n-    if s.is_empty() || !s.starts_with('/') || s.starts_with(\"//\") {\n+    if s.is_empty() || !s.starts_with('/') || s.starts_with(\"//\") || s.starts_with(\"/\\\\\") {\n+        return \"/\".to_string();\n+    }\n+    // Reject scheme-relative and protocol-smuggling forms.\n+    if s.contains(\"://\") || s.contains('\\\\') {\n         return \"/\".to_string();\n     }\n     s.to_string()\n }\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    #[test]\n+    fn sanitize_return_to_blocks_open_redirects() {\n+        assert_eq!(sanitize_return_to(\"\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"//evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"/\\\\evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"https://evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"/vote?parent=x\"), \"/vote?parent=x\");\n+    }\n+}\ndiff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs\nindex 5ed535ba199fa736f0048c32623b14c3b1e5de2d..d4a85ef52c15dc35148e4c743f0d646cbbdb056d 100644\n--- a/server/src/auth/mod.rs\n+++ b/server/src/auth/mod.rs\n@@ -26,7 +26,7 @@ use crate::{\n     ui_action::UI_RPC_FIELD,\n };\n \n-pub use session::{resolve_vote_actor, session_id_from_jar, VoteActor};\n+pub use session::{nav_pseudonym, resolve_vote_actor, session_id_from_jar, VoteActor};\n \n pub fn base_url_from_env(port: u16) -> String {\n     std::env::var(\"SORTER2_BASE_URL\")\n@@ -168,6 +168,10 @@ pub async fn login_page(\n         \"login · sorter2\",\n         login_body(session.as_ref(), &aliases, &providers),\n         state.views.get_views(\"/login\"),\n+        session\n+            .as_ref()\n+            .filter(|s| !s.pseudonym.trim().is_empty())\n+            .map(|s| s.pseudonym.as_str()),\n     );\n     (jar, Html(markup.into_string())).into_response()\n }\n@@ -222,6 +226,7 @@ pub async fn alias_page(\n             \"choose alias · sorter2\",\n             body,\n             state.views.get_views(\"/login/alias\"),\n+            None,\n         )\n         .into_string(),\n     )\n@@ -237,7 +242,12 @@ pub async fn github_start(\n         .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n     let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());\n     let state_token = session::new_oauth_state();\n-    let url = oauth::authorize_url(&cfg, &state_token, query.mock_user.as_deref());\n+    let mock_user = if config::mock_oauth_allowed() {\n+        query.mock_user.as_deref()\n+    } else {\n+        None\n+    };\n+    let url = oauth::authorize_url(&cfg, &state_token, mock_user);\n     let jar = jar\n         .add(session::oauth_state_cookie_value(&state_token))\n         .add(session::auth_return_cookie_value(&return_to));\ndiff --git a/server/src/auth/session.rs b/server/src/auth/session.rs\nindex 09659240b9455c6fca12db5652e1d31cf8c2acfc..41df030ded3abcafc0ab3887ab769adf103f9aa0 100644\n--- a/server/src/auth/session.rs\n+++ b/server/src/auth/session.rs\n@@ -5,7 +5,7 @@ use durable::{Db, Durability};\n use rand::Rng;\n \n use crate::{\n-    auth::config::AUTH_RETURN_COOKIE,\n+    auth::config::{self, AUTH_RETURN_COOKIE},\n     fetch::now_ms,\n     identity::{DEFAULT_ACTOR_UUID, DEFAULT_PSEUDONYM},\n     storage_dto::{SessionDataV1, SESSION_DATA_VERSION},\n@@ -37,6 +37,7 @@ pub struct VoteActor {\n }\n \n impl VoteActor {\n+    /// Test / bench helper: seed votes as the default pseudonym without a session.\n     pub fn anon() -> Self {\n         Self {\n             pseudonym: DEFAULT_PSEUDONYM.to_string(),\n@@ -70,20 +71,51 @@ fn hex_encode(bytes: &[u8]) -> String {\n     bytes.iter().map(|b| format!(\"{b:02x}\")).collect()\n }\n \n-pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> VoteActor {\n-    let Some(session_id) = session_id else {\n-        return VoteActor::anon();\n-    };\n-    let Ok(Some(session)) = load_session(db, session_id) else {\n-        return VoteActor::anon();\n-    };\n-    if session.expires_at <= now_ms() {\n-        return VoteActor::anon();\n+fn build_cookie(name: &'static str, value: String) -> Cookie<'static> {\n+    let mut builder = Cookie::build((name, value))\n+        .http_only(true)\n+        .same_site(SameSite::Lax)\n+        .path(\"/\");\n+    if config::cookies_secure() {\n+        builder = builder.secure(true);\n+    }\n+    builder.build()\n+}\n+\n+fn clear_cookie(name: &'static str) -> Cookie<'static> {\n+    let mut builder = Cookie::build((name, \"\"))\n+        .http_only(true)\n+        .same_site(SameSite::Lax)\n+        .path(\"/\")\n+        .removal();\n+    if config::cookies_secure() {\n+        builder = builder.secure(true);\n+    }\n+    builder.build()\n+}\n+\n+/// Resolve the vote actor from a live session. Fail-closed: never falls back to anon.\n+pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> Result<VoteActor, &'static str> {\n+    let session_id = session_id.ok_or(\"sign in to vote\")?;\n+    let session = load_valid_session(db, session_id).ok_or(\"session expired\")?;\n+    if !session_has_pseudonym(&session) {\n+        return Err(\"choose an alias first\");\n     }\n     let trust_weight = user_trust_weight(db, &session.uuid).unwrap_or(1.0);\n-    VoteActor {\n+    Ok(VoteActor {\n         pseudonym: session.current_pseudonym,\n         trust_weight,\n+    })\n+}\n+\n+/// Display name for the top nav, if any session is active.\n+pub fn nav_pseudonym(db: &Db, jar: &CookieJar) -> Option<String> {\n+    let session_id = session_id_from_jar(jar)?;\n+    let session = load_valid_session(db, &session_id)?;\n+    if session_has_pseudonym(&session) {\n+        Some(session.current_pseudonym)\n+    } else {\n+        None\n     }\n }\n \n@@ -151,54 +183,27 @@ pub fn destroy_session(db: &Db, session_id: &str) -> Result<(), String> {\n }\n \n pub fn session_cookie_value(session_id: &str) -> Cookie<'static> {\n-    Cookie::build((SESSION_COOKIE, session_id.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(SESSION_COOKIE, session_id.to_string())\n }\n \n pub fn clear_session_cookie() -> Cookie<'static> {\n-    Cookie::build((SESSION_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(SESSION_COOKIE)\n }\n \n pub fn oauth_state_cookie_value(state: &str) -> Cookie<'static> {\n-    Cookie::build((OAUTH_STATE_COOKIE, state.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(OAUTH_STATE_COOKIE, state.to_string())\n }\n \n pub fn clear_oauth_state_cookie() -> Cookie<'static> {\n-    Cookie::build((OAUTH_STATE_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(OAUTH_STATE_COOKIE)\n }\n \n pub fn auth_return_cookie_value(return_to: &str) -> Cookie<'static> {\n-    Cookie::build((AUTH_RETURN_COOKIE, return_to.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(AUTH_RETURN_COOKIE, return_to.to_string())\n }\n \n pub fn clear_auth_return_cookie() -> Cookie<'static> {\n-    Cookie::build((AUTH_RETURN_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(AUTH_RETURN_COOKIE)\n }\n \n pub fn auth_return_from_jar(jar: &CookieJar) -> Option<String> {\n@@ -213,28 +218,35 @@ pub fn oauth_state_from_jar(jar: &CookieJar) -> Option<String> {\n     jar.get(OAUTH_STATE_COOKIE).map(|c| c.value().to_string())\n }\n \n-pub fn actor_uuid_for_vote(db: &Db, session_id: Option<&str>) -> String {\n-    let Some(session_id) = session_id else {\n-        return DEFAULT_ACTOR_UUID.to_string();\n-    };\n-    load_session(db, session_id)\n-        .ok()\n-        .flatten()\n-        .filter(|s| s.expires_at > now_ms())\n-        .map(|s| s.uuid)\n-        .unwrap_or_else(|| DEFAULT_ACTOR_UUID.to_string())\n-}\n-\n #[cfg(test)]\n mod tests {\n     use super::*;\n \n     #[test]\n-    fn missing_session_falls_back_to_anon() {\n+    fn missing_session_is_error() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let db = Db::open(dir.path()).unwrap();\n+        assert_eq!(resolve_vote_actor(&db, None).unwrap_err(), \"sign in to vote\");\n+    }\n+\n+    #[test]\n+    fn session_without_pseudonym_is_error() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let db = Db::open(dir.path()).unwrap();\n+        let (id, _) = create_session(&db, DEFAULT_ACTOR_UUID, \"\").unwrap();\n+        assert_eq!(\n+            resolve_vote_actor(&db, Some(&id)).unwrap_err(),\n+            \"choose an alias first\"\n+        );\n+    }\n+\n+    #[test]\n+    fn session_with_pseudonym_resolves() {\n         let dir = tempfile::tempdir().unwrap();\n         let db = Db::open(dir.path()).unwrap();\n-        let actor = resolve_vote_actor(&db, None);\n-        assert_eq!(actor.pseudonym, DEFAULT_PSEUDONYM);\n+        let (id, _) = create_session(&db, DEFAULT_ACTOR_UUID, \"alice\").unwrap();\n+        let actor = resolve_vote_actor(&db, Some(&id)).unwrap();\n+        assert_eq!(actor.pseudonym, \"alice\");\n         assert_eq!(actor.trust_weight, 1.0);\n     }\n }\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex 46d18b87f1313bf0aeb29955d18f291961057509..3cc3d7bdf55b5cb5d009600f4ade1fcd201a410b 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -4,11 +4,13 @@ use axum::{\n     http::{header, StatusCode, Uri},\n     response::{IntoResponse, Response},\n };\n+use axum_extra::extract::cookie::CookieJar;\n use maud::{html, Markup, DOCTYPE};\n \n use std::collections::HashSet;\n \n use crate::{\n+    auth::nav_pseudonym,\n     fetch::html::entity_section,\n     form_template::template_json_compact,\n     path_types::ItemId,\n@@ -126,7 +128,7 @@ pub fn now_ms() -> i64 {\n     t.as_millis() as i64\n }\n \n-pub(crate) fn layout(title: &str, body: Markup, views: u64) -> Markup {\n+pub(crate) fn layout(title: &str, body: Markup, views: u64, nav_user: Option<&str>) -> Markup {\n     let ver = asset_version();\n     let css_href = format!(\"/static/sorter.css?v={ver}\");\n     let js_src = format!(\"/static/sorter_ui.js?v={ver}\");\n@@ -145,7 +147,15 @@ pub(crate) fn layout(title: &str, body: Markup, views: u64) -> Markup {\n                     span class=\"view-meta muted\" { (views) \" views\" }\n                 }\n                 nav class=\"top-nav\" {\n-                    a href=\"/login\" { \"login\" }\n+                    @if let Some(name) = nav_user {\n+                        span class=\"top-nav-user\" data-testid=\"nav-user\" { (name) }\n+                        a href=\"/login\" { \"account\" }\n+                        form class=\"top-nav-logout\" method=\"post\" action=\"/auth/logout\" data-navigate=\"full\" {\n+                            button type=\"submit\" data-testid=\"nav-logout\" { \"log out\" }\n+                        }\n+                    } @else {\n+                        a href=\"/login\" data-testid=\"nav-login\" { \"login\" }\n+                    }\n                 }\n                 div id=\"errors\" {}\n                 (body)\n@@ -481,10 +491,11 @@ pub fn input_panel(query: &str, error: Option<&str>) -> Markup {\n     }\n }\n \n-async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {\n+async fn item_page(state: AppState, uri: Uri, item: ItemId, jar: CookieJar) -> Markup {\n     let path = uri.path().to_string();\n     state.views.increment(path.clone());\n     let views = state.views.get_views(&path);\n+    let nav_user = nav_pseudonym(state.projection_store.db(), &jar);\n \n     let tree = state\n         .scope_tree(&item)\n@@ -513,16 +524,24 @@ async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {\n             (ranking_panel(&item, node, &tree))\n         }\n     };\n-    layout(\"sorter2\", body, views)\n+    layout(\"sorter2\", body, views, nav_user.as_deref())\n }\n \n-pub async fn home(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {\n-    item_page(state, uri, ItemId::root()).await\n+pub async fn home(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    uri: Uri,\n+) -> impl IntoResponse {\n+    item_page(state, uri, ItemId::root(), jar).await\n }\n \n-pub async fn browse(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {\n+pub async fn browse(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    uri: Uri,\n+) -> impl IntoResponse {\n     let item = ItemId::from_browse_uri(uri.path()).unwrap_or(ItemId::root());\n-    item_page(state, uri, item).await\n+    item_page(state, uri, item, jar).await\n }\n \n #[cfg(test)]\ndiff --git a/server/src/html/vote.rs b/server/src/html/vote.rs\nindex 3aa00c417c89a9cab3417c650b50ed7c73f08e20..cadbec188b17a48a63b269c0e2fa2ea8ffedd7ed 100644\n--- a/server/src/html/vote.rs\n+++ b/server/src/html/vote.rs\n@@ -4,11 +4,13 @@ use axum::{\n     extract::{Query, State},\n     response::{Html, IntoResponse},\n };\n+use axum_extra::extract::cookie::CookieJar;\n use maud::{html, Markup};\n use serde::Deserialize;\n use std::collections::HashSet;\n \n use crate::{\n+    auth::nav_pseudonym,\n     fetch::html::entity_section,\n     form_template::template_json_compact,\n     html::{ranking_panel_with_highlights, scope_theme_style, JsBuilder},\n@@ -262,6 +264,7 @@ fn suggest_next(\n \n pub async fn vote_page(\n     State(state): State<AppState>,\n+    jar: CookieJar,\n     Query(q): Query<VoteQuery>,\n ) -> impl IntoResponse {\n     let parent = parse_item_param(&q.parent);\n@@ -329,8 +332,9 @@ pub async fn vote_page(\n     let path = format!(\"/vote?parent={}\", urlencoding::encode(parent.as_str()));\n     state.views.increment(path.clone());\n     let views = state.views.get_views(&path);\n+    let nav_user = nav_pseudonym(state.projection_store.db(), &jar);\n \n-    Html(layout(&title, body, views).into_string()).into_response()\n+    Html(layout(&title, body, views, nav_user.as_deref()).into_string()).into_response()\n }\n \n #[cfg(test)]\ndiff --git a/server/static/sorter.css b/server/static/sorter.css\nindex e66a1e6c1acc473c8ff1ddb1e16e75a82d33741c..257280b6b490c65222e580a325b77351cac6cc6b 100644\n--- a/server/static/sorter.css\n+++ b/server/static/sorter.css\n@@ -34,6 +34,47 @@ body {\n   font-size: 0.75rem;\n }\n \n+.top-nav {\n+  display: flex;\n+  align-items: center;\n+  justify-content: flex-end;\n+  gap: 0.75rem;\n+  padding: 0.5rem 1rem;\n+  font-size: 0.875rem;\n+}\n+\n+.top-nav a {\n+  color: var(--muted);\n+  text-decoration: none;\n+}\n+\n+.top-nav a:hover {\n+  color: var(--fg);\n+}\n+\n+.top-nav-user {\n+  color: var(--fg);\n+  font-weight: 600;\n+}\n+\n+.top-nav-logout {\n+  display: inline;\n+  margin: 0;\n+}\n+\n+.top-nav-logout button {\n+  background: none;\n+  border: none;\n+  padding: 0;\n+  color: var(--muted);\n+  font: inherit;\n+  cursor: pointer;\n+}\n+\n+.top-nav-logout button:hover {\n+  color: var(--fg);\n+}\n+\n .btn-primary {\n   background: var(--accent);\n   color: var(--accent-fg, #0f1115);\ndiff --git a/test/support/harness.clj b/test/support/harness.clj\nindex 3f05951f418258642dcacb4a10ccccc8bfbe8748..4505ece5aa193e826ca61c52f1467d252080d66b 100644\n--- a/test/support/harness.clj\n+++ b/test/support/harness.clj\n@@ -43,6 +43,7 @@\n          \"SORTER2_VIEWS_LOG\" (str data-dir \"/views.jsonl\")\n          \"PORT\" (str app-port)\n          \"SORTER2_BASE_URL\" (str \"http://127.0.0.1:\" app-port)\n+         \"SORTER2_ALLOW_MOCK_OAUTH\" \"1\"\n          \"GITHUB_CLIENT_ID\" \"test-client\"\n          \"GITHUB_CLIENT_SECRET\" \"test-secret\"\n          \"GITHUB_OAUTH_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[b7626603] Remove browser sentinel delegates so multi-user votes work.\n\nShared WEB_BROWSER_AGENT bound on first vote and blocked every later human; browser posts now use no delegate, matching forum UI.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex 70435b412188a151c5e89e842a5de57f7480ddf2..a4a22724fc9e27879951f520a9241d5832982a70 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -1645,8 +1645,8 @@ async fn run() -> Result<()> {\n                     tokio::time::sleep(std::time::Duration::from_millis(poll_interval_ms)).await;\n                     let poll: PendingSessionPollResponse =\n                         expect_json(client.get(&poll_url).send().await?).await?;\n-                    if !poll.agent.trim().is_empty() {\n-                        agent_out = Some(poll.agent.clone());\n+                    if let Some(a) = poll.agent.as_deref().map(str::trim).filter(|s| !s.is_empty()) {\n+                        agent_out = Some(a.to_string());\n                     }\n                     if poll.complete {\n                         token_out = poll.token;\ndiff --git a/server/src/api/auth.rs b/server/src/api/auth.rs\nindex bfddcce4dc1a77571d297648dd840e6c5bc194f8..01c02f50c19bcd62c7f1717f9b927f203c3164d0 100644\n--- a/server/src/api/auth.rs\n+++ b/server/src/api/auth.rs\n@@ -29,12 +29,6 @@ use crate::{\n     write_cmd::WriteCmd,\n };\n \n-/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).\n-const INVITE_BROWSER_AGENT: &str = \"00000000-0000-0000-0000-000000000000:invite:web/join\";\n-\n-/// Agent id for `/login` browser OAuth (no CLI); must pass [`parse_agent`].\n-pub const WEB_BROWSER_AGENT: &str = \"00000000-0000-0000-0000-000000000001:social:web/browser\";\n-\n /// HttpOnly cookie storing the same `slug_*` bearer string the CLI uses.\n pub const SLUG_SESSION_COOKIE: &str = \"slug_session\";\n \n@@ -282,7 +276,7 @@ pub async fn get_join_invite(\n     let session = format!(\"p_{}\", uuid::Uuid::new_v4().simple());\n     let redirect_next = safe_local_redirect(q.next.as_deref().or(q.redirect.as_deref()));\n     let s = PendingSession {\n-        agent: INVITE_BROWSER_AGENT.to_string(),\n+        agent: None,\n         created_ts: now_ms(),\n         provider: None,\n         provider_id: None,\n@@ -549,7 +543,7 @@ pub async fn post_choose_username(\n     };\n \n     let sessions = pending_sessions(&state);\n-    let (provider, provider_id, agent) = {\n+    let (provider, provider_id) = {\n         let sessions_read = sessions.read().await;\n         let Some(s) = sessions_read.get(&form.session) else {\n             return api_error(StatusCode::NOT_FOUND, \"unknown session\", None).into_response();\n@@ -560,14 +554,9 @@ pub async fn post_choose_username(\n         let Some(provider_id) = s.provider_id.clone() else {\n             return js_form_error_fragment(&form.session, \"oauth not completed\").into_response();\n         };\n-        (provider, provider_id, s.agent.clone())\n+        (provider, provider_id)\n     };\n \n-    if let Err(msg) = parse_agent(&agent) {\n-        return js_form_error_fragment(&form.session, &format!(\"invalid agent format — {msg}\"))\n-            .into_response();\n-    }\n-\n     let redeem_invite = {\n         let sessions_read = sessions.read().await;\n         sessions_read\n@@ -637,7 +626,8 @@ pub async fn get_web_login(\n     let redirect_next = safe_local_redirect(q.next.as_deref().or(q.redirect.as_deref()))\n         .or_else(|| Some(\"/\".to_string()));\n     let s = PendingSession {\n-        agent: WEB_BROWSER_AGENT.to_string(),\n+        // Humans sign in via the website with no AI delegate.\n+        agent: None,\n         created_ts: now_ms(),\n         provider: None,\n         provider_id: None,\n@@ -698,7 +688,7 @@ pub async fn post_pending_session(\n     );\n     let poll_url = format!(\"/api/v0/pending-session/{session}\");\n     let s = PendingSession {\n-        agent: agent_naked,\n+        agent: Some(agent_naked),\n         created_ts: now_ms(),\n         provider: None,\n         provider_id: None,\ndiff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs\nindex 578e5844e86f7c2666c8e37ef9fa90c01d20d134..57a0139928b09034122398f8f3362cbdbcc5862e 100644\n--- a/server/src/api/ui_html.rs\n+++ b/server/src/api/ui_html.rs\n@@ -276,7 +276,7 @@ async fn dispatch_ui_action(\n                 &session.bearer,\n                 room.clone(),\n                 thread_tag.clone(),\n-                Some(crate::api::auth::WEB_BROWSER_AGENT.to_string()),\n+                None,\n                 text,\n             )\n             .await\ndiff --git a/server/src/state.rs b/server/src/state.rs\nindex 648ab5304764a329fcabbbbcd3782b94e3e005a8..8ea84dcf9b1df8f8037e913cdd94e5908e6d5d55 100644\n--- a/server/src/state.rs\n+++ b/server/src/state.rs\n@@ -21,7 +21,8 @@ pub struct InviteState {\n \n #[derive(Debug, Clone)]\n pub struct PendingSession {\n-    pub agent: String,\n+    /// CLI `identity start` delegate (`uuid:rig:model`). `None` for browser `/login` and `/join`.\n+    pub agent: Option<String>,\n     pub created_ts: i64,\n     pub provider: Option<String>,\n     pub provider_id: Option<String>,\ndiff --git a/server/tests/integration_ui.rs b/server/tests/integration_ui.rs\nindex d242abff5769cc704b3c8070d7456e5788c31a45..22b16c87d5ecdb5272a017af70b5353d8c39c6e8 100644\n--- a/server/tests/integration_ui.rs\n+++ b/server/tests/integration_ui.rs\n@@ -418,6 +418,99 @@ async fn test_web_login_carries_vote_pair_next_into_pending_session() {\n     let sessions = state.pending_sessions.read().await;\n     let pending = sessions.get(&session).expect(\"pending session\");\n     assert_eq!(pending.redirect_next.as_deref(), Some(next));\n+    assert_eq!(\n+        pending.agent, None,\n+        \"browser /login must not invent a sentinel delegate\"\n+    );\n+}\n+\n+#[tokio::test]\n+async fn test_vote_compare_two_users_both_succeed_without_delegate() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    let client = reqwest::Client::new();\n+    let alice = test_bearer();\n+    let bob = seed_user_token(&state, \"bob\", \"bobtok\", \"bobsecret\").await;\n+\n+    // Define items first (votes require existing item bodies).\n+    let seed = ui_post_ingest_rpc(\n+        \"public\",\n+        \"multi-vote\",\n+        \"~/multi-a {alpha}\\n~/multi-b {beta}\\n\",\n+    );\n+    let seed_resp = client\n+        .post(format!(\"http://{addr}/ui\"))\n+        .header(\"Authorization\", format!(\"Bearer {alice}\"))\n+        .form(&[(\"__rpc__\", seed.as_str())])\n+        .send()\n+        .await\n+        .unwrap();\n+    assert_eq!(seed_resp.status(), reqwest::StatusCode::OK);\n+    let seed_js = seed_resp.text().await.unwrap();\n+    assert!(\n+        !seed_js.contains(\"auth-error\"),\n+        \"item seed must succeed, got: {seed_js}\"\n+    );\n+\n+    for (bearer, left, right, explanation) in [\n+        (&alice, \"3\", \"1\", \"alice prefers a\"),\n+        (&bob, \"1\", \"3\", \"bob prefers b\"),\n+    ] {\n+        let rpc = ui_vote_compare_post_rpc(\n+            \"public\",\n+            \"multi-vote\",\n+            \"~/multi-a\",\n+            \"~/multi-b\",\n+            left,\n+            right,\n+            explanation,\n+        );\n+        let resp = client\n+            .post(format!(\"http://{addr}/ui\"))\n+            .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n+            .form(&[(\"__rpc__\", rpc.as_str())])\n+            .send()\n+            .await\n+            .unwrap();\n+        assert_eq!(resp.status(), reqwest::StatusCode::OK);\n+        let js = resp.text().await.unwrap();\n+        assert!(\n+            !js.contains(\"delegate already bound\"),\n+            \"human vote must not hit shared-sentinel AgentBound ({explanation}), got: {js}\"\n+        );\n+        assert!(\n+            !js.contains(\"auth-error\"),\n+            \"human vote must succeed ({explanation}), got: {js}\"\n+        );\n+        assert!(\n+            js.contains(\"vote-edge-history-region\"),\n+            \"vote should morph edge history ({explanation}), got: {js}\"\n+        );\n+    }\n+\n+    let reduced = state.reduced.read().await;\n+    let human_votes: Vec<_> = reduced\n+        .ingests_ordered\n+        .iter()\n+        .filter_map(|id| reduced.ingests_by_id.get(id))\n+        .filter(|ing| ing.raw.contains(\"prefers\"))\n+        .collect();\n+    assert_eq!(human_votes.len(), 2, \"expected two vote ingests\");\n+    let mut principals: Vec<&str> = human_votes.iter().map(|i| i.principal.as_str()).collect();\n+    principals.sort();\n+    assert_eq!(principals, [\"bob\", \"testuser\"]);\n+    for ing in &human_votes {\n+        assert!(\n+            ing.delegate.is_none(),\n+            \"browser votes must have no delegate, principal={} delegate={:?}\",\n+            ing.principal,\n+            ing.delegate\n+        );\n+    }\n+    assert!(\n+        reduced.agent_bindings.is_empty(),\n+        \"human votes must not create AgentBound entries: {:?}\",\n+        reduced.agent_bindings\n+    );\n }\n \n #[tokio::test]\ndiff --git a/server/tests/support/mod.rs b/server/tests/support/mod.rs\nindex 4a620eaa875e7a1145f2a4e82cc4ff2be21d5345..a5306fa2c4c9fda47e43fc0de42407b66e23eced 100644\n--- a/server/tests/support/mod.rs\n+++ b/server/tests/support/mod.rs\n@@ -70,20 +70,25 @@ pub async fn rpc_batch(\n     response.json().await.unwrap()\n }\n \n-pub async fn seed_test_token(state: &AppState) {\n+/// Seed a user + bearer into reducer state (not appended to the event log).\n+/// Returns the `slug_<token_id>_<secret>` bearer string.\n+pub async fn seed_user_token(\n+    state: &AppState,\n+    username: &str,\n+    token_id: &str,\n+    secret: &str,\n+) -> String {\n     let registered = Event::UserRegistered(UserRegistered {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         provider: \"test\".to_string(),\n-        provider_id: \"testuser\".to_string(),\n+        provider_id: username.to_string(),\n     });\n-    let token_id = \"testtok\";\n-    let secret = \"secret\";\n     let salt = \"salt\";\n     let token_hash = sha256_hex(&format!(\"{salt}:{secret}\"));\n     let ev = Event::TokenIssued(TokenIssued {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         token_id: token_id.to_string(),\n         token_hash,\n         salt: salt.to_string(),\n@@ -92,6 +97,11 @@ pub async fn seed_test_token(state: &AppState) {\n     let mut r = state.reduced.write().await;\n     r.apply_event(registered);\n     r.apply_event(ev);\n+    format!(\"slug_{token_id}_{secret}\")\n+}\n+\n+pub async fn seed_test_token(state: &AppState) {\n+    let _ = seed_user_token(state, \"testuser\", \"testtok\", \"secret\").await;\n }\n \n pub async fn create_test_server_with_state() -> (\ndiff --git a/test/oauth.clj b/test/oauth.clj\nindex 3cbf496005e906ad6c579d44ac8c4055ee60d063..6911ac34a55707acda9f9ce091c079964649a252 100644\n--- a/test/oauth.clj\n+++ b/test/oauth.clj\n@@ -186,8 +186,9 @@\n               (:token poll-json))))))))\n \n (defn fetch-bearer-token!\n-  \"Simulate browser OAuth + username choice; returns `slug_…` bearer token.\n-   Ingest `--delegate` must match this agent string for `AgentBound` on first write.\"\n+  \"Simulate CLI identity OAuth + username choice; returns `slug_…` bearer token.\n+   Pass `:agent` (default local/dev) when the test will CLI-ingest with `--delegate`\n+   so first write can `AgentBound`. Browser UI posts use no delegate.\"\n   [base-url & {:keys [username agent] :or {username \"intuser\" agent default-agent}}]\n   (let [token (complete-registration! base-url :username username :agent agent)]\n     (when-not (str/starts-with? token \"slug_\")\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex 211493935d19582607f5c87fb492faf47bdc6f53..0c4295b15908ea7a2303dac4c42015ded51e4d73 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -535,7 +535,9 @@ pub struct PendingSessionStartResponse {\n pub struct PendingSessionPollResponse {\n     pub ok: bool,\n     pub complete: bool,\n-    pub agent: String,\n+    /// Present for CLI identity sessions; omitted for browser `/login` / `/join` (no delegate).\n+    #[serde(default, skip_serializing_if = \"Option::is_none\")]\n+    pub agent: Option<String>,\n     #[serde(skip_serializing_if = \"Option::is_none\")]\n     pub user: Option<String>,\n     #[serde(skip_serializing_if = \"Option::is_none\")]\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}