{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-28T23:55:00.000Z",
  "record_id": "VXI-EXT-ICE04-AUTH0-ROTATION-OVERLAP-RETRY-BOUNDARY-01-v1",
  "record_kind": "external_reference",
  "title": "Auth0 rotation overlap and concurrent retries",
  "system": "Auth0",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does an Auth0 rotation overlap window permit replay of any earlier refresh token?",
  "near_questions": [
    "Which refresh-token generation can Auth0 rotation leeway tolerate?",
    "Does overlap disable detection for a second-to-last refresh token?",
    "How should concurrent refresh retries be bounded?",
    "What configuration evidence supports an Auth0 retry window?"
  ],
  "supported_claims": [
    {
      "claim": "Auth0 describes an optional rotation overlap period to tolerate concurrent exchanges. During that leeway, reuse detection does not apply to the immediately previous token; exchanging the second-to-last token triggers detection. The configured window and exact token generation matter when deciding whether a retry is tolerated.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "No safe-replay claim for arbitrary old tokens or assurance that the buyer configured the documented overlap.",
    "Buyer implementation, live runtime enforcement, settled payment, certification or permission to act are not established.",
    "No expanded capabilities or licences for existing INDEX executables."
  ],
  "public_summary": "Auth0 describes an optional rotation overlap period to tolerate concurrent exchanges. During that leeway, reuse detection does not apply to the immediately previous token; exchanging the second-to-last token triggers detection. The configured window and exact token generation matter when deciding whether a retry is tolerated.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Auth0: Configure Refresh Token Rotation",
    "source_url": "https://auth0.com/docs/secure/tokens/refresh-tokens/configure-refresh-token-rotation.md",
    "checked_on": "2026-10-28",
    "candidate_record_id": "VXI-EXT-ICE04-AUTH0-ROTATION-OVERLAP-RETRY-BOUNDARY-01-v1",
    "candidate_record_sha256": "35ac6ce00643caf0cb455c937339b98a71766b6935926fab384efbd9b2fc638f",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Auth0 describes an optional rotation overlap period to tolerate concurrent exchanges. During that leeway, reuse detection does not apply to the immediately previous token; exchanging the second-to-last token triggers detection. The configured window and exact token generation matter when deciding whether a retry is tolerated.",
    "required_buyer_context": "Application rotation and leeway configuration; Token-generation order without token secrets; Concurrent exchange and recovery timestamps. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-28",
    "claim_to_check": "Does an Auth0 rotation overlap window permit replay of any earlier refresh token?",
    "documented_statement": {
      "status": "documented",
      "statement": "Auth0 describes an optional rotation overlap period to tolerate concurrent exchanges. During that leeway, reuse detection does not apply to the immediately previous token; exchanging the second-to-last token triggers detection. The configured window and exact token generation matter when deciding whether a retry is tolerated.",
      "source_ids": [
        "auth0-rotation-config"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "Review auth0 rotation overlap and concurrent retries before accepting the buyer claim. The existing family-invalidation record does not specify the configurable previous-token concurrency exception. This is a documentation-review judgment, not an observed deployment outcome.",
      "source_ids": [
        "auth0-rotation-config"
      ]
    },
    "buyer_evidence_required": [
      "Application rotation and leeway configuration",
      "Token-generation order without token secrets",
      "Concurrent exchange and recovery timestamps"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "No safe-replay claim for arbitrary old tokens or assurance that the buyer configured the documented overlap."
    },
    "unknowns": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected."
    },
    "evidence_sources": [
      {
        "source_id": "auth0-rotation-config",
        "url": "https://auth0.com/docs/secure/tokens/refresh-tokens/configure-refresh-token-rotation.md",
        "final_url": "https://auth0.com/docs/secure/tokens/refresh-tokens/configure-refresh-token-rotation.md",
        "status": 200,
        "captured_at_utc": "2026-10-28T23:49:42.254232+00:00",
        "sha256": "f47a0507667da273a0ece9641769322564f45e0745214aa93fe8fed7f7bff136",
        "bytes": 5002,
        "content_type": "text/markdown; charset=utf-8",
        "title": "Auth0: Configure Refresh Token Rotation",
        "hash_basis": "SHA-256 of captured HTTP response body bytes",
        "checked_on": "2026-10-28",
        "capture_status": 200,
        "claim_review_completed": true,
        "reviewed_sections": [
          "Configure in the Dashboard",
          "Configure with the Auth0 SPA SDK"
        ],
        "version_context": "Rolling official documentation captured 2026-10-28; exact response hash is pinned, not a stable vendor release. Verify the deployed API/version and account feature availability. ",
        "rights_review": "Original factual paraphrase and attributed source metadata only. Captured documentation and code remain private; no source prose, examples, images or vendor marks are redistributed. No licence to vendor software or buyer assurance is granted."
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Source documentation supports only the stated boundary. Existing licensed checkers analyse supported supplied declarations; they do not query these providers, verify live systems, settle payments or certify compliance.",
    "paid_value": {
      "decision_context": "Review auth0 rotation overlap and concurrent retries before accepting the buyer claim. The existing family-invalidation record does not specify the configurable previous-token concurrency exception.",
      "free": "Complete review, practical questions, source references and limitations; freely accessible and locally saveable.",
      "single_request": "Unavailable for this publication-only record; historical saved retrieval remains unchanged.",
      "evidence_receipt": "Unavailable for this publication-only record; no new paid retrieval entitlement.",
      "excluded": [
        "Fresh vendor research",
        "Live provider inspection",
        "Runtime enforcement or certification",
        "Expanded executable schemas or licences",
        "Executable AI cost reconciliation"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck the source and applicable API, account and configuration before current reliance. No monitoring or fresh research is included.",
      "specific_watch": "Configure in the Dashboard; Configure with the Auth0 SPA SDK"
    },
    "buyer_relevance": "Review auth0 rotation overlap and concurrent retries before accepting the buyer claim. The existing family-invalidation record does not specify the configurable previous-token concurrency exception.",
    "refusal_conditions": [
      "No safe-replay claim for arbitrary old tokens or assurance that the buyer configured the documented overlap.",
      "Do not infer buyer deployment conformance or successful business outcomes from source documentation."
    ]
  },
  "niche": {
    "niche_id": "ice04-governance",
    "label": "Agent Governance & Policy Boundaries",
    "classification_id": "governance",
    "classification_label": "Agent Governance & Policy Boundaries",
    "topic_id": "governance",
    "buyer_intent": "Review auth0 rotation overlap and concurrent retries before accepting the buyer claim. The existing family-invalidation record does not specify the configurable previous-token concurrency exception.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#auth0-rotation-overlap-retry-boundary",
  "machine_readable_record": "/varexis-index/records/auth0-rotation-overlap-retry-boundary.json"
}