Separa la revisión del permiso para fusionar.

HMAC_KEY = HKDF-SHA256(masterSecret, salt="sentinel-oracle-v1", info=serverFingerprint)

function GenerateChallenge(prNumber: number, sessionId: string): Challenge {
  nonce = crypto.getRandomValues(new Uint8Array(32))   // 256-bit random
  payload = JSON.stringify({
    pr:     prNumber,
    nonce:  hex(nonce),
    sessionId,
    ttl:    Date.now() + 120_000,     // 120 second validity window
  })
  signature = HMAC-SHA256(HMAC_KEY, payload)
  return { payload, signature }
}

challengeId = SHA256(payload + signature).slice(0, 16)   // 8-byte challenge ID
qrPayload = JSON.stringify({
  v:     1,                              // protocol version
  cid:   challengeId,                     // challenge identifier
  sig:   hex(signature),                  // HMAC signature
  host:  "https://100.x.y.z:3443",        // oracle server Tailscale IP
})

// QR is displayed on the workstation dashboard as an HTML canvas QR code.
// The phone scans it via the device camera using a WebRTC-based QR scanner.

// On the phone, after scanning the QR:
assertion = await navigator.credentials.get({
  publicKey: {
    challenge:      new Uint8Array(challengeId),           // bound to challenge
    allowCredentials: [{ id: credentialId, type: "public-key" }],
    userVerification: "required",                          // forces biometric
    timeout:          40_000,                              // 40 second window
  }
})

// The assertion is sent to the oracle server:
POST https://100.x.y.z:3443/api/authorize
Content-Type: application/json

{
  "challengeId": "a1b2c3d4e5f6a7b8",
  "credentialId": hex(assertion.id),
  "authenticatorData": base64(assertion.response.authenticatorData),
  "clientDataJSON": base64(assertion.response.clientDataJSON),
  "signature": base64(assertion.response.signature),
  "prNumber": 42
}

function HandleAuthorize(req): MergeResult {
  // 1. Look up challenge by challengeId
  challenge = db.challenges.get(req.challengeId)
  if (!challenge)                return { error: "challenge not found" }
  if (challenge.consumed)         return { error: "challenge already used" }
  if (Date.now() > challenge.ttl) return { error: "challenge expired" }

  // 2. Verify HMAC integrity
  expected = HMAC-SHA256(HMAC_KEY, challenge.payload)
  if (!constantTimeEqual(expected, challenge.signature))
    return { error: "challenge integrity check failed" }

  // 3. Verify WebAuthn assertion
  assertionOk = VerifyWebAuthnAssertion(req.assertion, challengeId)
  if (!assertionOk) return { error: "WebAuthn assertion invalid" }

  // 4. Verify PR binding
  payload = JSON.parse(challenge.payload)
  if (payload.pr !== req.prNumber)
    return { error: "PR number mismatch" }

  // 5. Mark challenge consumed (atomic)
  db.challenges.markConsumed(challengeId)

  // 6. Execute GitHub merge
  result = github.mergePullRequest({
    owner:  config.ghOwner,
    repo:   config.ghRepo,
    prNumber: req.prNumber,
    mergeMethod: "squash",
  })

  return { success: true, mergeResult: result }
}

git clone https://github.com/javier20dev25/sentinel-oracle.git
cd sentinel-oracle
npm install
npm run build

# Create config file manually or let the server generate defaults on first run:
mkdir -p ~/.sentinel-oracle
cat > ~/.sentinel-oracle/config.json << 'EOF'

# Option A: PAT mode
{
  "githubToken": "github_pat_...",
  "githubOwner": "your-org",
  "githubRepo": "your-repo"
}

# Option B: GitHub App mode (recommended)
{
  "githubAppId": "123456",
  "githubInstallationId": "654321",
  "githubPrivateKeyPath": "/home/sentinel/.sentinel-oracle/key.pem",
  "githubOwner": "your-org",
  "githubRepo": "your-repo"
}
EOF

# Set secrets via environment variables (recommended):
export ORACLE_MASTER_SECRET="$(openssl rand -hex 32)"

npm start

# Server listens on https://100.x.y.z:3443
# Open in browser on your phone via Tailscale to register a passkey.