ilpanich / axiam-java-sdk

92%

push

github

fix(security): lower the clock-skew ceiling 300s -> 60s (§13.4 observation 5) (#34)

MAX_CLOCK_SKEW_SECONDS satisfied CONTRACT.md §10.1 rule 7 — it was a named,
bounded constant — but at 300s it was 5x the RECOMMENDED leeway and 5x what
every sibling SDK fixes its value at. An operator could widen the acceptance
window on an expired token to five minutes and still be conformant, which makes
the rule's ceiling clause do very little work. It now equals the recommendation,
matching the C++ SDK, the only other SDK that enforces a ceiling rather than
fixing the value outright.

The default is unchanged at 60, so this affects only deployments that explicitly
widened the leeway; those now fail fast at LocalVerificationPolicy construction
rather than silently accepting older tokens.

Also syncs CONTRACT.md §10.1 rule 8 (subject of the decision) from the server.

mvn verify: BUILD SUCCESS, 403 tests, 0 failures; JaCoCo and doclint gates pass.


Claude-Session: https://claude.ai/code/session_01SkTHvZQMV47t3UwkEtmB1D

Co-authored-by: Claude <noreply@anthropic.com>

660 of 773 branches covered (85.38%)

Branch coverage included in aggregate %.

1746 of 1852 relevant lines covered (94.28%)

4.25 hits per line