Desktop audit server setup.
Database and environment
Apply the standalone migration 20261012090000_trueauthor_desktop_audits.sql to the selected Supabase project. It adds isolated audit tables and linked-device infrastructure without deleting existing application data.
Configure NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY, TRUEAUTHOR_DEVICE_GATEWAY_SECRET, TRUEAUTHOR_EVIDENCE_PRIVATE_KEY and TRUEAUTHOR_EVIDENCE_PUBLIC_KEYS. The server/database gateway secret must match. All private keys remain server-side.
Use the existing project’s authentication users. Configure localhost and the deployed server’s callback origins in Supabase before OAuth testing.
API
| Endpoint | Access |
|---|---|
POST /api/devices/link/start | Device proves possession of its key |
POST /api/devices/link/poll | Secret device code |
GET /api/devices/link/lookup; POST /api/devices/link/decide | Signed-in account approves linking |
POST /api/audit/checkpoints | Linked-device signed request; closed metadata v3 |
GET /api/audit/reports | Signed-in account |
POST /api/audit/reports/:documentId | Owner publishes, hides or revokes a checkpoint |
GET /api/audit/verify/:token | Published fixed metadata report |
GET /api/audit/keys | Public Ed25519 verification keys |
Evidence and versioning
Metadata v3 contains positions and source measurements, never manuscript or pasted text. Counts use UTF-16 units; text fingerprints use exact UTF-8 SHA-256. Hash chaining covers the exact serialized upload body. Receipt signatures cover the exact manifest string.
Legacy source-map v2 ingestion is disabled by default because it permits excerpts. It must not be used for the local-first workflow.