[waleedlatif1]

Summary

• Derive the document integration fixture’s expiry from its issued-at timestamp. Separate clock reads could produce a grant just over the maximum lifetime and intermittently fail authorization before the document assertion ran.
• Preserve the production TTL limit and all document security and persistence assertions.

Type of Change

• Bug fix

Testing

• All 29 resource-delegation authorization tests and root lint passed.
• Hosted clock-boundary validation: the old two-clock expiry fails with the intended authorization error; all eight document checks pass three times per provisioning path with the fix.
• PR CI passed, including all 16 integration shards. Both automated reviews are 5/5 with no unresolved threads.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (test-audit reviewed; hosted integration verified)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 23, 2026 12:16am UTC

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Low impact] This PR appears safe to merge.

Summary

Updates the document integration fixture to derive expiresAt from one issuedAt timestamp.

• Document integration grants now use one timestamp for expiry.

_{Reviews (1) · Last reviewed commit: "fix(tests): derive document grant expiry..." · Reviewed by Greptile}