rowid,app_id,statement,excerpt,proposed_by,accepted,reason
4,F1-002,The system lets a user sign in through a sign-in link sent by email.,"The instance sends password resets, address confirmations, sign-in links and invites through",verifier,1.0,"Emailed sign-in links are a user-facing sign-in method not covered by the password, passkey or external-account statement."
5,F1-002,The system lets a user renew an expired invite from the member list.,an expired one is renewed from the member list under a new,verifier,1.0,Renewing an expired invite is a distinct action not covered by invite expiry; the actor is set to a user because the source names no role.
6,F1-002,The system lets a user sign in an MCP client with OAuth when the instance is served over HTTPS.,MCP clients sign in with OAuth only over HTTPS.,verifier,1.0,"OAuth sign-in for MCP clients is a user-facing access feature with a stated condition, and no surviving statement covers it."