Cratis · woksin · Sep 9, 2026 · Sep 9, 2026 · Sep 9, 2026 · Sep 9, 2026
diff --git a/Documentation/configuration/error-pages.md b/Documentation/configuration/error-pages.md
@@ -21,7 +21,7 @@ condition is detected:
 | `invitation-select-provider.html` | A valid invite link was followed and multiple identity providers are configured. The page reads the `.cratis-providers` cookie to render a sign-in button for each available provider. | 200 |
 | `invitation-subject-already-exists.html` | The authenticated user's subject is already associated with an existing account during invite exchange (Phase 2). | 409 |
 | `invitation-email-unavailable.html` | Email binding is enabled, but the identity provider supplied no authenticated-session email address during invite exchange (Phase 2). | 403 |
-| `invitation-email-mismatch.html` | Email binding is enabled, and the identity provider supplied another address or explicitly reported `email_verified=false` during invite exchange (Phase 2). | 403 |
+| `invitation-email-mismatch.html` | Email binding is enabled, and the identity provider supplied another address or did not report the address as verified during invite exchange (Phase 2). | 403 |
 
 ---
 
@@ -115,9 +115,14 @@ that exposes an address.
 
 ### `invitation-email-mismatch.html`
 
-Served during Phase 2 when the provider supplied an address different from the invited address, or explicitly
-reported `email_verified=false`. An absent `email_verified` claim is not universal proof of ownership and is
-forwarded as `null`; OAuth providers do not currently map that claim. See
+Served during Phase 2 when the provider supplied an address different from the invited address, or did not
+report the address as verified.
+
+What counts as unverified depends on the mode. In the legacy unsigned exchange (no `Invite.Attestation`) only
+an explicit `email_verified=false` mismatches; an absent claim is forwarded as `null` for the backend to judge,
+and OAuth providers do not currently map that claim. With `Invite.Attestation` configured, the completion fails
+closed: only a single `email_verified` claim parsing to exactly `true` counts as verified, so a missing,
+duplicated, malformed, or non-`true` claim is answered with this page too. See
 [Invitation to Organization](lobby/invitation-to-organization.md) for the complete binding behavior.
 
 ---

diff --git a/Documentation/configuration/well-known-pages.md b/Documentation/configuration/well-known-pages.md
@@ -24,7 +24,7 @@ condition is detected:
 | `invitation-select-provider.html` | A valid invite link was followed and multiple identity providers are configured. The page reads the `.cratis-providers` cookie to render a sign-in button for each available provider. | 200 |
 | `invitation-subject-already-exists.html` | The authenticated user's subject is already associated with an existing account during invite exchange (Phase 2). | 409 |
 | `invitation-email-unavailable.html` | Gateway email binding is enabled (`Invite.EmailClaim`), but the identity provider supplied no authenticated-session email address (Phase 2). | 403 |
-| `invitation-email-mismatch.html` | Gateway email binding is enabled (`Invite.EmailClaim`), and the identity provider supplied another address or explicitly reported `email_verified=false` (Phase 2). | 403 |
+| `invitation-email-mismatch.html` | Gateway email binding is enabled (`Invite.EmailClaim`), and the identity provider supplied another address or did not report the address as verified (Phase 2). With `Invite.Attestation` configured, a missing, duplicated, malformed or non-`true` `email_verified` claim counts as not verified. | 403 |
 | `link-select-provider.html` | The embeddable provider-selection page of the [credential-link flow](link.md), served at `/.cratis/link`. Lists providers, opens the chosen provider's link challenge in a top-level window, and reports the outcome to its embedding parent. | 200 |
 | `link-complete.html` | A credential link completed, at `/.cratis/link/complete`. Broadcasts the completion on the link flow's `BroadcastChannel` and closes its window. | 200 |
 | `link-failed.html` | A credential link did not complete — the provider round-trip failed or the exchange was refused (see [Credential Linking](link.md)). Broadcasts the failure so an embedding selection page can offer a retry. | 403 |
@@ -122,9 +122,15 @@ indicating that the authenticated user's subject is already associated with an e
 
 Served during Phase 2 (post-login invite exchange) when gateway email binding is enabled — the
 `Invite.EmailClaim` claim is configured — the invite token was issued for a specific email address — and
-the provider supplied another address or explicitly reported `email_verified=false`. This is distinct from
+the provider supplied another address or did not report the address as verified. This is distinct from
 a provider that supplied no address at all.
 
+What counts as unverified depends on the mode. In the legacy unsigned exchange (no `Invite.Attestation`) only
+an explicit `email_verified=false` mismatches, and an absent claim is forwarded as `null` for the backend to
+judge. With `Invite.Attestation` configured, completion fails closed: only a single `email_verified` claim
+parsing to exactly `true` counts as verified, so a missing, duplicated, malformed or non-`true` claim is
+answered with this page as well.
+
 ### `invitation-email-unavailable.html`
 
 Served during Phase 2 when gateway email binding is enabled and the identity provider supplied no

diff --git a/...xyExtensions/when_declaring_anonymous_paths/and_they_are_declared_across_several_calls.cs b/...xyExtensions/when_declaring_anonymous_paths/and_they_are_declared_across_several_calls.cs
@@ -12,8 +12,8 @@ namespace Cratis.AuthProxy.Aspire.for_AuthProxyExtensions.when_declaring_anonymo
 /// way to write an app host, which is what makes this worth pinning.
 /// </para>
 /// <para>
-/// Two services are used to show the count is kept per service: <c>other</c> starts at its own zero rather
-/// than continuing <c>main</c>'s numbering.
+/// Two services are used to show the count is kept per service: <c language="text">other</c> starts at its own zero rather
+/// than continuing <c language="text">main</c>'s numbering.
 /// </para>
 /// </summary>
 public class and_they_are_declared_across_several_calls : given.an_auth_proxy_resource

diff --git a/...uthProxyExtensions/when_declaring_capability_only_admission/and_every_setting_is_given.cs b/...uthProxyExtensions/when_declaring_capability_only_admission/and_every_setting_is_given.cs
@@ -6,7 +6,7 @@ namespace Cratis.AuthProxy.Aspire.for_AuthProxyExtensions.when_declaring_capabil
 /// <summary>
 /// Every setting a deployment overrides reaches the proxy in the form its configuration binder reads —
 /// notably the lifetime, which binds as a <see cref="TimeSpan"/> and therefore has to be written in the
-/// invariant <c>hh:mm:ss</c> form rather than in whatever the host's culture would produce.
+/// invariant <c language="text">hh:mm:ss</c> form rather than in whatever the host's culture would produce.
 /// </summary>
 public class and_every_setting_is_given : given.an_auth_proxy_resource
 {

diff --git a/...roxyExtensions/when_declaring_capability_only_admission/and_only_the_verifier_is_given.cs b/...roxyExtensions/when_declaring_capability_only_admission/and_only_the_verifier_is_given.cs
@@ -5,7 +5,7 @@ namespace Cratis.AuthProxy.Aspire.for_AuthProxyExtensions.when_declaring_capabil
 
 /// <summary>
 /// Closing the interactive contract is its own builder rather than another optional argument on
-/// <c>AddAuthProxy</c>, and naming only the verifier writes every key the proxy reads — with the same
+/// <c language="text">AddAuthProxy</c>, and naming only the verifier writes every key the proxy reads — with the same
 /// defaults the proxy itself would have used.
 /// <para>
 /// The Aspire package cannot reference the proxy it configures, so these strings are the only thing joining

diff --git a/Source/Aspire.Specs/for_AuthProxyExtensions/when_declaring_identity_verification.cs b/Source/Aspire.Specs/for_AuthProxyExtensions/when_declaring_identity_verification.cs
@@ -5,7 +5,7 @@ namespace Cratis.AuthProxy.Aspire.for_AuthProxyExtensions;
 
 /// <summary>
 /// Declaring what a service's identity answer is worth is its own builder rather than another optional
-/// argument on <c>WithBackend</c>.
+/// argument on <c language="text">WithBackend</c>.
 /// <para>
 /// An optional argument is baked into the call site when the app host is compiled, so adding one to a
 /// shipped method changes its signature and every app host already built against the package fails to bind

diff --git a/Source/Aspire.Specs/for_AuthProxyExtensions/when_enabling_the_management_listener.cs b/Source/Aspire.Specs/for_AuthProxyExtensions/when_enabling_the_management_listener.cs
@@ -5,7 +5,7 @@ namespace Cratis.AuthProxy.Aspire.for_AuthProxyExtensions;
 
 /// <summary>
 /// Opening the management listener is its own builder rather than another optional argument on
-/// <c>AddAuthProxy</c>, and it writes exactly the four keys the proxy reads.
+/// <c language="text">AddAuthProxy</c>, and it writes exactly the four keys the proxy reads.
 /// <para>
 /// The Aspire package cannot reference the proxy it configures, so these strings are the only thing joining
 /// the two. A rename on either side binds nothing and falls back to a default — which for the port, the one