amadan
docs+home: refresh onboarding/sign-in status prose to match what shipped (#1260)
The overnight audit found the plan-of-record docs describing a pre-doors world: - accounts-and-recovery.md's header still said "design, not built" though phase 1 largely shipped (six web doors, anchors + ceremony proofs, Sign-in options, combine, sealed sessions, native passkey/Apple/email). The header now states what's live/dark/open, and the Phasing list gets honest per-item status. - conversational-onboarding.md gets a language note: "Save a passkey" / "backup" wording is design history — shipped copy says "Sign in". - onboarding-and-home-server.md's menu reference tracks the rename. - home.js's header comment described the superseded email-always-beneath card rule, and the DOORS comment declared google/microsoft dark though both ship lit. Comments now match the code beneath them. Doc/comment-only; no behaviour change.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
4 files changed,
+48
−19
docs/accounts-and-recovery.md+29 −8docs/conversational-onboarding.md+7 −0docs/onboarding-and-home-server.md+1 −1home/web/static/home.js+11 −10
diff --git a/docs/accounts-and-recovery.md b/docs/accounts-and-recovery.md| index 73eacfb..00b87a9 100644 |
| --- a/docs/accounts-and-recovery.md |
| +++ b/docs/accounts-and-recovery.md |
| @@ -1,7 +1,16 @@ |
| # 🤖 Accounts, sign-in & recovery — the anchor model |
| -Status: **design, not built** (decided with Paul 2026-07-16; nothing here has |
| -shipped). This document supersedes the *Invariants* section of |
| +Status: **plan of record — phase 1 largely shipped** (decided with Paul |
| +2026-07-16; status refreshed 2026-07-22). Live today: the six sign-in doors on |
| +home (passkey, email code, Apple, Google, Microsoft, GitHub — the #1112 card), |
| +identity anchors + ceremony proofs (`stateless.go`), the Sign-in options |
| +management step, account combine/merge (#1098), sealed anchor sessions, and |
| +the native passkey/Apple/email doors. Merged but dark: the synced DEK |
| +(#1144, flag off pending the device matrix). Not built yet: the phase-0 |
| +locked-card rungs and `/invite` link redesign, owner anchoring at creation, |
| +approve-from-another-device, paper kits, and the native OIDC doors (server |
| +legs done, client work open) — see *Phasing* below, per-item. |
| +This document supersedes the *Invariants* section of |
| `onboarding-and-home-server.md` — the "no email, no social login, ever" line — |
| after that invariant was field-falsified by real lockouts. Everything else in |
| that doc (the welcome page, the home server machinery, the blob schema, |
| @@ -344,19 +353,31 @@ step, which is what makes this rung safe to gate on identity alone. |
| ## Phasing |
| -0. **Sweep (no model change, this week):** the locked-space card gains its |
| +Status per item as of 2026-07-22: |
| + |
| +0. **Sweep (no model change):** the locked-space card gains its |
| missing rungs — "Link from your iPhone" (add-device QR) and "Ask for a |
| new invite" — and failure copy that never dead-ends at a ceremony sheet. |
| The **cosmetic invite-link redesign** (`/invite#Name/<T>`) also rides |
| - here: no crypto change, old links parse forever. |
| + here: no crypto change, old links parse forever. — **not built** (the Mac |
| + locked pane still shows the two-rung ladder; no `/invite` route exists). |
| 1. **SiwA + synced DEK** on iOS/Mac; web gains approve-from-phone. |
| Identity-first onboarding lands with it — the vault becomes the handoff |
| - bus and web↔native jumps stop losing fidelity. |
| -2. **Guardian-managed members + paper kits** (the family story). |
| + bus and web↔native jumps stop losing fidelity. — **partially shipped**: |
| + SiwA is live on web + both natives; the synced DEK is merged behind an |
| + off flag (#1144, device matrix owed); approve-from-phone and the |
| + identity-first ordering are not built. The web doors overshot the plan — |
| + Google/Microsoft/GitHub ship too; natively their server legs |
| + (`elevenmessenger://home-oidc`) are done and the client halves are open. |
| +2. **Guardian-managed members + paper kits** (the family story). — **not |
| + built.** |
| 3. **Owner anchoring at creation** — email or the successor anchor; the |
| - provisioner starts requiring/nudging it. |
| + provisioner starts requiring/nudging it. — **not built** (creation from |
| + home is effectively anchored via the home session; a bare setup link |
| + still claims anonymously). |
| 4. **Providers-as-attesters**, if ever. **Short/word-code invites** (the |
| - PAKE phase, bot-attended) slot in whenever they earn their build. |
| + PAKE phase, bot-attended) slot in whenever they earn their build. — |
| + **not built.** |
| ## Open decisions |
diff --git a/docs/conversational-onboarding.md b/docs/conversational-onboarding.md| index b17dd2f..7d6cbe4 100644 |
| --- a/docs/conversational-onboarding.md |
| +++ b/docs/conversational-onboarding.md |
| @@ -3,6 +3,13 @@ |
| Status: **phases 1–3 implemented** (roles, the setup conversation, the Admin |
| app v1 — landed with this doc); later phases still proposed. Captured from |
| design discussion 2026-07-06. |
| + |
| +> **Language note (2026-07-22):** this doc predates the anchor model |
| +> (`accounts-and-recovery.md`) and still says "Save a passkey" / "backup" in |
| +> places. The shipped flows say **"Sign in"** — the member-facing framing is |
| +> signing in with Eleven, never the mechanism. Read the passkey/backup |
| +> wording here as design history, not shipped copy. The "recovery kit" |
| +> (§ keys, path 2) is likewise superseded by that doc's paper-kit phase. |
| Builds on `onboarding-and-home-server.md` (welcome page, home-server vault, |
| fragility banner — phases 1–3a shipped) and the `/tutorial` mini-app |
| (`web/static/tutorial.js`), whose client-driven, in-Eleven's-voice pattern |
diff --git a/docs/onboarding-and-home-server.md b/docs/onboarding-and-home-server.md| index aa2ebca..930dc77 100644 |
| --- a/docs/onboarding-and-home-server.md |
| +++ b/docs/onboarding-and-home-server.md |
| @@ -226,7 +226,7 @@ touched. This rule is also recorded in CLAUDE.md conventions. |
| **This replaces the existing backup toast.** chat.js currently shows a |
| one-shot toast to single-device members (`maybeNudgeBackup()`, keyed on |
| -`lchat_backup_nudged`) pointing at ⋮ → "Add a device / back up". Once the |
| +`lchat_backup_nudged`) pointing at ⋮ → "Add a device" (renamed from "Add a device / back up" in the 2026-07-22 sign-in language sweep). Once the |
| onboarding flow owns back-up messaging, that toast is **removed** — one voice, |
| not two competing nudges. The banner is strictly better: it's driven by real |
| state (enrolment) rather than a fire-once flag, it can come back, and its |
diff --git a/home/web/static/home.js b/home/web/static/home.js| index 42ff5f4..d14d959 100644 |
| --- a/home/web/static/home.js |
| +++ b/home/web/static/home.js |
| @@ -1,10 +1,11 @@ |
| // The home landing page: every sign-in method is a door into the same |
| -// anonymous account, and the card composes itself per browser (#1112): ONE |
| -// primary door — the last-used method when this browser holds one, else the |
| -// platform default — with the email door always beneath it (unless it IS the |
| -// primary) and a quiet "Other ways to sign in" link to the all-ways step, |
| -// which lists every door. Apple and email are find-or-create (one button |
| -// resolves your account or mints it, no sign-in vs sign-up split). |
| +// anonymous account, and the card composes itself per browser (#1112, as |
| +// revised by Paul 2026-07-19): exactly ONE door — the last-used method when |
| +// this browser holds one, else the platform default — then a quiet "Other |
| +// ways to sign in" link to the all-ways step, which lists every door |
| +// (email included; nothing else ever sits on the main card). Apple and |
| +// email are find-or-create (one button resolves your account or mints it, |
| +// no sign-in vs sign-up split). |
| // Create-a-passkey appears only after a failed ceremony (the #newhere |
| // explainer — a cancelled prompt and a missing credential are deliberately |
| // indistinguishable, NotAllowedError either way, so the failure moment serves |
| @@ -244,10 +245,10 @@ function everSignedIn() { |
| // ---- the card algorithm (#1112) ------------------------------------------------ |
| -// Which doors are LIVE on this build. Google, Microsoft, and GitHub are |
| -// declared dark: the platform mapping below already points at the first two, |
| -// so each provider ships by flipping its flag here and adding its button to |
| -// the all-ways step (index.html's commented slots) — no restructuring. |
| +// Which doors are LIVE on this build. Google and Microsoft ship lit; |
| +// GitHub lights per-instance below (its flow needs a server-held client |
| +// secret, so the page's client id is the signal). A future door slots in |
| +// the same way: a flag here + its button in the markup — no restructuring. |
| const DOORS = { |
| apple: true, |
| email: true, |