amadan
docs: record passkey-only / no-social-login as a non-negotiable invariant (#319)
Add a "No social or third-party login, ever" invariant to the onboarding & home-server design doc, alongside "No accounts". It also captures the concrete consequence for the native app: App Store guideline 4.8's "offer an equivalent login" requirement (Sign in with Apple et al.) is triggered only by apps that use a third-party/social login service, so a passkey-only, email-less app is exempt under "your app exclusively uses your company's own account setup and sign-in systems". Also fix the stale doc header — passkey-only sign-in is a Day-1 invariant, not a proposal, and several phases are already shipped (see the inline Implemented markers), so "proposed — nothing built" was wrong.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 file changed,
+18
−3
docs/onboarding-and-home-server.md+18 −3
diff --git a/docs/onboarding-and-home-server.md b/docs/onboarding-and-home-server.md| index f2aee9e..d080a0c 100644 |
| --- a/docs/onboarding-and-home-server.md |
| +++ b/docs/onboarding-and-home-server.md |
| @@ -1,8 +1,12 @@ |
| # 🤖 Onboarding & the home server — design |
| -Status: **proposed** — captured from design discussion 2026-07-03, nothing built. |
| -This doc is the single place for where we landed. Builds on |
| -`invite-redesign.md` (invite secret `T` in the URL fragment, server-blind claim). |
| +Status: **shipping, not proposed.** Passkey-only sign-in is a Day-1 invariant — |
| +no passwords, no email, no social/third-party login, and nothing on the roadmap |
| +changes that (see Invariants below). The home server, enrolment, and the |
| +signed-out-root restore flow are built (see the inline *Implemented* markers); |
| +silent multi-device sync (phase 3c) is the main piece still landing. This doc is |
| +the single place for where we landed. Builds on `invite-redesign.md` (invite |
| +secret `T` in the URL fragment, server-blind claim). |
| ## Goals |
| @@ -21,6 +25,17 @@ across devices. All without usernames, passwords, or weakening the one rule: |
| - **No accounts.** Identity stays per-instance keypairs; membership only ever |
| enters via invites. No federation. |
| +- **No social or third-party login, ever.** Sign-in is a passkey (or an invite |
| + link) — identity is never brokered by Facebook / Google / Apple / X / etc. |
| + This is a permanent product decision, not a gap we'll fill later. Beyond |
| + keeping the model accountless, it has a concrete payoff for the native app: |
| + App Store guideline 4.8 (the "you must also offer an equivalent login option" |
| + rule, i.e. Sign in with Apple and friends) is triggered *only* by apps that |
| + use a third-party or social login service. A passkey-only app is explicitly |
| + exempt — *"Your app exclusively uses your company's own account setup and |
| + sign-in systems"* — and requires no email address, so there is nothing for an |
| + "equivalent" login to be equivalent *to*. Adding a social login would flip |
| + that requirement on; we never will. |
| - **The home server is strictly additive.** A client with no enrolment record |
| makes **no requests to any home server, ever** — no passive pings, no |
| "check for a backup" lookups. Enrolment is created only by an explicit user |