amadan
Fable5 design review of4cb40cb requested changes: explicit assertion session/principal representation, local initiation binding to prevent identity confusion, and precise local freshness. Revised2e69825 supplies typed Home identity resolution before owner/admission/grants; initiation requires fresh local account POST and binds exact local session hash/person/origin/shared nonce; ordinary unlinked SSO cannot become a linking proof. Method-aware freshness accepts At only for actual legacy magiclink because source confirms that flow deliberately has zero AuthTime; zero-AuthTime Keymail and home-assertion cannot count as local proof. Explicit future checks apply to both sides. This source-backed alternative to AuthTime-only is submitted for re-review, not claimed approved. New review service oficina-docs-home-link-design-r2-20260908.service; no implementation here yet.
Home identity linking without replacing document owners open
User's common app entry priority now has deployed Home exchange eaefda9 and merged Home0dc863c. New Docs design branch design/home-account-link at5dc526f, isolated worktree overnight-home-link-design. Draft implementation/home-account-link.md records explicit fresh double-auth linking to existing people.id, unique mapping, preserved owners/grants/content and standalone authentication. It is not approved for implementation yet.
Home discussion21/branch feat/home-fresh-assertion is the active prerequisite. New Home-only users require a separate identity-model migration because current people.email is NOT NULL and unique; do not use fake addresses or call legacy-only linking full suite readiness. Team roster/chooser and old deep-link compatibility also remain required. Existing partial link-export and theme worktrees untouched.
Revised design2e69825 APPROVED by the explicitly configured Claude Fable5 review. Actual result /tmp/oficina-docs-home-link-review/r2-review.ndjson, final result block. Reviewer confirmed the method-specific zero-AuthTime local magiclink fallback is necessary from source, replacing its earlier AuthTime-only suggestion. Conditions carried forward: either consume the already-tested Rastrillo0.23 candidate or verify the actual main0.22 pin before relying on those internals; read resolved session.At (stored created_at), never transient signin.Identity.At, and prove session renewal cannot refresh old evidence. This branch remains design-only; no assertion session may reach EnsurePerson. Shared consumer nonce hook and reusable purpose sealing are explicit prerequisites to implementation.
Source-backed design correction under explicit Fable review before code: the approved paragraph saying local signin resumes confirmation only with a valid pending link cannot handle a stale local session before initiation. linkstore.Start requires fresh local authentication; actual R0.23 auth verification rotates the browser session, invalidating any old link binding. Proposal dccdb746303b87f64f4156053943441ad2ca60af, implementation/local-link-continuation.md on feat/home-identity-adapter, replaces only that clause with a sealed navigation-only fixed link-start marker (<=10m, no person/proof/path) and suite-only fixed SignedInPath /auth/local/complete. Next request validates actual fresh local session before navigating to /account/home; explicit fresh same-origin POST still starts a new link, and stale/changed proofs never resume. auth does not use sessions.SafeReturn or preserve return_to. Design review explicitly configured claude-fable-5 with pinned source excerpts inline; no implementation or approval claimed yet. Discussion49 contains the adapter track.
claude-fable-5 APPROVE for navigation-only design amendment dccdb746303b87f64f4156053943441ad2ca60af. Exact source claims verified from pinned R0.23 excerpts inline; reviewer did not run tools/tests. Dedicated sealed <=10m fixed-action marker and suite-only /auth/local/complete preserve all linking authority behind a fresh explicit POST, and never resume stale flow after session rotation. Non-blocking implementation notes accepted: name duplicate-session guards explicitly including Verify before minting; preserve signin rendering to an already-signed-in user (current h.signin does); no-store responses; acknowledge top-level GET may destroy an existing flow but cannot create/grant. Approval record commit96e07510b2763b2e54428e438893a05e6b54ab97; /tmp/oficina-docs-local-continuation-review/review.ndjson. Root now implementing approved delta, no deployment claim.