amadan
Pushed storage implementation7f66b43ed0eae1c3f30a914c86e7c25e5691d1e8. Package internal/docs/linkstore, integration contract implementation/home-link-store.md. Full go test ./... and package race/vet pass. Three Go-overlay mutations failed for the intended accepted cross-session proof, accepted wrong/unbound nonce, and reusable rejected conflict. Logs /tmp/oficina-docs-link-store-mutations; full Go log /tmp/oficina-docs-link-store-go-test.log. CI is queued for exact7f66b43, not yet a merge gate. Root will integrate identity adapter, HTTP/config/UI then request whole-branch Fable review; no independent storage review or deployment claimed. Clock high-water serializes writes and enforces age after restart; within30s backward tolerance future checks use wall clock and age uses high-water. Larger rollback refuses before proof access. Business refusals commit proof deletion; storage failures roll back deletion/mapping together. No content keys, people or grant mutations, no new principals.
Existing-account link storage open
On branch feat/home-link-store
Implement the bounded storage portion of approved Docs46 design (2e69825): additive identity mappings, sealed initiation and pending proof records, local-session/nonce binding, five-minute dual freshness, atomic single-use confirmation. Isolated branch from reviewed preview8a12672. No handlers, UI, new principals, content/key changes or deployments. Whole integrated branch review remains required.
Root requested a second bounded commit on this worktree: strict HomeConfig parsing and tests, no App/handler wiring. Home runtime source confirms base64 JSON keyID-to-base64 SignPub manifest, maximum8 P-256 keys and4096 decoded JSON bytes. New helper preserves nil standalone mode but rejects nonnil partial config; validates canonical bounded base64 and duplicate JSON keys, delegates exact origin/public-key checks to canonical assertion.NewVerifier and dedicated DEK shape to shared seal.New. Root owns integration/review/deploy.
Config-only commit d5030ec1bd6a987f5c46bf7804d39e288fd234e6 pushed. API validatedHomeConfig(HomeConfig, origin) (homeSettings,error), fields issuer/consumerID/keys/dek. Standalone nil preserved; errors fixed and decoded state nil on every refusal. TestHomeConfig suite and race pass; go vet ./internal/docs passes. Three mutations fail for accepted duplicate JSON names, accepted incorrect issuer/audience origins, and accepted noncanonical base64. Evidence /tmp/oficina-docs-home-config-mutations. Root has full SHA and owns configuration/environment/App wiring plus integrated review and deployment.