oficina / docs Public

Integrated full Home existing-account flow is frozen/pushed at3ed76656449e3ed59afed7a828ba7e35c9ec87d7. Actual complete repository gate and exact-head hub CI pass; actual router race/mutation checks preserve existing two-owner/grant fixtures. Root fixed signout's immediate automatic SSO loop with a stable signed-out page.

Whole-code configured claude-fable-5 review is active under oficina-docs-home-integration-code-review-20260908.service; final outputs /tmp/oficina-docs-home-integration-review. Read-only frozen source plus exact dependency sources supplied.

Actual browser found a form-action redirect-chain failure and narrow layout defect. Both fixed separately at1e862f80752004d16db98693c25d4c693dc19510 on feat/home-csp, pending browser rerun and final review. Original3ed stays immutable during review. Rollback compatibility proof now delegated separately, including old binaries encountering home-assertion sessions. No new Docs deployment or production configuration change.

Whole-branch configured claude-fable-5 review APPROVED3ed76656449e3ed59afed7a828ba7e35c9ec87d7. Terminal code-exit.json exit0 and code-review.ndjson final verdict in /tmp/oficina-docs-home-integration-review; actual event.model also claude-fable-5. Scope is existing-account linking with retained local allowlist/grants; authoritative roster/new principals/production cutover remain excluded. Nonblocking notes: unused success state, stale-cookie /auth/start UX, duplicate-cookie HTML errors, verifier owns exact P256 length, global bounded initiation capacity.

Final integration fast-forwarded to browser fix1e862f80752004d16db98693c25d4c693dc19510; no changes beyond the reviewed3ed plus four-file CSP/layout delta. Exact1e full gate and hub CI pass, immutable ARM64 artifact built. All8 browser cases pass: /tmp/oficina-docs-home-browser/results.json and scope.json, actual Docs handlers/local mail with synthetic Home issuer. Follow-up Fable review of the final delta/interaction active under oficina-docs-home-integration-delta-review-20260908.service, same review directory delta-* files.

Independent rollback probe confirms both old8a12672 and production87662f5 reopen the new additive DB and preserve legacy owners/grants/content under explicit production local-email admission; old code refuses opaque Home sessions before EnsurePerson. Negative controls prove dev admit-all or an opaque allowlist entry is unsafe and creates bogus people/samples. Retaining the restrictive local-email allowlist is therefore a rollout/rollback condition. No live config or deployment change yet.

Bounded rollback proof completed using isolated archives and synthetic data only. New1e862f80752004d16db98693c25d4c693dc19510 created actual additive BootSchema, two existing local people, owned/shared/private documents, real Yjs updates in legacy encoding0, an address grant, explicit double-auth identity link, ordinary Home session and legacy local sessions. Both old preview8a126727ae93fedadcc9af0ee8048334edd803a4 and production87662f5b246004aca604a4b040cb6691cfd7f130 reopen that database through their actual App.New and router.

With explicit production-mode local-email admission and the same origin/keys/path, both refuse Home cookie GET303 and POST403 before allocating a person; legacy owned/shared200 and other-owner-private404 remain correct. Actual old local email verification rotates its presented legacy cookie and preserves the existing person; supported same-origin POST/signout revokes a Home cookie. Exact people/document/update/grant snapshots and the additive identity-link row stay unchanged.

Rollback is CONDITIONAL, not universally safe. Both old builds lack a home-assertion method discriminator and turn Subject into Address. Negative controls on the same seed proved that adding the opaque subject to the allowlist, or admit-all development mode, accepts the Home cookie and creates one bogus person plus six sample documents (people2->3, documents3->9). Preserve the restrictive valid local-email allowlist during activation AND rollback; never widen it to make an opaque Home session work on old code. Normal address-grant validation also matters; manually corrupted opaque grant data is outside the proof. Old Home sessions should fall back to local signin, or users can use the existing signout route. No supported bulk method-specific revoke was found and no raw production DB cleanup is proposed.

Evidence /tmp/oficina-docs-rollback-proof/summary.json, seed-result.json, preview-result.json, production-result.json and corresponding test logs; both old probes exited0. Tests used archived source plus temporary probes, no repository code edits, mail delivery, deploy or real data/secrets. This proves synthetic encoding0/schema/session compatibility, not live production activation or platform process cycling. Private fixture.json and database artifacts contain synthetic bearer tokens and must not be printed/published.

Final configured Fable delta review APPROVED1e862f80752004d16db98693c25d4c693dc19510; /tmp/oficina-docs-home-integration-review/delta-review.ndjson and delta-exit.json exit0. Exact integration CI success and full gate rechecked. Nonblocking policy notes kept for later upgrade work; no CSRF/session/admission changes in delta.

DEPLOYED exact1e ARM64 artifact SHA25670b0f02f693314614c72ac78accd57743465cf2eaae1ece08e94106e3fe5702f to https://overnight-docs.bds.oncarlos.com/, channel canary/overnight-release. Actual API body+header both verified after exact-host restart. Paired preview config now enabled: Home credential consumer docs-overnight -> exact Docs origin, plus atomic four-field Docs Home config with dedicated DEK. Existing local email admission/content/instance keys/DB path retained. Home credential remains02f9ac0; its actual body/header and outgoing consumer CSP verified. /tmp/oficina-docs-home-release/verified.json.

User notified with exact preview URL and linking steps. Live unsigned Chromium/WebKit matrix is running next; no real human email/authentication fabricated. Local eight-case full-flow proof uses captured Docs email and synthetic issuer, scope unchanged. Production observations still Docs87662f5, Sheets7212864, Home0d0262a; no production cutover. Final canary evidence review and Amadan merge remain pending.

Deployed-canary evidence review APPROVED final1e862f80752004d16db98693c25d4c693dc19510 for existing-account linking preview and normal integration merge. Configured claude-fable-5, terminal exit0; /tmp/oficina-docs-home-integration-review/canary-review.ndjson and canary-exit.json. Live8/8 and local8/8 scope remains explicit. Followed up nonblocking live-gate suggestion: wrong expected consumer ID causes the intended browser failure, without server/config mutation; /tmp/oficina-docs-home-release/browser-negative-control/verified.json. Positive results retained.

The restrictive local-email allowlist is a standing rollback precondition. Do not allow opaque Home subjects or development admit-all while old binaries remain deployable. The upgrade/rollback runbook is now recorded in suite plan6a7435e, implementation/overnight-2026-09-07.md, section Deployed Docs linking stage and rollback runbook. Retain existing keys/origin/DB path, all additive tables and the dedicated Home DEK; old builds refuse Home cookies under retained admission and keep local login. No platform restore/topology claim. Production promotion remains out of scope until roster/principals/chooser/legacy cutover acceptance.

Fetched Docs main remains87662f5, so no editor bundle merge conflict exists. Exact integration CI is green at1e and clean worktree confirmed; proceeding with supported Amadan branch merge, not a local main merge. The current CLI supports normal merge rather than the historical squash flag.