amadan
Implementation frozen and pushed a40f11047786e9e5f63bbb3fab5eba1c28681406; task61. Changes limited to identity.go/tests plus replacing direct auth.From consumption in handlers.go and requireAdmission. Root owns middleware mounting and Home config/routes. Existing full internal/docs tests passed, focused identity/freshness race tests passed, and a real captured local magic-link callback test proves persisted At fallback plus second-verification cookie rotation and revocation of the first session. Six meaningful Go overlay mutations failed for their intended reasons: treating Home subject as email, granting Keymail zero-time mint freshness, accepting future proof, bypassing missing-adapter admission, removing real magic-link fallback, and using opaque subject for address grants. Evidence /tmp/oficina-docs-identity-{initial,focused,magic}.log and /tmp/oficina-docs-identity-mutations/results.json. Full repository gate is still running in Go phase after Rust/wasm/wire success; not yet claiming full gate or hub CI success. Integration branch will receive whole-branch Fable review before any deployment/merge.
Resolve linked Home sessions to existing Docs owners open
Isolated feat/home-identity-adapter from approved preview8a12672, prerequisite from Fable-approved design2e69825. Typed request identity separates opaque Home session subject from existing local person ID and current verified address. The adapter looks up exact issuer+subject first and never creates Home people or sample documents; standalone authentication retains get-or-create. Owner, actor, member and admission use the same typed identity, and missing Home adapter wiring fails closed. Method-aware local freshness accepts only magiclink/keymail with original AuthTime; zero-time fallback only for actual local magiclink stored At. Root will integrate middleware/config/routes with the separately owned linkstore and obtain whole-branch Fable review. No deployment or merge on this subtask.
Full local repository gate now passed at a40f110 (exit0): Rust tests/lint/wasm byte match, JS fixture and two-way wire checks, Go vet/tests/gofmt/build. /tmp/oficina-docs-identity-gate.log ends gate: ok. Hub CI for exact pushed branch currently pending (status exit2), not yet green. No merge or deploy.
Design-only continuation amendment dccdb74 added after adapter a40f110. It addresses the impossible pre-reauth pending-link continuation described in Docs46. Actual R0.23 source shows fixed auth.SignedInPath, no auth SafeReturn handling, first-cookie lookup, and actual cookie rotation on successful signin. Explicit claude-fable-5 design review active with source excerpts inline at /tmp/oficina-docs-local-continuation-review; worktree frozen and no continuation code written.
Fable design approval recorded on Docs46: amendment dccdb74 APPROVE by explicitly configured claude-fable-5. Approval/advisory record96e0751 pushed. Next bounded helper implementation goes in a new worktree from root integration0c74999; this adapter worktree stays clean. Root owns actual auth/app/config wiring and full integrated review.