oficina / docs Public

feat/home-consumer: chain Docs sign-out through id.oficina.works open

On branch feat/home-consumer

claude agent, operated by paul@keymail.dev operated by paul@keymail.dev session 21a32889 · claude-code/2.1.280 · MacBookPro.localdomain

Preparation for switching Docs to Oficina sign-in (Paul, 2026-09-30: "Definitely switch to Oficina sign-in"). Plan: oficina/polish-audit/SSO-SWITCH.md.

What: in Home mode, POST /signout ends the Docs session, then 307s to {issuer}/signout with Referrer-Policy: strict-origin-when-cross-origin, so the id.* session ends too and the next Sign in asks again. This is the chain connect.Routes.Signout gives the other apps (home 01166fc); Docs has its own Home integration and never got it. Standalone sign-out is unchanged (303 to /signed-out).

Tests: TestHomeSignoutChainsToIssuer (new) failed first: status 303 Location "/signed-out", want 307 to https://id.oficina.works/signout. It passes with the change. The existing Home-mode router tests (homerouterintegration, teamrouter, teamstream, native_stream) now expect the chain.

Local gate: .amadan/ci.d/10-gate passes, apart from cmd/docs TestReleaseBinaryReportsItsVersion, which fails on macOS only because the unix socket path under $TMPDIR is too long (bind: invalid argument). It passes with TMPDIR=/tmp.

Not deployed. Not merged. A whole-branch review is required before merge. No config is changed by this branch: Home mode stays off until DOCS_HOME_* is set.

claude agent, operated by paul@keymail.dev operated by paul@keymail.dev session astra-ho · codex/GPT-6-Astra · MacBookPro.localdomain

Reviewer: Astra (GPT-6-Astra via Codex), whole-branch review requested by Paul, 2026-10-01.

VERDICT: APPROVE — feat/home-consumer at c4222be, reviewed as one merge-base diff against fetched origin/main (d40fbd1; merge base ee9ecb1). Read AGENTS.md, REVIEW-BRIEF.md, SSO-SWITCH.md §§1–6 and the earlier admission-loop reviews.

No blocking or non-blocking code findings in this branch.

INFO — internal/docs/home_routes.go:197: the sign-out chain matches Home. The first POST remains behind homeCSRF; only the assertion callback is exempt. The local session is revoked and six handoff cookies cleared before a fixed 307 to the validated issuer's /signout. The 307 preserves the POST and body; the ordinary Sign out form has no named payload. It does not put the Docs cookie/token in the URL or body. Browser cookie scoping selects the issuer's own cookie for the next hop. Cache-Control: no-store, Referrer-Policy: strict-origin-when-cross-origin, and issuer-inclusive form-action match Home origin/main 7a0f19c. Home admits only its registered consumer origins, handles null Origin using Referer plus Fetch Metadata, and returns to the matched registration plus /signed-out; request query/body cannot choose a destination. A missing-referrer/cross-site-cookie case has Home's explicit confirmation fallback. No fix required.
INFO — internal/docs/home_routes.go:123 and internal/docs/signin_return.go:95: the prior revoked-guest repair survives. The sign-in shortcut requires current admission, not just a session. Existing revoked-guest router tests ran in the full gate. Return paths retain handoff.SafePath validation and authenticated navigation storage. Home subjects resolve through explicit local-person links, not email matching or automatic creation; current admission remains enforced on protected requests. No fix required.
INFO — merge preservation. New main d40fbd1 contains K3 native durability work outside this branch's seven-file diff. A read-only merge-tree check found no conflicts against it. Merge/rebase normally and preserve that main work; do not replace main with the branch snapshot. No editor bundle rebuild is implied by this Go-only change.

Verification: GOTOOLCHAIN=go1.26.5 CGO_ENABLED=0 TMPDIR=/tmp bash .amadan/ci.d/10-gate passed: Node tests/bundle freshness, Rust formatting/clippy/build/tests, wasm freshness, both wire directions, Go vet/tests/format/build. Docs has no make ci/make test; this script is its documented local gate. Hub CI reports PASS at c4222be (CLI exit 0).

Mutation proof: changed only the scratch sign-out response policy to no-referrer. The new TestHomeSignoutChainsToIssuer failed specifically at its Referrer-Policy assertion, not compilation/status. Restored source; the same uncached test passed.

Home cross-check: inspected internal/home/signout.go and exchange.go at fetched main 7a0f19c. Focused Home sign-out, consumer-policy, assertion/fresh-authentication tests passed; Home/connect tests passed separately. The issuer binds assertions to the registered audience, nonce and actual subject, and keeps the destination in the consumer's handoff rather than accepting an arbitrary redirect. I did not run the optional browser SSO stack or change production configuration.

Recommended order: Docs #73 can land first. Calendar #17 before a rebased #23; Memoria #20 before #21 (which already contains it); Calls #22 before its unfinished chrome branch. Home code already has the required contract. Paul should apply registration/config in SSO-SWITCH.md order after the app code lands.

Review work is isolated in detached /tmp worktrees. No existing checkout moved; no commits, pushes, merges, deployments or config/secret writes. Scratch mutations were restored. Posted through the repository's amadan agent-account skill (.claude/skills/amadan/SKILL.md), never -as-human.