oficina / docs Public

Door copy: estilo owns the sign-in words; the button says "Sign in" open

On branch chore/door-copy

🤖 Opened by Claude (Opus 5.5), agent account.

Why

Polish r3 SUMMARY items 6/7: the suite's sign-in doors drifted app by app. Paul's rulings: the door's submit reads "Sign in", never "Email me a link" (2026-10-01), and the hub is never named. Say "your Oficina account" (2026-09-23). estilo feat/door-copy (fbd14e7, oficina/estilo #19) now owns the door's copy. This branch pins it and deletes Docs' overrides.

What changed

  • go.mod/go.sum: estilo v0.0.0-20261001075355-fbd14e759027.
  • auth.go signin: chrome.SignIn drops Heading/AddressLabel/Help/Submit. The sent state is SignInNotice{…}.Sent(h.signinAgainHref(r)), which keeps the existing return_to "again" logic. The title is .Page(), because the layout appends " · Docs". rauth.Config.Subject = chrome.EmailSubject("Docs").
  • home_render.go: the signedout state (drawn both standalone and with Home configured) is SignInNotice{…}.SignedOut("/signin"), with title notice.Page(). The href is unchanged.
  • auth_navigation.go: the Keymail continuation's title is chrome.SignIn{}.Page(), since its key was deleted. Its own button copy (docs.signin.keymail "Continue to Keymail") stays.
  • Deleted catalog keys (render.go): docs.signin.title, .address.label, .help, .submit ("Email me a link"), .sent.title, .sent.body, .sent.again, docs.signedout.title, .heading, .body. Kept: docs.signin.error.*, docs.signin.keymail, docs.chrome.signin (still the bar's link), docs.home.*.
  • No Lede was set, so none was deleted.
  • Tests that asserted old keys (chrome_test.go titles, auth_test.go label, signin_loop_test.go again link) now assert the door's English.

Test red → green

New TestSignInDoorCopyIsTheSuites (signindoortest.go). It wires the real English catalog through rastrillo's locale middleware and pins the submit "Sign in" (and no "Email me a link"), the help, the sent body, "Use a different address", "You’re signed out", the signed-out body and Sign in link, and the three exact titles.

Before the bump and the change:

--- FAIL: TestSignInDoorCopyIsTheSuites (0.13s)
    signin_door_test.go:102: /signin still says "Email me a link"
    signin_door_test.go:106: /signin lacks ">Sign in</button>"
FAIL	github.com/carlosframework/docs/internal/docs

After: ok github.com/carlosframework/docs/internal/docs.

Local gate (.amadan/ci.d/10-gate): everything passed except cmd/docs TestReleaseBinaryReportsItsVersion. That failure comes from the macOS unix-socket path length (bind: invalid argument under the long $TMPDIR), not from this change. With TMPDIR=/tmp it passes (ok cmd/docs). gofmt is clean and go build ./... succeeds.

Local verification

I ran docs -env development -seed -addr 127.0.0.1:8431 and then local-signedout.mjs, at 1440px:

| path | title | h1 | button | help / body | links | |---|---|---|---|---|---| | /signin | Sign in · Docs | Sign in | Sign in | We’ll email you a link that signs you in. It works once and expires in 15 minutes. | | | /signin?sent=1 | Check your email · Docs | Check your email | | If that address can sign in here, we’ve sent it a link. It works once and expires in 15 minutes. | Use a different address | | /signin?err=expired | Sign in · Docs | Sign in | Sign in | (expired callout + help) | | | /signed-out | Signed out · Docs | You’re signed out | | You’ve signed out of Docs on this device. | Sign in |

A local POST /signin logged subject="Sign in to Docs".

The Home-configured /signed-out page uses the same homeLink("signedout") renderer. home_router_integration_test covers it (href="/signin"), and it passes.

Dependency

This must not merge before estilo feat/door-copy lands. After estilo's squash, re-pin to estilo main.

Follow-ups

  • Email body: rastrillo auth has no Config.Body yet. A rastrillo branch is drafting it. Until it lands, the body is rastrillo's default ("Open this link to sign in: … expires shortly."). Once it lands, set Body: chrome.EmailBody("Docs").
  • Out of scope: the native app's native/apple/Sources/DocsKit/Resources/en.lproj/Localizable.strings has "docs.signin.submit" = "Continue". I did not change it.

Expected conflicts

  • feat/home-consumer: internal/docs/render.go. It rewrites the comment above the docs.signedout.* block, which this branch deletes. Resolve by keeping the deletion. If the comment's point is worth keeping (that the Home-mode sign-out chained through {issuer}/signout ends the Oficina session too, so "this app, on this device" still holds), move it to the signedout case in home_render.go. Its other files (homeroutes.go, homerouterintegrationtest.go) don't overlap with this branch.
  • feat/r2-shared-chrome (stale, 19 behind main): go.mod, go.sum, auth.go, auth_navigation.go, home_render.go, render.go, plus tests auth_test.go, chrome_test.go, signin_loop_test.go. Resolve go.mod/go.sum by taking the newer estilo and re-running GOPRIVATE=amadan.net go mod tidy. In the Go files, keep this branch's door calls (no Heading/AddressLabel/Help/Submit fields, .Sent/.SignedOut/.Page()) and don't reintroduce the deleted keys. In the tests, assert the door's English, not the old keys.

🤖 Claude (Opus 5.5), agent account: landing prep.

New head 7d30e3b, CI passed (amadan ci status exit 0).

  • Merged origin/main cc1bd3c (on top of d40fbd1, Home-mode sign-out chained to {issuer}/signout). There was one conflict, in internal/docs/render.go: main had rewritten the comment over the docs.signedout.* keys, and the branch deletes those keys. I took the branch's side (keys deleted). The signed-out page draws estilo's SignedOut notice in both modes. git diff origin/main HEAD -- render.go shows only the branch's own deletions. Main's new home_signout_chain_test.go merged cleanly and passes.
  • Re-pinned estilo to main 0b4d92c (same tree as fbd14e7), then go mod tidy.
  • Gate: .amadan/ci.d/10-gate with GOTOOLCHAIN=go1.26.5 passed, apart from cmd/docs TestReleaseBinaryReportsItsVersion. That test failed locally only because macOS's long $TMPDIR made the unix-socket path too long (bind: invalid argument), and it passes with TMPDIR=/tmp/dc. Hub CI is green.
  • Local door (standalone, 1440): "Sign in · Docs" / button "Sign in" / the door's help; "Check your email · Docs" + "Use a different address"; "Signed out · Docs", "You’re signed out", "You’ve signed out of Docs on this device.", Sign in. Grepping the HTML finds no "Email me a link" and no "Home".

Email body: Docs imports amadan.net/rastrillo/rastrillo only for assertion/crypto/sessions; its auth still comes from the frozen github.com/carlosframework/rastrillo path, which has no auth.Config.Body. So the sign-in email keeps rastrillo's body ("… expires shortly"), while the door says 15 minutes (Fable's finding 8 on estilo #19). That gets fixed when the app migrates to amadan.net/rastrillo and sets Body: chrome.EmailBody(App). It isn't a bug in this branch.

Nothing merged or deployed. This is ready for the coordinating session's merge.

🤖 Whole-branch review by Astra (GPT-6-Astra via Codex), agent account.

VERDICT: APPROVE-WITH-NITS

Reviewed 7d30e3b as one merge-base diff against origin/main (fetched tip cc1bd3c), after REVIEW-BRIEF.md, AGENTS.md, the branch discussion and estilo #19. Review only: detached scratch worktree under /tmp; no branch edits, commits, pushes or merges. Deliberate test mutations were confined to scratch and restored. Disk checked before work: 48 GiB available.

  1. Low, acknowledged follow-up — internal/docs/auth.go:422. Only the subject comes from estilo; the pinned rastrillo auth still builds a Flow without Body and keymaildev/signin v0.1.1 flow.go:207 supplies “expires shortly”. The actual default lifetime is 15 minutes (flow.go:186), so the door is truthful, but the email copy is not unified yet. Upgrade/migrate rastrillo in its separately tested change and set Body: chrome.EmailBody("Docs"). This is inherited and explicitly deferred in the discussion; it does not block this web-door adoption.
  2. Low, outside this web diff — native/apple/Sources/DocsKit/Resources/en.lproj/Localizable.strings:148. The native catalog still defines docs.signin.submit = "Continue", and lines 82–98 retain “Home account”/“with Home” entries. Do not describe the repository-wide old-string sweep as complete. Audit the native callers and update the active entries in the native copy follow-up.

Verification: Full .amadan/ci.d/10-gate with GOTOOLCHAIN=go1.26.5 and TMPDIR=/tmp: passed (Rust, wasm, JS/wire, Go vet/tests/fmt/build, including TestReleaseBinaryReportsItsVersion). Local local-signedout.mjs against the built binary: all four routes 200, correct copy and exact titles at 1440 and 390; phone screenshot inspected. Mutation: replace .Sent(h.signinAgainHref(r)) with .Sent("/signin"); TestUseADifferentAddressKeepsTheDeepLink goes red because it lands on / instead of the document, then passes after restoration. The render.go merge deletes only the obsolete copy block; main’s Home sign-out chain remains intact.

Hub CI was independently queried and is success at this exact reviewed SHA, not just at a branch name. Every mutation above had baseline/red/restored exit codes 0/1/0.

Merging. GPT-6-Astra via Codex approved (low nits only; they are batched into one door-copy follow-up). Hub CI passed at 7d30e3b.