oficina / docs Public

CI passed at a3a4402 (amadan ci status exit 0). Not merged; waiting for review.

Reviewer: Astra (GPT-6-Astra via Codex).

VERDICT: APPROVE

1. No actionable findings. I found no correctness, security, migration, data-loss or mouse-layout regression requiring a change.

Reviewed the whole branch at a3a4402af94d8cffcc676fbcf6e6cc1c1571260b against freshly fetched origin/main and merge base 73a54618c84ad1465b0267935aedc0ca73307e84, following AGENTS.md and REVIEW-BRIEF.md. Read this discussion and my Sheets #44 review, including its follow-up fixes.

The session pin and authority boundaries are sound:

• The precise 29e4491..d9c28d7 history is 997935b, 961863d, d9c28d7. The first is the identity-assertion merge, whose tree is identical to 29e4491; it adds no content relative to that comparison point. 961863d adds FromContext, routes its lookup through QueryRowContext, and adds cancellation/parity tests and documentation. d9c28d7 tightens those tests, suppresses logging only for errors matching the caller's cancellation, and cleans up the review scope. The net production change is confined to sessions. Neither ordinary From nor the existing lookup changes its unbounded/background-context behavior.
• internal/docs/team_session_reader.go:24 calls the same canonical reader Docs already used, without the now-unnecessary structural conversion. It still checks for exactly one acceptable cookie first. FromContext reads the database; it does not trust a cached Current session. Cancellation refuses access without refreshing, revoking or deleting the session. The stream guard subsequently checks context expiry, resolves identity, compares the actor/Home subject, rechecks document permission, and bounds the write by the remaining lease. The migration does not turn a session subject into admission or an app person ID.
• Both session packages retain the same schema, token and cookie contract: HTTPS uses __Host-rastrillo_session, Path=/, Secure, HttpOnly, SameSite=Lax and no Domain; HTTP uses the unprefixed name. Tokens are 32 random bytes in unpadded base64url, with a hex SHA-256 stored in SQLite. Both default to 30 days, persist UTC RFC3339 timestamps, reject expiry and revoke by deleting the token-hash row.
• The native bridge in internal/docs/native.go:27 is deliberate and compatible. Native exchange constructs a fresh request context, rechecks the approved browser cookie through Docs' current admission chain, independently resolves it through the legacy sessions package, then mints a distinct token. The new router tests cover HTTPS naming, pending exchange, wrong proof, identity continuity, one-use exchange, expiration before approval/after approval/after mint, and independent browser/native revocation. All pass. The team-session reader tests and upstream sessions, auth, mail, CSRF and native/server tests also pass.

Verification I ran independently:

• TMPDIR=/tmp .amadan/ci.d/10-gate: gate: ok. This includes browser-tag vet, all Go tests, Rust tests, both wire directions, fresh bundle/WASM checks, formatting and the application build. Remote CI also reports passed at this exact SHA.
• native/scripts/check-native.sh, with rustup cargo first on PATH: Native checks passed (core-only=0), including the Apple tests.
• go test -tags browser ./internal/docs/ -run TestNoZoomOnTap -count=1, using Playwright Chromium 1148 through RASTRILLO_CHROME: pass. Copied the unchanged test into a separate main worktree and supplied only its browser-test dependencies: it fails on main's door, list, title, toolbar, share address/link and jump-to fields at 12.5–14px. This checks computed styles under an asserted coarse pointer; it is not a direct Mobile Safari viewport-zoom measurement.
• Shared chrome check with the supplied r2-docs-check.config.mjs, against the reviewed release binary: 591 ok, 0 FAIL.
• Deliberate mutations in a separate scratch worktree: an HTTP native-session origin makes the new exchange test fail at approval; removing the toolbar coarse-pointer rule makes the new zoom test report all three 12.5px comboboxes; an extra old-path import fails TestNoPreMoveRastrillo; aliased UserID calls fail TestNoSessionsUserID independently on both paths. Restored code passes.
• Busy-rule mutations: a copied static/rastrillo.js fails the disk guard. More importantly for this app, replacing the in-memory busy.ShimJS() with ui.ShimJS() fails TestBusyRuleIsLinkedAndServed on both the linked fingerprint and the served bytes. The actual layout serves Estilo's split shim and busy.js together; the new framework path does not substitute the combined shim.
• The committed editor bundle and embedded WASM are unchanged from main and byte-identical to their fresh builds. Editor SHA-256: fedd7579de35d95f263226c577d9707b51f39bf62d0db7413d471bcfeafe3606; WASM: 21e982e3075e23558c0203d229cafcc35095624d667d8c715154c08c45bade26.
• make release succeeds for Linux/arm64. A Darwin/arm64 release built through the same script answers /api/version with v0.1.0-41-ga3a4402. The existing release-version test also passes in the gate.
• Built main with its original application dependencies, booted it, signed in, seeded sample documents, created a document and published a link. Stopped that binary and booted the reviewed release over the same database. The saved old cookie still authenticates the list, sample document and created document; the old public link serves the Millbrook content. Schema and all 13 migration ledger entries are unchanged.

I inspected the supplied before/after screenshots, including narrow touch document, jump-to and published-sharing views. Pixel-compared all 36 mouse pairs: 23 are identical; the others differ in the sky, generated public-link text, or a tiny combobox rendering detail. I also compared the author's saved geometry/style dumps: all 36 mouse views agree after excluding touch-action. The three Docs overrides and Estilo's title fix are coarse-pointer-only. Touch fields grow without the inspected pages overflowing.

Estilo 0b4d92c..530cb93 changes door interpolation from printf slots to named tokens, adds copy-set email helpers, adds opt-in danger menu rows, and fixes touch title sizing. Docs uses the default English copy and does not opt into Danger; the rendered door copy is preserved and its regression tests pass. Among the changed framework partials, Docs invokes field with a map and no Primary flag; choice-field is unchanged. It has no enhanced date controls. The additional auth subject hook remains unset. Mail's substantive change is context-aware delivery with a 30-second fallback when the caller has no deadline; schema, CSRF and migration production code are unchanged after normalizing the module path. This pin does not bring the later CSP/time-storage migration.

No existing checkout was moved or edited, and no commit, push, merge or deployment was made. All three review worktrees, the fixture server and its database were removed. Disk was checked with df -h /System/Volumes/Data. Posted as the configured agent account, with this Codex session identified, never with -as-human.