oficina / docs Public

Spec: record the RP hostnames, and that the RP ID is the full host

The spec never named the RP hostname, which was fine while it was
unknown and is a gap now that it is not. oficina, sqid bds, addresses
at <app>.<sqid>.oncarlos.com. carloku.com is the console brand and is
not this.

The second half binds Docs even though the RP belongs to the home:
WebAuthn accepts an RP ID that is a registrable suffix of the origin
host, so oncarlos.com would be accepted -- and it is shared by every
Carloku tenant, which would scope our people's credentials across other
people's apps. Full host, always, asserted by a test.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011F5CivVm4CmL9ByfSSAaXA

Paul Campbell pushed by paul@keymail.dev 1 month ago 3042ba5619fb137d5aab68219df76c9cbabc9af0 parent 76da002

1 file changed, +11 −0

docs/superpowers/specs/2026-08-30-docs-design.md +11 −0

No CI script — run details

Intent

full ledger: plan-rust-core

diff --git a/docs/superpowers/specs/2026-08-30-docs-design.md b/docs/superpowers/specs/2026-08-30-docs-design.md

index 6f2c791..17d467f 100644

--- a/docs/superpowers/specs/2026-08-30-docs-design.md

+++ b/docs/superpowers/specs/2026-08-30-docs-design.md

@@ -476,6 +476,17 @@ Docs never sends a document title to the home.

invention. The window is still sized by the guest tail — the person who

signed in once, months ago, to comment on one document. Docs has far more

of them than Sheets does.

+- **The hostnames, recorded 2026-08-30.** The account is `oficina`, sqid

+ `bds`; default addresses are `<app>.<sqid>.<apps-domain>` on the hosted

+ apps-domain `oncarlos.com`. So both home origins and every Docs instance

+ are distinct `oncarlos.com` hosts under `bds`. (`carloku.com` is the

+ console brand and is not this.)

+- **The RP ID is the full host, always** — a constraint that binds Docs even

+ though the RP is the home's. WebAuthn permits an RP ID that is a

+ registrable suffix of the origin's hostname, so `oncarlos.com` would be

+ *accepted* — and it is shared by every Carloku tenant, which would scope

+ our people's credentials across other people's apps. Asserted by a test

+ rather than remembered.

### 9.3 The canvas preference