oficina / docs Public

Spec §8.1: instance-local sign-in is required, not merely correct

Replacing my justification with a better one from the Sheets session.

I argued instance-local sign-in was correct for a single instance. The
stronger form is that factor VII requires it: self-hosting is a right and
first-class, and the earlier draft would have obliged someone
self-hosting one instance to stand up the entire suite home -- split
origins, blind-index directory, assertion minting, key rotation -- to
sign in to their own documents. Prohibitive rather than degraded, which
makes self-hosting nominal.

An argument from a value survives a reviewer who disagrees about
convenience.

Also records what the home actually is: not how you sign in, but how one
person reaches many instances without many credentials. Every part of its
machinery serves that and nothing else, which is why a lone instance
needs none of it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011F5CivVm4CmL9ByfSSAaXA

Paul Campbell pushed by paul@keymail.dev 1 month ago 34013e43a95b9e8af8bab7749ea45c1d8a096797 parent 9cffc8e

1 file changed, +16 −0

docs/superpowers/specs/2026-08-30-docs-design.md +16 −0

Intent

full ledger: signin-and-samples

diff --git a/docs/superpowers/specs/2026-08-30-docs-design.md b/docs/superpowers/specs/2026-08-30-docs-design.md

index e42d22b..4bbe01e 100644

--- a/docs/superpowers/specs/2026-08-30-docs-design.md

+++ b/docs/superpowers/specs/2026-08-30-docs-design.md

@@ -446,6 +446,22 @@ correct answers:

signs people in **itself**, with rastrillo's `auth` plugin: magic link,

auto-upgrading to keymail when the address resolves to a claimed inbox.

This is the right answer for that shape, not a placeholder for one.

+ **And it is required rather than merely correct.** Factor VII holds that

+ self-hosting is a right and first-class, not a degraded tier. An earlier

+ draft of this section made the home the only way in — which would have

+ obliged a person self-hosting one instance to stand up the entire suite

+ home, split origins, blind-index directory, assertion minting and key

+ rotation included, in order to sign in to their own documents. That is not

+ a degraded tier; it is a prohibitive one, and it would have made

+ self-hosting nominal. *(Argument owed to the Sheets session, 2026-08-31,

+ which is a better justification than the one this spec first gave.)*

+ It also sharpens what the home **is**: not "how you sign in", but *how one

+ person reaches many instances without many credentials*. Split origins, the

+ blind index, the rekey journal, the pepper living in exactly one place —

+ every part of it serves that and nothing else. A lone instance has none of

+ that problem and therefore needs none of that machinery.

- **A suite deployment** — Docs beside Sheets and others, one person

spanning several teams. Here three instances must not mean three

credentials, which is the problem the home exists to solve, and sign-in