amadan
Passkey RP ruling confirmed; assertion helper filed
Paul confirmed the ruling directly rather than by relay, so §8.1 is settled: one relying party at the home's credential origin, instances verify signed assertions and never enroll passkeys, and LegacyRPID covers the eventual hostname move. Both design sessions reached this shape independently and then each declined to adopt the other's report of the ruling until asking Paul separately. Two independent arrivals and two independent confirmations is a better basis for the framework ask than one app's opinion twice, so the spec records how it got here rather than only what it says. The identity-assertion helper is filed as rastrillo/rastrillo discussion #1 on amadan -- not GitHub, which is where both sessions had assumed it would go. Drafted jointly, both apps named as consumers, including Docs' self-pruning replay store requirement.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011F5CivVm4CmL9ByfSSAaXA
1 file changed,
+12
−7
docs/superpowers/specs/2026-08-30-docs-design.md+12 −7
diff --git a/docs/superpowers/specs/2026-08-30-docs-design.md b/docs/superpowers/specs/2026-08-30-docs-design.md| index a2d80e1..6f2c791 100644 |
| --- a/docs/superpowers/specs/2026-08-30-docs-design.md |
| +++ b/docs/superpowers/specs/2026-08-30-docs-design.md |
| @@ -394,9 +394,10 @@ no cross-origin hand-off is required. Instances receive identity as **signed |
| assertions** and verify a signature — Tito's pattern, where signing rather |
| than stripping is what stops a peer socket forging them. |
| -**This is marked in the Sheets spec as ruled but needing Paul's direct |
| -confirmation, and it is recorded the same way here.** It reached this session |
| -by relay, and a relayed ruling is not a confirmed one. |
| +**Confirmed by Paul directly, 2026-08-30.** It first reached this session by |
| +relay from the Sheets session, and was held as unconfirmed until asked |
| +directly — a relayed ruling is not a confirmed one, and both sessions applied |
| +that standard to each other in both directions during this design. |
| **Assertions carry identity, never authorization.** A guest's assertion is |
| the same shape as an owner's; the instance decides capability from its own |
| @@ -711,8 +712,9 @@ thumbnails all fall out of it. |
| ## 15. Open |
| -1. **The passkey RP ruling (§8.1)** reached this session by relay and needs |
| - Paul's direct confirmation. Sheets records it the same way. |
| +1. ~~**The passkey RP ruling**~~ — **closed 2026-08-30**, confirmed by Paul |
| + directly. §8.1 is settled: one relying party at the home's credential |
| + origin, instances verify signed assertions and never enroll passkeys. |
| 2. **Full-text search has no design.** An FTS5 index is plaintext in SQLite |
| and would fail our own gate (§12); decrypting the corpus per query is |
| O(corpus). Title and metadata search ships; full text waits for a design, |
| @@ -724,8 +726,11 @@ thumbnails all fall out of it. |
| Until one is cut, Docs pins a `main` pseudo-version — workable, but a |
| pinned pseudo-version is not a dependency anyone should ship on. |
| `ui-guidelines-52` is raising it; two apps hit it in one afternoon. |
| -4. **The identity-assertion helper** — filed jointly with Sheets, pending |
| - Paul's go-ahead to open it on the rastrillo GitHub repo. |
| +4. ~~**The identity-assertion helper**~~ — **filed 2026-08-30** as |
| + `rastrillo/rastrillo` discussion #1 on amadan, drafted jointly with |
| + Sheets, both apps named as consumers. Neither app is blocked on it; |
| + both can hand-roll verification and would rather not do it twice, |
| + differently. |
| 5. **`.amadan/ci.d/10-gate`** arrives with the first code branch. |
| 6. **The three-language cost.** Revisit once the crate is real. Revision 2 |
| already spent this clause once — the "same artifact both sides" claim did |