amadan
Record Fable approval of local navigation amendment
1 file changed,
+3
−1
implementation/local-link-continuation.md+3 −1
CI passed — run details
diff --git a/implementation/local-link-continuation.md b/implementation/local-link-continuation.md| index 1d3d830..f216e8a 100644 |
| --- a/implementation/local-link-continuation.md |
| +++ b/implementation/local-link-continuation.md |
| @@ -1,6 +1,6 @@ |
| # Local reauthentication navigation before Home linking |
| -Status: design amendment proposed by Codex, 2026-09-08, for Fable review before implementation. Supersedes only the local-signin continuation paragraph of the approved Docs account-link design2e69825. No code for this amendment is present on this branch. |
| +Status: design amendment approved by claude-fable-5 at dccdb746303b87f64f4156053943441ad2ca60af, 2026-09-08. Review used pinned source excerpts inline; it did not execute tests. Supersedes only the local-signin continuation paragraph of the approved Docs account-link design2e69825. No code for this amendment is present on this branch. |
| ## Why the earlier continuation cannot work |
| @@ -31,3 +31,5 @@ Rastrillo v0.23.0 sessions.resolve and SignIn use r.Cookie, accepting the first |
| ## Acceptance |
| Actual local email verification with a valid marker returns through the fixed bridge to the initiation page; no Home or linkstore operation occurs until the explicit new POST. Ordinary local signin still lands /. Failed verification never reaches the bridge. Marker missing/duplicate/tamper/expiry/unknown fields, hostile query destinations and wrong origin purpose all fall back to /. Browser tests include JS off. A changed local account displays its own account before a new initiation. Stale prior proofs cannot be confirmed after session rotation; the original session token is revoked. A freshly minted Home session cannot use At to pass local freshness. A meaningful mutation must fail if the bridge skips the method/freshness guard or if a stale initiation resumes. Whole integration code review, actual CI and canary acceptance remain required. |
| + |
| +Review implementation notes (non-blocking, to honor): explicitly guard duplicate session cookies before GET /auth/verify, GET /auth/callback, GET /auth/local/complete, the initiation/confirmation POSTs and Home exchange/session replacement. Check signin still renders to an already-signed-in user (the current h.signin renders directly without checking a session); preserve this in suite integration and JS-off browser acceptance. Set Cache-Control: no-store on the bridge and every marker-setting response. A cross-site top-level GET to /account/home may invalidate an existing flow; this deliberately fails closed by destroying a flow, never granting or creating one. Review result: /tmp/oficina-docs-local-continuation-review/review.ndjson. |