amadan
Record oficina.works as the primary domain
Supersedes the provisional platform-default hosts (<app>.<sqid>.oncarlos.com under Carloku account sqid bds) with the suite's own domain: id.oficina.works credential origin / RP oficina.works directory, at the apex <team>.<app>.oficina.works one team, one instance, one hostname The team slot is new: the provisional shape had nowhere to put the per-team hostname that home spec S7 reserves at enqueue. The RP rename drill (LegacyRPID + a window sized by the guest tail) did not have to run. No app in the suite has a passkey.Config yet -- sign-in is magic-link throughout -- so no credential was ever scoped to an oncarlos.com host. Moving now was free; moving after passkeys ship is not. The full-host RP ID constraint survives the move, with a new reason: oficina.works as an RP ID would be valid at every host in the zone, including the directory and each team instance, collapsing the split origins that home ruling 2 exists to create. Specs only. No code, no behaviour change.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HJ4p3qTNQqScxS6Z6wp8Pw
2 files changed,
+20
−11
AGENTS.md+2 −2docs/superpowers/specs/2026-08-30-docs-design.md+18 −9
CI passed — run details
diff --git a/AGENTS.md b/AGENTS.md| index f4f295f..a8a71cd 100644 |
| --- a/AGENTS.md |
| +++ b/AGENTS.md |
| @@ -114,8 +114,8 @@ actually breaks is the legacy fallback path, silently: a misconfigured |
| origin will not show up as "the app looks broken" in ordinary manual |
| testing with a real browser, which is exactly why it still needs to be |
| right rather than merely untested. `cmd/docs/main.go` reads `$DOCS_ORIGIN` |
| -(the platform's real per-instance origin belongs there — spec §9.2's |
| -`<app>.<sqid>.oncarlos.com`) and falls back to deriving one from `-addr` |
| +(the real per-instance origin belongs there — spec §9.2's |
| +`<team>.docs.oficina.works`) and falls back to deriving one from `-addr` |
| only for local/dev use; with neither set, or with a value that cannot |
| parse as an absolute `http(s)://host[:port]`, `internal/docs.New` refuses |
| to start rather than silently defaulting or booting on something |
diff --git a/docs/superpowers/specs/2026-08-30-docs-design.md b/docs/superpowers/specs/2026-08-30-docs-design.md| index 4bbe01e..7c5bbd7 100644 |
| --- a/docs/superpowers/specs/2026-08-30-docs-design.md |
| +++ b/docs/superpowers/specs/2026-08-30-docs-design.md |
| @@ -597,17 +597,26 @@ Docs never sends a document title to the home. |
| invention. The window is still sized by the guest tail — the person who |
| signed in once, months ago, to comment on one document. Docs has far more |
| of them than Sheets does. |
| -- **The hostnames, recorded 2026-08-30.** The account is `oficina`, sqid |
| - `bds`; default addresses are `<app>.<sqid>.<apps-domain>` on the hosted |
| - apps-domain `oncarlos.com`. So both home origins and every Docs instance |
| - are distinct `oncarlos.com` hosts under `bds`. (`carloku.com` is the |
| - console brand and is not this.) |
| +- **The hostnames, revised 2026-09-03** (home ruling 16, superseding the |
| + 2026-08-30 record). The suite's primary domain is **`oficina.works`**. |
| + The two home origins are `id.oficina.works` (credentials, the RP) and the |
| + apex `oficina.works` (directory); a Docs instance is |
| + **`<team>.docs.oficina.works`**, one team to one hostname. Hosting stays |
| + on Carloku with `oficina.works` as a custom domain. This replaces the |
| + provisional `<app>.<sqid>.oncarlos.com` under account sqid `bds`, which |
| + was a hosting artifact. (`carloku.com` was the console brand and was |
| + never this.) |
| +- **The rename cost nothing, because it happened first.** No app in the |
| + suite had a `passkey.Config` when the domain moved — sign-in is |
| + magic-link throughout — so no credential was scoped to an `oncarlos.com` |
| + host. The `LegacyRPID` window above is sized for a *future* move. |
| - **The RP ID is the full host, always** — a constraint that binds Docs even |
| though the RP is the home's. WebAuthn permits an RP ID that is a |
| - registrable suffix of the origin's hostname, so `oncarlos.com` would be |
| - *accepted* — and it is shared by every Carloku tenant, which would scope |
| - our people's credentials across other people's apps. Asserted by a test |
| - rather than remembered. |
| + registrable suffix of the origin's hostname, so `oficina.works` would be |
| + *accepted* for `id.oficina.works`. The old objection was that |
| + `oncarlos.com` is shared by every Carloku tenant; on a zone we own the |
| + objection is that a suffix RP ID scopes one credential across every team |
| + instance under it. Asserted by a test rather than remembered. |
| ### 9.3 The canvas preference |