oficina / home Public

Adopt the suite sharing doctrine: Appendix A.1.

oficina/suite holds the doctrine that binds every app in the suite, at revision 4, commit 210312f. This is the home's half of §12 step 1, and it is the largest of the four, because the doctrine's ruling 12 gives this spec a table it does not have.

New ruling 23 — numbered 23 rather than the appendix's 22, which is taken. Membership becomes (team, person_ref, role), written only at the directory origin by an owner behind step-up, or seeded by the drain with the team's first owner. Call 8 reads it; call 2 cannot write it. The doctrine's first revision wanted to derive the roster from directory rows, and that was wrong three ways this spec could have told it: no owner role on the row, §7 saying the home never learns who an owner is, and the row scoped per (team, app) where a roster is per team.

Also: §0 concedes that publishing the database now identifies each team's owners; §2.2's boundary moves from the instance to the team; §5.4 gains a narrow invalidation-hint exception for the roster epoch; §10 corrects "loses credentials, not access", which is false for a roster that cannot rebuild itself; §9 gains calls 7 and 8; and new §13a lists the consumed rulings and writes out the three-way compromise concession, including that a compromised credential origin can sign in as anyone — not new, not caused by ruling 23, but not covered by §2's sentence about a compromised directory either.

Waiting on: call 8 needs §13 step 4, the identity layer. Call 7 needs step

1. Neither is done here.

No code changes. Spec only.