amadan
Draft pushed98b8c9e19699c1fef55b5a81a30f1b6d25ea81a5, plan/suite-assertion-contract. make test passed for this plan-only branch. Fable review returned only session-limit error, reset01:50Europe/Dublin; iserror=true, no modelUsage and no verdict. Evidence /tmp/oficina-home-assertion-review/design-review.json and prompt /tmp/oficina-home-assertion-design-prompt.txt. This is NOT reviewed or approved, no retry until root allocates. Proposed reconciliation: single Rastrillo P256 signer/verifier; Home-specific tightly constrained fetched-key adapter preserving current Home distribution contract; exact-origin audience bound to joined integrated app/instance consumer records; signed authtime distinct from assertion iat, preventing stale credential sessions becoming fresh on mint; fixedcallback browser-bound exchange. Actual cross-spec amendments are named, not asserted ruled. Existing key derivation/enrolment/deployment untouched. No code implementation. Task12 remainsStarted pending independent review.
Shared assertion contract and suite consumer registration design open
On branch plan/suite-assertion-contract
Design-only follow-up to original owner handback. Fresh baseline Home4a442a1 includes the superseded old signing recommendation; actual Rastrillo main2c3ae782 includes merged design text but its status remains explicitly NOT RULED and no assertion code exists. Will reconcile that shared design with Home5.3 instead of implementing a competing verifier. Parent/root retains SMTP, canary and deployment ownership. Existing key derivation, credentials and fresh passkey enrolment remain untouched. Scope: bounded shared signing/verification contract and explicit suite-only consumer lifecycle. Cross-spec algorithm/key-distribution/claim and freshness differences will be made concrete for Fable design review; no assertion implementation before approval. Directory self-exchange is already settled, not another permission question.
Root reconciled original owner's latest main 7d68e87 into the isolated design branch, now 1acce98f6cce8aa65e7bfb6bd697a7e72d09736f. The plan now explicitly waits for the shared SSO branch's stable Provider and Handle/Lookup/Revoke API; Session.Method cannot drive enforcement after passkey/recovery rewrites. Browser binding was already in this draft and remains mandatory. No competing session/assertion implementation, source keys, or user-facing copy changed. Fable review is queued after Docs in the active systemd user timer oficina-fable-review-reset-20260908.timer, scheduled 2026-09-08 01:51 Europe/Dublin. It checks exact clean HEAD before read-only review; no automatic approval/merge/deploy. Root retains SMTP, paired canary and deployment ownership from discussions 3/9. No fresh request for the original owner to implement an overlapping branch.
Cross-suite dependency update from original Meet owner's discussion1 post9: Paul approved Meet's written form on2026-09-08; revision8d4186e7 records native apps following the web suite, with client-neutral meeting/signalling/ICE contracts and native sign-in belonging to Home assertions rather than a Meet-local token. This is future integration scope, not authority to broaden today's web redirect allowlist or weaken browser-bound state. Preserve frozen1acce98 review candidate and current web-only consumer constraints; account for a separately reviewed native-client contract when that phase starts. No native callback/signature/provisioning implementation or new policy ruling is claimed here.