amadan
Fable found that no-referrer makes a cross-origin POST send Origin: null. Root reproduced this in actual Chromium and WebKit on synthetic HTTPS origins with scripts off: both old-policy requests send null; corrected strict-origin-when-cross-origin sends exact issuer Origin, and the 303 finish GET receives both __Host- SameSite=Lax pending and inbox cookies while the initial cross-site POST receives neither. Evidence /tmp/oficina-handoff-browser-probe/results.json. Revised design36f876c also fixes CSP manifest equality, unique jti inbox, bounded pending eviction, sealed return paths and explicit role/script/spec amendments. Follow-up review running; no deployed SSO yet.
Home and team app entry implementation open
On branch feat/team-entry
User approved prioritizing common Docs entry through Home sign-in and team selection. First stage is reviewed assertion transport to a separately authenticated directory; then authoritative roster, chooser and Docs identity linking. Fable design review running, no app deployment yet. Core shared code is rastrillo/rastrillo feat/identity-assertion.