claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession oficina- · codex · DOCS-T1
Connect Home credential sign-in to a separate directory session through the reviewed shared consumer. Explicit role loaders keep assertion signing private to credentials; existing sign-in and recovery continue to a registered handoff with original AuthTime. Local integration/privacy and role migration tests pass. Fable full-code review and final CI running; no deployment or completed Docs/team journey yet.
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession oficina- · codex · DOCS-T1
Home mounting d1526e4 received independent Claude Fable 5 APPROVE via Command Code (subscription Fable returned a limit, not a review). Full actual CI passed. Eight actual-handler local browser runs passed Chromium/WebKit, JS on/off, widths320/1280 using a local-only HTTPS proxy and synthetic credential session. Actual emailed live authentication remains separate.
Deployed d1526e4 to both existing Home preview hosts with legacy roles still unset. Actual API version body AND header match; receipt /tmp/oficina-home-assertion-release/legacy-verified.json. Production unchanged. CARLOS rejected quoted JSON configuration, so follow-up eaefda9 adds bounded canonical _BASE64 alternatives; full local/actual CI passed, Fable delta review running. It is not enabled yet.
Supported instances set-environment exists in current platform. Credential keeps overnight-home; directory will move to overnight-directory with its existing DEK preserved. No database/path/credential rotation. New assertion private key scoped to credential environment only; directory will mask inherited credential/mail settings. The existing Home preview data remains intact. Full team chooser, roster and Docs linking remain subsequent work.
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession oficina- · codex · DOCS-T1
Final stage eaefda935d5214855f2154152f701c7fa0b5309a: actual CI success and full local test gate. Claude Fable 5 (Command Code) APPROVE for encoded configuration delta and independent live-canary evidence review. Exact review records are /tmp/oficina-home-assertion-review/command-code-review.ndjson, encoded-review.ndjson and canary-review.ndjson; final result blocks only. The canary review could not find earlier records using its relative paths; root separately read the actual complete final verdicts at these absolute paths.
DEPLOYED and enabled the credential and directory roles on existing preview pair. Both /api/version bodies and X-Carlos-Version headers equal eaefda9. Directory now uses overnight-directory; credential retains overnight-home. Host, socket and data paths unchanged; old credential secrets preserved, directory inherited credential/mail fields overridden empty, no private assertion key on directory bundle.
Eight live browser cases passed (Chromium/WebKit, JS on/off,320/1280) for actual Home→credential sign-in redirects/cookies/version. Eight real-HTTPS consumer checks passed including synthetic-subject session establishment, foreign-origin and expiry refusal, wrong nonce, eight simultaneous callbacks with exactly one winner, replay refusal and CSRF-protected signout/revocation. Evidence /tmp/oficina-home-assertion-release/browser/results.json and live-consumer-results.json. These deliberately do not claim a live emailed credential authentication; the complete credential→directory flow is covered by local actual-handler browser tests and email/recovery integration tests. Production restore, live clock manipulation, team chooser and Docs return remain later work. User notified with https://overnight-home.bds.oncarlos.com/ and precise limitations.
amadan