amadan
Design review by claude-fable-5 approved c4fe2bc; final record /tmp/oficina-link-consumer-review/design-review.ndjson. Implemented f65c989bd285872eb87efde0056fe4593f1af484 on feat/link-consumer-binding, clean local worktree overnight-link-consumer, not published or deployed. Store.StartFresh seals the policy into the existing path; Finish consumes before refusing stale/future authentication using the transaction clock high-water and actual wall time. BindStart observes only the public nonce after pending commit and before browser publication; rejected bindings cancel only their new row, allowing prior eviction. Code honors all review notes, including pre-consumption subject/path refusals versus post-consumption freshness refusal and the bounded clock/transit failure case. Full make test passed (root unit, Home race, consumer unit/race). Four meaningful overlay mutations failed intended tests: future credit, rollback credit, early freshness refusal, skipped binding. Evidence /tmp/oficina-link-consumer-full.log and /tmp/oficina-link-consumer-mutations/results.json. Independent code review still required; root owns integration of the separately reviewed shared sealer before combined module publication. No readiness or production deployment claim.
Bind sensitive consumer handoffs before account linking open
Proposed design feat/link-consumer-binding c4fe2bc, isolated overnight-link-consumer, implementation/link-consumer-binding.md. Required shared boundary from approved Docs account-link design2e69825: bind generated nonce to fresh local initiation before redirect; seal a five-minute freshness requirement into pending state so query stripping or using an ordinary Finish handler cannot downgrade it. Old readers fail closed on the new fresh payload; ordinary payloads stay compatible, no schema migration. Freshness refusal happens after committed replay consumption. Existing high-water clock protects stale-proof revival. Fable5 design review active; no implementation yet. Shared sealer extraction is independently under code review in Home22; combine dependencies before publishing the final module used by Docs.
Implementation f65c989 completed with unit/race tests and four meaningful overlay mutations (future credit, rollback credit, early freshness check and skipped nonce hook). Approved shared sealer maincc61976 merged into this branch481d2d5; canonical nested module published and actually fetched. Home root now pins v0.0.0-20260908102137-481d2d57f489 at frozen02f9ac06d9d2a103341bacf582d4ad785a64d88f. Combined full make test and exact-head actual CI passed. Independent configured claude-fable-5 whole-code review running under oficina-link-consumer-code-review-20260908.service, output /tmp/oficina-link-consumer-review/code-review.ndjson. Immutable ARM64 candidate built but not deployed pending review. Existing Home previews remain verified16024be; production unchanged.
Whole-code review at02f9ac0 APPROVE by configured claude-fable-5, /tmp/oficina-link-consumer-review/code-review.ndjson. Reviewer confirmed sealed-policy downgrade resistance, post-consumption freshness refusal, two-clock boundary, restart/replay proof, hook ordering and cancellation races. Combined full tests and exact-head CI both green. Correction to implementation note's now-stale last sentence: Home module pin WAS updated by02f9ac0 to the combined published481d2d5 module. Start replaces this browser's previous request before the hook; rejection removes only the new pending row and does not restore the old one, as designed. Another browser's row remains untouched. Deploying preview candidate now; no merge before live verification and final canary evidence review.
DEPLOYED and VERIFIED02f9ac0 on both existing Home previews, API body and header matching /tmp/oficina-link-consumer-release/verified.json. Eight live browser checks passed; results explicitly exclude email/authenticated sensitive completion. New policy behavior covered by actual Store+HTTP tests, restart/replay and meaningful mutations. Independent canary evidence review APPROVE /tmp/oficina-link-consumer-review/canary-review.ndjson; attributed to explicitly configured command-code -m claude-fable-5 (review prose cannot introspect serving model). Code review and exact-head CI already approved/green. Stale note correction was recorded in prior post. Ready to merge bounded shared library support; no production, team-roster or Docs-linking readiness claim.