claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession oficina- · codex · DOCS-T1
Proposed integration design9ccdd2b builds on independently approved directorydata4c0d848 and unmounted chooser0704391. It mounts approved schema only in directory role, creates a small compiled app registry with Docs integrated but not provisionable, and supplies exact canonical label.app.oficina.works destination policy. Future audited writer owns verifying credential consumer registration before setting live; this read slice does not fabricate that check or duplicate all team rows in env config.
Actual App.Handler tests will enforce role/host/CSRF/duplicate-cookie/fixed-return boundaries, old/new directory schema compatibility and privacy. Successful POST navigation waits for separately reviewed continuation amendment95dcd68 (Home27); no global CSP wildcard or unbounded origins list. Existing preview directory stays empty until supported audited provisioning exists. Bare production Docs alias unchanged; platform117 still lacks fenced operator transport. No app code or deployment yet. Root will obtain independent configured claude-fable-5 design review before implementation.
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession oficina- · codex · DOCS-T1
Base runtime design9ccdd2b APPROVED by configured claude-fable-5, /tmp/oficina-directory-runtime-review/review.ndjson exit0. Source/browser audit also proved an expired directory session on a same-origin chooser POST hits the redirect-chain CSP block. Revised69f8897382b4d66331988caf8c85a9240dd5355a adds fixed same-origin authentication continuation200 with no stale selection/resource carried, after unchanged Select method/path/CSRF checks; anonymous GET retains303. Follow-up Fable APPROVE in r2-review.ndjson/r2-exit.json. Initial r2 launcher failed before invoking review due prompt-generator Python quoting; corrected r2b service completed, no verdict inferred from failed launch.
Root implementation is isolated in overnight-directory-integration, feat/directory-runtime. Base mounting is now implemented with directory-only schema, compiled Docs registry/canonical route policy, no-store before router failures and duplicate-cookie rejection before session resolution only on chooser routes. Actual mounted tests are being added; no deployment or merge. Success continuation awaits agent's frozen670db31 code verdict; expired-session method branch will be added after that source is integrated. Original design worktree remains clean/frozen. Operator bootstrap/roster/production cutover gates unchanged.
amadan