oficina / home Public

Read-only prerequisite audit for the first two isolated Docs team previews (2026-09-08). No implementation, config or deployment change made.

Fresh source: platform origin/main dcf0cad333405aa8990af62c0871bd6ef63d96ba; platform-infrastructure origin/main259913017c2aeb99554e2c1384c2117d279f6e2a; Home deployed/runtime171f49a90b39a2c9138bd077d7d8adcc4040fd89; Docs freshly fetched main5fe0447ff896d9cc9083b326642bfac549ce524d. Platform main is unchanged from the fa64e28 follow-up audit. Platform117 is still open, explicitly appears in the unclaimed list, and has only its original coordinator follow-up. Current open PRs and branch/worktree names show no matching maintenance/drain implementation. That is evidence of no recorded competing implementation, not permission to overwrite another owner's work.

What already exists:

• Home171 mounts the canonical membership-derived Docs chooser. Its current production route policy accepts exactly https://<stored-label>.docs.oficina.works (directoryruntime.go:20). It preserves the existing directory DB, keys, identities and sessions; it supplies no team/owner write API. directorydata/store.go:73 provides sealed-name preparation only, explicitly inside a caller-owned transaction. Current additive schema contains teams, memberships and teaminstances; it lacks operator receipts, authenticated roster consumers and restore-generation authority.
• Platform instances create supports separate host/channel/environment bindings (instancescli.go:182-218,262-291; console/apiinstances.go:579,708). Signed-in instances enable pins the account platform subdomain (instancescli.go:60-65); use supported domain attachment for canonical team aliases, not store-mode domain changes or a permissive Home origin policy (domains_cli.go:23-50; console/apidomains.go:107-117). Alias issuance must actually materialize and pass TLS/exact-origin checks; an accepted claim alone is not verification.
• Docs5fe0447 accepts Home SSO only for an existing explicit Home/local account link (home_exchange.go:223-235). A new empty instance is not automatically usable by a Home-only principal. The pilot can use real local synthetic-account sign-in plus the reviewed explicit link flow in each fresh instance. Do not substitute a fabricated address or a first-visitor team owner. Docs -seed is sample-document seeding, not a Home owner/roster bootstrap command (cmd/docs/main.go:295-318). Roster producer/client/admission remains a separate missing Stage C capability.

Two distinct implementation gaps:

1. PLATFORM TRANSPORT: discussion117's durable, owner-authorized/fresh-auth, exact-host existing-DB maintenance operation is not implemented. Restart does not provide exclusion against subsequent wake. First-boot Seed only runs when neither local DB nor replica exists; it is app-manifest-wide and cannot populate the existing Home DB (activator/activator.go:769-780; backend_exec.go:306-328). Preserve the deployed Home DBs, keys and principals rather than recreating them to trigger seed.
2. HOME OPERATOR AUTHORITY: fa64e28 implementation/team-directory.md section Bootstrap requires a credential-side private address-to-existing-person resolution and separately purposed, short-lived authenticated owner seed receipt; directory verification consumes that receipt and atomically reserves team identity, seals its name, seeds the first owner and writes an operation receipt. Repeated operation IDs return the original result; changed payload under the same ID refuses. A sibling-app operation cannot create membership. A separate audited instance-live transition requires verified exact credential consumer registration and deployment/origin evidence. None of these app verbs exists merely because the platform can execute a command. Browser assertions are never owner bootstrap authority. The pepper stays in the credential process; the directory receives only the authenticated opaque person reference.

Smallest supported sequence to preserve the existing installation: A. Design and implement the Home operator package locally now, behind explicit non-serving entry points and immutable operation inputs. Start with existing authenticated synthetic identities for the pilot; no ordinary startup mutations, fixture web route, raw SQL transport or session impersonation. Define reserved-label/sqid allocation, receipt purpose/key lifecycle, strict size/expiry/action/team/directory binding, atomic replay/conflict semantics and failure privacy. Give the transport a bounded private input/result contract; an authority-bearing seed receipt must not be printed into public platform command logs or receipts. The offline package can be proved against disposable DBs before the transport exists. B. In parallel, root should claim/coordinate platform117 and draft its isolated transport design. Platform AGENTS explicitly says a missing API/CLI verb is a product gap to plan/build, so this is feasible work under the user's goal, not an external impasse. Existing instance-move code offers reusable patterns: CAS record transitions, status-based traffic exclusion, RetireExcept, Quiesced and checked checkpoint (host/movespass.go:26-42,267-300; activator/activator.go:1152-1210). Do not invoke move/cut as maintenance: its later steps purge local data and change region. A dedicated fence must survive restart/failover and exclude HTTP, scheduled work, competing maintenance and deployment/adoption races while retaining the database lease for the bounded exact executable operation. It must refuse missing DB, unknown operation/version/class/capability and any request that widens host/account/app. Failure or ambiguous completion remains fenced. Resume is a separate authorized, version/key/DB-identity-checked transition with durable receipts. Do not inherit instanceGate's app-token/member authority as sufficient for maintenance. An initial platform-managed hibernating-exec-instance scope may be the smallest reviewable cut, with unsupported unit/addr/fleet classes explicitly refused. Root's supported restart receipts identify hosts/environments and report asleep; they do not establish every execution/replication safety fact. Confirm exact route class, DB ownership and lease behavior in supported preflight before promising this scope covers both Home roles. The platform change needs current specs, owner coordination, Fable design/whole-code review, isolated CLI credentials, normal full CI and the required GitHub PR plus Amadan gate workflow. No box-shell or raw-SQL shortcut is part of this option. C. Once A and B are reviewed and verified, reserve two operator-approved synthetic labels; seed first owners through authenticated receipts into the existing directory. Create two distinct Docs instance records with distinct DBs and per-instance config/keys. Attach canonical owned aliases, register both exact canonical origins under distinct consumer IDs in the existing credential manifest without replacing existing registrations or keys, set each Docs origin/issuer/public keys/dedicated DEK, and verify body+edge version. Mark pending instances live only through the audited operator transition. Complete each existing-local-account link with actual synthetic authentication. This proves navigation and isolation; it does not complete roster-based admission/removal or production gateway cutover.

Alternatives: an all-new synthetic directory first-boot seed would need a separate review and would not satisfy preserving this existing directory's data. An online operator endpoint would need a new reviewed authority/transport design; it is not an available shortcut. Keep the production bare Docs alias and old document links unchanged until their separate compatibility plan is approved. The next useful bounded app slice is the local Home operator receipt/transaction design, while root owns the platform117 transport design and owner claim.

Sources and read-only artifacts: approved Home fa64e286990762aecc6913bb9076a3cb75b088c3 implementation/team-directory.md; Home spec rulings7/8/23 and sections7/14 (current lines789-800,1084-1095); platform AGENTS API/CLI and review rules; fetched instance-provisioning, route-scoped-config and sqlite-corruption specs; current instance-move spec. Immutable source snapshots, current PR/unclaimed listings and this note are under /tmp/oficina-team-provision-audit. No live environment values or secrets were read or changed.