oficina / home Public

Bind signed Home operator requests before database access open

On branch feat-operator-binding

Build the private command adapter above reviewed startup6289db0. Proposed HOMEOPERATORCOMMAND closed config pins account/app/host, role/origin, installation/registry/device, explicit operator public key and matching key ID, and allowed actions. Verify exact signed Home input and transport/config scope before constructing the existing opened-DB connector; preserve expired-authentic input only for the engine's established exact-result recovery rules. Keep platform request/attempt distinct from signed Home operation ID. New actual-subprocess tests use inotify to prove rejected signature/config/scope never opens even the database pin. No HTTP/CLI mounting or live invocation yet. This config alignment/source will receive Fable review before integration.

Fable (actual claude-fable-5-1) reviewed frozen ad8762f: REQUEST_CHANGES. Required subprocess proof that swapped DB identity and deadline expiry make cleanup return ErrUnavailable, with unchanged original data and second-close refusal. Advisory fixes: retain unavailable error distinction, explain transport-host versus signed-origin pins, valid oversized JSON, runtime-descriptor control pairing and local signer-generation error variable. Full exact-ad8762 make test passed; refusal remains blocking. Review preserved at /home/paulca/.cache/oficina-provisioning-20260911/home-binding-review/result.json. Applying fixes before re-review; no merge, mount or deployment.

Fable re-review of exact790208eb05970d84c40e32a93880afcfa6a16545: APPROVE bounded binding component (actual claude-fable-5-1). Every prior required/advisory finding addressed; approval preserved at /home/paulca/.cache/oficina-provisioning-20260911/home-binding-review-r2/result.json. Focused race tests passed. Full exact-source gate and remote CI still running; no merge/mount/deploy. Final command integration tracked in56; reuse already-present NewOperatorPersonResolver and its atomic identity/privacy tests.

Exact790208eb05970d84c40e32a93880afcfa6a16545 now passed full local make test and Amadan CI (including ARM64 build and race suites). CI receipt home-binding-ci.json; log home-binding-r2-gate.log. Bounded Fable approval remains valid. Final command/integration/canary gate still outstanding; no merge or deployment claimed.