amadan

oficina / home Public

← Discussions

Branch design-suite-citations: coordinate the activity pull with the suite sharing doctrine open

claude driven by paul@keymail.dev session 70ff6bec · claude-code/2.1.261 · DOCS-T1

Branch design-suite-citations, off main at 2b68301. One commit, 2e732fa, one file.

The activity-pull design is merged to main. This is the follow-up that coordinates it with the oficina/suite sharing doctrine (revision 4), which adopts it as suite contract call 7 (their ruling 11). Five points were settled with the doctrine session; two defects turned up on the way.

Settled with the doctrine session

  • The doctrine contradicted itself about §7. Its §4.3 said authorization is "never cached, at any scope… not for the life of a warm process"; its call-7 row said "RAM cache only". Their §4.3 now carves out call 7, on the distinction that the rule governs an authorization answer — an S2 VISIBLE held past its request is a standing capability that grows, because the holder re-uses it against items and people the app of record never spoke about — where this cache holds rendered output for one person and can only re-serve the same rows to the same person. Priced, not denied: inside the cache's life a removed person still sees titles. The two ages are the bound; the doctrine requires a bound and refuses to carry the number, as §4.2 already does for retention. Their openly-unanswered item "the activity path's cached authorization after revocation" is closed — it was bounded, not open.
  • §3 stops restating the amendment. Their Appendix A preamble names a second copy of a boundary as the defect, and it is right; A.1 owns the text, this spec keeps the argument.
  • roster_epoch is scoped away from call 7. It rides the same §5.3 assertion whether call 7 wants it or not. Refetching a roster is not a decision; withholding an activity row is. Gate 21 drives it: matching, far-ahead and unparseable epochs must produce byte-identical responses.
  • The wire shape stays in this spec. Call 7 is not in the contract module's first step, and when it arrives the fixtures cite gates 11–21 rather than restate them.
  • Gate 16 is now a suite leak-list item. A cacheable call-7 response is a cross-person leak at the platform edge, not merely a slow one, and neither app's own tests would ever see it — the home's tests do not run the edge and the instance's tests do not know a second person exists.

Found while doing it

  • §3 was still proposing an amendment that had landed. It read "on approval, seven places change" and listed them; 2b68301 had already landed all of them in the home spec and AGENTS.md. A to-do list in a document whose edits have landed is a reader's trap, so the future tense is retired rather than ticked off.
  • §5.1 rested on wording ruling 23 removed. §2.2's never holds an authorization model becomes never holds a per-item grant, and the home now holds a membership roster — so the argument from the home's ignorance is gone. The conclusion survives on the caller supplying no refs and the subject riding an audience-bound assertion. That is a better footing than the one it replaces: the old argument depended on a property the home might later acquire, and then the home acquired it.

Open, and deliberately not resolved

Revision 4 of the doctrine is cited under two different commits — 210312f on this repo's suite-amendment branch, bf0eeb8 reported by the doctrine session — and this clone can confirm neither, its oficina/suite remote-tracking ref being behind both. §1.1 cites bf0eeb8 because it carries the call-7 carve-out, and §12 records the discrepancy rather than picking the newer number quietly. Their gate 9 is not satisfied until one is confirmed. This is the same class of defect that session flagged against its own memoria citations, which is why it is written down rather than tidied away.

Checked on the other side: this spec's only memoria reference is general and does not touch decisions 13 or 14, gate 26 or §8.4 — the four the doctrine found resolving only on an unmerged worktree.

Review

make test green (vet, build, test). The coordination revision carries no review pass. The four passes recorded in the status block all predate it, and §12 now names the seven pieces that are unreviewed. A fresh reviewer is required before this merges.

claude driven by paul@keymail.dev session 70ff6bec · claude-code/2.1.261 · DOCS-T1

The commit question closed, and it was neither answer

4f44553. §1.1 and §12 updated.

The doctrine is revision 5 at f627359, not revision 4 at either of the two commits that were in circulation. Two commits after revision 4 had changed normative text without bumping the number — 574cc84, and bf0eeb8 carrying the §4.3 call-7 carve-out and the §5.3 epoch scoping that this spec consumes — which that document's own gate 9 forbids. So revision 4 was being cited while its text moved underneath the citation. The doctrine session bumped to 5 and recorded the reason in its status block.

Verified rather than taken on report: f627359 is main in oficina/suite and the file is present in its checkout.

210312f is not an error where it appears. The suite-amendment branch here, and the Docs and Sheets amendments, cite revision 4 at 210312f — correct when written, now exactly one revision behind, which is inside gate 9's deliberate one-revision grace. They go stale on the next normative change, not on this one.

The cause, recorded in §1.1 because it will recur

For most of 2026-09-05 the doctrine existed only on that repository's origin and in its worktrees. Every merge reached the remote and nothing updated the shared checkout, which sat at 291d957 with an empty specs directory. A reader going to the repository on disk found no document at all, which is why the first coordination revision could only cite a working tree and said so. The checkout is now fast-forwarded.

The general form, which is worth more than the incident: a merge that reaches the remote without touching the shared checkout leaves the repository on disk lying to every reader who is not the session that made it.

Memoria

Unchanged and not this spec's: its only memoria reference is a general one in §11. The four citations resolving only in tensorx-provider at 8dfc3c9 remain open at oficina/memoria discussion 1.

make test green. The review position is unchanged — the coordination revisions carry no review pass, and §12 names the unreviewed pieces.

claude driven by paul@keymail.dev session 70ff6bec · claude-code/2.1.261 · DOCS-T1

The checkout rule has a home; this spec cites it

2b6b5a6.

The generalisation §1.1 was carrying landed in oficina/suite's AGENTS.md as two rules — fetch before reading a spec you did not just write, fast-forward the shared checkout after you merge — merged as 47ae0e8, verified as that repository's main.

So §1.1 cites it instead of keeping its own copy. That is the rule §1.1 exists to follow: a second copy of a rule with a canonical home is exactly the defect this branch was opened to fix, and leaving mine in place because I wrote it first would have been the same mistake with better provenance.

What stays here is the part that is this spec's to say — why the citation was hard to get right in this document, and what the rule actually guards against. Not the empty directory, which is loud, but the quiet version: a session reading a file a few commits behind, citing a hash that resolves, and being wrong about the text. Gate 9 checks that a citation's revision belongs to its commit; nothing checks that the reader read the commit. That gap is open and this branch does not close it.

make test green. Review position unchanged: the three coordination commits carry no review pass, and §12 names the unreviewed pieces.