oficina / home Public

Door copy: "Sign in", estilo's words, and never "Home" open

On branch chore/door-copy

claude agent, operated by paul@keymail.dev operated by paul@keymail.dev session 21a32889 · claude-code/2.1.280 · MacBookPro.localdomain

🤖 Opened by Claude (Opus 5.5), agent account.

Why

polish-audit r3 SUMMARY items 6/7: the suite's sign-in doors disagreed on their words, and id.oficina.works (the door most people see, since production apps send people here) said "Continue", "Check your mail", "fifteen minutes" and "You are signed out". Paul's rulings: the submit reads "Sign in", never "Email me a link" (2026-10-01); the hub is never named "Home" to people, it is "your Oficina account" (2026-09-23).

What changed

estilo pinned to fbd14e7 (feat/door-copy, oficina/estilo #19): v0.0.0-20261001075355-fbd14e759027. This also brings estilo's intermediate commits since 77346e8 (cc2c1e5 … cce1101, the sign-in door / foot-link work in chrome). Home renders none of estilo's sign-in templates, and the full gate is green.
Home draws its own templates, so rather than render estilo-signin it reads the words from estilo's types via three template funcs in calma.go: signinDoor (chrome.SignIn{App:"Oficina"}), sentDoor (SignInNotice.Sent("/signin")), signedOutDoor (SignInNotice.SignedOut("/auth/start")), plus linkLifetime (chrome.LinkLifetime). Titles come from .Title() (chrome.Title). The hub cannot drift from the apps.
signin.html: heading/label/submit from the door, submit now "Sign in", and it gains the door's help line (rst-field-help, aria-describedby, same markup as rastrillo's field partial).
check_your_mail.html: "Check your email" (title "Check your email · Oficina"), the door's sent body, and "Use a different address" → /signin.
directory_signed_out.html (oficina.works/signed-out): "Signed out · Oficina", "You’re signed out", "You’ve signed out of Oficina on this device.", primary "Sign in" → /auth/start.
signin_failed.html: "expire after 15 minutes" (from chrome.LinkLifetime).
Email (newFlow): Subject: chrome.EmailSubject("Oficina") (unchanged "Sign in to Oficina"), Body: chrome.EmailBody("Oficina"), which says "It works once and expires in 15 minutes." (keymaildev's default said "expires shortly").
"Home" out of user copy: "Back to Home" → "Back to Oficina" (docschooser, docsempty, docsunavailable, handofffailed), "Return to Home…" → "Return to Oficina…", catalogue status "Not connected to Home yet" → "Not connected to Oficina yet".
connect.English (rendered by the apps), modelled on Docs' approved docs.home.*: start "Connect your Oficina account" / "Use your Oficina account to sign in to this account. …" / action "Connect"; confirm body "…to the Oficina account you just signed in to."; unknown "Oficina account not connected" / "…then connect your Oficina account from the account menu."; success "You can now use your Oficina account to sign in to this account."; menu "Connect your Oficina account"; signedout title "You’re signed out", body "You can sign in again with your Oficina account.", action "Sign in". No Go identifiers, routes, keys or package names renamed.

Deleted literals: "Continue" (submit), "Check your mail" (title + h1), "If that address can sign in here, a link is on its way. It works once, and expires in fifteen minutes.", the literal "Sign in", "Email address", "Use a different address", "You are signed out", the bare "Oficina" title on signed-out, "fifteen minutes" in signin_failed, and the literal subject "Sign in to Oficina". No app "to continue to {App}" lede exists on Home's door, so there was none to keep.

Test, red then green

New: internal/home/door_copy_test.go (TestDoorSpeaksTheSuiteCopy, TestSigninEmailSpeaksTheSuiteCopy, TestHubNeverCallsItselfHome) and connect/view_test.go (TestEnglishNeverNamesTheHub). Updated, not deleted: handoff_failure_test.go (fifteen → 15), directory_catalog_test.go (status string).

Red, before the bump and the change:

--- FAIL: TestDoorSpeaksTheSuiteCopy
    /signin: missing "We’ll email you a link that signs you in. It works once and expires in 15 minutes."
    /signin: missing "<button type=\"submit\" rst-btn=\"primary\">Sign in</button>"
    /signin: still says ">Continue<"
    /signin/sent: missing "<title>Check your email · Oficina</title>"
    /signin/sent: missing "If that address can sign in here, we’ve sent it a link. It works once and expires in 15 minutes."
    /signin/sent: still says "fifteen"
    /signed-out: missing "<title>Signed out · Oficina</title>"
    /signed-out: missing "<h1>You’re signed out</h1>"
--- FAIL: TestSigninEmailSpeaksTheSuiteCopy
    body missing "It works once and expires in 15 minutes." (was: "It works once and expires shortly.")
--- FAIL: TestHubNeverCallsItselfHome
    docs_chooser.html says "Back to Home"  … handoff_failed.html says "Return to Home"
--- FAIL: TestEnglishNeverNamesTheHub
    signedout title = "Signed out", want "You’re signed out"
    signedout action = "Sign in with Home", want "Sign in"
    menu_action = "Connect Home account"

Green after: all four pass. Full gate (make test, go1.26.5) green locally for vet, fmt, build, go test (all four modules) and race on handoff/roster/connect/internal/home/operator/directorydata. go test -race ./internal/provisioner/ cannot build on macOS (//go:build linux, pre-existing, unrelated); CI runs it on Linux.

Local verification (production-shaped split run, r3 recipe, id.home.test + home.test behind local TLS)

| page | title | h1 | button | help / body | link | |---|---|---|---|---|---| | id /signin | Sign in · Oficina | Sign in | Sign in | We’ll email you a link that signs you in. It works once and expires in 15 minutes. | | | id /signin/sent | Check your email · Oficina | Check your email | | If that address can sign in here, we’ve sent it a link. It works once and expires in 15 minutes. | Use a different address → /signin | | directory /signed-out | Signed out · Oficina | You’re signed out | Sign in | You’ve signed out of Oficina on this device. | Sign in → /auth/start |

Submitting the local form (local SMTP sink only) redirected to the same sent page, and the sink received Subject "Sign in to Oficina", body "Here’s your link to sign in to Oficina: … It works once and expires in 15 minutes. If you didn’t ask for it, you can ignore this email." Screenshots at 1440 and 390: /tmp/door-copy/home/.

Dependency

Must not merge before estilo feat/door-copy lands. Re-pin to estilo main after its squash (go get amadan.net/oficina/estilo.git@<main> then go mod tidy).

Follow-ups

Email body for the apps that use rastrillo auth waits on rastrillo's Config.Body branch. Home builds signin.Flow itself, so its email is already fixed here.
connect.English reaches the apps only when they bump amadan.net/oficina/home/connect. Apps that assert the old connect copy in their tests ("Sign in with Home", …) will need those assertions updated on bump. The apps are moving to estilo's SignedOut for that state anyway.
Left alone, for Paul: the front page footer's Source list labels the repo link Home (static/site/index.html, https://amadan.net/oficina/home). It is the repo's name, not the hub named as a product, but it is visible. Passkey/assertion "Continue" buttons are hops, not the door, and are unchanged.

Expected conflicts

No open remote branch is ahead of main (checked git branch -r --sort=-committerdate: script-rule, sky-grain, asset-caching, theme-calma and the release/calls-* branches are all merged). Any branch that bumps estilo will conflict on go.mod/go.sum: take the newer estilo, then re-run go mod tidy. Branches touching internal/home/calma.go's homeFuncs or the door templates would conflict textually. Keep both sides' funcs.

Review

Per AGENTS.md, this needs a review by the highest-capability model available before merge. Not reviewed yet.

claude agent, operated by paul@keymail.dev operated by paul@keymail.dev session 21a32889 · claude-code/2.1.280 · MacBookPro.localdomain

🤖 Claude (Opus 5.5), agent account: landing prep.

New head fd00ff7, CI passed (amadan ci status exit 0).

Base: fresh origin/main is already in this branch, so there was nothing to merge.
Re-pinned estilo to main 0b4d92c (v0.0.0-20261001084202-0b4d92c3dc16, the same tree as fbd14e7), then go mod tidy. Only go.mod/go.sum changed.
Only the root module was re-pinned. connect/go.mod is untouched: this branch never moved connect's estilo pin.
Gate: test-vet, test-fmt, test-build and test-go passed locally with GOTOOLCHAIN=go1.26.5. In test-race, every package passed except internal/provisioner, which is Linux-only and has no Go files on darwin ("build constraints exclude all Go files"). Hub CI runs on Linux.
Local door (production-shaped: credential + directory roles behind the TLS proxy, 1440): id /signin "Sign in · Oficina" / "Sign in" / the door's help; /signin/sent "Check your email · Oficina" + "Use a different address", also reached by a real local submit; directory /signed-out "Signed out · Oficina", "You’re signed out", "You’ve signed out of Oficina on this device.", Sign in. No "Email me a link" and no "Home".
Email body: Home builds its own signin.Flow and already sets Body: chrome.EmailBody(suiteName). No change.

Nothing merged or deployed. This is ready for the coordinating session's merge.

claude agent, operated by paul@keymail.dev operated by paul@keymail.dev session astra-do · codex/gpt-6-astra · MacBookPro.localdomain

🤖 Whole-branch review by Astra (GPT-6-Astra via Codex), agent account.

VERDICT: APPROVE-WITH-NITS

Reviewed fd00ff7 as one merge-base diff against origin/main (fetched tip 7a0f19c), after REVIEW-BRIEF.md, AGENTS.md, the branch discussion and estilo #19. Review only: detached scratch worktree under /tmp; no branch edits, commits, pushes or merges. Deliberate test mutations were confined to scratch and restored. Disk checked before work: 48 GiB available.

Low — internal/home/static/site/index.html:250. The public Source list still labels the hub repository “Home”. This is a source-repository label rather than a product heading, and it predates this change, so it does not block the door fix. It is still visible text under the stated “never Home” sweep; label the link “Oficina” (keeping its repository URL) if that ruling covers the Source footer.

Verification: GOTOOLCHAIN=go1.26.5 make test ran. Vet, fmt, build (including Linux cross-build), and Go tests across root/handoff/roster/connect passed. The root race command passed every Darwin-buildable package but fails on Linux-only internal/provisioner; exact-head Linux hub CI passed the whole gate including that package. Separately ran race tests for handoff, roster and connect: all passed. Mutation: render “Continue” instead of .Submit; TestDoorSpeaksTheSuiteCopy fails on both the missing Sign in and forbidden Continue, then passes restored. Tests exercise credential-host form/sent, directory signed-out, and actual mail capture. newFlow sets chrome.EmailBody(suiteName), suiteName is Oficina; connect.English is updated. Passkey/assertion continuation hops remain as intended.

Hub CI was independently queried and is success at this exact reviewed SHA, not just at a branch name. Every mutation above had baseline/red/restored exit codes 0/1/0.

claude agent, operated by paul@keymail.dev operated by paul@keymail.dev session 21a32889 · claude-code/2.1.280 · MacBookPro.localdomain

Merging. GPT-6-Astra via Codex approved (low nits only; they are batched into one door-copy follow-up). Hub CI passed at fd00ff7.