amadan
Land the correction: classification comes from signin, not from auth
Both §5.1 and AGENTS.md said we would use `rastrillo/auth` for address classification and the Keymail upgrade, "the part that is hard to get right and holds nothing". That is not a thing that can be done. `auth`'s classification is reachable only through `auth.Begin`, and `Begin` writes `auth_links.address TEXT NOT NULL` — precisely what ruling 14 exists to avoid. The sentence described a seam that does not exist. The real seam is one level down: `keymaildev/signin` exports `Flow` with a `LinkStore` the app supplies, so the app seals in `PutLink` and opens in `TakeLink`, and classification, the Keymail round trip and the rate limits all arrive with it. The plan has carried this correction as "filed" for two revisions. AGENTS.md's own opening rule is that a disagreement with the spec is fixed in the same commit, and "filed" is not fixed — so both land here, where the plan that depends on them lands. While in the same sentence: `auth_sessions` is no longer written at v0.22.0, its rows having been migrated into the shared `sessions` table, so the readable address at rest is `auth_links.address` and `sessions.subject`. The leak moved rather than closed, which leaves ruling 14's grounds intact.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2 files changed,
+21
−9
AGENTS.md+12 −7docs/superpowers/specs/2026-08-30-home-design.md+9 −2
diff --git a/AGENTS.md b/AGENTS.md| index d6889bb..dddc792 100644 |
| --- a/AGENTS.md |
| +++ b/AGENTS.md |
| @@ -169,13 +169,18 @@ quietly ignored). |
| any delete. `PRAGMA secure_delete` is on. |
| - **The session Subject is an opaque person ref, never an address.** |
| `rastrillo/auth` as shipped sets `Subject: id.Address` and stores readable |
| - addresses in `auth_links.address` and, via `Subject: id.Address`, |
| - in `sessions.subject` — `auth_sessions` is no longer written at v0.22.0, |
| - its rows having been migrated into the shared `sessions` table, so the |
| - leak moved rather than closed. Verified at source, filed |
| - upstream as `rastrillo/rastrillo` #2. We hand-roll session minting until |
| - that lands, and use `auth` only for address classification and the Keymail |
| - upgrade, which hold nothing. |
| + addresses in `auth_links.address` and, via `Subject: id.Address`, in |
| + `sessions.subject` — `auth_sessions` is no longer written at v0.22.0, its |
| + rows having been migrated into the shared `sessions` table, so the leak |
| + moved rather than closed. Verified at source, filed upstream as |
| + `rastrillo/rastrillo` #2. We hand-roll session minting until that lands, |
| + and take classification and the Keymail upgrade from **`keymaildev/signin` |
| + directly, not from `auth`** — corrected 2026-09-05: `auth`'s |
| + classification is reachable only through `auth.Begin`, which hardwires |
| + `Links: &linkStore{db: cfg.DB}` and writes `auth_links.address`, so "use |
| + `auth` only for the parts that hold nothing" was never a thing that could |
| + be done. `signin.Flow` takes a `LinkStore` the app supplies, so the app |
| + seals what it stores. |
| - **The home hashes; instances never hold the pepper.** A pepper on every |
| instance makes one compromise an offline dictionary attack against the |
| whole suite directory. |
diff --git a/docs/superpowers/specs/2026-08-30-home-design.md b/docs/superpowers/specs/2026-08-30-home-design.md| index d254bc7..c03991c 100644 |
| --- a/docs/superpowers/specs/2026-08-30-home-design.md |
| +++ b/docs/superpowers/specs/2026-08-30-home-design.md |
| @@ -316,8 +316,15 @@ a guarantee into a comment. |
| rest — sealed, enumerated in §3.2, never readable. |
| - **`PRAGMA secure_delete`**, because deleting a row does not remove bytes |
| from a file that is continuously replicated. |
| -- We still use `rastrillo/auth` for **address classification and Keymail |
| - upgrade** — the part that is hard to get right and holds nothing. |
| +- We use **`keymaildev/signin` directly** for classification and the Keymail |
| + upgrade — the part that is hard to get right and holds nothing. |
| + **Corrected 2026-09-05:** an earlier draft said `rastrillo/auth`, which |
| + cannot serve that purpose. Its classification is reachable only through |
| + `auth.Begin`, and `Begin` writes `auth_links.address TEXT NOT NULL` — the |
| + very thing ruling 14 exists to avoid. The seam is one level down: |
| + `signin.Flow` takes a `LinkStore` the app supplies, so the app seals in |
| + `PutLink` and opens in `TakeLink`, and classification, the Keymail round |
| + trip and the rate limits all come with it. |
| **Filed upstream as `rastrillo/rastrillo` #2**: a `Config.Subject` hook, a |
| sealed link store, and written `secure_delete`/WAL guidance. Every |