amadan
The RP is an oncarlos.com host, not carloku.com
carloku.com is the console and product brand; apps serve at <app>.<sqid>.<apps-domain>, hosted apps-domain oncarlos.com. Account oficina, sqid bds. Both origins are distinct oncarlos.com hosts under it. Adds ruling 13 and the warning the correction exposed: never widen the RP ID to a registrable suffix. WebAuthn permits a suffix of the origin's hostname, so oncarlos.com would be accepted — and it is shared by every Carloku tenant, which would scope this suite's credentials across other people's apps. The RP ID is the full host, asserted by a test.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01APtNStXDZ5H2fAc1ZuGqtS
1 file changed,
+14
−3
docs/superpowers/specs/2026-08-30-home-design.md+14 −3
No CI script — run details
Intent
diff --git a/docs/superpowers/specs/2026-08-30-home-design.md b/docs/superpowers/specs/2026-08-30-home-design.md| index 0b971dc..751c7cf 100644 |
| --- a/docs/superpowers/specs/2026-08-30-home-design.md |
| +++ b/docs/superpowers/specs/2026-08-30-home-design.md |
| @@ -34,6 +34,7 @@ blind, replaceable* — and `AGENTS.md` opens with this rule verbatim. |
| | # | Ruling | Rejected | Who, when | |
| |---|---|---|---| |
| | 1 | **One RP: the home's credential origin. Instances never enroll passkeys** | Per-instance passkeys (three teams = three credentials) | Paul, 2026-08-30 | |
| +| 13 | **Provisional origins are `oncarlos.com` hosts under account `bds`; the RP ID is always the full host** — §4 | `carloku.com` (the console brand, not the apps domain); a suffix RP ID | Corrected 2026-08-30 | |
| | 2 | **Split origins: credentials and directory on different hostnames** | One origin, mitigated with strict rendering + CSP | This session, 2026-08-30 | |
| | 3 | **Directory is a blind index: `HMAC(pepper, lowercased address)`** | Readable addresses; a sealed per-person vault blob | This session, 2026-08-30 | |
| | 4 | **The home hashes; instances never hold the pepper** | Instances hashing (a suite-wide secret on every instance) | This session, 2026-08-30 | |
| @@ -169,9 +170,19 @@ because it is not the same origin. |
| wanting to render account-authored content on the credential origin is |
| refused, and this sentence is the reason. |
| -**Provisional hostnames (Paul, 2026-08-30):** both origins are carloku.com |
| -subdomains for now, which **schedules** the RP rename drill rather than |
| -avoiding it — §5.5. |
| +**Provisional hostnames (Paul, 2026-08-30; corrected same day).** The |
| +account is `oficina`, sqid **`bds`**. Default addresses are |
| +`<app>.<sqid>.<apps-domain>`, and the hosted apps-domain is |
| +**`oncarlos.com`** — *not* `carloku.com`, which is the console brand |
| +(`console.carloku.com`) and appears nowhere in `platform.md`. Both origins |
| +are therefore distinct `oncarlos.com` hosts under `bds`. Using them now |
| +**schedules** the RP rename drill rather than avoiding it — §5.5. |
| + |
| +**Never widen the RP ID to a registrable suffix.** WebAuthn permits an RP ID |
| +that is a suffix of the origin's hostname, so `oncarlos.com` would be |
| +*accepted* — and it is shared by every Carloku tenant, which would scope our |
| +credentials across other people's apps. **The RP ID is the full host, |
| +always**, and it is asserted by a test rather than remembered. |
| --- |