oficina / home Public

§13 step 2: sign-in, the second factor, and recovery codes

The home can now sign a person in. Seven tasks from
docs/superpowers/plans/2026-09-03-home-signin.md, executed across 23
commits on step2/seal-and-secrets, and six adversarial review rounds.

## What is here

- internal/home/seal: values sealed at rest, ported from sheets-core
  unchanged apart from the HKDF info string, with vectors pinning the
  derivation.
- Four secrets loaded in one place, refusing rather than degrading,
  including all-zero keys — the canonical placeholder, well-formed
  enough to pass every other check.
- The schema: people (person ref, blind index, created_at — no address
  column) and signin_links (sealed address, no redeemed_at, taken by a
  single DELETE ... RETURNING so unknown, expired and already-used are
  one answer by construction).
- The person ref: opaque, minted, never derived from an address.
- Sign-in through keymaildev/signin, with the Keymail upgrade, driven
  end to end against a federation stub.
- The magic link redeemed on POST, never GET: a mail scanner's prefetch
  must not burn it, and an <img src=".../verify?token=…"> must not sign
  a victim into an attacker's account.
- Passkeys as an optional second factor, gated on BOTH sign-in paths,
  with ten single-use recovery codes redeemed by a plain form POST that
  needs no script — because recovery is exactly the moment WebAuthn is
  not working.
- Scriptless screens with ruling 21's carve-out named by template AND by
  src, the RP-ID guard, and the vendored stylesheets.
- Gates 1 and 2, and every gate on this branch watched failing on the
  thing it guards.

## What review caught that would otherwise have shipped

- A boot path that could not have started on the platform at all: it
  required a --db flag that carlos-app@.service never passes.
- The second factor removable from the keymail door by a one-line
  spelling change, because its only guard was a text grep.
- A magic-link expiry predicate with no test that could fail — the
  expired row was deleted by its own PutLink sweep before TakeLink saw
  it.
- A schema guard whose "sealed" exemption let unsealed_address through.
- A scriptless sweep blind to any <script> inside an {{if}} its fixture
  did not satisfy, and to </script > with a space.
- An oracle test that normalised away the difference it was looking for.
- An all-zero key accepted by every check.
- A stolen session cookie able to enrol its own passkey and, with no
  operator reset by design, lock the owner out permanently.
- A freshness window that bounced people to re-authenticate at the exact
  moment they held a passkey and zero recovery codes.

## Two things filed for Paul, not decided here

- §3.1 says the blind index "uses an expensive KDF rather than a bare
  HMAC"; ruling 3 says HMAC, and the code implements the ruling — so
  §3.1 is currently false about the code. Filed as a marked OPEN note in
  the spec with both sides argued.
- Enrolment now requires a fresh session. §5.2 says a passkey is
  "optional per person" and says nothing about how recently you must
  have proved yourself to add one; I took the safer side because the
  failure it prevents is unrecoverable.

## Not deployable yet, and deliberately so

cmd/home refuses to start without HOME_DEK, HOME_PEPPER,
HOME_SIGNIN_KEY, CARLOS_SMTP_PASS and the SMTP host and from address.
None is provisioned. Nothing in .amadan/ci.d deploys on merge, so this
is safe to land; deploying is what needs the secrets first, and the unit
is Restart=always, so deploying without them would 502 the site until a
rollback rather than leaving the old build serving.

Reviewed by Fable (rounds 1-2) and Opus (rounds 3-6, after Fable hit a
session rate limit); mutation testing throughout, which is what found
most of the above. Second opinion from gpt-6-astra via codex on the
step-3 signing decision.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>