oficina / home Public

Record native chooser implementation and public rollout prerequisites

Paul Campbell pushed by paul@keymail.dev 1 month ago eab0719de7d0fe727145f90a00f533aa7aeb9374 parent dbccdae

4 files changed, +11 −1

docs/superpowers/specs/2026-08-30-home-design.md +2 −0
implementation/directory-runtime.md +3 −1
implementation/docs-team-chooser.md +4 −0
implementation/team-entry.md +2 −0

CI passed — run details

diff --git a/docs/superpowers/specs/2026-08-30-home-design.md b/docs/superpowers/specs/2026-08-30-home-design.md

index 84c6b5c..268b384 100644

--- a/docs/superpowers/specs/2026-08-30-home-design.md

+++ b/docs/superpowers/specs/2026-08-30-home-design.md

@@ -1122,6 +1122,8 @@ restored is a hope, not a backup* — the restore drill runs before launch.

## 11. Shape and design

+Implementation status, 2026-09-11: the registry contains six integrated native apps (Docs, Sheets, Slides, Calendar, Meet and Memoria), each with the shared scriptless team chooser. All remain provisionable false. The proposed app grid, team switcher and New button below remain unimplemented; the preview launcher is the current directory surface. See implementation/directory-runtime.md for consumer evidence and deployment boundaries.

Ruling24 adds exactly one progressive enhancement: assertion.html may load /static/assertion.js to submit its registered-destination form. The visible Continue button remains usable with scripts off. This extends the earlier passkey-only allowlist without a blanket script exemption. Credential form-action is the process-wide exact consumer manifest; markup injection could post to any registered origin, which is why the credential origin must render no account-authored markup.

rastrillo `server` shape, zero-JS baseline, `day` theme, and the

diff --git a/implementation/directory-runtime.md b/implementation/directory-runtime.md

index f7d9211..f97acd8 100644

--- a/implementation/directory-runtime.md

+++ b/implementation/directory-runtime.md

@@ -10,7 +10,7 @@ Mounting this read path adds no membership, team, owner, consumer, queue request

## Compiled app registry and destination policy

-Introduce a small compiled registry type with slug, display name, integrated and provisionable fields, plus a foreign origin allowed only for unintegrated entries, matching Home spec section11. This slice has one supported entry: Docs, slug docs, integrated true, provisionable false. Integrated means this app has the reviewed assertion consumer; it is not a readiness badge. No new app grid or New action is rendered in this slice, and the other suite apps are not declared ready or replaced by external links. Future registry entries require their actual consumer/provisioning evidence.

+Introduce a small compiled registry type with slug, display name, integrated and provisionable fields, plus a foreign origin allowed only for unintegrated entries, matching Home spec section11. As of 2026-09-11, the registry has six integrated entries: Docs, Sheets, Slides, Calendar, Meet and Memoria. All remain provisionable false. Integrated means the app has a reviewed assertion consumer; it does not assert public release readiness. Each entry uses the shared team chooser and templates. The proposed app grid and New action remain unimplemented. Preview launcher overrides continue to take precedence. Further registry entries require consumer evidence and a separate provisioning decision.

The directory store receives the integrated slug set copied from this registry. Its route validator accepts only an integrated registered app and an exact origin equal to https://<stored-label>.<registered-slug>.oficina.works. The existing store validates the stored label, sqid, consumer ID and canonical HTTPS origin before calling this policy. No request supplies a hostname, foreign URL, URL suffix, app registry entry or policy override. Origin matching uses constructed string equality, not suffix matching. Test lookalike domains, prefix tricks, case, ports, paths, credentials and external origins.

@@ -39,3 +39,5 @@ Use actual LoadRuntime/NewRuntime/App.Handler tests, not only the unmounted choo

Seed synthetic teams only through explicit local test fixtures; test zero/one/two choices, canonical route rejection, disabled/pending instances, membership removal after rendering, duplicate cookies, wrong hosts, wrong methods, extra query/form fields, real missing-Origin/fetch-metadata cases, fixed anonymous return and two independent tabs. Extend existing privacy gates over newly mounted schemas, sealed names and errors. Repeat actual Chromium/WebKit narrow/wide and scripts on/off flows with the shared issuer and canonical synthetic Docs origins, including successful POST continuation and plain fallback; no test-only CSP relaxation.

After full Home gate, actual exact-head CI and independent whole-branch Fable approval, deploy the binary to the existing paired Home previews with original roles, keys, consumers and DB paths unchanged. Verify both API body and edge header. The existing directory will expose the empty chooser until audited team provisioning exists; announce exactly that scope. Live unsigned entry and authenticated empty-state checks must be distinguished; do not fabricate a human session to claim the latter. Obtain canary evidence review before normal Amadan merge. This incremental mount does not complete roster admission, team creation, owner step-up, guest/ex-member app tiles, production gateway cutover or restore acceptance.

+Consumer evidence for this extension: Docs main a8f5c0e; Sheets 6916ac8, Slides 6ed0951, Calendar 6874345, Meet 34fc367 and Memoria 0ee92ed passed TestHome journeys on 2026-09-11. Reviewed preview deployment receipts are in /home/paulca/.cache/oficina-native-home-live/release.json; journey receipts are in /home/paulca/.cache/oficina-rollout-20260911/journey-tests.json. The extension review by Claude Fable 5.1 (claude-fable-5-1) approved source and preview scope at dbccdae. Home discussion53 holds the merge review record. This evidence does not approve public app promotion, enable roster consumers, or supply the missing platform operator dispatch.

diff --git a/implementation/docs-team-chooser.md b/implementation/docs-team-chooser.md

index 29925b6..3d370f3 100644

--- a/implementation/docs-team-chooser.md

+++ b/implementation/docs-team-chooser.md

@@ -13,3 +13,7 @@ The existing Home renderer, layout, Estilo theme assets and Rastrillo attribute

Copy pipeline: gpt-5.6-luna drafted seven strings via the writing-pipeline skill; plain-writing and humane-docs passes made the failure message specific to loading teams rather than falsely declaring Docs down. Artifacts are in ignored writing/docs-chooser. The user waived human copy review for this work. No copy approval was requested or invented.

Tests use the actual directory store/schema, actual Home renderer/session middleware and real shared handoff. They cover empty/one/many destinations, membership removal after rendering, foreign/unknown teams, escaped hostile labels, no script tags, exact fixed return, query/form bounds and duplicates, hostile Origin including the sibling credential origin, email-shaped session subject refusal, no-store and no new cookie, unavailable-store privacy, and constructor credential-role refusal. Existing full Home script/markup/privacy gates apply to the new templates. Two overlay mutations (ignoring the selected sqid, and discarding /apps/docs return) fail the intended tests. No live browser/canary claim is made for unmounted handlers.

+## Native app extension, 2026-09-11

+The same chooser now serves Docs, Sheets, Slides, Calendar, Meet and Memoria at /apps/{app} and /apps/{app}/team. App identifiers, display names and form actions come from the closed compiled registry. Templates remain shared and scriptless. The catalog now offers Meet through its team chooser instead of Coming soon; explicit preview destinations still take precedence. Provisioning remains disabled. See directory-runtime.md for consumer evidence and Home discussion53 for the Fable review.

diff --git a/implementation/team-entry.md b/implementation/team-entry.md

index 4924ead..5ad3fcb 100644

--- a/implementation/team-entry.md

+++ b/implementation/team-entry.md

@@ -26,6 +26,8 @@ The new rastrillo assertion package signs and verifies the opaque person_ref, ex

## Directory and Docs stages

+2026-09-11 implementation extension: the reviewed Docs chooser also serves Sheets, Slides, Calendar, Meet and Memoria through the same membership query, canonical app-origin validation and continuation template. All six remain provisionable false. This adds no public gateway or live team provisioning; the existing-instance, deep-link and credential-preservation conditions below still apply.

The directory owns teams, authoritative memberships and team instance routes. Choose only among the signed-in person's active memberships that have the requested app provisioned; one team redirects automatically, several render a shared Estilo choice page, none render an empty state. Only server-owned origins enter redirect targets. POST choice checks current membership again. Persisting a last choice may change the default, never access.

Call 8 uses a consumer token scoped to one team. A complete roster includes generation and epoch and is paged with epoch-bound cursors. Apps stage all pages and publish one complete roster atomically, including an explicitly complete empty roster. Stale or failed refresh never extends the maximum age. Every request, including an existing session, loses team-standing access when the roster becomes stale; existing individual grants remain their own authority. A restored Home generation requires directory-owner confirmation before consumers trust it. Roster timing and recovery tests precede its deployment.