oficina / memoria Public

Raised from oficina/suite, where the sharing doctrine now lives. This asks for changes in your spec, so it is a request rather than a decision.

Filed rather than committed because this repo has three locked worktrees — notion-ingest, search-keyboard-nav, tensorx-provider — and two of the sections below are ones those sessions are plausibly editing. Whoever picks this up should take it on a branch.

What happened

Five app specs each restated the same boundary rules in their own words and the copies drifted. Rather than patch them pairwise, the rules now live once in oficina/suite:docs/superpowers/specs/2026-09-05-suite-sharing-doctrine.md — revision 4, commit 210312f, after three review passes by two models. Three of memoria's own decisions became suite rulings. Docs and Sheets have landed their amendments (suite-amendment on each).

The doctrine's §10 rule is cite, never restate: replace a restatement with a ruling number and a commit, rather than adding a citation beneath a second copy.

What Appendix A.4 asks for

• §1. Decisions 1, 3 and 4 are now suite rulings 1, 3 and 6; cite them. Decision 11 is superseded — admission is the home's roster (suite §5) in suite shape and the owners list in lone shape. S7 is retired, because it existed only for want of a roster of record.
• §1.3. The S3 prose does not match §6.1. S3 takes no person; the fix removed the asker rather than adding one.
• §4.1, the substantive one. Intersect S2's answer with the custody predicate (suite §4.3). The grants join as §4.1 states it — Sheets §4.5's "plus rows granted to me individually" — answers VISIBLE for an item that is not team-visible. A consumer holds ids for items it ingested; when one leaves team-visibility the feed says gone, which §4.2 requires to be indistinguishable from deletion, and an unintersected S2 tells them apart perfectly. That is the leak §6.1 closed on S3 and on the S1 visibility flag, reopened on the third call.

Also type the asker subject (suite §3): {kind, value}, personref in suite shape and a lowercased address in lone shape, so a mismatched pair answers UNKNOWN rather than `NOTVISIBLE`.

And define the source-behind case. STALE covers a source that has moved past the requested revision, but a source restored from backup can be behind it. That is UNKNOWN, withheld loudly — never VISIBLE, which authorises a revision nobody can vouch for, and never NOT_VISIBLE, which is the silent value and the exact mistake STALE was added to fix. Your §13 already records this defect as open.

• §4.3. Replace the body with a citation of suite §5.3 and delete the "at least one sibling says MEMBER" rule, which is what made a guest a member. The admission fixtures need replacing too, not just the prose — they cite a call that no longer exists.
• §6. Move the S1–S6 definitions to the contract module and cite them. The module is built: amadan.net/oficina/suite, types, golden fixtures and a thin client, no dependencies. Replace §6.4's "Any write" with "Any write except suite §7".
• §8.3. Replace the qualification of Docs §11.2 with a citation of suite §8. Docs has landed its side: the rejection stands and its edge is now recorded, as a qualification under ruling 6 rather than a claim about what §11.2 always meant.
• §9.1 and gate 17. These forbid memoria serving any sibling-facing endpoint. Suite §7 requires a receiver to check every source of a derived artefact with its app of record — so a hand-off carrying memoria-owned material has nobody to ask, and must be refused until that surface exists. Either open it with its own decision and leak entry, as your §12 requires, or record that such a hand-off is refused. Not editorial: it decides whether "save this answer as a Doc" works for answers built on memoria's own uploads.
• §11. The person-ref and home dependency on slice 1 looks wrong. Slice 1 runs in lone shape against sibling tokens (suite §3, §12 step 3), so the dependency is on the typed asker subject, not on the home. If that is right, slice 1 is less blocked than it reads.
• §13. Close the blocker "the source apps must adopt decision 1" against Docs' and Sheets' branches when they land.

The part you should push back on

A.4 may cite things that are not on your main. A review of the doctrine found that decisions 13 and 14, gate 26 and §8.4 resolve only in the tensorx-provider worktree at 8dfc3c9, not on main at 5869e73. The doctrine was read against a branch without saying so.

So before adopting: say which baseline is the real one. If those citations belong to unmerged work, the doctrine should cite the commit that carries them, or wait. I would rather this thread produced a corrected citation than a spec pointing at text that is not there. Reply on oficina/suite and the doctrine gets fixed.

What is already true

The contract module exists and is on oficina/suite main: S1, S2 with a total decoder, S3, the typed asker subject, a client that refuses another team's label and never follows a redirect, golden fixtures, and a conformance harness an app points at its own server half. Suite §12 step 3 is memoria slice 1 against that module, with Sheets and Docs serving S1–S3 — and it does not wait on the home.