oficina / memoria Public

Branch worktree-tensorx-provider, opened as the review record before merge, per Paul's rule of 2026-08-30: push and open the branch discussion, then squash-merge. Never merge without the discussion existing first — because the squash flattens the reasoning and this thread is where it survives.

What the branch does

Four things, which grew into each other over two days.

A named model provider. Decision 4 said "one named provider" and never said which. It is now TensorX (decision 13): open weights on EU infrastructure, one contractual counterparty rather than a proxy plus an upstream, verified against a live key. §8.2 pins dated model ids, §8.6 recosts at ~$3/month cheap and ~$26 frontier, and §7.2 records that encoding_format: "base64" is accepted and silently ignored, so ingest is several GB on the wire with no opt-out.

A shape ruling. Decision 14: memoria is a search page, not a chat. It rests on decision 5 rather than decision 3 — a conversational surface could satisfy the authorization invariant, and §12 parks it rather than forbidding it. Paul confirmed both halves.

The suite doctrine, adopted (Appendix A.4). Decisions 1, 3 and 4 become cited suite rulings; decision 11 is superseded by the home's roster and S7 is retired; §6.4's blanket write ban becomes ruling 9's two narrow forms; §8.3 cites suite §8 instead of qualifying Docs §11.2, which is how oficina/docs discussion 33 closed.

Slice 1's client half. internal/memoria/sibling — the S2 client against amadan.net/oficina/suite, with the obligation the module cannot cover: a call that never got a status has nothing for DecodeS2 to decode, and §4.1 says the caller synthesises UNKNOWN.

What went wrong, because that is the part worth keeping

Five review passes, every one REQUEST CHANGES, recorded in §1.7–§1.11. The pattern is one failure in several coats: the writer checks their work against their own model of it rather than against the thing.

• A rule broken in the paragraph that states it, twice (§1.7). §8.2 wrote "a model id that can move under a team cannot be printed on an answer", then picked two undatestamped aliases.
• A product ruling argued from two misread sections of this same spec (§1.8). §8.4 claimed decision 3 forbade a chat; it does not, and the latency argument was false by §6.5's own text.
• A gate its author had already mutation-tested, broken five more ways (§1.9) — including one that served a declared path outside the session gate.
• A rule invented while citing the section that forbade it (§1.10). §4.1's custody intersection was vacuous, did not close the leak, and re-adopted reasoning the doctrine had explicitly retracted.
• And the merge (§1.11): a conflict marker committed into .gitignore with make ci green throughout, because git parses marker lines as patterns; an egress exemption paid by a test that did not exist; "one predicate" untrue of production.

Two live bypasses were found in shipped code by adversarial mutation passes — POST /auth/begin?a;b=1 with an ordinary body defeated the sign-in guard, because ParseForm errors on a query string while rastrillo's FormValue ignores it. A guard that reads a request differently from the thing it guards is not guarding it.

Two findings that leave this repository

The sign-in dial is an unauthenticated SSRF, not an existence leak. keymaildev/signin takes host= from the submitted domain's TXT record with no allowlist, scheme, port or private-range check, and fetches it following redirects — before Authorize runs. Every rastrillo app has it. SECURITY-DRAFT-rastrillo-signin.md is the write-up, deliberately unfiled: rastrillo is public and a public issue would publish the reachability before anyone could patch. Paul's call.

memoria's gates have never run in CI. amadan ci status records nothing for this repo; the runner's -repo list omits memoria, oficina/suite and calendar. Every gate has only ever run when someone typed make ci. A guard written to pass is at least executed.

Not merged with this

AHEAD is adopted as suite doctrine revision 10 and the module has not shipped it, so §4.1's fifth value, gate 6, §8.1's third breaker, §5.2 step 2 and §7.4 are specified and unbuildable. One dependency with one date, waiting on suite CI existing at all.

State

make ci green: vet, fmt-check, test, migration-check. §10 runs 1–33 with no duplicates. Four NEEDS PAUL items in §13: the 12-hour session TTL, §8.7's unit-override switch, the CI runner's repo list, and the SSRF disclosure route.