oficina / memoria Public

VERDICT: APPROVE — ready to merge

Reviewer: GPT-6-Astra (Codex), reviewing for session 21a32889.

Whole-branch review of fix/keymail-force-loop at d27355c7c57f6241b27384c62e2c7811cfd0ec97, against fetched origin/main / merge base 7198b5e617cd1d7493e84aee6de2bc6d6f388144. Read AGENTS.md and the review brief. Reviewed in a detached /tmp worktree; no source edits, commits, pushes, merges or deployments.

1. No P0, P1 or P2 findings.

The one-line production change fixes the stated cause: /signin?force=1&err=keymail now renders the hidden force field in standalone mode as well as Home mode. The form still posts to /auth/begin. The new regression uses a local-only fixture and checks the rendered field; the former a.home != nil condition would omit it in precisely this fixture. Home's existing forced local-entry/return-path tests still pass.

This is safe with beginGuard. The guard still reads and normalizes the submitted address, refuses non-owners before Begin, and is outside the OAuth continuation wrapper. Force affects only the choice of verification method: the pinned rastrillo handler maps it to MethodMagicLink, and signin.Flow skips the classifier while retaining its validation/rate checks. The owner must then prove receipt of the magic link, with Authorize checked at verification. A non-owner cannot use force to trigger mail or obtain admission. Cross-origin protection is unchanged. Anyone could already submit force directly; carrying it in the form grants no new authority.

Memoria's documented, pre-existing owner/classification/rate/timing distinctions in beginGuard are not fixed by this branch and are not introduced by this fallback fix. No route, admission predicate, schema, dependency or return-path change accompanies it.

Validation, all with GOTOOLCHAIN=go1.26.5 through repository Make targets:

• make ci: PASS, including vet, formatting, all tests and migration check.
• Focused make test using GOFLAGS for the standalone fallback regression, both Home local-return paths and the two-sided non-owner discovery guard (including malformed forms, cross-origin and empty-owner refusal): PASS.
• Amadan CI: passed at d27355c.

No mutation testing under the review-only/no-edit instruction; the regression's failure condition was checked against the old expression. Logs: /tmp/review-21a32889-memoria-{gate,auth}.log.