oficina / memoria Public

Pushed a9814d6: existing-address Home links, sealed AUTOINCREMENT local identity, row-purpose/HMAC binding, current owner admission and suite.SubjectAddress preserved. Full make ci passed. Cumulative Fable approved Home-off/roster-off with dormant source findings; H2 LookupPerson refusal/storage distinction fixed and separately approved. H1 stale cookie fixed using framework Middleware; tests preserve cookies on transient DB failure and clear only absent/expired sessions before redirect. Explicit Home-on/roster-off activation review underway. Final shared recovery/Estilo pin and CI pending. No deployment. Release must explicitly override MEMORIA_SIBLINGS empty and must not configure/invoke connectors.

Roster activation blockers from cumulative Fable: S1 revision-zero row wedges polling; S2 strict URL origin validation missing; S3 reserved names upload/paste/notion can collide with owned source fingerprints and remote gone deletes owned content; S4 corrupt sibling item fails all ranked searches instead of withholding hit; S5 empty new revision body leaves stale content/refetch loop; S6 source/connector breaker rendering lacks actual route regression; S8 suite required-field decoder pin must precede revision-zero acceptance. These are dormant with explicit MEMORIA_SIBLINGS empty; do not enable roster during Home rollout. Keep existing connector data untouched. Full reviewer receipt retained in session cache memoria-review/review.json.

Final independent Claude Fable5.1 activation review APPROVES Home ON with sibling roster OFF after H1/H2 fixes, based on cumulative and follow-up receipts. Candidate a9814d6 remote CI already successful. Remaining activation conditions: final shared bridge gate/CI/merge and any recovery/Estilo repin, exact final appCI, real edgeHost unsigned /signin -> /auth/start canary; explicitly empty MEMORIASIBLINGS and MEMORIATEAM. No sibling or new connector activation. Source and UI checks are synthetic and no live account was injected.

Exact final adoption 0ee92ed71fb750c98196f65c2b2d9764dd746bcc. Source archive bound byte-for-byte by root. Mandatory local gate and exact CI terminal success; release build complete. Preview activation will preserve app-local content keys and require live canonical-origin/version/browser checks. Fable final review:

Verdict: APPROVE all five (Calendar 6874345, Slides 6ed0951, Memoria 0ee92ed, Meet 34fc367, Sheets-core 6916ac8). Reviewer: Claude Fable 5.1 (claude-fable-5-1), read-only, 2026-09-10. No files written, no commands run.

What each delta contains

Every branch.diff is confined to go.mod, go.sum, and the private-module build configuration. No Go source, template, migration, CSS, or route changed in any app. Base vs source was cross-checked through the diffs plus the CI logs on the exact binding.json SHAs.

| App | connect | estilo | GOPRIVATE | Extra | |---|---|---|---|---| | Calendar | 868f189 → 5b8d841 | new indirect dec3908 | Makefile | none | | Slides | 868f189 → 5b8d841 | new indirect dec3908 | Makefile + 10-gate | none | | Memoria | 868f189 → 5b8d841 | new indirect dec3908 | Makefile | stale go.sum rows dropped | | Meet | 868f189 → 5b8d841 | new indirect dec3908 | Makefile | connect/handoff moved indirect → direct | | Sheets-core | 868f189 → 5b8d841 | 672a447 → dec3908 direct | already present | none |

All five pin identical h1 hashes for connect 5b8d841 and estilo dec3908, matching the module cache and the approved shared-library review.

Contract compatibility, verified against the module cache

• Line-count fingerprint of connect 868f189 vs 5b8d841 shows only view.go, oauth.go, go.mod, go.sum, routes_test.go and the two deleted templates differ. bridge.go, routes.go, config.go, api.go, link_handlers.go, navigation*.go and linkstore/ are unchanged. No security or session logic moved.
• connect.PageData and connect.OAuthData are now type aliases to Estilo's homeconnect structs with identical field sets. Memoria's home_render.go field of type connect.PageData compiles unchanged.
• connect.Templates() now forwards Estilo's embed FS, which still contains templates/home_link.html and templates/oauth.html. Calendar, Slides, Memoria and Meet parse templates/home_link.html; Sheets parses templates/*.html. Both patterns resolve.
• No duplicate or omitted definitions. Grep across all five source/ trees finds no local define "home-connect", home-oauth-head or home-oauth. Each app references them exactly once from its own wrapper template. The home-oauth* definitions are only parsed and only used by Sheets.
• Meet's move of connect and handoff from // indirect to direct is a go mod tidy correction. Meet's base source already imported connect directly.

Behavioural change inherited from the library, and why it is safe

The failed page action moved from /account/home to /signin/local. All five apps mount GET /signin/local (Calendar routes.go:40, Slides app.go:71, Memoria app.go:79, Meet app.go:220, Sheets home_routes.go:11), so the link resolves. The template also adds <bdi> around the address and rst-btn="ghost" on the Back link. Rastrillo v0.23.0 ships the ghost twin, per the Estilo review. Purely presentational.

Build configuration

Calendar, Memoria and Meet CI steps exec make <target>, so the Makefile export covers them. Slides' 10-gate is a bash script that also runs make ci, so its own export is needed and present. Sheets already carried the comma-safe form. Every CI log shows go: downloading amadan.net/oficina/estilo.git ...dec3908b237c succeeding, which settles the private-fetch infrastructure question left open by the connect review.

Gate evidence

All five *-ci-final.json files are state: success on the exact binding.json SHAs with vet, fmt, test and migration check green. Sheets adds build and race; Slides adds the full Rust, wasm and Node gate. Memoria's sibling package passed, and LoadSiblings still returns an empty roster on empty MEMORIA_SIBLINGS without requiring MEMORIA_TEAM. No connector or sync code is in the delta.

Low, non-blocking

1. export GOPRIVATE := $(GOPRIVATE),amadan.net/oficina/estilo.git yields a leading comma when the ambient value is empty. Go ignores empty patterns. Sheets' $(if ...)$(comma) form is cleaner; align in a follow-up.
2. Calendar's go.mod puts the estilo require in a third require block. Cosmetic tidy output.
3. Memoria's go.sum drops golang.org/x/net and x/term rows. CI's readonly module mode passed, so nothing needed them.

Bounded config concerns

None of the preview configuration is in these deltas. Origins, consumer IDs, issuer, DEK, allowlists, env and channel are runtime values. The following remain operator-side gates before runtime merge, unchanged by this review:

• Routes.Middleware 404s any Host that is not the configured origin, so each https://overnight-APP.bds.oncarlos.com origin must match the served hostname exactly. Verify with an unsigned GET /signin returning 303, not /healthz.
• Each app needs its full *_HOME_* set including a dedicated stable DEK; a partial set refuses boot. Existing instance and content keys are untouched by this delta.
• Memoria: MEMORIA_SIBLINGS and MEMORIA_TEAM both empty.
• Slides: any preview database that booted the earlier home_connect ledger namespace must be discarded, per the Slides final verdict.
• Refresh the synthetic UI check on these exact dependencies and run live canary checks on Sheets canary/overnight-batch, Calendar canary/overnight-recurrence, and the new Slides, Meet and Memoria canary/overnight-home before enabling any Home launch link.

Preview deployed and verified: https://overnight-memoria.bds.oncarlos.com/signin . Exact source 0ee92ed71fb750c98196f65c2b2d9764dd746bcc; process /api/version and X-Carlos-Version both 0ee92ed. Exact CI and mandatory local gate passed, Fable final adoption review APPROVE. Eight synthetic rendered account-link browser checks plus four live Chromium/WebKit JS on/off redirects passed, exact consumer memoria-overnight and credential origin verified. Home preview launcher destination enabled. No human credentials or mail used for tests; user completes explicit dual-proof local account connection. Existing local content identities preserved. MEMORIASIBLINGS and MEMORIATEAM explicitly empty; roster activation remains blocked by task5.

Source merged through Amadan as 270e55053203297492395133cc023c01d333fd81 after canary verification. Root verified identical git trees to reviewed/deployed0ee92ed71fb750c98196f65c2b2d9764dd746bcc. Roster remains disabled; task5 still open.