oficina / sheets Public

This branch carries the Sheets design spec. Per AGENTS.md, this discussion is the branch's review record — the discussion survives a squash where a PR body does not.

Review passes

Pass 1 — dispatched to Fable, 2026-08-30. Verdict: not ready to approve, 13 confirmed findings, 4 suspected.

Three were migrations-if-found-later rather than edits:

1. Formula references don't survive copy, fill, cut or sort. §4.2 had claimed stable row/column ids removed the reference-rewriting pass. Relative references are positional offsets, so =A1 copied from B1 to B2 must become =A2 — the pass was moved, not removed, and the draft claimed four dependent features when only three held. §4.2 now specifies behaviour per operation.
2. The passkey story contradicted itself. §8 put the second factor on the instance; ruling 11 put the RP on the home. Verified at source: passkey.New takes RPID from Config.Origin, the app's own origin — so a person in three teams would enroll three passkeys, the exact problem decisions.md says to solve on day one. Resolved as ruling 15, confirmed by Paul.
3. The event log's payloads were in neither leak list, and version history is unimplementable unless they carry old cell values. §4.3 now splits input events from recalc markers.

Two findings were this session's own errors, both verified against source before acting:

• AGENTS.md mandated the rastrillo attribute grammar. The shipped ui/tokens.css has zero attribute selectors against 382 class selectors, and the migration is ruled-but-not-started — so the app would have rendered unstyled.
• scope.Owned is literally Where("user_id = ?"). Our rows are team-shared, so it would have returned only the creator's rows — failing as a plausible empty list rather than an error.

Cross-session verification. Three source claims re-verified by this session, three more by the Docs session (docs-e6) reviewing §9 as a declared consumer. That review found four further gaps — the home going down being unspecified, re-keying having no procedure, guest grants disclosing the team name, and directory rows needing a member/guest discriminator — all folded in.

Notable outcomes

• LegacyRPID already exists in rastrillo, so the RP rename drill is set-a-field-and-size-the-window rather than the multi-phase invention §9.5 described.
• The pepper moved off instances. Call 2 had each instance computing the HMAC, so every instance held a suite-wide secret — one compromise would have exposed the whole directory, inverting factor VIII. The home now hashes.
• Ruling 15 dissolved the gap it created. With the ceremony completing at the home before any assertion exists, the cross-origin WebAuthn problem disappears; what remains is a smaller ask, filed jointly with Docs.

Outstanding

• The assertion-verification filing is drafted in Appendix A and awaiting a rastrillo namespace grant to post.
• Upstream recording of rastrillo doctor, the OKLCH pair function and colour allocation — until done, all three are treated as unavailable and the §10.3 shim stands.

17 settled rulings, each dated, attributed, and recorded beside the alternative it beat.