amadan
Rulings 15, 16 and 17 confirmed
Paul, 2026-08-30. One RP at the home is confirmed, with his note recorded in section 8.1: CARLOS is expected to grow per-instance auth, so this is a staging post rather than a ceiling. The paragraph names what would reopen it — sign-in availability becoming a real complaint, a team needing to authenticate under its own domain for compliance, or CARLOS shipping per-instance auth with an answer to the N-credentials problem. That ruling also shrinks the shared gap rather than leaving it. The cross-origin WebAuthn problem dissolves, because the ceremony finishes at the home before any assertion exists and nothing crosses an origin. What remains is that an instance must verify a signed identity assertion and rastrillo has no helper for it — smaller, still shared with Docs, still to be filed once. Version history replays and recomputes rather than logging derived values, with the slow-restore cost accepted explicitly. And the slice narrowing is confirmed: charts slips first, conditional formatting second, and version history's baseline is restore-a-cell-or-range.
Reviewed-By: Fable (dispatched; see spec status line) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01APtNStXDZ5H2fAc1ZuGqtS
1 file changed,
+29
−10
docs/superpowers/specs/2026-08-30-sheets-design.md+29 −10
Intent
diff --git a/docs/superpowers/specs/2026-08-30-sheets-design.md b/docs/superpowers/specs/2026-08-30-sheets-design.md| index 9655e25..58c868a 100644 |
| --- a/docs/superpowers/specs/2026-08-30-sheets-design.md |
| +++ b/docs/superpowers/specs/2026-08-30-sheets-design.md |
| @@ -46,7 +46,9 @@ value reaching the replicated SQLite file or any object storage we write. |
| | 12 | **Link sharing is viewer-or-commenter, never editor** | Anonymous link editing | Paul, 2026-08-30 | |
| | 13 | **Passkey 2FA optional per person, owner-enforceable per team** | Mandatory; none | Paul, 2026-08-30 | |
| | 14 | **Light/dark is a per-person preference, switchable in the editor** | Per-document; per-team; follow-OS-only | Paul, 2026-08-30 | |
| -| 15 | **One RP: the home's credential origin. Instances never enroll passkeys** — §8.1 | Per-instance passkeys (three teams = three credentials) | This session, 2026-08-30 — **needs Paul's confirmation** | |
| +| 15 | **One RP: the home's credential origin. Instances never enroll passkeys** — §8.1 | Per-instance passkeys (three teams = three credentials) | Proposed by this session, **confirmed by Paul, 2026-08-30** | |
| +| 16 | **Version history replays inputs and recomputes; derived values are never logged** — §4.3 | Logging derived values (instant restore, log grows with fan-out) | Paul, 2026-08-30 | |
| +| 17 | **Slip order written down: charts first, conditional formatting second. Version history's baseline is restore-a-cell-or-range** — §13 | Holding all eleven at full scope; cutting charts outright today | Paul, 2026-08-30 | |
| --- |
| @@ -198,8 +200,11 @@ Two record kinds, because conflating them is what made the leak list wrong: |
| - **Recalc markers** — one row per recalc pass: the triggering event id and |
| the count of derived cells touched. **Not** the derived values. |
| -Derived values are not logged, because logging them makes the log grow with |
| -the *fan-out* of every edit rather than with the number of edits (§4.5). |
| +Derived values are not logged (ruling 16), because logging them makes the |
| +log grow with the *fan-out* of every edit rather than with the number of |
| +edits (§4.5) — in a SQLite file Litestream ships in full, continuously. |
| +**The accepted cost: restoring an old version of a large sheet is a |
| +recalculation, so it needs a progress state rather than being instant.** |
| Restoring a version replays inputs and **recomputes**; that is slower than |
| reading stored values and it is the only version that stays honest at scale. |
| @@ -384,6 +389,19 @@ enroll passkeys and never mount `Gate`. |
| - **`§9.1` call 1 is therefore unambiguous:** the home mints the session, |
| the instance trusts a signed assertion. The first draft left both plausible. |
| +**Forward, and recorded so this is a staging post rather than a ceiling |
| +(Paul, 2026-08-30):** CARLOS is expected to grow support for per-instance |
| +auth. One RP at the home is the right answer for Sheets now, and it is |
| +explicitly *not* a bet against per-instance auth later — it is a bet that we |
| +do not need it yet. |
| + |
| +What would make us revisit: sign-in availability becoming a real complaint |
| +rather than a theoretical one; a team needing to authenticate against its |
| +own instance under its own domain for a compliance reason; or CARLOS |
| +shipping per-instance auth with an answer to the N-credentials problem. Any |
| +of those, and §8.1 is reopened with this paragraph as the reason it was |
| +always going to be. |
| + |
| **Named consequence:** the credential origin is an authority, and a single |
| point of failure for *new* sign-ins. Existing sessions keep working, and |
| §9.1.1's hint ruling covers the directory — but sign-in is deliberately not |
| @@ -800,8 +818,8 @@ waits. |
| 10. Comments |
| 11. **Charts** |
| -**Scope honesty, from the review.** Ruling 5 is Paul's and stands. What it |
| -costs: **three of the eleven items are subsystems, not features** — charts, |
| +**Scope honesty, from the review — narrowing confirmed by Paul, |
| +2026-08-30 (ruling 17).** Ruling 5 stands; what it costs: **three of the eleven items are subsystems, not features** — charts, |
| version history (restore semantics, replay, retention), and conditional |
| formatting (a second expression evaluator plus a rules UI). Naming charts as |
| the sole slip candidate understated the risk. |
| @@ -839,11 +857,12 @@ it is a fallback rather than a scramble. |
| ## 15. Open |
| -- **Ruling 15** (one RP at the home) needs Paul's confirmation — it resolves |
| - a contradiction, and some resolution is required, but the shape is this |
| - session's call. |
| -- **The passkey/assertion gap is one gap with two consumers.** To be |
| - resolved jointly with Docs and filed once, not twice. |
| +- **Assertion verification is the remaining shared gap, and it is smaller |
| + than the one it replaced.** Ruling 15 dissolves the cross-origin WebAuthn |
| + problem — the ceremony finishes at the home before any assertion exists, |
| + so nothing needs handing across origins. What is left is that an instance |
| + must verify a signed identity assertion, and rastrillo has no helper for |
| + it. Docs needs the identical thing. To be settled jointly and filed once. |
| - **Upstream recording** of `rastrillo doctor`, the pair function and |
| allocation (§10.1). Until done, all three are unavailable. |
| - **The platform provisioning credential** — filed as `carlos/platform` #4. |