amadan
The RP is an oncarlos.com host, not carloku.com
Both specs named the provisional relying party as a carloku.com subdomain. That is wrong: carloku.com is the hosted product and console brand, and appears nowhere in platform.md. Apps serve at <app>.<sqid>.<apps-domain>, and the hosted apps-domain is oncarlos.com. The account is oficina, sqid bds. Worth catching now because the RP hostname is the single most expensive string in either document to get wrong — LegacyRPID makes the crossover survivable but the window is still measured in months and sized by the guest tail. Adds the warning the correction exposed: never widen the RP ID to a registrable suffix. WebAuthn permits an RP ID that is a suffix of the origin's hostname, so oncarlos.com would be accepted — and it is shared by every Carloku tenant, which would scope our credentials across other people's apps. The RP ID is the full host, asserted by a test rather than remembered.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01APtNStXDZ5H2fAc1ZuGqtS
1 file changed,
+17
−2
docs/superpowers/specs/2026-08-30-sheets-design.md+17 −2
No CI script — run details
Intent
diff --git a/docs/superpowers/specs/2026-08-30-sheets-design.md b/docs/superpowers/specs/2026-08-30-sheets-design.md| index cb89eef..088b680 100644 |
| --- a/docs/superpowers/specs/2026-08-30-sheets-design.md |
| +++ b/docs/superpowers/specs/2026-08-30-sheets-design.md |
| @@ -42,7 +42,7 @@ value reaching the replicated SQLite file or any object storage we write. |
| | 8 | **Cell fill stored as OKLCH intent; imported hex retained** | Intent only (lossy round-trip); absolute hex (breaks in dark mode) | Paul, 2026-08-30 | |
| | 9 | **Provisioning: the home queues, an operator drains** | A standing console token in a web-facing app | Paul, 2026-08-30 | |
| | 10 | **The home is its own repo and its own spec** | Keeping it here; Docs drafting it | Paul, 2026-08-30 | |
| -| 11 | **Passkey RP is a carloku.com subdomain, provisionally** | A real suite domain now; no passkeys | Paul, 2026-08-30 | |
| +| 11 | **Passkey RP is an `oncarlos.com` host, provisionally** — §9.7 | A real suite domain now; no passkeys | Paul, 2026-08-30 | |
| | 12 | **Link sharing is viewer-or-commenter, never editor** | Anonymous link editing | Paul, 2026-08-30 | |
| | 13 | **Passkey 2FA optional per person, owner-enforceable per team** | Mandatory; none | Paul, 2026-08-30 | |
| | 14 | **Light/dark is a per-person preference, switchable in the editor** | Per-document; per-team; follow-OS-only | Paul, 2026-08-30 | |
| @@ -651,9 +651,24 @@ That sweep is a named operator verb, not an emergent behaviour. |
| ### 9.7 The RP rename drill — smaller than the first draft thought |
| -Ruling 11 puts the RP on a carloku.com subdomain provisionally, which |
| +Ruling 11 puts the RP on a platform-default host provisionally, which |
| **schedules** the rename rather than avoiding it. |
| +**The concrete hosts, corrected 2026-08-30.** The account is `oficina`, |
| +sqid **`bds`** (`console.carloku.com/a/bds/`). Default addresses are |
| +`<app>.<sqid>.<apps-domain>` and the hosted apps-domain is **`oncarlos.com`** |
| +— *not* `carloku.com`, which is the console brand and appears nowhere in |
| +`platform.md`. So the credential origin is an `oncarlos.com` host under |
| +`bds`, and earlier drafts of this spec naming carloku.com were simply wrong. |
| +Worth catching here, because the RP hostname is the single most expensive |
| +string in the document to get wrong. |
| + |
| +**Never widen the RP ID to a registrable suffix on a shared platform |
| +domain.** WebAuthn permits an RP ID that is a suffix of the origin's |
| +hostname, so `oncarlos.com` would be *accepted* — and it is shared by every |
| +Carloku tenant, which would scope our credentials across other people's |
| +apps. The RP ID is the full host, always. |
| + |
| **But the mechanism already exists.** `passkey.Config.LegacyRPID` — |
| verified at source — is *"a relying party this instance used to be, accepted |
| for assertions (never registration) so a hostname move doesn't strand |