oficina / sheets Public

design: match canary fixture to provisioned isolated environment

Paul Campbell pushed by paul@keymail.dev 1 month ago d623c903dc66e4a2410ad5ae60dd8ca0256d81ca parent 41a05a0

1 file changed, +2 −2

docs/superpowers/specs/2026-09-07-canary-fixture-bootstrap.md +2 −2

Intent

diff --git a/docs/superpowers/specs/2026-09-07-canary-fixture-bootstrap.md b/docs/superpowers/specs/2026-09-07-canary-fixture-bootstrap.md

index bdb2e40..eb7814a 100644

--- a/docs/superpowers/specs/2026-09-07-canary-fixture-bootstrap.md

+++ b/docs/superpowers/specs/2026-09-07-canary-fixture-bootstrap.md

@@ -4,7 +4,7 @@ Status: proposed fallback for Fable review; do not deploy yet. Normal SMTP-based

## Target and boundary

-The only permitted target is app sheets, account bds, instance overnight-sheets.bds.oncarlos.com, channel canary/overnight-batch, with its separately bound named environment. Root has verified current platform CLI supports instance environment binding. Never change the app's default environment, production origin or production channel. The fixture receives fresh canary SHEETS_DEK and SHEETS_INSTANCE_KEY and an owner address sheets-review@example.test. It does not read or copy production secrets, sessions, databases or content.

+The only permitted target is app sheets, account bds, instance overnight-sheets.bds.oncarlos.com, channel canary/overnight-batch, with named environment overnight-batch, separately bound by root. Root has verified current platform CLI supports instance environment binding. Never change the app's default environment, production origin or production channel. The fixture receives fresh canary SHEETS_DEK and SHEETS_INSTANCE_KEY and an owner address oficina-fixture@example.test. It does not read or copy production secrets, sessions, databases or content.

Use a temporary reviewed bootstrap binary on this isolated instance, then replace it with the exact normal candidate binary. The bootstrap binary contains no login endpoint, alternate auth middleware, universal cookie, content endpoint or API backdoor. It initializes existing schema/session rows during startup only, then serves only platform health/version responses while awaiting replacement. It never serves the editor, so no browser behavior can accidentally be certified against bootstrap code.

@@ -24,7 +24,7 @@ Generate a random 32-byte session token locally using the framework's token form

Run sheets.BootSchema through the normal migrate.Apply path. Seed only one row in the existing sessions table in one transaction after rechecking the empty-state precondition. The pinned sessions schema contains token_hash, subject, method, auth_time, created_at and expires_at. Use:

- token_hash: supplied 64-character lowercase hex hash, validated strictly;

-- subject: exactly sheets-review@example.test;

+- subject: exactly oficina-fixture@example.test;

- method: fixture (do not claim the mailbox was verified);

- auth_time: empty;

- created_at: current UTC RFC3339;