oficina / suite Public

Record integrated Docs sign-in checks and pending directory work

Paul Campbell pushed by paul@keymail.dev 1 month ago 415ab4eaf71e202b9f4bbd080683b972a1fd4f9c parent 3089710

1 file changed, +11 −0

implementation/overnight-2026-09-07.md +11 −0

No CI script — run details

CI log

amadan: no CI script — add an executable .amadan/ci or a `ci` target to the Makefile

diff --git a/implementation/overnight-2026-09-07.md b/implementation/overnight-2026-09-07.md

index 95c034d..be1e184 100644

--- a/implementation/overnight-2026-09-07.md

+++ b/implementation/overnight-2026-09-07.md

@@ -759,3 +759,14 @@ Full review is retained there and posted to suite discussion 5.

- Team directory design fa64e286990762aecc6913bb9076a3cb75b088c3 independently APPROVED in /tmp/oficina-team-directory-review/r2-review.ndjson, Home24 design task Done. First review CHANGES REQUIRED fixed authenticated owner receipt and preserved directory session during sensitive Complete. False unsupported-max_age claim corrected against actual source. First review prose misidentified model; runner AND event.model proved claude-fable-5, discrepancy recorded. R2 metadata agrees. DirectorySchema is correct migration merge point. Existing-directory audited operator bootstrap still depends on platform117; first-boot Seed exists only for genuinely new DB and app-wide manifest effects require separate scoped review. No silent first-visitor ownership or old-DB edits.

- /root/team_directory_design now implements bounded directory schema/read store in isolated feat/directory-store from4d3039c: sealed names, stable IDs, memberships, live instance choices; no network mutations/provisioning/HTTP/UI yet. Root requested it avoid unreviewed mandatory per-team config pins or compiled Docs-only architecture; caller-injected validation policy may constrain pilot while keeping authoritative registry model. This follow-up remains active.

- NEXT root: collect bridge/navigation commits, wire Config.Home validation before DB open and main env fields; merge linkstore/handoff schemas after Docs schema; build shared bridge and typed resolver; exempt ONLY exact callback from CSRF, retain all other checks; suite /signin -> Home with safe return, /signin/local -> existing form, local completion fixed bridge; root wraps duplicate session/pending cookies before auth Verify/Callback, mounts guarded link routes and account-menu actions. Add actual signed Home+local-email/rotation browser integration preserving two existing owners/grants, full gate and whole-branch Fable before any Docs preview deployment. Then new Home-only principal migration and authoritative roster/team chooser/two-team/legacy-alias/restore acceptance before production.

+## Docs integrated browser checks and directory foundations

+- Docs integration feat/home-account-integration is frozen at3ed76656449e3ed59afed7a828ba7e35c9ec87d7 for whole-branch configured claude-fable-5 review. Worktree overnight-home-integration; Docs48/task60. Actual local full gate and exact-head hub CI pass. Includes bridge70beb9, approved fixed local-navigation helpere9398a9, full App/main/router wiring3741f6f, actual router integration tests7d9c8c4, stable signed-out page3ed7665. Existing local sign-in rotates its real cookie before linking; unknown Home identities do not create people. Original document return uses a separate encrypted navigation-only cookie. Signout stops at /signed-out rather than immediately signing in through Home again.

+- Active reviewer: oficina-docs-home-integration-code-review-20260908.service, /tmp/oficina-docs-home-integration-review/code-review.ndjson and code-exit.json when terminal. Dependency sources are supplied inline; original worktree stays frozen. No verdict yet. Do not restart merely because observation times out.

+- Actual browser found form-action self blocking the local linking POST's redirect chain to Home, plus horizontal body/address layout at320px. Separate feat/home-csp commit1e862f80752004d16db98693c25d4c693dc19510 fixes both, preserving reviewer source. Home-only policy adds the exact validated issuer and a drift test compares every other directive against actual pinned framework defaults; standalone unchanged. Existing rst-box now has block body/address. Docs54 tracks fix. Focused tests and exact-head hub CI pass; full gate /tmp/oficina-docs-home-csp-gate.log running. Immutable ARM64 binary built /tmp/oficina-docs-home-release/docs-arm64. No deployment yet.

+- Browser agent /root/docs_link_store repeats all8 Chromium/WebKit x scripts on/off x320/1280 cases on immutable1e, using actual Docs handlers/locale setup and captured local email with a synthetic signed Home issuer. All4 Chromium cases pass so far; WebKit running. Exact /api/version body checked; X-Carlos-Version is absent locally because the real edge supplies it. Live deployment still needs both. /tmp/oficina-docs-home-browser; earlier blocked3ed screenshot/trace preserved. Root /root/consumer_implementation separately proves old8a/876 binaries can reopen new additive schema and handle Home sessions under real restrictive admission; permissive admission is a required negative control, not assumed safe rollback.

+- Home directory data store4c0d84811a018c53a47b604a0de5885baec0771e (feat/directory-store, Home25) and Docs chooser07043915daebae10512a710915263093ed793b5b (feat/docs-team-chooser, Home26) have independent Fable approval, full local tests/race, actual CI and two meaningful mutations each. Neither is mounted, merged or deployed. Mount Schema through directorySchema, not HomeBootSchema. Store takes explicit supported Apps and injected route validation; chooser is directory-only GET/apps/docs plus CSRF-protected POST/apps/docs/team, rechecks membership before redirect. No bootstrap/network membership mutation was added. Audited existing-directory bootstrap still depends on platform117; do not make first visitor owner or mutate old DBs directly.

+- New Home-only principal designa5a7918 is under configured Fable review, Docs53/task66; /root/team_directory_design owns isolated design-home-principals. Existing people.email NOT NULL UNIQUE and real legacy-link FK prohibit fabricated empty/opaque email. Candidate uses an additive canonical ledger and disjoint positive ID ranges with explicit old-people allocation guards, below2^53; owner/grant IDs remain stable. This is a proposal, not approved code. No new Home-only users until fresh authoritative roster and migration/restore proof exist.

+- Prepared private preview settings /tmp/oficina-docs-home-config/docs-home.json remain unapplied: add docs-overnight -> exact Docs preview origin to credential Home consumer manifest; four Docs Home fields include dedicated fresh DEK. Temporary CARLOS private-input helper now supports one atomic sealed four-setting apply to docs/overnight-release, avoiding command-line secret exposure and partial config boots. Helper built but never invoked. Existing credentials/content keys/owners/allowed local addresses remain unchanged. Production aliases remain old instances, not gateways.

+- Next: await code verdict and browser/rollback proofs; combine any corrections into final integration, review final delta/head and deploy verified preview. Continue Home-only principal, authoritative roster/chooser/bootstrap and two-team routing acceptance before production entry cutover. Full suite goal remains active; no first-team label answer needed for current work.