amadan
Record verified Docs preview and conditional rollback procedure
1 file changed,
+10
−0
implementation/overnight-2026-09-07.md+10 −0
No CI script — run details
CI log
amadan: no CI script — add an executable .amadan/ci or a `ci` target to the Makefile
diff --git a/implementation/overnight-2026-09-07.md b/implementation/overnight-2026-09-07.md| index be1e184..dcca51e 100644 |
| --- a/implementation/overnight-2026-09-07.md |
| +++ b/implementation/overnight-2026-09-07.md |
| @@ -770,3 +770,13 @@ Full review is retained there and posted to suite discussion 5. |
| - New Home-only principal designa5a7918 is under configured Fable review, Docs53/task66; /root/team_directory_design owns isolated design-home-principals. Existing people.email NOT NULL UNIQUE and real legacy-link FK prohibit fabricated empty/opaque email. Candidate uses an additive canonical ledger and disjoint positive ID ranges with explicit old-people allocation guards, below2^53; owner/grant IDs remain stable. This is a proposal, not approved code. No new Home-only users until fresh authoritative roster and migration/restore proof exist. |
| - Prepared private preview settings /tmp/oficina-docs-home-config/docs-home.json remain unapplied: add docs-overnight -> exact Docs preview origin to credential Home consumer manifest; four Docs Home fields include dedicated fresh DEK. Temporary CARLOS private-input helper now supports one atomic sealed four-setting apply to docs/overnight-release, avoiding command-line secret exposure and partial config boots. Helper built but never invoked. Existing credentials/content keys/owners/allowed local addresses remain unchanged. Production aliases remain old instances, not gateways. |
| - Next: await code verdict and browser/rollback proofs; combine any corrections into final integration, review final delta/head and deploy verified preview. Continue Home-only principal, authoritative roster/chooser/bootstrap and two-team routing acceptance before production entry cutover. Full suite goal remains active; no first-team label answer needed for current work. |
| + |
| +## Deployed Docs linking stage and rollback runbook |
| + |
| +Docs1e862f80752004d16db98693c25d4c693dc19510 is deployed with Home enabled at https://overnight-docs.bds.oncarlos.com/. Actual body/header and paired Home02f9ac0 config verified in /tmp/oficina-docs-home-release/verified.json. Exact-head CI/full gate passed. Whole-code3ed, final-delta1e and deployed-canary evidence reviews all APPROVED by configured claude-fable-5; terminal receipts under /tmp/oficina-docs-home-integration-review. All8 local full-flow browser cases and8 live unsigned cases passed. Live scope is navigation/rendering only, with no human email/authentication; local full-flow uses actual captured Docs email and synthetic signed issuer. User notified with URL; menu item is Connect Home account. The live checker was also proven red with an intentionally wrong expected consumer ID, isolated output /tmp/oficina-docs-home-release/browser-negative-control/verified.json; positive evidence unchanged. |
| + |
| +Rollback rule: **The restrictive local-email allowlist is a standing rollback precondition.** Never widen it to opaque Home subjects or development admit-all while old binaries remain deployable. Both old8a126727ae93fedadcc9af0ee8048334edd803a4 and87662f5b246004aca604a4b040cb6691cfd7f130 reopen the new additive schema and preserve local access only under that condition. Negative controls produced bogus people and six samples on both old versions when admission was permissive. Evidence /tmp/oficina-docs-rollback-proof/summary.json. Keep existing origin, instance key, content key, DB path and local email admission. Retain the dedicated Docs Home DEK for future forward recovery; do not delete the additive link/handoff tables or restore an older DB to downgrade code. |
| + |
| +For this preview, use the supported CARLOS deploy command to return only docs/canary/overnight-release and host overnight-docs.bds.oncarlos.com to reviewed8a12672; retained artifact /tmp/oficina-docs-estilo-theme-release/docs-arm64 and its verified.json identify it. Never redirect a rollback at the production alias. Request an exact-host restart and verify actual /api/version body plus edge header. The old app ignores Home config; Home cookies are refused by retained email admission, while existing local sessions and ordinary local sign-in continue. Its supported same-origin POST /signout can revoke an individual Home session; no bulk cleanup or raw DB operation is assumed. Preserve all four Docs Home settings together for return to the new binary; if disabling them on new code, change all four atomically rather than leaving a partial startup configuration. This is tested application compatibility on disposable data, not a platform restore drill or blanket production-rollback proof. |
| + |
| +Home consumer manifest was changed only in credential environment overnight-home, adding docs-overnight with exact preview origin. Docs four-field settings were applied atomically through supported secrets set in overnight-release. Existing secrets/data retained; no private values printed. Production observation remains Docs87662f5, Sheets7212864, Home0d0262a. Final canary review permits normal Amadan integration merge, not production promotion. Platform117 freshly read still has no implementation; existing-DB fenced operations remain unavailable. New Home-only principal designa5a7918 approved and implementation07099a9 is underway with old/new allocator proof; authoritative roster design and chooser continuation amendment proceed in separate agents. |