amadan
Record approved shared authentication prerequisites and preview rollout
1 file changed,
+7
−0
implementation/overnight-2026-09-07.md+7 −0
No CI script — run details
CI log
amadan: no CI script — add an executable .amadan/ci or a `ci` target to the Makefile
diff --git a/implementation/overnight-2026-09-07.md b/implementation/overnight-2026-09-07.md| index fa9004e..f470f5e 100644 |
| --- a/implementation/overnight-2026-09-07.md |
| +++ b/implementation/overnight-2026-09-07.md |
| @@ -737,3 +737,10 @@ Full review is retained there and posted to suite discussion 5. |
| - Final canary evidence review initially ended permission_denied reaching for an external dependency, not an approval. Corrected evidence-only review receives full scripts/results inline: oficina-home-fresh-canary-r2-20260908.service, PID3460511, revalidated active/running. /tmp/oficina-home-fresh-review/canary-r2-review.ndjson and canary-r2-exit.json when finished. Do not restart on observation timeout. Home branch47301e8/task21 remain open until final evidence verdict and merge. |
| - Docs first design4cb40cb Fable CHANGES REQUIRED: decide assertion session representation, bind linking to local initiation, and define precise local freshness. Revised2e69825 independently APPROVED, /tmp/oficina-docs-home-link-review/r2-review.ndjson; recorded Docs46. Home sessions use method home-assertion and opaque subject, resolved through link table before owner/admission/grants; never EnsurePerson/sample creation. Link initiation requires fresh local POST and binds person/session hash/origin/nonce. A method-specific At fallback for local magiclink is necessary because real library source leaves AuthTime zero; zero-AuthTime Keymail/SSO cannot borrow At. Reviewer accepted correction to its earlier AuthTime-only suggestion. Still design-only. |
| - Carry Docs review conditions: main currently pins R0.22 while supplied internals and preview8a12672 use0.23; consume reviewed0.23 candidate or reverify exact0.22. Resolved session.At is stored created_at, not transient signin.Identity.At; renewal must not refresh proof. Next shared prerequisites: reusable purpose-bound sealing with old-ciphertext compatibility, and a shared-consumer nonce-binding hook plus receiver-side freshness for linking. Then actual Docs identity adapter/linking and authoritative teams/roster/chooser. New Home-only principal migration, two-team proof and old deep-link production cutover remain required; no fake emails or inferred ownership. |
| + |
| +## Shared sealing and sensitive consumer prerequisites |
| + |
| +- Fresh-auth final canary review APPROVED in canary-r2-review.ndjson; exact47301e8 CI rechecked and branch merged normally through Amadan as Home3947850. Home task21 Done. Earlier running-review entries above are superseded. |
| +- Shared purpose-sealer branch feat/shared-purpose-seal16024be adds public handoff/seal with explicit namespace and a Home adapter preserving oficina/home, existing DEK and historical ciphertext. Published nested module967d29f resolves canonically without replace. Full unit/race/actual CI passed; namespace and delimiter mutations each fail fixed historical compatibility checks. Independent configured claude-fable-5 whole-code APPROVE, /tmp/oficina-shared-seal-review/review.ndjson. Home discussion/task22. |
| +- Frozen16024be ARM64 artifact /tmp/oficina-shared-seal-release/home-arm64 SHA2560e82efcfb23d014e651f052908050a42caf1cd79f85ca7f9e2668020c15fa34f published to canary/overnight-home. Credential actual body/header verified new; directory still old body/new header after exact-host restart request. Deployment not yet fully verified; no merge or production promotion. Final browser/canary evidence pending. |
| +- Shared consumer designc4fe2bc on feat/link-consumer-binding independently APPROVED by configured claude-fable-5, /tmp/oficina-link-consumer-review/design-review.ndjson. RequireFreshAuth stores policy inside authenticated return-path payload, leaving ordinary payload bytes unchanged; old readers refuse fresh prefix. Finish consumes before freshness refusal, compares future time to wall clock and age to persisted high-water fence. BindStart receives only public nonce after pending commit, before cookie/redirect; rejection cancels only own new row, allowing zero rows if concurrently evicted. No schema change. Preserve pre-consumption nonce/subject/path refusal distinction. Implementation delegated to /root/consumer_implementation in isolated overnight-link-consumer worktree; do not modify concurrently. Combine shared sealer into branch before final module publication. |