oficina / suite Public

Record shared sign-in implementation and preview evidence

Paul Campbell pushed by paul@keymail.dev 1 month ago a42baf4b80ecee2f0e6d17be4f4801918b17e7ec parent 96477c4

1 file changed, +10 −0

implementation/overnight-2026-09-07.md +10 −0

No CI script — run details

CI log

amadan: no CI script — add an executable .amadan/ci or a `ci` target to the Makefile

diff --git a/implementation/overnight-2026-09-07.md b/implementation/overnight-2026-09-07.md

index 4eb24a1..fb4965a 100644

--- a/implementation/overnight-2026-09-07.md

+++ b/implementation/overnight-2026-09-07.md

@@ -704,3 +704,13 @@ Full review is retained there and posted to suite discussion 5.

- Fetched rastrillo origin/main2c3ae78: identity-assertions design exists but still NOT RULED and no assertion code package. Home candidate9b77ec8 has credential sign-in but directory/team/consumer handoff not implemented. Earlier Fable assertion recommendation permits a bounded core implementation after resolving wire/transport contract; it does not require waiting for all SAML work. Re-read full review before adopting its advice.

- Common next slice across URL choices: shared signer/verifier and browser-bound/replay-protected app exchange; authoritative Home team membership and instance registry; app entry redirect, one-team auto-select/multi-team chooser on directory origin; Docs consumer with audience tied to actual team instance; two-team isolation, stable deep links, switch/signout/expiry tests. Preserve separate team DBs and existing production identity/data while migrating.

- Options to present: generic entry with redirect to team subdomain (smallest change, current isolation); path-prefixed common host (user-acceptable, needs base-path support, browser-storage/session partitioning and platform cross-box decision); cookie-selected common host (largest trusted gateway change, must avoid global team-cookie switching existing tabs/deep links).

+## Shared sign-in implementation, 8 September 09:58 Dublin

+- User accepted implementing the existing team-subdomain design first. Full target remains common app entry, Home sign-in, team selection and return to that team's app. Production bare hosts still alias bds instances.

+- Rastrillo assertion core29e4491 independently approved by Fable5.1, full local/actual CI green, merged997935b and mirrored to GitHub. Canonical amadan Go module resolves. Shared Home consumer3c550c3 independently approved by Fable5.1, full unit/race/actual CI green, merged into Home maina1c1459. Neither merge enabled SSO in a running app.

+- Home mounting candidate d1526e4 implements separate credential/directory runtime roles, exact consumer manifest, browser-bound exchange and independent directory sessions. Fable5 via Command Code approved; subscription Fable hit its limit, recorded rather than treated as review. Full local/actual CI green. Eight local Chromium/WebKit cases, JS on/off at320/1280, passed actual handlers using synthetic credential sessions and a local-only HTTPS proxy. Evidence /tmp/oficina-home-assertion-browser/results.json. This is not live emailed sign-in proof.

+- DEPLOYED d1526e4 to BOTH existing Home previews; actual API body and header verified at /tmp/oficina-home-assertion-release/legacy-verified.json. Roles are still legacy/unset, so new exchange is not enabled. User notified with this limitation. Production unchanged.

+- Deployment revealed CARLOS rejects quoted JSON environment values. Follow-up eaefda9 adds explicit canonical BASE64 configuration alternatives with bounded decoding, ambiguous-input refusal and unchanged semantic checks. Full local/actual CI green; Fable follow-up running under oficina-home-encoded-review-20260908.service. Do not deploy/enable before review result.

+- Supported CARLOS instances set-environment exists in platform origin/maindcf0cad; isolated CLI built at /tmp/oficina-carlos-sso/carlos. Existing preview hosts currently share overnight-home environment. Plan: credential keeps overnight-home; directory rebinds to overnight-directory preserving its host/DB/socket. Existing HOME_DEK copied privately to that new unused bundle to preserve any existing sealed state; credential pepper/signin/DEK unchanged. New private assertion key is in overnight-home only. Failed directory env set was rejected before mutation because JSON quotes were invalid. Directory has not been rebound. Never put assertion private key in default app config.

+- Remaining: configure/verify two-role preview, live handoff/error/replay/restart checks and restore evidence; authoritative roster/team chooser; Docs identity linking that preserves existing PersonIDs/grants; two-team isolation; reviewed cutover of common app hosts with legacy deep-link continuity. No first-visitor ownership grants, remote DB editing or production channel promotion.