oficina / suite Public

Record fresh-auth preview deployment and approved Docs linking design

Paul Campbell pushed by paul@keymail.dev 1 month ago ae5043ec07db1fdaca256c0cf0909cc9f8dae535 parent 601d7e5

1 file changed, +10 −0

implementation/overnight-2026-09-07.md +10 −0

No CI script — run details

CI log

amadan: no CI script — add an executable .amadan/ci or a `ci` target to the Makefile

diff --git a/implementation/overnight-2026-09-07.md b/implementation/overnight-2026-09-07.md

index 62950fd..fa9004e 100644

--- a/implementation/overnight-2026-09-07.md

+++ b/implementation/overnight-2026-09-07.md

@@ -727,3 +727,13 @@ Full review is retained there and posted to suite discussion 5.

- First Fable design attempt fb470be ended permission_denied trying to read module sources; its final text is not a verdict. Authoritative terminal receipt /tmp/oficina-home-fresh-review/design-exit.json. Corrected4b184e7 review supplies those external source excerpts directly and uses read-only worktree access. Existing active service oficina-home-fresh-design-r2-20260908.service, PID3376787, actual active/running revalidated. Output /tmp/oficina-home-fresh-review/design-r2-review.ndjson, final receipt design-r2-exit.json when finished. Do not restart on observation timeout or read reasoning deltas as approval.

- Docs draft design/home-account-link at4cb40cb, worktree docs/.claude/worktrees/overnight-home-link-design, implementation/home-account-link.md; Amadan Docs discussion46. Existing IDs/grants/content remain unchanged; explicit fresh double-auth plus atomic bounded sealed pending-link rows and unique identity mappings. New Home-only principals require a separate data-model migration, not fake email. Reuse/extract the existing purpose sealer with compatibility tests before Docs consumption. Draft is NOT approved for implementation.

- Docs independent Fable design review is also confirmed running: oficina-docs-home-link-design-review-20260908.service, PID3400521. Output /tmp/oficina-docs-home-link-review/review.ndjson, exit.json when terminal. Both reviews use configured claude-fable-5 via Command Code; no finer model version claimed. Read only final result blocks, not reasoning deltas. Finish Home design corrections then implement/test/review/deploy fresh-auth before linking. No new deployment this continuation; Home preview stays eaefda9. Team-name/label question still unanswered, but does not block these implementation prerequisites.

+## Fresh-auth implementation and preview47301e8

+- Home design4b184e7 independently APPROVED by configured Fable5. Implemented47301e8295f0c1f4a8a7b8c2b853a72bf395b24d on feat/home-fresh-assertion: strict max_age300, sealed original-subject binding resolved with sessions.From, shared strict intent decoder, actual forced magic-link reauthentication for stale sessions, future-time refusal and preserved original AuthTime. Ordinary SSO remains unchanged. Completed Keymail+recovery is deliberately fresh; half-sessions fail.

+- Full make test including unit/race and actual hub CI passed. Three overlay mutations removing freshness, original subject binding and server-side forced email each fail the intended behavioral test. Logs /tmp/oficina-home-fresh-mutations. Fable whole-code APPROVE /tmp/oficina-home-fresh-review/code-review.ndjson. Nonblocking reviewer suggestion that ordinary assertions forward future auth_time is contradicted by assertion.validate AuthTime>IssuedAt refusal; do not clamp and invent freshness.

+- Eight actual-handler local browser cases pass Chromium/WebKit, JS on/off,320/1280: stale synthetic session, actual local captured email verification, assertion handoff, authenticated directory and signout. /tmp/oficina-home-fresh-browser/results.json and server-r3.log. Earlier failures at sixth case were actual per-address rate limit429; fixed the fixture to use distinct synthetic addresses, not production budgets. Earlier unit fixtures needed classifier-cache reset and clean mail capture; final tests explicitly establish their Keymail classification.

+- DEPLOYED47301e8 on both existing Home previews with original role/config/DB/key settings unchanged. Actual API body AND header verified after supported exact-host restarts; /tmp/oficina-home-fresh-release/verified.json includes artifact SHA. Eight live browser entry/fresh-request/invalid-age cases passed, /tmp/oficina-home-fresh-release/browser/results.json. User notified with https://overnight-home.bds.oncarlos.com/ and scope: no new linking UI, no real email sent by root, no production change.

+- Final canary evidence review initially ended permission_denied reaching for an external dependency, not an approval. Corrected evidence-only review receives full scripts/results inline: oficina-home-fresh-canary-r2-20260908.service, PID3460511, revalidated active/running. /tmp/oficina-home-fresh-review/canary-r2-review.ndjson and canary-r2-exit.json when finished. Do not restart on observation timeout. Home branch47301e8/task21 remain open until final evidence verdict and merge.

+- Docs first design4cb40cb Fable CHANGES REQUIRED: decide assertion session representation, bind linking to local initiation, and define precise local freshness. Revised2e69825 independently APPROVED, /tmp/oficina-docs-home-link-review/r2-review.ndjson; recorded Docs46. Home sessions use method home-assertion and opaque subject, resolved through link table before owner/admission/grants; never EnsurePerson/sample creation. Link initiation requires fresh local POST and binds person/session hash/origin/nonce. A method-specific At fallback for local magiclink is necessary because real library source leaves AuthTime zero; zero-AuthTime Keymail/SSO cannot borrow At. Reviewer accepted correction to its earlier AuthTime-only suggestion. Still design-only.

+- Carry Docs review conditions: main currently pins R0.22 while supplied internals and preview8a12672 use0.23; consume reviewed0.23 candidate or reverify exact0.22. Resolved session.At is stored created_at, not transient signin.Identity.At; renewal must not refresh proof. Next shared prerequisites: reusable purpose-bound sealing with old-ciphertext compatibility, and a shared-consumer nonce-binding hook plus receiver-side freshness for linking. Then actual Docs identity adapter/linking and authoritative teams/roster/chooser. New Home-only principal migration, two-team proof and old deep-link production cutover remain required; no fake emails or inferred ownership.