amadan
Record external launch review conditions and exact source citations
1 file changed,
+35
−8
implementation/external-home-launch.json+35 −8
CI passed — run details
CI log
=== gate === ok amadan.net/oficina/suite 0.009s ok amadan.net/oficina/suite/conformance 0.004s
diff --git a/implementation/external-home-launch.json b/implementation/external-home-launch.json| index 2bd3d22..f5fef29 100644 |
| --- a/implementation/external-home-launch.json |
| +++ b/implementation/external-home-launch.json |
| @@ -4,7 +4,7 @@ |
| "state": "proposed", |
| "author": "this session, Codex suite coordinator subagent", |
| "date": "2026-09-10", |
| - "reviewer": "claude-fable-5-1; R1 REQUEST CHANGES; revised boundary awaiting R2", |
| + "reviewer": "Codex root APPROVE boundary; claude-fable-5-1 R2 APPROVE with text conditions, incorporated below; final record awaiting verification", |
| "runtime_activation": false |
| }, |
| "citations": [ |
| @@ -25,7 +25,12 @@ |
| "oauth.go", |
| "appapi.go", |
| "docs/apps.md", |
| - "CLAUDE.md" |
| + "CLAUDE.md", |
| + "registry.go", |
| + "relay.go", |
| + "reauth.go", |
| + "handlers.go", |
| + "devices_test.go" |
| ] |
| }, |
| { |
| @@ -36,7 +41,25 @@ |
| "internal/home/auth.go", |
| "internal/home/store.go", |
| "internal/instance/webauthn.go", |
| - "CLAUDE.md" |
| + "CLAUDE.md", |
| + "internal/home/link.go", |
| + "internal/home/home_test.go", |
| + "web/static/homeauth.js" |
| + ] |
| + }, |
| + { |
| + "repo": "oficina/home", |
| + "commit": "481d2d57f489", |
| + "paths": [ |
| + "docs/superpowers/specs/2026-08-30-home-design.md", |
| + "implementation/fresh-assertion.md", |
| + "implementation/link-consumer-binding.md", |
| + "handoff/http.go", |
| + "handoff/store.go" |
| + ], |
| + "sections": [ |
| + "home design 5.3 assertion and 5.6 redirect protocol", |
| + "reviewed shared handoff implementation" |
| ] |
| } |
| ], |
| @@ -57,16 +80,18 @@ |
| "claiming an unopened vault is ready", |
| "reusing generic connect session hooks without a provider-specific proof adapter", |
| "storing any server-side mapping from Keymail anonymous identity user handle or passkey credential to a mailbox", |
| - "treating long-lived Keymail identity link tokens as fresh or revocable mailbox-device proof" |
| + "treating long-lived Keymail identity link tokens as fresh or revocable mailbox-device proof", |
| + "using a Keymail reauthentication step-up ticket alone as mailbox-owner proof; it proves some registered passkey asserted, not ownership of the selected mailbox" |
| ] |
| }, |
| "provider_seams": { |
| "mail": { |
| - "local_authority": "Existing verified mailbox-scoped owner/device proof. Never an anonymous identity user handle, identity-service passkey credential, identity link token or OAuth app grant. Exact immutable mailbox incarnation and revocation API must be established from provider registry/device code before implementation.", |
| + "local_authority": "Existing verified mailbox-scoped owner/device proof. Never an anonymous identity user handle, identity-service passkey credential, identity link token or OAuth app grant. Exact immutable mailbox incarnation and revocation API must be established from provider registry/device code before implementation. A relay-stamped fresh auth time must accompany independent mailbox-scoped proof such as the existing device proof or a challenge signed by the mailbox signing key. A reauthentication ticket alone is never mailbox proof.", |
| "unlock": "Existing same-origin WebAuthn PRF or established local device key state opens the mailbox vault client-side.", |
| "integration_owner": "keymail/keymail", |
| "new_entry": "Proposed provider-owned /oficina/launch and /oficina/connect endpoints; route names require provider review before implementation.", |
| - "pending_state": "Relay-held, mailbox-keyed, sealed short-lived pending state, reached using existing mailbox-scoped authenticated routing before redirect. The Home auto-POST has no provider bearer; it addresses a random single-use browser-bound rendezvous. No identity-service user/passkey identifier enters pending state or the mailbox relation. Exact proxy/header stripping and routing evidence is an implementation prerequisite." |
| + "pending_state": "Relay-held, mailbox-keyed, sealed short-lived pending state, reached using existing mailbox-scoped authenticated routing before redirect. The Home auto-POST has no provider bearer; it addresses a random single-use browser-bound rendezvous. No identity-service user/passkey identifier enters pending state or the mailbox relation. Exact proxy/header stripping and routing evidence is an implementation prerequisite. Pending rendezvous state must stay outside all backed-up stores: use relay memory or a separately reviewed non-backed-up transient store, never registry.db or identity.db. A sealed short lifetime does not remove historical snapshots.", |
| + "deployment_shape": "Relay shape only: provider-owned launch/connect endpoints require relay identity and freshness stamping. Standalone keymail serve lacks that identity service and must refuse these endpoints; it retains existing local sign-in. Feature detection cannot silently weaken to a lesser proof." |
| }, |
| "files": { |
| "local_authority": "Existing Slopbox Home credential/device proof chooses the encrypted directory; existing instance membership proof authorizes files. These are distinct authorities. Proposed relation binds Slopbox Home users.id (AUTOINCREMENT), never an instance member ID in the Home relation. Fresh proof requires a new local passkey sign-in within the specified window; existing session created_at alone is not proof of a recent ceremony.", |
| @@ -117,7 +142,7 @@ |
| ], |
| "storage_and_revocation": { |
| "home": "No provider bearer token, device secret, private key, vault plaintext, inbox name or file path.", |
| - "provider": "Provider-specific relation schema, requiring separate owner privacy approval. Keymail: HMAC/sealed Home binding may map only to a mailbox-scoped non-reusable incarnation and revocation generation; no identity-user/passkey-to-mailbox join anywhere. Slopbox Home: a stable keyed Home-subject binding on users.id is a new opaque correlation column, not part of its current anonymous schema. This privacy addition requires explicit provider approval before implementation, plus raw-DB grep and correlation tests. If refused, retain launch-only navigation with local unlock and no durable relation. Dedicated key lifecycle and exact schema remain prerequisites.", |
| + "provider": "Provider-specific relation schema, requiring separate owner privacy approval. Keymail: HMAC/sealed Home binding may map only to a mailbox-scoped non-reusable incarnation and revocation generation; no identity-user/passkey-to-mailbox join anywhere. Slopbox Home: a stable keyed Home-subject binding on users.id is a new opaque correlation column, not part of its current anonymous schema. This privacy addition requires explicit provider approval before implementation, plus raw-DB grep and correlation tests. If refused, retain launch-only navigation with local unlock and no durable relation. Dedicated key lifecycle and exact schema remain prerequisites. Keymail pending rendezvous state is excluded from registry.db, identity.db and their Litestream/S3 backup set. Process restart expires the in-memory operation and returns the person to an explicit retry without changing an account link.", |
| "deletion": "Remove relation in the same transaction as local principal deletion; never reuse principal IDs. Revoked provider devices cannot satisfy pending or future local proof.", |
| "unlink": "Own confirm screen behind fresh provider proof. Delete relation and pending flows atomically, preserving mailbox/files and existing independent credentials.", |
| "logout": "Provider sign-out retains its existing vault-lock/device semantics and must not instantly restart Home sign-in. Home sign-out grants no authority to erase provider keys or data.", |
| @@ -134,7 +159,9 @@ |
| "Deploy isolated provider canaries after independent whole-delta review, then verify live versions and local unlock behavior; no shared production instance overwrite.", |
| "Keymail tests prove no persistent or pending-state relation contains both an anonymous identity-service user/passkey identifier and a mailbox identifier. Freeze and review registry, device-token, reauth and relay header-stripping code before choosing the principal.", |
| "Slopbox Home relation participates in existing raw-DB/ciphertext privacy tests (including home_test.go); tests cover absence of raw Home subject, address, file path and instance location. Document the deliberate opaque per-user correlation change and require provider approval.", |
| - "Slopbox fresh-proof API must require a new verified sign-in; replaying an old session created_at cannot satisfy the window. Keymail identity link tokens cannot satisfy freshness or revocation." |
| + "Slopbox fresh-proof API must require a new verified sign-in; replaying an old session created_at cannot satisfy the window. Keymail identity link tokens cannot satisfy freshness or revocation.", |
| + "Keymail tests reject a valid step-up ticket without independent mailbox-scoped ownership proof, and reject standalone serve deployment for Oficina launch/connect.", |
| + "Keymail raw backup/registry/identity fixtures prove pending rendezvous state never lands in backed-up stores; restart expires pending state without creating or changing links." |
| ], |
| "unresolved_before_implementation": [ |
| "Exact provider owner/device freshness APIs and whether they rotate/revoke proof on account switch.", |