# Development log

## Working agreement

This log is the project ledger for decisions, implementation, evidence, and pending work. Major choices remain provisional until a human signs below; unsigned entries do not automatically block reversible work. Production authentication, migrations, deployment, and externally consequential changes require their implementation gates to be satisfied. Every agent must report changes here through the coordinator. The user subsequently authorized infrastructure, repository creation, and publication **when release ready**; no production deployment has been performed.

## 2026-10-11 — Bootstrap and first vertical slice

Initial workspace was empty and had no Git repository. Coordinator delegated independent protocol/contracts, authentication/security, and frontend/SDK work; coordinator owns the reference resource engine, HTTP adapter, integration verification, and this ledger. Agents use the inherited model and reasoning configuration; no model override was available under the current delegation instructions.

### Decision register

| ID | Decision and rationale | Status / human sign-off |
| --- | --- | --- |
| D001 | Use **Bindle** as provisional protocol name and `/.well-known/bindle/manifest.json`, matching the supplied path. The brief also says Bridle; settle spelling before public release. | Provisional. Reviewer: ___ Date: ___ Outcome: ___ |
| D002 | Discover a manifest at `https://host/.well-known/bindle/manifest.json`; send the handle separately as a login hint. `https://user@host` denotes URL userinfo, not a user-specific host resource. Stable subject URLs are distinct from mutable email/login handles. | Recommended. Reviewer: ___ Date: ___ Outcome: ___ |
| D003 | Build on OAuth authorization code + S256 PKCE, with exact registered redirects and issuer binding, rather than inventing an authentication protocol. Redirect login is the v0 baseline; embedded login remains deferred pending a secure browser flow. | Recommended; production gate. Reviewer: ___ Date: ___ Outcome: ___ |
| D004 | Email fallback occurs only after definitive absent discovery (404/410) and explicit user choice. Network/TLS/server failures must not silently change identity provider. Verified email association never silently merges accounts. | Recommended. Reviewer: ___ Date: ___ Outcome: ___ |
| D005 | Fragment/contract definitions are immutable, versioned HTTPS URLs. Public metadata describes fields; personal preference values remain private. Apps explicitly request contract methods and users see the exact resource selection. | Recommended. Reviewer: ___ Date: ___ Outcome: ___ |
| D006 | Effective resource authorization intersects the approved resource set with current preference assignments, supported contracts, method allowlist, live grant, and expiry. New assignments need renewed consent; removals revoke effective access immediately. | Implemented in local engine. Reviewer: ___ Date: ___ Outcome: ___ |
| D007 | Sync writes require optimistic concurrency; transaction IDs deduplicate identical requests and reject different payloads under the same ID. Replays still require live authorization. | Implemented in local engine; durable deduplication pending. Reviewer: ___ Date: ___ Outcome: ___ |
| D008 | Use **entity** for the authority owning data, with individuals first and organizations later; subject denotes its token identity. Organizational delegation must have explicit membership/roles and no implicit graph inheritance. | Provisional. Reviewer: ___ Date: ___ Outcome: ___ |
| D009 | Start with profile, preferences, resource discovery, and object storage; design separate contracts for files/collections and events. Implement one hosted storage backend before Google Drive/WebDAV/S3 adapters. Avoid claiming all providers have identical guarantees. | Recommended. Reviewer: ___ Date: ___ Outcome: ___ |
| D010 | Provide an offline runnable, loopback-only, in-memory prototype first. It is not an identity provider and has no real email delivery, passkey verification, or provider credentials. Production services will reuse the authorization semantics behind authenticated owner sessions. | Current implementation boundary. Reviewer: ___ Date: ___ Outcome: ___ |
| D011 | Integrate actual local 3sln dodo/ngin source with license/provenance, because external DNS/source retrieval failed. Do not guess stack APIs or install unverified replacements. | Implemented. Reviewer: ___ Date: ___ Outcome: ___ |
| D012 | Hosted v0 trusts the operator with plaintext data and encrypted-at-rest connector secrets. Self-hostability is not end-to-end encryption or portable domain identity; user-only encryption and provider migration need separate designs. | Explicit custody boundary. Reviewer: ___ Date: ___ Outcome: ___ |
| D013 | Use issuer-side resource gateway only, static registered clients, five-minute tokens, and mandatory live grant checks in v0. Remote resource delegation and iframe authentication require separate trust profiles. | Recommended. Reviewer: ___ Date: ___ Outcome: ___ |

### Completed work

- Reference authorization engine: resource ownership, explicit consent, resource/method-scoped grants, live revocation, expiry, current preference intersection, transaction replay, and optimistic storage writes.
- HTTP demo adapter: loopback binding, Host/Origin checks, JSON/body limits, same-origin static content policy, fixture consent/preferences/revocation and RPC routes. It intentionally publishes no authentication/discovery manifest.
- Five initial engine tests passed, covering authorization and sync boundaries rather than implementation snapshots.
- Protocol/contracts/auth/security drafts now exist in `docs/spec/`, with primary standards references and detailed email-link/recovery edge cases.
- Real dodo/ngin source snapshots are vendored with original MIT licenses and commit provenance. SDK discovery and custom login element plus stack-based consent/account UI are implemented.
- `docs/implementation.md` records prototype/spec differences explicitly; `AGENTS.md` preserves coordination and review expectations for future work.

### Integration verification

The initial HTTP test could not bind `127.0.0.1` because the sandbox returned `EPERM`. It was adapted to invoke the actual HTTP request callback with readable request streams and response doubles, exercising routing, Host/Origin controls, JSON validation, consent and RPC without a listening socket. This is useful adapter verification but does not establish real network/browser behavior. The runnable server remains available for use outside that sandbox.

Current automated suite passes core authorization/sync, HTTP adapter, and SDK discovery tests. Frontend DOM integration and malformed-manifest hardening are being completed; final results will be appended below. No claim of production conformance or completed identity service is made.

Final coordinator review found and fixed an authorization edge case: removing then restoring a preference resource could revive an old approval. Removing an assignment now permanently narrows existing grants; restoration requires renewed consent. The regression test covers this alongside new-resource expansion. Demo token lifetimes now match the draft five-minute ceiling. SDK metadata checks now reject version/issuer mismatches and delegated endpoints and bound response size/time.

Frontend DOM smoke passed real dodo/ngin rendering, empty-selection/unacknowledged-consent rejection, grant/revoke updates, and default/custom-host login behavior. This used an already installed local happy-dom, without dependency installation. The local dodo checkout's 0.0.9 API did not support current stack composition; the frontend agent corrected the vendor snapshot to the published 0.1.0 package already present in a sibling project. Provenance records that source accurately.

The current consent screen demonstrates one resource fragment, with a separate storage configuration action and optional decline even with no assigned storage. Configuration does not grant app access. The final DOM smoke additionally checks removal makes the request resource unavailable and that decline works without setup. It does **not** yet implement a general schema renderer, required-fragment setup wizard, atomic fields, or multi-fragment requests. These are mandatory next UX work; real-browser/accessibility and human usability validation remain pending.

Final checks: `npm test` passed **10 tests**; portable `npm run test:dom` passed using the already installed happy-dom via `BINDLE_DOM_MODULE_URL`. The repo declares the exact happy-dom development version for normal installation; no dependency installation was performed in this restricted session. DOM smoke files are preserved in `tests/browser/`. Prototype remains runnable via `npm run dev` on a host allowing loopback sockets. Production work is outstanding as detailed below and in `docs/implementation.md`.

### Pending milestones and completion gates

1. **Spec review and local demonstration:** finish protocol/auth/contracts/security drafts; demonstrate optional decline before configuration, explicit resource/method consent, existing app visibility, revocation, and login-handle behavior. Add realistic usability sessions with first-time users and accessibility/browser checks. Automated unit tests do not establish intuitive UX.
2. **Production identity service:** durable transactional account/email/session store; mail delivery and rate limits; opaque single-use token hashing; scanner-safe magic-link GET; explicit cross-account outcomes; WebAuthn registration/assertion verification, recovery and credential management; audit events. Test concurrency and takeover attempts.
3. **Federated relying-party flow:** registered clients/redirects, authorization transactions, code exchange, PKCE/state/issuer validation, token audience binding, expiration/revocation, safe discovery, and conformance tests with an independently hosted provider. Do not advertise interoperability before this passes.
4. **Persistent storage:** durable grants/preferences/deduplication; isolated app namespaces, quotas, data export/deletion, conditional writes; hosted storage adapter and two-device sync conflict tests. Current demo has account-wide selected-bucket access and no app namespace.
5. **Provider integrations:** Google Drive OAuth scopes/refresh handling, S3 signing/credential isolation, WebDAV capability checks; SSRF defenses and backend-specific consistency tests. Credentials stay provider-side. Provider contract declarations require tested behavior.
6. **Organization subjects:** memberships, scoped delegation, administrator consent, resource ownership transfer/recovery; explicit authorization design before implementation.
7. **Release:** choose protocol name and canonical domain, licensing for first-party code, dependency/version policy, security review, operational backups/restore, and deployment destination. Human approval records remain blank until actually signed.

### Evidence and limits

Node v24.6.0 is available. Initial external shell requests to stack.3sln.com and raw.githubusercontent.com failed DNS; browser access to the requested stack URLs failed. Local sibling projects provide stack source evidence. No secrets were fetched and no remote service was modified. Memory-only fixtures reset on restart. Public identifiers under `*.example` are examples and are not published contracts.

## 2026-10-11/12 — Release expansion: identity, contact capabilities, messaging, Workers

User expanded the actual-release scope to contact tokens, blob messaging, notifications, PWA, recovery, abuse defenses, cold storage, real provider integrations and Cloudflare deployment. User explicitly authorized headless Chrome, Wrangler local testing, Chrome DevTools MCP configuration, creation of `3sln/3sln.me` and direct work on main, plus a publishing workflow modeled on Storia. User requested a dedicated UI red-team agent and a final screenshot walkthrough.

Coordinator delegated deep identity implementation/security review, contact/messaging/notification design and implementation, stack-based release UI, and dedicated adversarial browser work. Heavy messaging/security decisions use GPT-6 Astra with high reasoning; identity/UI engineering uses GPT-6.1 Sol with high reasoning, under the user's request for appropriate intelligence. Coordinator implements Worker bindings, storage integration, infrastructure and release workflow.

### Additional decision register

| ID | Decision / consequence | Human review |
| --- | --- | --- |
| D014 | Contact URLs use `/users/{handle}/message#token=...`, never HTTP URI userinfo. Fragment keeps the bearer out of server URL logs and referrers; API uses Authorization. GET never delivers a message or consumes a token. | Reviewer: ___ Date: ___ Outcome: ___ |
| D015 | Contact tokens are ES256/Ed25519 JWS signed by an entity-specific key and bound to exact live registered grants, collection/MIME/expiry/count/byte limits. Signatures alone do not bypass revocation or quotas. Hosted v0 signing keys are server-custodied and encrypted; user-controlled signing-key portability remains additional work. | Reviewer: ___ Date: ___ Outcome: ___ |
| D016 | Use collections for message grouping, with read status, owner moves/tags/classification, sticky quarantine and bounded declarative rules. Human content and automation blobs share transport but not automatic rendering. | Reviewer: ___ Date: ___ Outcome: ___ |
| D017 | Start with bounded JSON web archives containing HTML/assets; no filesystem extraction, recursive archives or remote fetches. Current renderer reconstructs inert structural HTML and strips all media/style; rich safe asset/data-URL rendering remains release work. | Reviewer: ___ Date: ___ Outcome: ___ |
| D018 | Notifications use transactional outbox and leased delivery; check current unread/quarantine/preferences again immediately before transport. Generic push text by default. Email requires verified destination and consent; unsubscribing invalidates already leased deliveries. | Reviewer: ___ Date: ___ Outcome: ___ |
| D019 | Free account activation requires terms, server-verified Turnstile, passkey or strong optional password, and downloaded recovery-file proof/ack. Recovery secrets/sessions are hashed, single use, and never persisted in browser storage. Pending setup token may live in sessionStorage for same-tab resume. | Reviewer: ___ Date: ___ Outcome: ___ |
| D020 | Cloudflare adapters use sqlite Durable Objects for identity/CAS, abuse windows and account metadata; R2 for message blobs and cold metadata snapshots. Services use ngin actions/queries plus injected runtime resources. No public demo mutation routes on Worker. | Reviewer: ___ Date: ___ Outcome: ___ |
| D021 | Initial identity directory is a serialized global registry for atomic handle/email claims, with bounded account envelopes; scaling/sharding and benchmarking are required before claiming low-cost high-scale readiness. | Reviewer: ___ Date: ___ Outcome: ___ |
| D022 | Seven-day cold-cache eviction is non-destructive and separate from user-requested inactivity/deletion schedules. Automatic permanent deletion remains disabled until notification, grace, activity and backup removal invariants are implemented; requested 2-day/7-day new-account and 1-year age-scaled policies are still release work. | Reviewer: ___ Date: ___ Outcome: ___ |
| D023 | Object storage descriptor publication authority is `https://3sln.me/artefacts/contracts/object-storage/v1`; negotiate read/write/list/range/presign capabilities rather than falsely claiming every backend's conditional writes. Presigned read URLs can remain usable until expiry after revocation; explicit separate permission needed. | Reviewer: ___ Date: ___ Outcome: ___ |
| D024 | Manual publish workflow with tests, dependency audit, real Wrangler/browser tests and machine-recorded release gates. Main pushes run CI; do not publish. User will supply Cloudflare GitHub secrets when ready. | Reviewer: ___ Date: ___ Outcome: ___ |

### Implementation and environment evidence

- Real maintained SimpleWebAuthn verification, Argon2id policy, session/CSRF, mandatory recovery, email proof/link/login services are implemented with injected resources. Mail transport remains unconfigured.
- Contact signing/verification, live quotas/revocation, collection/message/read/move/tag/rules/quarantine, inert HTML/archive validation, notification preferences/leases/unsubscribe are implemented and tested.
- Worker adapter and `wrangler.jsonc` target 3sln.me with Durable Objects/R2 bindings; separate `wrangler.local.jsonc` explicitly enables test CAPTCHA behavior only locally. Production `RELEASE_READY=false` prevents public signup.
- `.mcp.json` configures pinned Chrome DevTools MCP with isolated headless Chrome and telemetry disabled. Installed browser tooling and real local Chrome work. Wrangler local execution is running on localhost:8787.
- GitHub repo created at https://github.com/3sln/3sln.me; Git initialized on main. Storia's manual publish/browser-gating workflow reviewed; corresponding gated workflow prepared.
- Dependency audit caught vulnerable original happy-dom test dependency. Updated to21.0.1; installation audit then reported zero vulnerabilities.
- Actual Worker passkey signup+verification reaches recovery. Real browser found auth DOM input-reuse failure; frontend agent correcting keyed/remounted fields. Password signup exposed Workers' prohibition on dynamic WASM compilation; platform adapter being corrected to statically imported Argon2 module. These findings prevent release claims.
- Security cross-review found archive race, non-atomic deletion/marker, missing method allowlists, JSON primitive handling, abuse alarm race and blob compensation gaps. Fixes and adapter tests in progress; see `docs/release/ui-redteam.md` and release gate file.

### Release state

`release-status.json` is intentionally false. Public provider keys, CAPTCHA production configuration, Cloudflare bot/WAF policy, mail/push transport verification, provider conformance, rich archive rendering, complete federated OAuth/preferences and account-lifecycle delivery/deletion gates remain unresolved. A polished screen is not evidence these features work. Screenshot walkthrough will present actual verified local behavior and these boundaries.

## 2026-10-12 — Cloudflare hosted email resource

User requested Cloudflare-native hosted email and dedicated verify/login/notify/accounts/security sender addresses. Replaced the unused Resend implementation with the structured Cloudflare Email Sending beta binding in `apps/worker/email.mjs`; `transports.mjs` re-exports it without changing the portable injectable identity/notification delivery interfaces. Isolating mail from the Node web-push imports preserves Worker test bundling.

| Decision | Consequence | Human review |
| --- | --- | --- |
| Hosted email policy (provisional) | Bind `EMAIL` with exactly five `allowed_sender_addresses`; `MAIL_ENABLED="false"` by default. Require explicit enablement, binding and canonical HTTPS origin. Provider acknowledgement is not idempotency or exactly-once delivery. | Reviewer: ___ Date: ___ Outcome: ___ |

Coordinator wired the resource into Worker identity mailer and exposes email availability only when configuration admits a transport. Association uses the actual identity `purpose='link'` and `/email/confirm` route; login uses `purpose='login'` and `/email/login`. Links retain fragment tokens, ten-minute expiry and explicit confirmation. Association additionally reminds users to confirm in their requesting browser session. Invalid recipients, control characters, substituted origins and unsupported purposes fail before binding calls; provider errors are replaced with a generic message and an allowlisted code, with no adapter logs or raw secret-bearing errors.

Unread reminders contain only generic text and manual fragment unsubscribe, with allowed `List-Unsubscribe` and no RFC8058 one-click claim. Finite account and security notice templates reserve their requested sender roles, but the hosted reminder dispatcher, lifecycle jobs and security event callers remain unconnected. Templates are currently English; locale selection/catalogue integration remain outstanding. Lifecycle deletion gates are unchanged. Stable retry payloads cannot prevent duplicate external sends after an ambiguous acknowledgement because the documented binding has no idempotency argument.

Verification: all eight new Cloudflare binding tests passed; `npm test` passed **109 tests**. Production Wrangler dry run succeeded and listed `EMAIL` with all five permitted senders and `MAIL_ENABLED="false"`; its first invocation reported an unwritable external log path, so a second dry run redirected logs into `.output/wrangler-email.log` and completed cleanly. No deployment, remote mail, domain onboarding or DNS changes were performed. Mock and bundle results do not establish deliverability.

[Email deployment instructions](docs/deployment/email.md) link official Workers API, binding restrictions, header policy and onboarding documentation. Account owner must confirm Workers Paid/Email Sending beta availability and onboard `3sln.me`, reviewing bounce/SPF/DKIM/DMARC DNS changes, before authorizing live delivery verification and enabling the resource. Email Sending domain onboarding supports the intended transactional-user mail; verified-destination-only Email Routing capability cannot establish public signup readiness. End-to-end delivery, suppression/bounce operations, template localization and release sign-off remain provisional.

## 2026-10-11 — Encrypted recovery-file design

User requested a recovery file encrypted under a key derived from all selected typed personal-information answers, with readable questions and optional hints. [Recovery-file v1 proposal](docs/spec/recovery-file.md) records the exact envelope, authenticated header, combined-answer encoding, normalization rules, browser/service boundary, and required evidence. This is a provisional design, not completed implementation or security approval.

| ID | Decision / consequence | Human review |
| --- | --- | --- |
| D025 | Encrypt the existing independently random recovery credential locally with one key derived from every selected answer; no signing keys or account credentials are derived from PII. Offer an additional private passphrase. Public questions/hints and offline guessing are explained explicitly. | Reviewer: ___ Date: ___ Outcome: ___ |
| D026 | Versioned bounded envelope: fixed Argon2id v19, 64 MiB, three iterations, one lane, random 16-byte salt; AES-256-GCM with independent random 12-byte IV and authenticated question/type/hint/profile metadata. Reject unknown/downgraded algorithms and oversized work before derivation; no weaker fallback. | Reviewer: ___ Date: ___ Outcome: ___ |
| D027 | Typed normalization preserves numeric leading zeros, explicit international phone country code, Gregorian year-first dates, and all selected answers. Text uses explicit whitespace rules and locale-independent lowercasing; exact NFC passphrases are separate. This does not claim full Unicode casefold or universal Unicode-version independence; conformance vectors and supported Unicode repertoire remain release evidence. | Reviewer: ___ Date: ___ Outcome: ___ |
| D028 | Keep answer processing in private browser state and preferably fresh recovery documents that never loaded third-party scripts; use a terminating first-party Argon2 worker and narrowly scoped WASM CSP permission. Same-document CAPTCHA scripts otherwise remain trusted with answers. Preserve existing random-token proof, pending-account confirmation and resumable recovery semantics. | Reviewer: ___ Date: ___ Outcome: ___ |

Design review examined the existing identity `downloadRecovery`, `confirmRecovery`, and `recover` methods, their replay/resume tests, browser asset build, and installed hash-wasm argument types. Primary references are linked in the proposal. Design-only work ran no implementation tests. Coordinator and implementation agents must reconcile any final module/schema/normalization differences here and in the proposal before reporting completion. Human sign-offs remain blank.

## 2026-10-11 — Portable runtime, device management, portal contributions and verified encrypted recovery

Current implementation supersedes the earlier prototype evidence above. The production release remains disabled; the following is verified local work, not a production sign-off.

| ID | Decision / consequence | Human review |
| --- | --- | --- |
| D029 | Hosted outbound mail uses Cloudflare `EMAIL.send`, explicitly gated by `MAIL_ENABLED`, with fixed sender roles (`verify`, `login`, `notify`, `accounts`, `security`) and a Wrangler sender allowlist. Self-hosted adapters use their operator's domain/brand. Provider acceptance is not inbox delivery or exactly-once delivery. | Reviewer: ___ Date: ___ Outcome: ___ |
| D030 | One portable Request/Response application, identity repository, account controller and abuse policy run behind Cloudflare Durable Object/R2 adapters and a single-process Node SQLite/private-files adapter. Runtime capabilities are injected; Node proxy trust and distributed operation require separate implementations. | Reviewer: ___ Date: ___ Outcome: ___ |
| D031 | Contact invitations are signed endpoint URLs, replacing the earlier token/URL duality. HTML GET provides a host composer; explicit token MIME GET mints a separate short-lived bearer; multipart POST sends a bounded blob. Live parent revocation/quarantine/scopes/quotas apply to both delivery paths. Sender annotations remain separate from owner classification. | Reviewer: ___ Date: ___ Outcome: ___ |
| D032 | Multiple passkeys and revocable device sessions share the account authority. Phone-to-TV/device sign-in uses a short-lived request, human confirmation and one-time poll-secret handoff; a QR carries an approval reference, never an owner session. | Reviewer: ___ Date: ___ Outcome: ___ |
| D033 | Portal contributions are statically installed code with deterministic manifests and capability-gated commands; UI receives pure view data. Contextual keybindings and user overrides have a bounded declarative parser. Localization uses actual MIT-licensed `@3sln/bab` source; user content is not translated. | Reviewer: ___ Date: ___ Outcome: ___ |
| D034 | All portal form values are captured into a private browser submission vault; ngin Actions receive opaque operation IDs. Recovery answers/credentials never enter Query projections, preferences, URL parameters or application logs. Fresh recovery documents load no third-party scripts; this is not a sandbox against an already compromised origin. | Reviewer: ___ Date: ___ Outcome: ___ |

### Verified behavior

- Worker and Node use maintained WebAuthn verification and Argon2id implementations. Static WASM imports address Workers' dynamic-compilation prohibition. Signup remains pending until a recovery credential is acknowledged; recent authorization and exact-origin CSRF guard credential/device changes. Interrupted recovery can resume with the original file until replacement setup is confirmed. Verified email is a contact channel until the owner explicitly opts into email login.
- Account operations and cold shelving are serialized through the same account gate. Snapshot readback/hash/owner/version validation precedes atomic metadata eviction. Message payloads are immutable private objects; metadata changes no longer read or rewrite those payloads. The retention/deletion scheduler is still incomplete and disabled.
- Static portal modules, Publications sample CRUD, bab English/Spanish catalogs, context-sensitive commands, chords and shortcut overrides are implemented. The Publications sample is opt-in code, not a publicly deployed feature.
- Encrypted recovery now has one to twelve editable/reorderable questions, typed normalization, public optional hints, a recommended private passphrase, local encryption and a mandatory answer round-trip before account activation. A hint matching its full raw or normalized answer is rejected at setup. Every answer participates; no alternate weaker key slot exists. The downloaded file has only public question metadata and ciphertext, containing the independently random server recovery credential inside.
- A dedicated terminating browser worker derives the fixed 64 MiB/three-pass Argon2id key. Recovery documents and this worker use narrowly scoped `wasm-unsafe-eval`; third-party scripts/frames are excluded. CAPTCHA runs before the fresh restore document; only its short-lived challenge is handed through tab storage, never answers or recovery credentials. The round-trip checks the in-memory encrypted envelope and does not prove a durable filesystem write.
- Cloudflare mail is wired to identity association/opt-in login but disabled by default. Reminder, lifecycle and security template resources exist; their hosted event scheduling/delivery is not yet wired. Node embedders can inject a mail resource. Email templates still need locale integration and live delivery verification.

### Evidence and remaining work

`npm test` passed 124 tests after the encrypted-core/hint changes; Worker integration passed 16 tests; portal Action/Query state checks passed 3 tests; DOM smoke passed. A fresh isolated Wrangler instance passed all 5 real Chrome suites/cases: Node/browser cryptography plus archived seven-type vector, hostile-metadata/wrong-answer/wrong-issuer privacy audit, repeated-submit/navigation cancellation, full passkey setup/assertion, and full password resume/recovery/rotation/contact delivery. CI now includes state and encrypted-browser checks. Browser runner uses a fresh temporary data store and unused port, and redacts signed invitation query material from its saved log.

Independent [recovery security audit](docs/release/recovery-security-audit.md) found no unresolved critical/high defect demonstrated in its scope. This is not a broad release certification. [Recovery-file specification](docs/spec/recovery-file.md) and archived vectors document the exact format, Unicode limitations, offline-guessing risk and implementation boundary. No answer-derived encryption can make public/guessable PII a strong secret. Low-memory mobile performance, live production CAPTCHA, real email delivery and human approval remain unverified.

Production deployment is still blocked by actual release work recorded in `release-status.json`: complete federation/preferences integration and interoperability, provider OAuth keys/flows/conformance, rich HTML/archive asset rendering, hosted push/email dispatch and localization, requested lifecycle notices/grace/deletion, production bot controls, data/record garbage collection and cost/load verification, resolved independent audit findings, and terms/privacy review. Do not enable `RELEASE_READY` based only on the local UI tests. Created Cloudflare R2 buckets are `3sln-me-blobs` and `3sln-me-account-archives`; no Worker/domain deployment has been performed.

| D035 | First-party implementation and documentation use the repository MIT license to permit reuse/self-hosting. Upstream 3sln stack, bab and maintained cryptography sources retain their own MIT notices/provenance. Human confirmation of the release's licensing/publication policy remains unsigned. | Reviewer: ___ Date: ___ Outcome: ___ |

Final screenshot walkthrough: [standalone HTML](docs/walkthrough.html) and [Markdown](docs/walkthrough.md), with reviewed local test screenshots under `docs/walkthrough-assets/`. Recovery images contain readable public metadata and masked/empty inputs, never live answer material or credentials. Current landing, resource, notification and security screens make unavailable capabilities visible. English/Spanish recovery UI entries were added through bab catalogs; user prompts/hints stay unchanged. Narrow-phone/reorder/Spanish-restore verification passed with zero browser runtime errors. The production-config bundle dry run still succeeds with mail and release flags disabled.

Final combined browser rerun after recovery spacing/cancellation/localization changes: **6/6 passed** in a clean temporary Wrangler runtime, including question reorder/mobile/Spanish metadata preservation. The walkthrough's eleven account/recovery screenshots were refreshed from this exact run. The runner no longer streams full Worker request logs to the console and redacts signed query capabilities in the saved diagnostic log.

Final CI browser group includes the repaired signed-endpoint composer fixture and eleven UI fault cases. **17/17 passed** in a fresh isolated runtime after dialog focus/keybinding hardening and the separate notification-email capability flag. Enabling identity verification mail cannot advertise reminder delivery while its dispatcher is unwired. Walkthrough screenshots were refreshed from this final run. Human sign-offs and all production release gates remain unchanged.

## 2026-10-11 — Source publication and remote verification

Committed the reviewed source snapshot to `3sln/3sln.me` main as `75b699e9da25f2eebbfa6d39224d23176009ffec` and pushed under the user's repository/main authorization. [GitHub checks run](https://github.com/3sln/3sln.me/actions/runs/38197748448) completed successfully: dependency audit, unit tests, actual Worker integration, DOM/state checks, production-config dry run and the full isolated Linux/Chromium browser group. This publishes source and documentation only. No hosted Worker deployment, domain activation, live email or DNS onboarding occurred. A follow-up documentation commit records this evidence without changing verified application code.


## 2026-10-11 — Dedicated system-email sender subdomain

User changed the hosted sender domain to `sys.3sln.com`, reserving bare-domain addresses for potential user mail. This supersedes the earlier `@3sln.me` sender examples without rewriting their historical evidence. Hosted Wrangler now explicitly sets `MAIL_SENDER_DOMAIN="sys.3sln.com"` and permits only `verify`, `login`, `notify`, `accounts` and `security` at that domain. Self-hosted defaults remain operator-controlled; account/verification/unsubscribe links remain on the identity app origin. Setup docs now name the sending subdomain and parent DNS zone. No DNS changes, onboarding, mail or deployment were performed.

| D036 | Use `sys.3sln.com` for hosted system senders, keeping bare domains available for user email. Direction explicitly requested by user; configuration verification remains separate from deliverability. | Reviewer: ___ Date: ___ Outcome: ___ |

Verification: all nine focused email adapter/configuration tests passed, including host-origin links with a separate sender domain. Production Wrangler dry run passed with the five `@sys.3sln.com` senders and `MAIL_ENABLED="false"`.


## 2026-10-11 — Reported sender onboarding and live email test

User reported `sys.3sln.com` onboarded and explicitly authorized a test message to their supplied recipient. Created an isolated ignored local Worker with a remote Cloudflare `EMAIL` binding, restricted to the exact test sender/destination and protected against unauthenticated or duplicate invocation. One test attempt from `notify@sys.3sln.com` returned `email sending not authorized for subdomain 'sys.3sln.com'`; no acceptance/message ID was returned. No successful delivery is claimed, and the app was not deployed. Public DNS queries for `cf-bounce.sys.3sln.com` and `_dmarc.sys.3sln.com` returned ENOTFOUND at test time; these alone do not prove dashboard configuration state. Cloudflare documentation confirms Email Sending onboards subdomains separately from routing/apex domains. Updated setup status; mail and release gates remain disabled pending actual authorization and delivery verification. Recipient address and temporary authorization secret are not recorded in public project files.


## 2026-10-11 — Corrected system sender domain

User corrected the intended/onboarded sender subdomain to `sys.3sln.me`. This supersedes D036's `sys.3sln.com` address choice; historical test results above remain unchanged. Hosted sender configuration, allowlist, tests and deployment instructions now use `verify`, `login`, `notify`, `accounts` and `security` at `sys.3sln.me`. Account URLs still use `3sln.me`. The user-authorized test recipient and one-message test intent remain in effect for the corrected domain.


The corrected live test from `notify@sys.3sln.me` succeeded through the real remote Cloudflare `EMAIL` binding (HTTP200, accepted=true, provider messageId returned). This confirms authorization/acceptance for this sender, not inbox arrival or all five sender roles/end-to-end identity flows. No app deployment occurred. All nine focused adapter/config tests passed; production mail and broader release gates remain disabled pending recipient confirmation and outstanding implementation/verification. The temporary test authorization secret was removed after the attempt.


## 2026-10-11 — Recipient confirmed test delivery

User confirmed receiving the authorized test message sent from `notify@sys.3sln.me`. One live Cloudflare binding send is now verified through recipient receipt. This supersedes the earlier unconfirmed-arrival status for that attempt. Authentication mail flows, other sender roles, hosted reminder/security/lifecycle dispatch, suppression/bounce handling and email localization still require their own checks. Production mail and broader release gates remain disabled; no deployment occurred.

## 2026-10-11 — Shared storage plans, billing and search groundwork

User revised the free plan to **500 MB** and requested visible metering. Implemented decimal-byte plan definitions: free 500,000,000 bytes, Plus 5 GB at $5/year, Pro 100 GB at $30/year. The portal shows used, reserved and remaining space, messages/files breakdown, localized annual prices and clear over-limit behavior. Reading, exporting and deleting remain available after a downgrade; positive storage growth is refused. External provider storage does not count as hosted bytes.

| Decision | Direction and current limits | Human sign-off |
| --- | --- | --- |
| D037 | Use the requested annual plans and decimal byte limits. Pricing remains provisional: full Pro payload storage alone is approximately $18/year before billing fees, indexing, operations and support. See [scaling analysis](docs/architecture/scaling.md). | Reviewer: ___ Date: ___ Outcome: ___ |
| D038 | Enforce one account-owned quota across message payloads and hosted files. Durable reservations precede blob uploads; final metadata commits recheck entitlement and expiry. Bounded cleanup retries abandoned uploads. | Reviewer: ___ Date: ___ Outcome: ___ |
| D039 | Keep payloads in R2 and use account-local SQLite indexes for bounded inbox/file pages. Large accounts retain indexed SQLite metadata until a paged cold-archive format is implemented; the old bounded whole-account archive is not a large-account scaling solution. | Reviewer: ___ Date: ___ Outcome: ___ |
| D040 | Polar checkout never grants capacity. Authenticated, replay-protected webhook processing reconciles authoritative provider state, validates configured annual products and applies deadline-bound entitlements. Billing remains disabled with credential/product placeholders. | Reviewer: ___ Date: ___ Outcome: ___ |
| D041 | Search is a derived, owner-isolated FTS index with revisioned durable events, source authorization on every result, tag filters, bounded candidates and semantic provider ports. Query execution reads no payload blobs. Semantic provider deployment, relevance validation and broader source adapters remain pending. | Reviewer: ___ Date: ___ Outcome: ___ |
| D042 | Identity-directory sharding, paged cold metadata, production load/cost benchmarks and complete source-index erasure must precede a large-scale release claim. The current global identity directory and account deletion remain release gates. | Reviewer: ___ Date: ___ Outcome: ___ |

Independent agents reviewed architecture/economics, billing and quota behavior, search source authorization and UI failure states. Fixed post-commit HTTP errors caused by the execution-context variable, stale derived catalogs being treated as source authority, and cold-account queue processing incorrectly producing tombstones. Bounded migration now queues existing valid messages. Metadata edits enqueue work without fetching message bodies; alarms process extraction separately. Runtime mutation queues enforce free/paid queue budgets; legacy backfill obeys the plan queue bound while reserving capacity for new items, and advances independently of catalog migration on alarms. A full queue rejects the source mutation rather than silently omitting search work; this backpressure policy remains provisional. Search currently integrates message sources; hosted-file and arbitrary module source indexing need adapters. Content extraction and indexing have explicit bounds and are not a claim that every byte or unsupported message format is searchable.

No live Polar calls, transactions or application deployment occurred. Credentials, product IDs and provider catalog verification remain operator setup work. See [billing setup](docs/deployment/billing.md), [search specification](docs/spec/omni-search.md), [scaling review](docs/release/scaling-review.md) and [independent storage audit](docs/release/storage-billing-audit.md).

Verification after reconciliation: `npm test`176/176, actual Worker integration16/16, UI state7/7, DOM smoke, Chrome21/21 and production Worker dry run passed. New screenshots were visually reviewed and added to [walkthrough](docs/walkthrough.md), explicitly labeled as API-fault-injection fixtures for billing/search. The PWA shell caches the new public modules and offline tests confirm private account responses remain uncached. No production readiness or deployment is claimed.

## 2026-10-12 — Provisioned semantic search, sharded identity and spend controls

User requested a cheap Workers AI embedder, real Vectorize resources, a financial model, severe account admission limits, and removal of shared hot-path resources. Created the actual Cloudflare indexes `bindle-search-bge-small-v1` and `-s1`, `-s2`, `-s3`: 384-dimensional cosine indexes for the fixed English `@cf/baai/bge-small-en-v1.5` model. Hosted Wrangler binds all four plus `AI`; local defaults do not call paid providers. No application deployment occurred.

| Decision | Direction and qualifications | Human sign-off |
| --- | --- | --- |
| D043 | Explicit owner opt-in for remote English semantic processing. Embed only the first 480 UTF-8 bytes; bounded document/query attempts and conservative spend reservations; lexical indexing survives semantic failure. The current 1,000 upsert ceiling is lifetime attempts, not a recyclable active-vector allowance. | Reviewer: ___ Date: ___ Outcome: ___ |
| D044 | Four fixed account-routed Vectorize shards, no query fan-out; sixteen budget partitions with exact aggregate ceilings and durable prepaid leases. Preserve routing and all outstanding/spent obligations during any later migration; reject silent remaps. | Reviewer: ___ Date: ___ Outcome: ___ |
| D045 | Five independent 64-bucket identity lookup families remove the global directory from ordinary authentication/session updates. Recoverable, token-checked cross-shard uniqueness claims. Explicit fresh-layout gate; no automatic legacy migration. See [identity review](docs/architecture/identity-sharding.md). | Reviewer: ___ Date: ___ Outcome: ___ |
| D046 | Valid CAPTCHA/terms/complete signup must pass IP, subnet, country-region and global windows. Defaults: one per IP/three hours, two/IP/day, fifteen/subnet/day, five/country/hour, twenty-five/country/day, ten/global/hour and two hundred/global/day. A durable 1,000-new-admission rollout ceiling prevents admission growth forever under daily limits; this is not a count of existing accounts. Country comes from trusted Cloudflare metadata, never a client-supplied country header. Unknown regions share a restrictive fallback. Local test configuration explicitly relaxes IP cooldown. | Reviewer: ___ Date: ___ Outcome: ___ |
| D047 | The $5/month/$0.50/day semantic operation ledger is not a provider invoice cap. Recurring stock charges, R2, SQL, ingress, cleanup, support and payment risk remain liabilities. [Cost model](docs/architecture/unit-economics.md) and [calculator](scripts/cost-model.mjs) separate global allowances from per-user marginal cost and model full/heavy use. Requested operator cash-budget preference; provisional guards do not authorize deployment. | Reviewer: ___ Date: ___ Outcome: ___ |

Independent source audits found and resolved corrupt-accounting admission, a lease refill race that resurrected spent credit, and a healthy concurrent identity operation that falsely reported conflict after committing. Global allocations commit before external operations, expired/ambiguous leases receive no refunds, and exact-version routing is persisted. Uneven partitions and unused daily leases can pause service early; no automatic borrowing or budget reset exists. Admission counters are application work controls, not a guarantee that incoming denial-of-wallet traffic cannot generate provider charges. Identity maintenance, metadata retention/purge, physical-byte overhead and production load verification remain explicit release work.

Verification before the subsequent beaming work: full core/Node suite213/213; actual Worker security/contact suite16/16; rebuilt Chrome suite22/22, including semantic consent, mode selection and revocation states using labeled API fixtures. These are local results. Synthetic live Workers AI calls returned 384 dimensions; Vectorize accepted mutations. Early bounded query checks did not observe visibility within their window; a subsequent authenticated Wrangler query found the synthetic probe with cosine score near1. All-shard visibility and eventual deletion verification are still being checked; write acceptance alone is not claimed as complete provider conformance.

## 2026-10-12 — Device names and paid WebRTC beaming in progress

User requested customizable device names, self-device and contact file transfers, multi-file selective acceptance, sender- or receiver-created QR/NFC invitations, and streaming downloads. Nearby QR/NFC pairing requires no prior contact; remote contact delivery needs an explicit beam grant, not generic messaging access. Remote offers notify all eligible recipient devices, with an atomic first-accept claim choosing exactly one device. Self transfers can target a named signed-in device. Contact metadata disclosure is owner-controlled.

Design, backend and browser agents have distinct ownership and are coordinating request/transport contracts. Direct WebRTC data channels avoid hosted payload copies; browser streaming and bounded fallback are under implementation. Cloudflare TURN documentation exposes short-lived credential issuance and per-allocation approximate limits, but no documented enforceable per-tenant byte cap. A declared file size or an application reservation cannot constrain a malicious holder's TURN traffic; relay must remain disabled unless actual enforcement is available. Paid status alone is not sufficient protection against relay costs. Push notification delivery remains a separate unverified gate; an in-portal offer notification is not proof of push delivery.

| D048 | Explicit, single-recipient acceptance of authenticated file manifests; grant-scoped remote contact offers and one-use nearby invitations. Streaming bounded chunks, cancellation and integrity checks; real TURN port prepared with an enforceable-cost gate. Design/implementation/review ongoing, not release-ready. | Reviewer: ___ Date: ___ Outcome: ___ |

Live provider follow-up: the finite synthetic check generated a real 384-dimensional Workers AI embedding and observed it through queries on all four provisioned Vectorize bindings. Visibility required repeated polling and the immediate get/query views were not fully consistent. Synthetic delete mutations were accepted; subsequent listing checks confirmed all four shards contain no synthetic probe vectors. This verifies basic inference/insert/query behavior, not production latency, quality, billing or complete lifecycle conformance. The operator check is reproducible via `scripts/verify-semantic-provider.mjs`.

Root hot-path follow-up: repeated authenticated reads no longer rewrite account owner metadata or activity within fifteen minutes, and warm reads cannot postpone an earlier pending alarm. A native SQLite regression verifies zero repeated activity writes and preserved schedule. The beaming poll scenario and its higher request count are now called out in the economics document; the earlier typical activity inputs are not measured portal usage.


## 2026-10-12 — Work admission, MCP OAuth and conversations

The reconciled runtime suite passed 247/247 before the new MCP/conversation additions. This includes independent concurrency, spend, cleanup and beaming security regressions. Cleanup now backs off after failures and pauses after eight attempts while retaining outstanding ownership; it does not discard data or release uncertain reservations. Native Node alarms claim their scheduled record before executing so a handler can reliably schedule future work.

| Decision | Direction and current limits | Human sign-off |
| --- | --- | --- |
| D049 | Provisional monthly covered-change limits: free 1,000, Plus 5,000, Pro 10,000; service 250,000, allocated through sixteen fixed partitions and durable prepaid leases. Expose usage/reset in the portal. Preserve reads, export, deletion, revocation, privacy disablement and billing upgrades. These counters do not cap every billable request or the provider invoice. | Reviewer: ___ Date: ___ Outcome: ___ |
| D050 | Separate HTTP MCP service and OAuth authority outside Bindle. Explicit collection/action consent, PKCE, audience-bound tokens, live source checks and revocation. Sixty-four fixed authorization shards avoid centralized token introspection. Registered clients only initially; no uncontrolled dynamic registration or remote metadata fetching. Implementation and independent audit pending. | Reviewer: ___ Date: ___ Outcome: ___ |
| D051 | Sender-generated shared conversation secret permits default bearer replies; unequal per-member rights require independent identity proof and signed membership records. A creator coordinator serializes changes; removal rotates the secret for retained members. Initial secret disclosure grants pending invitees bearer authority. Contact revocation does not retrospectively revoke an independent conversation. | Reviewer: ___ Date: ___ Outcome: ___ |
| D052 | Persist all-recipient delivery obligations and show partial/failure states. Local text conversations are the first implementation subset; cross-host interoperability, membership convergence, abuse budgets and full conformance remain release gates. | Reviewer: ___ Date: ___ Outcome: ___ |

Federated mutation journals need a separate admission review before enabling that currently unconfigured surface; read RPCs already avoid outcome journals and payload copies. Ingress, exempt reads, beaming signaling and provider storage liabilities remain outside the covered-change counter. No production deployment or release readiness is claimed.


## 2026-10-12 — App resources and agent adapters: comparative design

User asked for a backed comparison of contributed resources, apps as resources, and importing existing MCP endpoints. Independent high-intelligence review recommends a provisional **apps-as-resources plus optional MCP adapter** direction. See [three-option analysis](docs/architecture/app-resource-options.md) and [independent audit](docs/release/resource-contributions-audit.md). This supersedes a universal one-resource-per-callable assumption in the first draft. Apps may still contribute genuine domain resources; native host modules and direct existing resource methods remain valid without MCP.

| Decision | Direction and qualifications | Human sign-off |
| --- | --- | --- |
| D053 | App state uses whichever resources/contracts the app already has permission to access, app-owned state, or both. Files are one example, not a constraint. Add no separate app-state subsystem. | Reviewer: ___ Date: ___ Outcome: ___ |
| D054 | One owner-specific app connection resource may expose individually granted methods in a pinned generated contract. An MCP importer maps exact upstream tools to safe method IDs and immutable schemas. Reuse existing preference/resource/contract/method grants; a generic tools-call tunnel would bypass that granularity. | Reviewer: ___ Date: ___ Outcome: ___ |
| D055 | Automatic MCP compatibility establishes adapter interoperability only. Unknown tools, changed schemas/revisions, producer disconnect and dependencies require live checks and appropriate owner review. It establishes neither calendar/storage semantic compliance nor permission. Remote code semantics cannot be attested merely by pinning metadata. | Reviewer: ___ Date: ___ Outcome: ___ |
| D056 | Optional stateless/stateful callbacks require a separately authenticated endpoint and a short-lived provider-audience token intersecting approved dependencies and operation budgets. Parent completion closes redemption and reconciles required dependent effects; expiry never manufactures successful writes. This callback adapter remains design work, not implemented capability. | Reviewer: ___ Date: ___ Outcome: ___ |

The separately implemented 3sln HTTP MCP service remains outside Bindle. The portable app/resource adapter and generated contract projection are the Bindle-facing design. No upstream adapter, contribution registry or webhook delegation implementation is claimed yet.


## 2026-10-12 — Reconciled local implementation checkpoint

MCP now has separate 64-shard OAuth authorization, exact collection/function consent, hashed durable credentials, S256 PKCE, audience checks, rotating refresh tokens with reuse-family revocation, and official SDK HTTP tools/resources/prompts. OAuth request admission and bounded cleanup fail closed. Empty operator-reviewed client configuration permits no production authorization flow. Independent review fixed malformed expiry acceptance and avoided holding shard transactions across account/provider work. Revocation stops newly admitted operations; already admitted work may finish. See [MCP audit](docs/release/mcp-audit.md).

Conversations now have encrypted private shared capabilities, independently signed source/membership records, explicit initial invitation MIME and admission, bearer-default replies, per-member restrictions, epoch rotation, threads, bounded durable all-member fanout and honest per-recipient status. Invalid authority/schema/replay requests do not burn normal acceptance work. Source acceptance and recipient inbox copies are separate covered effects; protective restrictions/removal remain available at exhaustion. Independent review fixed source-key and capability-hash binding, cross-conversation message-ID collisions, historical snapshot delivery, and atomic inbox semantic fingerprint receipts across a crash. See [conversation audit](docs/release/conversations-audit.md). General cross-provider discovery/transport/conformance remains gated.

The real Worker conversation check exposed a runtime-specific public-JWK export difference that Node fixtures did not show; explicit public-field construction fixed it. The actual Worker test now verifies signed service creation, bearer delivery, secret-free human inbox rendering and rejection of forged administrator rights. A separate real two-Node-server loopback test verified HTTP peer posting and delivery; neither establishes unrestricted production federation or DNS-rebinding safety.

Independent UI review fixed callback query substitution, stale same-owner thread selection, source-qualified permission/draft identities, non-JSON 401 handling, private state clearing, offline mutation busy state and out-of-order reconnect owner replacement. Real Chrome caught an invalid compound class token that Happy DOM accepted. Consent now renders with no checked defaults, separate destructive warnings and clear deny controls. Reviewed fresh screenshots and updated [walkthrough](docs/walkthrough.md); mocked API records are labeled explicitly. Screenshots normalize document scroll so sticky navigation is captured consistently.

Final evidence: **274/274 runtime tests**, **18/18 actual Worker tests**, **33/33 UI state/audit tests**, **27/27 Chrome browser checks**, plus a focused 5/5 screenshot/layout refresh. Production Worker dry run passed; no application deployment occurred. Synthetic provider vectors were removed from all four shards. TURN relay, billing, full notifications, provider OAuth credentials, general federation, large-account lifecycle and the new upstream app/MCP contribution adapter remain release work. No human approval or release readiness is fabricated.


## 2026-10-12 — User approval: app connection resources and management

User explicitly approved the app-connection-as-resource direction: “app connections as their own resources makes the most sense for me as well,” and requested a place to track and remove/dissociate connected apps. This records approval of D054's resource model only; it does not imply approval of every importer, generated-contract or callback detail in D054–D056. Those implementation/security details retain their separate review places.

| Decision | Direction and qualifications | Human sign-off |
| --- | --- | --- |
| D057 | Track owner-specific app connection resources in Connected apps. Disconnect stops new authorized calls and token refresh for the connection; revoking one agent grant remains a narrower operation. Preserve user-owned data and disconnected history. Fresh explicit consent can reconnect, with a new generation so old credentials cannot regain access. | Resource model approved by user in conversation, 2026-10-12. Lifecycle details: Reviewer ___ / Date ___ / Outcome ___ |

Backend, frontend and independent security agents are implementing/reviewing durable connection ownership, live generation checks and localized management UI. The existing MCP consent is the first implemented connection source; general Bindle login/import adapters remain separate release work.


## 2026-10-12 — App manifest presentation and discovery

User requested app names/icons and other presentation from Bindle manifests, linked PWA manifests, or discovered manifest links in provided app index/auth pages. Added optional Bindle `application` metadata using web app presentation fields plus `web_manifest`, operator-reviewed source URLs, inert bounded parsing and once-per-reviewed-request snapshots. Registered app identity stays visible; presentation does not confer trust or authority.

| Decision | Direction and qualifications | Human sign-off |
| --- | --- | --- |
| D058 | Prefer explicit registered overrides, then Bindle app presentation, then linked/discovered web app manifests. Discovery is bounded and credential-free; missing/unsupported metadata falls back without blocking consent or owner disconnection. | Reviewer ___ / Date ___ / Outcome ___ |
| D059 | Node may opt into a DNS-pinned HTTPS/443 discovery adapter with public IPv4 enforcement and process-local budgets. Cloudflare discovery remains disabled without equivalent verified actual-destination enforcement. Store raster icon references but use safe initials until a bounded raster cache is implemented; never auto-fetch external icons in account/consent views. | Reviewer ___ / Date ___ / Outcome ___ |

Independent architecture/runtime/UI reviews cover revocation generations, pending consent, private-data boundaries, metadata SSRF, inert HTML, credential isolation and graceful partial failures. User approval of the resource model is recorded under D057; these new networking/presentation choices retain separate review points.


Implementation reconciliation: durable app connections now use the existing owner `resource/*` catalog, canonical resource URLs, authenticated client provenance and generation-bound MCP grants. GET `/api/apps` and CSRF-protected DELETE `/api/apps/:id` provide owner management. Disconnect is local and immediate, with no 64-shard revocation fanout; new access/refresh/code admission and final account dispatch recheck the connection. Fresh inspected consent reconnects at a newer generation. Records are bounded and retained as revocation tombstones; owner data and unrelated storage resources are preserved. Upstream tool import and the Bindle grant bridge remain separate work; empty contracts do not claim conformance.

Presentation is pinned during consent inspection. Bounded single-flight collection runs outside authority transactions, with declared metadata available on both platforms. Optional Node discovery is wired behind `APP_METADATA_DISCOVERY_ENABLED=true`, uses only public IPv4 HTTPS/443 and actual-dial DNS pinning, and passed a real MDN index-to-manifest read-only check. No credentials or icon bytes were fetched. Cloudflare external discovery remains disabled; remote icons remain references until a safe raster cache exists. Node quotas are process-local, not an invoice cap.

Final checks for this change: **308/308 runtime tests**, **18/18 actual Worker tests** (including connected-app listing/disconnect/data preservation), **40/40 UI state/audit checks**, **28/28 full Chrome checks**. A subsequent **12/12 focused Chrome check** verified card readability, the v9 public-shell cache and private-cache/session regressions after final polish. Worker deployment dry run passed. Updated screenshot walkthrough uses labeled fixtures. User resource-model approval is recorded; no production readiness or application deployment is claimed.


## 2026-10-12 — Shared callable foundation, browser automation and user commands

User asked for browser automation integration and whether connected apps should contribute portable user commands. Independent architecture and security agents recommend existing resource/contract/method operations as the common foundation, with human UI, HTTP MCP and browser WebMCP as adapters. The recommendation and command profile are recorded in [callables and user commands](docs/architecture/callables-and-user-commands.md), [browser architecture](docs/architecture/browser-automation.md) and [contribution specification](docs/spec/resource-contributions.md).

| Decision | Direction and qualifications | Human sign-off |
| --- | --- | --- |
| D060 | Keep callable business operations independent of MCP and host presentation. Optional declarative user-command metadata requests presentation in a palette, menu, button or supported typed form; do not automatically expose every low-level tool as a human command. | Reviewer ___ / Date ___ / Outcome ___ |
| D061 | Share schemas, validation and business dispatch while retaining separate authenticated owner, OAuth assistant and explicitly enabled browser-session authority. A human confirmation cannot elevate an assistant request or confer persistent automation access. | Reviewer ___ / Date ___ / Outcome ___ |
| D062 | Start native browser automation with the portal's own five collection/item operations, exact session-scoped collection/function grants, trusted mutation review, generation-bound connection checks and abort cleanup. Browser callback metadata establishes no authenticated assistant identity. Cooperative third-party frames, upstream imports and closed-browser execution remain separate work. | Reviewer ___ / Date ___ / Outcome ___ |

Implemented a shared five-operation catalog and explicit Automation hub with English/Spanish strings. Browser grants require deliberate selection, expire with the owner session and retain one-use, argument-bound mutation receipts. Independent audits cover immutable arguments, stale registration, cancellation, malformed grant/receipt records, revocation and caller separation. Unsupported browsers keep HTTP MCP and connected-app management reachable. No arbitrary app command renderer or generic contribution registry is claimed as implemented; that proposed layer will reuse existing grants rather than invent app state or a second permission plane. Production remains gated.

Verification checkpoint: **333/333 runtime tests**, **43/43 UI state/audit checks**, **20/20 actual Worker tests**, and **31/31 full Chrome checks** passed, including one real native WebMCP test against local Wrangler (experimental Chrome flags; no modelContext/owner API mocks). Worker deployment dry run passed. Native discovery, filtered listing, trusted confirmed hosted-file write, byte readback and disable/revocation were verified. An earlier overlapping browser-run attempt overwrote the shared generated test configuration; sequential rerunning removed that test interference and passed. Screenshot review identified raw arguments dominating confirmation; readable operation summaries are receiving targeted polish before the final screenshot checkpoint.

Final polish checkpoint: readable mutation review now shows the operation, collection, file/message identifier, conditional-write semantics, decoded byte size and a bounded inert plain-text preview; exact immutable arguments stay available in collapsed details. EN/ES review labels and metadata summaries are localized. **43/43 UI checks** passed again, followed by **14/14 focused Chrome checks** covering native WebMCP, fixture/unsupported flows and session/cache adversarial behavior. Updated the [screenshot walkthrough](docs/walkthrough.md) with actual native desktop/review images and a labeled mobile fixture. Browser runner now uses a per-run generated configuration/secrets directory to prevent the observed overlap interference. These are local checks; no production application deployment occurred.


## 2026-10-12 — User approval: callable commands and storage without enumeration

User approved the shared callable direction ("Sounds like the right path, let's do it") and explicitly requested that the common Drive/S3/WebDAV object-storage interface omit listing. This records approval of D060–D061's direction, not every future importer, schema or grant-bridge detail. Existing sign-off spaces retain their implementation-review purpose.

| Decision | Direction and qualifications | Human sign-off |
| --- | --- | --- |
| D063 | No public object-storage listing method, permission or capability. Apps retain a known bootstrap key/reference and maintain bounded directory/index objects. Inbox collection listing is separate. Conditional index updates are mandatory where writes are advertised; index/object updates are distinct effects with crash/orphan reconciliation and directory backup requirements. | No-list direction approved by user, 2026-10-12. Detailed semantics: Reviewer ___ / Date ___ / Outcome ___ |
| D064 | Implement the first optional host-neutral user-command projection over pinned callable methods. Trusted host adapters preserve the original immutable caller and use the existing dispatch/grants/journal; bounded inert metadata supplies presentation only. General upstream import and the production authority bridge remain distinct work. | Callable direction approved by user, 2026-10-12. Adapter review: Reviewer ___ / Date ___ / Outcome ___ |

Removed listing from the unpublished object-storage v1 draft artefact, capability descriptions, runtime gateway and demo. Stale stored listing capabilities cannot expose storage `items_list` through MCP/browser access; inbox tools retain their own listing support. MCP tool discovery now intersects exact grants with live source capabilities. External connector verification requires a known small file key and performs an exact read, with no enumeration fallback; UI closes on success, retains failures for retry and excludes hosted resources from external credential verification.

Independent storage review documents provider-ID/bootstrap and atomicity limitations. Google Drive currently has a defensive direct-child read adapter using existing file IDs and internal native enumeration helpers, with mocked provider checks. It has **no completed OAuth onboarding/refresh, write/delete support, logical-key mapping, persisted directory-root workflow or real-account verification**. The portal therefore keeps it unavailable; it is not yet an end-to-end Drive sync integration. See [storage contract and directory model](docs/spec/storage.md).

The first callable adapter and actual federation fixtures are implemented. Independent audit reproduced and fixed mutable nested caller credentials during asynchronous confirmation. Host-neutral invocation and existing portal contributions share dispatch without granting assistant requests owner authority; 17/17 implementation/independent command checks pass. Arbitrary external app installation, generalized renderer and upstream importer are not claimed complete. See [implementation reconciliation](docs/architecture/callables-and-user-commands.md).

Final checks: **356/356 runtime tests**, **43/43 UI state/audit checks**, **20/20 actual Worker checks**, and Worker dry run passed. The existing **31 Chrome checks** passed with the new contract; the added known-file verification check initially needed waits/scoped selectors for asynchronous rendering and duplicate background/dialog alerts, then passed independently. A subsequent focused run passed all **12 native/session/cache checks**, and the corrected verification fixture passed **1/1**, exercising exact key submission, failed-read retry, success close and hosted-button exclusion. No application deployment or production provider conformance is claimed.


## 2026-10-12 — Canonical branding and managed Google Drive

User requested the organization logo from `../.github`; the local checkout is `../dotgithub` (repository `3sln/.github`, revision `458ad44a83a9f4b54136c96ca74122cabd99be8b`). Copied canonical mark, outlined light/dark wordmarks and 512px avatar unchanged. Used the wordmark in the portal, mark/PNG for favicon/PWA/apple touch, and exact PNG as a Cloudflare email CID attachment with escaped HTML and unchanged plaintext. No live mail sent. Inbox-provider sender avatar/BIMI certification remains separate; see [branding setup](docs/deployment/branding.md). Generic self-hosted branding is retained.

User also authorized finishing Google Drive while provisioning credentials. Portable OAuth/PKCE, encrypted owner/session-bound one-use state, refresh, dedicated folders, stable logical keys, immutable uploads, durable generated-ID journals, digest/membership checks, logical deletion and mapping-preserving same-account reconnect are implemented and wired through Account, Worker/Node APIs and localized portal flows. Google credentials remain absent. [Deployment setup](docs/deployment/google-drive.md), [independent architecture/security review](docs/architecture/google-drive-integration.md).

| Decision | Direction and qualifications | Human sign-off |
| --- | --- | --- |
| D065 | Managed Drive writes use immutable provider files and atomic host-owned key-map publication; this is conditionalAuthority=bindle-host, not upstream Drive CAS. Retain old/deleted physical files and ambiguous-operation IDs with explicit bounds/disclosure. Preserve root/map on same-principal reconnect. Disconnect removes local credentials; project-wide Google revocation remains an explicit Google Account action because it affects other clients. | Reviewer ___ / Date ___ / Outcome ___ |
| D066 | User explicitly authorizes the first Cloudflare deployment to attach secrets. Deploy the current public draft/portal with RELEASE_READY=false and production account creation gated. Missing-key MCP is safely unavailable and production MCP stays disabled. This infrastructure deployment does not satisfy or waive public-release gates. | Initial gated deployment approved by user in conversation, 2026-10-12. Operational review: Reviewer ___ / Date ___ / Outcome ___ |
| D067 | Optional resource-scoping metadata describes enforceable controls. Store selected resource + scope privately in the shared preference field; all consumers share this field scope. Project only a resolved scoped resource reference and consumer-specific token with appropriate grants. An owner save reviews exact currently effective consumers/effects; no per-app scope UI or raw parent credentials are introduced. | Field-value/reference/token model explicitly clarified by user, 2026-10-12. Contract/lifecycle details: Reviewer ___ / Date ___ / Outcome ___ |

Independent Drive review fixed late refresh/disconnect resurrection, stale refresh responses, ciphertext transplantation, moved/changed downloads, malformed responses and reconnect publication races. Durable gateway verification caught ranged metadata reporting partial rather than full object size and corrected it. OAuth callback moves bounded data into a private fragment then clears history before rendering; code never enters the Query model. Known-file verification preserves newly refreshed credentials. Tests distinguish fixtures from real Worker boundaries and provider conformance.

The scoped-field model is specified in [resource-scoping.md](docs/architecture/resource-scoping.md) and linked from the preference projection contract. It is proposed protocol/editor work, not a completed general scoping implementation. Independent review clarified effective exact-field authorization and child-relative output sanitization.

Predeployment review found an actual public-cost path: invalid unsubscribe requests could allocate arbitrary Account Durable Objects. Added active-identity checking before dispatch and an independent no-allocation regression. Secret-free production bootstrap tests verify signup503, demo404, unavailable federation manifest/MCP and disabled Google. Both required R2 buckets and all four Vectorize indexes were confirmed present.

Verification: **396/396 runtime tests**, **52/52 UI checks**, **25/25 actual Worker checks**, **36/36 full Chrome checks**, followed by **16/16 focused branding/Google/session/cache checks**, and Worker dry run passed. The screenshot walkthrough now includes canonical branding, inline email preview and labeled Google setup fixtures. No live Google conformance or public release readiness is claimed.