From fd9c77b92e0d817d349714b62366455a0f28823f Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 29 Sep 2026 09:35:17 +0200 Subject: [PATCH] Decision 47 recorded (R-711 option A: open sign-up closed after the first admin) Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- documentation/architecture/01-topology-and-trust.md | 4 +++- documentation/architecture/09-update-architecture.md | 5 +++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/documentation/architecture/01-topology-and-trust.md b/documentation/architecture/01-topology-and-trust.md index e6621f5d..4edb34e3 100644 --- a/documentation/architecture/01-topology-and-trust.md +++ b/documentation/architecture/01-topology-and-trust.md @@ -134,7 +134,9 @@ controller first (`forwardAuth`), and only a browser holding a gate cookie for t is minted after a valid dashboard session vouched for the browser (a 60-second, one-use token bound to the host, on the dashboard's own `/__gate/start`). The controller is in an app's request path ONLY while its gate is closed; once open, the gate's traefik router is removed and the app is reached exactly as without it. The gate decides who creates -the first admin; it does not decide who may sign up afterwards (R-711). +the first admin. **Who may sign up afterwards** is `09` §3 decision 47 (operator ruling 2026-09-29): once the first admin +exists, open sign-up is closed; only the admin adds people, from the app's own user page. An app that cannot close it +says so on its page. --- diff --git a/documentation/architecture/09-update-architecture.md b/documentation/architecture/09-update-architecture.md index fa1f933c..32235643 100644 --- a/documentation/architecture/09-update-architecture.md +++ b/documentation/architecture/09-update-architecture.md @@ -511,6 +511,11 @@ R-636's louder repeated alarm. request; a gated app answers 500 while the controller is down (closed, not open); a phone app cannot reach a gated app; an app with no probe waits for the household's press, and the press trusts the household. Not covered by the gate: open sign-up after the setup (R-711). Design record: `01-topology-and-trust.md` §5. +47. **Open sign-up is closed once an app's first admin exists** — *operator ruling 2026-09-29 (R-711, option A).* After + the household's first admin exists, a stranger can no longer make an account; only the admin adds people, from the + app's own user page, and the app page says how. Where an app cannot close sign-up, it stays in the catalog and its + page says plainly that anyone who finds the address can make an account; STATUS asks the operator about it. + Mechanism and per-app proof: *(filled in by the 2026-09-29 afternoon session)*. Same day, operator: CC changes the admin passwords of demo-hp's installed bookstack and calibre-web and stores them in the operator's credentials file (not in any repo).