# Local Home operator seed and provisioning Status: design approved by configured Claude Fable (`claude-fable-5`, provider event metadata verified), 2026-09-08, exact reviewed commit 898fe219f4da5092b2cc28210b344ede6a478e50. Home discussion 37 retains the verdict and earlier quota/permission refusals. This branch starts at directory runtime171. It defines an application package and local command protocol; the companion `home-provisioner.md` defines the authority adapters and staging proposal. No implementation, platform117 or live provisioning approval is implied. ## Contracts and scope The governing sources are Home spec §7, §10, §14 and rulings 8, 22 and 23 in `docs/superpowers/specs/2026-08-30-home-design.md`; approved directory design fa64e286990762aecc6913bb9076a3cb75b088c3, `implementation/team-directory.md` (Home discussion 24); approved roster contract 4e7b3ff, `implementation/roster-contract.md` (discussion 28); and approved producer 32fb49c1d5a4f0317b7291f441f78e21b7f0a11c, `implementation/roster-producer-storage.md` and `internal/home/directorydata/roster_migrations/migrations/0001_roster.sql` (discussion 33; use the migration embedded by RosterSchema if its filename changes). Shared roster 667dc8218dd5 supplies Provisioning, SignProvisioning and VerifyProvisioning. HTTP runtime design 5fbfdf0 is a separate integration review, not authority for this writer. Home discussion 35 records the source audit. The credential role alone resolves an address with its pepper. The directory alone creates teams and memberships. An audited operator selects an approved sealed request and its intended owner; a browser assertion, a visitor, an instance bearer and the platform account owner alone supply no team-owner identity proof. The operator transport authenticates the operator's authority to run an approved action on this exact deployment. The credential receipt below binds the intended owner across roles. This preserves the operator seed exception in §14; it does not assert that provisioning is a browser fresh-owner ceremony. This slice supports generation initialization when no generation or consumer exists, a new team with its first owner, initial consumer provisioning and activation. It provides no roster editing, token rotation, restore, owner confirmation, key rotation, sibling owner seeding or ownership transfer command. Those require their own reviewed operation and fresh-owner rules. In particular, missing generation alongside existing consumers is a refusal, never a repair. ## Transport and command boundary Platform discussion 117 owns stopping traffic and all background work, holding the database lease, selecting the immutable executable and exact database, and resuming safely. Its private-input/result protocol is generic. The proposed entry point is `home operator-v1 --db `, with standard output captured as the private result by the transport. The fixed command and role permissions belong to reviewed deployment configuration. No request chooses a binary, path, SQL, environment variable, shell fragment or network destination. The command never starts an HTTP server, sends mail or makes network calls. Read one UTF-8 JSON object from private stdin with a 64 KiB hard limit including whitespace, then require EOF. Write one JSON result of at most 64 KiB to the private standard-output channel only, after transaction commit. The transport never tees or logs stdout and discards stderr. Input and result are encrypted at rest by the transport, available only through its authenticated private result channel, and never included in public status, receipts or logs. The application does not implement its own remote encryption protocol. Within the signed private wrapper defined in home-provisioner.md, operation-input common fields are `version:1`, `operation`, and `operation_id` (random canonical 32-byte base64url). Operation-specific closed objects are specified below. Reject unknown or duplicate fields, trailing JSON, alternate numeric forms, invalid UTF-8, malformed canonical base64 and oversized decoded values before mutation. Strings are bounded before allocating their decoded contents. No error includes supplied values. Exit 0 means a complete committed result is available; exit 2 is fixed refusal and exit 3 unavailable/ambiguous. Neither exit code permits automatic mutation retry. The platform queries the original result or explicitly reruns the exact input under a fresh fence; Home idempotency then returns the committed result without performing the action again. The invocation must be authorized outside the request. The local adapter accepts an immutable operation allowlist and expected role/origin/database identity from reviewed launch configuration. A request's `operation` only selects within that allowlist. Package constructors are private to the command adapter or receive an opaque validated operator context; exported structs cannot fabricate that context. The transport's operation ID is distinct from Home operation_id. Both must be bound by the adapter's verified invocation context. Current platform source has no signed Home invocation receipt, and this design does not assert otherwise. No body field can claim an operator identity or maintenance state. The platform must provide an authenticated invocation context or equivalent private launch configuration before command wiring is approved; an environment boolean supplied by the caller is insufficient. ## Keys and durable private results Use the existing Rastrillo family key encoding and crypto.Sign/Verify operations, with strict canonical key decoding and derived key IDs. Reuse shared seal for stored private envelopes. Do not copy signing arithmetic or browser assertion validation to create operator authority. Credential operator signing uses a separately provisioned private key and context `oficina/home/owner-seed/v1`; the directory pins its public key outside every receipt. Directory provisioning signing uses its separately provisioned operator key and shared context `oficina/roster/provisioning/v1`. Roster response keys are also distinct. Keys arrive through the existing protected per-instance config mechanism; runtime browser assertion keys and existing data keys remain unchanged. Ordinary startup neither creates nor rotates any of these keys. Reject identical public keys across the roles within the command's configured material. Public key pin replacement is an explicit future operator migration, not an input field. Add role-specific operator result tables through additive migrations. Credential and directory databases never receive each other's tables. Each result row has operation_id primary key, fixed action, opaque operator reference from verified invocation context, creation time, a keyed request digest, and a sealed result. The request digest is HMAC-SHA256 using an independently provisioned 32-byte idempotency key. The actual shared sealer exposes Seal/Open, not a key derivation API. No custom KDF is introduced. Digest canonical typed operation input, not raw JSON whitespace. This prevents a stored bare address/name digest becoming an offline dictionary. Seal result bytes with the existing role sealer and purpose `operator.result/v1///`. A result can contain an authority-bearing receipt or bearer and therefore never appears plaintext in SQLite/WAL, logs or public receipts. Never persist the original address/input. Repeated exact input under the same operation ID returns the stored result; changed semantic input or different action refuses. A lost post-commit response therefore does not mint a new bearer, person or receipt. Keep successful result rows until an explicit reviewed retention policy exists; no rolling cleanup may make an old operation reusable. This initial low-volume administrative table has a hard 10,000-operation limit, refusing further new operations at capacity. The existing roster_operator_receipts table retains its approved public metadata shape and SHA256 digest of the signed provisioning record; no bearer, display name, input digest containing address material or private result belongs there. The new directory result row and that receipt commit in the same transaction. Private results are bounded to 48 KiB before sealing, leaving transport space. ## Operations All origins come from validated configuration or must equal it exactly. Production team destinations reuse the compiled registry and canonical label policy from `directoryFeatures` and `directorydata.Config.ValidateRoute`; for Docs the origin is `https://