Compendium · Atoms · Specs & Documents

Specs & Documents

Items

of 1002 total

Atomic primitives in the specs & documents family. Click any tile for the live render, the spec it was built from, and the code that fell out.

Featured 14 Atoms 762 Compositions 240

Atoms · 17

#001 do

SPEC-014 v1.3.0

@author

Authenticate via OAuth

Issue a session for verified Google identities. Reject everything else without disclosing why.

Verified emails create a session
Unverified emails are rejected silently
Sessions expire after 24 hours

SEALED

#002 de

ICS READY

#011 do

Authenticate via OAuth so verified identities can act, and unverified ones cannot — silently.

SPEC-014 · INTENT @platform / 2026-05-21

#012 do

SPEC-014 / v1.3.0

Authenticate via OAuth. Verified emails create a 24-hour session. Unverified emails are rejected silently. Rate-limit at 10 attempts per minute per identity. p99 latency must remain ≤ 200ms.

APPROVED

@platform · 2026-05-21

#281 do

SPEC-014

v1.3.0

#282 do

spec lifecycle

DRAFT
REVIEW
IN-PROGRESS ← HERE
IMPLEMENTED

#283 do

@author

PLATFORM ARCHITECT

spec author SPEC-014

#284 do

URGENT — THIS QUARTER

SPEC-014 / priority

#285 do

line budget TIGHT

75%

SPEC-014 187 / 250 lines

#286 do

feature

new capability, new acceptance

kind SPEC-014

#287 do

SPEC-014 DEPENDS ON SPEC-038

cross-reference spec graph edge

#288 do

TL;DR

Verified Google identities create a 24-hour session; unverified emails are rejected silently; rate limit at 10 attempts per minute per identity. Not in scope: SSO providers beyond Google.

#289 do

spec domains

#auth @platform
#payments @gatekeeper
#notifications @author

#290 do

token cost NOMINAL

4,280 tokens

SPEC-014 13% of 32k context

#291 do

SPEC-014 v1.3.0

Authenticate via OAuth

#292 do

spec touches

SPEC-014 DO + GO

#293 do

NEEDS GOVERNANCE REVIEW

SPEC-014 · readiness @gatekeeper

Criteria & Constraints · 17

#003 do

SPEC-014 / AC 5 CLAUSES

✓ AC-01 Verified email creates a session
✓ AC-02 Unverified email returns 401 within 200ms
AC-03 Session expires after 24 hours of inactivity
✕ AC-04 Does NOT log credentials to any sink
AC-05 Rate-limit triggers at 10 attempts / minute

#004 go

EXHIBIT B / THREAT MODEL v1.3.0

SEV	THREAT	MITIGATION	OUT-OF-SCOPE
HIGH	Credential stuffing on /auth	Rate-limit + lockout @ 10/min	Botnet behind residential proxies
MED	Session token replay	Bind to UA + IP fingerprint	Mobile NAT roaming churn
LOW	OAuth open-redirect	Allowlist redirect domains	Subdomain takeover detection
HIGH	PII in error responses	Sanitise + opaque error codes	Error timing oracles

#007 go

CONSTRAINT HARD

p99 ≤ 200ms

WHY: Auth latency above 200ms causes mobile retry storms.

#301 do

AC-07

GIVEN a verified session WHEN the user posts /checkout THEN tax is computed at the billing-address rate

✓

#302 do

AC-N-03

MUST NOT log credentials or session tokens to any sink WHEN the request body contains an Authorization header

#303 go

4 MIT

Tampering covered

#304 do

EDGE AC-09 leap-second tick skips the cache TTL window

#305 do

Stripe Tax

last probe 03:42 UTC

TAX-2024-08 every 15m

#306 do

GUARD

INC-1842 → AC-12

silent cart-line drop on retry

#307 go

OUT OF SCOPE

OOS-04 cross-region replication consistency

#308 do

FAILURE MODE / FM-03 HIGH

TRIGGER: identity provider returns 5xx mid-flow
BLAST: all new sessions, until IdP recovers
CONTAINED BY: AC-11

#309 do

PASS

AC-08 · CI-7741 · 2026-05-21

#310 go

CONSTRAINTS — SPEC-014

p99 ≤ 200ms payload ≤ 256 KB retention 90d region EU only pii none

#311 do

cart.qty BOUNDARY

probe @ 0 probe @ 100

#312 do

ASSUMPTION ASM-02

Stripe Tax computes rates within 50ms p95 in EU regions

#313 do

PRE session.verified == true

AC-07

#314 do

AC-07

POST session.expiresAt == now + 24h

Analysis & Lint · 17

#005 go

FAILURE MODES & EFFECTS FMEA

FM-01 Auth provider outage — no degraded path defined
FM-02 Clock skew on session expiry between regions
FM-03 Race: two concurrent logins from same identity
FM-04 Localised error string leaks server-side enum
FM-05 Stale OAuth state nonce kept in memory > 5 min

#006 do

- v1.2.0RETIRED

+ v1.3.0APPROVED

## Intent

Authenticate via OAuth.

Session lifetime: 7 days.

Session lifetime: 24 hours.

Rate limit: 100/min.

Rate limit: 10/min per identity.

- [ ] Verified email -> session

#010 do

SPEC-LINTER · FAIL 4 ISSUES

ERR SL001 Missing ## Acceptance Criteria section
ERR SL014 Vague term: "secure" — replace with measurable property
WARN SL022 No negative criteria (does NOT…) found
WARN SL031 Constraint lacks rationale

#014 de

ICS BREAKDOWN SPEC-014

#321 do

// lint finding

SL014 specs/SPEC-038.md:42

Vague term "secure" — replace with measurable property

#322 do

// severity scale

! BLOCKER * IMPORTANT . NICE

Closed set. Every finding is exactly one tier.

#323 do

COMPLETENESS 72/100

0 ICS axis 100

#324 do

ACCEPTANCE COVERAGE 84/100

0 CCS axis 100

#325 do

// SDS strider cell

TESTABILITY

78 ↑ +6

vs last week

#326 do

// CSG conflict UNRESOLVED

SPEC-038 vs SPEC-061

surface auth/session.ttl

SPEC-038 mandates 24h; SPEC-061 mandates 12h

#327 do

// spec health status

HEALTHY WATCH DEGRADED

One pill per spec. Roll-up of ICS, lint, and drift signals.

#328 do

// SCR vitality

specs touched / 7d

#329 do

// spec corpus

READY

DRAFTING

STALE

#330 do

// triggered rules

SL001 requires acceptance section
SL014 no vague terms
SL022 requires negative criteria
SL031 constraint needs rationale

#331 do

LINT SUMMARY SPEC-038

Σ BLOCKERS

Σ IMPORTANT

Σ NICE

#332 do

// lint · 12 runs TREND

8 findings

#333 do

// suggested fix SL014

was

must be secure

try

rejects unsigned tokens within 200ms

Lifecycle · 17

#008 do

SPEC-014 v1.2.0

v 1.3.0

APPROVED

#009 do

@author OWNER

The Governor

DO · AUTHOR

#013 do

SPEC-014 / INDEX 123 LINES

I Intent 012
II Acceptance Criteria 028
III Constraints 014
IV Failure Modes 022
V Threat Model 031
VI Out-of-Scope 009
VII Approvals & Lineage 007

#015 go

RE-SPEC REQUIRED 2/5 TRIGGERS

RX-01 Acceptance criteria changed upstream
! RX-02 p99 latency drift exceeds 20% over 30 days
RX-03 New regulatory constraint applies
RX-04 Downstream consumer added a hard dependency
! RX-05 Failure mode FM-01 fired in production

#341 do

// lifecycle pip

DRAFT

SPEC-341

SINCE 2026-05-14

Open · mutable · not binding

#342 do

// lifecycle pip

REVIEW GATE

SPEC-342

4 REVIEWERS · DAY 2/5

Frozen for reading

#343 do

// lifecycle pip

62% DONE

IN-PROGRESS

SPEC-343 · 5/8 CRITERIA

#344 do

// lifecycle pip

100% GREEN

IMPLEMENTED

SPEC-344 · LOAD-BEARING

#345 do

SPEC-148 / v2.4.1

Legacy session ttl policy. Superseded by tighter audit controls; retained until consumers migrate.

DEPRECATED

SEE SPEC-204 · SUNSET 2026-09-30

#346 do

SPEC-077 / v3.0.0 (final)

v1 telemetry pipeline contract. Closed after the v3 fleet cutover; retained for lineage only.

ARCHIVED

CLOSED 2025-11-04 · LINEAGE ONLY

#347 do

// spec age

14 DAYS

DRAFTED AGO SPEC-347

#348 do

// re-spec window

5 DAYS

RE-SPEC DUE TRIGGER RX-02 · SPEC-348

#349 do

// transition

state → state

#350 do

// ownership handoff

FROM

AUTHOR

→

ARCHITECT

2026-05-21 09:14Z

#351 do

// lifecycle · spec-351

day 1 IN-PROG day 30

#352 do

// version bump

FROM v1.3.0

→

TO v1.4.0

MINOR BUMP

#353 do

SPEC-353 / v1.4.0

Public retention contract. Visible on the consumer portal; pinnable by downstream callers from this moment.

PUBLISHED

2026-05-21 · v1.4.0

— Full detail →

—

// source

Alpha · Honest about it

The framework is real.
The community is forming now.

DoCoDeGo is in Alpha. The framework is documented, the practices are battle-tested at small scale, and the next release is being shaped in public.

If it produces anything, it should produce engineers and teams who think more clearly about what they are building and why.

Two doors in

Join the Discord

Discord is where specs are debated, the framework gets sharper, and decisions land in writing. The conversation is the artefact.

Specs & Documents

Authenticate via OAuth

Authenticate via OAuth

The framework is real.The community is forming now.

The framework is real.
The community is forming now.