The web face of specdossierd serves only the guest: a round's page, its remarks, login and enrolment (`/r/{id}`, `/login`, `/enrol`); `/` answers 404 and desk has no code. Every act of the person who answers for a dossier — open, put a round, hand to an agent, agree, attest, land — is a verb of the CLI run from their copy of the project, because adr-003 holds the agreement as the person's act written in their copy and, as a Hard constraint, that no source of specdossierd agrees, rewrites or opens a dossier; the service never reads the project.
The principal wants the owner to manage dossiers from a web face, for two reasons a local face cannot meet: a face on the server is shared (every participant, a guest included, sees what they owe across dossiers — the-trail's `shared` state) and it serves orchestrated instances, which reach the service and never a person's loopback. A face on the server alone cannot act: the acts that matter happen in a copy the service never reads. The question is how a page on the server leads to an act on the person's machine, by the same CLI verb, with the person's consent provable.
openbyname, a project of the same principal, is a native handler for `openbyname://` (`obn://`) links that acts on the person's machine only as their own declarations allow: a link carries names, never paths; a declared task is an argv array run without a shell, selected by name, and nothing of the link reaches the command (openbyname adr-002); it runs only after the issuer redeems the link's single-use ticket for exactly that project, task and action, and with the issuer unreachable nothing runs; tickets are issued over HTTP only to a subject the consumer's Issuer authenticates and allows (openbyname adr-005); a repository's declaration takes effect only by explicit registration and its tasks only when the person approves its digest (openbyname adr-003). It holds no resident process and no open port: the operating system starts it on the link and it ends with the act.
On 2026-10-07 the principal chose, among the forms characterized in conversation, the server's web face as the owner's face with openbyname as the bridge to the person's machine, with no local web server and no change to openbyname.
THE SHARED FACE IS THE SERVER'S, AND IT PREPARES; IT NEVER ACTS IN THE PROJECT. specdossierd's web face shows the owner their dossiers, their stages and points, and lets them prepare an act: disposition the points and agree, put a round, land (adr-012). Opening a dossier, which names a path of the project, and attesting, which carries a signature made out of band, stay the CLI's. Preparing an act records an intent — the act, the dossier, the round's digest it was prepared against, and its arguments (the dispositions, the agreed digest, the branch, and for a round or a landing the person's own Authorize decision, carried unspent — adr-012) — bound to the person the authority identified, single-use and expiring. An intent is transient, as a round is (adr-003): it is never the record and never names a path of the project.
THE BRIDGE CARRIES CONSENT, NOT ARGUMENTS. The page offers the act as one link, `obn://specdossier/apply?do=run&v=<ticket>`. The service issues the ticket only to the person the authority identified, for exactly that intent and the claim {project = specdossier, task = apply, action = run}, by openbyname's published issuing protocol (adr-005 there). openbyname redeems it against the service; the service answers 2xx once, releases that intent to its person, and logs the redemption in its signed log (adr-005 here). The link names a task; it never carries a dossier, a path or an argument, so openbyname stays as it is.
THE ACT IS THE CLI'S, IN THE PERSON'S COPY: ONE PATH. The task `apply` is an argv array the person declared in openbyname for specdossier and approved by its digest: `specdossier apply`. The verb asks the service, authenticated as the person by the authority's own client, for the intents released to them; validates each against its Nickel contract; and calls the core action the matching verb calls — agree, round, land — refused exactly as that verb would be: an intent prepared against a round digest that is no longer the round's is refused, and one already applied is not applied twice. Whatever the act writes is written in the person's copy, by the person's process; what reaches the service reaches it as the verb already sends it.
THE BRIDGE IS OPTIONAL, AND ITS ABSENCE STILL HOLDS. Without openbyname registered, the page shows the same intent as the command to paste (`specdossier apply`); the act, the checks and the person's copy are the same, and only the evidence that the act came from that page is missing. specdossierd speaks openbyname's issuing and redemption protocols and imports none of openbyname's code.
WHAT THIS REFINES: the invariant «One path of actions, many faces» reads «the web's handler calls that same action» (principal, 2026-09-29, decision 4a). For acts the guest makes on the round (a remark) the handler keeps calling the core's action. For acts that adr-003 holds in the person's copy, the web's handler records the intent and the CLI's verb calls the action: still one path, invoked by the CLI on the person's machine; never a second path, never NCL written by a face.
WHAT THIS DOES NOT DECIDE: the pages of the owner's face themselves; how an orchestrated instance acts for a person (it calls the CLI or the API directly, as `hand` already does, and is never issued a link ticket by default, per openbyname adr-005's synthesis); desk, which would wrap this same face.
An act prepared on the web face reaches the project only by `specdossier apply`, which calls the core action of the matching verb in the person's copy; no handler of specdossierd calls the core's open, agree or land
A link ticket is issued only to the person the authority identified, for exactly one intent and the claim {specdossier, apply, run}, redeemed once, and its redemption is an entry of the service's signed log
No crate of openbyname is a dependency of any crate of specdossier; without openbyname the face offers the pasted command and the act is unchanged
The server's face acts: specdossierd holds a copy of the project and writes the act in it
Rejected: Violates adr-003 (the service never reads the project; no source agrees, rewrites or opens a dossier) and «Responsibility is a person's».
A local web server on the loopback as the owner's face
Rejected: Shares nothing and is unreachable by orchestrated instances; a standing process and port on each machine; browsers restrict a public page reaching the loopback.
A resident CLI watcher applying released intents
Rejected: A standing process that applies what the server releases, with no consent at the moment of the act, is the server acting at a distance.
A handler of its own (specdossier://)
Rejected: Rewrites openbyname for one project and its safety properties with it.
Change openbyname so a task takes arguments from the link
Rejected: Breaks openbyname's invariant «Nothing the URL names is executed» and its adr-002: any page could pass arguments to a command on the person's machine. The intent carries the arguments instead, as data the CLI validates.
A browser extension with native messaging, or the File System Access API
Rejected: The first is installed per browser under each store's policy; the second is Chromium-only, asks on each session, and cannot run git, sign nor the CLI, which breaks «One path of actions, many faces».
Copy and paste the command, with no bridge
Rejected: Kept as the fallback when openbyname is absent; as the only form it leaves no evidence binding the page to the act.