Goal: Deploy and prove the canonical Cubid starter integration

[KazanderDad]

Parent: https://github.com/Cubid-Me/cubid-monorepo/issues/49
Brainstorm Task: Capture production SIWC hosted-test evidence and narrowing
Sequence: Goal 3 of 3

Objective

Replace the obsolete starter.cubid.me deployment with the canonical v3 starter and prove the complete production relying-party SIWC/OIDC flow.

Execution Tasks

• Reconcile and merge the existing SIWC demo implementation.
• Deploy the correct Vercel project with an exact registered production client.
• Run and automate the full hosted browser smoke.

Sequence Context

• Depends on: monorepo production protocol boundary Goal and SDK production issuer Goal.
• Enables: Sprint completion.
• Run independently by: a fresh Codex thread in Cubid-Me/cubid-starter-v3 after both predecessor Goals are green.

Non-Goals

• Turning the starter into an app-wide authentication gate.
• Reimplementing Cubid-hosted login, passkeys, consent, or token issuance.
• Exposing API keys, tokens, PKCE verifier, nonce, cookies, or user PII.

Guardrails

• Keep the starter a relying-party educational demo.
• Read the installed Next.js version documentation before code changes.
• Preserve HttpOnly cookie and server-mediated callback handling.
• Stop on Vercel, DNS, client-registration, quota, billing, or permission blockers.

Expected Codebase Surfaces

• Existing codex/siwc-demo-todos commits and dirty working-tree files.
• src/app/api/cubid/siwc/**, src/components/cubid/**, README, env example, and deployment configuration.
• Hosted starter.cubid.me alias and registered callback/client metadata.

Acceptance Criteria

• Production serves the canonical v3 marker and expected SIWC routes.
• A registered-client flow completes discovery, Authorization Code + PKCE, Login/SSO, consent, callback, token/userinfo, starter session, and starter-only logout.
• The developer trace is ordered and redacted.
• Automated smoke detects wrong-project deployment and missing routes.

Validation Plan

Run pnpm lint, pnpm typecheck, pnpm build, route-level checks, and real browser smoke on starter.cubid.me.

Child Tasks

• STARTER-01 Reconcile and land the canonical SIWC demo implementation
• STARTER-02 Deploy the correct starter project and register its production client — blocked by STARTER-01
• STARTER-03 Prove and automate the full hosted relying-party flow — blocked by STARTER-02 and cross-repo predecessor evidence

Risks And Mitigations

• Existing dirty work may overlap the SIWC branch: preserve it and resolve deliberately before PR.
• Wrong Vercel alias/project may recur: assert a canonical marker and route contract in deployment smoke.
• Browser auth may require an operator-controlled fixture: use a marked throwaway client/account and redact evidence.

Stop Condition

Stop when the deployed starter completes the production flow, automated and visual evidence passes, and the Sprint has a final cross-repo handoff.

Vetting Addendum — 2026-07-16

Implementation Worktree

• Repo/root checkout: Cubid-Me/cubid-starter-v3 at /Users/botmaster/src/cubid/cubid-starter-v3
• Branch: codex/siwc-demo-todos
• Base: main
• Shared by: STARTER-01 Reconcile and land the canonical SIWC demo implementation #2, STARTER-02 Deploy the correct starter project and register its production client #3, and STARTER-03 Prove and automate the full hosted relying-party flow #4; run sequentially.
• The existing dirty files are explicitly in scope and must be preserved and reconciled.
• This root checkout is never safe to remove automatically.
• Cleanup owner: sprint-orchestrator via $approved-cleanup after merge, without removing the root checkout.

Update code, technical docs, tests, deployment evidence, and the branch-scoped session log as required. Read the installed Next.js docs before framework changes.

Integrated validation and smoke

Run pnpm lint, pnpm typecheck, pnpm build, focused route/tests, hosted route probes, and the full registered-client browser flow. Capture redacted desktop and mobile screenshots for the canonical landing/sign-in state, Identity allow/consent, successful session and trace, and starter-only logout; include safe negative state/config evidence. Verify the canonical marker, exact callback, issuer/state/nonce/PKCE behavior, userinfo/session/logout, and wrong-project detection.

Issue Validator

After all Tasks, local/hosted validation, session-log updates, and commits, run $issue-validator before moving this Goal to In Review. Provide the Goal/Sprint URLs, commits, worktree, changed files, commands/results, deployment ID and rollback target, hosted smoke results, visual artifacts, and non-goals. The validator checks the complete flow, redaction, credential boundaries, UI evidence, wrong-project regression, docs/tests coverage, and unresolved external blockers; reports pass, pass-with-notes, or fail to sprint-orchestrator; and comments here. A fail returns the relevant Task to implementation.

Stop at In Review; do not publish SDK packages or remove the root checkout.

[KazanderDad]

Orchestrator implementation checkpoint — 2026-07-20

• Re-scanned the live Goal tree before implementation.
• The monorepo predecessor Cubid-Me/cubid-monorepo#51 is green at On dev; its satisfied blocker relationship was removed from STARTER-02 (STARTER-02 Deploy the correct starter project and register its production client #3).
• STARTER-01 (STARTER-01 Reconcile and land the canonical SIWC demo implementation #2) remains natively blocked by SDK Goal Cubid-Me/cubid-sdk#35, which is still Ready and has no open implementation PR.
• STARTER-03 (STARTER-03 Prove and automate the full hosted relying-party flow #4) also remains blocked by SDK-02 Cubid-Me/cubid-sdk#37.
• The shared root checkout /Users/botmaster/src/cubid/cubid-starter-v3, branch codex/siwc-demo-todos, was preserved. Its existing dirty SIWC files remain untouched.
• No Starter implementation or validation was started because there is currently no unblocked Ready Starter Task.

Resume order after the separate SDK agent produces an independently green handoff: #2 → #3 → #4, with independent validation after each Task.

[KazanderDad]

SDK production Identity issuer handoff

SDK Goal Cubid-Me/cubid-sdk#35 has implementation commits ready on codex/sprint-49-production-issuer:

• 1abb7984 - adds checkCubidIdentityIssuerReadiness(...), pnpm auth:issuer:check, CI wiring, tests, acceptance coverage, docs, and API reference output.
• 46bb060c - aligns auth/auth-react/example docs around discovery-first endpoint usage, exact production/staging issuer validation, compatibility UI boundaries, and React acceptance coverage.

Starter configuration guidance

• Production issuer: https://id.cubid.me
• Staging issuer: https://staging-id.cubid.me, only for explicitly staging-registered clients/callbacks.
• New starter examples should use OIDC discovery from the configured issuer and avoid hard-coding issuer-relative endpoint paths.
• https://login.cubid.me should not be configured as the issuer; it is only compatibility UI during cutover.
• Browser config should remain public relying-party metadata only: issuer, client id, callback URI, post-logout callback URI. No Cubid dapp API keys, client secrets, service-role keys, provider secrets, or recovery material should be present in browser env vars.

SDK validation evidence

• pnpm auth:issuer:check passed against https://id.cubid.me, JWKS keys: 1.
• pnpm auth:issuer:check -- --environment staging --issuer https://staging-id.cubid.me passed against explicit staging, JWKS keys: 1.
• Focused auth/auth-react tests passed: 34 tests.
• Acceptance harness passed: 8 files / 12 tests.
• Repo pnpm build, pnpm lint, and pnpm typecheck passed.

No SDK package publication has been performed yet; consume this branch/ref for implementation testing until it lands through the SDK dev/main promotion flow.