STARTER-03 Prove and automate the full hosted relying-party flow

[KazanderDad]

Parent Goal: #1
Depends on: #3, https://github.com/Cubid-Me/cubid-monorepo/issues/54, and Cubid-Me/cubid-sdk#37
Blocks: Sprint completion

Objective

Complete the end-to-end production SIWC/OIDC flow through the deployed starter and turn its essential contract into repeatable smoke coverage.

Expected Surfaces

• Hosted starter.cubid.me, id.cubid.me, and login.cubid.me/allow.
• Starter smoke/acceptance tests and CI/deployment workflow.
• Ordered redacted trace UI and GitHub evidence.

Scope

• Test first-run state, normal SSO, force login, force consent, callback, token/userinfo, starter session, starter-only logout, state mismatch, missing config, and redaction.
• Use a marked throwaway test identity/client; never a production user's credential.
• Assert the canonical UI marker and SIWC route contract so wrong-project deployments fail.
• Capture screenshots or browser evidence for sign-in, consent, success/session, trace, and logout states.
• Add a recurring or post-deploy smoke that avoids exposing secrets and fails clearly on external blockers.

Non-Goals

• Automated handling of CAPTCHAs or personal WebAuthn credentials.
• Persisting tokens or test-user PII in CI artifacts.
• SDK publication.

Guardrails

• Redact tokens, codes, verifier, nonce, cookies, wallet keys, and PII.
• Verify exact issuer, redirect URI, state, nonce, PKCE, and app-scoped subject behavior.
• Stop on account, quota, billing, permission, or hosted-service failures.

Acceptance Criteria

• A real registered-client flow completes Authorization Code + PKCE, Login/SSO, consent, callback, token/userinfo, session, and starter-only logout.
• Force-login and force-consent behavior is demonstrated.
• Negative state/config paths fail safely.
• The visible trace is ordered and redacted.
• Automated smoke detects the previously observed obsolete deployment and missing-route failure.

Validation Plan

Run starter lint/typecheck/build/tests, hosted HTTP checks, and independent real-browser smoke with screenshots or equivalent visual evidence.

Stop Condition

Commit smoke/test/evidence changes with required logging, attach the redacted hosted evidence, and stop when the parent Sprint can be handed to final vetting/implementation review.

[KazanderDad]

Vetting record — 2026-07-16

• Authorized root checkout: /Users/botmaster/src/cubid/cubid-starter-v3; branch codex/siwc-demo-todos; base main; start after STARTER-02 Deploy the correct starter project and register its production client #3, monorepo #54, and SDK #37. Never remove this root checkout automatically.
• Exact surfaces: hosted starter/Identity/Login consent flow, starter smoke/acceptance tests, CI/post-deploy workflow, ordered redacted trace, evidence artifacts, docs, and branch session log.
• Code/docs/tests: add the narrow repeatable wrong-project/route/flow smoke, redaction assertions, technical docs, and session log before the focused commit. No CAPTCHA or personal-credential automation.
• Validation: starter focused tests, pnpm lint, pnpm typecheck, pnpm build, hosted HTTP route checks, and independent browser coverage for normal SSO, force login, force consent, callback, token/userinfo, session, logout, mismatch/config failures, and redaction.
• Visual evidence: redacted desktop/mobile screenshots for landing/sign-in, Cubid allow/consent, successful session and ordered trace, starter-only logout, plus safe negative state/config behavior. Never persist tokens, codes, verifier, nonce, cookies, wallet keys, or PII.
• Independent validation: after implementation, hosted smoke, session log, and commit, run $issue-validator with issue/Goal/Sprint URLs, commit/deployment, checkout, changed files, commands, full flow results, screenshots, automation evidence, blockers, and non-goals. It reports pass, pass-with-notes, or fail to sprint-orchestrator and comments here.
• Stop with a final cross-repo Sprint handoff after validator report; do not publish SDK packages. Cleanup after merge must preserve the root checkout.

[KazanderDad]

Implementation checkpoint — fixture action required

The public-safe hosted contract smoke is implemented locally with a scheduled/manual CI workflow, focused tests, runbook, and evidence note. Local lint, typecheck, all 26 tests, production build, diff check, and the live credential-free smoke are green. The live smoke confirms the canonical marker, unsigned session, starter-only logout, safe negative callback, and normal/force-login/force-consent authorization launch contracts without printing redirect values, cookies, identifiers, or protocol data.

The remaining acceptance step requires the approved marked browser fixture. Open https://starter.cubid.me/ in Chrome Incognito using only the approved non-personal Cubid test identity. If the Codex browser extension is unavailable there, enable Allow in Incognito for it from chrome://extensions, return to that starter tab, and report fixture tab ready. Do not use a personal account.

No commit has been created and this Task remains In Progress until the real login/consent/callback/session/trace/logout states can be captured with redacted visual evidence.

[KazanderDad]

Hosted validation blocker — Login passkey confirmation stalls

STARTER-03 authenticated acceptance is blocked by a reproducible production Login behavior. On the active Cubid Starter v3 OIDC request, the primary Sign with passkey action enters a disabled Confirming... state and does not resolve, navigate, or surface a recoverable error. The request remains active and the page emits no visible error.

Read-only source inspection shows the primary button invokes passkey authentication with browser-autofill/conditional mediation, while a global loading flag disables all passkey confirmation controls until that promise settles. There is no bounded timeout or cancellation recovery path. The alternative device-specific path uses non-autofill modal authentication, but treating it as the acceptance result would mask the primary-flow defect.

Proposed predecessor: create a Cubid monorepo Login Task under Sprint #49 / Goal #51 to make the active-request passkey action bounded and recoverable, preserve the OIDC transaction through success, add regression coverage for stalled/cancelled conditional mediation, deploy Login, independently validate, then return to STARTER-03.

No credentials, WebAuthn material, tokens, cookies, codes, subjects, identifiers, or PII were inspected or recorded. STARTER-03 remains In Progress; its uncommitted secretless smoke work is preserved.

[KazanderDad]

Dependency handoff: MONO-11 #76 and its time-relative test predecessor MONO-12 #83 were independently validated, merged to the monorepo dev branch via PR #82 at exact merge SHA 6bfb88fd5b29940b0b2cd93b40fdc2731abe94dc, deployed to the affected OIDC/Login production surfaces, and promoted to On dev.

The native #76 predecessor edge is therefore removed as satisfied for STARTER-03. #76 remains open only for the later project-wide dev-to-main lifecycle gate. Resuming the preserved Starter implementation and hosted acceptance now.