Repair reciprocal Web discovery and safe sign-in resumption #121

Superseded — owner decision, 9 October 2026

Superseded by #143, paired with BostonTechnologies/netratel#180.

The owner has requested replacement of the NetRatel ↔ RatelDesk service-link system with five-minute, single-use pairing codes; address + code → Pair & connect → final tenant mapping/name/capabilities → Save; and View/Test/Delete. This issue is closed as not planned / superseded, recording the design change rather than successful acceptance of the retired deployed journey.

The old proof-bearing browser continuation, reciprocal Web discovery and consent/recovery acceptance are retired with those runtime paths. Ordinary account sign-in and disclosure protection remain required.

The replacement issues now own source implementation, removal of the old runtime/setup records, focused validation, reviewed PRs, required CI, normal merges and next-beta publication. Earlier instructions in this historical issue to preserve the old ceremony/frozen protocol or stop before merge/release do not govern that replacement. Historical evidence below remains unchanged.

The real NetRatel reciprocal-link acceptance against published RatelDesk 0.1.1-beta.9 found that Web-origin discovery returns HTTP 404 at /api/integrations/service-link/metadata. The Web application maps that exact anonymous metadata endpoint, but its earlier /api disclosure filter rejects the path before the handler runs. NetRatel correctly refuses discovery from both initiating roles.

A standalone run of the immutable published Web digest sha256:732130de06c8229ac1d5fc3e14a9ca423468924a51e3f143aded6d3bd05f4ede independently reproduced the 404. Its source is 006381c6f78ac1d37965f52ddc28bff002753055.

Acceptance:

• Admit only the fixed service-link metadata path through the existing Web disclosure filter; preserve all other API exclusions.
• Exercise the actual complete Web pipeline in a live Compose fixture, checking discovery through the Web origin and an unrelated excluded API path.
• Keep both frozen contracts and existing published bytes unchanged.
• Validate and publish a compatible companion prerelease through the existing hosted pipeline, then repeat the actual two-product acceptance.

Follow-up evidence for #119 and #116. NetRatel foundation BostonTechnologies/netratel#164 and epic BostonTechnologies/netratel#141 remain targeted at NetRatel 0.1.1-beta.1. RatelDesk prerelease numbering is independent.

Additional current browser finding: the Web approval entry requires authorization before clearing its proof-bearing query. A signed-out responder can therefore put browser correlation into the ordinary login return URL, and local sign-in returns to /home, losing the approval. The initiating product also needs a protected way to continue that exact retained attempt after the responder signs in.

The same companion correction will clear the incoming query before ordinary Local/OIDC/Hybrid sign-in and expose an antiforgery-protected Continue action for only the original initiating actor/browser session and live awaiting-approval attempt. It will return the retained pinned navigation without new attempts, rights, secrets, expiry extension or database writes. Wrong actor/session, expiry and changed phase must fail. Existing contract bytes, migrations, rate limits and deadlines remain unchanged. Add real Web-boundary proof-redaction checks and actual SQLite/PostgreSQL continuation tests, and review the final expanded diff before all current CI/release gates.

Additional recovery and consent corrections

The same reciprocal-link review identified two companion defects: competing workers can each persist a distinct outbound journal before sending the same lifecycle step, and responder consent details continue displaying the proposal after its organization/customer/scopes have been narrowed.

Persist new journals through the existing attempt Revision concurrency check in the same atomic save, so the losing insert rolls back and recovery reuses the winner’s operation ID and fingerprint. A real PostgreSQL barrier regression covers competing scopes, lost acknowledgements and restart recovery. Show the actual selected/narrowed grants before consent while preserving pinned reverse resource boundaries and saved immutable summaries. These corrections require no migration, shared wire-contract change, rate-limit change or expiry extension.

The focused continuation, Web, rendered consent and PostgreSQL recovery cases have passed locally. The final full suite, all seventeen current hosted checks, immutable beta.10 publication and actual NetRatel interoperability remain required; local fixtures do not establish that public-product acceptance.

Frozen-contract edge acceptance

Independent source audit identified further corrections required before the compatible release: reject numeric strings and explicit null values for nonnullable protocol fields; normalize only typed scope/capability sets for semantic exchange/rotation retries while preserving recorded legacy operations and approved hashes; reject incoherent reciprocal tenant pairs before provisioning; prevent direct manual revocation from bypassing coordinated unlink; honor token expiry from the beginning of the HTTP request; and sweep expired temporary bootstrap handoff fields even when linking is disabled.

The original eight frozen contract/checksum artifacts remain unchanged. Meaningful provider/HTTP/parser/cache regressions and refreshed independent source review are required, followed by the full suite and all seventeen hosted checks on the final head. The 1,875-pass local full run covers the earlier discovery/continuation/journal/consent source and is explicitly superseded as the final release gate by these subsequent audit corrections. No compatible-public-build interoperability result is claimed yet.