feat(web): stage disabled account-link consent

[coreplane-switchboard]

Requested by justin · Thread

Stages a disabled browser adapter and Access–Slack consent UI. A browser can restart failed verification without losing its bounded result retry, while a committed link remains fenced after that window closes.

Why: #2395 adds the consent step after #2401 in the U2 sequence. Record 0081 remains proposed; this PR grants no live linking or cross-surface authority.

Where to look

1. Disabled browser entry Explicit fixture mode requires an exact HTTPS loopback origin; production has no registered route.
2. Protected actions and restart Cookie-bound CSRF and closed forms protect consent; restart rotates the cookie only after a terminal verification. ⚠ A weakened guard could replace an active session.
3. Committed result fence Authenticated inspection retains the claimed marker after the result deadline, while receipt reads expire.
4. Consent and terminal UI Verified identifiers precede explicit consent; only restartable terminal states show the new action.
5. Store and browser proof Memory and SQLite tests cover CSRF, cookie rotation, old-result retry, and committed-session refusal.
6. Living behavior The spec binds local proofs and names the remaining release gates.

Feedback wanted: Check the default-off boundary, terminal restart and committed-result fence, plus the isolated UI’s fit with the ongoing refactor.

Risk: A browser guard error could weaken future linking. This adapter and preview remain unwired. Activation, rate limits, revocation, authorization and history migration require separate review.

Verified: 65 focused tests, bot and web typechecks, scoped consistency checks, exact-head CI and Switchboard LGTM at 81dc0d4 pass. No live linking was exercised.

Decisions (3)

• Keep the browser entry disabled. The fixture requires explicit mode and exact HTTPS loopback origin; no production route, OAuth setup or permissions are added.
• Rotate only after terminal verification. A protected restart replaces the browser cookie without mutating the old intent or shortening its bounded result window.
• Keep committed results fenced. After the result deadline, inspection can deny restart without returning a receipt; a result read still expires.

Validation (5 criteria)

Criterion	Proof
Browser, ceremony, store and UI behavior	Four focused Vitest files passed, 65 tests, including both in-memory and SQLite result-window boundaries.
Type and format safety	Root TypeScript and web Vue typechecks passed; changed-file Prettier and diff checks passed.
Spec and public contract	specs:check, specs:coverage --require, hygiene:check and vocabulary:check passed.
Independent review	Switchboard posted LGTM with no findings at 81dc0d4d8285a83e21180732769e1945b1488864; GitHub auto-approved the same head.
CI at the reviewed head	All reported checks completed successfully or were skipped; no failures or pending checks remained.

[coreplane-switchboard]

LGTM: Staged consent remains disabled; no actionable correctness or spec contradiction found.

Note

Approved · head b57cef8 · no findings

Full review

No actionable findings.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). This repository opted in through its REVIEW_BOT_LOGIN and REVIEW_BOT_ID variables.

[coreplane-switchboard]

Changes requested: Terminal browser sessions cannot initiate another verification.

Warning

Changes requested · head 8acbcf8 · 1 finding: 1 minor

Severity	Finding	Where
minor	F1 Terminal session cookie permanently blocks fresh verification	src/channels/linkBrowser.ts:177

Full review

F1 (minor, high confidence) — After cancellation, failure, or expiry, the browser retains its link: cookie. The page shows a terminal state, while /begin rejects every bound session with 409, so that browser cannot start the fresh verification the UI calls for without manually deleting its cookie. Add a protected way to replace a terminal session while preserving the bounded receipt-retry window.

[coreplane-switchboard]

Changes requested: After the result window closes, a committed session is misclassified as expired and can restart.

Warning

Changes requested · head b6d1211 · 1 finding: 1 minor

Severity	Finding	Where
minor	F2 Spec contradiction — account-link-consent.md item 4: committed session can restart after result window	src/channels/linkBrowser.ts:202

Full review

F2 (minor, high confidence): At the old result window’s deadline, the store returns expired even for a committed intent. The browser adapter then offers and accepts /restart, contrary to the spec’s promise that committed sessions cannot restart. A user with still-valid Access proof can begin another ceremony for the already-linked pair. Preserve the bounded result-read window, but distinguish an expired committed result from an intent that may restart, and cover that boundary in both stores.

[coreplane-switchboard]

LGTM: F2 is resolved: committed intents remain claimed after the result window while result reads expire; no remaining findings.

Note

Approved · head 81dc0d4 · no findings

Full review

F2 is resolved. Committed sessions remain ineligible for restart after the result window closes, while old-result reads still expire. No remaining findings.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). This repository opted in through its REVIEW_BOT_LOGIN and REVIEW_BOT_ID variables.