Repository navigation
Mobile: TOB trusted configuration and WorkOS session slice (T1) #2101
Description
Observable path
From DeepSeekBot on a phone with no paired Host, open Cloud services, scan a deployer-verified TOB public configuration, confirm its origin, sign in through WorkOS PKCE, see the initialized administrator, refresh, and sign out of only that cloud session. UAT only.
Parent: BotHarness/tob#2. This is one T1 increment, not closure of T1 or release of T2.
Boundaries
- Separate cloud connection/session owner from existing Host pairing and credentials.
- Pin the full imported connection, compare unauthenticated discovery, refuse changed targets before credential transmission; confirm replacement explicitly.
- System browser, PKCE/state, exact registered development callback, expiring one-use transaction. SecureStore credentials, serialized rotation, failure/restart recovery, local cleanup even if remote logout is unconfirmed.
- TOB owns discovery and auth API; no mobile server key or custom Human token issuer. API/CLI semantics remain aligned.
- Phone builds and Human QR/OAuth actions require the shared device lane. Existing native SDK/build state, disk, CI, source tests and runtime evidence remain distinct.
Acceptance
- Public configuration QR export and mobile import agree with the TOB contract.
- Native login/callback, verified identity, token refresh, restart, own logout and post-logout refusal pass against UAT.
- Unknown/changed origin, malformed config, wrong/replayed state, callback expiry, provider failure and concurrent refresh fail safely in focused tests.
- Existing Host pairing remains usable; cloud operations do not require a Host.
- Actual native screenshots/Human QA and exact build/commit evidence recorded; Android/phone gaps explicit.
Organization creation, owner/member permissions, identity events/revocation propagation and full cross-client T1 acceptance are subsequent work. No Production deployment.
Activity
DoodleBears commentedon Oct 17, 2026
Agent work claim
codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9codex/tob-t1-mobile-auth(DeepSeekBot); companion TOB branch to be recorded with its PR.Tracks #2101 and BotHarness/tob#2.
feat(mobile): allow trusted cloud configuration text import (#2101)
docs: avoid cloud session ADR number collision (#2101)
docs: capture native TOB configuration import evidence (#2101)
test: prepare real UAT sessions for native cloud verification
test: bound native driver diagnostics and require a result
test: handle Hermes async fixtures and isolate simulator targets
docs: record unattended native UAT session acceptance
test: declare native UAT driver contracts for source checks
test(mobile): drive native AuthKit callback with local emulator
docs(mobile): publish bounded native browser callback evidence
style: format browser acceptance report and counters
docs(mobile): record real Hosted AuthKit UAT acceptance
DoodleBears commentedon Oct 17, 2026
T1 real Hosted AuthKit / native PKCE acceptance — 2026-10-18 JST
Task:
codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9; mobile Draft PR #2103./api/mematched the accepted bootstrap identity and trusted configuration.Six inspected screenshots and bounded report; 92-second post-login recording. Credentials/browser callback URLs were not recorded. Evidence commit
459c07d7458f8075ceeec938ab1e28a3eeece44e; product runtime216963322, retained native sourcea0b291907, UAT service1ad3e6605unchanged. No source retest claimed for this media/docs-only update; prior code/tooling CI39064596308 passed.This supersedes earlier “real hosted pending” notes for the successful email/native-PKCE path only. T1 remains open for physical QR and remaining platform/accessibility/native failure acceptance; mobile/CLI organization create/list/switch and owner/member/no-membership rules; retry/reconciliation/identity-event/revocation behavior; deployment/configuration interruption recovery; final review and Human acceptance. T2 and Prod are not released.
Final exact-head CI: verify39068186933 passed at
459c07d7458f8075ceeec938ab1e28a3eeece44e: all three test shards, lint/format/typecheck/build, mobile iOS/Android exports, docs and isolated Host smoke. No deployment.DoodleBears commentedon Oct 18, 2026
PR #2103 is now merged through integration #2157 after Human authorization. Keeping this issue open for the remaining real QR/camera import and explicit platform/Human acceptance boundary; Hosted AuthKit return and session lifecycle already have their recorded native UAT proof. No Prod deployment. Broader identity-event/recovery work remains TOB#2. Task: codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9.
feat(mobile): add trusted TOB UAT import and WorkOS sessions