[DoodleBears]

Task #2161 | Claim | UAT evidence and limits

Why the change

A recipient should open an invitation, confirm its destination and join that conversation without first managing servers or pairing a computer.

Special things to note

• Merge risk: two-way door, reverting the client leaves existing grants intact; medium blast radius across mobile entry navigation, instance trust and invitations. Review origin binding, recipient-only previews, pending-target recovery and channel-only access.
• Companion TOB #25 is deployed only to UAT at f10437b. Invitations remain recipient-bound locators. QR rendering/save and the combined workspace drawer remain later work; sender native share, new-instance trust/Hosted AuthKit continuation, camera and Android acceptance are still open. The Human authorized integration into main; no production deployment. Remaining product/acceptance scope stays open in Cloud channel UX: source marks, organization navigation and scoped sharing #2161 and the dedicated follow-up.
• Runtime CI passes at 1a2c1c385fd842958a078da05bb85c841d69934e; 32 focused client tests/typecheck pass. The assigned iOS Simulator verified preview, pending/cold restart, exact guest-channel entry, one message, revocation and isolated logout through real UAT. It found and fixed a misleading account label and missing cold-start identity restoration; first failures and the failing-then-passing regression are retained. Synthetic test login does not prove interactive Hosted AuthKit. Evidence commit 8b9c8dba55f13e323274fc728a3116a2df2ad9bb changes no runtime code.

Current-main integration candidate: 9cef15686f9fe7e6a53deecd947501449d3619b9; mobile suite 670 passed / 8 skipped and typecheck passed locally. The first integration CI exposed missing keyboard/safe-area/SVG test shims in statistics settings; the failing test now passes, with no product-code change. A stale local theme dependency was aligned to the pinned version without changing dependency declarations. Fresh integration CI39124731403 passed; merged to main as 38dd1096c98930f6c1c7e446e526cfb5f5019c39. Remaining acceptance: #2186; broader feature work: #2161. Historical native evidence below is tied to its recorded runtime, not a new native acceptance of the updated main.

Change outline

Create or join / no paired computer → Join with invitation
URL or QR input → service domain → unauthenticated discovery
  → explicit trust for a new instance → existing WorkOS login
  → recipient-only workspace/channel preview
  → explicit Join → exact guest channel
  → cold reopen → restore verified identity → same channel/history

Pending target is a local navigation draft, never a grant. Wrong origins cannot receive saved credentials. Acceptance uses existing server authority; a guest never selects or joins the organization. Revocation denies old-session reads and removes the guest destination.

Same Simulator, English/light, 402×874: before 9a2b651 forced the cloud-only user through computer pairing; after final runtime 1a2c1c385 exposes the invitation entry directly.

Before	After

Real invited guest message and subsequent revoked read:

20-second native preview → Join → channel recording. Full evidence includes cold reopen, light/dark, maximum text and the original failures. Own test grant/session were revoked, latest refresh rejected, other sessions preserved, display settings restored and the shared window released. No Prod, native rebuild or new PR merge.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8c5ab283-77b1-4ced-9a58-ccfe8b54115d

📥 Commits

Reviewing files that changed from the base of the PR and between 5e8642f and 678bed9.

⛔ Files ignored due to path filters: 15

• .github/pr-screenshots/2161-invitation-journey/after-preview-dark.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/after-preview-light.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/after-preview-max-dark.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/after-preview-max-light.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/before-entry-light.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/before-inbox-light.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/final-cold-reopen.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/final-entry-light.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/final-join-channel.mp4 is excluded by !**/*.mp4
• .github/pr-screenshots/2161-invitation-journey/final-join-contact.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/final-message-dark.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/final-message-light.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/final-revoked.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/first-accepted-channel-identity-failure.png is excluded by !**/*.png
• .github/pr-screenshots/2161-invitation-journey/first-preview-account-label-failure.png is excluded by !**/*.png

📒 Files selected for processing: 20

• .github/pr-screenshots/2161-invitation-journey/README.md
• .github/pr-screenshots/2161-invitation-journey/proof.json
• apps/mobile/app/(tabs)/(home)/index.tsx
• apps/mobile/app/+native-intent.tsx
• apps/mobile/app/_layout.tsx
• apps/mobile/app/cloud-join.tsx
• apps/mobile/src/cloud/client.ts
• apps/mobile/src/cloud/invitation-link.ts
• apps/mobile/src/cloud/native-intent.ts
• apps/mobile/src/cloud/native.ts
• apps/mobile/src/ui/cloud/channels-screen.tsx
• apps/mobile/src/ui/cloud/invitations-screen.tsx
• apps/mobile/src/ui/cloud/join-screen.tsx
• apps/mobile/src/ui/shell/create-button.tsx
• apps/mobile/src/ui/strings.ts
• apps/mobile/test/cloud-client.test.ts
• apps/mobile/test/create-button.test.tsx
• apps/mobile/test/home-search.test.tsx
• changes/2161-invitation-journey.md
• docs/architecture/cloud-navigation.md

+---------------------+
| sync; sync; review; |
+---------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[DoodleBears]

UAT API/CLI tracer is verified at service f10437bfbe46c4cbcbfb71bc6b599e9551669051 (CI, sanitized evidence): recipient preview does not join; wrong account/anonymous refused; landing reveals no destination; mismatched origin refused before sending credentials; revoked acceptance denied; no organization membership or sibling access. Schemas remain D1/Org/Channel 5/4/5. No Prod or authentication-setting change.

Companion mobile #2169 is Draft. Native invitation acceptance, pending-target restart recovery and before/after screenshots are still pending the assigned Simulator window; real camera QR, QR display/save and workspace drawer remain separate unfinished gates. T1/#3 stays open.

Task: codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9.

[DoodleBears]

Assigned Batch21 iOS Simulator acceptance is now verified and published in DeepSeekBot #2169. Evidence, recording, first failures and limits.

• Runtime 1a2c1c385fd842958a078da05bb85c841d69934e; UAT service f10437b, schemas 5/4/5. Runtime CI passes. Screenshot links render in the PR; video is published. Evidence/doc-only heads have their own CI.
• Deep-link recipient preview, pending cold restart, explicit guest accept/direct channel, one native message and accepted cold reopen pass. CLI independently proves no organization membership, sibling denial and exactly one committed message.
• Revoke blocks the old session and removes the guest channel. Phone refresh/logout revokes only its independent synthetic session, rejects latest refresh and preserves other sessions. Trusted config retained; own private fixture removed, original display settings restored, driver/Metro stopped, shared window released.
• Native QA found and fixed two issues: misleading saved-session label; absent cold-start identity cache hiding the loaded channel. The latter has a failing-before/passing-after regression (32 client tests and typecheck pass); original captures retained.

Still open: sender native copy/share, new-instance trust and Hosted AuthKit return carrying an invitation, real camera/Android; QR rendering/save, unified workspace drawer, organization-wide Agents and remaining umbrella gates. Synthetic login does not prove interactive Hosted AuthKit. No Prod or new PR merge. Task codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9.