Task: Run Preview signed-in OTP wallet smoke

[KazanderDad]

Parent Goal: #79
Depends on: #74
Blocks: Preview wallet/pay-link smoke confidence

Objective

Run Preview signed-in wallet smoke using manual/agent-assisted Gmail OTP retrieval for hubert.cormac@gmail.com.

Expected Surfaces

• Gmail browser/session for hubert.cormac@gmail.com
• Vercel TCOIN Preview deployment
• /tcoin/wallet
• /tcoin/wallet/dashboard

Scope

• Request OTP in Preview.
• Retrieve OTP from Gmail browser.
• Confirm dashboard renders after sign-in.
• Record evidence on Goal Goal: Prove Preview sandbox smoke and Buy TCOIN sandbox #79.

Non-Goals

• Do not build automated OTP fixture in this sprint.
• Do not use Apple Mail as the primary OTP retrieval path.

Guardrails

• Avoid logging OTP values in durable public comments.
• Capture pass/fail evidence without exposing sensitive codes.

Acceptance Criteria

• Preview sign-in succeeds for hubert.cormac@gmail.com.
• Dashboard renders and basic authenticated state is visible.

Validation Plan

• Manual/agent-assisted browser smoke.
• Gmail OTP timing and result note on Goal Goal: Prove Preview sandbox smoke and Buy TCOIN sandbox #79.

Stop Condition

Stop after authenticated Preview smoke evidence is captured or OTP delivery/auth blocker is recorded.

[KazanderDad]

Vetting Note

This issue is part of Sprint #78 and is vetted for the shared implementation branch/worktree below.

Implementation Worktree

• Repo: GreenPill-TO/Genero
• Base branch: origin/dev
• Worktree path: /Users/botmaster/src/greenpill-TO/Genero
• Worktree branch: codex/tcoin-production-launch-readiness
• Use this same worktree for related Sprint Sprint: TCOIN production launch readiness #78 issues: Goal: Align hosted release environments and remote Supabase readiness #74, Goal: Prove Preview sandbox smoke and Buy TCOIN sandbox #79, Goal: Prove Supabase-side worker scheduling #80, Goal: Prove Production smoke and live Buy TCOIN gate #81, and Tasks Task: Configure GitHub Environment secrets and vars for TCOIN release alignment #82-Task: Enforce live Buy TCOIN approval gate and disabled fallback #93.
• Worktree owner: Sprint Sprint: TCOIN production launch readiness #78 / sprint-orchestrator.
• Retain until: Sprint PR is merged and approved-cleanup completes.
• Cleanup owner: sprint-orchestrator via approved-cleanup.
• Do not implement the parent Sprint issue directly; implement unblocked Ready Task issues first, then validate their parent Goal.

Implementation Expectations

• Update code, docs, tests, and agent-context/session-log/ as relevant to the issue.
• Capture evidence directly on the relevant Goal issue, not in a separate evidence packet.
• Never print or persist secret values.
• Do not run linked Supabase writes without explicit just-in-time human approval.
• For UI/browser smoke, provide route/result notes and screenshots or comparable visual evidence when practical.

Issue Validator

After implementation, local validation, session-log update, and commit, the orchestrator must run issue-validator before moving high-risk Tasks or Goals to In Review.

Validator input should include: issue URL, parent issue URL, commit hash, worktree path, changed files summary, validation commands/results, smoke evidence, visual evidence where relevant, non-goals/guardrails, skipped checks, and residual risks.

Expected validator output: pass, pass-with-notes, or fail, with concise evidence and required fixes. The validator reports back to the orchestrator; the orchestrator moves Project status only after validation passes.

[KazanderDad]

Implementation progress for #86

Commit: 4f9203921c7af5e585001d9632983033ea17f0a5

What was observed on hosted Preview:

• Chrome can access https://tcoin-git-dev-cubid-team.vercel.app/tcoin/wallet while headless/non-authenticated smoke is blocked by Vercel Deployment Protection.
• /tcoin/wallet/dashboard renders the unauthenticated wallet preview state.
• The auth modal requested OTP for the target test identity and Gmail received the Supabase Auth email.
• The code was entered without recording it in durable comments/logs.
• The hosted app then looped in post-auth provisioning with Unauthorized from the authenticated user-settings ensure-user path, so the dashboard did not complete signed-in smoke on the current deployed build.

Code fix in this branch:

• shared/lib/edge/core.ts now accepts an explicit internal access-token override and prefers it before polling the global Supabase session.
• user-settings ensure-user and fetchUserByContact(...) can receive that explicit token.
• Wallet and SpareChange sign-in pass the freshly verified OTP session token into post-auth user provisioning.
• useAuth user reconciliation passes the current access token as well.

Validation:

• pnpm exec vitest run shared/lib/edge/core.test.ts app/tcoin/wallet/components/modals/SignInModal.test.tsx
• pnpm exec tsc --noEmit --pretty false
• pnpm lint
• git diff --check

Status: implementation is ready for deployed Preview validation, but #86 should remain In Progress until this branch has a Preview deployment and the signed-in dashboard smoke passes there.

[KazanderDad]

Additional #86 PR Preview smoke evidence

PR: #96
Latest commit: 65d26af99c6e6b10f5fbb90e8cbe65f5b8f3d7d6
Preview URL tested: https://tcoin-git-codex-tcoin-preview-smoke-buy-cubid-team.vercel.app

What passed:

• PR Preview TCOIN deployment became reachable in Chrome.
• /tcoin/wallet/dashboard rendered the unauthenticated wallet preview state.
• Auth modal requested a fresh OTP for the test identity.
• Gmail received the Supabase Auth email.
• The OTP was entered without recording the code in durable comments/logs.

What still fails:

• The PR deployment remains stuck after OTP with Failed to finish authenticated user provisioning: Unauthorized from the authenticated user-settings /auth/ensure-user path.
• The dashboard does not complete signed-in smoke yet.

Current assessment:

• The Next.js-side token handoff fix is implemented and deployed in the PR Preview, but it is not sufficient by itself.
• The remaining blocker is Preview Supabase Edge Function/runtime alignment for user-settings /auth/ensure-user, including confirming the deployed Edge Function version and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY in the Edge runtime.

Validation already run locally:

• pnpm exec vitest run shared/lib/edge/core.test.ts app/tcoin/wallet/components/modals/SignInModal.test.tsx
• pnpm exec tsc --noEmit --pretty false
• pnpm lint
• pnpm test
• pnpm build
• git diff --check

Status: keeping #86 In Progress. Do not start #87 until this signed-in Preview smoke passes. Repairing/deploying Preview Supabase Edge Functions is a linked Supabase action and needs just-in-time approval.

[KazanderDad]

Preview signed-in OTP smoke is now green after the approved user-settings Edge Function/runtime repair.

Evidence:

• Cleaned up merged PR [codex] Fix Preview OTP provisioning for TCOIN smoke #96 and verified local dev fast-forwarded to 99f74c6.
• Preview Supabase project: GeneroDev (uyopiuwmlhbevoxmfvfx).
• user-settings Edge Function deployed successfully as version 13 with verify_jwt=false.
• Supabase dashboard/CLI confirmed this account can read but not manage custom Edge secrets, so the repair uses Supabase-hosted SUPABASE_PUBLISHABLE_KEYS plus exact-match TCOIN CORS fallbacks instead of requiring a custom secret write.
• Chrome hosted smoke on https://tcoin-git-dev-cubid-team.vercel.app/tcoin/wallet/dashboard: signed out, requested a fresh OTP for the approved test account, submitted the code, reached authenticated welcome/setup, then loaded the authenticated wallet dashboard showing the test account, balance panel, and Home/Receive/Send/Contacts/History navigation.

No OTP value or secret value is recorded here.