Prod validation receipts — 2026-08-19 sign-in feedback (v0.2.17)

[justinhelmer]

Prod validation receipts for the 2026-08-19 user-testing feedback on CLI sign-in, shipped as v0.2.17 via #49 (per-provider login picker), #51 (direct-to-provider OAuth routing), and #53 (terms/privacy notice at account creation).

All agent-executable checks ran against the published npm artifact (@coreplane/polylane@0.2.17, dist-tags.latest, published 2026-08-20T01:10:52Z) talking to production (api.polylane.com / console.polylane.com), in a PTY with the browser-open call stubbed and every account-creating action cancelled at the gate — no prod data was created.

V	Check	Evidence	Prod
V1	Released artifact contains all three fixes	npm latest = 0.2.17 (Release run, CI at release commit); shipped bundle greps: notice text ×1, both gate lines ×1 each, signupEntry||n.provider routing, value:"google",label:"Google" ×2 (login + signup pickers)	✅ 2026-08-20
V2	auth login shows five separate options	PTY capture below: Google / GitHub / Email / Device code / API key, each its own entry	✅ 2026-08-20
V3	Provider pick opens the direct-to-provider console entry, not the signin page	Stubbed open received https://console.polylane.com/signup?redirect=%2Foauth%2F…&provider=google and …&provider=github (full URLs below); GET /signup and /signup?provider=google → 200	✅ 2026-08-20 (agent side; browser hop is V6)
V4	Terms/privacy notice + gate at every account-creating path	Captures below: OAuth signup gates with "Press Enter to create your account, or Ctrl-C to cancel." before any browser call (stub log shows zero opens from signup); email path gates with "Press Enter to continue…" before the signup POST; scripted --dry-run --email --password prints the notice with no gate; verbs kept separate (agree → Terms, acknowledge → Privacy)	✅ 2026-08-20
V5	Notice links resolve	https://polylane.com/terms/ → 200, https://polylane.com/privacy/ → 200	✅ 2026-08-20
V6	[human] Signed-out browser hop: provider pick lands directly on that provider's OAuth, then back on CLI consent	Open the V3 URL in a private window → should land on accounts.google.com (or github.com/login) with no console signin page, and return to the CLI consent screen after auth	✅ 2026-08-20 (manual, @justinhelmer)

V2 — picker capture (v0.2.17, PTY)

◆  Sign in (or sign up) with
│  ● Google (opens your browser)
│  ○ GitHub
│  ○ Email
│  ○ Device code
│  ○ API key

V3 — stubbed browser-open URLs (truncated at scope list)

STUBBED-OPEN: https://console.polylane.com/signup?redirect=%2Foauth%2Foauth_client_db0e300c0001s66dhw481fxn%3Fclient_id%3D…%26redirect_uri%3Dhttp%253A%252F%252Flocalhost%253A18991%252Fcallback%26scope%3D…%26response_type%3Dcode&provider=google
STUBBED-OPEN: https://console.polylane.com/signup?redirect=%2Foauth%2F…&provider=github

V4 — gate captures

OAuth signup path (cancelled at gate; browser stub log unchanged, so nothing opened):

◇  Sign up with Google ─────────────────────────────────────────────╮
│  Pick "Google" there, then approve the CLI's access when asked.   │
│  By continuing, you agree to the Terms of Service and acknowledge the Privacy Policy:
│    https://polylane.com/terms/
│    https://polylane.com/privacy/
◆  Press Enter to create your account, or Ctrl-C to cancel.
^C

Email path (cancelled at gate, before the signup POST):

◇  Email  prodval-receipt@example.com
◇  Password  ▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪
│  By continuing, you agree to the Terms of Service and acknowledge the Privacy Policy:
│    https://polylane.com/terms/
│    https://polylane.com/privacy/
◆  Press Enter to continue, or Ctrl-C to cancel.
^C

Scripted path (auth signup --email … --password … --dry-run, stdin closed): notice printed, no gate, request stubbed, exit 0.

Notes

• The OAuth-signup note still says "Pick "Google" there" — stale now that the signup page auto-starts the provider; tracked as a follow-up in the #51 stack-position note.
• Review follow-ups deferred with reviewer agreement live in the resolved threads on #49 and #53.

This issue closes when V6 is checked off.

[justinhelmer]

V6 verified manually by @justinhelmer (2026-08-20): signed-out browser hop from a provider pick lands directly on that provider's OAuth and returns to the CLI consent screen — no console signin page. That completes the checklist: V1–V6 all ✅ against @coreplane/polylane@0.2.17 in production. Closing.