feat(console): real consent flow with field narrowing, time limits, and grant binding

CONSOLE-BRAND-ICONS-REPORT.md

@@ -0,0 +1,32 @@
+# Console brand icons report
+
+## Delivery
+
+- Vendored `@pdpp/polyfill-connectors` from data-connectors commit `a39f33e6bbd3ba6c73af9e5512fc945beb3cc1d2`.
+- Tarball SHA-256: `12fba07a33dfe34ba709346c3501f01bc55675afae31f1df98715ee03fa7a5c2`.
+- Updated the root lockfile integrity and `reference-implementation/vendor/SHA256SUMS`.
+- The reference server projects the vendored manifest `brand` declarations at `/connector-index.json`. The endpoint returned 45 `brandIcons` entries in the rebuilt preview.
+- `ConnectorIcon` reads only that index, chooses `darkUrl` under `data-theme="dark"`, and uses Monogram when an index entry is absent or its image cannot render. It is used by Sources, Explore, source detail, and consent rows.
+- Removed console consumption of the previous inline manifest-icon value. No connector-specific SVG assets remain under `apps/console`; the remaining `app/icon.svg` and `public/brand/pdpp-favicon.svg` are application identity assets.
+
+## Validation
+
+- ConnectorIcon unit test: 7 passed, 0 failed.
+- Changed Sources model plus consent contract tests: 118 passed, 0 failed.
+- Console typecheck: passed.
+- Full console suite: 2,168 passed, 149 failed. The failures are pre-existing worktree-layout failures: tests require absent sibling `packages/polyfill-connectors`, `packages/pdpp-brand`, and `packages/operator-ui` paths.
+- PostgreSQL consent journey oracle: 13 passed, 0 failed; consent challenge persistence oracle: 1 passed, 0 failed. Both used a disposable PostgreSQL 16 container and its provisioned test sentinel.
+- Production console build in the `core` image: passed.
+
+## Visual inspection
+
+Captured `/sources?demo=mixed` at 1440px and 390px in light and dark under `~/.tmp/` using the local preview and checked the DOM theme attribute and ConnectorIcon output. The valid declared icons rendered on both viewports and themes. Two upstream SVGs observed in the demo (Gmail and Chase) omit an XML namespace and Chromium reports zero intrinsic width; the component degrades these to Monogram instead of showing a broken image.
+
+The preview had no seeded consent challenge, so a populated consent-page capture could not be made without manufacturing authorization data outside this change. Consent row rendering is covered by the source contract test and shares ConnectorIcon.
+
+## Image
+
+- Disk gate before build: 182 GB available on `/`.
+- Tag: `pdpp-console-brand-icons:a39f33e6`.
+- Image ID: `sha256:ba35b10ec32478f678a6384edc5b03bccace116d6ce4ffdd6ea035e22ed1784f`.
+- No running image or production container was swapped.

DC-IMAGE-BUILD-REPORT.md

@@ -0,0 +1,62 @@
+# DataConnect hosted-image build report
+
+## Root cause
+
+The failed build was caused by host disk exhaustion, not by vendored-package
+lookup or `PATCHRIGHT_VERSION` extraction. The host had about 2 GB free when
+the failure occurred. In `/tmp/build-dc-57d94999.log`, the extraction completed:
+`npm install` added the selected Patchright package. The following
+`npx patchright install --with-deps chromium` then failed while Debian `apt`
+reported invalid repository signatures, a failure consistent with the constrained
+disk available for its package-list and temporary-file writes.
+
+No branch drift caused the failure. `git diff a72cb53a8..57d949997 -- deploy vendor`
+is empty; the Dockerfile and
+`reference-implementation/vendor/pdpp-polyfill-connectors-0.0.1.tgz` are
+byte-identical to the proven main revision. The tarball exists and declares
+the exact dependency `patchright: 1.61.1`.
+
+## Fix
+
+No Dockerfile, build-script, or vendored-tarball change was needed. After
+`docker builder prune -f` reclaimed 10.06 GB of unused build cache (25 GB free
+before the rerun), the original Dockerfile built successfully.
+
+## Evidence
+
+The required command completed successfully:
+
+```sh
+docker build --target core --build-arg PDPP_REFERENCE_REVISION=$(git rev-parse HEAD) --tag pdpp-banner-zero:data-connect-57d94999 --file deploy/docker/Dockerfile .
+```
+
+Final build-log tail from `/tmp/build-dc-57d94999-rerun.log`:
+
+```text
+#35 [reference-browser 1/1] COPY --from=source /app /app
+#35 DONE 12.8s
+#36 exporting to image
+#36 exporting layers 5.6s done
+#36 writing image sha256:449350fb1249d63c60031b33ee7b138698f2e82acaf86a8679296600194e0272 done
+#36 naming to docker.io/library/pdpp-banner-zero:data-connect-57d94999 0.0s done
+#36 DONE 5.7s
+```
+
+Image ID: `sha256:449350fb1249d63c60031b33ee7b138698f2e82acaf86a8679296600194e0272`.
+
+Runtime check:
+
+```text
+$ docker run --rm pdpp-banner-zero:data-connect-57d94999 node -e "console.log(process.version)"
+v24.19.0
+```
+
+Server boot proof used disposable local-only values for its required production
+startup guards, then stopped and removed the proof container. It stayed running
+and logged:
+
+```text
+authorization server listening (port 17662)
+resource server listening (port 17663)
+running=true status=running exit=0
+```

DC-IMAGE-SUPERVISOR-REPORT.md

@@ -0,0 +1,116 @@
+# DC image supervisor report
+
+Date: 2026-09-03
+
+## Diff summary
+
+- Added `deploy/railway/core-supervisor.ts` as the container PID 1. It starts
+  Xvfb (unless `PDPP_BROWSER_HEADLESS=1`), the reference AS/RS on loopback
+  ports 7662/7663, and the standalone Next.js console on `$PORT` (3000 by
+  default). It propagates termination and publishes a readiness file only when
+  both reference ports accept TCP connections.
+- Added a `console-builder` Docker stage and copied Next standalone, static,
+  and public output into `/console` in the `core` target. The target now
+  exposes 3000 and invokes the supervisor.
+- Marked browser-capable image stages with `PDPP_RUNTIME_BROWSER=1`; the
+  reference runtime requires this marker and `DISPLAY` before it permits headed
+  browser connector launches.
+- Added `@pdpp/polyfill-connectors` to the console's Next transpilation list.
+  The console imports that vendored TypeScript through the reference package;
+  without this entry `next build` fails to parse it.
+- Updated one console test to use the package's exported
+  `@pdpp/polyfill-connectors/static-secret-injection` path. Its former source
+  path is not resolvable by TypeScript after the vendoring move.
+
+## Image build
+
+Command:
+
+```sh
+docker build --target core --build-arg PDPP_REFERENCE_REVISION=$(git rev-parse HEAD) --tag pdpp-banner-zero:data-connect-$(git rev-parse --short=8 HEAD) -f deploy/docker/Dockerfile .
+```
+
+Result: success.
+
+Image ID: `sha256:d023e20eb48876c410b0560df630b98abf48c2fc51f8d0a94e13cceefbab4850`
+
+Entrypoint command:
+
+```text
+["node","--import","tsx","/app/deploy/railway/core-supervisor.ts"]
+```
+
+Build tail:
+
+```text
+#34 [console-builder 1/1] RUN npm run build --workspace=apps/console
+#34 ✓ Compiled successfully
+#34 Finished TypeScript
+#34 DONE 23.3s
+#37 [core 1/3] COPY --from=console-builder .../.next/standalone /console
+#38 [core 2/3] COPY --from=console-builder .../.next/static /console/apps/console/.next/static
+#39 [core 3/3] COPY --from=console-builder .../public /console/apps/console/public
+#40 writing image sha256:d023e20eb48876c410b0560df630b98abf48c2fc51f8d0a94e13cceefbab4850
+#40 naming to docker.io/library/pdpp-banner-zero:data-connect-3b2d4398
+#40 DONE
+```
+
+## Isolated runtime proof
+
+Created a throwaway `postgres:16-alpine` database and a dedicated Docker
+network. The test image was published only on `127.0.0.1:3009`; it was given
+dummy owner/encryption secrets plus the inspected production storage-contract
+variables. No production container, port, or database was used.
+
+First boot exposed one required production contract variable:
+
+```text
+production local semantic execution requires
+PDPP_LOCAL_TRANSFORMER_SUPERVISOR_RESTART_CONTRACT=1
+```
+
+The retry supplied that inspected production variable (and disabled embedding
+downloads); it completed successfully.
+
+Proof command/result tail:
+
+```text
+GET http://127.0.0.1:3009/owner/login
+owner_status=200
+owner_html=<title>PDPP Reference Provider — Owner sign-in
+
+GET http://127.0.0.1:3009/.well-known/oauth-authorization-server
+well_known_status=200
+well_known_issuer=http://127.0.0.1:3009
+
+GET /oauth/authorize with the ChatGPT request shape and Accept: text/html
+authorize_html_status=302
+location: /owner/login?return_to=%2Foauth%2Fauthorize...
+
+POST /owner/login with the dummy owner password and CSRF field
+login_post_status=302
+location: /oauth/authorize?response_type=code&client_id=https%3A%2F%2Fchatgpt.com...
+
+Authenticated retry of that authorization request
+post_login_authorize_status=302
+location: http://127.0.0.1:3009/consent?challenge=cc_NEPd99YCSZpk8f8DFr5Pbvnh
+
+GET that consent URL through the console
+consent_page_status=200
+consent_page_title=<title>PDPP — Personal Data Portability Protocol
+
+Final rerun summary
+owner=200 well_known=200 authorize_code=302 login_post_code=302
+consent_redirect_code=302 consent_page=200
+PDPP_RUNTIME_BROWSER=1
+```
+
+The supervisor log included successful AS proxy requests for `/owner/login`,
+`/.well-known/oauth-authorization-server`, and the authenticated
+`/oauth/authorize` request, followed by the console's request to
+`/oauth/authorize/consent-challenges/cc_NEPd99YCSZpk8f8DFr5Pbvnh`.
+
+After proof, the scratch app container, Postgres container, and Docker network
+were stopped and removed. `docker image prune -f` was run; it reclaimed 0 B.
+An intervening `docker builder prune -f` reclaimed 19.47 GB of dangling build
+cache after the disk filled during verification.

apps/console/next.config.mjs

@@ -35,6 +35,12 @@ const nextConfig = {
     },
     useTypeScriptCli: true,
   },
+  // Off everywhere: the dev-only "N" build-status badge (bottom-left, fixed
+  // position) never ships in a production build regardless of this flag —
+  // `next build`/`next start` don't include next-devtools — but it visually
+  // overlaps small-viewport UI (e.g. a mobile sticky action bar) in `next
+  // dev`, which is where this app's screenshots and manual review happen.
+  devIndicators: false,
   output: "standalone",
   outputFileTracingIncludes: {
     "/llms-full.txt": ["../../docs/agent-skills/**/*.md", "../../openspec/README.md", "../../pnpm-workspace.yaml"],
@@ -86,7 +92,13 @@ const nextConfig = {
   // consume its TypeScript sources directly once shim pairs (.js + .d.ts)
   // collapse into single .ts exports. Without this, Next's bundler would
   // reject .ts entries from a node_modules-resolved workspace package.
-  transpilePackages: ["pdpp-reference-implementation", "@pdpp/brand", "@pdpp/brand-react", "@pdpp/operator-ui"],
+  transpilePackages: [
+    "pdpp-reference-implementation",
+    "@pdpp/brand",
+    "@pdpp/brand-react",
+    "@pdpp/operator-ui",
+    "@pdpp/polyfill-connectors",
+  ],
   webpack(config) {
     config.resolve.alias = {
       ...config.resolve.alias,

apps/console/package.json

@@ -10,7 +10,7 @@
     "build": "next build --webpack",
     "start": "next start",
     "types:check": "next typegen && tsc --noEmit",
-    "test": "TSX_TSCONFIG_PATH=tsconfig.json node --import tsx ../../scripts/test-scratch/run-command.ts -- node ../../scripts/run-node-tests.mjs --test --import tsx --import ../../packages/operator-ui/css-stub-register.ts \"**/*.test.ts\" \"**/*.test.mjs\"",
+    "test": "TSX_TSCONFIG_PATH=tsconfig.json node --import tsx ../../scripts/test-scratch/run-command.ts -- node ../../scripts/run-node-tests.mjs --test --import tsx --import ../../reference-implementation/vendor/operator-ui/css-stub-register.ts \"**/*.test.ts\" \"**/*.test.mjs\"",
     "check": "ultracite check && pnpm --dir ../.. generated-artifacts:check",
     "fix": "ultracite fix",
     "verify": "pnpm types:check && pnpm test && pnpm check && pnpm build"

apps/console/src/app/(console)/explore/explore-canvas.tsx

@@ -39,7 +39,8 @@
  */
 "use client";
 
-import { IcInput } from "@pdpp/brand-react";
+import { ConnectorIcon, IcInput } from "@pdpp/brand-react";
+import type { ConnectorBrandIconIndex } from "../lib/connector-brand-index.ts";
 import { humanizeFieldLabel, rowPrimary, rowSecondary } from "@pdpp/display";
 import { kindGlyph, RecordIdentity } from "@pdpp/operator-ui/components/record-identity";
 import { feedDescription, feedSectionTitle } from "@pdpp/operator-ui/components/views/explorer-utils";
@@ -334,6 +335,7 @@ function dedupeWarnings(warnings: readonly ExplorerWarning[]): ExplorerWarning[]
 }
 
 interface ExploreCanvasProps {
+  connectorIndex: ConnectorBrandIconIndex;
   data: RecordsExplorerData;
   /**
    * The Explore route base path (e.g. "/explore"). A plain string —
@@ -1738,11 +1740,13 @@ const STREAM_GROUP_TOP_N = 8;
 // a builder, not a wall) UNLESS it holds an active filter or a search is matching
 // inside it — then it opens so the relevant streams are visible without a click.
 function SourceFacetGroup({
+  connectorIndex,
   group,
   forceOpen,
   onToggle,
   onToggleExclude,
 }: {
+  connectorIndex: ConnectorBrandIconIndex;
   group: SourceStreamGroup;
   forceOpen: boolean;
   onToggle: (stream: string) => void;
@@ -1755,6 +1759,7 @@ function SourceFacetGroup({
   return (
     <details className="rr-x-source-group" open={forceOpen || hasActive}>
       <summary className="rr-x-source-group__summary">
+        <ConnectorIcon connectorId={group.connectorId} connectorIndex={connectorIndex} name={group.displayName} />
         <span className="rr-x-source-group__name" title={group.displayName}>
           {group.displayName}
         </span>
@@ -1793,10 +1798,12 @@ function SourceFacetGroup({
 // two sources appears under EACH with that source's own number, never a global
 // tally (RL2/RL3). A "search within filters" box tames many sources/streams.
 function StreamFacets({
+  connectorIndex,
   groups,
   onToggle,
   onToggleExclude,
 }: {
+  connectorIndex: ConnectorBrandIconIndex;
   groups: readonly SourceStreamGroup[];
   onToggle: (stream: string) => void;
   onToggleExclude: (stream: string) => void;
@@ -1837,6 +1844,7 @@ function StreamFacets({
       <div className="rr-x-facets__scroll">
         {filtered.map((g) => (
           <SourceFacetGroup
+            connectorIndex={connectorIndex}
             forceOpen={singleSource || searching}
             group={g}
             key={g.connectionId}
@@ -3015,6 +3023,7 @@ function SavedViewTabs({
 
 // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: ExploreCanvas orchestrates the full workbench state; this cell only swaps the shared record identity renderer.
 export function ExploreCanvas({
+  connectorIndex,
   data,
   explorePath,
   order = "newest",
@@ -3795,7 +3804,7 @@ export function ExploreCanvas({
               </div>
             </>
           )}
-          <StreamFacets groups={streamGroups} onToggle={toggleStream} onToggleExclude={toggleExcludeStream} />
+          <StreamFacets connectorIndex={connectorIndex} groups={streamGroups} onToggle={toggleStream} onToggleExclude={toggleExcludeStream} />
         </div>
         {/* P1: sticky close affordance so users aren't trapped in the mobile rail */}
         <div className="rr-x-rail__close">

apps/console/src/app/(console)/explore/page.tsx

@@ -41,6 +41,7 @@ import { assembleExplorerData } from "@pdpp/operator-ui/explore/explore-data-ass
 import { RecordroomShellWithPalette } from "@/app/(console)/components/recordroom-shell-with-palette.tsx";
 import { ServerUnreachable } from "../components/server-unreachable.tsx";
 import { liveDashboardDataSource } from "../lib/data-source.ts";
+import { loadConnectorBrandIndex } from "../lib/connector-brand-index.ts";
 import { getRsInternalUrl, ReferenceServerUnreachableError } from "../lib/owner-token.ts";
 import { verifyDashboardSession } from "../lib/verify-session.ts";
 import { ExploreCanvas } from "./explore-canvas.tsx";
@@ -106,6 +107,7 @@ export default async function RecordsExplorerPage({
     return (
       <RecordroomShellWithPalette build="pdpp 0.1.0" host="this server">
         <ExploreCanvas
+          connectorIndex={await loadConnectorBrandIndex()}
           data={demo.buildExploreDemoData()}
           explorePath={dashboardRoutes.section.explore}
           order="newest"
@@ -126,7 +128,10 @@ export default async function RecordsExplorerPage({
   const requestedOrder = params.order === "oldest" ? "oldest" : "newest";
 
   try {
-    const data = await assembleExplorerData(params, liveDashboardDataSource, getRsInternalUrl());
+    const [data, connectorIndex] = await Promise.all([
+      assembleExplorerData(params, liveDashboardDataSource, getRsInternalUrl()),
+      loadConnectorBrandIndex(),
+    ]);
     const order = data.supportsTimelineDirection && requestedOrder === "oldest" ? "oldest" : "newest";
     // Relationships for the inspected record come from declared metadata via the
     // SAME `records/lib/relationships.ts` helpers the records detail page uses —
@@ -148,6 +153,7 @@ export default async function RecordsExplorerPage({
     return (
       <RecordroomShellWithPalette build="pdpp 0.1.0" host="this server">
         <ExploreCanvas
+          connectorIndex={connectorIndex}
           data={data}
           explorePath={dashboardRoutes.section.explore}
           order={order}

apps/console/src/app/(console)/lib/connection-catalog.test.ts

@@ -453,14 +453,15 @@ test("wave-0807 static-secret connectors (Steam, Jellyfin, Apple Contacts) are e
 test("requested-connector reachability: Steam/Jellyfin/Apple Contacts/GroupMe never render actionless or unavailable", async () => {
   // Discrimination guard for the static-secret injection-registry fix: these
   // four connectors declare a real static_secret setup and are present in
-  // STATIC_SECRET_CONNECTOR_REGISTRY (packages/polyfill-connectors/src/
+  // STATIC_SECRET_CONNECTOR_REGISTRY (@pdpp/polyfill-connectors/src/
   // static-secret-injection.ts). If either the manifest or the registry drift,
   // Add Source must not silently strand them with no route or a "not
   // available" verdict.
   const manifests = await loadCommittedManifests();
   const catalog = buildConnectorCatalog(manifests);
+  // biome-ignore lint/correctness/noUndeclaredDependencies: this is the exact vendored runtime package declared by pdpp-reference-implementation, which owns the injection registry.
   const { STATIC_SECRET_CONNECTOR_REGISTRY } = await import(
-    "../../../../../../packages/polyfill-connectors/src/static-secret-injection.ts"
+    "@pdpp/polyfill-connectors/static-secret-injection"
   );
   for (const key of ["steam", "jellyfin", "apple_contacts", "groupme"]) {
     const entry = catalog.find((e) => e.connectorKey === key);