Parent

• WebUI epic: #29
• Depends on: WEB-03 #32, WEB-04 #33, WEB-05 #34
• Feeds: SESSION-08 #27, release hardening #14

Outcome

Prove that the WebUI is a secure second frontend over canonical sessions and provide actionable operational evidence/runbooks.

Estimate

• 5 SP / 3 engineering days
• Risk: high

Scope

• Run a real Telegram OIDC cloud-dev login and verify membership-derived tenant access.
• Run two-user/two-tenant browser scenarios including negative tenant/session/event/run/upload identifiers.
• Prove a WebUI-created canonical session/event can be read by the synthetic second frontend and later projected by Telegram without transcript import.
• Prove session rotation, logout, membership revocation, expiry, CSRF, callback replay and fixation defenses.
• Prove text and attachment flows, bounded polling, cold start, 429/5xx retry and upload cleanup.
• Add dashboards/alerts for auth failures, callback failures, active/revoked sessions, 4xx/5xx, latency, YDB errors and upload abandonment without tenant payload logging.
• Write runbooks for Telegram OIDC outage/key rotation, leaked session response, membership revocation, stuck uploads and image rollback.

Verification

• Exact Git commit, image digest, Terraform state revision and migration head are recorded.
• Browser E2E and API negatives pass against cloud-dev.
• No cross-tenant object/event/session appears in logs, responses or canonical context.
• Alert delivery is exercised with synthetic failures.
• Evidence is linked into #27 and #14 rather than duplicated.

Acceptance criteria

• The WebUI is proven as an independently authenticated second frontend.
• Tenant and session authorization is enforced server-side on every tested route.
• OIDC/session/upload incidents have executable containment and recovery steps.
• The track can be enabled or rolled back without changing Telegram ingress.

Non-goals

• Production approval.
• Search/summarization or billing UI.
• Replacing the broader cross-frontend gate in #27.