The QA widget comments (QaCorner, ProfileLoader, app-wrapper-material) say our own surfaces and the host's
session instead of naming one host; StackLayout describes a normal host page's flow; the live-cors script
note says it was measured on the live test host. Comments and notes only; no behaviour changes.
The QA widget's Start now: GET /api/orgs → mint an RS256 gateway token via
/api/o/<slug>/mcp/mint (reads access_token) → POST /sessions to qhoot (Bearer) →
open /qhoot/assembly.html?c=<code>. Verified end-to-end (qhoot 201). Backend side
(qhoot iss/aud aligned to the mint; mint signing key pinned to certified green-key-1)
handled on the app-shell/qhoot infra.
The QA panel now checks the go-base session via same-origin GET /api/auth/me and
shows 'signed in as X' + Start; if not signed in it offers 'Log in with Nuxtinator'
(opens the same-origin /plugin-assets/qa-connect.html popup, which reads the session
and postMessages the identity back). Works when the plugin is same-origin; under
NUXT_PUBLIC_PLUGIN_SANDBOX_ISOLATE_ORIGIN=true the frame is origin-null so the check
is blocked (browser rule) and the button surfaces that. Connect page shipped to the
mfe-index volume root.
The widget mounted but was invisible: as a CHILD component of the custom element,
its <style scoped> block was silently dropped from the shadow root (Vue keeps only
the ROOT component's styles), so position/z-index never applied → it laid out as a
static full-width block. Switch to useShadowStyles (same pattern as legend/table/
map-panel) → the pill now floats bottom-right. Verified headless: absolute,
z-index 2147483000, visible, bottom-right.
The widget rendered but was painted under map legends/panels and could be trapped
by a profile's full-bleed layout. Switch .qa-corner to position:fixed with a
top-of-stack z-index so it floats bottom-right over any map. (Plugin-open path
fixed separately in convert.py: a plugin now opens its representative MAP page,
not the multi-map staging directory — faster load + the widget shows.)
Adds library/components/qa/QaCorner.vue — a bottom-right floating 'QA' button +
panel (OIDC-onboarding shell: 'Log in with Nuxtinator', no key), rendered by
ProfileLoader over any profile. OPT-IN via profile-config.qa (default OFF) so the
same bundles that power partner embeds never show a QA button; the SPA shell sets
qa:true on every mount so it appears on all maps in the power app. Backend (qhoot /
nuxtbase-baas agent bridge + MCP) wired in a later pass — this is the visible shell.
Spec: _qa-cycle/01-ideation-research/qa-loops/qa-embeddable-qa-agent-bridge.md
