Problem
The interaction code is defined only in terms of the user arriving at the URL: "once the user arrives at the URL with a valid code, the code is consumed and cannot be reused," and the single-use rule in (#interaction-endpoint) is likewise keyed on arrival at the interaction URL. That does not describe a PS that completes the interaction on a channel it already controls — a phone tap, a chat approval — where the person never visits url and the code is never presented.
Suggested direction
State that a PS MAY complete an interaction on any channel it controls without the person visiting url or presenting code, and define what happens to the single-use code in that case (invalidated at completion; later presentation returns invalid_code). Polling already carries the completion signal, so this is a clarification plus code semantics, not a new mechanism.
Context
From the notes.ito.com deployment review (writeup, review pass). Belongs in the protocol, referenced from the personal PS profile (separate issue), where out-of-band completion is the normal case.
Problem
The interaction
codeis defined only in terms of the user arriving at the URL: "once the user arrives at the URL with a valid code, the code is consumed and cannot be reused," and the single-use rule in (#interaction-endpoint) is likewise keyed on arrival at the interaction URL. That does not describe a PS that completes the interaction on a channel it already controls — a phone tap, a chat approval — where the person never visitsurland the code is never presented.Suggested direction
State that a PS MAY complete an interaction on any channel it controls without the person visiting
urlor presentingcode, and define what happens to the single-use code in that case (invalidated at completion; later presentation returnsinvalid_code). Polling already carries the completion signal, so this is a clarification plus code semantics, not a new mechanism.Context
From the notes.ito.com deployment review (writeup, review pass). Belongs in the protocol, referenced from the personal PS profile (separate issue), where out-of-band completion is the normal case.