The real-handshake test against the saltire LTI platform emulator
turned up a launch bug dev mode cannot reach: pylti1p3's Flask adapter
requires the application to supply the cookies_allowed_js_check.html
template used by enable_check_cookies(), and without it every OIDC
login 500s. The template tests whether cookies survive, then re-enters
the login flow or offers a new-window fallback.
docs/SALTIRE.md records the verified test setup: local HTTPS with a
self-signed certificate, the platform description for
instance/lti_config.json, the saltire-side configuration, and the
session-id caveat on saltire's token/jwks URLs. The 2026-08-01 run
verified the full OIDC handshake, JWT validation, NRPS roster sync
over the wire, and instructor/learner role routing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
