Add commissioned ideas activity plan

.agent/knowledge/repo_discoveries.md

@@ -14,6 +14,14 @@ Use this log for durable findings that future contributors and agents should reu
 
 ## Discoveries
 
+- Date: 2026-04-21
+- Area: activities | planning | commissioned-ideas
+- Discovery: A staged classroom competition activity like Commissioned Ideas, described to teachers as Shark Tank-inspired, fits the current repo best when it combines activity-local stage control and registration patterns from `gallery-walk`, reveal/review flow ideas from `resonance`, leaderboard-style ranking from `traveling-salesman`, and a lightweight winner reveal borrowed from `raffle`, without adding any activity-specific branches to shared dashboard or routing layers.
+- Why it matters: The requested flow spans registration, instructor-controlled live progression, weighted peer voting, and a final reveal. Treating those as activity-owned concerns keeps the repo aligned with the activity-containment policy and avoids speculative shared abstractions for "multi-phase competition" behavior.
+- Evidence: `activities/gallery-walk/server/routes.ts`; `activities/gallery-walk/client/manager/ManagerPage.tsx`; `activities/gallery-walk/client/student/StudentPage.tsx`; `activities/resonance/server/routes.ts`; `activities/resonance/client/manager/ResonanceManager.tsx`; `activities/traveling-salesman/client/components/Leaderboard.tsx`; `activities/raffle/client/manager/RaffleManager.tsx`; `.agent/plans/commissioned-ideas-activity-plan.md`
+- Follow-up action: When implementation begins, keep Commissioned Ideas session state, voting rules, scoring, and podium reveal inside `activities/commissioned-ideas/...`, and only extract shared seams if a second activity later needs the same contracts.
+- Owner: Codex
+
 - Date: 2026-04-21
 - Area: client | activities | syncdeck
 - Discovery: SyncDeck should scope `allow-popups-to-escape-sandbox` to instructor-configured presentation iframes only; embedded/internal iframes should keep the stricter sandbox without popup escape.

.agent/knowledge/security-notes.md

@@ -130,3 +130,12 @@ Track security-relevant boundaries, risks, and mitigation decisions.
 - Validation (test/review/path): `client/src/components/common/manageDashboardUtils.ts`; `client/src/components/common/ManageDashboard.tsx`; `activities/syncdeck/server/routes.ts`; `client/src/components/common/manageDashboardUtils.test.ts`; `activities/syncdeck/server/routes.test.ts`; `npm test`.
 - Follow-up action: Add optional hostname/domain allowlist policy if deployment requires restricting presentation origins.
 - Owner: Codex
+
+- Date: 2026-04-23
+- Area: commissioned-ideas instructor bootstrap + manager websocket auth
+- Threat or risk: Storing `instructorPasscode` in browser `sessionStorage` and placing it in the websocket URL query string exposes the credential to client-side storage inspection, browser/network tooling, and URL-based logging surfaces. Those patterns are especially likely to trip CodeQL and create avoidable secret-handling risk.
+- Control or mitigation: `commissioned-ideas` now carries the passcode only in the one-time create-session bootstrap history payload, opts out of the generic same-tab `sessionStorage` fallback (`allowSessionStorageFallback: false`), and authenticates manager websocket connections with a post-connect `commissioned-ideas:manager-auth` message instead of a query parameter.
+- Residual risk: Reloading the manager page after the initial handoff drops the in-memory bootstrap payload, so the instructor must reopen from the create-session navigation flow. The create route still intentionally returns the passcode, so downstream consumers must avoid logging that response body.
+- Validation (test/review/path): `activities/commissioned-ideas/activity.config.ts`; `activities/commissioned-ideas/client/manager/CommissionedIdeasManager.tsx`; `activities/commissioned-ideas/client/hooks/useCommissionedIdeasSession.ts`; `activities/commissioned-ideas/server/routes.ts`; `client/src/components/common/manageDashboardUtils.ts`; `client/src/components/common/manageDashboardUtils.test.ts`; `activities/commissioned-ideas/server/routeHandlers.test.ts`; `npm test` (blocked only by unrelated existing server failures in `galleryWalkRoutes.test.ts`, `sessionStore.test.ts`, and `statusRoute.test.ts`).
+- Follow-up action: Reuse the same opt-out + post-connect auth pattern for any future activity that needs to hand an instructor secret from create-session into a websocket-managed screen.
+- Owner: Codex