# Saber 2 project: production eXplore embedding test and support request

Report2026-11-09.1. Tested November9,2026, America/Chicago. This is a production-origin test, not a localhost test. No working authenticated embed is claimed.

## What we need

Provide a stable, supported, read-only eXplore Digital Threads embed URL for **Lockheed Saber2.0 Capability Development Project**, project UUID **4c5f4b92-b741-4af4-b839-2dc0cfbf14e0**, usable inside **https://s2cd.xcelerator.us**. It should continue working for authorized S2CD viewers across refreshes, new visits and normal session renewal, without relying on Chris's personal Siemens session or requiring Chris to reopen Solutionlink each time.

The durable link and access grant must apply to this exact project only. Loading another project ID or changing startup parameters must not broaden access. Include the Digital Threads tabletop, stage selection, pan/zoom, and project-scoped solution/process drilldown needed for that view. Editing, publishing, deleting, tenant administration and unrelated projects are outside the requested grant. Existing S2CD access remains the entry gate; no request to make the customer project globally public is implied.

## Production results

Parent page: https://s2cd.xcelerator.us/processes. Open the existing Interactive eXplore panel trial disclosure. Chrome used its existing authorized S2CD session with default browser protections. Same-profile top-level Solutionlink opened the named Saber project and displayed its Solutions. A separate dedicated Edge MCP session was expired; that is a different profile and not the Chrome control.

| Test | Route | Observed result |
|---|---|---|
| Vendor share | sl-ngi-prod.solutionlink.us /Web/index.html#/Xplore/project/{projectUUID} | Redirected to diswlogin.siemens.com, then child frame reported refused to connect. |
| Current Solutionlink host | solutionlink.siemens.com /Web/index.html#/Xplore/project/{projectUUID} | Loading, then the same framed sign-in refusal. Reproduced after confirming top-level project access in the same Chrome profile. |
| Token-free direct eXplore | explore.solutionlink.us /index.html with itemName, diagram=L0 and projectid | eXplore Unity shell loaded inside S2CD. Authenticating ended with an explicit session-expired message instructing the viewer to reopen through refreshed Solutionlink. No project tabletop or interactive Digital Threads rendered. |

The shell loading establishes that S2CD is capable of displaying the eXplore application surface. It does not establish a valid project session. The failed share routes identify a framed authentication boundary, but this test did not capture the exact blocked authentication response or establish whether a particular cookie policy caused it. No global prohibition on eXplore embedding is inferred. The production direct-frame message reads: "Your session has expired. Please re-open eXplore via Solutionlink after the latter has been refreshed first." This reproduces the earlier local-preview session-expiry failure from the actual deployed S2CD origin.

No browser security settings, cookies, authentication messages or startup credentials were copied or modified. No S2CD source/deployment or native project content was changed for these tests. The current production page already had the three diagnostic controls. Fresh native eXplore launch was not retested in this run; prior native launches succeeded.

## Specific support requested from Solutionlink/eXplore

1. **Persistent project-only entry point.** Supply the supported embed URL, parameters, correct host/environment and licensing requirements for this exact project. Confirm whether the Share Link button is only a top-level launcher or can support an embedded session. Clarify whether map/thread selection parameters are supported and stable.
2. **Durable access mechanism.** Prefer a stable, revocable project-scoped share grant or a renewable embedded viewer session that runs without a personal browser session. If a persistent/long-lived token is required, issue it only for this project and read-only viewer actions, document its audience, lifetime, revocation and rotation, and deliver it through a secure channel. We have not determined that a non-expiring token is necessary. A server-side grant exchanged for short-lived viewer sessions is acceptable if it preserves the always-available user experience and is supported by Siemens.
3. **Allowed S2CD parent.** Confirm/enable embedding from https://s2cd.xcelerator.us on every required app/data/startup hop. Supply the required frame policies, permitted messaging origins, browser storage requirements and supported session-refresh behavior. Sign-in should occur outside the iframe if needed; the recurring viewer should not depend on framed login. Do not request weakening browser security.
4. **Project-scope enforcement and entitlement.** Validate project UUID and read-only permissions server-side. Confirm whether S2CD-authorized viewers can use a project publication/share grant or must each have a Siemens identity/license. Document service identity options if per-viewer Siemens login is not compatible with the required experience. Origin/referrer restrictions alone are not project authorization.
5. **Integration interface.** Provide supported ready/error/session-expired events, renew/refresh handoff, thread/process deep links and whether a host SDK or postMessage contract is available. Tokens must not be placed in this public support page, client source, logs or general-purpose URLs. A supported confidential grant can remain in server-side storage if the vendor design calls for it.

## Acceptance checks with the team

| Check | Pass condition |
|---|---|
| Production-origin load | Authorized S2CD viewer opens the panel and the correct Saber Digital Threads tabletop renders. |
| Interaction | Pan/zoom, select thread/stage and open the corresponding project process; no unrelated project context appears. |
| Return visit | Refresh, new tab and a new authorized S2CD browser session still work without Chris's personal Siemens login. |
| Renewal | Cross the real session expiry and confirm supported automatic renewal or a controlled reauthentication flow consistent with the agreed viewer model. |
| Scope rejection | Substitute a different project ID, request write/admin operations or reuse the grant outside its supported context; access must be denied server-side. |
| Revocation | Revoke/rotate the project grant and verify the documented behavior, including existing viewer sessions. |
| Viewer entitlement | Verify the agreed S2CD gate/Siemens identity/license model with the actual intended audience. |

These are requested acceptance checks, not completed or failed assertions beyond the three observed route tests.

## Evidence and machine-readable handoff

- [Results JSON](/saber-embedding.json)
- [Vendor share refusal](/evidence/saber-embedding/vendor-share.png)
- [Current host refusal after top-level control](/evidence/saber-embedding/current-host-signed-in-control.png)
- [Direct eXplore authentication state](/evidence/saber-embedding/direct-final.png)
- [Support bundle](/downloads/saber-embedding-support-2026-11-09.zip)

No access token, credential, cookie, native project export or customer process diagram is included. The published project UUID is a routing identifier, not an access grant. This supplemental report does not change the immutable MCP0.4.0 ZIP.