---
name: websocket-realtime-review
description: Map authorized WebSocket and realtime upgrade, authentication, subscription, channel, message, and reconnect boundaries.
---

# WebSocket and realtime review

## Accepted inputs

- Current scope and controlled accounts
- Approved handshake and message captures
- Owned channels, records, and recipients

## Procedure

1. Record transport, upgrade request, origin, cookies or tokens, subprotocol, and reconnect behavior.
2. Build a state machine for connect, authenticate, subscribe, publish, acknowledge, unsubscribe, and disconnect.
3. Catalog message types and fields without replaying unknown state-changing operations.
4. Compare controlled identities across one channel or object change at a time.
5. Distinguish client-side routing from server-enforced authorization.
6. Use a nonexistent channel or expired controlled session as a negative control.

## Output artifacts

- Handshake and message catalog
- Channel and identity matrix
- State diagram, paired references, and rejected confounders

## Stop conditions

No flooding, brute-force subscriptions, messages to uncontrolled recipients, or actions with uncertain side effects.

## Completion gate

Complete when the server-side decision is reproducible with fresh controlled sessions and every retained lead has a negative control and safe next step.