Hi Richard,
Just closing the loop on the WordPress/Discourse SSO issue. We got it working.
In the end, the solution was to go back to the standard WP-Discourse DiscourseConnect Provider rather than continuing with our custom DiscourseConnect/HMAC implementation.
We created a fresh Discourse API key, rotated the DiscourseConnect shared secret, enabled the WP-Discourse Provider at the network level, and changed the Discourse Connect URL from our old custom callback to the WordPress site URL specified by WP-Discourse.
We then tested with a completely new WordPress user and a clean Discourse session:
WordPress login → Enter Community → automatically logged into Discourse as the same user.
So standard WP-Discourse is now handling the SSO correctly.
Thanks again for pointing us in the right direction while we were working through it.
Gee