[mvalancy]

OAuth callbacks previously linked by email without an ownership contract, and a failed provider insert could leave an orphan user. New links now require provider-specific verified email evidence and a verified existing local account. Bound provider+subject identity stays stable, disabled/current-revision changes fail, and new users/provider bindings commit atomically on an isolated SQLite connection. This is the OAuth portion of #184, stacked on token PR #197.

Google requires verified Gmail/Workspace authority. GitHub and LinkedIn profiles use bounded requests to fixed HTTPS endpoints, retaining verification metadata and checking LinkedIn subject agreement. Their unsafe library JSON loaders are disabled. All configured providers enforce session-bound state. New provider credentials/raw profiles are not stored, and the HTTP callback no longer logs token-bearing redirects. Provider and recovery contract documents official sources, legacy binding limits and the restriction on linking unverified local accounts.

Independent review of the first head identified preregistration takeover and an asynchronous malformed-profile crash; both are fixed and independently cleared at 9c7e3d74a191740d772f042b73ef4c6c69916fbd. Earlier failures remain recorded. Actual password-login/JWT and asynchronous-provider negatives establish the corrections.

Validation on this frozen head: 49 focused OAuth cases, 211 full server cases, 176 harness cases, plus build/types/lint passed. Clean install precedes this correction; dependencies remain unchanged. Tests cover actual Passport state/code/callback orchestration with synthetic provider transport, real temporary SQLite collisions/concurrency/rollback isolation, and local HTTP token issuance/stale-session rejection. Final exact-head CI is pending. Synthetic transport does not establish live OAuth/TLS/key rotation, hosted behavior or production deployment.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ❌ failure
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Current composition is 809f17f1301a1354148d2b25114437301dc4f06f, importing six reviewed Router harness/workflow/lesson paths through the stack; OAuth runtime and 49 focused security tests are byte-identical to reviewed 9c7e3d7. Full local server suite 211/211 and current harness 178/178 passed. Independent review cleared the exact composition.

Final Comprehensive run 40589229879 failed on Node 22 during CLI fixture teardown with ENOTEMPTY under two temporary .git directories. This remains a failure, not a retry candidate: investigating background Git writes and fixture isolation before a reviewed correction. OAuth integration is held. No live provider or deployment acceptance is claimed.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Current CAPTCHA head a0fcaf882109a6b76d5f8f4278e4af2895629271 fixes a verification event-listener race exposed in token CI 40591509438. A visible widget could emit before its passive listener effect attached. Only the listener/reset block moves to layout timing; fetch/focus and authentication policy remain unchanged.

A deterministic React.Profiler regression emits at the first widget commit: old source fails 1/5, corrected source passes 5/5. Replacement, error, prior-action and unmount controls reject stale events. Independent review cleared exact source and downstream compositions. Local build/types/lint, 179 harness checks, and 353 web tests passed; the web run used bounded workers after retaining an unrelated unbounded 5-second test timeout and subsequent failure. No timeout/retry settings were relaxed. Rebuilt production SPA passed all four real CAPTCHA browser cases in 17.8s, one worker, zero retries.

Token current head 2b05ea00240d06d4e16ccbcce4d55ecd65476f8d and OAuth d83fd9ae627f4bebd1cbc30bab4ac6e3ad840c1b import exactly these four reviewed paths; their auth feature code is unchanged. Final current-head CI remains required. Earlier failed/cancelled runs remain evidence, not passes.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Imported reviewed LOD correction #207 without changing this feature's own implementation. The composition adds exactly four reviewed paths (renderer effect, regression, lesson and index); independent review verified complete tree/blob unions, parents and unchanged feature code. Source #207 passes LOD desktop/phone2/2, web346/346, harness175/175, smoke6/6, build/types/lint. Refreshed exact-head CI is active; earlier failures/cancelled superseded runs are retained and are not passes. The CSS acceptance failure is addressed by the isolated transition-ownership fix, not by retries or relaxed assertions.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Final correction composition is now 9ffe86e4aec8d46d95cdcfdf34f6d14c9b326f16. Independent review verified the complete six-path import from reviewed LOD/camera-readiness head 7cbf292: source renderer, both browser regressions and lessons match byte-for-byte; feature-specific code and dependencies remain unchanged. The symptom index retains every previous row and adds the motion lesson. No instruction or authority changes.

The combined local motion suite passes 3/3 in 2.1 minutes with zero retries; combined LOD validation and fresh exact-head CI remain pending. Previous green heads do not establish this composition's final acceptance. Earlier LOD/rotation failures and insufficient title-geometry evidence remain retained. Integration follows #207 → #210 → #199 → #195 → #197 → #202 → #206 → #211, with native dev merge verification and post-merge CI before issue closeout. Independent agent review is not a GitHub non-author approval.

[mvalancy]

Final native dev-only integration evidence for 9ffe86e4aec8d46d95cdcfdf34f6d14c9b326f16: verified OAuth provider identity, bounded provider responses and isolated atomic account linking. Independent exact-head implementation/composition reviews found no remaining findings. The reviewed camera corrections are included; feature-specific code is unchanged from its reviewed source.

CI40602595497 and Comprehensive40602595502 passed every applicable job. Downloaded strict artifacts verify smoke6, new-user42, LOD2, routes7, mobile27 and performance3, all with zero failed/warned/skipped cases, evidence errors, timeouts or nonzero executions. Effects, showcase, supported-Node coverage, installer and real-Neo4j gates also passed. The main/nightly-only production job is inapplicable to this dev PR.

The live base and complete merge result will be checked against the preceding reviewed stack tree immediately around the native operation. Expected resulting tree: 078ed0d063f96da6b14157386585802d5ee0c2dc. Retargeting a stacked PR to an equivalent dev tree changes no feature content. Earlier failures remain retained; no retry is substituted for a fix.

This uses the owner's standing dev administrator authority and does not claim a GitHub non-author approval. Issue closeout waits for successful validation of the integrated dev head; intermediate post-merge runs may be superseded by later reviewed stack integration and are not counted as passes. Main, release, deployment and protection remain unchanged.