Execution: verify Google OAuth in Vercel production (PR #903)

[groupthinking]

Parent program

Progresses #898. This issue owns protected production verification for Google OAuth.

Agent login

google-labs-jules[bot]

Agent run ID

15243187445261469621

Objective

Verify and safely complete the Google OAuth naming migration for Vercel production by keeping GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET canonical, preserving legacy fallback compatibility until production migration is proven, and recording exact-head and production evidence without exposing secrets.

Acceptance criteria

• GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are canonical.
• Legacy GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET remain temporary fallbacks.
• Tests prove canonical precedence and backward compatibility.
• Environment examples and migration/removal documentation are updated.

Declared file scope

• .env.example
• apps/web/.env.example
• apps/web/src/app/login/GoogleSignInButton.tsx
• apps/web/src/app/login/page.tsx
• apps/web/src/lib/__tests__/auth-config-source.test.ts
• apps/web/src/lib/auth.ts
• docs/deployment/VERCEL_PRODUCTION_RUNBOOK.md

Focused test paths

• apps/web/src/lib/__tests__/auth-config-source.test.ts

Allowed extra files

• none

Current state — CODE GREEN, AUTHORIZED PRODUCTION VERIFICATION PENDING

• Canonical PR: fix(auth): restore Google OAuth configuration in Vercel production #903
• Canonical branch: jules-15243187445261469621-ffdb089e
• Exact code head: f8800ad3673ab5b11453da249d377f5539c5b152
• Review state: 0 unresolved threads
• Competing implementation PRs: none found

Exact-head and runtime evidence

• Focused test verified on current head: npm --prefix apps/web test -- --run src/lib/__tests__/auth-config-source.test.ts
• Review threads: 0 unresolved
• validate: passed on exact head
• PR Governance: recently alternates across reruns; investigate only against the current exact head
• Canonical issue and evidence: recently alternates across reruns; investigate only against the current exact head
• agent-completion/truth-gate: remains the procedural blocker on the current exact head
• Vercel Agent Review: in progress on the current exact head
• Last verified production deployment: dpl_7DFP2PGLmtiRvPBVi6wqM9tdpTUN, READY from main at 2d660c7e5382db1df5c5eba39537aa9d034376bb
• Vercel runtime query on 2026-07-21 found no production errors in the preceding 24 hours

Remaining gates — authorized owner

1. Confirm the Google OAuth client ID and secret exist in Vercel production without printing their values.
2. Verify the authorized redirect URI matches the canonical production domain.
3. Reverify fix(auth): restore Google OAuth configuration in Vercel production #903's exact head, approve/merge it, and deploy the resulting main commit.
4. Complete a real Google sign-in and callback.
5. Attach the production deployment ID and exact main SHA.
6. Confirm the audited OAuth error fingerprints remain absent for 24 hours, then close this issue.

No known code blocker remains. A clean runtime window before deploying #903 does not prove the new configuration or real sign-in.

Historical incident fingerprints

• Missing Google OAuth client ID/secret
• NextAuth SIGNIN_OAUTH_ERROR with missing client_id
• NextAuth OAUTH_CALLBACK_ERROR with missing state cookie
• Route: /api/auth/[...nextauth]

Safety boundary

Never place credential values in GitHub, logs, comments, or artifacts. Do not mutate production credentials or deploy without authorized ownership.

Execution receipt

• Declared agent/run: google-labs-jules[bot] / 15243187445261469621
• Controller login/run: groupthinking / eventrelay-blocker-watch-20260721-1005z
• Canonical PR/branch: fix(auth): restore Google OAuth configuration in Vercel production #903 / jules-15243187445261469621-ffdb089e
• Claimed: 2026-07-20T23:55:29Z
• Latest verified heartbeat: 2026-07-28T10:40:49Z
• Exact head: f8800ad3673ab5b11453da249d377f5539c5b152
• Artifact: current exact head includes canonical-name precedence, legacy fallback compatibility, documentation updates, and zero unresolved review threads; protected production verification remains pending

Truth-gate reconciliation — 2026-07-21

• Added the machine-readable Agent login and Agent run ID fields without fabricating a snapshot.
• Normalized the existing verified checklist as Acceptance criteria.
• Added copilot-rabbit authorization and triggered an exact-head reevaluation.
• Replaced the generic invalid_payload failure with explicit evidence on run 29821176515.
• Pre-dispatch intent snapshot exists: no.
• Declared file scope and focused-test contract existed before implementation: no; do not backfill as historical intent.
• Trusted terminal result from google-labs-jules[bot] / 15243187445261469621: pending.
• Current-head Copilot review: pending.

Controller receipt

• Controller login/run: groupthinking / eventrelay-blocker-watch-20260721-1005z
• Canonical PR: fix(auth): restore Google OAuth configuration in Vercel production #903
• Claimed: 2026-07-21T10:05:35Z
• Latest verified heartbeat: 2026-07-28T10:40:49Z
• Exact head: f8800ad3673ab5b11453da249d377f5539c5b152
• Artifact: exact-head code migration is present and review threads are resolved; remaining blockers are procedural truth-gate provenance and protected production verification

Next executable action

Keep work on the canonical PR/branch only. Do not create a competing implementation. If the accepted current-head review opens a valid finding, patch the same branch. Protected deployment verification and an authorized legacy-provenance disposition remain the later human boundaries.

[linear-code]

MYX-88

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[coderabbitai]

🔗 Related PRs

#277 - Vercel remediation complete: waitUntil adoption + active middleware + @vercel/functions package (resolves three user-defined outcomes; 16-agent verification-gate consolidated PASS on full matrix) [closed]
#384 - fix(web): restore broken production build (Tailwind v4 PostCSS + OTel superset) — conflict-free continuation of #377 [merged]
#404 - fix(web): sync package-lock with @vercel/functions (unblocks #277 auto-merge) [merged]
#780 - fix(web): harden Google OAuth + dashboard auth [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[google-labs-jules]

Jules is on it. When finished, you will see another comment and be able to review a PR.