[SUPERSEDED by #903] Restore Google OAuth configuration in Vercel production

[Codex]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>Restore Google OAuth configuration in Vercel production</issue_title>
<issue_description>## Outcome

Google sign-in succeeds in the canonical Vercel production deployment without missing-client or callback-state errors.

Runtime evidence

Vercel project: v0-uvai (prj_4Qj52UTshPstdsMWdgFtN3B31j8B)

Observed during the seven-day audit window:

• 4 occurrences: Google OAuth client id/secret missing
• 4 occurrences: GOOGLE_OAUTH_CLIENT_ID / GOOGLE_OAUTH_CLIENT_SECRET missing
• 4 occurrences: NextAuth SIGNIN_OAUTH_ERROR with client_id is required
• 1 occurrence: NextAuth OAUTH_CALLBACK_ERROR with missing state cookie
• Affected route: /api/auth/[...nextauth]

Required work

• Establish one supported variable naming convention in application configuration.
• Confirm the Google OAuth client ID and secret exist in Vercel production without exposing their values.
• Verify the authorized redirect URI matches the canonical production domain.
• Redeploy from main.
• Complete a real Google sign-in and callback.
• Confirm Vercel runtime errors remain clear for 24 hours.
• Attach the exact production deployment and commit SHA as evidence.

Safety

Do not place credential values in this issue, PRs, build logs, or comments.

Acceptance criteria

Google authentication completes successfully against the production deployment, callback state validation succeeds, and the four audited error groups no longer recur.

Related governance initiative: #898</issue_description>

• Closes Execution: verify Google OAuth in Vercel production (PR #903) #900

Comments on the Issue (you are @codex[agent] in this section)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Ready	Preview, Comment, Open in v0	Jul 20, 2026 11:57pm

[github-actions]

🔍 PR Validation

⚠️ PR title should follow conventional commits format

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA bde55dd.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[github-actions]

Agent Completion Truth Gate: BLOCKED

Reasons: invalid_payload

Machine-readable verdict

{
  "details": {
    "invalid_fields": [
      "policy.agent_login",
      "policy.run_id"
    ]
  },
  "reasons": [
    "invalid_payload"
  ],
  "verdict": "blocked"
}

Workflow evidence

[Copilot]

Copilot wasn't able to review any files in this pull request.

[groupthinking]

Review — not ready to merge; one production-safety flag

Highest-priority concern (potential prod auth outage): this PR narrows the accepted env-var names in apps/web/src/lib/auth.ts from either GOOGLE_OAUTH_CLIENT_ID/SECRET or GOOGLE_CLIENT_ID/SECRET down to only GOOGLE_CLIENT_ID/SECRET. The code change alone does not "restore" OAuth — it changes which env names production reads. If Vercel production currently has the credentials set under the GOOGLE_OAUTH_CLIENT_* names, merging this will make the app stop reading them and break Google sign-in harder, not fix it. The deprecation console.error acknowledges exactly this scenario but does not prevent it.

➡️ Before this can safely merge, confirm (per the issue's own unchecked boxes) that Vercel production actually has GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET populated, and that a real sign-in + callback succeeds against production. Those acceptance criteria are not yet evidenced on this PR.

Blocking gates (independent of the above):

• agent-completion/truth-gate verdict is BLOCKED — invalid_payload, invalid_fields policy.agent_login, policy.run_id (missing/invalid agent-run manifest).
• Title still begins [WIP] — fails the conventional-commits title check.

The code/test/doc changes are internally consistent (the test asserts the single-convention source and auth.ts matches). This is purely about verifying the production env before the naming convention is narrowed. Holding for human review + merge approval; not auto-merging to protected main.

---

Generated by Claude Code

[groupthinking]

Reviewed the OAuth env standardization (GOOGLE_OAUTH_* → GOOGLE_CLIENT_*). The change is coherent — auth.ts, apps/web/.env.example, LAUNCH_CHECKLIST.md, and the config-source test all line up, and the production deprecation-warning for lingering GOOGLE_OAUTH_* vars is a nice touch. Two items:

1. Should-fix — incomplete migration in the root .env.example. The PR updates apps/web/.env.example but the repo-root .env.example (lines 71-72) still ships the deprecated names:

GOOGLE_OAUTH_CLIENT_ID=
GOOGLE_OAUTH_CLIENT_SECRET=

A developer copying the root example would set the deprecated names and trip the very warning this PR adds. Please update these to GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET for consistency. (grep -rn GOOGLE_OAUTH_ . confirms these are the only remaining references outside the intentional deprecation-warning block in auth.ts.)

2. Deploy caveat (not a code issue). This drops the GOOGLE_OAUTH_* fallback entirely — auth.ts now reads only GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET. Since LAUNCH_CHECKLIST records Google sign-in as already LIVE in production (verified 2026-07-14), if Vercel prod currently holds the creds under the GOOGLE_OAUTH_* names, Google auth will stop activating the moment this merges. The Vercel production env must be switched to the new names in lockstep with the merge. The added console.error will flag stragglers, but it won't restore the fallback.

Note for whoever merges: this PR is subject to the same repo-wide Agent completion enforcement check that is currently failing-closed on every open PR (empty trusted-publisher allowlists — by design), so it can't go green until that's provisioned by a human. That's independent of the code above.

---

Generated by Claude Code

[groupthinking]

Superseded by #903 for issue #900. #903 covers the same OAuth naming work plus the root environment example and production runbook, and all executable checks on exact head 7ff692d5137297485f5e116d46ef1cc1e58cff82 pass (E2E is repository-configured as skipped). Preserve this branch for history, but continue implementation and review only on #903.