fix(auth): restore Google OAuth configuration in Vercel production

.Jules/palette.md

@@ -0,0 +1,7 @@
+## 2024-07-14 - Scrubber Keyboard Accessibility
+**Learning:** Adding keyboard event listeners (like `onKeyDown`) to custom interactive elements (like a `div` acting as a scrubber/slider) doesn`t automatically expose those shortcuts to screen readers.
+**Action:** Always add `aria-keyshortcuts` to custom ARIA widgets (like `role="slider"`) to announce available keyboard commands (e.g., "ArrowLeft ArrowRight Home End") when the element receives focus.
+
+## 2026-07-13 - Search Input Accessibility
+**Learning:** Search inputs still need an explicit programmatic label when the only visible prompt is a placeholder, but a submit button with visible text like `Go` should usually rely on that visible text for its accessible name so voice-control users can activate it by name.
+**Action:** Add a real label (or equivalent programmatic name) to placeholder-only search inputs, and only add an `aria-label` to short-text submit buttons when it includes the visible button text.

.claude/settings.json

@@ -0,0 +1,5 @@
+{
+  "enabledPlugins": {
+    "desktop-commander@claude-plugins-official": true
+  }
+}

.env.example

@@ -69,6 +69,12 @@ ALLOW_UNAUTHENTICATED=
 #   Generate a secret:  openssl rand -base64 32
 NEXTAUTH_SECRET=
 NEXTAUTH_URL=http://localhost:3000
+<<<<<<< HEAD
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+# Legacy fallback variables are also supported:
+=======
+>>>>>>> origin/main
 GOOGLE_OAUTH_CLIENT_ID=
 GOOGLE_OAUTH_CLIENT_SECRET=
 # Optional: restrict sign-in to a single email domain (e.g. uvai.io)

.github/agentic/verification-loop.aw.yml

@@ -0,0 +1,135 @@
+# EventRelay Hybrid Refactor — Agentic Workflow
+# GitHub Agentic Workflows (.aw) — Public Preview (Jun 11, 2026)
+# This workflow runs continuous verification on the refactor branch
+# Docs: https://githubnext.com/projects/agentic-workflows/
+
+name: "EventRelay Hybrid Refactor Verification Loop"
+description: |
+  Self-correcting verification loop for the hybrid-infra-v2 refactor.
+  Monitors agent PRs, runs verification gates, and auto-merges or escalates.
+
+# Trigger on any PR targeting the refactor branch
+on:
+  pull_request:
+    branches: ["refactor/hybrid-infra-v2"]
+    types: [opened, synchronize, ready_for_review]
+  issue_comment:
+    types: [created]
+    if: "github.event.comment.author_association in ['OWNER', 'MEMBER', 'COLLABORATOR']"
+  schedule:
+    - cron: "0 */4 * * *"  # Every 4 hours: check for stale agent tasks
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+agent:
+  model: "claude-sonnet-4-6"
+  tools:
+    - github
+
+steps:
+  # ═══════════════════════════════════════════════════════════
+  # LAYER 1: Mechanical Pre-Filter
+  # ═══════════════════════════════════════════════════════════
+  - name: "Gate 1: Docker Build"
+    id: docker_build
+    run: |
+      docker build --network=none -f Dockerfile -t eventrelay-test .
+    success_condition: "exit_code == 0"
+    on_failure:
+      action: "comment"
+      message: |
+        ## ❌ Verification Gate FAILED: Docker Build
+
+        The Dockerfile failed to build. Error output attached.
+
+        **Self-correction hint (Tier 1):** Check for missing dependencies or syntax errors in the Dockerfile.
+        **Agent:** Please fix and push again.
+
+  - name: "Gate 2: Python Test Suite"
+    id: pytest_full
+    needs: [docker_build]
+    run: |
+      docker run --rm eventrelay-test pytest tests/ -x --timeout=300 --tb=short
+    success_condition: "exit_code == 0"
+    on_failure:
+      action: "comment"
+      message: |
+        ## ❌ Verification Gate FAILED: Test Suite
+
+        Tests failed. See output above.
+
+        **Self-correction hint (Tier 1):** The failing test name and traceback are above. Fix the specific regression.
+        **If this is attempt 2+:** Consider Tier 2 — change approach rather than patching the same code.
+
+  - name: "Gate 3: Security Scan"
+    id: security_scan
+    needs: [docker_build]
+    run: |
+      docker run --rm eventrelay-test bandit -r src/ -ll -f json
+    success_condition: "exit_code == 0"
+    on_failure:
+      action: "comment"
+      message: |
+        ## ❌ Verification Gate FAILED: Security Scan
+
+        High-severity security findings detected. This PR cannot merge until resolved.
+
+        **Agent:** Fix the specific bandit findings listed above.
+
+  # ═══════════════════════════════════════════════════════════
+  # LAYER 2: Semantic LLM Evaluator
+  # ═══════════════════════════════════════════════════════════
+  - name: "Gate 4: Semantic Code Review"
+    id: semantic_review
+    needs: [pytest_full, security_scan]
+    agent_action: |
+      Review this PR diff against its stated intent (from the issue body).
+
+      Score on four dimensions (1-10):
+      1. Correctness: Does the code do what the issue asked?
+      2. Security: Are there any vulnerabilities introduced?
+      3. Performance: Will this cause regressions under load?
+      4. Test coverage: Are the changes adequately tested?
+
+      PASS threshold: All scores >= 7.
+
+      If PASS: Comment "✅ Semantic Gate PASSED — awaiting human reviewer approval before merge."
+      If FAIL: Comment with specific feedback and request changes.
+
+      Note: Do NOT approve or merge the PR. Human review is required for merge authorization.
+
+  # ═══════════════════════════════════════════════════════════
+  # REQUEST HUMAN APPROVAL (only if all gates pass)
+  # ═══════════════════════════════════════════════════════════
+  - name: "Request Human Approval on Full Pass"
+    id: request_approval
+    needs: [semantic_review]
+    condition: "all_gates_passed"
+    agent_action: |
+      All automated gates have passed. Post a comment on the PR:
+      "✅ All verification gates passed. This PR requires explicit human approval before merge.
+      A repository maintainer (OWNER or MEMBER) must approve this PR to authorize merging."
+      Enable GitHub's native auto-merge feature on the PR (do NOT directly merge).
+      The merge will only proceed after a human approves via GitHub's review system.
+    merge_method: "squash"
+    delete_branch: false  # Keep branch alive for remaining tasks
+
+  # ═══════════════════════════════════════════════════════════
+  # ESCALATION (on repeated failures)
+  # ═══════════════════════════════════════════════════════════
+  - name: "Escalate Stale Tasks"
+    id: escalation
+    trigger: "schedule"
+    agent_action: |
+      Check all open issues with label "agent-task" on this repo.
+      For any issue that has been open > 48 hours without a PR:
+      1. Comment on the issue: "⚠️ This task is stale. Escalating."
+      2. Create a GitHub issue comment or open a new issue tagged "escalation-alert" with:
+         - Issue title and URL
+         - Assigned agent
+         - Time elapsed
+         - Suggested next action
+      3. If the issue has had 3+ failed PR attempts, reassign to a different agent.

.github/pull_request_template.md

@@ -1,3 +1,15 @@
+<<<<<<< HEAD
+## Summary
+
+Describe the outcome and the evidence that supports it.
+
+## Linked issue
+
+Fixes #
+
+## Verification
+
+=======
 ## Canonical issue
 
 Closes #
@@ -21,10 +33,13 @@ Describe the user or operational result this PR produces.
 
 List exact automated and manual checks, tied to the current head SHA.
 
+>>>>>>> origin/main
 - [ ] Focused tests
 - [ ] Required CI
 - [ ] Review threads resolved
 
+<<<<<<< HEAD
+=======
 ## Production evidence
 
 Provide the Vercel preview, production deployment, runtime evidence, or state why production evidence is not applicable.
@@ -37,6 +52,7 @@ Provide the Vercel preview, production deployment, runtime evidence, or state wh
 - [ ] Required checks pass on the current head
 - [ ] Human decision is requested only for product, security, irreversible infrastructure, or production approval
 
+>>>>>>> origin/main
 ## Agent provenance
 
 Human-authored pull requests may delete this section. Agent-authored pull requests must replace agent-lock-example with agent-lock-manifest and fill the values. Scope and test paths remain authoritative in the linked issue.

.github/workflows/AUDIT.md

@@ -11,20 +11,30 @@ concrete reason, verified against the actual repository tree.
 | `.yaml` → `stale.yml` | **FIX (rename)** | File had no basename (literally `.yaml`); renamed to `stale.yml`. Content (daily stale-bot) is sound. |
 | `auto-assign.yml` | **FIX** | Replaced `gh issue edit` with the REST assignees endpoint. The CLI command used GraphQL `replaceActorsForAssignable`, which fails for this repository's GitHub App token when assigning the issue owner. |
 | `auto-label.yml` | KEEP | Labels PRs by changed file type; guarded with try/catch. |
+<<<<<<< HEAD
+| `autonomous-video-processing.yml` | KEEP | Manual matrix batch processor; well-formed, scoped permissions. |
+=======
 | `autonomous-video-processing.yml` | **FIX** | Was a discovery loop whose "processing" step incremented a counter and printed success, so every run reported videos as processed without doing any work. Inline heredoc extracted to `scripts/ci/autonomous_video_{plan,processing,summary}.py` (lintable + unit-tested); added `workflow_call`, secret preflight, guardrail caps, per-video correlation-ID manifests, 30-day evidence retention, and a QA-gated deliverables upload. See the "Multi-agent pipeline alignment" note below. |
+>>>>>>> origin/main
 | `branch-cleanup.yml` | **FIX** | Added `workflows: write` permission (missing permission caused push of restored branch to fail with "refusing to allow a GitHub App to create or update workflow ... without `workflows` permission"). Also restored push-sentinel trigger for `claude/branch-cleanup-*` branches and the restore-branch step, and removed the incorrect NOTE claiming restoration of workflow-containing branches is impossible with this token. |
 | `bulk-issue-processor.yml` | KEEP | Manual bulk issue ops via `gh` + Python; dry-run default. |
 | `ci.yml` | **FIX** | Added blocking `apps/web` type-check and ESLint steps before the build so CI fails fast on TypeScript or lint regressions. |
 | `codeql-analysis.yml` | **FIX** | Removed the OWASP `dependency-check` job — pinned to unstable `@main` and pointed at dead paths (`frontend/node_modules`, `src/mcp-bridge.py`); produced no usable SARIF. Switched the Node cache from the dead `frontend/node_modules` path to the npm download cache (`~/.npm`), which is correct for this npm-workspaces repo. CodeQL analysis itself retained. Dependency coverage already lives in `dependency-review.yml` + `security.yml`. |
 | `coverage.yml` | **FIX** | Added a top-level `name:` and the `workflow_dispatch` trigger the README already documented as available. |
+<<<<<<< HEAD
+=======
 | `gh-aw-validation.yml` | **ADD** | Adds pinned gh-aw (`v0.82.14`) validation for EventRelay's custom markdown workflows. Enforces compile/validate plus actionlint, zizmor, and poutine checks, and verifies committed lock files. |
+>>>>>>> origin/main
 | `dependabot-auto-merge.yml` | KEEP | Comprehensive guards (same-repo, non-draft, SHA match, major excluded). |
 | `dependency-review.yml` | KEEP | PR dependency review with documented allow-lists. |
 | `deploy-cloud-run.yml` | KEEP | The real deployment path (GCP Cloud Run); manual dispatch. |
 | `deploy.yml` | **DELETE** | References a non-existent `deployments/` tree (manifests/terraform); actual infra is `infrastructure/`. The validate job hard-`exit 1`s on missing manifests. Generic multi-cloud (AWS+Azure+Slack) scaffold that duplicates `deploy-cloud-run.yml`. |
 | `e2e-tests.yml` | **FIX** | Resolve the PR's Vercel preview deployment via the GitHub Deployments API before E2E runs, and skip the PR-comment step for forked `pull_request` runs where `GITHUB_TOKEN` is read-only (`Resource not accessible by integration`). Same-repo PRs still get comments. |
 | `emergency-stop.yml` | KEEP | Manual operational kill-switch with typed confirmation. |
+<<<<<<< HEAD
+=======
 | `eventrelay-ci-investigator.md` / `.lock.yml` | **FIX** | Require a dedicated `CODEX_API_KEY` credential in pre-agent steps so Codex-specific runs fail fast with an explicit key-missing error instead of ambiguous fallback behavior. |
+>>>>>>> origin/main
 | `issue-triage.yml` | KEEP | Keyword auto-labeling + triage comment on new issues. |
 | `mcp-optimization.yml` | **DELETE** | Entire workflow targets `mcp-servers/mcp-profiling/` (requirements.txt, investigator_client.py, profiling_server.py) which does not exist — every run fails. |
 | `phase-goal-tracker.yml` | KEEP | Tracks markdown checklists on phase issues, keeps a single status comment updated, and auto-closes the issue when all checklist goals are complete. |
@@ -67,6 +77,9 @@ valid. Referenced paths were checked against the working tree:
 
 | `agent-completion-enforcement.yml` | **ADD** | Protected-default-branch verifier that creates the independent **Agent completion enforcement** Check directly against the PR head SHA. It accepts only an exact-head machine-readable report from the configured dedicated GitHub App; missing/stale/mutable evidence, untrusted label provenance, and custom roles all fail closed. The existing `agent-completion/truth-gate` status stays advisory and must not be made required. |
 
+<<<<<<< HEAD
+The protected policy at `.github/agent-lock/trusted-publishers.json` starts with empty allowlists and therefore blocks until a repository administrator provisions the dedicated App and trusted actor identities through protected review. The repository ruleset must then require **Agent completion enforcement**, one independent approval, and resolved conversations.
+=======
 The protected policy at `.github/agent-lock/trusted-publishers.json` starts with empty allowlists and therefore blocks until a repository administrator provisions the dedicated App and trusted actor identities through protected review. The repository ruleset must then require **Agent completion enforcement**, one independent approval, and resolved conversations.
 
 ## Repository governance workflows
@@ -114,3 +127,4 @@ at `discovery-only` without ever claiming delivery.
 - No `contents: write` on the workflow. Committing session records from CI needs
   elevated permissions; evidence is artifact-only until that trade-off is
   explicitly accepted.
+>>>>>>> origin/main

.github/workflows/README.md

@@ -10,7 +10,10 @@ workflow; this README is the index.
 |----------|------|---------|---------|
 | CI | `ci.yml` | push / PR to `main` | Type-check + lint `apps/web`, build the web app, lint Python (informational), run unit tests |
 | Coverage | `coverage.yml` | push / PR to `main`,`develop`; manual | Generate pytest coverage and upload lcov to Qlty |
+<<<<<<< HEAD
+=======
 | gh-aw Validation | `gh-aw-validation.yml` | push / PR to `main` on gh-aw files; manual | Pin `gh aw` to `v0.82.14`, compile custom EventRelay `.md` workflows, and run validate + actionlint + zizmor + poutine checks |
+>>>>>>> origin/main
 | CodeQL Analysis | `codeql-analysis.yml` | push / PR to `main`; weekly (Mon 06:00 UTC) | Static security analysis for JavaScript/TypeScript and Python |
 | Security Scan | `security.yml` | push / PR to `main`; weekly (Sun 00:00 UTC) | npm audit, Python safety, bandit, Trivy image scan |
 | Dependency Review | `dependency-review.yml` | PR to `main`,`develop` | Review new dependencies for vulnerabilities and license policy |
@@ -25,7 +28,11 @@ workflow; this README is the index.
 | Close stale issues | `stale.yml` | daily (00:00 UTC) | Mark and close stale issues and PRs |
 | Branch Cleanup | `branch-cleanup.yml` | manual; push sentinel on `claude/branch-cleanup-*` | Gated archive-then-delete of branches (dry-run by default); push `[restore-branch:<branch>]` sentinel to restore a deleted branch from its archive tag |
 | E2E Tests | `e2e-tests.yml` | push / PR to `main` | Run Vitest E2E pipeline tests against production or the PR's Vercel preview deployment and report results on the PR |
+<<<<<<< HEAD
+| Autonomous Video Processing | `autonomous-video-processing.yml` | manual | Batch-process YouTube videos by category (matrix) |
+=======
 | Autonomous Video Processing | `autonomous-video-processing.yml` | manual; `workflow_call` | Batch-process YouTube videos by category (matrix) through the ATLAS→PRISM→FORGE→SENTINEL stage pipeline, emitting per-video correlation-ID manifests |
+>>>>>>> origin/main
 | Real Video Processing (Cloud) | `real-processing.yml` | manual | Process a single video: transcript and/or AI analysis |
 | API-cost PostgreSQL | `api-cost-postgres.yml` | push / PR when substrate changes; manual | Exercise fresh, upgrade-from-002, and round-trip migrations plus runtime-role integration tests on PostgreSQL 16 |
 | Deploy to Google Cloud Run | `deploy-cloud-run.yml` | manual | Run migrations, deploy the bounded delivery-disabled worker, then promote a tested API candidate |
@@ -70,6 +77,8 @@ Generates pytest coverage and uploads lcov to Qlty.
   <https://qlty.sh>, then add it under **Settings → Secrets and variables →
   Actions**.
 - Coverage HTML and lcov are stored as artifacts for 30 days.
+<<<<<<< HEAD
+=======
 - The test step is authoritative (`--cov-fail-under=90`, no `continue-on-error`,
   no `|| true`) so failures cannot report green.
 
@@ -119,6 +128,7 @@ record, so any artifact can be linked back to its originating run.
 - A video is `delivered` only when every stage — including the terminal SENTINEL
   QA stage — reports success. The deliverables artifact upload is conditioned on
   that status, so a blocked run publishes evidence but never deliverables.
+>>>>>>> origin/main
 
 ### Deploy to Google Cloud Run — `deploy-cloud-run.yml`
 
@@ -171,8 +181,11 @@ A full audit of this directory was performed (see
 
 
 | Agent completion enforcement | `agent-completion-enforcement.yml` | `pull_request_target`; manual | Creates the independent, head-bound `Agent completion enforcement` Check from protected default-branch code. |
+<<<<<<< HEAD
+=======
 | PR Governance | `pr-governance.yml` | `pull_request_target` (opened/edited/reopened/synchronize/ready_for_review) | Validates that every ready PR links exactly one real open canonical issue and contains non-empty delivery evidence sections; fails on competing PRs. |
 | Repository Reconciliation | `repository-reconciliation.yml` | daily (13:17 UTC); manual | Non-destructive daily report of ready PRs missing a canonical issue, issues with competing implementation PRs, and stale unattached branches. |
+>>>>>>> origin/main
 
 ## Agent-completion enforcement