{
  "_ai_door": {
    "see": "https://miscsubjects.com/start",
    "note": "Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."
  },
  "task": {
    "task_id": "WT-0177",
    "kind": "work",
    "objective": "Lane 2 of the connections layer: OAuth in the door. applyAuth honors oauth2:<connection_id> and oauth2_cc:<connection_id>; a shared token store (KV conn_token:<id>, rotating refresh) that mcpFreshToken also uses; GET /api/connect/<provider>/start and one GET /api/connect/callback for every provider using oauth4webapi (MIT; Arctic is deprecated); revoke endpoint; prove with Slack as the owner's user and a second Google account beside the first.",
    "detail": "Design fixed in bridge/client-bridge/HANDOFF.md, Lane 2. Redirect URI is https://miscsubjects.com/api/connect/callback for every provider. Client secrets are Worker secrets OAUTH_<PROVIDER>_CLIENT_SECRET, never D1. Callback fetches the provider identity endpoint and writes external_account_id + scopes_json + state=connected. Developer-app registration is the only owner-hands step; drive his Chrome through it.",
    "state": "completed",
    "priority": 1,
    "revision": 7,
    "depends_on": [],
    "permitted_capabilities": [
      "CODE_LEASE_START",
      "CODE_LEASE_COMMIT",
      "DEPLOY_LEASE",
      "D1_QUERY",
      "DIR_PATCH",
      "LOCAL_EXEC",
      "KV_PUT_JSON",
      "KV_GET_JSON"
    ],
    "acceptance_tests": [
      {
        "id": "connect_route",
        "type": "http_ok",
        "url": "/api/connect"
      },
      {
        "id": "connect_schema",
        "type": "contains",
        "url": "/api/connect",
        "needle": "oauth2",
        "scope": "raw"
      },
      {
        "id": "one_oauth_connected",
        "type": "sql_count_at_least",
        "sql": "SELECT COUNT(*) FROM connections WHERE mechanism IN ('oauth2','oauth2_cc') AND state='connected'",
        "min": 1
      },
      {
        "id": "two_google",
        "type": "sql_count_at_least",
        "sql": "SELECT COUNT(*) FROM connections WHERE service='google' AND state='connected'",
        "min": 2
      },
      {
        "id": "oauth_rows",
        "type": "sql_count_at_least",
        "sql": "SELECT COUNT(*) FROM directory WHERE auth LIKE 'oauth2:%'",
        "min": 1
      },
      {
        "id": "evidence",
        "type": "evidence_present",
        "field": "slack_send_as_owner_trace"
      }
    ],
    "required_evidence": [
      "slack_send_as_owner_trace",
      "google_second_account_trace",
      "refresh_after_expiry_trace"
    ],
    "parent_task": null,
    "supersedes": null,
    "failure": null,
    "failure_count": 0,
    "last_result": {
      "accepted": true,
      "tests_declared": 6,
      "tests_passed": 6,
      "tests_inherited_from": null,
      "results": [
        {
          "id": "connect_route",
          "ok": true,
          "detail": "HTTP 200 https://miscsubjects.com/api/connect"
        },
        {
          "id": "connect_schema",
          "ok": true,
          "detail": "contains \"oauth2\" in https://miscsubjects.com/api/connect (scope=raw) → true"
        },
        {
          "id": "one_oauth_connected",
          "ok": true,
          "detail": "count=2 (need 1)"
        },
        {
          "id": "two_google",
          "ok": true,
          "detail": "count=2 (need 2)"
        },
        {
          "id": "oauth_rows",
          "ok": true,
          "detail": "count=14 (need 1)"
        },
        {
          "id": "evidence",
          "ok": true,
          "detail": "checked against required_evidence",
          "evidence_field": "slack_send_as_owner_trace"
        }
      ],
      "missing_evidence": []
    },
    "completed_at": "2026-09-11T01:24:26-07:00",
    "created_at": "2026-09-10T22:12:09-07:00",
    "updated_at": "2026-09-11T01:24:26-07:00",
    "audit": "/api/work/task/WT-0177/audit",
    "submit_to": "/api/work/task/WT-0177/submit"
  }
}