fix(auth): audit + review blockers — scope ceiling, Notion refresh, fan-out retryability, removal/callback race

[BenKurrek]

Fixes from the 2026-07-15 auth/lifecycle audit of this branch plus the confirmed findings from Henry's two review batches on #6116. Base PR (#6116) is parked; this stays DRAFT until work resumes. Rebased onto b20aee04+.

Landed (each red→green proven, committed separately)

1. Shared-vendor scope loss — the reported gmail → google-docs sign-out (fix(auth): clamp exchange scopes to the unified recipe ceiling…)
The A6 clamp now bounds the vendor's echoed grant by the unified recipe scope ceiling instead of the per-flow request, so cumulative grants (Google include_granted_scopes, declared in TOML) survive a second extension's connect. Anti-over-claim preserved; generic, no vendor branch. Tests: real gmail+docs manifests unioned like production (verified failing pre-fix with exactly the reported scope loss) + reworked ceiling pin.

2. Notion recipe broken on this branch (A4) (fix(recipes): capture Notion refresh_token + expires_in)
TOML-only: declare /refresh_token + /expires_in captures + rotates_refresh_token = true; without them every Notion connection died ~1h post-connect. Manifest pin + DCR exchange tests, both verified red on the old manifest. Checklist section re-anchored to this branch.

3. Blocked-run fan-out retryability + idempotent continuation replays (fix(auth): keep blocked-run fan-out retryable…) — audit blocker #2 ≡ Henry batch-2 "BlockedAuth fanout failures become permanently non-retryable" (his 100%-confidence item)
An incomplete sweep now errors so the continuation is never marked dispatched and the re-drive paths retry it; replays are safe because the resume dispatch settles idempotently on already-settled gates (same shape the deny path used). Safety unchanged: a stale reference never resumes a different gate — pinned by reworked side-effect-freedom tests. New: incomplete_fan_out_keeps_the_continuation_retryable, resume_continuation_leaves_settled_gate_untouched, oauth_callback_with_stale_gate_converges_without_resuming.

4. Removal/callback credential-resurrection race (fix(auth): close the removal/callback credential-resurrection race) — Henry batch-2, verified
Cleanup now cancels the provider's flows before enumerating accounts (a racing callback either loses its flow before minting, or its mint is caught by the now-later scan), plus cross-replica compensation: a callback whose flow-completion write loses its CAS race revokes the account it just minted. Callback-wins invariant pinned in cleanup_contract; the exact mid-cleanup interleave is not deterministically reachable at contract tier (per-flow lock serializes in-process) — closed by ordering, documented per testing.md.

Suite status: ironclaw_auth 30+27+70 green · composition product_auth 139 green · product_workflow lib 93 green · fmt clean · clippy (3 changed crates, CI-exact) running.
Pre-existing on base (NOT from this PR), verified by stash-and-run: production_libsql_oauth_callback_fans_out_to_all_owner_provider_blocked_runs is red on the unmodified base; gate_prompt_is_posted_exactly_once_… is a parallelism flake (green 3/3 standalone).

Next (specced, not yet implemented)

• Configure-modal false "connected" broadcast after activation failure (Henry batch-2, confirmed at source) — broadcast only on authoritative activation success.
• Crash-mid-remove manifest-tombstone reinstall wedge (audit blocker feat: Sandbox jobs #4).
• Delete dead LifecycleActivation machinery; hardening batch (A9 PkceMode::None reject, flow_status expiry, checklist honesty).
• Henry batch-2 items needing verification-then-fix: Telegram webhook secret_token injection, channel-rebuild ingress leak, cross-extension credential handle namespacing, identity-delete RecordVersion fencing, delivery-coordinator Delivered-vs-durable truth, set_channel_config persist-before-mutate, DM-target JSON validation.
• Henry batch-1 (runtime bridges): usage/receipt fidelity, ToolCall actor propagation, ChannelAdapter::cleanup invocation, removal-compensation snapshot restore, hosted-MCP rediscovery on restart, native reservation RAII.
• Items colliding with the greenfield/blank-slate decision (old-state loading, migration deletion, Docker [slack] volumes) need an owner ratification reply on feat(reborn): unified generic extension runtime + Option A honest state machine (reconcile main) #6116 rather than code.

Full audit evidence: session reports (part1/part2/part3 + verdict).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• staging
• reborn-integration

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 91aa40b5-6f05-4a86-ad3c-1fe9b19a4803

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates the OAuth scope clamping strategy from clamping to the requested scopes to clamping to the recipe's declared scope ceiling, preventing cumulative-grant vendors (like Google) from stripping previously granted scopes and signing out other extensions. It also fixes a bug where Notion connections expired after one hour by declaring refresh token and expiry captures in the Notion manifest. The review feedback suggests a performance improvement in the scope clamping logic by consuming the owned granted vector with into_iter() to avoid unnecessary cloning and heap allocations.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Since granted is an owned Vec<ProviderScope> that is not used after this block, we can consume it using into_iter() instead of borrowing and cloning each ProviderScope. This avoids unnecessary heap allocations and string copying during the token exchange process.

Suggested change

	let clamped: Vec<ProviderScope> = granted
	.iter()
	.filter(|scope| requested_scopes.contains(scope))
	.filter(|scope| {
	recipe
	.scopes
	.iter()
	.any(|ceiling| ceiling == scope.as_str())
	})
	.cloned()
	.collect();
	let over_granted = granted.len().saturating_sub(clamped.len());
	if over_granted > 0 || clamped.len() < requested_scopes.len() {
	let outside_ceiling = granted.len().saturating_sub(clamped.len());
	let granted_len = granted.len();
	let clamped: Vec<ProviderScope> = granted
	.into_iter()
	.filter(|scope| {
	recipe
	.scopes
	.iter()
	.any(|ceiling| ceiling == scope.as_str())
	})
	.collect();
	let outside_ceiling = granted_len.saturating_sub(clamped.len());

References

1. To improve performance, avoid unnecessary heap allocations and cloning when processing collections.

[railway-app]

🚅 Deployed to the ironclaw-pr-6128 environment in ironclaw-ci-preview

Service	Status	Web	Updated (UTC)
ironclaw	✅ Success (View Logs)	Web	Jul 15, 2026 at 8:42 pm