fix(auth): audit + review blockers — scope ceiling, Notion refresh, fan-out retryability, removal/callback race - #6128

Merged

BenKurrek merged 5 commits into

nea25/unified-vs-mainfrom

nea25/fable-audit-fixes

Jul 15, 2026

Commits on Jul 15, 2026

fix(auth): clamp exchange scopes to the unified recipe ceiling, not the per-flow request

BenKurrek
and
claude
committed
cf0c2ee
fix(recipes): capture Notion refresh_token + expires_in (A4)

BenKurrek
and
claude
committed
83ebe6b
fix(auth): keep blocked-run fan-out retryable; settle replayed gate continuations idempotently

BenKurrek
and
claude
committed
b6f409b
fix(auth): close the removal/callback credential-resurrection race

BenKurrek
and
claude
committed
6c308aa
docs(extensions): correct the resolved-manifest contract to blank-slate fail-loud

BenKurrek
and
claude
committed
49c1c25