docs(plan): seal auth foundation through Task 3

Author: fffonion

plans/2026-09-03_production-agent-auth-and-usability.md

@@ -847,7 +847,7 @@ The RSS-tool migration is the first implementation phase. Tasks 1–13 remain bl
 
 ### Task 1: Address the integrated config/auth boundary
 
-**Status:** acceptance reopened for the boundary address. Existing integration `1c0b8dfd8aaac82552adf66cf0dee114f0af4e8f` remains in history and is not reverted. This task must pass Stage A before Task 2 continuation.
+**Status:** accepted in the current integration line. Stage A passed independent spec and quality review after opaque identity, fixture isolation, bounded lifetime and CI-test race corrections. The accepted integration history is retained; no earlier integration commit is reverted.
 
 **Objective:** add bounded structural config/auth schemas and path resolution while proving that provider selection/default/business interpretation is RSS-owned and that the foundation can be exercised through a minimal RSS entry.
 
@@ -879,7 +879,7 @@ tests/config_rss_entry_tests.rs
 
 ### Task 2: Snapshot-review and build the secure auth store
 
-**Status:** unaccepted. The interrupted Task 2 snapshot must be reviewed before continuation; no acceptance may be inferred from the existing integration commit.
+**Status:** accepted in the current integration line. The interrupted snapshot was frozen and reviewed before recovery; the completed store then passed independent spec and quality review, including canonical envelopes, generation-aware revocation, per-credential refresh single-flight and bounded secret-slot lifetime.
 
 **Objective:** provide host-side credential persistence and concurrency primitives while keeping token lifecycle meaning and refresh/reauth policy in RSS.
 
@@ -922,6 +922,8 @@ tests/auth_store_rss_tests.rs
 
 ### Task 3: Implement generic OAuth/PKCE primitives for RSS orchestration
 
+**Status:** accepted in the current integration line. Generic PKCE, callback, bounded transport, authorization-code/device primitives and the real RSS flow entry passed independent spec and quality review. OAuth host entries remain fixture-only; Task 4 still owns production catalog exposure.
+
 **Objective:** provide reusable crypto, callback, bounded transport and secret-persistence primitives without implementing a Rust OAuth workflow engine.
 
 **RSS owner:** create `rss/auth/oauth_flow.rss` for generic authorization-code/device flow sequencing, refresh timing, retry/backoff and status/error policy. Provider adapters select scopes, public parameters and payload interpretation.
@@ -948,6 +950,8 @@ tests/oauth_rss_entry_tests.rs
 
 **Commit:** `feat(auth): add generic oauth flows and refresh`
 
+**Batch seal record (2026-09-07):** work through Task 3 is sealed at integration code commit `31f2df8` (Task 2 integration base `543543f`; Task 3 commits `a8ed9e9`, `318b025`, `31f2df8`). Final focused verification covered Task 1 config/auth, Task 2 store/RSS and Task 3 OAuth/RSS suites, plus format, workspace all-feature check and strict Clippy. Tasks 4 and later remain pending for a future batch; no production OAuth catalog is exposed by this seal.
+
 ### Task 4: Expose the confined OAuth host bridge
 
 **Objective:** register generic host primitives for RSS without encoding Codex or any provider workflow in Rust.

tests/gateway_tests.rs

@@ -2351,9 +2351,7 @@ async fn stop_waits_on_a_blocking_thread_during_a_storage_stall() {
     }
     let slow_persistence = persistence.clone();
     let slow_load = tokio::task::spawn_blocking(move || {
-        let started = std::time::Instant::now();
         slow_persistence.load().expect("reload should succeed");
-        started.elapsed()
     });
     tokio::time::sleep(std::time::Duration::from_millis(150)).await;
 
@@ -2370,6 +2368,10 @@ async fn stop_waits_on_a_blocking_thread_during_a_storage_stall() {
         .await
     });
     tokio::time::sleep(std::time::Duration::from_millis(150)).await;
+    assert!(
+        !slow_load.is_finished(),
+        "the seeded reload must still occupy the worker before stop"
+    );
 
     // The stop request: while it is pending, an unrelated request spawned
     // alongside it must still complete within a strict budget. On a
@@ -2411,17 +2413,16 @@ async fn stop_waits_on_a_blocking_thread_during_a_storage_stall() {
             .0,
         StatusCode::OK
     );
-
-    let slow: std::time::Duration =
-        tokio::time::timeout(std::time::Duration::from_secs(120), slow_load)
-            .await
-            .expect("the reload must finish")
-            .expect("reload task must not panic");
     assert!(
-        slow >= std::time::Duration::from_millis(1200),
-        "the seeded reload must actually occupy the worker for a while (took {slow:?})"
+        !slow_load.is_finished(),
+        "the unrelated request must complete while storage remains stalled"
     );
 
+    tokio::time::timeout(std::time::Duration::from_secs(120), slow_load)
+        .await
+        .expect("the reload must finish")
+        .expect("reload task must not panic");
+
     let (stop_status, stop_body) = tokio::time::timeout(std::time::Duration::from_secs(60), stop)
         .await
         .expect("the stop must finish once the stall drains")

tests/oauth_flow_tests.rs

@@ -9,10 +9,10 @@ use std::time::{Duration, Instant};
 
 use rustscript_agent::auth::oauth::{
     BoundedPublicOAuthIntent, BrowserOpener, CallbackMode, CallbackWaiter, CredentialUse,
-    MAX_LIVE_OAUTH_FLOWS, OAuthClock, OAuthError, OAuthFlowKind, OAuthHost,
-    OpaqueAuthorizationCodeHandle, OpaqueVerifierHandle, PreparedHttpsRequest, ProviderRequest,
-    RawCallbackInput, RawHttpsResponse, ScriptedBrowser, ScriptedCallback, ScriptedCancel,
-    ScriptedClock, ScriptedHttpsTransport, TrustedEndpoint, TrustedTransportPolicy,
+    MAX_LIVE_OAUTH_FLOWS, OAuthError, OAuthFlowKind, OAuthHost, OpaqueAuthorizationCodeHandle,
+    OpaqueVerifierHandle, PreparedHttpsRequest, ProviderRequest, RawCallbackInput, ScriptedBrowser,
+    ScriptedCallback, ScriptedCancel, ScriptedClock, ScriptedHttpsTransport, TrustedEndpoint,
+    TrustedTransportPolicy,
 };
 use rustscript_agent::auth::pkce::{self, PKCE_CHALLENGE_METHOD};
 use rustscript_agent::auth::store::AuthStore;