fix(calendar): reject deployment-wide provider credentials in hosted runtime

[seonghobae]

Security/product boundary

The hosted multi-user Calendar runtime must not use deployment-wide provider credentials as request authority. Protected main already has user-owned connection metadata, encrypted Calendar secret storage and credential materialization primitives, but the production bootstrap still composed process-wide Google or CalDAV credentials while synchronization authority was only workspace-scoped.

Test-first change

• Original RED 768383f9e68a7534420ab464fc586e6e798486de and GREEN c6e017fe3c8df823270a448d04aef8906c3838cd removed the deployment-wide Google path from hosted composition while retaining explicitly invoked standalone Google composition.
• RED 224b2f66f7f99210cd04f6452bc7f1bee96d15ab requires hosted composition to reject both Google and CalDAV process-wide credentials.
• GREEN 256e33f9c72ebe483943143ad6202ed7ca7f4284 makes the hosted factory fail closed for both supported standalone providers until authenticated user-owned connection evidence and scoped secret materialization are composed.

This advances #129 but does not complete it. Hosted user-scoped provider composition, OAuth callback/token exchange/refresh, provider cleanup, calendar discovery/selection and end-to-end scoped synchronization remain required. Stacked #228 now owns the bounded Google OAuth authorization-state/PKCE slice and is non-force restacked on this exact parent.

Protected-main adoption

Protected main advanced through merged runner-control foundation #218 to 193a87ef54c3fe6dcda4755bce4d6bc81e3a0297.

Current exact head 217370c8effcd96b760e7b32f4cf4f117385133d is a non-force two-parent descendant of prior Calendar head e322b2bc0981d8acc708b5b3ae680459e33b2e8a and current protected main. Fresh compare from protected main is ahead-only (behind_by=0, ahead_by=11) with exactly six Calendar/configuration/documentation paths: .env.example, ARCHITECTURE.md, CHANGELOG.md, README.md, the provider-environment test, and Calendar main.ts. Shared workflow/control-plane changes arrive through ancestry only.

Fresh exact-head CI, Security Scan, SAST Semgrep, CodeQL PR, Commercial Readiness and AppGuardrail runs are all queued. Queued evidence is not GREEN. No predecessor check/review evidence transfers after the head move.

Keep Draft until the unchanged exact head has terminal applicable repository/security checks, current independent review/thread requirements and live-base compatibility. No self-approval, bypass, force-push, destructive rebase, stale evidence reuse or gate weakening.

Refs #129, #228.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.