feat(calendar): add scoped Google OAuth state and PKCE authority

[seonghobae]

Scope

Advances #129 with one bounded hosted Google Calendar OAuth authorization-state slice stacked on Draft #216. This PR does not exchange provider tokens, complete hosted provider composition, or close #129.

Test-first evidence

• RED f9a45bcaadcaa2dcc570083f135700ba5d5aa775 adds the authorization-state/PKCE contract tests before the production module exists.
• 0c0705abb4feb9151210b9c38e8f8daaaa03cdc4 adds the Calendar-owned application and persistence/secret-store ports.
• RED bb663420bedfc14fdd71a52e814e6e77f9a5e1c0 → 7801a99a2e631a63e926275a352fdcadb97c27b5: malformed secret-handle compensation.
• RED f656d1198c97b79a5d92ceb4c4c9acb7651cf5f2 → 7244795991b58006f2842b2bb64d5d853e682484: scoped secret purpose/lifetime.
• RED 7db60914077cd8620db8b6a245920225d2b7be1a → 07f23381f1bca354d1e2e6501ab1fdbbf1fc02a3: scoped verifier materialization and cleanup.
• RED 8d7aa2e4f75eff407af1ab380b77679b5d162775 → causal repair 2b7250aa18e6c7e8aa919b54c9f65373381bc09e: a consumed repository row is dependency evidence, not trusted in-process state. A Proxy-backed field getter that previously could expose password=must-not-escape-oauth-state-evidence is now collapsed inside one credential-free validation boundary before verifier materialization. A bounded Node reproduction confirms predecessor native detail escaped while the repaired boundary returns only the fixed unavailable classification.
• 0da52b857f37515c002d4c8e73442f53f89ced10 records the authorization/evidence boundary in CHANGELOG.md.

The slice binds each five-minute authorization ceremony to trusted life-os.calendar-user.v1 workspace/user authority, one operator-configured HTTPS callback URI, and fixed google_calendar_oauth_authorization purpose. Durable OAuth state contains only opaque credential-free authority evidence; verifier material stays behind the secret-store port. Persistence-returned consumed records are revalidated as hostile dependency evidence before their secret reference can be used.

Provider token exchange, successful post-exchange verifier deletion, concrete PostgreSQL state persistence, hosted callback composition, refresh, provider cleanup and calendar discovery remain follow-up work.

Current stack

Parent #216 has non-force adopted current protected main@193a87ef54c3fe6dcda4755bce4d6bc81e3a0297 and is now exact 217370c8effcd96b760e7b32f4cf4f117385133d.

This child previously targeted parent e322b2bc0981d8acc708b5b3ae680459e33b2e8a. The parent advance changed only shared workflow/control-plane paths and did not overlap the two OAuth source/test files. Non-force merge descendant 31a54ad90c610c087dbb32eec1bfd393379bc4ce adopted current #216 without rewriting child history; the subsequent RED/repair/CHANGELOG commits preserve that ancestry.

Current exact head 0da52b857f37515c002d4c8e73442f53f89ced10 compares ahead-only from current parent (behind_by=0, ahead_by=14) with four paths: the OAuth application, its original contract tests, the hostile-evidence regression test, and CHANGELOG. No parent authority or workflow file is copied into the child delta.

This remains a non-default stacked Draft. Exact-head PR-triggered workflow runs are absent, and there are no submitted reviews or inline review threads; none of that is GREEN evidence. Keep Draft until #216 integrates normally, this child is retargeted/revalidated on protected-main lineage, focused/full tests and applicable exact-head CI/security/review gates are terminal.

Refs #129, #216.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}