Connect community web and CLI to shared Cosift accounts

[TeoSlayer]

The community web app and CLI can now use the accounts and tokens issued by cosift-auth, and share followed topics and article requests with cosift-mcp. This keeps the proposed web platform, saved searches, contributions and credit ledger while connecting them to Andrei's agent onboarding infrastructure.

Integration

• Optional COSIFT_AUTH_MODE=shared: email-code browser login, HttpOnly session cookies, direct Firestore account/token verification using the versioned Secret Manager token contract, and revocation/ban handling that fails closed.
• Existing verified-email accounts retain saved requests, contributions and balances when linked to a shared UID. Legacy password sessions are invalidated; SQLite is bound to one explicit project/database. Standalone password mode remains available for separate installations.
• CLI accepts an existing COSIFT_TOKEN for Search/Answer/Research, contributions, local indexing and credits; explicit origin-bound session persistence remains supported. Routine token commands do not revoke an agent's credential.
• Onboarding follows interests through MCP. The web Topics view lists, follows/unfollows, checks coverage and records idempotent article requests. It does not claim that the unfinished article-authoring pipeline is available.
• MCP search compatibility preserves bounded k and retriever parameters and applies the same account quotas/credits as web and CLI requests.
• Version-pinned companion patches inside this PR, tested locally: MCP forwards the verified caller's token per request; the auth deploy script can preserve its existing CIDR proxy-resolver configuration. Neither patch was pushed or deployed in Andrei's repositories.

The PR also retains the community search/answer/research interface, saved requests, URL/CSV/sample contributions, content/embedding revalidation, durable contribution credits and quota reservations, disabled-by-default Stripe checkout, public route restrictions, and the revert of draft ranking PR #54.

Validation

• Full go test -race -timeout 10m ./..., go vet, Linux ARM64 static compilation, and real crawl/serve smoke passed locally.
• 11 browser-logic regressions passed. Manual local browser flow verified shared login, onboarding→MCP topics, duplicate article requests, search/save and logout.
• Official auth token vectors and the real Firestore SDK over a local gRPC fixture cover token parsing/HMAC, document schema, revocation/bans, last-used writes, ambiguity and infrastructure failures.
• Patched MCP: 248 passed, 2 skipped, 5 integration tests deselected.
• Real MCP→community→engine contract verified concurrent account isolation, quota enforcement, credential boundaries and BM25 parameters. Real MCP protocol/tool checks covered topics, lookup and idempotent requests.

See docs/SHARED-ACCOUNTS.md and docs/SHARED-ACCOUNTS-VALIDATION.md for topology, configuration, reproducible checks and limitations.

Security follow-up: the independent Go scan found affected gRPC v1.82.1 call paths and missing Go 1.26.0 standard-library security fixes. The PR now requires gRPC v1.83.2 and Go 1.26.8, and CI runs pinned govulncheck v1.8.0. The final package-level scan reports 0 vulnerabilities in imported packages; it still lists the unused OpenPGP advisory inside the required x/crypto module. CI gates imported packages. A passing Snyk check on the final commit is still required.

Rollout gates — not deployed

Live GCP verification was blocked by expired local Google credentials. Provision the gateway's ADC/IAM access, verify the exact Cloud Run URLs/audiences and Firestore index, and test real email login, credential refresh, revocation/bans and proxy attribution in staging. Without correct client-IP attribution, all web users would share auth's gateway-IP email cap; do not fix that by blindly increasing a public service's trusted-hop count.

Review and land the companion changes before routing production MCP searches through the community gateway. The existing model/load/Stripe acceptance gates still apply. No merge, release, deployment, DNS/org-policy change, updater activation or real Stripe charge has been performed. Auto-merge remains disabled.

Current status: the full local race/coverage suite and 11 web regressions passed after the latest failure sweep; shared-account package coverage is now 90.0%. Commit baf6451 fixes Cloud Run IAM failures being mistaken for user revocation or suspension and adds gateway/CLI/auth failure regressions. Application CI is running on that commit. Snyk still reports an error; its report requires sign-in. Do not override that result based only on the independent Go scan.

Deployment preparation now includes the connected installer/CLI handoff and companion service changes. Live Google access must be restored before IAM, public installer ingress, and staging acceptance can be verified. No production deployment or merge has occurred.

[codecov]

Codecov Report

❌ Patch coverage is 81.50134% with 207 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/community/payments.go	71.51%	30 Missing and 19 partials ⚠️
cmd/cosift/community.go	76.11%	23 Missing and 9 partials ⚠️
internal/community/limits.go	76.53%	13 Missing and 10 partials ⚠️
internal/community/shared.go	90.73%	10 Missing and 9 partials ⚠️
cmd/cosift/community_receipt.go	67.34%	9 Missing and 7 partials ⚠️
internal/community/server.go	80.48%	9 Missing and 7 partials ⚠️
internal/sharedaccount/google.go	76.81%	16 Missing ⚠️
cmd/cosift/community_session.go	84.31%	4 Missing and 4 partials ⚠️
internal/sharedaccount/remote.go	92.98%	5 Missing and 3 partials ⚠️
cmd/cosift/community_moderation.go	0.00%	5 Missing and 1 partial ⚠️
... and 7 more

📢 Thoughts on this report? Let us know!