[bokelley]

Google mailbox equivalence produces a support hint and ID-only audit evidence. Remove the unreachable automatic-consolidation block and the dashboard promise of account merging. Detection neither binds credentials nor copies memberships, aliases, canonical routing or authority; ordinary credential-event authentication continues when the provider or audit is unavailable, with provider details excluded from logs.

Refresh the existing branch onto main 033ce862, retaining its original head. Keep the already-claimed-alias exclusion in both local and read-only provider lookup paths. Current native OAuth regressions distinguish local/provider lookup paths and permit only the authenticating-user UPSERT and the exact ID-only support audit. A matching repeated callback may produce another audit record, as in the original candidate; no new dedupe migration or authority operation is added.

Validation on 03c2eb4: 28 focused unit/callback tests and 4 real PostgreSQL 15.18 authority-preservation integration tests pass, using a disposable local database with the current migration-620 schema prerequisite. Full normal hooks, guards and typechecks pass. Fresh service PostgreSQL/version qualification remains required.

Release hold retained: Draft and post-RC6; genuine security review and fresh exact-head CI are required before promotion. #7514 has merged and is no longer a source-refresh dependency. This is one containment slice of #6827 and does not close that recovery incident. Generic account merging and account-linking mutations remain separately owned.

Draft disposition — 2026-10-09

• Existing author: @bokelley.
• Workstream / hold: Engineering / human review; source qualified and pushed; genuine draft/human hold retained.
• Next action: Automatic Google authority consolidation disabled while credential login and support-only, ID-only audit remain. Both local and provider-fallback already-claimed aliases are excluded; 28 unit and four real PG15.18 tests pass. Full normal hooks and push completed. Existing security/privacy review and draft/auto-off hold remain; no generic identity merge or Identity linking: isolate organization authorization to the authenticated credential #6827 closure.

This draft is retained for the stated workstream. Continue on this existing branch; no parallel PR is needed. This disposition does not waive CI, review, migration, or release gates.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean diff, no blocking or medium findings.

Checked:

• No Critical/High/Medium findings (row 1 does not fire).
• gated_paths: false — row 2 does not apply.
• high_risk: false — rows 3 and 5 do not apply.
• No medium data-loss/schema/infra findings (row 4 n/a).
• No prior decision (row 6 n/a).
• No no-auto-approve team match (row 7 n/a).
• Zero medium findings, so row 8 (≥3 medium) does not fire.
• Falls through to row 9 → approve.

Change removes automatic Google email-alias account consolidation from /auth/callback, replacing WorkOS org-membership copying and mergeUsers with a read-only detection service that emits an ID-only, PII-free audit record and a non-authoritative support banner. No org access or admin authority inheritance. Audit writes are schema-safe; fail-open affects only the cosmetic banner. No protocol/wire surface touched (server/** app change), so no changeset required and no schema↔docs, oneOf, or artifact-immutability concerns apply.

[aao-secretariat]

Re-approval: no reviewable delta since the prior approval; re-submitting after stale-review dismissal.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean pass, no blocking findings.

This PR removes the Google email-alias auto-merge (which unioned credential authority on mailbox equivalence) and replaces it with a detection-only design: a narrow read-only AliasProvider surface, an append-only registry_audit_log row, and a support notice. The reviewer verified the removed authority-union path, the narrow interface, non-leaking error logging, the audit insert shape against migrations, and the two largest delta test files proving no memberships/orgs/API-key authority crosses between aliases.

App/server-only change — no static/schemas/source/**, docs, or dist/** touched, so no changeset is correctly absent. No schema↔docs coherence, oneOf, artifact-immutability, or 3.1.x-eligibility concerns apply.

Gate posture: no critical/high/medium findings (rows 1, 4–8 don't fire); high_risk=false; gated_paths=false with review_decision=APPROVED; no no-auto-approve team match; prior decision was approve. Falls through to row 9.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean subsequent pass, no findings.

Head f0e1578 is a byte-for-byte rebase of the prior-approved commit 0c4973b; the delta was re-read independently. This is a server/app-only change (no static/schemas/source/**, no docs/reference/**, no dist/** artifacts touched), so schema↔docs coherence, changeset scope, oneOf discriminator, artifact immutability, and 3.1.x patch-eligibility gates do not apply.

The change removes Google-alias auto-merge (which previously unioned org memberships, consolidated users, claimed aliases, and bound credentials) and replaces it with read-only detection producing a support hint plus an ID-only audit record. It fails closed on provider/audit errors and leaks no provider details — a net security improvement, not a regression. Verified authority-union removal (http.ts:192-213), lowercased-alias query correctness, audit privacy, the design-system CSS-var migration in dashboard.html, and the two >200-line integration/callback test files that guard the security invariant. No changeset needed (app-only, protocol surface untouched).

Gate checks: gated_paths false; high_risk false; no no-auto-approve team match; review_decision APPROVED. No critical/high/medium findings. Prior decision was approve; net state unchanged. Falls through to row 9.

[bokelley]

Refreshed onto current main in 636d3af. Conflict resolution preserves the current credential-event login boundary while removing the stale automatic-consolidation path. Updated stale fixtures for current relationship analytics and exact-credential API-key authorization. Validation: 10 focused unit/callback tests, 2 PostgreSQL 16 integration cases on a fresh migrated database, typecheck, and diff checks all pass. Keeping this draft until RC6 and #7514.