docs: calendar authorization contract (T11)

[wiggdevin]

Summary

One-page design memo for T11: docs/plans/2026-09-04-calendar-authorization.md, 90 lines, nine decisions covering scopes and callback correlation, identity binding, calendar ownership, channel mapping, disconnect and revocation, cache bounds and write fences, propagation timing, refresh-failure UX, and agent access. Docs-only diff. It is the contract T12 (feat/google-calendar) implements and T12a assumes. The file resolves the plan's 2026-09-xx-calendar-authorization.md placeholder.

Review history

Three GPT-5.6 Sol adversarial rounds (high effort, read-only), each triaged against the tree and answered as decisions:

• Round 1: 2 BLOCK, 8 WARN verified (loopback callback accepted an uncorrelated code: no OAuth state or OIDC nonce; binding_generation fenced reads but not writes). 3 Sol BLOCKs downgraded under the plan rubric. All answered.
• Round 2: 1 BLOCK (the fence was compare-then-write, not a compare-and-swap under the store's mutation) plus 8 WARN (mutations after stale membership, confused-deputy calendar ids from the webview, revocation journal shape, cache bounds, 403 matrix, exact wire scopes and access_type=offline, caller provenance, epoch durability). All answered.
• Round 3: 3 BLOCK (agents at operator trust can read a plaintext cache through the bundled shell; a delayed project-wide revocation for G kills a reconnected H; a universal "must find Active{G}" predicate cannot advance journal entries) plus 7 WARN, 1 NIT. All answered; one required the driver scope decision below.

Every file:line citation was verified with sed in the worktree, including 6d4f7f796:calendar.rs:181,261 (PR block#1382's prototype, which already carried state).

Driver decision (scope)

Managed agents run at operator trust with an unrestricted shell (crates/buzz-dev-mcp/src/shell.rs:146, paths.rs:3-7, VISION_AGENT.md:57). The denial seam in decision 9 therefore protects the Google credential and the calendar commands, not rendered event rows on disk; the render cache is readable by any process at the user's trust level like every other local Buzz store, never holds a token or code, and encrypting it would not stop a process that can already read the keychain. Recorded under Risks accepted.

For T12

• Test names fixed by this memo (rejects_mismatched_state, requires_nonce_echo, refuses_binding_after_identity_swap, refresh_after_disconnect_does_not_restore_binding, events_list_after_membership_loss_is_unreadable, stale_rows_unreadable_after_restart, edit_rejected_after_membership_removal, and the per-transition fence tests) belong in T12's traceability table in the implementation plan; the plan file is not edited here.
• Naming and Workspace-admin verification of the owning calendar account is an acceptance gate T12 cannot start without.
• The memo's decision 8 narrows T12's "refresh failure surfaces a reconnect state" to the terminal class; T12's traceability table follows the four states.

Test plan

• just file-size-check exit 0; memo is 90 lines (cap 90).
• Pre-push lefthook lanes green on push (docs-only diff).
• No code, no Cargo.lock, no workflow changes.

🤖 Generated with Claude Code

[wiggdevin]

Converted to draft by the driver on 2026-09-04.

Four Sol passes have not converged: pass 4 still reports 7 BLOCK and 5 WARN (OIDC identity validation, invalid_token semantics, crash-safe account replacement, membership-loss retention vs T12, unused scope, mapping existence oracle, callback server bounds). The memo has grown to 990 lines, which is a full OAuth integration spec rather than the one-page decision contract ticket T11 asked for.

Decision: T11 is not complete. Before wave 3 (when T12 needs it) the memo is cut back to the nine checklist decisions with one reason each, the implementation-level material moves into T12's own design, and Sol reviews the short form. Pass-4 report: scratchpad wave1/calendar-authz/sol-review-pass4.md (local).

🤖 Generated with Claude Code