SPRINT-2 Gate A Report — OIDC Client + BWS (S2-A)

Status: Applied — awaiting Ryan approval before S2-B deploy
Date: 2026-08-28

---

rydaunicorn@gmail.com (pre-Gate D cleanup)

Per Ryan: test account, delete not migrate.

Check	Result
public.users	Was 1 row — deleted (prior session)
FK refs (profile, watchlist, subscriptions, etc.)	0
auth.users	Was 1 row — deleted in same transaction

Remaining RealOutcomes users: 2 (ryan@last1.enterprises, ryan@last1.org).

---

app_clients row (realoutcomes)

Field	Value
app_id / client_id	realoutcomes
Row UUID	fd280953-3af8-4328-8028-d152130e1933

redirect_uris (applied)

URI	Purpose
https://realoutcomes.app/auth/callback	Production
http://192.168.1.99:5000/auth/callback	R940 LAN soak (until SPRINT-3 tunnel)
http://localhost:5000/auth/callback	Local dev

scopes (applied)

openid, email, profile, offline_access, identity:read, app_links:read, trust_events:write

(credentials:read dropped — RealOutcomes does not use credential API.)

---

BWS keys written

Project	Key
Last1.id	LAST1_ID_R940_PROD_REALOUTCOMES_APP_SECRET
realoutcomes	REALOUTCOMES_APP_PROD_LAST1_ID_ISSUER = https://auth.last1.id
realoutcomes	REALOUTCOMES_APP_PROD_LAST1_OAUTH_CLIENT_ID = realoutcomes
realoutcomes	REALOUTCOMES_APP_PROD_LAST1_OAUTH_CLIENT_SECRET
realoutcomes	REALOUTCOMES_APP_PROD_LAST1_OAUTH_REDIRECT_URI = http://192.168.1.99:5000/auth/callback

---

auth-last1id runtime (VM 114)

Item	Status
/opt/auth-last1id/.env	REALOUTCOMES_APP_SECRET present
/opt/last1.id/.env	REALOUTCOMES_APP_SECRET appended
last1id-app container	Fixed — container recreated with REALOUTCOMES_APP_SECRET in env (44 chars verified)

---

Ryan Gate A decision

Please confirm:

1. redirect_uris list above (prod + LAN + localhost)
2. scopes list above
3. Proceed to Gate B code review (PR, no deploy until approved)

Rollback: revert app_clients redirect/scopes from backup; remove env secret; Supabase login on VM 117 still works until S2-E.