Tier 4 Onset — T-3 Gate A Report — OIDC Client + BWS¶

Status: Applied — awaiting Ryan approval before Gate B code refactor
Date: 2026-08-29
Pattern: RealOutcomes SPRINT-2 Gate A (SPRINT-2_GATE_A_REPORT.md)

Summary¶

Extended the existing onset system OAuth client on auth.last1.id with clinic portal callback URIs. Did not rotate ONSET_APP_SECRET (preserves iOS deep-link OAuth on the same client). Wrote ONSET_APP_PROD_LAST1_OAUTH_* keys to the onset BWS project for Gate C deploy render.

iOS impact: None. iOS redirect URIs (onset://last1/callback, https://theonset.app/last1/callback) preserved unchanged.

app_clients row (`onset`)¶

Field	Value
app_id / client_id	`onset`
Row UUID	`8c19617f-1a48-4dd0-92e7-f25b2c005156`
client_classification	`internal`
client_secret_hash	`null` (system app — env secret)

redirect_uris (applied)¶

URI	Purpose
`onset://last1/callback`	Preserved — iOS Last1.id link
`https://theonset.app/last1/callback`	Preserved — iOS web fallback
`https://clinic.theonset.app/auth/callback`	New — clinic portal production
`http://192.168.1.101:3000/auth/callback`	New — R940 LAN soak (onset-app VM 118)
`http://localhost:3000/auth/callback`	New — local dev

scopes (applied)¶

openid, email, profile, offline_access, identity:read, app_links:read

trust_events:write omitted: clinic.theonset.app has no trust-events integration (unlike RealOutcomes). Add at Gate B only if code audit finds a consumer.

Rollback JSON: backups/onset-gate-a-2026-08-29/app_clients-onset-pre-gate-a.json

BWS keys¶

Last1.id project (`cffb320a-5f61-4e1d-85df-b480012151ec`)¶

Key	Status
`LAST1_ID_R940_PROD_ONSET_APP_SECRET`	Already present (44 chars) — not rotated

Naming note: Identity infra secrets use LAST1_ID_R940_PROD_* per R940_NAMING_CONVENTION_v1.md §5 (not {PRODUCT}_APP_PROD_*). Maps to runtime ONSET_APP_SECRET on last1id-app.

onset project (`1c643206-048d-42ea-980c-b48001216f05`) — created Gate A¶

Key	Value
`ONSET_APP_PROD_LAST1_OAUTH_CLIENT_ID`	`onset`
`ONSET_APP_PROD_LAST1_OAUTH_CLIENT_SECRET`	Copy of Last1.id BWS secret (server token exchange)
`ONSET_APP_PROD_LAST1_ID_ISSUER`	`https://auth.last1.id`
`ONSET_APP_PROD_LAST1_OAUTH_REDIRECT_URI`	`http://192.168.1.101:3000/auth/callback` (LAN soak until T-4 tunnel)

auth-last1id runtime (VM 114 / LAN `192.168.1.96`)¶

Item	Status
`/opt/auth-last1id/.env`	`ONSET_APP_SECRET` present
`last1id-app` container	`ONSET_APP_SECRET` in env (44 chars verified)
Container recreate	Not required — secret unchanged

Cross-stack window (documented)¶

Surface	Auth issuer	Gate
Clinic portal (T-3+)	`auth.last1.id`	This sprint
iOS / TestFlight	Hosted GoTrue (`emxrmjysvxeboavhatry`)	Until App Store release (Q4 lock)

Both share the onset OAuth client on auth.last1.id for iOS Last1.id linking only; clinic PKCE uses the new /auth/callback URIs above. iOS Supabase JWT auth remains on hosted until a future sprint.

Ryan Gate A decision¶

Please confirm:

redirect_uris list above (prod + LAN :3000 + localhost + preserved iOS URIs)
scopes list above (no trust_events:write)
Secret policy: keep existing ONSET_APP_SECRET (no rotation) — OK?
Proceed to Gate B (@last1id/sdk clinic refactor, PR for review, no deploy)

Rollback: PATCH app_clients from backups/onset-gate-a-2026-08-29/app_clients-onset-pre-gate-a.json; delete four new onset BWS keys; clinic Supabase login on Railway / onset-db GoTrue still works until Gate E.

STOP — Gate A. Reply Gate B go to authorize code refactor.