Pre-release validation: hosted OAuth and settings sync

[siracusa5]

Context

Follow-up to #38. The implementation may merge after code review and CI, but these hosted acceptance checks remain pre-release gates for the desktop account-sync release.

Acceptance checks

• Packaged GitHub OAuth and Keychain persistence

  • Run a packaged build configured for the hosted ContextCake Supabase project.
  • Complete the GitHub browser flow and confirm the contextcake://auth/callback deep link returns to the app.
  • Confirm signed-in state survives an app restart through macOS Keychain-backed encrypted storage.
  • Confirm cancel/retry and sign-out clear pending or persisted session state without exposing tokens in plaintext.

• Second macOS user/device settings roundtrip

  • Sign into the same ContextCake account from a second macOS user or Mac.
  • Change a safe preference/profile/source-metadata value and confirm it syncs in both directions.
  • Confirm paths, MCP commands/arguments, cache directories, credential references, and other machine-local execution details do not transfer as runnable configuration.

• Hosted account deletion

  • Use a disposable test account and invoke self-service account deletion.
  • Confirm the Supabase Auth user and owner settings row are removed.
  • Confirm local encrypted session state is cleared and ContextCake remains usable while signed out.

Evidence to record

• Packaged app version and commit SHA.
• macOS versions/devices used.
• Redacted screenshots or logs for each check.
• Confirmation that the hosted database/Auth records were removed after deletion.

Do not publish the desktop account-sync release until every acceptance check above passes.

[siracusa5]

Status: this gate was breached

Recording what happened, because the checks below are still outstanding and three releases have shipped past them.

#38 merged 2026-07-15 deferring three hosted acceptance checks here, noting they "remain required before publishing the desktop account-sync release." Since then:

Release	Date	Account sync reachable?
0.1.0	2026-07-17	yes
0.2.0	2026-07-20	yes
0.3.0	2026-07-29	yes

Reachable, not merely present: generate-supabase-config.mjs throws unless SUPABASE_URL and SUPABASE_ANON_KEY are set, app-release.yml supplies both from repository secrets, and AccountPanel renders unconditionally in Settings with sign in, sign out and delete account. There is no feature flag — every published build can sign a user into the hosted project.

To be clear about what this is and isn't: nothing here says the feature is broken. It says nobody has confirmed it works on the artifact users download.

Some of this is already discharged

Re-checking the acceptance list against the test suite, several sub-bullets are covered automatically on every PR by the desktop job and don't need a manual repeat:

Sub-check	Covered by
Callback state validation; only an encrypted session is written	auth.test.mjs
Cancel/retry cannot orphan or hijack an in-flight attempt	auth.test.mjs
Sign-out clears the encrypted local session, including offline	auth.test.mjs
Paths, MCP commands/args, cache dirs, credential refs never sync as runnable config	settings-sync.test.mjs
Second-client convergence: tombstones, account switch, last-write-wins	settings-sync.test.mjs

What genuinely remains

Three things cannot be simulated — a packaged app, a second physical machine, and the hosted database:

1. Packaged OAuth + Keychain persistence — real browser flow, contextcake://auth/callback returning to the packaged app, session surviving a restart, cancel mid-flow persisting nothing.
2. Second-machine settings roundtrip — convergence both directions; the second machine's sources arriving as non-runnable pending metadata.
3. Hosted account deletion — Auth user and user_settings row both gone, local state cleared, app still usable signed out.

Commands and full steps are in docs/release-gates.md (#75).

Stopping the recurrence

Nothing connected this issue to the release workflow — a gate declared only in an issue is enforceable only by someone remembering it. #75 adds a release-workflow step that refuses to publish while an ## Open: section remains in docs/release-gates.md, and records this gate there.

Once #75 lands, app-v0.3.1 will fail until this gate is closed. That's intended.