# Google OAuth Verification Response Package Date: 2026-08-27 (Australia/Sydney) Status: local engineering candidate; external alignment, recording, credential delivery, deployment, and email reply remain approval-gated. This package responds to Google's 2026-08-26 request for a stronger restricted scope justification, exact implementation/configuration alignment, a new demo video, and usable reviewer access. It contains no OAuth secrets, tokens, credentials, account identifiers, or passwords. ## Decision StratoFusion cannot replace `https://www.googleapis.com/auth/drive` with `drive.file`, a read-only scope, or a Picker-only workflow without removing core product behavior. The product is an account-wide, multi-provider storage manager. After a user connects a Google Drive account, StratoFusion must operate across existing files, folders selected later through normal browsing, and future files covered by an explicitly configured recurring backup or sync. A per-file grant cannot discover the account hierarchy, search pre-existing content, or continue a user-configured job as new matching files appear. ## Product Behavior Requiring Full Drive Access | Visible behavior | Why a narrower scope is insufficient | | --- | --- | | Browse an existing Drive hierarchy | Users navigate files and folders that were not created by StratoFusion or individually selected through Picker. | | Search and optional indexing | Search and user-enabled indexing cover existing content across the connected account, including Google Workspace export flows. | | Download and cross-provider transfer | Users select existing Drive items and copy or move them to another connected provider. | | Upload, create folder, rename, and trash | These user-facing operations require write access in addition to account-wide discovery. | | Backup | A user explicitly chooses source, destination, and schedule. Later runs must include future source items without repeating a Picker grant for each file. | | Sync | A user explicitly configures direction and mode. Subsequent reconciliation must discover and update current and future items on both sides. | The grant is not used for advertising, sale of user data, generalized AI model training, or unrelated profile access. StratoFusion's Drive connection does not request separate Google `openid`, `userinfo.email`, or `userinfo.profile` scopes. Connected-account display metadata comes from the Drive API. ## Exact Scope Alignment The requested scope must match in all three places before submission: 1. the reviewed source revision and deployed application; 2. Google Auth Platform Data Access and consent-screen configuration; and 3. the expanded scope shown in the recorded production OAuth grant. The canonical source constant is `src/lib/oauth/google-drive-scope-policy.ts`. The following production paths consume that exact constant or its exact-token validator: - `src/lib/oauth/scope-builder.ts` — direct Google connection request; - `src/config/services/google.config.ts` — provider service configuration; - `src/lib/clerk-oauth-integration.ts` — social connection eligibility; - `src/lib/rclone/core/config-templates.ts` — worker remote configuration; - `src/app/api/google/create-folder/route.ts` — folder OAuth client; - `src/app/api/google/upload/route.ts` and `src/server/uploads/google-upload-session.ts` — upload authorization. Authorization checks use exact scope tokens. `drive.file`, `drive.readonly`, prefixes, and suffixes do not satisfy the full-Drive requirement. Regression tests cover this distinction. The legacy `src/services/GoogleDriveService.ts` provider declaration still contains the same exact literal; changing that oversized legacy file solely to import the constant would violate the current 500-line CASA changed-file gate, so its value is verified during review rather than represented as a constant consumer. ## External Alignment Checklist These are read-only verification steps until a separately authorized operator approves a configuration change: - [ ] Confirm the selected Google Cloud project and production OAuth client by exact ID against the private inventory. - [ ] Confirm Data Access lists exactly `https://www.googleapis.com/auth/drive` for the submitted client. - [ ] Confirm the consent-screen scope explanation describes the product behaviors above and does not imply Picker-only access. - [ ] Confirm publishing status remains **In production**. - [ ] Confirm homepage, privacy, and terms URLs match the submitted production application and respond without an authentication redirect. - [ ] Confirm the deployed revision requests the same exact scope. - [ ] Preserve redacted screenshots or exports with timestamps; exclude client secrets, tokens, authorization codes, OAuth state, account IDs, IPs, and reviewer credentials. Any mismatch stops the recording. Do not edit the Cloud project or deploy a candidate merely to make the evidence appear aligned; obtain the relevant authorization first. ## New Demonstration Video Acceptance Criteria Record one continuous production flow after the exact candidate is deployed and the external alignment checklist passes. 1. Show the submitted app identity, production origin, privacy/terms links, selected Cloud project, production client, and Data Access page. 2. Start from StratoFusion's real **Connect Google Drive** entry point and show its provider disclosure before leaving the app. 3. Show the Google account chooser and complete consent screen in English. 4. Expand the consent detail so the full `https://www.googleapis.com/auth/drive` URL is readable. 5. Return to StratoFusion and prove access to a pre-existing Drive item that was not individually selected through Picker. 6. Demonstrate browse, search, and download against that source account. 7. Demonstrate upload, folder creation if practical, rename, and move-to-trash; show the corresponding effects in the source Google Drive account. 8. Demonstrate a cross-provider copy and show the destination effect. 9. Configure a backup and sync with explicit source, destination, direction, and mode; show the resulting job/effect without overstating completion. 10. End on the connected account/workspace and state why current and future account-wide items cannot be covered by `drive.file` plus Picker. The recording must not expose credentials, OAuth state, authorization codes, tokens, client secrets, unrelated browser tabs, personal notifications, or private files. Use dedicated non-admin reviewer/provider accounts containing synthetic data. ## Recorder Safety Contract `scripts/record-google-oauth-verification-ready.mjs` performs real provider writes. It now refuses to start unless all target, account, source, destination, and Cloud project values are supplied explicitly. The operator must set `STRATOFUSION_RECORDER_CONFIRM_TARGET` to the exact base origin. Production also requires `STRATOFUSION_RECORDER_ALLOW_PRODUCTION=true`. The recorder has no default personal email, storage state, provider account, or production target. OAuth logs retain only endpoint, redirect URI, and scope tokens; state and account hints are discarded. Review the generated recording and artifacts for accidental disclosure before upload. ## Reviewer Access - Create a dedicated non-admin reviewer identity with only synthetic provider data and the minimum product entitlement needed for the demonstrated flow. - Verify sign-in in a clean browser from the instructions Google will receive. - Avoid phone, payment-card, invitation, email-domain, CAPTCHA, or administrator approval blockers. - Provide exact step-by-step navigation from sign-in to Google Drive connection and each feature shown in the video. - Send credentials only through Google's designated secure verification channel. Never commit them, include them in the video, or paste them into a public issue or ordinary documentation. - Do not weaken production administrator MFA to create reviewer access. ## Direct Reply Draft Reply in the existing Google Trust and Safety thread after alignment, video, and reviewer access are complete: > Hello Google Trust and Safety, > > We have updated the requested evidence for StratoFusion. We confirmed that > the deployed application, Google Auth Platform configuration, consent screen, > and demonstration all request the same restricted scope: > `https://www.googleapis.com/auth/drive`. > > StratoFusion cannot use `drive.file` plus Picker because it is an account-wide > multi-provider storage manager. Users browse and search pre-existing Drive > content, transfer selected existing items between providers, and explicitly > configure recurring backup and sync jobs that must discover future items. > The application also provides upload, create-folder, rename, download, and > move-to-trash operations. Per-file selection cannot support account hierarchy > discovery or future items covered by a user-configured recurring job. > > The new video shows the production app entry point, expanded English consent > detail with the exact scope, a pre-existing non-Picker-selected item, the > user-facing read/write/transfer features, and the effects in the connected > source and destination accounts. The application remains In production. > > We have also supplied active dedicated reviewer credentials and step-by-step > navigation through the designated secure channel. Please let us know if any > additional evidence is required while the CASA assessment proceeds. ## Approval Gates And Completion Boundary Local code, tests, documentation, and a pull request may proceed autonomously. The following remain separate explicit approvals: - Google Cloud or consent-screen configuration changes; - deployment to staging or production; - use or creation of reviewer credentials; - running the mutating recorder against any remote account; - publishing or uploading the video; and - sending the Google reply. This package prepares the response; it does not claim that any of those external actions have occurred.