[harrisonoconnorhover]

What changed

• load and verify the fixed same-origin Dander bootstrap descriptor, with explicit 404 loopback/offline mode
• add external OIDC authorization-code + PKCE login with state, nonce, and the Dander API audience as resource
• keep access tokens in memory and callback transactions in session storage; reject refresh tokens, URL tokens, client secrets, unsafe callbacks, and foreign-origin Bearer requests
• export static /auth/callback and /signed-out routes and preserve the existing static build/local workspace

Why

DRUFF-25 establishes the authenticated, provider-neutral browser boundary required before the generated hosted Control API client can replace local-only graph management. It does not add remote graph UI, provider logic, cloud resources, or a Next server.

The independent completion review caught Strict Mode overwriting the preserved callback URL; the final implementation captures once, cleans the address immediately, and has a Strict Mode regression proving the original code/state is processed exactly once.

Checks

• pnpm contracts:check
• pnpm typecheck
• pnpm lint
• pnpm format:check
• full Vitest: 61 files / 627 tests
• Playwright: 10/10
• static production build, including /auth/callback and /signed-out
• independent adversarial pre-implementation and completion review