iter4 Phase 0 — security & production hardening blockers

[jdhart81]

Six cutover-gating fixes for the paid hosted MCP (hosted-mcp/), ahead of the 2026-11-19 Energy AI cutover. All acceptance tests included and green.

C1 Real GitHub-OIDC authentication & account recovery. /authorize is now
IdP-gated; oauth_subject = "github:"+id (immutable, UNIQUE). The same
identity always resolves to the same caller_id — losing a token no longer
orphans an account. New routes /authorize + /authorize/callback; new
secrets GITHUB_OAUTH_CLIENT_ID / _SECRET. Test: tests/auth.test.ts.

C2 Purged operational docs from the public tree. STRIPE_GO_LIVE_*.md and
operator-digests/ moved to git-ignored docs/internal/. Live Stripe ids,
the account id, and absolute local paths scrubbed from all tracked files.
New CI secret-scan job fails the build on any committed live identifier.

H1 Exactly-once metering under concurrency. meteredCall reserves the
usage_ledger row on the UNIQUE (caller_id, request_id) index before
debiting; concurrent/retried calls debit once, meter once, replay the
row. Migration 0007 adds usage_ledger.settlement_state. Test:
tests/metering.test.ts.

H2 Conservation cron counts all revenue streams — routing fees, brain
unlocks, attestations, marketplace sales — not routing alone. Migration
0008 links marketplace_conservation_ledger rows to their payout. Test:
tests/conservation_cron.test.ts.

H3 Atomic money paths. redeemCreditCode, bookPurchase, and the subscription
credit path now commit as a single D1.batch() transaction. Test:
tests/atomic_money.test.ts.

H4 CI for the TypeScript hosted-MCP — a hosted-mcp job runs typecheck +
vitest (incl. the cross-core parity test) on every push and PR.

Test infra: real-SQLite D1 harness (tests/helpers/d1.ts) via node:sqlite.
Suites: pytest 33 passed; vitest 156 passed; typecheck clean.

Maintainer actions tracked in docs/internal/ITER4_PHASE0_CLOSEOUT.md.

Summary

Invariants

• Existing tests still pass (pytest -q)
• New behavior has unit tests
• No invariant in docs/INVARIANTS.md is weakened or removed (or explicitly justified below)
• Both demos still run end-to-end:
  • python examples/run_demo.py
  • python examples/compute_efficiency_demo.py

Notes