# Google OAuth Verification Video

> **Historical submission evidence:** References to `stratofusion-dev` below
> describe the OAuth client inventory shown during the April 2026 verification
> recording. The permanent shared development environment is retired. Retain
> this wording only as evidence until the corresponding external client is
> separately approved for deletion.

**Last Updated:** August 27, 2026

> **Current submission requirements:** Google's 2026-08-26 follow-up requires
> a newly recorded demonstration, expanded readable consent detail, evidence of
> the maximum requested access, exact implementation/console alignment, and
> working reviewer access. Use the
> [2026-08-27 response package](../security/GOOGLE_OAUTH_VERIFICATION_RESPONSE_2026-08-27.md)
> as the controlling checklist. Client names and inventory counts retained in
> this April script are historical until reconfirmed against the private current
> inventory.

> **Mutation safety:** The recorder performs real upload, transfer, rename,
> trash, backup, and sync operations. It has no default production target or
> personal account. Supply every required `STRATOFUSION_*` value, set
> `STRATOFUSION_RECORDER_CONFIRM_TARGET` to the exact origin, and separately set
> `STRATOFUSION_RECORDER_ALLOW_PRODUCTION=true` for production. Do not run it
> without authorization for the target and dedicated synthetic-data accounts.

This runbook provides the word-for-word narration and recording checklist for
StratoFusion's Google OAuth restricted-scope verification submission.

## Current Product Facts

These points are grounded in the current codebase and should not be changed in
the narration unless the implementation changes first.

- Project ID: `statafusion`.
- Demo domain: `https://stratofusion.io`.
- Demo client: `stratofusion-prod`.
- Google scope currently requested in the Drive connection flow.
  `https://www.googleapis.com/auth/drive`
- StratoFusion does **not** currently request separate Google `openid`.
  `userinfo.email`, or `userinfo.profile` scopes in this connection flow.
- Before redirecting to Google, StratoFusion shows an in-product provider.
  disclosure with:
  - permissions requested.
  - how StratoFusion uses the access.
  - exact scopes requested.
  - revocation and privacy links.

## Reviewer-Facing Requirements

This script is aligned to Google's current verification guidance.

- Show the end-to-end flow, including the OAuth grant process.
- Show the same application submitted for verification, including app name and.
  branding.
- Show the complete OAuth consent screen with the exact scope requested.
- Ensure the consent screen language is set to English.
- Demonstrate the live user-facing features that use the requested scope.
- Be ready to show all OAuth clients in the project that request the restricted.
  scope.

Source: Google's current verification requirements and FAQ:

- `https://support.google.com/cloud/answer/13464321`.
- `https://support.google.com/cloud/answer/13463817`.

## Important Recording Note

The current `scripts/record-google-oauth-verification-ready.mjs` flow still
goes straight to the Google auth URL and does not show StratoFusion's real
connection entry point or its policy links. It is safety-hardened but is not by
itself submission-complete. Extend or manually stage the recording so the live
connection dialog and policy links appear before the OAuth flow.

## Word-For-Word Script

Use calm, literal narration. Do not improvise claims about scopes, AI training,
or data sharing.

### Intro Slide

> "This is the Google OAuth verification demonstration for StratoFusion, project
> ID `statafusion`. This recording shows the live StratoFusion application, the
> live Google OAuth flow, the live Google Drive restricted scope, and live
> user-facing features that use that scope. No mock data or simulated consent
> screens are used."

### OAuth Clients Slide

> "This Google Cloud project currently contains three active OAuth clients that
> are configured for this application: `stratofusion-prod`,
> `stratofusion-dev`, and `stratofusion-local`. I will show the client list and
> each client details page in the console before demonstrating the production
> flow used on `stratofusion.io`."

### Active Client Slide

> "The live OAuth flow in this demonstration uses the production web client,
> `stratofusion-prod`, on `https://stratofusion.io`."

### Scope Usage Slide

> "StratoFusion currently requests one Google scope in this Drive connection
> flow: `https://www.googleapis.com/auth/drive`. This scope is required because
> users can browse Drive folders, search Drive items, upload files, download
> files, copy files to another provider, rename files, delete files, create
> backup jobs, and create sync jobs from StratoFusion's unified interface.
> The connection dialog provides a concise explanation of why access is needed
> and links to StratoFusion's policy documents. Google remains the only approval
> step and shows the exact permissions requested."

## Live Recording Script

### 1. Homepage And Privacy Link

Show the marketing homepage on `https://stratofusion.io` and briefly show the
homepage link to the Privacy Policy.

> "Starting on the StratoFusion homepage at `stratofusion.io`. This homepage
> describes the product's storage-management functionality and links to the
> Privacy Policy on the same domain."

### 2. Privacy Policy Page

Open the Privacy Policy page and keep the URL visible.

> "This is the StratoFusion Privacy Policy page on the same verified domain.
> The policy describes how StratoFusion accesses, uses, stores, and shares
> provider data for the features it offers."

### 3. Google Cloud Branding Page

Open the Google Cloud OAuth branding page for project `statafusion`.

> "This is the Google Cloud branding configuration for project `statafusion`.
> The app name is StratoFusion, with the submitted branding information visible
> here."

### 4. OAuth Clients List

Open the Google Cloud OAuth clients page and show all three active clients.

> "This is the OAuth clients page for the same project. The active clients in
> this project are `stratofusion-prod`, `stratofusion-dev`, and
> `stratofusion-local`."

### 5. Client Details

Open each client details page one by one. Keep the client name, client ID, and
authorized redirect URIs visible.

> "Here is the details page for `stratofusion-prod`, including the client ID and
> authorized redirect URI."

> "Here is the details page for `stratofusion-dev`."

> "Here is the details page for `stratofusion-local`."

### 6. Data Access Configuration

Open the Google Cloud data access page and keep the Drive scope visible.

> "This is the data access configuration page for the same project. The Google
> Drive restricted scope requested by StratoFusion is
> `https://www.googleapis.com/auth/drive`."

### 7. StratoFusion Connection Entry Point

Open the live StratoFusion app where the user starts the Google Drive
connection flow. Show the real connection dialog.

> "Returning to the live StratoFusion application. I am now opening the Google
> Drive connection flow from the production app."

### 8. In-Product Policy Notice

Show the concise connection-access summary and the visible Privacy Policy,
Terms of Service, and Fair Use Policy links. Open the Privacy Policy in its new
tab and show the sections covering files and metadata, OAuth credentials,
Google user data and provider permissions, data use, retention, and revocation.
Return to the connection dialog.

> "StratoFusion keeps a concise notice and links to its policy documents at the
> point where a user connects an account. The Privacy Policy explains the
> provider data StratoFusion processes, why it is used, how it is retained, and
> how access can be revoked."

### 9. Continue To Google

Click `Personal` for Google Drive. The provider choice should start the OAuth
flow immediately.

> "I am now continuing from StratoFusion to Google's OAuth flow."

### 10. Google Account Chooser

Show the Google account chooser.

> "This is Google's account chooser for the live OAuth flow."

### 11. Unverified App Warning

If the testing interstitial appears, show it. If it does not appear for the
test account, skip this line.

> "This test account sees Google's unverified-app warning because this restricted
> scope is still in the verification process. I am continuing with an approved
> test account."

### 12. Google Consent Screen

Show the full consent screen with English selected in the bottom-left language
picker.

> "This is the Google OAuth consent screen for StratoFusion. The consent screen
> is in English and shows the same application name and branding being submitted
> for verification."

### 13. Scope Details

Expand the service or scope details so the exact Drive scope URL is visible.

> "Expanding the consent details shows the exact restricted Drive scope requested
> by the application: `https://www.googleapis.com/auth/drive`."

### 14. Grant Access And Return To StratoFusion

Approve the consent screen and show the redirect back to StratoFusion.

> "I am now approving the requested Drive access and returning to
> StratoFusion."

### 15. Workspace Ready

Show the Drive workspace after the OAuth callback completes.

> "The OAuth flow is complete and StratoFusion has returned to the live
> workspace with Google Drive connected."

### 16. Connected Services

Show Google Drive alongside the other connected providers.

> "The service selector now shows Google Drive connected in the unified
> multi-provider workspace."

### 17. Browse Google Drive

Open a real Google Drive folder and show its contents.

> "This is a live browse operation against Google Drive. I am opening a folder
> and viewing its contents from StratoFusion."

### 18. Search

Run a search and show the matching results.

> "This is a live search across Google Drive items from the StratoFusion
> interface."

### 19. Upload

Show the upload dialog, then the upload progress, then the uploaded file in the
results list.

> "This is a live upload to Google Drive from StratoFusion. The upload dialog
> shows Google Drive as the destination, the transfer starts, and the uploaded
> file then appears in the workspace."

### 20. Download

Select the uploaded file and start a download.

> "This is a live download from Google Drive initiated from StratoFusion."

### 21. Copy To Another Provider

Show the copy dialog from Google Drive to Dropbox, then show the copy progress.

> "This is a live user-initiated copy from Google Drive to another connected
> provider. The file is selected in Google Drive and copied to Dropbox through
> StratoFusion."

### 22. Rename

Show the rename dialog for the uploaded file.

> "This is a live rename operation on a Google Drive file from the
> StratoFusion interface."

### 23. Delete

Show the delete confirmation and then the result after deletion.

> "This is a live delete operation on the same Google Drive file. The
> confirmation dialog appears first, and after confirmation the file no longer
> appears in the current list."

### 24. Backup

Show the backup dialog from Google Drive to OneDrive, then show the progress.

> "This is a live backup job configuration using Google Drive as the source and
> another connected provider as the destination."

### 25. Sync

Show the sync dialog from Google Drive to Dropbox, select the mode, and show
the progress state.

> "This is a live sync job configuration using Google Drive as the source and
> Dropbox as the destination. The sync mode is selected in the StratoFusion
> interface and the job starts."

### 26. Conclusion

End on the connected-services view or workspace.

> "This concludes the demonstration. StratoFusion requests the Google Drive
> restricted scope to power these visible, user-facing storage-management
> features in the live application: browsing, searching, uploading,
> downloading, copying, renaming, deleting, backup, and sync."

## Recording Checklist

### Pre-Recording

- [ ] Use the production app at `https://stratofusion.io`.
- [ ] Confirm the Google Cloud project is `statafusion`.
- [ ] Confirm the production client is `stratofusion-prod`.
- [ ] Confirm the project still contains the three active OAuth clients.
  `stratofusion-prod`, `stratofusion-dev`, and `stratofusion-local`
- [ ] Confirm the requested Google scope is only.
  `https://www.googleapis.com/auth/drive`
- [ ] Confirm the homepage privacy-policy link matches the privacy-policy URL on.
  the OAuth consent screen configuration
- [ ] Confirm the consent-screen language is set to English.
- [ ] Prepare a small test upload file.
- [ ] Prepare a known Google Drive folder to browse during the demo.
- [ ] Ensure the test accounts for Google Drive, Dropbox, and OneDrive are ready.
  for copy, backup, and sync examples
- [ ] Close browser tabs, notifications, and anything that should not appear in.
  the recording

### During Recording

- [ ] Homepage visible on `stratofusion.io`.
- [ ] Privacy Policy link visible on the homepage.
- [ ] Privacy Policy page visible on the same domain.
- [ ] Google Cloud branding page visible for `statafusion`.
- [ ] OAuth clients list visible with all three active clients.
- [ ] Each client details page shown with client ID and redirect URI visible.
- [ ] Data access page shown with.
  `https://www.googleapis.com/auth/drive` visible
- [ ] Real StratoFusion connection entry point shown.
- [ ] Concise connection-access summary shown.
- [ ] Privacy Policy, Terms of Service, and Fair Use Policy links shown.
- [ ] Privacy Policy opened with provider permissions, data use, retention, and
  revocation sections visible.
- [ ] Google account chooser shown.
- [ ] Unverified-app warning shown if it appears for the test account.
- [ ] Full consent screen shown in English.
- [ ] Expanded scope details show.
  `https://www.googleapis.com/auth/drive`
- [ ] Redirect back to StratoFusion shown after consent.
- [ ] Google Drive appears connected in the workspace.
- [ ] Browse operation shown.
- [ ] Search operation shown.
- [ ] Upload dialog, upload progress, and uploaded-file result shown.
- [ ] Download action shown.
- [ ] Copy dialog and copy progress shown.
- [ ] Rename dialog shown.
- [ ] Delete confirmation and delete result shown.
- [ ] Backup dialog and backup progress shown.
- [ ] Sync dialog, selected mode, and sync progress shown.
- [ ] Final workspace or connected-services view shown.

### Post-Recording

- [ ] Verify the recording is continuous through the OAuth flow.
- [ ] Verify the narration does **not** mention `openid`, `userinfo.email`, or.
  `userinfo.profile`
- [ ] Verify the narration does **not** claim that StratoFusion never shares.
  data with third parties
- [ ] Verify the narration does **not** claim AI-model training consent unless a.
  real AI-training consent flow is actually shown
- [ ] Verify the consent screen is readable and in English.
- [ ] Verify the exact Drive scope URL is readable on-screen.
- [ ] Verify the video length is appropriate and the audio is clear.
- [ ] Verify the uploadable video file plays correctly before submission.

## Submission Form Scope Justification

Use this text for the verification form unless the product behavior changes.

```text
StratoFusion is a multi-provider cloud storage management application that
unifies Google Drive, OneDrive, and Dropbox into a single interface. The
application currently requests the Google Drive restricted scope
https://www.googleapis.com/auth/drive.

This scope is required for the live user-facing features that StratoFusion
currently provides for connected Google Drive accounts, including:

1. Browsing Drive folders and files in the unified workspace
2. Searching Drive items from the StratoFusion interface
3. Uploading files to Drive
4. Downloading files from Drive
5. Copying files from Drive to another connected provider
6. Renaming Drive files
7. Deleting Drive files
8. Creating backup jobs that use Drive as a source or destination
9. Creating sync jobs that use Drive as a source or destination

The same Drive scope is also used to read the connected-account label metadata
exposed by the Drive API so StratoFusion can identify the connected Google
Drive account in the UI without requesting separate Google profile scopes.

All of these actions are user-facing features initiated from the StratoFusion
interface. Read-only scopes are insufficient because StratoFusion's live
features include file creation, transfer, rename, delete, backup, and sync
operations in addition to read and browse functionality.
```

## Avoid These Claims

Do not say any of the following in the video unless the product behavior and
scope configuration are changed first.

- "StratoFusion requests `openid`, `userinfo.email`, and `userinfo.profile` in.
  this Google Drive flow."
- "No third parties process any data.".
- "Google Drive data is used for AI model training.".
- "Read-only scopes would support the same live product behavior.".