Status: local engineering candidate; external alignment, recording, credential
delivery, deployment, and email reply remain approval-gated.
This package responds to Google's 2026-08-26 request for a stronger restricted
scope justification, exact implementation/configuration alignment, a new demo
video, and usable reviewer access. It contains no OAuth secrets, tokens,
credentials, account identifiers, or passwords.
Decision
StratoFusion cannot replace
https://www.googleapis.com/auth/drive with drive.file, a read-only scope, or
a Picker-only workflow without removing core product behavior.
The product is an account-wide, multi-provider storage manager. After a user
connects a Google Drive account, StratoFusion must operate across existing
files, folders selected later through normal browsing, and future files covered
by an explicitly configured recurring backup or sync. A per-file grant cannot
discover the account hierarchy, search pre-existing content, or continue a
user-configured job as new matching files appear.
Product Behavior Requiring Full Drive Access
Visible behavior
Why a narrower scope is insufficient
Browse an existing Drive hierarchy
Users navigate files and folders that were not created by StratoFusion or individually selected through Picker.
Search and optional indexing
Search and user-enabled indexing cover existing content across the connected account, including Google Workspace export flows.
Download and cross-provider transfer
Users select existing Drive items and copy or move them to another connected provider.
Upload, create folder, rename, and trash
These user-facing operations require write access in addition to account-wide discovery.
Backup
A user explicitly chooses source, destination, and schedule. Later runs must include future source items without repeating a Picker grant for each file.
Sync
A user explicitly configures direction and mode. Subsequent reconciliation must discover and update current and future items on both sides.
The grant is not used for advertising, sale of user data, generalized AI model
training, or unrelated profile access. StratoFusion's Drive connection does not
request separate Google openid, userinfo.email, or userinfo.profile
scopes. Connected-account display metadata comes from the Drive API.
Exact Scope Alignment
The requested scope must match in all three places before submission:
the reviewed source revision and deployed application;
Google Auth Platform Data Access and consent-screen configuration; and
the expanded scope shown in the recorded production OAuth grant.
The canonical source constant is
src/lib/oauth/google-drive-scope-policy.ts. The following production paths
consume that exact constant or its exact-token validator:
src/lib/oauth/scope-builder.ts — direct Google connection request;
src/config/services/google.config.ts — provider service configuration;
src/lib/clerk-oauth-integration.ts — social connection eligibility;
src/app/api/google/upload/route.ts and
src/server/uploads/google-upload-session.ts — upload authorization.
Authorization checks use exact scope tokens. drive.file, drive.readonly,
prefixes, and suffixes do not satisfy the full-Drive requirement. Regression
tests cover this distinction. The legacy src/services/GoogleDriveService.ts
provider declaration still contains the same exact literal; changing that
oversized legacy file solely to import the constant would violate the current
500-line CASA changed-file gate, so its value is verified during review rather
than represented as a constant consumer.
External Alignment Checklist
These are read-only verification steps until a separately authorized operator
approves a configuration change:
Confirm the selected Google Cloud project and production OAuth client by
exact ID against the private inventory.
Confirm Data Access lists exactly
https://www.googleapis.com/auth/drive for the submitted client.
Confirm the consent-screen scope explanation describes the product
behaviors above and does not imply Picker-only access.
Confirm publishing status remains In production.
Confirm homepage, privacy, and terms URLs match the submitted production
application and respond without an authentication redirect.
Confirm the deployed revision requests the same exact scope.
Preserve redacted screenshots or exports with timestamps; exclude client
secrets, tokens, authorization codes, OAuth state, account IDs, IPs, and
reviewer credentials.
Any mismatch stops the recording. Do not edit the Cloud project or deploy a
candidate merely to make the evidence appear aligned; obtain the relevant
authorization first.
New Demonstration Video Acceptance Criteria
Record one continuous production flow after the exact candidate is deployed
and the external alignment checklist passes.
Show the submitted app identity, production origin, privacy/terms links,
selected Cloud project, production client, and Data Access page.
Start from StratoFusion's real Connect Google Drive entry point and show
its provider disclosure before leaving the app.
Show the Google account chooser and complete consent screen in English.
Expand the consent detail so the full
https://www.googleapis.com/auth/drive URL is readable.
Return to StratoFusion and prove access to a pre-existing Drive item that was
not individually selected through Picker.
Demonstrate browse, search, and download against that source account.
Demonstrate upload, folder creation if practical, rename, and move-to-trash;
show the corresponding effects in the source Google Drive account.
Demonstrate a cross-provider copy and show the destination effect.
Configure a backup and sync with explicit source, destination, direction,
and mode; show the resulting job/effect without overstating completion.
End on the connected account/workspace and state why current and future
account-wide items cannot be covered by drive.file plus Picker.
The recording must not expose credentials, OAuth state, authorization codes,
tokens, client secrets, unrelated browser tabs, personal notifications, or
private files. Use dedicated non-admin reviewer/provider accounts containing
synthetic data.
Recorder Safety Contract
scripts/record-google-oauth-verification-ready.mjs performs real provider
writes. It now refuses to start unless all target, account, source, destination,
and Cloud project values are supplied explicitly. The operator must set
STRATOFUSION_RECORDER_CONFIRM_TARGET to the exact base origin. Production also
requires STRATOFUSION_RECORDER_ALLOW_PRODUCTION=true.
The recorder has no default personal email, storage state, provider account, or
production target. OAuth logs retain only endpoint, redirect URI, and scope
tokens; state and account hints are discarded. Review the generated recording
and artifacts for accidental disclosure before upload.
Reviewer Access
Create a dedicated non-admin reviewer identity with only synthetic provider
data and the minimum product entitlement needed for the demonstrated flow.
Verify sign-in in a clean browser from the instructions Google will receive.
Avoid phone, payment-card, invitation, email-domain, CAPTCHA, or administrator
approval blockers.
Provide exact step-by-step navigation from sign-in to Google Drive connection
and each feature shown in the video.
Send credentials only through Google's designated secure verification
channel. Never commit them, include them in the video, or paste them into a
public issue or ordinary documentation.
Do not weaken production administrator MFA to create reviewer access.
Direct Reply Draft
Reply in the existing Google Trust and Safety thread after alignment, video,
and reviewer access are complete:
Hello Google Trust and Safety,
We have updated the requested evidence for StratoFusion. We confirmed that
the deployed application, Google Auth Platform configuration, consent screen,
and demonstration all request the same restricted scope:
https://www.googleapis.com/auth/drive.
StratoFusion cannot use drive.file plus Picker because it is an account-wide
multi-provider storage manager. Users browse and search pre-existing Drive
content, transfer selected existing items between providers, and explicitly
configure recurring backup and sync jobs that must discover future items.
The application also provides upload, create-folder, rename, download, and
move-to-trash operations. Per-file selection cannot support account hierarchy
discovery or future items covered by a user-configured recurring job.
The new video shows the production app entry point, expanded English consent
detail with the exact scope, a pre-existing non-Picker-selected item, the
user-facing read/write/transfer features, and the effects in the connected
source and destination accounts. The application remains In production.
We have also supplied active dedicated reviewer credentials and step-by-step
navigation through the designated secure channel. Please let us know if any
additional evidence is required while the CASA assessment proceeds.
Approval Gates And Completion Boundary
Local code, tests, documentation, and a pull request may proceed autonomously.
The following remain separate explicit approvals:
Google Cloud or consent-screen configuration changes;
deployment to staging or production;
use or creation of reviewer credentials;
running the mutating recorder against any remote account;
publishing or uploading the video; and
sending the Google reply.
This package prepares the response; it does not claim that any of those
external actions have occurred.