{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[4e327784] deploy live constitution dashboard\n\nExpose auditable progress and event streaming, configure the production roots and runtime, and make tested main-branch commits the deployment authority.\n\nCo-authored-by: Cursor \n\nSide A — unified diff (full patch):\ndiff --git a/.dockerignore b/.dockerignore\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..c9d63a722beba0a0297fc853089332c460ab78dd\n--- /dev/null\n+++ b/.dockerignore\n@@ -0,0 +1,7 @@\n+.git\n+.venv\n+.hypothesis\n+__pycache__\n+tests\n+*.json\n+*.bsp\ndiff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..76dcdf82d53177c1e47d86b23a54523239d232a6\n--- /dev/null\n+++ b/.github/workflows/deploy.yml\n@@ -0,0 +1,49 @@\n+name: Test and deploy\n+\n+on:\n+ push:\n+ branches: [main]\n+\n+concurrency:\n+ group: production\n+ cancel-in-progress: false\n+\n+permissions:\n+ contents: read\n+\n+jobs:\n+ test:\n+ runs-on: ubuntu-latest\n+ steps:\n+ - uses: actions/checkout@v4\n+\n+ - uses: astral-sh/setup-uv@v6\n+ with:\n+ enable-cache: true\n+\n+ - name: Run Python tests\n+ run: uv run pytest -q\n+\n+ - name: Install Babashka\n+ run: |\n+ curl -fsSL https://raw.githubusercontent.com/babashka/babashka/master/install \\\n+ | sudo bash -s -- --dir /usr/local/bin\n+\n+ - name: Run process integration tests\n+ run: bb TEST.sh\n+\n+ deploy:\n+ needs: test\n+ runs-on: ubuntu-latest\n+ environment:\n+ name: production\n+ url: https://token.slug.social\n+ steps:\n+ - uses: actions/checkout@v4\n+\n+ - uses: superfly/flyctl-actions/setup-flyctl@master\n+\n+ - name: Deploy to Fly\n+ run: flyctl deploy --remote-only\n+ env:\n+ FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}\ndiff --git a/Dockerfile b/Dockerfile\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..c9a5c00782371c19ad5ab5c58cf6f5a8ffec0141\n--- /dev/null\n+++ b/Dockerfile\n@@ -0,0 +1,17 @@\n+FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim\n+\n+RUN apt-get update \\\n+ && apt-get install -y --no-install-recommends git ca-certificates \\\n+ && rm -rf /var/lib/apt/lists/*\n+\n+WORKDIR /app\n+COPY pyproject.toml uv.lock ./\n+RUN uv sync --frozen --no-install-project\n+\n+COPY constitution.py ./\n+\n+ENV PATH=\"/app/.venv/bin:${PATH}\" \\\n+ PYTHONUNBUFFERED=\"1\"\n+\n+EXPOSE 8080\n+CMD [\"python\", \"constitution.py\"]\ndiff --git a/constitution.py b/constitution.py\nindex 4bee9f83663ab7fb36db95129b92b64b4ef57258..a58257e1881b21d1d6fa8e68a3faa222e4f661ef 100644\n--- a/constitution.py\n+++ b/constitution.py\n@@ -24,12 +24,12 @@ A daily GitHub Action backs up the JSONL ledger to the same repo.\n Run: uv run constitution.py\n \"\"\"\n \n-from decimal import Decimal, getcontext\n+from decimal import Decimal, getcontext, DefaultContext\n from datetime import datetime, timezone\n from fastapi import FastAPI, Request, Response\n from fastapi.responses import PlainTextResponse, HTMLResponse\n from starlette.middleware.sessions import SessionMiddleware\n-import json, time, os, asyncio, httpx, pathlib, subprocess, hashlib, re, fcntl\n+import json, time, os, asyncio, httpx, pathlib, subprocess, hashlib, re, fcntl, base64\n import sympy as sp # type: ignore[reportMissingImports]\n from tenacity import retry, retry_if_exception, stop_after_attempt, wait_exponential\n from evaleval import (\n@@ -37,6 +37,7 @@ from evaleval import (\n exec_event, One, Two, Three, Selector, MORPH, PREPEND,\n )\n \n+DefaultContext.prec = 50\n getcontext().prec = 50\n \n app = FastAPI()\n@@ -129,14 +130,47 @@ OPENROUTER_BASE_URL = os.environ.get(\"OPENROUTER_BASE_URL\", \"https://openrouter.\n # using the exact same source; their normalized values are committed to every\n # discovery event.\n DEFAULT_REPOSITORIES = [\n+ {\n+ \"id\": \"constitution\",\n+ \"url\": \"https://github.com/sortersocial/constitution.git\",\n+ \"refs\": [\"refs/heads/**\"],\n+ },\n {\n \"id\": \"slug\",\n- \"url\": \"https://github.com/tommy-mor/slug.git\",\n+ \"url\": \"https://github.com/sortersocial/slug.git\",\n+ \"refs\": [\"refs/heads/**\"],\n+ },\n+ {\n+ \"id\": \"sorter\",\n+ \"url\": \"https://github.com/sorterisntonline/sorter.git\",\n+ \"refs\": [\"refs/heads/**\"],\n+ },\n+ {\n+ \"id\": \"sorter2\",\n+ \"url\": \"https://github.com/sortersocial/sorter2.git\",\n+ \"refs\": [\"refs/heads/**\"],\n+ },\n+ {\n+ \"id\": \"sorter-oldest\",\n+ \"url\": \"https://github.com/tommy-mor/sorter.git\",\n \"refs\": [\"refs/heads/**\"],\n },\n ]\n DEFAULT_CONTRIBUTORS = {\n \"tommy-mor\": [\"thmorriss@gmail.com\"],\n+ \"christopher-whitman\": [\n+ \"chris@cwwhitman.com\",\n+ \"7566903+cwwhitman@users.noreply.github.com\",\n+ ],\n+ \"jake-chvatal\": [\n+ \"jake+github@uln.industries\",\n+ \"jakechvatal@gmail.com\",\n+ \"jake@isnt.online\",\n+ ],\n+ \"lara\": [\"me@lara.lv\"],\n+ \"nat-reid\": [\"nathanielreid@gmail.com\"],\n+ \"zod\": [\"jason.p.mcel@gmail.com\", \"me@zod.tf\"],\n+ \"jovan\": [\"jovan@slug.social\", \"jovan@getcivicai.com\"],\n }\n \n REPOSITORIES = json.loads(\n@@ -147,6 +181,7 @@ CONTRIBUTORS = json.loads(\n )\n GIT_MIRROR_DIR = pathlib.Path(os.environ.get(\"GIT_MIRROR_DIR\", \"/data/git\"))\n GIT_TIMEOUT_SECONDS = int(os.environ.get(\"GIT_TIMEOUT_SECONDS\", \"120\"))\n+GITHUB_TOKEN = os.environ.get(\"GITHUB_TOKEN\", \"\")\n \n # Council model IDs: slug.social garden rank under this parent (bodies = OpenRouter URLs), then top-up from OpenRouter list.\n SLUG_SOCIAL_BASE_URL = os.environ.get(\"SLUG_SOCIAL_BASE_URL\", \"https://slug.social\").rstrip(\"/\")\n@@ -661,20 +696,30 @@ def _git(repo: pathlib.Path | None, *args: str, input_bytes: bytes | None = None\n if repo is not None:\n command += [\"-C\", str(repo)]\n command += list(args)\n+ git_env = {\n+ **os.environ,\n+ \"GIT_CONFIG_NOSYSTEM\": \"1\",\n+ \"GIT_CONFIG_GLOBAL\": os.devnull,\n+ \"GIT_NO_REPLACE_OBJECTS\": \"1\",\n+ \"LC_ALL\": \"C\",\n+ \"TZ\": \"UTC\",\n+ }\n+ if GITHUB_TOKEN:\n+ credential = base64.b64encode(\n+ f\"x-access-token:{GITHUB_TOKEN}\".encode()\n+ ).decode()\n+ git_env.update({\n+ \"GIT_CONFIG_COUNT\": \"1\",\n+ \"GIT_CONFIG_KEY_0\": \"http.https://github.com/.extraHeader\",\n+ \"GIT_CONFIG_VALUE_0\": f\"Authorization: Basic {credential}\",\n+ })\n try:\n result = subprocess.run(\n command,\n input=input_bytes,\n stdout=subprocess.PIPE,\n stderr=subprocess.PIPE,\n- env={\n- **os.environ,\n- \"GIT_CONFIG_NOSYSTEM\": \"1\",\n- \"GIT_CONFIG_GLOBAL\": os.devnull,\n- \"GIT_NO_REPLACE_OBJECTS\": \"1\",\n- \"LC_ALL\": \"C\",\n- \"TZ\": \"UTC\",\n- },\n+ env=git_env,\n timeout=GIT_TIMEOUT_SECONDS,\n check=False,\n )\n@@ -844,9 +889,15 @@ def _build_discovery(epoch_n: int, boundary_ms: int, events: list) -> GitDiscove\n canonical_location = min(\n locations[qualified_oid], key=lambda x: (x[0], x[1])\n )\n+ # One commit may be reachable from dozens of refs in the same mirror.\n+ # Verify its object once per repository, not once per source ref.\n+ object_locations = {\n+ (str(m), raw_oid): (m, raw_oid)\n+ for _, _, m, raw_oid in locations[qualified_oid]\n+ }\n object_hashes = {\n hashlib.sha256(_git(m, \"cat-file\", \"commit\", raw_oid)).hexdigest()\n- for _, _, m, raw_oid in locations[qualified_oid]\n+ for m, raw_oid in object_locations.values()\n }\n if len(object_hashes) != 1:\n raise RuntimeError(f\"conflicting Git objects share OID {qualified_oid}\")\n@@ -994,11 +1045,55 @@ async def discover_repositories(epoch_n: int, boundary_ms: int) -> GitDiscovery:\n \n \n SSE_CLIENTS = []\n+AUDIT_HISTORY = []\n+AUDIT_SEQUENCE = 0\n+PROCESS_STATE = {\n+ \"running\": False,\n+ \"phase\": \"idle\",\n+ \"progress\": 100,\n+ \"message\": \"Waiting for the next epoch\",\n+}\n+\n+\n+def _sse_event(event_name: str, payload: dict) -> str:\n+ return (\n+ f\"event: {event_name}\\n\"\n+ f\"data: {json.dumps(payload, separators=(',', ':'))}\\n\\n\"\n+ )\n+\n+\n+async def broadcast_audit(\n+ kind: str,\n+ message: str,\n+ *,\n+ progress: int | None = None,\n+ phase: str | None = None,\n+) -> dict:\n+ global AUDIT_SEQUENCE\n+ AUDIT_SEQUENCE += 1\n+ if progress is not None:\n+ PROCESS_STATE[\"progress\"] = max(0, min(100, int(progress)))\n+ if phase is not None:\n+ PROCESS_STATE[\"phase\"] = phase\n+ PROCESS_STATE[\"message\"] = message\n+ payload = {\n+ \"id\": AUDIT_SEQUENCE,\n+ \"timestamp_ms\": int(time.time() * 1000),\n+ \"kind\": kind,\n+ \"message\": message,\n+ **PROCESS_STATE,\n+ }\n+ AUDIT_HISTORY.append(payload)\n+ del AUDIT_HISTORY[:-200]\n+ wire = _sse_event(\"audit\", payload)\n+ for queue in list(SSE_CLIENTS):\n+ await queue.put(wire)\n+ return payload\n \n \n async def broadcast_js(js: str):\n \"\"\"Send a JS snippet to all connected SSE clients.\"\"\"\n- for queue in SSE_CLIENTS:\n+ for queue in list(SSE_CLIENTS):\n await queue.put(js)\n \n \n@@ -1006,10 +1101,29 @@ async def rank_commits(commits: list[dict]):\n if not commits:\n return {}, []\n \n- models = await fetch_top_models(n=3)\n contributors = sorted(set(c[\"contributor\"] for c in commits))\n- if len(contributors) > 1 and not models:\n+ if len(contributors) == 1:\n+ await broadcast_audit(\n+ \"ranking\",\n+ f\"Only {contributors[0]} is eligible; rank is 1.0\",\n+ progress=90,\n+ phase=\"finalizing\",\n+ )\n+ return {contributors[0]: Decimal(\"1\")}, []\n+ if not (OPENROUTER_API_KEY or \"\").strip():\n+ raise RuntimeError(\n+ \"OPENROUTER_API_KEY is required when multiple contributors need ranking\"\n+ )\n+\n+ models = await fetch_top_models(n=3)\n+ if not models:\n raise RuntimeError(\"no council models available for contributor ranking\")\n+ await broadcast_audit(\n+ \"council\",\n+ f\"Council selected: {', '.join(models)}\",\n+ progress=35,\n+ phase=\"ranking\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-council\", f\"Council: {', '.join(models)} — {len(commits)} commits\"]\n ]))\n@@ -1035,6 +1149,11 @@ async def rank_commits(commits: list[dict]):\n \n async def compare_fn(i, j):\n a1, a2 = authors[i], authors[j]\n+ await broadcast_audit(\n+ \"comparison\",\n+ f\"Comparing {a1} with {a2}\",\n+ phase=\"ranking\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-status\")][MORPH][\n [\"div#emission-status\", f\"Comparing {a1} vs {a2}…\"]\n ]))\n@@ -1050,6 +1169,11 @@ async def rank_commits(commits: list[dict]):\n if winner_weight <= 0 or loser_weight <= 0:\n raise ValueError(\"ratio weights must be positive\")\n results.append((w, l, winner_weight, loser_weight))\n+ await broadcast_audit(\n+ \"vote\",\n+ f\"{model}: {authors[w]} over {authors[l]} ({result['ratio']})\",\n+ phase=\"ranking\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-vote\",\n [\"span.model\", model], \" — \",\n@@ -1059,6 +1183,11 @@ async def rank_commits(commits: list[dict]):\n ]\n ]))\n except Exception as e:\n+ await broadcast_audit(\n+ \"error\",\n+ f\"{model} failed: {e}\",\n+ phase=\"error\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-error\", f\"⚠ {model}: {e}\"]\n ]))\n@@ -1068,8 +1197,13 @@ async def rank_commits(commits: list[dict]):\n async def progress_fn(ev):\n if ev[\"phase\"] == \"spanning_tree\":\n label = f\"Spanning tree: {ev['step']}/{ev['total']}\"\n+ percent = 35 + round(35 * ev[\"step\"] / max(ev[\"total\"], 1))\n else:\n label = f\"Zip pass {ev['pass']}: {ev['step']}/{ev['total']}\"\n+ percent = 70 + round(20 * ev[\"step\"] / max(ev[\"total\"], 1))\n+ await broadcast_audit(\n+ \"progress\", label, progress=percent, phase=\"ranking\"\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-status\")][MORPH][\n [\"div#emission-status\", label]\n ]))\n@@ -1083,6 +1217,12 @@ async def rank_commits(commits: list[dict]):\n scores = rank_centrality(pairs)\n ranking = {authors[i]: Decimal(str(scores[i])) for i in range(len(authors))}\n ranking_rows = sorted(ranking.items(), key=lambda x: x[1], reverse=True)\n+ await broadcast_audit(\n+ \"ranking\",\n+ \"Ranking: \" + \", \".join(f\"{a} {s:.4f}\" for a, s in ranking_rows),\n+ progress=90,\n+ phase=\"finalizing\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-ranking\",\n [\"b\", \"Ranking: \"],\n@@ -1104,11 +1244,33 @@ def pool_remaining(events: list) -> Decimal:\n \n \n async def run_emission(epoch_n, boundary_ms):\n+ PROCESS_STATE[\"running\"] = True\n+ await broadcast_audit(\n+ \"start\",\n+ f\"Epoch {epoch_n} emission started\",\n+ progress=2,\n+ phase=\"starting\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-start\", f\"⚡ Epoch {epoch_n} emission started\"]\n ]))\n \n+ await broadcast_audit(\n+ \"discovery\",\n+ \"Fetching configured repositories and snapshotting refs\",\n+ progress=8,\n+ phase=\"discovery\",\n+ )\n discovery = await discover_repositories(epoch_n, boundary_ms)\n+ await broadcast_audit(\n+ \"discovery\",\n+ (\n+ f\"Discovered {len(discovery.observations)} new commits; \"\n+ f\"{len(discovery.commits)} are eligible\"\n+ ),\n+ progress=30,\n+ phase=\"discovery\",\n+ )\n ranking, models = await rank_commits(discovery.commits)\n \n def make_emission(events):\n@@ -1146,6 +1308,13 @@ async def run_emission(epoch_n, boundary_ms):\n \n entry = await store.atomic(make_emission)\n if entry:\n+ PROCESS_STATE[\"running\"] = False\n+ await broadcast_audit(\n+ \"complete\",\n+ f\"Epoch {entry.epoch} complete; emitted {entry.total_emitted} SLG\",\n+ progress=100,\n+ phase=\"idle\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-amount\",\n f\"Pool {entry.pool_before} → emit {entry.total_emitted} → {entry.pool_after}\"]\n@@ -1189,13 +1358,24 @@ async def distribute_usdc(holdings, treasury_balance):\n async def epoch_loop():\n while True:\n epoch_n, current_start, next_boundary = current_epoch()\n+ processed = {e.epoch for e in store.read() if isinstance(e, Emission)}\n+ if epoch_n >= 0 and epoch_n not in processed:\n+ try:\n+ await run_emission(epoch_n, current_start)\n+ except Exception as exc:\n+ PROCESS_STATE[\"running\"] = False\n+ await broadcast_audit(\n+ \"error\",\n+ f\"Epoch {epoch_n} failed: {exc}; retrying in 60 seconds\",\n+ phase=\"error\",\n+ )\n+ print(f\"epoch {epoch_n} emission failed: {exc}\", flush=True)\n+ await asyncio.sleep(60)\n+ continue\n+\n now = int(time.time() * 1000)\n wait_ms = next_boundary - now\n-\n if wait_ms <= 0:\n- processed = {e.epoch for e in store.read() if isinstance(e, Emission)}\n- if epoch_n not in processed and epoch_n >= 0:\n- await run_emission(epoch_n, current_start)\n await asyncio.sleep(60)\n elif wait_ms < 86_400_000:\n await broadcast_js(exec_event(Three[Selector(\"#emission-status\")][MORPH][\n@@ -1243,6 +1423,36 @@ async def get_ranking():\n return {\"ranking\": latest.ranking, \"epoch\": latest.epoch}\n \n \n+@app.get(\"/api/status\")\n+async def get_status():\n+ events = store.read()\n+ discoveries = [e for e in events if isinstance(e, GitDiscovery)]\n+ emissions = [e for e in events if isinstance(e, Emission)]\n+ return {\n+ **PROCESS_STATE,\n+ \"epoch\": current_epoch()[0],\n+ \"openrouter_configured\": bool((OPENROUTER_API_KEY or \"\").strip()),\n+ \"sse_clients\": len(SSE_CLIENTS),\n+ \"latest_discovery\": (\n+ {\n+ \"epoch\": discoveries[-1].epoch,\n+ \"snapshot_id\": discoveries[-1].snapshot_id,\n+ \"observations\": len(discoveries[-1].observations),\n+ \"eligible_commits\": len(discoveries[-1].commits),\n+ }\n+ if discoveries else None\n+ ),\n+ \"latest_emission\": (\n+ {\n+ \"epoch\": emissions[-1].epoch,\n+ \"total_emitted\": emissions[-1].total_emitted,\n+ \"ranking\": emissions[-1].ranking,\n+ }\n+ if emissions else None\n+ ),\n+ }\n+\n+\n @app.get(\"/api/contributor/{github_username}\")\n async def get_contributor(github_username: str):\n history = [\n@@ -1306,13 +1516,6 @@ async def test_emit():\n \n # ===========================================================================\n # §9. SSE — live audit stream of the pairwise voting process\n-#\n-# TODO: the /sse emission audit page needs a real SSE-driven UI. votes arrive\n-# incrementally during rank_commits(), and the client should show a live\n-# progress bar and per-vote results as they stream in. this requires a\n-# dedicated page that connects to /sse and updates the DOM on each event\n-# (council, comparing, vote, ranking, emission_complete). defer until we\n-# have playwright tests to cover it — the incremental rendering is fiddly.\n # ===========================================================================\n \n @app.get(\"/sse\")\n@@ -1322,6 +1525,13 @@ async def sse_stream(request: Request):\n \n async def generate():\n try:\n+ yield _sse_event(\"audit\", {\n+ \"id\": AUDIT_SEQUENCE,\n+ \"timestamp_ms\": int(time.time() * 1000),\n+ \"kind\": \"connection\",\n+ \"message\": f\"Connected to epoch {current_epoch()[0]}\",\n+ **PROCESS_STATE,\n+ })\n yield exec_event(Three[Selector(\"#emission-status\")][MORPH][\n [\"div#emission-status\", f\"Connected — epoch {current_epoch()[0]}\"]\n ])\n@@ -1334,10 +1544,15 @@ async def sse_stream(request: Request):\n except asyncio.TimeoutError:\n yield \": keepalive\\n\\n\"\n finally:\n- SSE_CLIENTS.remove(queue)\n+ if queue in SSE_CLIENTS:\n+ SSE_CLIENTS.remove(queue)\n \n from starlette.responses import StreamingResponse\n- return StreamingResponse(generate(), media_type=\"text/event-stream\")\n+ return StreamingResponse(\n+ generate(),\n+ media_type=\"text/event-stream\",\n+ headers={\"Cache-Control\": \"no-cache\", \"X-Accel-Buffering\": \"no\"},\n+ )\n \n \n # ===========================================================================\n@@ -1359,6 +1574,7 @@ def _page(title: str, body: list) -> HTMLResponse:\n [\"meta\", {\"charset\": \"utf-8\"}],\n [\"meta\", {\"name\": \"viewport\", \"content\": \"width=device-width, initial-scale=1\"}],\n [\"title\", title],\n+ [\"style\", RawContent(_WATCH_CSS)],\n ],\n [\"body\",\n body,\n@@ -1367,6 +1583,387 @@ def _page(title: str, body: list) -> HTMLResponse:\n ]))\n \n \n+_WATCH_CSS = \"\"\"\n+/* ================================================================\n+ ZIGGURAT — bevel-first dark theme\n+ --spread (0→1) controls bevel depth. 0 = flat. 1 = full relief.\n+ Light source: top-left. Shadow: bottom-right.\n+ Platforms nest. Each level is raised. Nothing is rounded.\n+ ================================================================ */\n+\n+:root {\n+ color-scheme: dark;\n+ --spread: 1;\n+\n+ --g0: #080808;\n+ --g1: #131313;\n+ --g2: #1c1c1c;\n+ --g3: #252525;\n+ --g4: #2e2e2e;\n+ --g5: #383838;\n+\n+ --hi: #5e5e5e;\n+ --lo: #050505;\n+ --bv: calc(var(--spread) * 4px + 1px);\n+ --bv-lg: calc(var(--spread) * 6px + 2px);\n+\n+ --signal: #f0f0f0;\n+ --prose: #c2c2c2;\n+ --ui: #888;\n+ --meta: #4a4a4a;\n+ --link: #8899ee;\n+ --code-fg: #c8dda0;\n+\n+ --font-prose: \"Iowan Old Style\", \"Palatino Linotype\", Palatino, \"Book Antiqua\", Georgia, serif;\n+ --font-ui: system-ui, -apple-system, sans-serif;\n+ --font-code: ui-monospace, \"Cascadia Code\", \"SF Mono\", Menlo, monospace;\n+}\n+\n+*, *::before, *::after { box-sizing: border-box; }\n+html, body { margin: 0; padding: 0; }\n+\n+body {\n+ background: var(--g0);\n+ color: var(--prose);\n+ font-family: var(--font-ui);\n+ font-size: 14px;\n+ line-height: 1.6;\n+ margin: 0 auto;\n+ max-width: 560px;\n+ min-height: 100vh;\n+ padding: 0 16px 48px;\n+}\n+main { width: 100%; padding: 18px 0 48px; }\n+\n+h1, h2, h3 {\n+ color: var(--signal);\n+ font-size: 11px;\n+ font-weight: bold;\n+ letter-spacing: 0.12em;\n+ margin: 14px 0 6px;\n+ text-transform: uppercase;\n+}\n+a { color: var(--link); text-decoration: none; }\n+a:hover { color: var(--signal); }\n+.eyebrow {\n+ background: var(--g2);\n+ border: var(--bv) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ color: var(--ui);\n+ font-size: 11px;\n+ letter-spacing: 0.12em;\n+ padding: 4px 10px;\n+ text-transform: uppercase;\n+ width: fit-content;\n+}\n+\n+/* Every dashboard section is a raised platform. */\n+.panel {\n+ background: var(--g2);\n+ border: var(--bv-lg) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ margin: 8px 0;\n+ padding: 10px;\n+ width: 100%;\n+}\n+.status-row {\n+ align-items: center;\n+ display: flex;\n+ flex-wrap: wrap;\n+ gap: 8px;\n+ justify-content: space-between;\n+}\n+#process-status { color: var(--signal); font-family: var(--font-code); font-weight: bold; }\n+.badge {\n+ align-items: center;\n+ background: var(--g3);\n+ border: var(--bv) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ color: var(--ui);\n+ display: inline-flex;\n+ font-size: 11px;\n+ gap: 7px;\n+ padding: 3px 8px;\n+}\n+.dot { background: var(--meta); height: 8px; width: 8px; }\n+.live .dot { background: #7acc7a; }\n+.warn .dot { background: #cc9955; }\n+\n+/* The progress track is inset; its signal is raised inside it. */\n+.progress-shell {\n+ background: var(--g1);\n+ border: var(--bv-lg) solid;\n+ border-color: var(--lo) var(--hi) var(--hi) var(--lo);\n+ height: 58px;\n+ margin: 14px 0 10px;\n+ overflow: hidden;\n+ position: relative;\n+}\n+#progress-fill {\n+ background: var(--link);\n+ border: var(--bv) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ height: 100%;\n+ transition: width .35s steps(8, end);\n+ width: 0;\n+}\n+#progress-label {\n+ color: var(--signal);\n+ display: grid;\n+ font-family: var(--font-code);\n+ font-size: 18px;\n+ font-weight: bold;\n+ inset: 0;\n+ place-items: center;\n+ position: absolute;\n+ text-shadow: 1px 1px var(--lo);\n+}\n+\n+.controls { align-items: center; display: flex; flex-wrap: wrap; gap: 8px; }\n+button {\n+ background: var(--g5);\n+ border: var(--bv) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ color: var(--signal);\n+ cursor: pointer;\n+ font: inherit;\n+ font-size: 12px;\n+ padding: 4px 10px;\n+}\n+button:hover { background: #404040; }\n+button:active {\n+ background: var(--g4);\n+ border-color: var(--lo) var(--hi) var(--hi) var(--lo);\n+ transform: translate(1px, 1px);\n+}\n+button:disabled { cursor: default; opacity: .4; }\n+.note { color: var(--meta); font-size: 11px; margin: 4px 0; }\n+\n+.feed-head { align-items: baseline; display: flex; justify-content: space-between; }\n+#audit-feed {\n+ background: var(--g1);\n+ border: var(--bv) solid;\n+ border-color: var(--lo) var(--hi) var(--hi) var(--lo);\n+ display: flex;\n+ flex-direction: column;\n+ gap: 5px;\n+ margin-top: 8px;\n+ padding: 6px;\n+}\n+.event {\n+ background: var(--g3);\n+ border: var(--bv) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ display: grid;\n+ gap: 6px;\n+ grid-template-columns: 82px 88px 1fr;\n+ padding: 5px 8px;\n+}\n+.event[data-kind=\"error\"] { border-left-color: #cc5555; }\n+.event[data-kind=\"complete\"], .event[data-kind=\"ranking\"] { border-left-color: #7acc7a; }\n+.event[data-kind=\"vote\"] { border-left-color: var(--link); }\n+.event time, .event-kind { color: var(--meta); font-family: var(--font-code); font-size: 10px; }\n+.event-kind { text-transform: uppercase; }\n+.event-message { color: var(--prose); font-family: var(--font-prose); }\n+\n+code {\n+ background: var(--g1);\n+ border: 2px solid;\n+ border-color: var(--lo) var(--hi) var(--hi) var(--lo);\n+ color: var(--code-fg);\n+ font-family: var(--font-code);\n+ font-size: 12px;\n+ padding: 1px 4px;\n+}\n+\n+@media (max-width: 520px) {\n+ .event { grid-template-columns: 72px 1fr; }\n+ .event-message { grid-column: 1 / -1; }\n+}\n+\"\"\"\n+\n+\n+def _watch_initial_state() -> dict:\n+ events = store.read()\n+ feed = []\n+ for event_ in events[-40:]:\n+ if isinstance(event_, GitDiscovery):\n+ feed.append({\n+ \"id\": f\"discovery-{event_.snapshot_id}\",\n+ \"timestamp_ms\": event_.timestamp_ms,\n+ \"kind\": \"discovery\",\n+ \"message\": (\n+ f\"Epoch {event_.epoch}: observed {len(event_.observations)} commits; \"\n+ f\"{len(event_.commits)} eligible\"\n+ ),\n+ })\n+ elif isinstance(event_, Emission):\n+ feed.append({\n+ \"id\": f\"emission-{event_.epoch}\",\n+ \"timestamp_ms\": event_.timestamp_ms,\n+ \"kind\": \"complete\",\n+ \"message\": (\n+ f\"Epoch {event_.epoch}: emitted {event_.total_emitted} SLG; \"\n+ f\"ranking {event_.ranking}\"\n+ ),\n+ })\n+ feed.extend(AUDIT_HISTORY)\n+ return {\n+ \"process\": dict(PROCESS_STATE),\n+ \"openrouter_configured\": bool((OPENROUTER_API_KEY or \"\").strip()),\n+ \"epoch\": current_epoch()[0],\n+ \"feed\": feed[-200:],\n+ }\n+\n+\n+_WATCH_JS = \"\"\"\n+const initial = __INITIAL__;\n+const feed = document.querySelector('#audit-feed');\n+const processStatus = document.querySelector('#process-status');\n+const connection = document.querySelector('#connection-status');\n+const fill = document.querySelector('#progress-fill');\n+const progressLabel = document.querySelector('#progress-label');\n+const play = document.querySelector('#play');\n+const pause = document.querySelector('#pause');\n+const seen = new Set();\n+let source = null;\n+\n+function setProgress(value) {\n+ const n = Math.max(0, Math.min(100, Number(value ?? 0)));\n+ fill.style.width = `${n}%`;\n+ progressLabel.textContent = `${Math.round(n)}%`;\n+ document.querySelector('.progress-shell').setAttribute('aria-valuenow', String(n));\n+}\n+\n+function addEvent(event) {\n+ const id = String(event.id);\n+ if (seen.has(id)) return;\n+ seen.add(id);\n+ const row = document.createElement('div');\n+ row.className = 'event';\n+ row.dataset.kind = event.kind || 'event';\n+ const when = document.createElement('time');\n+ when.dateTime = new Date(event.timestamp_ms).toISOString();\n+ when.textContent = new Date(event.timestamp_ms).toLocaleTimeString();\n+ const kind = document.createElement('span');\n+ kind.className = 'event-kind';\n+ kind.textContent = event.kind || 'event';\n+ const message = document.createElement('span');\n+ message.className = 'event-message';\n+ message.textContent = event.message;\n+ row.append(when, kind, message);\n+ feed.prepend(row);\n+ while (feed.children.length > 200) feed.lastElementChild.remove();\n+}\n+\n+function applyState(event) {\n+ processStatus.textContent = event.message || 'Waiting for the next epoch';\n+ setProgress(event.progress);\n+ if (event.kind !== 'connection') addEvent(event);\n+}\n+\n+function connect() {\n+ if (source) return;\n+ source = new EventSource('/sse');\n+ connection.classList.remove('warn');\n+ connection.classList.add('live');\n+ connection.querySelector('span:last-child').textContent = 'connecting';\n+ play.disabled = true;\n+ pause.disabled = false;\n+ source.onopen = () => {\n+ connection.querySelector('span:last-child').textContent = 'live';\n+ };\n+ source.addEventListener('audit', event => applyState(JSON.parse(event.data)));\n+ source.onerror = () => {\n+ connection.classList.remove('live');\n+ connection.classList.add('warn');\n+ connection.querySelector('span:last-child').textContent = 'reconnecting';\n+ };\n+}\n+\n+function disconnect() {\n+ if (source) source.close();\n+ source = null;\n+ connection.classList.remove('live');\n+ connection.classList.add('warn');\n+ connection.querySelector('span:last-child').textContent = 'paused locally';\n+ play.disabled = false;\n+ pause.disabled = true;\n+}\n+\n+play.addEventListener('click', connect);\n+pause.addEventListener('click', disconnect);\n+initial.feed.forEach(addEvent);\n+processStatus.textContent = initial.process.message;\n+setProgress(initial.process.progress);\n+connect();\n+\"\"\"\n+\n+\n+@app.get(\"/watch\")\n+async def watch():\n+ initial = json.dumps(\n+ _watch_initial_state(), separators=(\",\", \":\")\n+ ).replace(\" 0\")\n \n- ;; 9. SSE connects and sends initial event\n+ ;; 9. watch UI exposes progress, controls, readiness, and live SSE\n+ (println \"\\nchecking /watch UI…\")\n+ (bind watch-html (slurp (str base-url \"/watch\")))\n+ (assert! (str/includes? watch-html \"role=\\\"progressbar\\\"\")\n+ \"watch page has progress bar\")\n+ (assert! (str/includes? watch-html \"id=\\\"play\\\"\")\n+ \"watch page has play control\")\n+ (assert! (str/includes? watch-html \"id=\\\"pause\\\"\")\n+ \"watch page has pause control\")\n+ (assert! (str/includes? watch-html \"OpenRouter configured\")\n+ \"watch page reports council readiness\")\n+ (bind status-resp (get-json base-url \"/api/status\"))\n+ (assert! (true? (:openrouter_configured status-resp))\n+ \"status API reports OpenRouter configuration\")\n+\n+ ;; 10. SSE connects and sends initial event\n (println \"\\nchecking /sse initial event…\")\n (bind sse-events (read-sse-events (str base-url \"/sse\") 1 5000))\n (assert! (= 1 (count sse-events)) \"received 1 SSE event\")\n (assert! (not (str/blank? (first sse-events)))\n \"initial SSE event contains executable audit data\")\n \n- ;; 10. POST /test/emit — full ranking pipeline hits mocks\n+ ;; 11. POST /test/emit — full ranking pipeline hits mocks\n (println \"\\ntriggering /test/emit (epoch 1)…\")\n (bind emit-resp (post-json! base-url \"/test/emit\"))\n (assert! (= \"emission\" (:type emit-resp)) \"emit response type is emission\")\n@@ -503,7 +518,7 @@\n (bind rank-after (get-json base-url \"/api/ranking\"))\n (assert! (= 1 (:epoch rank-after)) \"latest ranking is epoch 1\")\n \n- ;; 11. kill and restart — prove replay determinism\n+ ;; 12. kill and restart — prove replay determinism\n (println \"\\nkilling server for replay test…\")\n (.destroyForcibly (:proc server))\n (deref server)\ndiff --git a/tests/test_git_discovery.py b/tests/test_git_discovery.py\nindex 0dd31bc42a19bc8c59842dc61f193c595c474659..5a9e167e16ad2ffb25988af85820f6f19e8910cd 100644\n--- a/tests/test_git_discovery.py\n+++ b/tests/test_git_discovery.py\n@@ -393,7 +393,9 @@ def test_empty_epoch_records_zero_emission_without_burning_pool(\n monkeypatch.setattr(c, \"store\", c.JsonlStore(discovery_config / \"ledger.jsonl\"))\n \n async def discover(_epoch, _boundary):\n- return SimpleNamespace(commits=[], snapshot_id=\"empty-snapshot\")\n+ return SimpleNamespace(\n+ observations=[], commits=[], snapshot_id=\"empty-snapshot\"\n+ )\n \n async def rank(_commits):\n return {}, []\n@@ -412,7 +414,11 @@ def test_emission_distribution_sums_exactly_to_total(\n monkeypatch.setattr(c, \"store\", c.JsonlStore(discovery_config / \"ledger.jsonl\"))\n \n async def discover(_epoch, _boundary):\n- return SimpleNamespace(commits=[{\"x\": 1}], snapshot_id=\"ranked-snapshot\")\n+ return SimpleNamespace(\n+ observations=[{\"x\": 1}],\n+ commits=[{\"x\": 1}],\n+ snapshot_id=\"ranked-snapshot\",\n+ )\n \n async def rank(_commits):\n return {\n@@ -454,6 +460,7 @@ def test_any_council_failure_aborts_ranking(monkeypatch):\n \n monkeypatch.setattr(c, \"fetch_top_models\", models)\n monkeypatch.setattr(c, \"llm_pairwise_compare\", compare)\n+ monkeypatch.setattr(c, \"OPENROUTER_API_KEY\", \"test-key\")\n commits = [\n {\n \"contributor\": contributor,\n@@ -465,3 +472,54 @@ def test_any_council_failure_aborts_ranking(monkeypatch):\n ]\n with pytest.raises(RuntimeError, match=\"council model failed\"):\n asyncio.run(c.rank_commits(commits))\n+\n+\n+def test_contested_ranking_requires_openrouter_key(monkeypatch):\n+ monkeypatch.setattr(c, \"OPENROUTER_API_KEY\", \"\")\n+ commits = [\n+ {\n+ \"contributor\": contributor,\n+ \"oid\": \"sha1:\" + char * 40,\n+ \"message\": contributor,\n+ \"patch\": \"patch\",\n+ }\n+ for contributor, char in [(\"alice\", \"a\"), (\"bob\", \"b\")]\n+ ]\n+ with pytest.raises(RuntimeError, match=\"OPENROUTER_API_KEY\"):\n+ asyncio.run(c.rank_commits(commits))\n+\n+\n+def test_watch_page_has_live_controls_progress_and_key_warning(\n+ discovery_config, monkeypatch\n+):\n+ monkeypatch.setattr(c, \"store\", c.JsonlStore(discovery_config / \"ledger.jsonl\"))\n+ monkeypatch.setattr(c, \"OPENROUTER_API_KEY\", \"\")\n+ monkeypatch.setattr(c, \"current_epoch\", lambda: (3, 0, 1))\n+ response = asyncio.run(c.watch())\n+ html = response.body.decode()\n+ assert 'role=\"progressbar\"' in html\n+ assert 'id=\"play\"' in html\n+ assert 'id=\"pause\"' in html\n+ assert \"new EventSource('/sse')\" in html\n+ assert \"OpenRouter key missing\" in html\n+\n+\n+def test_audit_events_are_json_sse_and_update_process_state(monkeypatch):\n+ clients = []\n+ history = []\n+ monkeypatch.setattr(c, \"SSE_CLIENTS\", clients)\n+ monkeypatch.setattr(c, \"AUDIT_HISTORY\", history)\n+ queue = asyncio.Queue()\n+ clients.append(queue)\n+\n+ async def emit():\n+ event = await c.broadcast_audit(\n+ \"progress\", \"halfway\", progress=50, phase=\"ranking\"\n+ )\n+ return event, await queue.get()\n+\n+ event, wire = asyncio.run(emit())\n+ assert event[\"progress\"] == 50\n+ assert event[\"phase\"] == \"ranking\"\n+ assert wire.startswith(\"event: audit\\ndata: {\")\n+ assert '\"message\":\"halfway\"' in wire\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[52f5c51c] Add Reddit OAuth linking and make UUID the only account identity.\n\nOAuth providers only attach to a session UUID (first link creates the\nprincipal); linked providers stay private on the account page.\n\nCo-authored-by: Cursor \n\nSide B — unified diff (full patch):\ndiff --git a/AGENTS.md b/AGENTS.md\nindex 6e0fd8ebb65d665c9c1438e3275971d62b98fd95..e9cc3173dbeb21ad0fc090ca7b407b027c7820a9 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -35,8 +35,11 @@ Environment variables (defaults in `server/src/state.rs`):\n - `SORTER2_DATA_DIR` — default `./data` (created on startup)\n - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`\n - `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)\n-- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)\n-- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)\n+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth linking (optional)\n+- `REDDIT_CLIENT_ID` / `REDDIT_CLIENT_SECRET` (or `REDDIT_APP_*`) — Reddit API import + OAuth linking (optional)\n+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` and `/auth/reddit` (tests only)\n+\n+Identity: UUID is canonical. OAuth providers only *link* to a UUID (first link creates the principal). Linked providers are private to the account owner.\n \n Health check: `GET /healthz` → `ok`.\n \ndiff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs\nindex 5906f93b13853421e96a3c37bc9d8202a47842bf..c706ae8045a811e5941f5f6c72da88f42a403a82 100644\n--- a/server/src/auth/mod.rs\n+++ b/server/src/auth/mod.rs\n@@ -1,4 +1,8 @@\n-//! GitHub OAuth login, session cookies, and vote actor resolution.\n+//! OAuth linking, session cookies, and vote actor resolution.\n+//!\n+//! Canonical identity is a UUID. OAuth providers only *link* to that UUID\n+//! (first link creates the principal; later links attach while logged in).\n+//! Which providers are linked is private to the account owner.\n \n pub mod config;\n pub mod identity;\n@@ -22,7 +26,9 @@ use crate::{\n form_template::template_json_compact,\n html::layout,\n state::AppState,\n- storage_schema::{oauth_link_owner, pseudonym_owner, Store, StoreFields},\n+ storage_schema::{\n+ linked_providers_for_uuid, oauth_link_owner, pseudonym_owner, Store, StoreFields,\n+ },\n ui_action::UI_RPC_FIELD,\n };\n \n@@ -53,10 +59,12 @@ fn new_actor_uuid() -> String {\n pub struct LoginQuery {\n #[serde(default)]\n pub return_to: Option,\n+ #[serde(default)]\n+ pub error: Option,\n }\n \n #[derive(Debug, Deserialize)]\n-pub struct GitHubStartQuery {\n+pub struct OAuthStartQuery {\n #[serde(default)]\n pub return_to: Option,\n #[serde(default)]\n@@ -72,15 +80,22 @@ fn return_from_query_or_jar(jar: &CookieJar, query: Option<&str>) -> String {\n .unwrap_or_else(|| \"/\".to_string())\n }\n \n-fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, String)> {\n+/// Available OAuth link targets: `(provider_key, label, start_href)`.\n+fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, &'static str, String)> {\n let mut out = Vec::new();\n+ let enc = urlencoding::encode(return_to);\n if oauth::GitHubConfig::from_env(base_url).is_some() {\n out.push((\n- \"GitHub\",\n- format!(\n- \"/auth/github?return_to={}\",\n- urlencoding::encode(return_to)\n- ),\n+ \"github\",\n+ oauth::provider_label(\"github\"),\n+ format!(\"/auth/github?return_to={enc}\"),\n+ ));\n+ }\n+ if oauth::RedditConfig::from_env(base_url).is_some() {\n+ out.push((\n+ \"reddit\",\n+ oauth::provider_label(\"reddit\"),\n+ format!(\"/auth/reddit?return_to={enc}\"),\n ));\n }\n out\n@@ -125,23 +140,41 @@ fn alias_claim_forms(return_to: &str, submit_label: &str) -> Result Markup {\n+fn login_error_message(code: Option<&str>) -> Option<&'static str> {\n+ match code {\n+ Some(\"oauth_taken\") => {\n+ Some(\"that OAuth account is already linked to a different sorter2 account\")\n+ }\n+ Some(\"oauth_failed\") => Some(\"OAuth failed — try again\"),\n+ _ => None,\n+ }\n+}\n+\n+fn signed_out_body(\n+ providers: &[(&str, &str, String)],\n+ error: Option<&str>,\n+) -> Markup {\n html! {\n main class=\"panel login-page\" {\n section class=\"login-section\" {\n h1 { \"sign in\" }\n- p class=\"muted\" { \"link an account to vote under a lasting alias\" }\n+ p class=\"muted\" {\n+ \"link an OAuth account to create your identity, then claim an alias to vote\"\n+ }\n+ @if let Some(msg) = login_error_message(error) {\n+ p class=\"alias-bad\" data-testid=\"login-error\" { (msg) }\n+ }\n @if providers.is_empty() {\n p class=\"muted\" {\n- \"OAuth is not configured. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET.\"\n+ \"OAuth is not configured. Set GitHub and/or Reddit client credentials.\"\n }\n } @else {\n ul class=\"oauth-provider-list\" {\n- @for (name, href) in providers {\n+ @for (key, label, href) in providers {\n li {\n a href=(href) class=\"btn-primary oauth-provider\"\n- data-testid=(format!(\"oauth-{}\", name.to_lowercase())) {\n- (format!(\"Continue with {name}\"))\n+ data-testid=(format!(\"oauth-{key}\")) {\n+ (format!(\"Link {label}\"))\n }\n }\n }\n@@ -156,7 +189,10 @@ fn signed_out_body(providers: &[(&str, String)]) -> Markup {\n fn account_body(\n actor: &session::SessionActor,\n aliases: &[String],\n- providers: &[(&str, String)],\n+ // Provider keys already linked to this UUID (private).\n+ linked: &[String],\n+ // Providers available to link: not yet attached.\n+ unlinkable: &[(&str, &str, String)],\n claim_forms: Markup,\n ) -> Markup {\n let current = actor.pseudonym.trim();\n@@ -212,16 +248,29 @@ fn account_body(\n (claim_forms)\n }\n \n- @if !providers.is_empty() {\n- section class=\"login-section\" {\n- h2 { \"linked sign-in\" }\n- p class=\"muted small\" { \"sign in again with the same provider to return to this account\" }\n+ section class=\"login-section\" {\n+ h2 { \"linked sign-in\" }\n+ p class=\"muted small\" {\n+ \"private to you — linking more providers raises trust weight without publishing which accounts you use\"\n+ }\n+ @if linked.is_empty() {\n+ p class=\"muted\" data-testid=\"linked-providers-empty\" { \"none yet\" }\n+ } @else {\n+ ul class=\"linked-provider-list\" data-testid=\"linked-providers\" {\n+ @for key in linked {\n+ li data-testid=(format!(\"linked-{key}\")) {\n+ (oauth::provider_label(key))\n+ }\n+ }\n+ }\n+ }\n+ @if !unlinkable.is_empty() {\n ul class=\"oauth-provider-list\" {\n- @for (name, href) in providers {\n+ @for (key, label, href) in unlinkable {\n li {\n a href=(href) class=\"btn-secondary oauth-provider\"\n- data-testid=(format!(\"oauth-relink-{}\", name.to_lowercase())) {\n- (format!(\"Re-link {name}\"))\n+ data-testid=(format!(\"oauth-link-{key}\")) {\n+ (format!(\"Link {label}\"))\n }\n }\n }\n@@ -243,12 +292,21 @@ fn account_body(\n fn login_body(\n session: Option<&session::SessionActor>,\n aliases: &[String],\n- providers: &[(&str, String)],\n+ linked: &[String],\n+ providers: &[(&str, &str, String)],\n claim_forms: Option,\n+ error: Option<&str>,\n ) -> Markup {\n match (session, claim_forms) {\n- (Some(actor), Some(forms)) => account_body(actor, aliases, providers, forms),\n- _ => signed_out_body(providers),\n+ (Some(actor), Some(forms)) => {\n+ let unlinkable: Vec<_> = providers\n+ .iter()\n+ .filter(|(key, _, _)| !linked.iter().any(|p| p == key))\n+ .cloned()\n+ .collect();\n+ account_body(actor, aliases, linked, &unlinkable, forms)\n+ }\n+ _ => signed_out_body(providers, error),\n }\n }\n \n@@ -268,6 +326,10 @@ pub async fn login_page(\n .as_ref()\n .map(|s| alias_list(db, &s.uuid))\n .unwrap_or_default();\n+ let linked = session\n+ .as_ref()\n+ .map(|s| linked_providers_for_uuid(db, &s.uuid).unwrap_or_default())\n+ .unwrap_or_default();\n let providers = oauth_providers(&base_url_from_env(state.cfg.port), &return_to);\n \n let claim_forms = if session.is_some() {\n@@ -282,7 +344,14 @@ pub async fn login_page(\n } else {\n \"login · sorter2\"\n },\n- login_body(session.as_ref(), &aliases, &providers, claim_forms),\n+ login_body(\n+ session.as_ref(),\n+ &aliases,\n+ &linked,\n+ &providers,\n+ claim_forms,\n+ query.error.as_deref(),\n+ ),\n state.views.get_views(\"/login\"),\n session\n .as_ref()\n@@ -302,7 +371,6 @@ pub async fn alias_page(\n let db = state.projection_store.db();\n let session = session::load_valid_session(db, &session_id).ok_or(StatusCode::UNAUTHORIZED)?;\n if session::session_has_pseudonym(&session) {\n- // Already onboarded — manage aliases on the account page.\n return Ok(Redirect::to(\"/login\").into_response());\n }\n \n@@ -331,7 +399,7 @@ pub async fn alias_page(\n pub async fn github_start(\n State(state): State,\n jar: CookieJar,\n- Query(query): Query,\n+ Query(query): Query,\n ) -> Result {\n let cfg = oauth::GitHubConfig::from_env(&base_url_from_env(state.cfg.port))\n .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n@@ -342,7 +410,28 @@ pub async fn github_start(\n } else {\n None\n };\n- let url = oauth::authorize_url(&cfg, &state_token, mock_user);\n+ let url = oauth::github_authorize_url(&cfg, &state_token, mock_user);\n+ let jar = jar\n+ .add(session::oauth_state_cookie_value(&state_token))\n+ .add(session::auth_return_cookie_value(&return_to));\n+ Ok((jar, Redirect::temporary(&url)).into_response())\n+}\n+\n+pub async fn reddit_start(\n+ State(state): State,\n+ jar: CookieJar,\n+ Query(query): Query,\n+) -> Result {\n+ let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+ .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+ let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());\n+ let state_token = session::new_oauth_state();\n+ let mock_user = if config::mock_oauth_allowed() {\n+ query.mock_user.as_deref()\n+ } else {\n+ None\n+ };\n+ let url = oauth::reddit_authorize_url(&cfg, &state_token, mock_user);\n let jar = jar\n .add(session::oauth_state_cookie_value(&state_token))\n .add(session::auth_return_cookie_value(&return_to));\n@@ -355,6 +444,13 @@ pub struct OAuthCallbackQuery {\n pub state: String,\n }\n \n+/// Link `provider:provider_id` to a UUID.\n+///\n+/// - Logged in + new provider → attach to session UUID\n+/// - Logged in + already ours → no-op\n+/// - Logged in + owned by someone else → conflict\n+/// - Logged out + known link → resume that UUID\n+/// - Logged out + unknown → create principal + first link\n async fn finish_oauth_login(\n state: &AppState,\n jar: CookieJar,\n@@ -364,11 +460,41 @@ async fn finish_oauth_login(\n let db = state.projection_store.db();\n let return_to = return_from_query_or_jar(&jar, None);\n \n- let uuid = match oauth_link_owner(db, provider, &provider_id)\n- .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?\n- {\n- Some(existing) => existing,\n- None => {\n+ let existing_owner = oauth_link_owner(db, provider, &provider_id)\n+ .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+ let session_uuid = session::session_id_from_jar(&jar)\n+ .as_deref()\n+ .and_then(|id| session::load_valid_session(db, id))\n+ .map(|s| s.uuid);\n+ let linking_while_logged_in = session_uuid.is_some();\n+\n+ let uuid = match (session_uuid, existing_owner) {\n+ (Some(session_uuid), Some(owner)) if owner == session_uuid => session_uuid,\n+ (Some(_), Some(_)) => {\n+ return Ok((\n+ jar.add(session::clear_oauth_state_cookie()),\n+ \"/login?error=oauth_taken\".into(),\n+ ));\n+ }\n+ (Some(session_uuid), None) => {\n+ let ts = now_ms();\n+ state\n+ .append_identity_events(vec![Event::OauthLinked {\n+ uuid: session_uuid.clone(),\n+ provider: provider.to_string(),\n+ provider_id,\n+ ts,\n+ }])\n+ .await\n+ .map_err(|e| {\n+ tracing::warn!(err = %e, \"oauth link append failed\");\n+ StatusCode::INTERNAL_SERVER_ERROR\n+ })?;\n+ session_uuid\n+ }\n+ (None, Some(owner)) => owner,\n+ (None, None) => {\n let uuid = new_actor_uuid();\n let ts = now_ms();\n state\n@@ -409,6 +535,9 @@ async fn finish_oauth_login(\n \"/login/alias?return_to={}\",\n urlencoding::encode(&return_to)\n )\n+ } else if linking_while_logged_in {\n+ // Additional link while already in an account → stay on account page.\n+ \"/login\".to_string()\n } else {\n return_to\n };\n@@ -434,22 +563,57 @@ pub async fn github_callback(\n .build()\n .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n \n- let token = oauth::exchange_code(&client, &cfg, &query.code)\n+ let token = oauth::github_exchange_code(&client, &cfg, &query.code)\n .await\n .map_err(|e| {\n tracing::warn!(err = %e, \"github oauth token exchange failed\");\n StatusCode::BAD_GATEWAY\n })?;\n- let user = oauth::fetch_user(&client, &cfg.api_base, &token)\n+ let user = oauth::github_fetch_user(&client, &cfg.api_base, &token)\n .await\n .map_err(|e| {\n tracing::warn!(err = %e, \"github user fetch failed\");\n StatusCode::BAD_GATEWAY\n })?;\n \n- let provider = \"github\";\n- let provider_id = oauth::provider_id(&user);\n- let (jar, dest) = finish_oauth_login(&state, jar, provider, provider_id).await?;\n+ let (jar, dest) =\n+ finish_oauth_login(&state, jar, \"github\", oauth::github_provider_id(&user)).await?;\n+ Ok((jar, Redirect::to(&dest)).into_response())\n+}\n+\n+pub async fn reddit_callback(\n+ State(state): State,\n+ jar: CookieJar,\n+ Query(query): Query,\n+) -> Result {\n+ let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+ .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+\n+ let expected_state = session::oauth_state_from_jar(&jar).ok_or(StatusCode::BAD_REQUEST)?;\n+ if expected_state != query.state {\n+ return Err(StatusCode::BAD_REQUEST);\n+ }\n+\n+ let client = Client::builder()\n+ .timeout(std::time::Duration::from_secs(15))\n+ .build()\n+ .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+ let token = oauth::reddit_exchange_code(&client, &cfg, &query.code)\n+ .await\n+ .map_err(|e| {\n+ tracing::warn!(err = %e, \"reddit oauth token exchange failed\");\n+ StatusCode::BAD_GATEWAY\n+ })?;\n+ let user = oauth::reddit_fetch_user(&client, &cfg, &token)\n+ .await\n+ .map_err(|e| {\n+ tracing::warn!(err = %e, \"reddit user fetch failed\");\n+ StatusCode::BAD_GATEWAY\n+ })?;\n+\n+ let (jar, dest) =\n+ finish_oauth_login(&state, jar, \"reddit\", oauth::reddit_provider_id(&user)).await?;\n Ok((jar, Redirect::to(&dest)).into_response())\n }\n \ndiff --git a/server/src/auth/oauth.rs b/server/src/auth/oauth.rs\nindex b80078fee0c5acd905b9125d29454e46c4e0d066..369b1527d9032cf312a07819279e0f988ef4a36e 100644\n--- a/server/src/auth/oauth.rs\n+++ b/server/src/auth/oauth.rs\n@@ -1,8 +1,15 @@\n-//! GitHub OAuth (raw reqwest, same style as reddit.rs).\n+//! OAuth providers (GitHub + Reddit). Provider accounts only *link* to a UUID;\n+//! the UUID is the canonical identity. Which providers are linked is private.\n \n use reqwest::Client;\n use serde::Deserialize;\n \n+use crate::reddit::{\n+ default_user_agent, reddit_oauth_api_base, reddit_oauth_token_base,\n+};\n+\n+// ── GitHub ──────────────────────────────────────────────────────────────────\n+\n #[derive(Debug, Clone)]\n pub struct GitHubConfig {\n pub client_id: String,\n@@ -40,7 +47,7 @@ impl GitHubConfig {\n }\n \n #[derive(Debug, Deserialize)]\n-struct TokenResponse {\n+struct GitHubTokenResponse {\n access_token: String,\n }\n \n@@ -50,7 +57,7 @@ pub struct GitHubUser {\n pub login: String,\n }\n \n-pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n+pub fn github_authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n let mut url = format!(\n \"{}/login/oauth/authorize?client_id={}&redirect_uri={}&scope=read:user&state={}\",\n cfg.oauth_base.trim_end_matches('/'),\n@@ -65,7 +72,7 @@ pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -\n url\n }\n \n-pub async fn exchange_code(\n+pub async fn github_exchange_code(\n client: &Client,\n cfg: &GitHubConfig,\n code: &str,\n@@ -90,14 +97,14 @@ pub async fn exchange_code(\n return Err(format!(\"github token HTTP {}\", resp.status()));\n }\n \n- let body: TokenResponse = resp\n+ let body: GitHubTokenResponse = resp\n .json()\n .await\n .map_err(|e| format!(\"github token parse failed: {e}\"))?;\n Ok(body.access_token)\n }\n \n-pub async fn fetch_user(\n+pub async fn github_fetch_user(\n client: &Client,\n api_base: &str,\n access_token: &str,\n@@ -120,10 +127,149 @@ pub async fn fetch_user(\n .map_err(|e| format!(\"github user parse failed: {e}\"))\n }\n \n-pub fn provider_id(user: &GitHubUser) -> String {\n+pub fn github_provider_id(user: &GitHubUser) -> String {\n user.id.to_string()\n }\n \n+// ── Reddit ──────────────────────────────────────────────────────────────────\n+\n+#[derive(Debug, Clone)]\n+pub struct RedditConfig {\n+ pub client_id: String,\n+ pub client_secret: String,\n+ pub redirect_uri: String,\n+ /// Host for `/api/v1/authorize` (www.reddit.com in production).\n+ pub authorize_base: String,\n+ /// Host for `POST /api/v1/access_token`.\n+ pub token_base: String,\n+ /// Host for bearer `GET /api/v1/me` (oauth.reddit.com).\n+ pub api_base: String,\n+ pub user_agent: String,\n+}\n+\n+/// Authorize page base; defaults to the same host as token POSTs.\n+pub fn reddit_authorize_base() -> String {\n+ std::env::var(\"REDDIT_OAUTH_AUTHORIZE_BASE\")\n+ .or_else(|_| std::env::var(\"REDDIT_OAUTH_BASE\"))\n+ .unwrap_or_else(|_| \"https://www.reddit.com\".into())\n+}\n+\n+impl RedditConfig {\n+ pub fn from_env(base_url: &str) -> Option {\n+ let client_id = std::env::var(\"REDDIT_CLIENT_ID\")\n+ .or_else(|_| std::env::var(\"REDDIT_APP_ID\"))\n+ .ok()?;\n+ let client_secret = std::env::var(\"REDDIT_CLIENT_SECRET\")\n+ .or_else(|_| std::env::var(\"REDDIT_APP_SECRET\"))\n+ .ok()?;\n+ if client_id.is_empty() || client_secret.is_empty() {\n+ return None;\n+ }\n+ let base = base_url.trim_end_matches('/');\n+ Some(Self {\n+ client_id,\n+ client_secret,\n+ redirect_uri: format!(\"{base}/auth/reddit/callback\"),\n+ authorize_base: reddit_authorize_base(),\n+ token_base: reddit_oauth_token_base(),\n+ api_base: reddit_oauth_api_base(),\n+ user_agent: default_user_agent(),\n+ })\n+ }\n+}\n+\n+#[derive(Debug, Deserialize)]\n+struct RedditTokenResponse {\n+ access_token: String,\n+}\n+\n+#[derive(Debug, Deserialize)]\n+pub struct RedditUser {\n+ /// Stable id (`t2_…`); never use `name` as identity.\n+ pub id: String,\n+ pub name: String,\n+}\n+\n+pub fn reddit_authorize_url(cfg: &RedditConfig, state: &str, mock_user: Option<&str>) -> String {\n+ let mut url = format!(\n+ \"{}/api/v1/authorize?client_id={}&response_type=code&state={}&redirect_uri={}&duration=temporary&scope=identity\",\n+ cfg.authorize_base.trim_end_matches('/'),\n+ urlencoding::encode(&cfg.client_id),\n+ urlencoding::encode(state),\n+ urlencoding::encode(&cfg.redirect_uri),\n+ );\n+ if let Some(user) = mock_user {\n+ url.push_str(\"&mock_user=\");\n+ url.push_str(&urlencoding::encode(user));\n+ }\n+ url\n+}\n+\n+pub async fn reddit_exchange_code(\n+ client: &Client,\n+ cfg: &RedditConfig,\n+ code: &str,\n+) -> Result {\n+ let resp = client\n+ .post(format!(\n+ \"{}/api/v1/access_token\",\n+ cfg.token_base.trim_end_matches('/')\n+ ))\n+ .header(\"User-Agent\", &cfg.user_agent)\n+ .basic_auth(&cfg.client_id, Some(&cfg.client_secret))\n+ .form(&[\n+ (\"grant_type\", \"authorization_code\"),\n+ (\"code\", code),\n+ (\"redirect_uri\", cfg.redirect_uri.as_str()),\n+ ])\n+ .send()\n+ .await\n+ .map_err(|e| format!(\"reddit token request failed: {e}\"))?;\n+\n+ if !resp.status().is_success() {\n+ let status = resp.status();\n+ let body = resp.text().await.unwrap_or_default();\n+ return Err(format!(\"reddit token HTTP {status}: {body}\"));\n+ }\n+\n+ let body: RedditTokenResponse = resp\n+ .json()\n+ .await\n+ .map_err(|e| format!(\"reddit token parse failed: {e}\"))?;\n+ Ok(body.access_token)\n+}\n+\n+pub async fn reddit_fetch_user(\n+ client: &Client,\n+ cfg: &RedditConfig,\n+ access_token: &str,\n+) -> Result {\n+ let resp = client\n+ .get(format!(\n+ \"{}/api/v1/me\",\n+ cfg.api_base.trim_end_matches('/')\n+ ))\n+ .header(\"User-Agent\", &cfg.user_agent)\n+ .bearer_auth(access_token)\n+ .send()\n+ .await\n+ .map_err(|e| format!(\"reddit user request failed: {e}\"))?;\n+\n+ if !resp.status().is_success() {\n+ return Err(format!(\"reddit user HTTP {}\", resp.status()));\n+ }\n+\n+ resp.json()\n+ .await\n+ .map_err(|e| format!(\"reddit user parse failed: {e}\"))\n+}\n+\n+pub fn reddit_provider_id(user: &RedditUser) -> String {\n+ user.id.clone()\n+}\n+\n+// ── Shared helpers ──────────────────────────────────────────────────────────\n+\n pub fn validate_pseudonym(raw: &str) -> Result {\n let trimmed = raw.trim();\n if trimmed.is_empty() {\n@@ -144,3 +290,12 @@ pub fn validate_pseudonym(raw: &str) -> Result {\n pub fn sanitize_pseudonym(login: &str) -> String {\n validate_pseudonym(login).unwrap_or_else(|_| \"user\".to_string())\n }\n+\n+/// Display name for a provider key (`github` → `GitHub`). Never show provider ids.\n+pub fn provider_label(provider: &str) -> &'static str {\n+ match provider {\n+ \"github\" => \"GitHub\",\n+ \"reddit\" => \"Reddit\",\n+ _ => \"OAuth\",\n+ }\n+}\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 84f2565b105fb302241b949af64bd5e49916eab2..0d948af1457504fdbd34d0b14261f65ac58da0ec 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -47,6 +47,8 @@ pub fn create_app(state: AppState) -> Router {\n .route(\"/login/alias\", get(crate::auth::alias_page))\n .route(\"/auth/github\", get(crate::auth::github_start))\n .route(\"/auth/github/callback\", get(crate::auth::github_callback))\n+ .route(\"/auth/reddit\", get(crate::auth::reddit_start))\n+ .route(\"/auth/reddit/callback\", get(crate::auth::reddit_callback))\n .route(\"/auth/logout\", post(crate::auth::logout))\n .route(\"/auth/switch\", post(crate::auth::switch_pseudonym))\n .route(\"/ui\", post(crate::api::ui_html::post_ui_html))\ndiff --git a/server/src/projection_apply.rs b/server/src/projection_apply.rs\nindex 4fb4b48ee0a53b7f673fae0c9731eed5acc33332..f50458c2ff3c447a3cfd28adb298e6883a2da4e9 100644\n--- a/server/src/projection_apply.rs\n+++ b/server/src/projection_apply.rs\n@@ -4,6 +4,8 @@\n //! child links, recent-vote appends) plus a cursor advance, all committed in\n //! one atomic `DisableWal` batch.\n \n+use std::collections::HashMap;\n+\n use crate::{\n event_log::EventLogError,\n events::{Event, EventRecord},\n@@ -44,6 +46,8 @@ pub fn apply_records(\n let db = projection_store.db();\n let mut batch = db.batch();\n let mut last_seq = 0u64;\n+ // Weight reads must see earlier writes in this same batch.\n+ let mut pending_weights: HashMap = HashMap::new();\n \n for record in records {\n match &record.event {\n@@ -85,6 +89,7 @@ pub fn apply_records(\n ensure_path_writes(&mut batch, &parsed);\n }\n Event::PrincipalCreated { uuid, .. } => {\n+ pending_weights.insert(uuid.clone(), BASE_TRUST_WEIGHT);\n batch.write(\n Store::root()\n .user_weights()\n@@ -112,17 +117,25 @@ pub fn apply_records(\n }\n } else {\n batch.write(Store::root().oauth_links().key(&link_key).set(uuid));\n- let current = Store::root()\n- .user_weights()\n- .key(&uuid.clone())\n- .get(db)\n- .map_err(|e| EventLogError::Apply(e.to_string()))?\n+ let current = pending_weights\n+ .get(uuid)\n+ .copied()\n+ .or_else(|| {\n+ Store::root()\n+ .user_weights()\n+ .key(&uuid.clone())\n+ .get(db)\n+ .ok()\n+ .flatten()\n+ })\n .unwrap_or(BASE_TRUST_WEIGHT);\n+ let next = trust_weight_after_link(current);\n+ pending_weights.insert(uuid.clone(), next);\n batch.write(\n Store::root()\n .user_weights()\n .key(&uuid.clone())\n- .set(&trust_weight_after_link(current)),\n+ .set(&next),\n );\n }\n }\n@@ -205,6 +218,15 @@ mod tests {\n ),\n record(\n 3,\n+ Event::OauthLinked {\n+ uuid: uuid.into(),\n+ provider: \"reddit\".into(),\n+ provider_id: \"t2_abc\".into(),\n+ ts,\n+ },\n+ ),\n+ record(\n+ 4,\n Event::PseudonymClaimed {\n uuid: uuid.into(),\n pseudonym: \"octocat\".into(),\n@@ -219,8 +241,12 @@ mod tests {\n oauth_link_owner(store.db(), \"github\", \"42\").unwrap(),\n Some(uuid.to_string())\n );\n+ assert_eq!(\n+ crate::storage_schema::linked_providers_for_uuid(store.db(), uuid).unwrap(),\n+ vec![\"github\".to_string(), \"reddit\".to_string()]\n+ );\n assert_eq!(resolve_actor_uuid(store.db(), \"octocat\").unwrap(), uuid);\n- assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 1.5);\n+ assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 2.0);\n let aliases = Store::root()\n .user_pseudonyms()\n .key(&uuid.to_string())\ndiff --git a/server/src/storage_schema.rs b/server/src/storage_schema.rs\nindex b942810afd96d3bf01b7765718303a39be4ef8d2..dac6f8e6080e3f5683c24dbb8861f5a981d456c4 100644\n--- a/server/src/storage_schema.rs\n+++ b/server/src/storage_schema.rs\n@@ -103,6 +103,25 @@ pub fn oauth_link_owner(db: &Db, provider: &str, provider_id: &str) -> durable::\n .get(db)\n }\n \n+/// Provider names linked to a UUID (`github`, `reddit`, …). Private — for the\n+/// account owner's page only; never expose which providers are linked publicly.\n+pub fn linked_providers_for_uuid(db: &Db, uuid: &str) -> durable::Result> {\n+ let mut providers = Vec::new();\n+ for (key, owner) in Store::root().oauth_links().iter(db)? {\n+ if owner != uuid {\n+ continue;\n+ }\n+ let Some((provider, _)) = key.split_once(':') else {\n+ continue;\n+ };\n+ if !providers.iter().any(|p| p == provider) {\n+ providers.push(provider.to_string());\n+ }\n+ }\n+ providers.sort();\n+ Ok(providers)\n+}\n+\n pub const RECENT_VOTES_CAP: u64 = 200;\n \n fn id_key(id: &ItemId) -> String {\ndiff --git a/test/support/harness.clj b/test/support/harness.clj\nindex 4505ece5aa193e826ca61c52f1467d252080d66b..741024aab1d14269e225791189633287980ae2e4 100644\n--- a/test/support/harness.clj\n+++ b/test/support/harness.clj\n@@ -48,12 +48,15 @@\n \"GITHUB_CLIENT_SECRET\" \"test-secret\"\n \"GITHUB_OAUTH_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n \"GITHUB_API_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n+ ;; Reddit import fixtures + Reddit OAuth on reddit-port.\n \"REDDIT_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_CLIENT_ID\" \"test-reddit\"\n+ \"REDDIT_CLIENT_SECRET\" \"test-reddit-secret\"\n \"REDDIT_OAUTH_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n- \"REDDIT_CLIENT_ID\" \"\"\n- \"REDDIT_CLIENT_SECRET\" \"\"\n- \"REDDIT_APP_ID\" \"\"\n- \"REDDIT_APP_SECRET\" \"\"}))\n+ \"REDDIT_OAUTH_AUTHORIZE_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_OAUTH_TOKEN_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_OAUTH_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_USER_AGENT\" \"web:sorter2-test:v0 (by /u/test)\"}))\n \n (defn with-auth-servers\n \"Start mock Reddit + mock OAuth + release sorter2-server.\ndiff --git a/test/support/mock_oauth.clj b/test/support/mock_oauth.clj\nindex 909d7a7be8b159ea54a122d69c46af3db3318118..5ba7e9be3cf6d2226648e9609a09ed45f306930f 100644\n--- a/test/support/mock_oauth.clj\n+++ b/test/support/mock_oauth.clj\n@@ -1,5 +1,5 @@\n (ns test.support.mock-oauth\n- \"In-process HTTP stub for GitHub OAuth (authorize, token, /user).\"\n+ \"In-process HTTP stub for GitHub + Reddit OAuth (authorize, token, user).\"\n (:require [clojure.string :as str])\n (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n [java.net InetSocketAddress URLDecoder]))\n@@ -12,11 +12,14 @@\n (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n (str/split query #\"&\"))))\n \n-(defn- parse-mock-user [raw]\n+(defn- parse-mock-user\n+ \"GitHub-style `id:login` (numeric id). Reddit-style `t2_xxx:name`.\"\n+ [raw]\n (let [s (or raw \"1002:newbie\")\n [id login] (str/split s #\":\" 2)]\n- {:id (Long/parseLong id)\n- :login (or login \"newbie\")}))\n+ {:id id\n+ :login (or login \"newbie\")\n+ :numeric? (re-matches #\"\\d+\" id)}))\n \n (defn- send-json [^HttpExchange ex status body]\n (let [bytes (.getBytes body \"UTF-8\")]\n@@ -31,9 +34,10 @@\n (.sendResponseHeaders ex 302 -1)\n (.close (.getResponseBody ex)))\n \n-(defn- read-form-code [^HttpExchange ex]\n+(defn- read-form [^HttpExchange ex]\n (let [body (slurp (.getInputStream ex))]\n- (query-param body \"code\")))\n+ {:code (query-param body \"code\")\n+ :grant (query-param body \"grant_type\")}))\n \n (defn- bearer-token [^HttpExchange ex]\n (some-> (.getRequestHeaders ex)\n@@ -44,8 +48,18 @@\n (when (str/starts-with? token \"mock:\")\n (parse-mock-user (subs token 5))))\n \n+(defn- authorize-redirect [exchange query]\n+ (let [redirect-uri (query-param query \"redirect_uri\")\n+ state (query-param query \"state\")\n+ mock-user (query-param query \"mock_user\")\n+ user (parse-mock-user mock-user)\n+ code (str \"mock:\" (:id user) \":\" (:login user))\n+ loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+ \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+ (send-redirect exchange loc)))\n+\n (defn start-mock-oauth\n- \"Start mock GitHub OAuth on `port`. Returns a zero-arg `stop` function.\"\n+ \"Start mock GitHub + Reddit OAuth on `port`. Returns a zero-arg `stop` function.\"\n [port]\n (let [server (HttpServer/create (InetSocketAddress. \"127.0.0.1\" port) 0)\n handler\n@@ -53,28 +67,45 @@\n (handle [^HttpExchange exchange]\n (let [uri (.getRequestURI exchange)\n path (.getPath uri)\n- query (.getQuery uri)]\n+ query (.getQuery uri)\n+ method (.getRequestMethod exchange)]\n (cond\n+ ;; GitHub authorize\n (str/ends-with? path \"/login/oauth/authorize\")\n- (let [redirect-uri (query-param query \"redirect_uri\")\n- state (query-param query \"state\")\n- mock-user (query-param query \"mock_user\")\n- user (parse-mock-user mock-user)\n- code (str \"mock:\" (:id user) \":\" (:login user))\n- loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n- \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n- (send-redirect exchange loc))\n+ (authorize-redirect exchange query)\n+\n+ ;; Reddit authorize\n+ (str/ends-with? path \"/api/v1/authorize\")\n+ (authorize-redirect exchange query)\n \n- (str/ends-with? path \"/login/oauth/access_token\")\n- (let [code (or (read-form-code exchange) \"mock:1002:newbie\")]\n+ ;; GitHub token\n+ (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n+ (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n \n+ ;; Reddit token (client_credentials for import + authorization_code for login)\n+ (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+ (let [form (read-form exchange)\n+ grant (or (:grant form) \"\")\n+ code (or (:code form) \"mock:t2_test:redditor\")]\n+ (if (= grant \"client_credentials\")\n+ (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+ (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+ ;; GitHub user\n (= path \"/user\")\n (let [token (bearer-token exchange)\n- user (or (parse-token-user token) {:id 1002 :login \"newbie\"})]\n+ user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n (send-json exchange 200\n (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n \n+ ;; Reddit /api/v1/me\n+ (str/ends-with? path \"/api/v1/me\")\n+ (let [token (bearer-token exchange)\n+ user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n+ (send-json exchange 200\n+ (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n :else\n (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))))]\n (.createContext server \"/\" handler)\ndiff --git a/test/support/mock_reddit.clj b/test/support/mock_reddit.clj\nindex 5efa92db3e1f79b8f423a2f1adcbda959123c1ad..a630cf0938722193e9af88382d60e777ff371be4 100644\n--- a/test/support/mock_reddit.clj\n+++ b/test/support/mock_reddit.clj\n@@ -1,14 +1,56 @@\n (ns test.support.mock-reddit\n- \"In-process HTTP stub for Reddit API fixtures (`test/fixtures/reddit/`).\"\n+ \"In-process HTTP stub for Reddit API fixtures + OAuth login endpoints.\"\n (:require [clojure.java.io :as io]\n [clojure.string :as str])\n (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n- [java.net InetSocketAddress]))\n+ [java.net InetSocketAddress URLDecoder]))\n \n (defn fixtures-dir\n ([] (fixtures-dir (System/getProperty \"user.dir\")))\n ([root] (str root \"/test/fixtures/reddit\")))\n \n+(defn- query-param [query key]\n+ (when query\n+ (some (fn [pair]\n+ (let [[k v] (str/split pair \"=\" 2)]\n+ (when (= k key)\n+ (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n+ (str/split query #\"&\"))))\n+\n+(defn- parse-mock-user [raw]\n+ (let [s (or raw \"t2_test:redditor\")\n+ [id login] (str/split s #\":\" 2)]\n+ {:id id :login (or login \"redditor\")}))\n+\n+(defn- send-bytes [^HttpExchange ex status ^bytes body content-type]\n+ (.set (.getResponseHeaders ex) \"Content-Type\" content-type)\n+ (.sendResponseHeaders ex status (alength body))\n+ (doto (.getResponseBody ex)\n+ (.write body)\n+ (.close)))\n+\n+(defn- send-json [^HttpExchange ex status body]\n+ (send-bytes ex status (.getBytes body \"UTF-8\") \"application/json\"))\n+\n+(defn- send-redirect [^HttpExchange ex location]\n+ (.set (.getResponseHeaders ex) \"Location\" location)\n+ (.sendResponseHeaders ex 302 -1)\n+ (.close (.getResponseBody ex)))\n+\n+(defn- read-form [^HttpExchange ex]\n+ (let [body (slurp (.getInputStream ex))]\n+ {:code (query-param body \"code\")\n+ :grant (query-param body \"grant_type\")}))\n+\n+(defn- bearer-token [^HttpExchange ex]\n+ (some-> (.getRequestHeaders ex)\n+ (.getFirst \"Authorization\")\n+ (str/replace #\"^[Bb]earer \" \"\")))\n+\n+(defn- parse-token-user [token]\n+ (when (str/starts-with? token \"mock:\")\n+ (parse-mock-user (subs token 5))))\n+\n (defn start-mock-reddit\n \"Start a mock Reddit API on `port`. Returns a zero-arg `stop` function.\"\n ([port] (start-mock-reddit port (fixtures-dir)))\n@@ -19,15 +61,38 @@\n handler\n (proxy [HttpHandler] []\n (handle [^HttpExchange exchange]\n- ;; `/r//about.json` → subreddit entity; `/r/.json` → listing.\n- (let [path (.getPath (.getRequestURI exchange))\n- body (if (str/includes? path \"/about\")\n- about\n- listing)]\n- (.sendResponseHeaders exchange 200 (alength body))\n- (let [out (.getResponseBody exchange)]\n- (.write out body)\n- (.close out)))))]\n+ (let [uri (.getRequestURI exchange)\n+ path (.getPath uri)\n+ query (.getQuery uri)\n+ method (.getRequestMethod exchange)]\n+ (cond\n+ (str/ends-with? path \"/api/v1/authorize\")\n+ (let [redirect-uri (query-param query \"redirect_uri\")\n+ state (query-param query \"state\")\n+ user (parse-mock-user (query-param query \"mock_user\"))\n+ code (str \"mock:\" (:id user) \":\" (:login user))\n+ loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+ \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+ (send-redirect exchange loc))\n+\n+ (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+ (let [form (read-form exchange)\n+ grant (or (:grant form) \"\")\n+ code (or (:code form) \"mock:t2_test:redditor\")]\n+ (if (= grant \"client_credentials\")\n+ (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+ (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+ (str/ends-with? path \"/api/v1/me\")\n+ (let [user (or (parse-token-user (bearer-token exchange))\n+ {:id \"t2_test\" :login \"redditor\"})]\n+ (send-json exchange 200\n+ (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n+ ;; `/r//about.json` → subreddit entity; `/r/.json` → listing.\n+ :else\n+ (let [body (if (str/includes? path \"/about\") about listing)]\n+ (send-bytes exchange 200 body \"application/json\"))))))]\n (.createContext server \"/\" handler)\n (.setExecutor server nil)\n (.start server)\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}