[daliu]

Outcome

Map the repository OAUTH-001 and OAUTH-001A/B/C planning slices to existing live Strava tracker #88 so no agent publishes or implements a duplicate ticket.

Refs #99
Refs #88

Change

• Mark STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 as the canonical live OAUTH-001/STRAVA tracker.
• Keep OAUTH-001A/B/C as bounded outcomes inside STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88.
• Require any future split to make STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 the explicit tracker and cross-link the claimed child first.
• Preserve ABUSE-001A deferral of stravaExchangeCode until OAUTH-001C is delivered within STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88.
• Preserve DATA-001A ownership of registration/order confirmation handoffs.

No runtime, test, workflow, provider, production-data, or deployment configuration changed.

Verification

• Exact head: 9c2aa02cf9f493f78da18d9e8d1458326ec2034a.
• Diff contains only GITHUB_ISSUES.md, GITHUB_ISSUE_SLICES.md, and SECURITY.md.
• git diff --check passed.
• All changed relative Markdown links resolve.
• Live STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 was extended as the self-contained canonical tracker: A/B/C boundaries, P0 labels, slice-specific dependencies/readiness, B owner-action governance, App Check deferral/cutover, and no-duplicate split rules are explicit.

Officer impact

None — this corrects agent issue ownership only and changes no officer procedure or live behavior.

Officer documentation

None — no public content, officer action, account, payment, data, permission, hosting, or recovery procedure changed.

Deployment evidence

• Source documentation changed: yes.
• Tests: runtime unchanged; exact docs diff/link checks passed.
• Code merged: no — awaiting review/checks.
• Website/Firebase/provider/live behavior: not changed or verified.
• Rollback: revert this documentation-only pull request.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	9c2aa02
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a549bd40b6de30008017df9
😎 Deploy Preview	https://deploy-preview-129--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Review blocker on 38edddf despite the duplicate mapping being resolved:

1. GITHUB_ISSUE_SLICES.md changes OAUTH-001B from owner_action to generic “represented within STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88,” losing the required owner-only boundary for provider/IAM/encryption decisions. Preserve each slice's original workflow state alongside the STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 mapping: A/C remain proposed; B remains owner_action.
2. Live STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 still says the whole issue waits for ABUSE-001, while the new canonical map says ABUSE-001A must defer stravaExchangeCode until OAUTH-001C merges. With STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88's “do not begin until dependencies complete” language, that is a cycle. Make STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 readiness/dependencies slice-specific and treat ABUSE as coordination rather than a predecessor for C, so C can follow merged SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99 and unblock ABUSE.

The three-file docs-only scope and #88 cross-link otherwise resolve the original duplication risk.

[daliu]

Independent read-only review: APPROVE exact head 9c2aa02.

• OAUTH-001A/C explicitly remain proposed; OAUTH-001B remains owner_action.
• Live STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 and repository docs now use coherent slice-specific readiness. ABUSE-001A may proceed while only stravaExchangeCode remains deferred, so the dependency cycle is gone.
• P0/status/labels, canonical mapping, and no-duplicate cross-links are consistent; no dangling child found.
• The diff is clean and docs-only. Exact-head CI run 29234091214 and Netlify checks passed.

No remaining blocker. This is independent Codex-agent review, not human approval; merge authority remains with the #99 owner.