[fcakyon]

Apps can reuse the shipped Google login journey while keeping one account and revocable session model across web, Android, iOS and TV.

• Add the reusable-app-components plugin with the app-auth skill, React Google adapter, always-available same-tab fallback and optional Muvisafe-inspired panel. The app owns branding, navigation and access rules.
• Define provider adapters, native code/PKCE login, TV code approval and device revocation around one session contract. Native/TV implementations and additional providers remain pending.
• Document a PocketBase + Go auth/mail target and OpenShip conventions for Muvisafe, MyAIPatient, Fast Rational and Orchestrator. Preserve Orchestrator's allowlist, individual session revocation and separate CLI tokens. This adds no shared Go runtime and performs no app migration.

Web button or redirect ─┐
Native SDK or browser ──┼─ verified provider identity → app policy → revocable app session
TV code approval ───────┘

Unstyled fixture	Optional panel

Both images show local test fixtures. The panel uses app-owned theme variables. Production integrations retain Google's official button.

Validated: 10 headless Chrome fixture tests pass, covering no-JavaScript fallback, same-tab navigation, credential exchange, 401/429/500 retry, close/SDK-unload cancellation and en/tr desktop/mobile controls. TypeScript, plugin/skill validation and four simplify reviews pass. The fixtures use a local SDK substitute and HTTP server. They do not certify real Google or native/TV flows. Prior Muvisafe deployment evidence is recorded separately in the skill provenance.