feat(social): C2 Bluesky connect (#641)

[radandevist]

What

Epic C step 2 — Bluesky connect for tenants (#641), part of the social-accounts epic (#630). A tenant admin can connect a Bluesky account with an identifier + app password, reconnect it after a password change, disconnect it (secret erased), scope its visibility to projects, and list accounts with keyset pagination.

Closes #641 · refs #630

Per-area changes

Infrastructure seam + client (Modules/SocialAccounts/Providers/Bluesky/, Lib/)

• IBlueskyClient HTTP adapter over Bluesky createSession with typed outcomes: Success(Identity, AccessJwt, PdsHost) / AccountFailure(reason) / Transient — secrets never leave the request body; 401→refused, 400-class→account-not-found, network/5xx→transient.
• BlueskySessionProvider implements the Epic-D ISocialSessionProvider.OpenSessionAsync seam exactly (identifier = stored handle, secret decrypted only in-flight).
• FakeBlueskyClient records every attempt and programs outcomes; fakes in every spec, never real network.

Rate limiting (Lib/RateLimiting/, env)

• New SocialConnect policy (default 5 permits / 3600 s per session fingerprint), stricter than reads by design (spec §4). Wired through AppEnvironment (SOCIAL_CONNECT_RATE_LIMIT_*), .env.example, settings record, limiter store, coverage validator.

Domain service (Services/SocialAccountService.cs)

• Connect: upsert-by-(tenant, provider, DID); refusal/unreachable → nothing stored; same-DID re-connect reactivates in place.
• Reconnect: replaces the secret only on provider success; refused → row untouched; revoked → 404.
• Disconnect: status → Revoked + ProtectedCredentials erased to empty sentinel; soft delete untouched (history kept).
• SetProjects: replace-all diffing validated against the tenant's live projects; empty set = visible everywhere.
• Find: keyset pagination via CursorSortFieldHandler (created_at/updated_at) + optional project visibility filter. Project links are loaded before VisibleIn runs — under AsNoTracking an unloaded navigation made every account look unattached and leaked attached accounts across projects; caught first by spec, then covered again by proof 3.

API surface (Routes.SocialAccounts.cs, Endpoints/, Handlers/Tenant/)

• /social-accounts group: GET list (view, HeavySearchList), POST /connect (manage, SocialConnect), POST /{id}/reconnect (manage, SocialConnect), POST /{id}/disconnect (manage, default), PUT /{id}/projects (manage, default).
• New RFC 7807 result type AppProviderUnavailableHttpResult (+ TypedProblems.ProviderUnavailable) — 503 reserved strictly for downstream provider outages.
• Audit constants socialaccount.connected/reconnected/disconnected/projects.set; details carry handle/DID/project ids, never the app password.
• i18n keys EN+FR (credentials-refused, provider-unreachable, social-account-not-found, social-account-disconnected-success, project-not-found) + regenerated ResponseKeys.g.cs.
• Permissions slice (tenant.socialaccounts.view/manage/publish) landed earlier on this branch.

Client

• Kiota regeneration: new packages/client-ts/src/socialAccounts/ surface; front typecheck green.

Verification

All heavy commands through ~/ai-orchestration-playbook/tools/heavy.sh:

• just build-api — green (0 warnings).
• Service specs: 16/16 (SocialAccountService.*Spec, exclusive ApiFixture per class, at-rest secrets verified through an independent DbContext).
• Architecture + ComprehensiveRateLimiting guards: 107/107 (includes endpoint rate-limit coverage validation of the five new routes).
• Six mandated proofs (.dump/mutation-check.md sibling evidence): secret-leak sweep (list/detail routes, every DB column, audit_log rows; blob round-trips but plaintext appears nowhere), tenant isolation (B on A's ids → 404 everywhere; lists disjoint), project visibility over HTTP, permission matrix (403 ×5 routes without verb, 401 without session), refusal→nothing-stored (422 then 503, zero rows; success inserts exactly one), disconnect semantics (revoked + Unprotect.Outcome == Absent, still listed, reconnect-after-revoke → 404). 8/8 green.
• Adversarial mutation (.dump/mutation-check.md): dropping the tenant filter fails the build outright (IDE0060 — parameter unused); neutralizing it with || true turns SocialAccountIsolationSpec red with tenant B successfully mutating A's account. Restored byte-exact (SHA-256 verified), suites green again.
• Full API suite just test-api: 1992/1992 passed (log: .dump/full-api-suite.log).
• just generate-client && pnpm --filter front typecheck: green.
• just check-write: clean. just knip: fails identically on this branch's baseline without our diff (pre-existing findings in scripts-ts/shared-ts; zero hits touching the social slice).

Note: the brief cited just api-check, which does not exist in the justfile; substituted just build-api + targeted suites + full just test-api as above.

Risk / rollout

No DB migration in this step (entity + junction shipped earlier). Deployed env needs no new required variables — SOCIAL_CONNECT_RATE_LIMIT_* have safe defaults. The Bluesky client is behind an interface faked in tests; production registration requires SOCIAL_ACCOUNTS_MASTER_KEY already present since the Epic-D canary work.

Round 2 (review fixes)

Round-1 verdict was CHANGES_REQUIRED (2 MAJOR blocking + 3 MAJOR follow-ups) — all five addressed, one commit each, merged cleanly with origin/develop first. Paired RED/GREEN mutation evidence per finding under .dump/.

1. BlueskySessionProvider spec (b85ec4ef7) — new BlueskySessionProviderSpec drives every outcome through FakeBlueskyClient: success → Opened(Did, Handle, AccessJwt, PdsHost); unprotect absent/tampered → AccountFailure (plain-words cause); missing row → AccountFailure; refused → AccountFailure plus persisted flip Status→NeedsReconnect, LastError=sanitised cause, UpdatedAt (ExecuteUpdateAsync, asserted via fresh AsNoTracking context); transient → Transient with zero stored-state change. Proof: swapping the Transient/AccountFailure mapping → RED 2/5 (session-provider-red.log), restored → GREEN 5/5.
2. Record secret redaction (4090ed980) — BlueskyCredentials and SocialSession override ToString()/PrintMembers rendering the app password / access JWT as [REDACTED]; AccessJwt additionally [property: JsonIgnore] so serializer-based logging cannot leak it. Positional ctor unchanged (D1 seam intact). New SocialSessionSecretRedactionSpec asserts ToString(), interpolation, reflection PrintMembers and JSON output never contain the secret value: RED 0/3 before the overrides, GREEN 3/3 after (redaction-red.log / -green.log).
3. SocialConnect exhausted over HTTP (f6ad50979) — new ComprehensiveRateLimitingSpec case uses the previously unused socialConnectPermitLimit: 1 factory parameter and drives two real POSTs to /social-accounts/connect: first 201, second 429 application/problem+json. Proof: detaching the policy from the connect endpoint (fallback AuthenticatedDefault lets the second request pass) → RED 0/1, re-attached → GREEN 1/1 (rate-limit-red.log / -green.log). The Verification claim above is corrected accordingly.
4. i18n parity guard (6eb6ce61d) — packages/shared-ts vitest spec pins full EN↔FR key parity of the response-message namespace and names the five new keys explicitly with non-empty values both sides. Proof: removing an FR key → RED, restored → GREEN (i18n-red.log / -green.log).
5. Plan relocated (382b7f9c2) — git mv docs/superpowers/plans/2026-08-25-c2-bluesky-connect.md docs/records/2026-08-25-plan-c2-bluesky-connect.md; self-reference fixed; stale design-spec link replaced by a pointer to the prune audit record; emptied superpowers dirs removed.

Post-fix full API suite: 2047/2047 passed (.dump/full-api-suite-r2.log).

Round 3 (spec-drift + develop/D1 convergence)

Round-2 verdict was CHANGES_REQUIRED with ONE blocking finding: the spec-drift REQUIRED gate was RED (committed kiota-lock.json stale vs committed openapi.json).

1. Spec-drift fix (939340af1) — packages/client-ts/src/kiota-lock.json regenerated from the committed apps/api/openapi.json via just build-api && just generate-client. The descriptionHash flips 17ADE7D5… → 6DFA216E…, byte-for-byte the hash the reviewer derived independently. Determinism proof: a second clean just build-api && just generate-client at the new tip left git status completely empty (zero diff, lock file was the only changed artifact).
2. develop merge (863b51118) — merges origin/develop at 2ef6872b0, including D1 (feat(publishing): D1 — Publication model, IPublishProvider, Bluesky createRecord with a deterministic key #1433, 12938d937) which shares the seam files. Only one content conflict: the seam file itself, where both branches define the same types. Resolved to ONE definition (no duplicates survive): the enriched ISocialSessionProvider.cs keeps D1's contract byte-identical — positional ctor SocialSession(Did, Handle, AccessJwt, PdsHost) unchanged, so every D1 consumer (PublishPublicationJobHandler, BlueskyPublishProvider, their specs) compiles as-is — while retaining the round-2-F2 secret redaction ([property: JsonIgnore] on AccessJwt plus ToString()/PrintMembers rendering it [REDACTED]), so the reviewed security fix is not regressed by the convergence. DI converges by the mechanism D1 documented for exactly this moment: develop's UnimplementedSocialSessionProvider registers through TryAddScoped, so this lane's real AddScoped<ISocialSessionProvider, BlueskySessionProvider>() wins last-wins with no code change; the placeholder remains only as a fail-loud backstop.
3. Gates at the merge tip (all heavy commands under heavy.sh, canonical test env values from .env.example):
   • API suites filtered to SocialAccounts + Publishing modules plus the D1 Roslyn guards (PublicationArchitecture.Spec, AppRoleComposition.Spec, ServiceAttributeRegistration.Spec, ServiceArgsRecordConvention.Spec): 233/233 passed.
   • pnpm --filter front typecheck: green. Full front test chain (vitest + all guards incl. design-system, z-index, context-chunk isolation, font bundle, react-compiler artifact guard): green — 101 compiler-compiled modules ≥ floor 72 after a fresh pnpm --filter front build.
   • pnpm lint: green.
   • Contract drift after the merge: zero diff (just build-api && just generate-client at the merge tip, clean tree).
4. CI at the pushed tip (863b51118) — polled to completion only (gh pr checks, every check terminal before reading results): all 28 checks pass, zero failures, including the previously-red spec-drift and its openapi-spec-drift-gate summary, both e2e suites (Build e2e images / 4× front-e2e / front-e2e-gate), quality, supply-chain, react-doctor-gate.

Model

Model: Ox Alpha via Nous Portal (jcode), effort max (three provider deaths, resumed from on-disk state each time — see .dump/resume-*.md). Reviewer: adversarial round 1 pending (free-first chain). Model line added by the captain from the dispatch ledger; the lane self-reported nothing.