Complete shared-service authorization and per-user Slack validation #7

Scope

Complete authorization and verify access under the approved Vee first-release design.

• Notion, Granola, Google Calendar, and AgentMail use designated organizational OAuth grants. GitHub uses the existing app installation.
• Slack search uses each verified requester's account. Private-channel access is opt-in inside that requester's DM with Vee. Personal DM history is excluded.

The original blanket request for shared authentication has been superseded for Slack by the approved per-user access design.

Implemented on main

• Fixed shared credential subjects and GitHub installation scope are implemented in agent/lib/shared-auth.ts.
• Administrator authorization commands are implemented in scripts/connections.js.
• Shared-account setup and provider permission boundaries are documented in the README.

Pending work

#15 adds requester-bound Slack authorization. #16 enforces provider and action boundaries. #17 and #19 add staged diagnostics and rollout checks. All remain draft PRs, so they are not evidence of a completed live rollout.

The September 29 results in #17 recorded missing authorization for the checked Notion, Granola, and AgentMail subjects and a missing Calendar connector. This triage did not rerun those provider checks. Calendar provisioning is tracked specifically in #4.

Acceptance criteria

• Confirm the designated account and credential owner for each organizational provider. Document reconnect, revocation, and rotation procedures without recording tokens.
• Finish organizational provider setup and verify successful retrieval from two Slack users without personal OAuth prompts for those shared services.
• Complete the Slack authorization and isolation checks in the rollout checklist, including independent users, account mismatch, revoked consent, OAuth resume, and private-channel boundaries.
• Verify migration retains the old shared Slack grant only for operator recovery and never substitutes it after a user's authorization failure.
• Record the tested deployment SHA and provider-stage results before broader rollout.

Credential availability alone does not establish working provider access.