Phase 2 — Security-critical observability
OAuth token refresh, credential rotation, auth failure, and provider switch are all silent. auth.json is written with correct file permissions (0o600) but no events are emitted.
Security teams need to know when credentials change, expire, or fail. Emit events for auth state transitions.
Phase 2 — Security-critical observability
OAuth token refresh, credential rotation, auth failure, and provider switch are all silent.
auth.jsonis written with correct file permissions (0o600) but no events are emitted.Security teams need to know when credentials change, expire, or fail. Emit events for auth state transitions.