From dc13c6a07c823f9eaa6681099ddcc9ebf9f6d185 Mon Sep 17 00:00:00 2001 From: Sarthak Agarwal Date: Sat, 8 Aug 2026 06:03:28 +0530 Subject: [PATCH] docs: clarify hosted oauth backend boundary --- docs/oauth-architecture.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/docs/oauth-architecture.md b/docs/oauth-architecture.md index aa491e63..bb9a982f 100644 --- a/docs/oauth-architecture.md +++ b/docs/oauth-architecture.md @@ -52,3 +52,16 @@ Postgres. Hosted connectors may consume `locality-auth-core` for IDs and scope profiles, but hosted availability, tenant binding, finalization, grants, and jobs remain private runtime responsibilities. + +## Backend Image Boundary + +The public `apps/oauth-service` broker is the desktop/local-direct OAuth helper. +It completes provider authorization through localhost and must not be deployed +as the hosted credential authority for enterprise/admin sources. + +Hosted/admin OAuth is a backend process mode in `locality-internal`. That mode +owns tenant-bound intents, provider callbacks, managed secret references, +Postgres finalization, and worker handoff. Keeping the boundary explicit lets +the public repo share connector identity and callback vocabulary without +shipping hosted tenant authorization, Secrets Manager policy, or admin +credential lifecycle code.