Adam Moussa 9cf124a24b Fold in Gemini (round-3, third model family) auth findings ... - Gemini-BLOCK-1: AllowedOAuthScopes strictly filtering a V2 pre-token Lambda's output is unverified -> fatal Phase-0a check (§6 #8a); if it fails, pre-token fail-closed becomes the primary boundary. - Gemini-BLOCK-2: Cognito access tokens carry client_id/scopes, not native aud -> align §1h + facade/server checks to client_id allow-list / scope-prefix audience proxy. - Gemini-Q: 0a spike must run on production-equivalent Enterprise Grid + real licenses. - Gemini-NIT (path-corrected): project memory is a private store at ~/.claude/.../memory/, not the repo and not Gemini's own ~/.gemini path. Three model families now converge: structural plan sound; only open risk is the auth token-mint mechanism, fully spike-gated in Phase 0a.		2026-06-11 13:22:55 -04:00
..
agentforce-plan.md	Fold in Gemini (round-3, third model family) auth findings	2026-06-11 13:22:55 -04:00
design.md	Initial commit: sh-mcp design and plan	2026-06-09 19:25:24 -04:00