[Muawiya-contact]

What changed

• Route new reviewer invitations to the One Concept Review callback through a branded Supabase Invite user template and documented production URL settings. Confirmed learners keep their Auth identity and password. Unconfirmed identities receive a fresh invitation on retry.
• Open a dedicated account setup page only after a verified invitation or recovery email creates a session. It shows the verified email, requires password confirmation, strips callback credentials, and uses the same Supabase Auth account and learner profile as the mobile app.
• Start new owner and reviewer memberships with authenticator requirement off while retaining the optional Settings switch. Enforce a maximum of 10 active reviewer memberships, including the owner, in FastAPI and the Edge candidate.
• Add versioned permanent reviewer-membership removal. It retains the Supabase Auth user, learning profile, legacy batches, audit events, and historical review evidence; clears open assignments; and suppresses pending reviewer notifications. Self-removal and deletion of the last qualified administrator are denied.
• Clarify that Add comment records feedback while Request changes queues a private AI correction when generation is enabled. AI output still requires human approval and publication.

Validation

• PostgreSQL: 45 focused tests, then 41 focused tests after the Edge execution-mode fix; final schema-contract inventory 23 tests passed. The FastAPI retry and Edge re-invitation regressions passed against disposable PostgreSQL 16; 37 schema and reviewer access checks passed after the review fix.
• Edge handler: 95 tests passed before the review fix; the complete handler suite passed locally after adding the unconfirmed-account re-invitation regression. Supabase function TypeScript passed before the review fix.
• Review website: 17 component tests, all 54 browser tests, typecheck, and fixture production build passed on the final PR quality run.
• Backend lint/tests and mobile typecheck/tests passed on the same final hosted run.
• Backend Ruff F,E9 and whitespace checks passed. Public live home and callback routes both returned HTTP 200; no real email delivery or hosted Auth settings were tested.

Deployment and remaining work

This PR does not alter live Supabase, Railway, or Netlify settings. Before inviting a real reviewer, apply migrations 0131–0134 with matching API/Edge code; set EDITORIAL_INVITE_REDIRECT_URL=https://coding-moves-one-concept-review.netlify.app/auth/callback; allowlist that exact URL in Supabase Auth; and install the Invite user template from backend/email-templates/invite-reviewer.html. Keep the Supabase Site URL on the working learner fallback. Use the review website's Reviewers page so membership is created.

Issue #437 tracks controlled new/existing-user email and sign-in checks, reviewer removal and AI correction acceptance, plus the separately requested global private-draft top-up to ten. The current worker does not provide that global top-up and production generation remains disabled.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-22T04:30:41.049992Z We couldn’t complete this review. Comment @codex review to try again.	1adc930	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Muawiya-contact]

Manual work to activate and verify this PR

The code and automated checks are ready, but the live Supabase, Railway, and Netlify settings and real email flow still need an operator check. Please work through these in order:

• Deploy the matching reviewer site and API/Edge revision through the normal release process. Apply and verify migrations 0131–0134 in order in the target Supabase database, then run the schema readiness check. Record them in backend/migrations/applied.txt only after production application is verified. A merge into develop alone does not update the live site or services.
• Confirm Netlify’s production build uses the production API origin, Supabase URL, public publishable/anon key, and Production environment label. Check that https://coding-moves-one-concept-review.netlify.app/ and /auth/callback both load directly over HTTPS.
• In the API environment, set EDITORIAL_INVITE_REDIRECT_URL=https://coding-moves-one-concept-review.netlify.app/auth/callback and add https://coding-moves-one-concept-review.netlify.app to ALLOWED_ORIGINS. In Supabase Auth → URL Configuration, allow that exact callback URL while keeping the working learner Site URL and existing mobile redirects.
• In the correct Supabase project, install the Invite user subject (You're invited to One Concept Review) and the raw HTML from backend/email-templates/invite-reviewer.html. Keep its {{ .ConfirmationURL }} links intact. Check that the configured Auth sender can deliver to your test inbox. If you want a separate password-change notice, enable the Supabase Password changed security notification as described in docs/EMAIL_TEMPLATES.md.
• Ensure the intended owner is a confirmed Auth user with reviewer-management access. From the website’s Reviewers page, invite a new test email. Check the received email has no localhost link, opens the dedicated password setup page, and lets that one account sign in to both the learning app and reviewer site after reviewer-name approval.
• Retry an invitation for an unconfirmed Auth account and check that a fresh usable email arrives. Add an existing confirmed learner separately: their current password should work after enrollment and name approval. This path does not send an invite email, so tell the learner the reviewer-site URL directly.
• Test Forgot password from the reviewer site, including a successful recovery and an expired or incomplete link. Check that sign-in works afterward on both clients and that callback credentials are removed from the browser URL.
• Check that a new reviewer’s authenticator requirement starts off and can be enabled in Settings. Count the owner in the 10 active reviewers: the tenth should be allowed and an eleventh refused. Remove a test reviewer through Reviewers and confirm their review access and open assignments are gone while their learning account and historical review evidence remain.
• With generation enabled in the intended environment, verify Request changes creates a private AI correction on a later worker run and still requires human approval before publication. Add comment only records feedback. Record the live results in issue #437.

The separate requested automatic top-up to 10 private reviewer drafts is still product work tracked in #437; this PR does not activate it. Do not treat the HTTP 200 callback check or green CI as proof that real invitation email delivery works.