[simplesagar]

Why

After the move to ai.speakeasy.com, Google rejected Scale's connection because their Google OAuth client still listed only https://app.getgram.ai/mcp/remote_login_callback. Norbert had to swap the URI by hand.

The guides never hard-coded the host. They use {{ gram.oauth.callback_url }}, and speakeasy.com/docs already renders it as https://ai.speakeasy.com/mcp/remote_login_callback. The gap is admins with an existing Google client. In Gram, each Speakeasy client keeps the callback origin it was created with, and a Manual client saved from Settings > Identity after the move registers on the organization's default host (server/internal/remotesessions/callbackorigin.go, identitycommit.go at ff6a2b2). A Google client that lists only the old callback then returns redirect_uri_mismatch.

What changed

All nine Google guides are updated: Gmail, Calendar, Docs, Drive, People, Sheets, Slides, BigQuery and Compute Engine. BigQuery and Compute Engine are included because they use the same kind of Google web client.

• external.md#create-oauth-client: for a reused or shared web client, tells the reader to:
  • confirm Authorized redirect URIs lists {{ gram.oauth.callback_url }} exactly;
  • recognize an old https://app.getgram.ai entry;
  • add the new value with + Add URI and keep the old one while other Speakeasy servers still use it;
  • expect Google to take 5 minutes to a few hours to apply the change.
• speakeasy.md: maps redirect_uri_mismatch at first connection to that fix.
• research.md / meta.yaml: a "Callback domain change" dossier section and provenance records:
  • Google's web-server OAuth guide for the exact-match rule;
  • Manage OAuth Clients for editing a client and the propagation delay;
  • doctrine/ai-control-plane-oauth.md.
• Doctrine (separate commit, needs approval under constitution I8): the Redirect URI row in doctrine/ai-control-plane-oauth.md now records per-client callback origins, re-pinned to Gram ff6a2b2, with a doctrine/CHANGELOG.md entry.

go/generated is left to the post-merge regen bot.

Verification

• lint-guide --json on all nine guides returns [] (no findings).
• The generator's pre-merge validation (go/internal/gen, go run .) passes.
• go test ./... passes except cmd/supervise-factory, which needs Docker and fails the same way on main.
• Rendering every guide with https://ai.speakeasy.com/mcp/remote_login_callback leaves no template keys, and both new notes appear.

Follow-up outside this repo

The Scale POC Notion page "Google Workspace (Gmail, Calendar, Drive) setup" still hard-codes https://app.getgram.ai/mcp/remote_login_callback in step 2.3.

  

Fixes S-1191

[linear-code]

S-1191