GeezerVison

Summary

• Apply the hosted Google verification flag when starting or completing new Ads, Meet and Chat grants. Cover both account linking and managed enrollment.
• Reject pending scopes supplied through other Google clients, including Vertex AI. Constrain each review integration to its declared scopes and disable incremental scope accumulation.
• Keep the existing Google client configuration for every environment. Previously issued credentials continue refreshing with their original client. A reconnect that requests a new grant goes through the verification check.

Type of change

• Bug fix

Testing

• Ran 26 HTTP and managed-enrollment integration cases against disposable PostgreSQL and Redis, plus 20 Google Chat connector cases. Verified token refresh using the existing client with the grant flag off.
• Ran 79 focused unit cases, including Google service-account transport and managed OAuth.
• Ran app type checking, repository lint and the test-pattern audit.

Rollout

The hosted flag is off when absent. Enable it on the staging deployment used for review. A separate Google project and reviewer-only deployment can supply its own Google client without replacing the shared staging or production credentials. Google review and production release are separate follow-ups.