[Muawiya-contact]

What changed

• Send new reviewer invitations to the One Concept Review callback with a branded Supabase Invite user email. Confirmed learners keep their existing Auth identity and password; an unconfirmed identity receives a fresh invitation on retry.
• Open password setup only after an invitation or recovery link establishes a verified session. The page shows the account email, requires password confirmation, and removes callback credentials from the address bar. The same account works in the learning app and review workspace. Refreshing the page keeps setup pending for that verified account until the password is saved.
• Start new owner and reviewer memberships with optional authenticator use. Limit active memberships to 10 including the owner, in both FastAPI and the Supabase Edge API.
• Add versioned permanent removal of reviewer membership. It preserves the learner account and historical review evidence, clears open assignments, and suppresses pending notifications. Self-removal and removal of the last qualified administrator are blocked.
• Clarify that Add comment saves feedback and Request changes queues a private AI correction when generation is enabled. Human approval and publication are still required.

Integration and validation

Merged current develop after #458 and #459 without rewriting earlier commits. The four reviewer migrations are now 0133–0136, after learner opt-in migrations 0131–0132. Their SQL bodies are unchanged; the combined schema contract was regenerated from disposable PostgreSQL 16. No applied migration was edited.

• Local PostgreSQL: the ordered migration/contract check passed, followed by 72 reviewer and schema tests.
• Supabase Edge: TypeScript check and 98 API handler tests passed.
• Review site: 22 unit tests, typecheck, fixture production build, and 54 browser tests passed, including the invitation setup refresh regression.
• git diff --check passed. Local Ruff is unavailable; the hosted backend quality job runs it with the complete test suite.
• All three hosted quality checks passed on final head 2cbb03d: backend lint and complete tests, mobile typecheck and tests, and review website build and browser tests (run 40695981812).

Activation after merge

Merging into develop does not apply production SQL, deploy the Edge API, change Supabase Auth, or send invitations. Before a production release, apply all pending migrations in order, including 0133–0136 with matching API/Edge code. Set EDITORIAL_INVITE_REDIRECT_URL to https://coding-moves-one-concept-review.netlify.app/auth/callback, allowlist that exact callback in Supabase Auth, and install backend/email-templates/invite-reviewer.html. Keep the Supabase Site URL on the working learner fallback. Invite from the review site's Reviewers page so membership is created.

A controlled real-email, sign-in, and reviewer-removal check remains for deployment acceptance. Issue #437 also tracks the separate request to keep the private draft queue topped up to ten; this PR does not change that worker behavior.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-22T04:30:41.049992Z We couldn’t complete this review. Comment @codex review to try again.	1adc930	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Muawiya-contact]

Manual work to activate and verify this PR

The source and automated checks are ready. Merging into develop does not apply SQL, deploy the review site or Edge API, change Supabase Auth settings, or send invitations. Complete these checks with the matching production release:

• Verify the production Supabase migration ledger against the database. Apply only pending migrations in order, including the reviewer changes 0133–0136 after learner opt-in 0131–0132 where those are still pending. Run the schema readiness check. Update backend/migrations/applied.txt only after production application is verified.
• Deploy the matching Supabase Edge API and Netlify review-site revision. Confirm Netlify uses the production Edge API URL, matching Supabase Auth URL, public publishable/anon key, and Production label. Check both the site root and /auth/callback directly over HTTPS.
• Set the Edge API's EDITORIAL_INVITE_REDIRECT_URL=https://coding-moves-one-concept-review.netlify.app/auth/callback and allow the exact Netlify origin in ALLOWED_ORIGINS. In Supabase Auth URL Configuration, allow that exact callback while keeping the working learner Site URL and mobile redirects.
• Install the Invite user subject (You're invited to One Concept Review) and raw HTML from backend/email-templates/invite-reviewer.html in the correct Supabase project. Preserve both {{ .ConfirmationURL }} placeholders. Confirm the configured sender can deliver to a test inbox.
• From Reviewers on the website, invite a new test email. Follow its link, set a password, refresh the setup page once before saving, and verify the same account signs in to both the learning app and reviewer site after reviewer-name approval. A manually sent Supabase Dashboard invite does not grant reviewer membership.
• Retry an invitation for an unconfirmed Auth user and check for a fresh usable email. Add an existing confirmed learner separately; their current password should work after membership and name approval, without a new invite email. Test reviewer-site recovery, including an expired link and removal of callback credentials from the browser URL.
• Confirm new reviewer authenticator use starts off and can be enabled in Settings. Count the owner in the ten active reviewers: the tenth is allowed and an eleventh denied. Remove a test reviewer through Reviewers and confirm their learning account and historical evidence remain while reviewer access and open assignments are gone.
• With generation enabled in the intended environment, check that Request changes queues a private AI correction and still requires human approval to publish. Add comment only saves feedback. The separate automatic top-up to ten private reviewer drafts remains tracked in #437.

Do not treat a green CI run or HTTP 200 callback as proof of real invitation email delivery. Keep account details, email links, tokens, and passwords out of the PR.

[Muawiya-contact]

ok