Harden Slack OAuth refresh and Gmail live guardrails

[aseembits93]

Summary

• coalesce concurrent Slack OAuth refreshes in-process and serialize refreshes across CLI, daemon, desktop, and File Provider processes using a state-root lock around every production credential backend
• bypass the macOS keychain process cache for the post-lock credential reread so waiting processes reuse the rotated single-use Slack refresh handle
• refresh Slack before daemon and FUSE consumers start, and keep the rotated credential persisted by the protected live workflow
• verify canonical Gmail sent-message projections reject Linux FUSE writes without changing bytes or dirtying status
• update the Slack connector documentation, live coverage map, and workflow contract

Google Docs and Google Calendar coverage has moved to #208.

Verification

• cargo test -p locality-store
• cargo test -p localityd --test source_descriptor
• cargo check --workspace
• bash -n tests/ci_workflow_contract.sh tests/live_gmail_vfs_roundtrip.sh tests/live_slack_vfs_read.sh
• tests/ci_workflow_contract.sh
• LOCALITY_LIVE_GMAIL_SELFTEST=1 tests/live_gmail_vfs_roundtrip.sh

The credentialed provider/FUSE scenarios run in the protected connector-live-e2e environment.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
locality	Ready	Preview	Aug 18, 2026 6:54pm

[github-actions]

Codex review

No high-confidence issues found.