Mindbridge · track status

CONNECTOR-TRUTH

Whether a customer can connect a source and stay connected — and why, while the OAuth app sits in Google's testing mode, every Gmail source dies within 7 days of consent.

Re-measured 2026-08-16 from gh issue list. Verify before starting — issue checklists decay as boxes are ticked, and the dead-connector count is a live production figure. This page has never been published; publish fresh per docs/status/artifacts.json.

The liveness half of this track is tracked on MEASUREMENT, not here. "Nothing tells us when a connector dies" is connector-liveness (#3060), ruled p1 on 2026-08-14 and still p1 — do not re-ask. This page covers the compliance pair that makes the dying stop and does not duplicate it.

Next →#1248 CASA Tier 2 Assessment — Preparation & Completion · the externally-gated step, because the vendor's turnaround can't be compressed.

5 of 9 production Gmail connectors dead · 2 open p1 issues — the Google verification pair.

2open issues

5 / 9Gmail connectors dead

7 dtoken lifetime in testing mode

Open work Why this order Rulings History

Open work

CASA Tier 2 Assessment — externally gated

p1 #1248 chore: CASA Tier 2 Assessment — Preparation & Completion externally gated — lead time fixed Mizo

Sub-issue of the OAuth verification (#1241): Google requires a CASA Tier 2 assessment (OWASP ASVS Level 2 — 73 requirements) of the restricted gmail.readonly scope before verification completes. Triage, the OWASP ZAP dynamic scan and the Fluid Attacks static scan are already done; what remains is the manual review of architectural requirements, fixing every gap, and a final clean run before submitting to the Google-assigned vendor. The body forbids submitting until those steps are complete — findings during the official assessment extend the timeline and may incur re-assessment fees. Cost is not free: $150–$500 depending on the vendor Google assigns (the parent #1241 says CASA Tier 2 is "typically free"; budget from this sub-issue).

Google OAuth Verification — the parent

p1 #1241 chore: Complete Google OAuth App Verification for Gmail (Restricted) + Calendar (Sensitive) Scopes the parent — leaves testing mode Mizo

The parent of the CASA sub-issue. Until Google completes verification the app stays in testing mode — capped at a hundred manually added test users — so the Gmail connector cannot leave the mode that limits it. Scopes: gmail.readonly (Restricted) and calendar.events.readonly (Sensitive). Remaining checklist: the demo video, the OAuth 2.0 client IDs, the consent-screen scope justifications, and the submission for verification. The CASA step may require the app to be deployed and accessible; coordinate with infra if a staging environment is needed.

Why is it in this order?

Ordering criterion — and what it ignores

CASA (#1248) sorts above its OAuth parent (#1241) because it is the externally-gated prerequisite on the critical path to leaving testing mode: Google assigns the vendor and the assessment has turnaround, so starting it later delays the whole verification one-for-one. The parent's remaining items — demo video, client IDs, scope justifications, submission — are not externally gated and can advance in parallel.

What it ignores: issue age and filing order (both are months old and would tie), priority labels as a tie-break (both are p1), checklist completion (ticked boxes say nothing about what remains blocked), and cost/ease (neither reorders a customer-facing deadline).

Standing rulings

None for this track — track-order.json's decided list is empty. The adjacent ruling that connector-liveness (#3060) stays p1 is decided on the MEASUREMENT track, not here, so it is cross-referenced above rather than restated.

History

Filed dates · no merges yet

Both issues are months old: the verification parent (#1241) filed 2026-05-20, the CASA sub-issue (#1248) filed the next day, 2026-05-21. No merged PR and no post-mortem yet; the only measured state is the production census the measurement track holds — 5 of 9 Gmail connectors dead (cross-referenced to #3060).