fix(lint): satisfy wsl whitespace in OAuth callback server test

[steipete]

Main went red on the lint gate right after the robustness-sweep merge; the PR-branch CI does not run this linter. Verified locally: golangci-lint run reports 0 issues, build passes.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 16, 2026, 7:24 AM ET / 11:24 UTC.

ClawSweeper review

What this changes

Adds blank lines between OAuth callback-server timeout assertions in one Go test to satisfy the whitespace linter.

Merge readiness

✅ Ready for maintainer review

The patch is a focused test-formatting repair with no functional or security defect identified. It remains open because the author is a repository collaborator; likely related people: Sebastien Tardif (recent callback-limit work, high confidence) and steipete (long-running OAuth/lint-area contributor, high confidence).

Priority: P3
Reviewed head: cb07be4080f05fb930baacfd122a1ade74d2335b

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	This is a focused, low-risk lint repair with no correctness finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: This collaborator-authored, test-only formatting change has no separate user-visible runtime behavior requiring proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This collaborator-authored, test-only formatting change has no separate user-visible runtime behavior requiring proof.
Evidence reviewed	4 items	PR diff scope: The branch adds three blank lines to the existing timeout assertions and changes no production code. Lint configuration: The repository enables wsl_v5 globally, and the Google-auth exclusion disables only tagliatelle, so the whitespace rule applies to this test. Current behavior and provenance: Current main's callback-server constructor defines the four limits covered by this test; its immediately related change is commit 75aec7f.
Findings	None	None.
Security	None	None.

How this fits together

The OAuth callback server receives the browser authorization response and applies HTTP safety limits before token exchange completes. Its unit test verifies those limits, and the lint gate checks the test's formatting.

flowchart LR
  Browser[Browser authorization response] --> Callback[OAuth callback server]
  Callback --> Limits[HTTP timeout and header limits]
  Limits --> Test[OAuth unit test]
  Test --> Lint[Whitespace linter]
  Lint --> Checks[Pull-request checks]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Test formatting scope	1 test file affected; 3 lines added; 0 production lines changed	The patch is limited to linter-required spacing around existing OAuth safety assertions.

Technical review

Best possible solution:

Land the focused formatting repair after the current platform checks complete, preserving the existing callback-server assertions.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR changes test formatting only; the reported condition is a lint-gate failure rather than a user-facing runtime bug.

Is this the best way to solve the issue?

Yes: formatting the existing assertions is the narrowest maintainable repair for the reported whitespace-linter failure.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 75aec7f8b0a4.

Labels

Label changes:

• add P3: This is a low-risk lint-gate repair with no runtime behavior change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored, test-only formatting change has no separate user-visible runtime behavior requiring proof.

Label justifications:

• P3: This is a low-risk lint-gate repair with no runtime behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored, test-only formatting change has no separate user-visible runtime behavior requiring proof.

Evidence

What I checked:

• PR diff scope: The branch adds three blank lines to the existing timeout assertions and changes no production code. (internal/googleauth/oauth_flow_more_test.go:21, cb07be4080f0)
• Lint configuration: The repository enables wsl_v5 globally, and the Google-auth exclusion disables only tagliatelle, so the whitespace rule applies to this test. (.golangci.yml:47, 75aec7f8b0a4)
• Current behavior and provenance: Current main's callback-server constructor defines the four limits covered by this test; its immediately related change is commit 75aec7f. (internal/googleauth/oauth_flow.go:158, 75aec7f8b0a4)
• Repository review policy: The full repository policy requires review-only PR handling and explicitly keeps collaborator-authored PRs out of automatic closure. (AGENTS.md:1, 75aec7f8b0a4)

Likely related people:

• Sebastien Tardif: Introduced the current callback-server timeout coverage in the immediately preceding main-branch change. (role: recent area contributor; confidence: high; commits: 75aec7f8b0a4; files: internal/googleauth/oauth_flow.go, internal/googleauth/oauth_flow_more_test.go)
• steipete: History shows repeated work on OAuth callback handling and whitespace-lint maintenance on this surface. (role: OAuth and lint-area contributor; confidence: high; commits: 77f079846117, 70c751c4001c, 1c19dc713edd; files: internal/googleauth/oauth_flow_more_test.go)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.