Legend: [ ] Incomplete, [X] Complete
Evidence for every completed checklist item must include the exact verification command (wrapped with backticks) plus its exit code and artifacts (logs, screenshots, .scratch transcripts) directly beneath the item when the work is performed.
Deliver a Google-compatible OAuth 2.0 / OIDC provider surface (auth, token, userinfo, revoke, JWKS, discovery) that apps can target via GOOGLE_CLIENT_ID/SECRET/ENDPOINT, while brokering identity through Okta and offering an admin UI + YAML-driven registry for client apps. Success means drop-in behavior with google-auth SDKs, enforceable redirect/source policies, PKCE + offline refresh support, and first-class CRUD for app credentials inside DTU.