docs: record repository login E2E verification

docs/development-log.md

@@ -53,3 +53,13 @@ This is the append-only implementation and handoff record shared by Codex and Cl
 - Known limitations: No Android device is connected, so the hosted App Link, system-browser return, live account login, repository result, and device Keystore behavior require one manual E2E run on the target phone.
 - Next recommended task: Install the debug APK on the target Android device and verify login plus the internal repository list; after that, begin branch browsing.
 - Next owner: Human product owner for device E2E, then Codex.
+
+## 2026-08-25 — TASK-011 device E2E closure
+
+- Agent and role: Human product owner, device verifier; Codex, evidence recorder
+- Verification performed: Installed application login against the production company Gitea and retrieval of the authenticated account's internal repository list.
+- Result: System-browser OAuth, verified App Link return, authenticated API access, and repository-list rendering passed on the target device.
+- Review status: Automated gates previously passed and final independent review reported no P0/P1; the remaining manual device gate is now closed.
+- Task status: TASK-011 complete.
+- Next recommended task: Add repository selection and branch listing.
+- Next owner: Codex.

tasks/002b-oauth-android-integration.md

@@ -1,6 +1,6 @@
 # TASK-002B: Integrate OAuth with Android and verify App Links
 
-Status: implemented through TASK-011 — device E2E verification pending
+Status: completed through TASK-011 — device OAuth/App Link E2E passed
 Owner: Codex
 Reviewer: Claude
 

tasks/011-login-repository-list.md

@@ -1,6 +1,6 @@
 # TASK-011: Sign in and list accessible repositories
 
-Status: code complete and independently reviewed — device E2E pending
+Status: complete
 Owner: Codex
 Reviewer: Claude
 
@@ -35,18 +35,18 @@ A user can sign in to the configured company Gitea through the system browser an
 
 ## Acceptance criteria
 
-- [ ] Login opens an external browsable HTTPS intent and no WebView dependency or component exists.
-- [ ] The manifest accepts only the configured verified HTTPS callback host and path.
-- [ ] Callback processing uses TASK-002A validation and clears pending verifier/state on every terminal result.
-- [ ] Code exchange sends client ID, redirect URI, original verifier, and no client secret.
-- [ ] Access/refresh tokens are encrypted with an Android Keystore key, excluded from backup, redacted from string output, and removed on logout.
-- [ ] The authenticated `/api/v1/user` call confirms the account before repository loading.
-- [ ] `/api/v1/user/repos` follows pagination to completion, deduplicates by stable repository ID, and has a bounded page count.
-- [ ] DTOs remain in data packages; UI models contain no token, HTTP, or Android persistence types.
-- [ ] UI has localized signed-out, browser-waiting, loading, content, empty, authentication-expired, permission-denied, offline, and server-error states.
-- [ ] Repository rows identify owner/name, visibility, optional description, and default branch; logout is explicit.
-- [ ] Unit tests cover exchange form, callback terminal clearing, token codec, repository mapping/pagination/deduplication, and error mapping.
-- [ ] Build, unit tests, lint, focused tests, secret scan, and independent review pass.
+- [x] Login opens an external browsable HTTPS intent and no WebView dependency or component exists.
+- [x] The manifest accepts only the configured verified HTTPS callback host and path.
+- [x] Callback processing uses TASK-002A validation and clears pending verifier/state on every terminal result.
+- [x] Code exchange sends client ID, redirect URI, original verifier, and no client secret.
+- [x] Access/refresh tokens are encrypted with an Android Keystore key, excluded from backup, redacted from string output, and removed on logout.
+- [x] The authenticated `/api/v1/user` call confirms the account before repository loading.
+- [x] `/api/v1/user/repos` follows pagination to completion, deduplicates by stable repository ID, and has a bounded page count.
+- [x] DTOs remain in data packages; UI models contain no token, HTTP, or Android persistence types.
+- [x] UI has localized signed-out, browser-waiting, loading, content, empty, authentication-expired, permission-denied, offline, and server-error states.
+- [x] Repository rows identify owner/name, visibility, optional description, and default branch; logout is explicit.
+- [x] Unit tests cover exchange form, callback terminal clearing, token codec, repository mapping/pagination/deduplication, and error mapping.
+- [x] Build, unit tests, lint, focused tests, secret scan, and independent review pass.
 
 ## External evidence
 
@@ -67,4 +67,5 @@ A user can sign in to the configured company Gitea through the system browser an
 - Focused authentication, callback, token-codec, HTTP transport, repository pagination/mapping, error mapping, and immutable UI-state tests passed.
 - `git diff --check` and the sensitive-pattern scan passed; no WebView or production client secret exists.
 - Independent review confirmed the browser/App Link, PKCE, Keystore/backup, identity-before-repositories, and bounded pagination design. Its P1 browser-cancellation, response-read, and token-retained error-recovery findings were fixed, together with signed-in error/logout UX, nullable DTO validation, immutable snapshots, and focused regression tests. Final re-review found no remaining P0/P1.
-- Hosted `assetlinks.json` was visually confirmed by the product owner with both development signing fingerprints. No Android device is connected to this workstation, so actual browser callback and authenticated live-server E2E remain a manual verification step.
+- Hosted `assetlinks.json` was visually confirmed by the product owner with both development signing fingerprints.
+- Product-owner device E2E on 2026-08-25 passed: account login returned through the verified App Link and the app displayed the accessible internal repository list from the production Gitea instance.