claude/.claude/tasks/contracts/2026-07-10-seo-account-mgmt-0353.md

CONTRACT — seo-account-mgmt

• date: 2026-07-10 | flow: feat | branch: feature/seo-account-mgmt
• status: active

REQUEST (verbatim — IMMUTABLE)

"J'aimerais qu'on rajoute quand meme une option au skill pour juste connecter le compte. du style un argument au skill seo pour fiare un truc du genre /set seo-connect ou quelque chjose comme cas. Et aussi pouvoir clean la liste des compte deja enregister. pouvoir supprimer des compte ou tout supprimer" — design proposal validated by user ("go pour l'un puis l'autre oui"): /seo connect [label] / /seo accounts / /seo forget <label> / /seo forget --all; tokenstore remove+clear verbs; fetch.sh forget dispatch; new connect.sh wrapper (sources env internally, usable from any project); Makefile delegates to it; SKILL.md arg routing + STEP 0 fix; forget output must state local removal ≠ Google revocation (myaccount.google.com/permissions).

CLARIFICATIONS

none — request complete (design pre-validated in conversation).

ACCEPTANCE CRITERIA

1. python3 lib/seo-data/tokenstore.py remove --file F --label X deletes only label X (others preserved), prints {"status":"ok","removed":true|false}, never prints a refresh token; atomic write + fcntl lock as set.
2. python3 lib/seo-data/tokenstore.py clear --file F empties the store (subsequent list → "accounts": []), JSON ok, same write discipline.
3. Fail-open preserved on new verbs: bad usage → {"status":"error",...} + exit 2; unexpected error → degraded JSON (existing _cli try/except covers).
4. fetch.sh forget --label X / forget --all dispatch to remove/clear within the existing contract (JSON stdout, exit 0 ok, exit 2 bad usage); fetch.sh forget with no/invalid flag → exit 2 + JSON.
5. New lib/seo-data/connect.sh: sources ${SEO_DATA_ENV_FILE:-~/.claude/.env} internally (set -a, never echoed), picks venv python else system, execs connect.py with passed args; with no creds exits nonzero with the "Set GOOGLE_OAUTH_CLIENT_ID/SECRET" gate message (deterministic, offline).
6. Makefile seo-connect delegates to connect.sh (env-sourcing duplication from caa5bed removed); venv creation + pip install kept before.
7. skills/seo/SKILL.md routes connect [label] / accounts / forget <label>|--all BEFORE the audit flow (audit /seo <url> unchanged); forget path includes the Google revocation notice (myaccount.google.com/permissions); STEP 0 no longer proposes bare make seo-connect as the only path (connect.sh tilde path offered).
8. lib/seo-data/README.md documents connect.sh, forget verbs, revocation note.
9. lib/seo-data/seo-data.test.sh covers: remove keeps others / removed:false on missing label / clear empties / redaction on remove / forget via fetch.sh (JSON + exit codes, bad usage 2) / connect.sh offline negative path; plus wiring locks (connect.sh sources vault, Makefile delegates, SKILL routes, README documents). Whole suite + make test green.
10. No commit attribution trailers; tilde paths for engine calls in SKILL.md.

FILE SCOPE

lib/seo-data/tokenstore.py, lib/seo-data/fetch.sh, lib/seo-data/connect.sh (new), lib/seo-data/seo-data.test.sh, lib/seo-data/README.md, Makefile, skills/seo/SKILL.md