[dzucconi]

Summary

Fixes native-app sign-in when the app selects a temporary local callback port. Codex publishes http://127.0.0.1/callback but connects using an available port, such as http://127.0.0.1:58043/callback.

Registered callback + temporary loopback port → accepted

Apply the loopback port rule from RFC 8252 during authorization and token exchange. All other callback components must still match; token exchange remains tied to the exact callback chosen for that sign-in. Update the OAuth documentation to include Codex.

Evidence

• Before: Replaying the reported callback with Codex's published metadata returned redirect_uri not registered for this client.
• After: The same local reproduction reaches the consent page. Regression tests cover complete simulated flows for Codex, IPv4, IPv6, and localhost, plus callback mismatches.
• Typecheck, 146 application tests, 8 review-policy tests, formatting, and diff checks pass. Live app sign-in still needs verification after deployment.

Merge Danger

Door: Two-way. No storage migration.

Blast Radius: Connections.

Changes callback matching for HTTP loopback addresses. Existing access tokens are unaffected.