[P2] Test OAuth profiles against the application default catalog revision

[michielbdejong]

Recorded during review of main at a1eb305ccfa2f3fc8ddede4875765cf1b099bd2b. This issue records a finding only; no implementation changes were made or requested.

Finding

The application default pins catalog revision a53b5e75641dabc04af18813348312edcd453bf9, but the Google-offline/Spotify-PKCE profile regression test loads d83c3ce0afd9f8ca0e4c42e142fa89d5fa9d8f70. Its passing result does not establish that the default configuration supplies those profiles. This is a test/configuration alignment finding; it does not claim a live deployment was inspected.

Evidence

• src/config.rs:57
• src/catalog.rs:338

Desired outcome

Cover the default configured pin explicitly, with any candidate/newer revision tested separately and clearly identified.

[michielbdejong]

Fixed in #73 — added a test that loads the catalog from the application's actual default CATALOG_PATH pin (now a shared config::DEFAULT_CATALOG_PATH constant) and asserts the OAuth profiles it supplies; the existing test against a separately-pinned revision is now clearly labeled as such rather than implying it covers the default.

---

Generated by Claude Code