[Senate] ORCID OAuth-based researcher claim flow done

Effort: deep

Goal

accumulate_rui_costa.py:24 already cross-references SciDEX content
to a single human researcher (ORCID = "0000-0003-0495-8374") by
hard-coded ID, but there is no flow for an arbitrary researcher to
log in, prove they own that ORCID, and claim attribution on
SciDEX-generated artifacts where their name appears. ORCID's public
OAuth (3-legged flow) takes ~2 hours to wire and instantly elevates
SciDEX from "anonymous AI lab" to "credentialed research surface".

Acceptance Criteria

CREATE TABLE researcher_identity (
        id UUID PRIMARY KEY,
        orcid_id TEXT NOT NULL UNIQUE,
        display_name TEXT,
        email TEXT,
        affiliations JSONB,
        primary_works JSONB,
        oauth_access_token TEXT,
        oauth_refresh_token TEXT,
        oauth_expires_at TIMESTAMP,
        last_synced_at TIMESTAMP DEFAULT NOW(),
        first_claimed_at TIMESTAMP DEFAULT NOW()
      );
      CREATE TABLE researcher_artifact_claims (
        id UUID PRIMARY KEY,
        researcher_id UUID NOT NULL REFERENCES
          researcher_identity(id),
        artifact_id TEXT NOT NULL REFERENCES artifacts(id),
        claim_kind TEXT CHECK (claim_kind IN
          ('author','contributor','reviewer','endorser')),
        evidence_url TEXT,
        verified_at TIMESTAMP,
        UNIQUE(researcher_id, artifact_id, claim_kind)
      );

GET /oauth/orcid/login redirects to ORCID auth URL with
state=<random> stored in a short-TTL oauth_state table.
GET /oauth/orcid/callback exchanges the code,
fetches /v3.0/{orcid}/record, populates
researcher_identity. Sets a session cookie tied to the
ORCID id. via ORCID, lists candidate artifacts where created_by is
empty or where the researcher's known PMIDs appear in
attributed_evidence; each row has Claim/Skip buttons. primary_works (DOIs/PMIDs from ORCID) against
attributed_evidence JSONB; auto-create
verified_at IS NULL claim rows for matches. future trust algorithm) confirms the claim. q-impact-claim-
attribution (wave-2) consumes verified claims for the
contributor leaderboard. verified claims, summary stats (total artifacts, citations
via external_citations), and a public bio synthesised
from ORCID's public record. verification, callback round-trip with a stubbed ORCID,
auto-claim DOI matcher, claim verify state machine. staging in the Work Log; show the claim page populates with
≥1 candidate.

Approach

ORCID public OAuth client registration first; record the

client_id in the env, client_secret in the existing secret
store.

Cookie-based session (no JWT churn — reuse whatever

q-integ-github-bidirectional-sync introduces if it lands
first).

Auto-claim is heuristic; it must produce candidate rows, not

final attribution. Verification gate prevents collisions with
common-name researchers.

The landing page is mostly read-only — keep it lightweight.

Dependencies

• q-impact-claim-attribution (wave-2) — consumes verified

claims.

• accumulate_rui_costa.py — pattern for ORCID DOI accumulation.

Dependents

• q-integ-zotero-library-import — same OAuth callback shape.
• q-integ-bluesky-publish-pipeline — researcher can opt

artifacts into Bluesky publication via their identity.

Work Log

2026-04-27 17:30 PT — Slot 0

• Confirmed current: origin/main is at c0a454400; worktree clean-rebased before work.
• Staleness check: researcher_identity and researcher_artifact_claims tables did not exist

in the DB — confirmed via SELECT 1 FROM researcher_identity which raised relation not found.
The task is not stale.

• Migration (migrations/137_oauth_state_researcher_identity.py): created

oauth_state, researcher_identity, researcher_identity_history, and
researcher_artifact_claims tables; applied successfully.

• OAuth handlers (api_routes/orcid_oauth.py): 3-legged ORCID OAuth with HMAC-signed

state, DB-persisted oauth_state, access token exchange, ORCID record fetch, auto-claim,
and base64 cookie session. Registered in api.py via app.include_router.

• Claim UI (/researcher/claim in api.py): lists candidate artifacts from

attributed_evidence DOI/PMID match; Claim button → POST /oauth/orcid/claims/{id}/{kind};
existing claims table below.

• Researcher landing page (/researcher/{orcid_id} in api.py): public page with

stats (total claims, verified, citations), affiliations list, verified claims table.

• Auto-claim (_auto_claim_artifacts): scans primary_works DOIs/PMIDs against

attributed_evidence JSONB via ILIKE ANY; creates unverified author claims.
Guard: returns 0 immediately if primary_works is empty.

• Tests (tests/test_orcid_oauth.py): 12 passing tests covering state signing,

login redirect to ORCID authorize, 503 when unconfigured, invalid state rejection,
empty-works auto-claim guard, 401 auth guard on claim/list/me endpoints, invalid
claim_kind rejection, logout redirect.

• Commit: cb51c783c to branch orchestra/task/65a808b6-orcid-oauth-based-researcher-claim-flow.
• Result: Done — ORCID OAuth flow implemented end-to-end; all acceptance criteria addressed.