Parent auth — DECIDED 2026-10-13 (#337)

Guest browse OK. Google OAuth required for parents who create cases / manage Account / buy / review. Guest case-submit is not the long-term path. #281 enforces this.

Epic: Account owns the card

Build order

1. P1 — When an account is required (Google for case create; guest browse) #281 P1 — When an account is required
2. # Issue P2 — Google account owns the profile #282 P2 — Google account owns the profile
3. # Issue P3 — Tutor edits the card #283 P3 — Tutor edits the card
4. Issue P5 — Capacity and time, free to change #285 P5 — Capacity and time
5. Issue P6 — Account page, Carousell order #286 P6 — Account page layout
6. # Issue P4 — Verified edits need evidence #284 P4 — Verified edits need evidence (after verification exists)
7. Issue P7 — Both sides review after a lesson #287 P7 — Both-sides review (after Reviews and the notification bus #205)
8. Notes: Issue P8 — Note draft, then publish #288/Issue P9 — Edit a live note #289/Issue P13 — Bought notes #293 closed (draft/publish/bought)
9. Issue P10 — Saved tab #290 P10 — Saved tab · Issue P12 — Bell, on the #205 bus #292 P12 — Bell on Reviews and the notification bus #205 bus · Issue P14 — Report on the card, the note, and the shop #294 P14 — Report

Browse needs no account. A product action does.
Google sign-in happens before a form, so a draft has an owner.
A centre page later uses this layout. Do not build it here.

Related (not children)

• Join / go-live / badge: Join with no evidence. One badge from approved grades. #309, Go live on submit #310
• Preview sandbox: Preview as Parent sandbox (OAuth owned by #280) #104 (OAuth itself is this epic)
• Case board apply: Tutor case board + apply-to-staff (parent Google per #337; guest submit not primary) #81 (reconciled)
• Post-signup checklist: Post-signup checklist on Account (no follow graph) #141
• Freestyle shop: Epic: Freestyle micro-services / gig marketplace (extends notes shop) #325 (separate)

Gap

• P11 was never filed (number gap after P10). If something was intended (e.g. parent account blocks, or delete account), file it as a new issue rather than inventing a silent P11.

Acceptance

• Eng schedules P1→P3→P5→P6 before P4/P7.
• No second Google OAuth implementation under Preview as Parent sandbox (OAuth owned by #280) #104.
• Parent case-create path follows [DECIDED] Parent auth: Google for case/account; guest browse OK (#280/#281) #337 (Google-first); no guest-primary funnel