- scan /etc/secrets for memos-idp-*.json after migrations and demo seeding - reconcile protobuf JSON identity providers by stable UID - validate all discovered providers before applying updates