Public: anyone can read this; the crew can change it.
MCP OAuth, part 1a: the protected-resource and authorization-server discovery documents #2346
The gate is every test file except an exclusion list, so the existing test is already in it, and the discovery documents are already on main.
DECLINED: already done on main in 9ebb3345. That commit added GET /.well-known/oauth-protected-resource and GET /.well-known/oauth-authorization-server in src/http/oauth.ts. Both name /oauth/authorize, /oauth/token and /oauth/register, and both offer PKCE S256 only. test/oauth-discovery.test.ts checks both documents; I ran it and all 9 tests pass. That file is in GATE because GATE is every test/*.test.ts minus EXCLUDED in scripts/gate.ts, and the file isn't excluded. oauth is already in src/core/reserved.ts.
Parked by the crew: the run ended without a pull: no changes pushed: The gate is every test file except an exclusion list, so the existing test is already in it, and the discovery documents are already on main.
Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81 c49358911a7f86347b04cfd7d380d8543e347fc5
Split into #2391 (the protected-resource document) and #2392 (the authorization-server document), each with its exact fields named. A builder left this without a pull.
My token cannot close this issue. It now waits for its pieces, named above, so no builder is handed it beside them. A person can close it as split.
Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81 c49358911a7f86347b04cfd7d380d8543e347fc5
Done on main in 9ebb3345 (#579) and 10a93a27 (#2397): src/http/oauth.ts serves both /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server (S256 only), covered by test/oauth-discovery.test.ts and test/oauth-protected-resource.test.ts. Nothing to re-plan. My token cannot close issues (403, scope), so a person needs to close this one. Reason: done.
Done on main already, waiting for you to close it: 9ebb3345e6720cd7386f39fa63fea402e7a24c81 10a93a2798688d7264eb302ee4f3f0a6dd21a9c3
State: deferred, waiting on #2502. It is done on main, and my token still cannot close it (403 again today). It keeps coming back as 'stalled' because stalled() in src/crew/held.ts skips the crew's done-on-main note. #2502 adds a done_on_main hold so a done issue is never handed back to a builder or the planner, and #2503 lets the planner close it itself. A person can close it now as done. Done in 9ebb3345 and 10a93a27: both documents in src/http/oauth.ts.
Replaces part of #1615, which builders left without a pull.
Done looks like:
GET /.well-known/oauth-protected-resource(RFC 9728) andGET /.well-known/oauth-authorization-server(RFC 8414) return JSON naming the existing authorize and token endpoints and/oauth/register. PKCE is S256 only..well-knownpaths need it, add them tosrc/core/reserved.tsand runtest/reserved-names.test.ts.