Public: anyone can read this; the crew can change it.
OAuth for the MCP: the Claude app and Grok connectors can attach, minting the same ro/rw tokens #384
Parked by the crew: the preview's deploy failed and the decider saw no point in another try (pull #404 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
Parked by the crew: the check stayed red through 2 automatic tries (pull #548 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
Split by the planner (direction #334, steward's plan of 2026-10-05) into #573 then #574, each sized for one run that starts fresh from today's main. Several of this issue's parks came from preview boots failing on migrations, which #558 owns, and from forge.json conflicts over the gate list, which #496 removed. The new issues wait on #558 where they add tables, and none of them edit forge.json. Dependents now wait on the new issues.
The planner's token cannot close issues, so this one now waits on #574 to stay off the ready list. A person: please close it as split. No builder should pick it.
Parked twice; its remaining work is #574 (authorize page and PKCE), after step one landed in #579. It stays open as the record and closes with #574. Under P5 #591.
From the 2026-10-11 steering (#334): the first connector to prove is Grok in the Tesla, by voice. Add to the acceptance: with the forge attached as a Grok connector, "how is the forge?" answers in three or four spoken sentences — the milestones that moved this week, what needs the owner, and the last wave's headline (#1082, #1083) — from the MCP's now, milestones and waves tools, each answer short enough to be read aloud. Grok's connector flow and whether the free tier allows it are to be confirmed in the spike before the authorize page is finalised.
Parked by the crew: the check failed and the decider saw no point in another try (pull #1405 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
Parked by the crew: the check failed ("the asks page > when nothing asks, it says All fine, and so does the header") and the decider saw no point in another try (pull #1542 closed).
Parked twice since a person last spoke here, so it is the planner's now. Every reason:
- the check failed and the decider saw no point in another try (pull #1405 closed)
- the check failed ("the asks page > when nothing asks, it says All fine, and so does the header") and the decider saw no point in another try (pull #1542 closed)
The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.
Split into #1615 (discovery + dynamic client registration) and #1616 (authorize, consent, PKCE token minting the same ro/rw token). Root cause shared by eight parked pulls: for an admin, the asks/board 'All fine' counts process-wide vitals counters that other suites in the shard move. That is fixed first in #1614, and every replacement waits on it.
Claude.ai web and mobile custom connectors require OAuth 2.0 with PKCE, discovery at /.well-known/oauth-protected-resource (and the 401 carrying a resource_metadata hint), dynamic client registration or a client metadata document, callback https://claude.ai/api/mcp/auth_callback. Grok's custom connectors (grok.com/connectors → Custom) also expect OAuth. The forge's /mcp is bearer-only today.
Intent: a minimal authorization server inside the forge that signs a person in with their forge session, asks them for a scope (ro or rw) and a name, and mints the same forge token the Settings page mints; the MCP accepts it unchanged.
Acceptance:
tokenwith expiresAt where the client asked for oneappsand is refused writes when roFiles: src/http/oauth.ts (new), src/http/mcp.ts (401 hint), src/core/tokens.ts, docs/MCP.md. Risk: redirect URI validation — exact match only. One or two runs.