Remote MCP OAuth and Atomic Knowledge Tools Pass Production Acceptance
End-to-end production acceptance on the live domain has passed: OAuth Allow exposed exactly 9 tools and 4 public capabilities, followed by atomic publish, same-payload replay, management reads, CAS update, zh/en/ja public readback, confirmed delete, post-delete 404, token revocation, and temporary-data cleanup. File pu
# Remote MCP OAuth and Atomic Knowledge Tools Pass Production Acceptance
The owner remote MCP has completed end-to-end acceptance on the live domain while continuing to reuse the verified article-service boundaries.
## Completed production acceptance
- OAuth Allow after owner sign-in returned successfully to the local AI client, with authorization code, PKCE S256, exact resource, and minimum scopes enforced.
- MCP `tools/list` returned exactly 9 tools: `site_capabilities`, `article_list`, `article_search`, `article_get`, `article_manage_list`, `article_manage_get`, `article_publish`, `article_update`, and `article_delete`; the public capability list contained exactly 4 entries.
- `article_publish` completed one atomic publication and safely replayed the same canonical payload under the same operationId; `article_manage_list` and `article_manage_get` then read back the management data.
- `article_update` passed its `expectedUpdatedAt` CAS update, and the public API read the updated body back in zh, en, and ja.
- `article_delete` completed with CAS and explicit `confirm: true`; every zh/en/ja public read then returned 404.
- The grant was revoked after acceptance, and the temporary client, grant, test article, and receipts were cleaned without retaining test data.
## Security boundary and remaining scope
`content:read`, `content:write`, and `content:delete` remain separately authorized. Every management call rechecks the grant, scopes, and current administrator role. `article_publish_files` remains a local stdio MCP allow-root tool; it is not exposed remotely, and local paths are never sent to the site. The remote endpoint now covers public content reads and atomic owner knowledge management, but remote takeover of the remaining site tools and games is not complete, so this release does not claim that AI can control the whole site or every game.
