Choose read or setup before connecting an MCP client

[frahlg]

When an MCP client omitted scope, FTW signed a read-only offer at once. Redeeming an invitation that also allowed setup could consume it without setup rights. Let that browser first choose read/troubleshoot or read/configure, before exposing a key, offer, QR or owner code. Explicit scopes keep their current meaning and cannot widen through this choice.

The original cookie and exact issuer Origin protect the choice. Signing stays outside the database lock and uses the existing global/address budget. A conditional write saves one choice against the original phase and deadline. Lost replies, competing tabs and an approval during signing return the saved result; cancellation or expiry cannot revive a request. The roster, code lookup, request view and invitation route reject the unchosen phase.

Setup write tools now request both diagnostic reads and setup writes in their metadata and runtime OAuth challenge. A new connection can read its schema and receipt; old token rights are not inferred. Existing scopes remain in a step-up request. The rendered consent page also keeps its recovery link hidden until there is a saved result.

Stacked on sharing #38, after setup #37. This does not implement passive first-start claiming, vendor sign-in or forecast priors; those remain separate Core increments in ADR 0011. Deployment follows the common Core beta; this PR alone does not make a new box claimable.

Validation: full Cloud race tests pass after retaining the checked client address on the initial page. Controlled signer barriers cover two competing choices, cancellation/expiry, approval during a late same-choice reply and both signing budgets. Tests also cover hidden pre-choice reads, roster/code/invitation gates, explicit blank/offline/narrow scopes, original cookie/Origin, look-alike addresses and a setup write-only token. Full CI passes on head f518a8d, including vet, race tests, development-tag tests, import boundaries, fuzzing, MCP inspector and Linux builds. An independent read-only reviewer rechecked the fixes with no further findings. The actual template was rendered and inspected in a closed local browser fixture. No real home or client account was used.

Production Go growth above #38: OAuth +192 lines, MCP +10 lines; tests excluded.

Deployment: main commit c9c5be9 passed CI and deployed as sha256:0fb95dbdefd1c1f4b26a298696cf9f30992b8df35ba4e24fa5ae80a9565bd88b. Provenance names this commit and the main image workflow. Both service images and the public source headers match. The host is healthy over HTTP/1.1 and HTTP/3; all nine boxes reconnected with no drops. Statistics remain disabled. The next common Core beta is coordinated with the source-history fix; no box update was made here.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T18:07:05.242611Z	ae2b78c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.