Deploy a throwaway remote MCP host/auth feasibility slice

Outcome

A minimal public slice proves the real user-facing host path before product architecture depends on it.

Scope

• Serve protected-resource and authorization-server discovery over public HTTPS.
• Prove one scoped read and one scoped mutation with normalized principal context.
• Exercise login, consent, revocation, and a short-lived mobile browser link.
• Keep the slice throwaway: no product state machine or demo choreography.

Acceptance

• The target host connects to the deployed MCP URL from a cold account.
• Google login reaches Farewright through a candidate authorization-server profile.
• Read and mutation scopes are enforced and revocation blocks a later call.
• The mobile browser link completes on the intended device/session.
• Observed product, plan, version, URLs, and limitations are recorded without secrets.

Dependencies

• External setup issue complete enough to supply candidate credentials.
• GitHub foundation issue complete enough for a reviewed spike PR.

Review

Security-sensitive spike evidence must be reviewed by a model session that did not implement it.

No files or tests are named; start with the deployed MCP URL and candidate authorization-server profile after the external setup and GitHub foundation dependencies are ready. Exercise the listed login, scoped read and mutation, revocation, and mobile-link acceptance cases, then record the observed product, plan, version, URLs, and limitations without secrets.