Buyer gap
LineageWeave MCP clients need a supported non-password credential path without creating a second application-owned identity, issuance, revocation, and audit system.
Product boundary
Keyverse remains the authorization server and identity authority. LineageWeave remains an OAuth protected resource and accepts only resource-bound access tokens issued by Keyverse. Do not add LineageWeave-managed long-lived bearer keys.
Acceptance criteria
- Publish and test OAuth authorization-server metadata and OIDC discovery for MCP clients.
- Support a public-client authorization-code flow with PKCE and exact redirect URI validation.
- Support MCP client registration through a reviewed standards-compatible mechanism when required by clients.
- Issue access tokens bound to the exact LineageWeave MCP resource indicator and requested least-privilege scopes.
- Preserve centralized revocation, deprovisioning, audit, and account policy in Keyverse.
- Evaluate RFC 8628 device authorization only for clients that cannot complete a browser callback; do not implement it speculatively.
- Add real browser/client integration evidence and negative tests for wrong issuer, audience, scope, redirect URI, expired token, and revoked account.
- Add an ADR and doctoring references in APA 7th style before implementation.
Standards basis
- Model Context Protocol. (2025). Authorization. https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization
- Lodderstedt, T., Bradley, J., Labunets, A., & Fett, D. (2025). Best current practice for OAuth 2.0 security (RFC 9700). RFC Editor. https://www.rfc-editor.org/rfc/rfc9700
- Campbell, B., Bradley, J., Sakimura, N., & Lodderstedt, T. (2018). Resource indicators for OAuth 2.0 (RFC 8707). RFC Editor. https://www.rfc-editor.org/rfc/rfc8707
- Hunt, P., Richer, J., Mills, W., Mishra, P., & Philpott, W. (2025). OAuth 2.0 protected resource metadata (RFC 9728). RFC Editor. https://www.rfc-editor.org/rfc/rfc9728
- Denniss, W., Bradley, J., Jones, M., & Parecki, A. (2019). OAuth 2.0 device authorization grant (RFC 8628). RFC Editor. https://www.rfc-editor.org/rfc/rfc8628
LineageWeave linkage
This replaces the architectural direction attempted by LineageWeave PRs #333 and #334. ADR 0109 already rejects a static MCP API key because it creates a second identity and revocation system.
Buyer gap
LineageWeave MCP clients need a supported non-password credential path without creating a second application-owned identity, issuance, revocation, and audit system.
Product boundary
Keyverse remains the authorization server and identity authority. LineageWeave remains an OAuth protected resource and accepts only resource-bound access tokens issued by Keyverse. Do not add LineageWeave-managed long-lived bearer keys.
Acceptance criteria
Standards basis
LineageWeave linkage
This replaces the architectural direction attempted by LineageWeave PRs #333 and #334. ADR 0109 already rejects a static MCP API key because it creates a second identity and revocation system.