diff --git a/.planning/phases/19.7-generic-mcp-module/COVERAGE.md b/.planning/phases/19.7-generic-mcp-module/COVERAGE.md index 7deb69ae..323c4ca8 100644 --- a/.planning/phases/19.7-generic-mcp-module/COVERAGE.md +++ b/.planning/phases/19.7-generic-mcp-module/COVERAGE.md @@ -14,7 +14,7 @@ Phase 19.7 calls no third-party service at runtime. It implements an MCP server | transport: stream resumability (`Last-Event-ID`, event store) | OPT-OUT | tool calls are short HTTP route dispatches; a dropped stream is retried by the client | | authorization: protected resource metadata (RFC 9728) | INTEGRATE | `prm.go`, through the SDK's `auth.ProtectedResourceMetadataHandler` | | authorization: 401 with `WWW-Authenticate` (resource metadata, scope) | INTEGRATE | `pier.go`; scope hint `read` added when absent | -| authorization: bearer access-token verification (MCP grants, member `usr_` tokens) | INTEGRATE | D-20 to D-23; revocation ends or narrows sessions (D-27) | +| authorization: bearer token verification (MCP grants, member `usr_` tokens) | INTEGRATE | D-20 to D-23; revocation ends or narrows sessions (D-27) | | authorization: `read`/`write` ceiling and separate `backend` scope | INTEGRATE | D-20, D-21; permissions always filter on top | | lifecycle: initialize, initialized, ping | INTEGRATE | SDK; `InitializedHandler` arms the session | | server info: name and version | INTEGRATE | application name and the framework module version |