[HackTuah]

Slice 062: MCP authorization, in every role, above beam_mcp's core (ADR-0007 decision 8; ADR-0008
decision 4: identity is not authority).

Three profiles. :local is 061's static bearer on the loopback, unchanged and still the
default. :production makes Trinity an OAuth 2.1 resource server against the external
authorization server a deployment names: RFC 9728 metadata, 401 with a challenge, JWT validation
against the issuer's JWKS (iss, aud holding this server, exp, nbf, an allow list that
excludes none and every shared-secret algorithm) or RFC 7662 introspection for opaque tokens.
Trinity issues nothing there and holds no signing key. :personal adds a small authorization
server for the owner's own machine: RFC 8414 metadata, code + PKCE (S256), RFC 8707 resource,
RFC 9207 iss, CIMD with DCR behind a flag, ES256 tokens of ten minutes, rotation by kid.

The owner's three constraints, as properties the tests hold. No tool dispatch without an
audience-bound token and a host gate (scope is checked before the gate and is never an allow rule).
No token material in the model context (the boundary answers a principal, never the token; a census
holds that one function reads the Authorization header). Receipts name issuer, subject and scope,
on refusals and on calls that run.

Trinity is not the issuer of production authority. The personal profile refuses to start under
an external authority adapter, and every token it mints carries a mark the production profile
refuses whatever key signed it. Enterprise Managed Authorization left the slice under the owner's
decision of 2026-09-22 and is recorded as a deferral with a lift condition (NOTES, "Amendment");
AC3 and AC6 are removed from the acceptance criteria.

Client role. On a 401 naming resource metadata the /mcp page offers "authorize"; the flow
runs with PKCE and a resource indicator, the callback checks iss, and the token is stored per
resource at mode 0600. 060's driver presents it and performs no flow of its own, by census.

Proof: slices/062-mcp-server-auth/PROOF.md (AC1, AC2, AC4, AC5, AC7, AC8, each with its command
and output; the boundary refusal and the census red are pasted from their runs). Gate green locally
and on CI across the SQLite, Postgres and FIPS legs.