MCP release developer guide

The MCP Worker source of truth is B:\GRIFFAI_MASTER\platform\cloudflare\saas\griffai-saas-mcp. The documentation source of truth is this site.

OAuth discovery, protected-resource metadata, token grants, revocation, and the MCP resource URL must derive from Worker configuration. mcp.griff.run is canonical. connect.griff.run is a validation-only compatibility issuer through 2026-11-09T00:00:00Z; new metadata and tokens use the canonical issuer, and missing, malformed, or expired sunset configuration disables legacy validation fail-closed.

Changes require tests for the intended behavior plus a negative or mutation control showing the test fails when the contract is broken. Do not bypass tenant authentication, entitlement reloads, revocation checks, Durable Object session ownership, or pre-handler metering reservation.

The public documentation contract is enforced by npm run test:release. Docusaurus build failures, broken internal links, or missing release artifacts block deployment.