Summary
Corrects the Official MCP Registry OCI metadata discovered during the first manual publication
attempt, without changing the MCP authorization runtime.
Changes
- removes
packages[0].versionfrom the OCI Registry package; - keeps the released version exclusively in the canonical OCI
identifier; - rejects OCI
registryBaseUrl,versionandfileSha256in project-owned validation; - advances the immutable Registry publication candidate from
v0.6.1tov0.6.2; - updates Registry regression tests and EN/PT-BR documentation;
- adds ADR 0025 documenting the Registry validation gap and corrective release decision.
The existing multi-platform scan-before-publish release boundary, OAuth/OIDC behavior, MCP protocol
semantics and OCI ownership label remain unchanged.
This release does not automate Official MCP Registry publication. The first successful publication
remains a manual P2.3 operation performed only after the v0.6.2 release is independently verified.