docs: fix stale 2-tier scope claims, Release-Checklist command drift (v1.9.2 freshness pass)
Cross-checked every wiki page against current main (through #1209) and
docs/tools.md, docs/mcp-contract.md, docs/operator-guide.md. Found and
fixed real drift, not just cosmetic staleness:
- Client-Compatibility.md, Smoke-Tests-and-Live-Verification.md: both
claimed "write scope sees the full write/build/admin tool set" — the
admin tier (#1039/#1050) narrowed that; write no longer includes the
four managed Hugo lifecycle tools. Fixed both, matching the model
OAuth-Clients-and-Scopes.md and Pitfall-Anonymous-vs-Authenticated-Server.md
already correctly describe.
- Managed-Hugo-Upgrades.md: said "all five [Hugo upgrade] tools require
a write bearer" — verified against internal/tools/admin/image.go's
Defs(): only get_hugo_update requires write; the other four require
admin. This was a real security-relevant inaccuracy, not just stale
wording.
- Installation-Guide.md: scope table still said "read/write scopes",
missing admin.
- Documentation-Source-of-Truth.md: self-contradicted — described the
current 3-scope model, then immediately said "do not reintroduce a
third canonical scope," leftover text from before #1039/#1050 shipped
the admin tier it was warning against. Reworded to be accurate and
forward-looking (warn against a fourth scope instead).
- Release-Checklist.md: explicitly claims "docs/release-checklist.md
remains the source of truth for the exact command list" and then
presented its own diverged copy (had a standalone `gofmt -w` step the
repo doc doesn't have; missing check-readme-release/check-agent-ready.sh
the repo doc does have). Synced to match, noted gofmt is CI-enforced
rather than a manual step, and added a note about the new v1.9.2
diff-coverage gate (#1207).
- Pitfall-Claude-auth_callback-vs-oauth_callback.md: added a
terminology note on its historical `scope: site.admin` example
(still valid as a compatibility alias, but now resolves to the
narrower `admin` tier, not `write`) — same pattern the sibling
invalid-scope-disguised-as-302 pitfall page already uses.
- Pitfall-openid-configuration-404.md: added a "reconfirmed live
2026-08-20" note — re-observed the same 404-then-success pattern in
production logs today while diagnosing an unrelated ChatGPT connector
issue; still expected, still no fix needed.
Read every other page (Home, AgentReady-Pitfalls, Live-Deployment-Runbook,
Discovery-and-RFC-Map, Webhook-Plugins-Configuration, Security-Redaction-Checklist,
Pitfalls-Index, Scope-and-Tool-Matrix, remaining Pitfall-* pages,
Client-Compatibility, OAuth-Clients-and-Scopes) — all already current
against v1.9.2 main, no changes needed. Config field names
(cloudflare/indexnow/google_indexing) spot-checked directly against
internal/config/config.go and match exactly. docs/tools.md and
docs/mcp-contract.md already document the three chunked-upload tools
from #1204/#1205 — repo docs were already in sync.
Refresh Installation Guide / Home / Release Checklist post-submission
.mcpb was described as 'planned, not yet published' — no longer true:
it's built and attached automatically to every GitHub release
(.mcpbignore keeps it correctly scoped), and the Directory listing has
been submitted for review (Phase 5, #782). Updated Installation Guide's
comparison table and Option C section, Home.md's intro to surface the
local/npm/mcpb distribution channel exists at all (previously only
described the shared OAuth deployment), and Release Checklist with a new
section on the npm/GitHub Packages/mcpb release steps that didn't exist
when that page was last written.
Add Installation Guide: remote HTTP+OAuth vs local stdio/npx
Covers both transport modes end to end, per #782: the existing
arleo.eu-style HTTP+OAuth deployment (linking Live Deployment Runbook /
OAuth Clients and Scopes for the full pipeline) and the new stdio
transport via npx/npm/direct binary/planned .mcpb, including the
MCP_HUGO_* env var config path MCPB-style hosts need. Linked from Home.md.