docs: correct stale/security-relevant claims found in a full wiki audit - Security-Proof-Client-Credential-Isolation.md: the 'Client isolation matrix' still described DCR redirect-URI scope inheritance as current, safe behavior -- that was the exact #497 P0 vulnerability, fixed in #505. Corrected the table and added a note. - Home.md, Scope-and-Tool-Matrix.md, OAuth-Clients-and-Scopes.md: all three said anonymous/read access requires 'no auth at all', which is only true with OAuth disabled. Production runs with OAuth enabled, where every /mcp request without a bearer is challenged regardless of tool tier (#498, confirmed live). Added correction notes distinguishing the scope-ACL layer (genuinely ungated) from bearer-token requirement (not bearerless in production). - AgentReady-Pitfalls.md, Live-Deployment-Runbook.md: documented a second, distinct cause of the 'chtimes ... operation not permitted' build failure (#521, live-reproduced 2026-07-18) -- the MCP server's own build_site tool runs as a different system user (mcp-hugo-server-go) than the manual rebuild path these pages already documented (hugo-mcp), and can be blocked by individual files that drifted to the wrong owner even when ReadWritePaths is already correct.

jmrGrav committed Jul 18, 2026

docs: document july 13 agent-ready recovery

jmrGrav committed Jul 13, 2026

docs: add operational wiki runbooks

jmrGrav committed Jul 5, 2026