@noodleseed/agent-kit 0.48.2 → 0.49.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/manifest.json +245 -245
  2. package/package.json +1 -1
  3. package/skills/claude-code/SKILL.md +1 -1
  4. package/skills/claude-code/authoring-mcp-servers/SKILL.md +1 -1
  5. package/skills/claude-code/building-mcp-apps/SKILL.md +1 -1
  6. package/skills/claude-code/connecting-apis-to-mcp/SKILL.md +1 -1
  7. package/skills/claude-code/debugging-mcp-delivery/SKILL.md +1 -1
  8. package/skills/claude-code/deploying-mcp-services/SKILL.md +1 -1
  9. package/skills/claude-code/designing-mcp-products/SKILL.md +1 -1
  10. package/skills/claude-code/embedding-mcp-assistants/SKILL.md +1 -1
  11. package/skills/claude-code/examples/customer-auth/README.md +13 -0
  12. package/skills/claude-code/examples/customer-auth/test/server.test.ts +2 -0
  13. package/skills/claude-code/executing-noodle-plans/SKILL.md +1 -1
  14. package/skills/claude-code/publishing-mcp-integrations/SKILL.md +1 -1
  15. package/skills/claude-code/references/embedded-assistant.md +3 -1
  16. package/skills/claude-code/references/troubleshooting.md +7 -0
  17. package/skills/claude-code/reporting-noodle-feedback/SKILL.md +1 -1
  18. package/skills/claude-code/verifying-mcp-delivery/SKILL.md +1 -1
  19. package/skills/codex/SKILL.md +1 -1
  20. package/skills/codex/authoring-mcp-servers/SKILL.md +1 -1
  21. package/skills/codex/building-mcp-apps/SKILL.md +1 -1
  22. package/skills/codex/connecting-apis-to-mcp/SKILL.md +1 -1
  23. package/skills/codex/debugging-mcp-delivery/SKILL.md +1 -1
  24. package/skills/codex/deploying-mcp-services/SKILL.md +1 -1
  25. package/skills/codex/designing-mcp-products/SKILL.md +1 -1
  26. package/skills/codex/embedding-mcp-assistants/SKILL.md +1 -1
  27. package/skills/codex/examples/customer-auth/README.md +13 -0
  28. package/skills/codex/examples/customer-auth/test/server.test.ts +2 -0
  29. package/skills/codex/executing-noodle-plans/SKILL.md +1 -1
  30. package/skills/codex/publishing-mcp-integrations/SKILL.md +1 -1
  31. package/skills/codex/references/embedded-assistant.md +3 -1
  32. package/skills/codex/references/troubleshooting.md +7 -0
  33. package/skills/codex/reporting-noodle-feedback/SKILL.md +1 -1
  34. package/skills/codex/verifying-mcp-delivery/SKILL.md +1 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@noodleseed/agent-kit",
3
- "version": "0.48.2",
3
+ "version": "0.49.0",
4
4
  "private": false,
5
5
  "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
6
6
  "license": "Apache-2.0",
package/skills/claude-code/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: noodle-seed
3
3
  description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:cd6ca0d915e6acb9 -->
6
+ <!-- noodle-skill version:0.49.0 hash:cd6ca0d915e6acb9 -->
7
7
 
8
8
  # Noodle Seed
9
9
 
package/skills/claude-code/authoring-mcp-servers/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: authoring-mcp-servers
3
3
  description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:0b2fd8c7e43fc69f -->
6
+ <!-- noodle-skill version:0.49.0 hash:0b2fd8c7e43fc69f -->
7
7
 
8
8
  # authoring-mcp-servers
9
9
 
package/skills/claude-code/building-mcp-apps/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: building-mcp-apps
3
3
  description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:f7fa54992c8d7692 -->
6
+ <!-- noodle-skill version:0.49.0 hash:f7fa54992c8d7692 -->
7
7
 
8
8
  # building-mcp-apps
9
9
 
package/skills/claude-code/connecting-apis-to-mcp/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
3
3
  description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:1e86b8704f407bd3 -->
6
+ <!-- noodle-skill version:0.49.0 hash:1e86b8704f407bd3 -->
7
7
 
8
8
  # connecting-apis-to-mcp
9
9
 
package/skills/claude-code/debugging-mcp-delivery/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
3
3
  description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:aa715bae12041d7c -->
6
+ <!-- noodle-skill version:0.49.0 hash:aa715bae12041d7c -->
7
7
 
8
8
  # debugging-mcp-delivery
9
9
 
package/skills/claude-code/deploying-mcp-services/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: deploying-mcp-services
3
3
  description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:93e735b7ffb45df1 -->
6
+ <!-- noodle-skill version:0.49.0 hash:93e735b7ffb45df1 -->
7
7
 
8
8
  # deploying-mcp-services
9
9
 
package/skills/claude-code/designing-mcp-products/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: designing-mcp-products
3
3
  description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:76cce86729cffbee -->
6
+ <!-- noodle-skill version:0.49.0 hash:76cce86729cffbee -->
7
7
 
8
8
  # designing-mcp-products
9
9
 
package/skills/claude-code/embedding-mcp-assistants/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
3
3
  description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:cc54a67f21c0ecdb -->
6
+ <!-- noodle-skill version:0.49.0 hash:cc54a67f21c0ecdb -->
7
7
 
8
8
  # embedding-mcp-assistants
9
9
 
package/skills/claude-code/examples/customer-auth/README.md CHANGED
@@ -34,6 +34,19 @@ bounded read-only GET checks and never register a client. A successful
34
34
  `noodle deploy --access customers` reports the same findings as nonblocking warnings; the application team
35
35
  repairs the issuer rather than adding a Noodle OAuth proxy.
36
36
 
37
+ Adding the embedded assistant does not choose or rewrite MCP customer auth. Inspect the exact active
38
+ deployment before changing configuration:
39
+
40
+ ```sh
41
+ noodle deployments list --org <org> --app <app> --env <env> --json
42
+ ```
43
+
44
+ This Firebase bridge intentionally advertises the Noodle authorization server. A direct or federated
45
+ replacement must advertise its configured tenant issuer. If the exact active direct/federated `customers`
46
+ deployment instead advertises the platform issuer, report `customer_auth_state_inconsistent` with only the
47
+ endpoint, deployment ID, server version, and sanitized protected-resource metadata. Do not share tokens or
48
+ secrets, proxy or rewrite metadata, rotate credentials, or redeploy repeatedly to conceal the mismatch.
49
+
37
50
  During MCP OAuth login, Noodle Cloud hosts the Firebase bridge page at
38
51
  `https://cloud.noodleseed.dev/oauth/customer/firebase/authorize`. The customer app does not add an
39
52
  authorization route. The SaaS operator only configures Firebase Auth to allow the Noodle Cloud origin, and
package/skills/claude-code/examples/customer-auth/test/server.test.ts CHANGED
@@ -24,6 +24,8 @@ describe('customer-auth example', () => {
24
24
  colorScheme: 'auto',
25
25
  });
26
26
  expect(manifest.server.auth).toMatchObject({
27
+ kind: 'bridge',
28
+ provider: 'firebase',
27
29
  projectId: '${env.FIREBASE_PROJECT_ID}',
28
30
  apiKey: '${env.FIREBASE_WEB_API_KEY}',
29
31
  authDomain: '${env.FIREBASE_AUTH_DOMAIN}',
package/skills/claude-code/executing-noodle-plans/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: executing-noodle-plans
3
3
  description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:6a9f132ddb79352e -->
6
+ <!-- noodle-skill version:0.49.0 hash:6a9f132ddb79352e -->
7
7
 
8
8
  # Execute a Noodle Seed implementation plan
9
9
 
package/skills/claude-code/publishing-mcp-integrations/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
3
3
  description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:efffbf82007f935d -->
6
+ <!-- noodle-skill version:0.49.0 hash:efffbf82007f935d -->
7
7
 
8
8
  # publishing-mcp-integrations
9
9
 
package/skills/claude-code/references/embedded-assistant.md CHANGED
@@ -110,7 +110,9 @@ Do not put these model values in the embedding SaaS environment. A production de
110
110
 
111
111
  ## Access modes and customer auth
112
112
 
113
- Session exchange authenticates with the backend client credentials, so the embed works under any `--access` mode. Add `--access customers` only when verified end customers should also call the MCP endpoint directly. That mode requires `server.auth`; `noodle deploy` preflights the rule locally and fails with `server_auth_required` before contacting the service. Fix by adding auth to server options:
113
+ Session exchange authenticates with the backend client credentials, so the embed works under any `--access` mode. The assistant does not select direct MCP access or protected-resource discovery. If protected-resource metadata advertises an unexpected issuer, inspect the exact active deployment before changing auth by following `references/troubleshooting.md`.
114
+
115
+ Add `--access customers` only when verified end customers should also call the MCP endpoint directly. That mode requires `server.auth`; `noodle deploy` preflights the rule locally and fails with `server_auth_required` before contacting the service. Fix by adding auth to server options:
114
116
 
115
117
  ```ts
116
118
  auth: customerAuth.federatedOidc({
package/skills/claude-code/references/troubleshooting.md CHANGED
@@ -3,6 +3,7 @@
3
3
  ## Contents
4
4
 
5
5
  - First moves
6
+ - Customer-auth metadata
6
7
  - Symptom map
7
8
 
8
9
  ## First moves
@@ -11,6 +12,12 @@ Re-run the local gates before debugging in-host: `noodle validate`, `noodle chec
11
12
 
12
13
  For protocol/conformance checks, the headless harness is `@mcpjam/cli`, not a `noodle` subcommand. Use it against a local `noodle dev` URL without an access token, or against hosted URLs through the host/OAuth flow printed by `noodle connect`.
13
14
 
15
+ ## Customer-auth metadata
16
+
17
+ Adding `embeddedAssistant(...)` does not select the MCP access mode or authorization server. Before changing auth, inspect the exact active deployment with `noodle deployments list --org <org> --app <app> --env <env> --json` and match its active deployment ID, server version, and access mode to the endpoint being tested.
18
+
19
+ For `customers` access, Direct or federated customer auth must advertise the configured tenant issuer; a managed Noodle bridge must advertise the Noodle authorization server. Owner-only access advertises the platform authorization server. If a direct or federated `customers` deployment still advertises the platform issuer, treat it as `customer_auth_state_inconsistent` and escalate with the endpoint, active deployment ID, and sanitized protected-resource metadata. Do not proxy, rewrite, rotate, or redeploy to hide the mismatch. Never share bearer tokens, refresh tokens, client secrets, or credential files.
20
+
14
21
  ## Symptom map
15
22
 
16
23
  | Symptom | Likely cause | Fix |
package/skills/claude-code/reporting-noodle-feedback/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
3
3
  description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:0f404109f4845683 -->
6
+ <!-- noodle-skill version:0.49.0 hash:0f404109f4845683 -->
7
7
 
8
8
  # reporting-noodle-feedback
9
9
 
package/skills/claude-code/verifying-mcp-delivery/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
3
3
  description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:6ef6ef551e26b78e -->
6
+ <!-- noodle-skill version:0.49.0 hash:6ef6ef551e26b78e -->
7
7
 
8
8
  # verifying-mcp-delivery
9
9
 
package/skills/codex/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: noodle-seed
3
3
  description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:cd6ca0d915e6acb9 -->
6
+ <!-- noodle-skill version:0.49.0 hash:cd6ca0d915e6acb9 -->
7
7
 
8
8
  # Noodle Seed
9
9
 
package/skills/codex/authoring-mcp-servers/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: authoring-mcp-servers
3
3
  description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:0b2fd8c7e43fc69f -->
6
+ <!-- noodle-skill version:0.49.0 hash:0b2fd8c7e43fc69f -->
7
7
 
8
8
  # authoring-mcp-servers
9
9
 
package/skills/codex/building-mcp-apps/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: building-mcp-apps
3
3
  description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:f7fa54992c8d7692 -->
6
+ <!-- noodle-skill version:0.49.0 hash:f7fa54992c8d7692 -->
7
7
 
8
8
  # building-mcp-apps
9
9
 
package/skills/codex/connecting-apis-to-mcp/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
3
3
  description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:1e86b8704f407bd3 -->
6
+ <!-- noodle-skill version:0.49.0 hash:1e86b8704f407bd3 -->
7
7
 
8
8
  # connecting-apis-to-mcp
9
9
 
package/skills/codex/debugging-mcp-delivery/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
3
3
  description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:aa715bae12041d7c -->
6
+ <!-- noodle-skill version:0.49.0 hash:aa715bae12041d7c -->
7
7
 
8
8
  # debugging-mcp-delivery
9
9
 
package/skills/codex/deploying-mcp-services/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: deploying-mcp-services
3
3
  description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:93e735b7ffb45df1 -->
6
+ <!-- noodle-skill version:0.49.0 hash:93e735b7ffb45df1 -->
7
7
 
8
8
  # deploying-mcp-services
9
9
 
package/skills/codex/designing-mcp-products/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: designing-mcp-products
3
3
  description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:76cce86729cffbee -->
6
+ <!-- noodle-skill version:0.49.0 hash:76cce86729cffbee -->
7
7
 
8
8
  # designing-mcp-products
9
9
 
package/skills/codex/embedding-mcp-assistants/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
3
3
  description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:cc54a67f21c0ecdb -->
6
+ <!-- noodle-skill version:0.49.0 hash:cc54a67f21c0ecdb -->
7
7
 
8
8
  # embedding-mcp-assistants
9
9
 
package/skills/codex/examples/customer-auth/README.md CHANGED
@@ -34,6 +34,19 @@ bounded read-only GET checks and never register a client. A successful
34
34
  `noodle deploy --access customers` reports the same findings as nonblocking warnings; the application team
35
35
  repairs the issuer rather than adding a Noodle OAuth proxy.
36
36
 
37
+ Adding the embedded assistant does not choose or rewrite MCP customer auth. Inspect the exact active
38
+ deployment before changing configuration:
39
+
40
+ ```sh
41
+ noodle deployments list --org <org> --app <app> --env <env> --json
42
+ ```
43
+
44
+ This Firebase bridge intentionally advertises the Noodle authorization server. A direct or federated
45
+ replacement must advertise its configured tenant issuer. If the exact active direct/federated `customers`
46
+ deployment instead advertises the platform issuer, report `customer_auth_state_inconsistent` with only the
47
+ endpoint, deployment ID, server version, and sanitized protected-resource metadata. Do not share tokens or
48
+ secrets, proxy or rewrite metadata, rotate credentials, or redeploy repeatedly to conceal the mismatch.
49
+
37
50
  During MCP OAuth login, Noodle Cloud hosts the Firebase bridge page at
38
51
  `https://cloud.noodleseed.dev/oauth/customer/firebase/authorize`. The customer app does not add an
39
52
  authorization route. The SaaS operator only configures Firebase Auth to allow the Noodle Cloud origin, and
package/skills/codex/examples/customer-auth/test/server.test.ts CHANGED
@@ -24,6 +24,8 @@ describe('customer-auth example', () => {
24
24
  colorScheme: 'auto',
25
25
  });
26
26
  expect(manifest.server.auth).toMatchObject({
27
+ kind: 'bridge',
28
+ provider: 'firebase',
27
29
  projectId: '${env.FIREBASE_PROJECT_ID}',
28
30
  apiKey: '${env.FIREBASE_WEB_API_KEY}',
29
31
  authDomain: '${env.FIREBASE_AUTH_DOMAIN}',
package/skills/codex/executing-noodle-plans/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: executing-noodle-plans
3
3
  description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:6a9f132ddb79352e -->
6
+ <!-- noodle-skill version:0.49.0 hash:6a9f132ddb79352e -->
7
7
 
8
8
  # Execute a Noodle Seed implementation plan
9
9
 
package/skills/codex/publishing-mcp-integrations/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
3
3
  description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:efffbf82007f935d -->
6
+ <!-- noodle-skill version:0.49.0 hash:efffbf82007f935d -->
7
7
 
8
8
  # publishing-mcp-integrations
9
9
 
package/skills/codex/references/embedded-assistant.md CHANGED
@@ -110,7 +110,9 @@ Do not put these model values in the embedding SaaS environment. A production de
110
110
 
111
111
  ## Access modes and customer auth
112
112
 
113
- Session exchange authenticates with the backend client credentials, so the embed works under any `--access` mode. Add `--access customers` only when verified end customers should also call the MCP endpoint directly. That mode requires `server.auth`; `noodle deploy` preflights the rule locally and fails with `server_auth_required` before contacting the service. Fix by adding auth to server options:
113
+ Session exchange authenticates with the backend client credentials, so the embed works under any `--access` mode. The assistant does not select direct MCP access or protected-resource discovery. If protected-resource metadata advertises an unexpected issuer, inspect the exact active deployment before changing auth by following `references/troubleshooting.md`.
114
+
115
+ Add `--access customers` only when verified end customers should also call the MCP endpoint directly. That mode requires `server.auth`; `noodle deploy` preflights the rule locally and fails with `server_auth_required` before contacting the service. Fix by adding auth to server options:
114
116
 
115
117
  ```ts
116
118
  auth: customerAuth.federatedOidc({
package/skills/codex/references/troubleshooting.md CHANGED
@@ -3,6 +3,7 @@
3
3
  ## Contents
4
4
 
5
5
  - First moves
6
+ - Customer-auth metadata
6
7
  - Symptom map
7
8
 
8
9
  ## First moves
@@ -11,6 +12,12 @@ Re-run the local gates before debugging in-host: `noodle validate`, `noodle chec
11
12
 
12
13
  For protocol/conformance checks, the headless harness is `@mcpjam/cli`, not a `noodle` subcommand. Use it against a local `noodle dev` URL without an access token, or against hosted URLs through the host/OAuth flow printed by `noodle connect`.
13
14
 
15
+ ## Customer-auth metadata
16
+
17
+ Adding `embeddedAssistant(...)` does not select the MCP access mode or authorization server. Before changing auth, inspect the exact active deployment with `noodle deployments list --org <org> --app <app> --env <env> --json` and match its active deployment ID, server version, and access mode to the endpoint being tested.
18
+
19
+ For `customers` access, Direct or federated customer auth must advertise the configured tenant issuer; a managed Noodle bridge must advertise the Noodle authorization server. Owner-only access advertises the platform authorization server. If a direct or federated `customers` deployment still advertises the platform issuer, treat it as `customer_auth_state_inconsistent` and escalate with the endpoint, active deployment ID, and sanitized protected-resource metadata. Do not proxy, rewrite, rotate, or redeploy to hide the mismatch. Never share bearer tokens, refresh tokens, client secrets, or credential files.
20
+
14
21
  ## Symptom map
15
22
 
16
23
  | Symptom | Likely cause | Fix |
package/skills/codex/reporting-noodle-feedback/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
3
3
  description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:0f404109f4845683 -->
6
+ <!-- noodle-skill version:0.49.0 hash:0f404109f4845683 -->
7
7
 
8
8
  # reporting-noodle-feedback
9
9
 
package/skills/codex/verifying-mcp-delivery/SKILL.md CHANGED
@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
3
3
  description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
4
4
  ---
5
5
 
6
- <!-- noodle-skill version:0.48.2 hash:6ef6ef551e26b78e -->
6
+ <!-- noodle-skill version:0.49.0 hash:6ef6ef551e26b78e -->
7
7
 
8
8
  # verifying-mcp-delivery
9
9