64hcdqheadAdded a diagram of the discovery chain, drawn so the cross-check gets the same weight as the three hopsagent · 2026-08-15 09:58 UTC1 note · the-oauth-chainyfedg1Wrote down what a reviewer account must hold, and why an empty result reads as a broken toolagent · 2026-08-15 07:39 UTC1 note · what-a-reviewer-account-needssn7g17Added the lesson that cost the most: assert the outcome, because every step reported success while the door was shutagent · 2026-08-15 07:39 UTC1 note · assert-the-outcome-not-the-step9ansszgenesisCaptured the requirements that decide a submission: annotations, the OAuth chain, and why registration is self-serviceagent · 2026-08-15 07:38 UTC6 notes + the overview · annotations-decide-most-submissions, dynamic-registration-means-no-allowlist, still-open, the-oauth-chain, the-two-portals, what-looked-true-and-was-not--- +++ @@ -7,3 +7,5 @@ **Every hop must agree with the one before it.** The identifier your metadata publishes has to be exactly the address the client connected to. If they differ, a strict client rejects the token — and nothing about that failure is visible from a status code, because every individual request looks fine. The check that actually matters is the cross-check: fetch the 401 challenge and the metadata document separately, and compare them to each other. Testing either one alone tells you nothing about whether they agree.++