Configure the Cognito-backed MCP facade

Required configuration

1. Use issuer https://tidyboard.org and resource https://tidyboard.org/mcp.
2. Create one no-secret PKCE Cognito client named tidyboard-mcp-facade with callback https://tidyboard.org/oauth/callback and upstream scopes openid email profile.
3. Provision separate Ed25519 signing and AES-256-GCM encryption SSM keys and trust only official ChatGPT/Claude CIMD hosts.

Tidyboard server contract

Authorization-server metadata must publish S256, token_endpoint_auth_method none, client_id_metadata_document_supported, and no registration_endpoint. Protected-resource metadata must name only https://tidyboard.org as the authorization server.

Facade access tokens use issuer https://tidyboard.org and audience https://tidyboard.org/mcp. Refresh tokens rotate; revocation invalidates the complete facade grant immediately.

Stage the tidyboard-mcp-facade rollout

1. Create/import only tidyboard-mcp-facade with https://tidyboard.org/oauth/callback; preserve direct MCP resources.
2. Deploy, run rollout dry-run then apply, and require runtime verification of health, facade metadata, and every JWKS key.
3. Smoke ChatGPT and Claude hosted/loopback: read, finance/recovery step-up, preview, refresh, revoke, reconnect, wrong scope, and wrong household.
4. After both pass, review the separate final plan removing unused direct MCP resources.

Validate discovery

1. Open /.well-known/oauth-protected-resource and confirm the exact resource, Tidyboard issuer, and 25 scopes.
2. Open /.well-known/oauth-authorization-server and confirm S256, CIMD support, public token exchange, canonical endpoints, and no registration endpoint.
3. Open /oauth/jwks.json and confirm every key is a complete public OKP Ed25519 EdDSA signing key with no private material.
4. Connect each supported platform using only https://tidyboard.org/mcp and verify Auth launches automatically.