[Madraka]

What

RFC-0044, "Remote MCP authorization: OAuth 2.1 for Cloudhal deployments", for #144. Documentation only: no runtime code, no tests run.

The RFC decides, with alternatives: RFC 9728 resource metadata and the WWW-Authenticate challenge on /mcp (plus the 403 insufficient_scope step-up); Better Auth's mcp() + jwt() + cimd() plugins as the authorization server on the same database (issuer <origin>/api/auth, JWT access tokens verified locally against the jwks table plus one agent_grants row read for mode, elevation and immediate revocation); CIMD first with rate-limited, pruned DCR as the fallback (switchable); a Studio consent screen and "Connected agents" section; token → Principal so the policy engine, audit log, approvals, modes and elevations are unchanged and agent keys keep working; threat model; migration 0030_oauth and the Better Auth 1.7.12 → 1.7.18 family bump; test plan on sqlite + Miniflare D1 and an e2e test with the MCP client's OAuthClientProvider; three rollout phases matching #144 and the ADRs each amends (ADR-0004 addendum, ADR-0010, ADR-0011 §5–6); a self-host section that depends on #143's --base-url; a client compatibility table (Claude apps, Claude Code, ChatGPT/Codex, Cursor, VS Code, SDK/Inspector).

Open questions for the owner are at the end (DCR on by default, refresh reuse window, token lifetime, mode at consent, pre-registered clients, DPoP, consent memory, host allow-list, playground).

The docs site builds the RFC index from docs/rfcs, so no index file was edited.

Checklist

• pnpm check and cargo test --workspace pass locally — pnpm lint is green; the full suites were not run (docs-only change, and the owner's machine must not run several suites at once)
• Contract change? pnpm gen was run and generated files are committed (docs/adr/0001) — n/a
• User-visible change in a published package? pnpm changeset added — n/a
• Commits are signed off (git commit -s, DCO)
• Docs / AGENTS.md updated if behaviour or commands changed — n/a (RFC only)

🤖 Generated with Claude Code