docs: correct MCP authorization spec drift to the 2026-07-28 revision

[EsTharian]

The repo tracked MCP Authorization revision 2025-11-25 while the code had already moved past it. Two revisions have shipped since (2025-11-25, 2026-07-28), and ADR-007's delta section was written against the 2026-07-28 release candidate, asserting gaps that have since been closed.

Comments and documentation only — no behaviour change.

ADR-007

• Reviews the final 2026-07-28 spec instead of the RC.
• Records as shipped what it claimed was missing: RFC 9207 iss (feat(oauth): emit RFC 9207 iss in authorization responses (MCP 2026-07-28) #282), the mcp-guard 401 scope challenge (feat(oauth): include scope in the mcp-guard 401 challenge #284), and offline_access filtering. All three were verified in code.
• Adds the items the RC review missed: DCR deprecation (PR #2858) + the SEP-2596 lifecycle policy; application_type (SEP-837) and client-credential issuer binding (SEP-2352) as client-side MUSTs requiring nothing of the AS; the new scope-hierarchy MUST; and the stable EMA / draft client-credentials extensions.
• Corrects a false delta claim: CIMD's normative strength did not firm between revisions — it is SHOULD in both, and DCR is MAY in both. Only DCR's characterisation changed to "deprecated".

Spec pins

Repointed 2025-11-25 → 2026-07-28 across mcp-guard, the root README, the MCP quickstart, the API reference and the Docker guide — only where the described behaviour is actually current.

Scope model correction

The agent scope modes are independent OAuth scopes, not a hierarchy. agent:admin does not imply agent:readonly: mcp-guard matches exactly and case-sensitively per RFC 6749 §3.3, so a client needing both must request both. The ⊇ ReadOnly claim is corrected in docs/agent-authorization.md and at its source in scope-modes.ts and the agent_mode enum.

Known leftovers

• ~11 stale 2025-11-25 pins remain in unassigned auth-server/config source (cimd.ts, client-resolution.ts, discovery.ts, step-up.ts, authorize.ts, well-known.ts, config/schemas/auth.ts). Pins, not false claims — deliberately left for a scoped sweep.
• ADR-007's own remaining 2025-11-25 references are the intentional audit trail of the superseded review.
• test(docs): four drift guards — links, anchors, endpoint coverage, status claims #349 (docs drift-guard test suite) is still open and unimplemented — it is what would have caught this class of drift automatically.

🤖 Generated with Claude Code

https://claude.ai/code/session_01764LWL3PEHphHBwRRkUv1W