[acedatacloud-dev]

Summary

Fix the same two-replica OAuth race found in the account MCP across the other hosted MCP implementations. The shared source now persists exact DCR client registrations, pending PKCE state, single-use authorization codes, and MCP revocation markers in encrypted Redis state. Unknown client IDs are rejected instead of receiving a fabricated callback URI.

scripts/sync_oauth.py distributes one OAuth provider source to 28 packages and one state-store source to 31 packages, including the three local provider variants. The 25 currently active production Deployments point to the existing OAuth Redis service and use separate per-service encryption keys. The deployment helper creates each key once, marks the Deployment, refuses silent key rotation, waits for Redis, and verifies the updated Deployment with a 900-second rollout gate. Sora remains at zero replicas; six packages without active source Deployments receive only the library fix.

Dependency and rollout

1. Merge and deploy fix(acedatacloud): allow hosted MCP fleet to use OAuth state #964 first, then verify the Redis NetworkPolicy admits all 26 current service labels.
2. Merge this PR and track sync, image build, Deployment readiness, and public OAuth discovery for each active MCP. The central Redis and its persistent volume are already live.
3. After all fleet Deployments are updated, deploy a companion AuthBackend change that rotates legacy Studio DCR client IDs once. Opening that change earlier would let Studio cache IDs registered against an old in-memory Pod.

The old live-only mcp-seedream:1 Deployment has no current monorepo manifest; the public seedream.mcp.acedata.cloud ingress targets the managed mcp-seedream-pro Service covered here.

Validation

• scripts/sync_oauth.py --check; OAuth contract check; root unittest suite and seven focused generator/deploy tests passed.
• Shared OAuth cross-replica tests (6 passed), including registration, exact redirect, callback, one-time code exchange, and cross-replica revocation.
• Suno package tests (73 passed, 7 skipped); Digital Human, Happy Horse, and Midjourney OAuth tests passed.
• Ruff check and format validation for all 31 OAuth packages; mypy on shared and three local variants.
• All 25 active Deployment manifests parsed and checked against their actual Deployment names and Secret references; 50 deployment shell files passed sh -n; representative manifests passed Kubernetes server-side dry run.

Rollback

Keep the per-service Secrets and Redis data. Reverting a service image leaves existing durable API Credentials usable, but reconnect reliability returns to the old per-Pod behavior until its new image is restored.