[mrgoonie]

Summary

Consolidate the website issue backlog into one reviewable change: add OAuth sign-in for the content MCP and update English and Vietnamese gateway documentation. This draft incorporates the work in #92 alongside subsequent documentation updates.

Relates to #134, #133, #132, #131, #91, #90, #89, #88, #87, #73, #93, #94, #95, #96, #97, #98, #99, #100, #101, #102, #103, #104, #105, #106, #107, #108, #109, #110, #111, #112, #113, #114, #115, #116, #117, #118, #119, #120, #121, #125, #126, #127, #128, #129 and #53.

Changes

• Route content MCP OAuth consent, tokens, validation and revocation through a SQLite-backed Durable Object; retain API-key authentication. The token path supports both public clients and signed client assertions, with ES256 and RS256/JWKS regression tests and serialization of assertion replay checks across owners of the same client.
• Update bilingual guides for gateway and workspace behavior, gate website analytics on consent, document existing app analytics replay and claim events, and add Workers-runtime tests to CI. OAuth audit targets retain the client host and a fingerprint without recording client URL paths or query values; audit details omit the untrusted client display name.

Testing & evidence

• pnpm test: 705 tests passed; pnpm test:workers: 4 tests passed, including consent/code concurrency, cross-owner assertion replay and Durable Object eviction.
• Generated output checks: all 50 changed EN/VI docs pages have one H1, correct language and canonical/OG/hreflang values, no skipped heading levels, manifest entries and Markdown twins. Staging sitemap lists all 50 routes. An earlier link check found 5,412 internal docs links resolved; these checks do not replace visual or keyboard review. Four new private-repository links were replaced; the public generated CLI reference returned 200 and its anchor exists.
• pnpm check: no errors; one existing deprecation hint. pnpm build, staging build and staging wrangler deploy --dry-run passed.
• PR CI on 5ce6046 passed. The follow-up legal copy update passed 24 focused tests and pnpm check; CI on 9055128 passed. Subsequent changes passed exact-head CI on 9a9da6f.
• Staging Worker deployed from commit 082780f without D1 migrations (version 7171a458-ab0a-417b-9d8e-60ca1dda7e51); the later CLI mapping is not yet deployed. A read-only comparison found no missing binding names or types, no changed plain variables, and six secret bindings before and after (secret values were not inspected). /, /vi, /index.md and both OAuth discovery documents returned 200; an unauthenticated /mcp call returned 401 with the staging metadata challenge. The login and consent forms use Referrer-Policy: origin to keep OAuth parameters out of referrers while preserving the browser Origin required by CSRF checks; redirects use no-store and no-referrer. A local authenticated authorization error page and both existing-session and newly verified login redirects also returned both headers; the latter set a Secure HttpOnly session cookie; The user observed a browser form CSRF failure under no-referrer; the origin-only fix has been deployed and a real browser retry reached the OTP entry form. A fresh staging ChatGPT authorization granted only pages:read, posts:read and docs:read, and a real list_pages call succeeded. The earlier callback error and all-checked consent screenshot were not reproduced, so their causes remain unknown.

Review and release gates

• Draft: finish issue-by-issue source and acceptance review, review of the final diff, and dependent staging and production verification before merging.

• Consent decision: website PostHog and Google Tag Manager now initialize only after acceptance; Google analytics consent is granted while advertising consent signals remain denied; the no-JavaScript GTM fallback was removed. Local tests exercise no choice, essential-only, acceptance, saved consent and cross-tab withdrawal. The locally rendered production-config HTML contains both gates and no GTM noscript iframe; Chrome asset inventory on the local build showed no PostHog or GTM resources before consent or after Essential only; a local Chrome network capture found zero PostHog/GTM requests before choice or after Essential only, then observed both initializers after Accept with external requests blocked; production verification remains pending.

• Website-chat credential cards require current workspace membership, as confirmed by the user. Gateway membership enforcement merged to dev in nextlevelbuilder/dewee#2244, and widget member-link journey feat(webchat): verify workspace member links dewee-webchat#53 has merged with passing CI. Keep the feature disabled until both are deployed and the full journey is verified. Public-image service binding documentation follows merged feat(images): support public worker service bindings dewee-webchat#49 and docs(memory): note that the prompt only names memory tools the agent can call #51.

• Page-context Gateway PR nextlevelbuilder/dewee#2230 merged into dev; its contract specifies 64 KiB while issue docs: document per-turn page context for website chat #131 says 32 KiB. Paired staging and production acceptance remain pending. Widget support is not assumed.

• Cloud browser Gateway and control-plane changes merged into dev, and Workspace MCP controls PR nextlevelbuilder/dewee#2235 merged into dev; the compatible extension PR remains open. The merged MCP contract requires hosted confirmation by the requesting member and makes revocation idempotent, differing from issue docs: manage connected browsers and grants over Workspace MCP #132. Verify paired staging and production acceptance. The release executor and Operations MCP companion also lack final staging and production acceptance; do not claim final deployed contracts until verified.

• The homepage H1 experiment has not started. Its traffic must satisfy its existing preregistered stopping rule; this PR does not claim an experiment result or close experiment: benefit-led vs category-led homepage H1 #53.

• This introduces a Durable Object binding and migration. A read-only preflight found no pending D1 migrations and no omitted existing non-secret binding names or changed plain variables against the latest production Worker; existing D1/KV IDs, R2 buckets and Durable Object class names also match; Durable Object namespace continuity and post-deploy secret preservation still require verification. Recheck before merge. Production deployment and verification have not occurred.

• Visual review: render checks covered the changed pages in EN/VI, light/dark and 375/768/1440, with no automated errors; independent screenshot review is in progress. Existing shared controls have touch targets under 44 px, also reproduced against production. Large blank areas on Developers were reproduced against the existing production baseline at all three widths; they are a pre-existing layout concern, not a confirmed PR regression. Independent review examined all captured changed-page EN/VI screenshots at 375/768/1440 in both themes, including long-page continuations and all final-head website-chat images; no confirmed visual regression. Mobile API Overview tables use the same horizontally scrollable wrapper as Workspace MCP; the latter received a staging keyboard check, but API Overview was not separately tested by keyboard. The latest website-chat images were captured on final head. Five extra EN/VI routes identified by the reviewer are not changed in the current PR diff. The existing small touch targets remain an accessibility checklist exception; full contrast and keyboard audits are not established by screenshots. Four final-head website-chat checks printed zero errors, but their helper processes needed interruption after reporting, so they are not clean process-exit evidence.

• Gateway staging and production validation remain pending: the shared beta-release lease is held and renewed by another active run. No Gateway merge or release was dispatched.

• 2026-11-09: Gateway and CCP staging readiness report exact SHA 0d8c668 (containing Gateway #2244); the corresponding staging workflows and Gateway v3.57.0 production release completed successfully. Widget beta.6 includes experiment: benefit-led vs category-led homepage H1 #53, is published to npm and CDN, and stable latest remains byte-identical to 0.4.2. The full signed-in widget journey remains unverified; the observed test host still reports widget backend 0.4.1.

• Website staging Worker version 332ce906 was deployed from final head 9a9da6f without running D1 migrations. EN/VI website-chat, discovery and homepage routes return 200, the existing staging connector read call works, and all pre-existing binding names/types, six secret bindings and plaintext variables were retained. A pre-existing staging D1 migration 0012 remains pending; production D1 reports no migrations pending.