fix(ci): remove expiring OAuth token deploy gate

[isuttell]

Summary

Production deploys fail after successfully deploying the Workers because the MCP smoke uses a stored, short-lived user OAuth token. Run 35007586363 failed with initialize returned 401.

Changes

• Remove the OAuth token preflight and authenticated MCP smoke step from production deployment, as explicitly requested by Isaac.
• Keep the existing credential-free production smoke, including Worker health, MCP discovery, missing-token challenges, and API-key rejection.
• Update the runbooks and amend ADR 0097. Authenticated MCP smoke remains available as an operator check.

Risk: LOW

Workflow and documentation change. Deployment no longer asserts authenticated MCP tool calls. Runtime authentication and authorization are unchanged.

Test plan

• pnpm verify
• actionlint .github/workflows/deploy-production.yml
• pnpm smoke:prod:readonly, passed against production
• git diff --check

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Deployment

  • Production deployments now use credential-free, read-only MCP smoke checks.
  • Authenticated MCP validation is no longer a required deployment gate and must be performed separately by an operator with a current session token.

• Documentation

  • Updated deployment instructions and operational runbooks to describe the revised smoke-test process.
  • Clarified that application credentials are not valid for authenticated Workspace Member checks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 699077ce-ca4b-4754-add9-1e99803bba1c

📥 Commits

Reviewing files that changed from the base of the PR and between e00fe48 and af18964.

📒 Files selected for processing (4)

• .github/workflows/deploy-production.yml
• docs/adr/0097-mcp-private-principal-handoff.md
• docs/ops/runbook-mcp-hosts.md
• docs/ops/status/hosted-ops.md

💤 Files with no reviewable changes (1)

• .github/workflows/deploy-production.yml

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 6 reviews per hour.

---

📝 Walkthrough

Walkthrough

Changes

Production MCP validation

Layer / File(s)	Summary
Remove authenticated deployment gates .github/workflows/deploy-production.yml	The production workflow removes stored-token validation and the authenticated MCP production smoke test.
Update MCP deployment guidance docs/adr/0097-mcp-private-principal-handoff.md, docs/ops/runbook-mcp-hosts.md, docs/ops/status/hosted-ops.md	Documentation now describes credential-free read-only smoke checks and operator-run authenticated checks with a current Workspace Member session token.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to af189

Production deployment no longer depends on an expiring user token, while read-only health and authentication checks remain automated and authenticated checks remain available to operators.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: removing the expiring OAuth token deployment gate from CI. It is concise and specific.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch t3code/fix-ci-deploy

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

agent-paste PR preview resources were cleaned up. The shared Preview GitHub Environment is retained for future preview deploys.