- Two audience scopes per MCP server, not one: Kong's own openid-connect
plugin re-exchanges the token, so it must also name
kong-token-exchange-broker. Measured on catalog.
- Drop the resolved Konnect-not-persisting blocker; the cause was a dead
Konnect org, not Konnect refusing writes.
- Drop the resolved kong-token-exchange-broker secret mismatch; its
client_credentials returns 200.
- Record the real blocker: PydanticAI's MCP client cannot open a session
against ai-mcp-proxy.
- Document the realm's override-on-start import and ${KC_SECRET_*}
placeholders, and the a2a-sdk 1.x serving requirements.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Design agreed in discussion, nothing built yet. Records the agent's role, its
scopes and MCP servers, its A2A surface, and the framework choice with its
reason — so the next session starts from the decisions rather than re-deriving
them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Stéphane Tailland