ece9eee4

docs: a binary nobody was ever handed leaves the record

a73x 2026-08-11 15:40

Commit message

docs: a binary nobody was ever handed leaves the record

The local stdio MCP binary was never in a release tarball — it existed only
for whoever built the source tree. The public record now reads the way the
product always worked for everyone who could reach it: eitri speaks MCP at
/mcp on the plane, and nowhere else. The one-surface decision argues from
principle instead of narrating a retirement, and the v0.0.4 notes stop
offering a local companion no download ever carried.

docs/decisions.md

Old		New
@@ -142,11 +142,11 @@ conformance suite: a Provisioner is whatever passes it.
142	### One MCP surface: `/mcp` on the plane	142	### One MCP surface: `/mcp` on the plane
143		143
144	eitri speaks MCP in exactly one place: `/mcp` on the control plane, authenticated	144	eitri speaks MCP in exactly one place: `/mcp` on the control plane, authenticated
145	by a bearer PAT. Instead of a local stdio binary beside it and a public SSO front	145	by a bearer PAT. Not a local binary beside it, not a public SSO front ahead of
146	ahead of it — three arrangements are three credential stories to keep honest, and	146	it: every added arrangement is another credential story to keep honest — its own
147	the extra two earn nothing. The stdio binary held its own user CA and its own	147	config, its own key material, its own way of naming a tenant — while the plane
148	config file while the plane already authenticates PATs and holds no signing key	148	already authenticates PATs and holds no signing key at all. A self-hoster gets
149	at all; a self-hoster gets an MCP server by self-hosting the plane, and a public	149	an MCP server by self-hosting the plane, and a public front would target this
150	front targets this same endpoint rather than being a fourth thing. Reversed by a	150	same endpoint rather than being a second thing. Reversed by a genuine air-gapped
151	genuine air-gapped need: guests to drive with no plane to reach.	151	need: guests to drive with no plane to reach.
152	Details in [mcp.md](mcp.md).	152	Details in [mcp.md](mcp.md).

docs/releases.md

Old		New
@@ -15,8 +15,7 @@ console is drawn in the site's own language.
15		15
16	MCP. eitri-server serves MCP at `/mcp` over streamable HTTP, authenticated	16	MCP. eitri-server serves MCP at `/mcp` over streamable HTTP, authenticated
17	with the same bearer token the API takes; a caller sees exactly the fleet its	17	with the same bearer token the API takes; a caller sees exactly the fleet its
18	token can see. `api.eitri.sh` carries that one route and nothing else. The	18	token can see. `api.eitri.sh` carries that one route and nothing else.
19	stdio binary is there for local use—both transports serve the same tools.
20		19
21	Delegated access, not a held key. eitri never holds a signing key for your	20	Delegated access, not a held key. eitri never holds a signing key for your
22	guests. When a token-only caller needs SSH access, you delegate it: sign the	21	guests. When a token-only caller needs SSH access, you delegate it: sign the