From cc9e9b25cc7b59a0d8f8b3cb020327188ee88079 Mon Sep 17 00:00:00 2001
From: Craig Jennings <c@cjennings.net>
Date: Fri, 22 May 2026 17:41:58 -0500
Subject: chore(todo): close the mcp/ install-pipeline doc item

---
 todo.org | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/todo.org b/todo.org
index 5e85b12..347194a 100644
--- a/todo.org
+++ b/todo.org
@@ -1452,7 +1452,9 @@ removed links if needed (the install loop is idempotent).
   bridge symlink got removed in a later commit. Drop that bullet when the
   recipe lands.
 
-** TODO [#B] Document the =mcp/= install pipeline in =mcp/README.org=
+** DONE [#B] Document the =mcp/= install pipeline in =mcp/README.org=
+CLOSED: [2026-05-22 Fri]
+Wrote =mcp/README.org= covering everything in the "what to cover" list: the file layout (tracked vs gitignored), the secrets-bundle shape (plain =${VAR}= secrets + base64-bundled OAuth artifacts, AES256 symmetric =gpg -c=), the install flow (decrypt → materialize keys/token caches at mode 600 → expand → register unregistered, idempotent), the http/sse-vs-stdio transport split, token rotation when a Google refresh token is revoked, and adding a new server. Grounded in a read of the actual =install.py= + =servers.json=.
 
 =mcp/= has =install.py=, =servers.json=, =secrets.env.gpg=, =gcp-oauth.keys.json= (gitignored, regenerated at install). No README. Coming back to this in three months I'll re-discover how the bundle is structured, what =install.py= does, and how to rotate tokens. Saving that re-discovery is the whole point.
 
-- 
cgit v1.2.3