Align relay and MCP transport documentation with current architecture

[dzianisv]

Parent: #130

Problem

docs/eval.md and docs/chrome-devtools-relay.md contain stale authentication, version, and transport statements that conflict with the current UUID-only relay and separate Streamable HTTP MCP architecture.

Scope

• Document the distinct direct WSS CLI, local stdio/HTTP MCP, and hosted Streamable HTTP MCP paths.
• Remove stale second-factor/auth and obsolete version/test references.
• Correct live-test claims so they match actual defaults and CI coverage.
• Add a working stdio MCP configuration example for a full WSS relay URL without publishing a real UUID.

Acceptance criteria

• README and docs make transport boundaries and security assumptions unambiguous.
• Commands and configuration examples match current binaries.
• No live credential appears in source or GitHub.
• PR references this issue and Review CLI WSS remote compatibility after HTTP MCP relay refactor #130.

[dzianisv]

Implementation started in isolated worktree on branch docs/134-relay-architecture. Scope is docs-only: source-grounded relay/MCP transport boundaries, current client configs, and stale auth/test-claim cleanup. Evidence and PR will follow after independent review and checks.

[dzianisv]

Implemented in PR #141: https://github.com/VibeTechnologies/vibe-mcp/pull/141\n\nEvidence:\n- Docs-only commit: ad5b307\n- Changed only README.md, docs/eval.md, and docs/chrome-devtools-relay.md\n- git diff --check: PASS\n- README JSON examples: 7/7 parsed\n- npm run build: PASS\n- npm run test:ci: PASS (all 11 deterministic scripts)\n- Independent final review corrected the last test-boundary mismatch and found no remaining issues\n- No real relay UUID or credential was used; examples use 00000000-0000-0000-0000-000000000000\n\nPR references Fixes #134 and parent #130. It will not be merged by this task.

[dzianisv]

Final verification: PR #141 CI build passed in 1m57s (run 31532777416). PR state is OPEN, merge state CLEAN, mergedAt is null. Branch and remote both point to ad5b30719777749a855d013d1b454dfe6d2df876; worktree is clean. No merge performed.

[dzianisv]

Supervisor follow-up: verified no task commit was pushed to the default branch. Current refs: origin/main=e5847cf7c51064fba0c878d1673922b42f721630; origin/docs/134-relay-architecture=ad5b30719777749a855d013d1b454dfe6d2df876. PR #141 has base main, head docs/134-relay-architecture, state OPEN, and mergedAt: null. No revert is appropriate because ad5b307 is not on main; reverting main would modify unrelated history.

[dzianisv]

Accuracy rework started on PR #141. Confirmed blockers: wrong hosted MCP hostname/mode collapse, unsafe local bridge exposure guidance, over-deleted eval runbook, and imprecise test/CI boundaries. Rework remains docs-only on docs/134-relay-architecture; no merge will be performed.

[dzianisv]

Accuracy rework pushed to PR #141 in commit 65d07f8.\n\nCorrections:\n- canonical hosted endpoint is https://relay.api.vibebrowser.app/mcp with OAuth 2.1/DCR\n- documented exact current scope enforcement, legacy /mcp/<uuid>, X-Remote-Session, legacy bearer compatibility, and direct JSON-over-WSS separation\n- local HTTP is now explicitly unauthenticated and loopback-only; --allow-host, --host, and --public-url are not presented as safe publication\n- added explicit --devtools paths and local relay-owned shared fallback distinction\n- restored full cross-repo eval commands, selectors, pass criteria, judge/Langfuse env guidance, dated profile, exact UUID-auth harness bounds, and complete CI gates\n\nEvidence:\n- final diff: only README.md, docs/eval.md, docs/chrome-devtools-relay.md\n- git diff --check: PASS\n- README JSON: 7/7 parsed\n- no non-placeholder UUID literals\n- live unauthenticated OAuth discovery probe: /mcp 401 with browser:read browser:control; protected-resource and auth-server metadata 200\n- npm run build: PASS\n- npx tsc --noEmit: PASS\n- npm run validate:skill: PASS\n- npm run test:ci: PASS, all 11 hermetic E2Es\n- npm run test:e2e:plugin-bundle: PASS, 13 checks\n\nPR remains open and unmerged.

[dzianisv]

Final rework verification: PR #141 CI build passed in 1m59s on run 31539741152 for head 65d07f8305503d4887237287576578cb242a27c9. PR remains OPEN and unmerged. No merge performed.

[dzianisv]

Owner update: OAuth-first PR #141 is closed as superseded. Replacement branch chore/remove-relay-oauth documents the supported direct HTTP https://relay.api.vibebrowser.app/mcp/<uuid> hosted connector, retains local stdio and WSS CLI/skill paths, and is in review/fix verification before a new PR.