Log the OAuth disruption and the first reviewer feedback on the Anthropic directory submission

docs/anthropic-directory-submission.md

@@ -6,8 +6,10 @@ the catalog that serves Claude.ai, Claude Desktop, Claude Mobile, Cowork, and
 Claude Code. Field drafts below are pre-filled from this repo and the live
 deployment; paste and adapt them in the portal.
 
-Verified against the official docs on **2026-07-31**. The portal UI may add
-details (e.g. exact icon dimensions) not published in the docs.
+Verified against the official docs on **2026-10-23** (first written against
+their 2026-07-31 versions; the portal, submitter and review-status facts
+below are from the current pages). The portal UI may add details (e.g. exact
+icon dimensions) not published in the docs.
 
 > **Server-state claims re-verified 2026-09-01.** Tool-surface numbers below
 > were regenerated from a live scan of a deployed instance of the current
@@ -19,14 +21,37 @@ details (e.g. exact icon dimensions) not published in the docs.
 > through, but `/version` and `/status/` answer with a redirect at that edge —
 > the rows and steps below that relied on them say so inline.
 
+## Submission log
+
+- **2026-09-28 — submitted** as **"Internet Computer"** (slug
+  `internet-computer`). Status **In review** ever since; no reviewer feedback
+  as of 2026-10-23. In the status model below, *In review* means a person is
+  checking the listing and the next move is Anthropic's — nothing is owed
+  from our side until the status changes or mcp-review writes.
+- **The submission date fell inside an OAuth disruption** (2026-09-25 to
+  2026-10-01) caused by the DCR-to-CIMD migration (CIMD became the default
+  registration mode in [#203](https://github.com/dfinity/imcp2/pull/203),
+  merged 2026-09-24): a user reported DCR failing with HTTP 400 "redirect URI
+  not permitted" on 2026-09-25, and OpenAI's reviewer could not complete the
+  sign-in flow on 2026-10-01. A reviewer who tried the connector in that
+  window would have failed at sign-in. The fix is live. If feedback cites a
+  sign-in failure, answer with this timeline and ask for a re-test.
+- **2026-07-31 — pre-submission email** to <mcp-review@anthropic.com>, asking
+  ahead about the financial-transactions acknowledgment, got an automated
+  acknowledgement (ticket #120537913, from directory@mail.anthropic.com) and
+  no human reply. The question it asked is now moot: the funding tools it
+  described were removed and ledger methods are refused (blocker 2 below).
+- **If the status does not move:** escalate to <mcp-review@anthropic.com>
+  with the listing name, the submitting organization, and the status the
+  portal shows — the channel and the three details the status doc asks for.
+
 ## Where and how submission happens
 
-- **Portal:** <https://claude.ai/admin-settings/directory/submissions/new>
-  (status/feedback afterwards at
-  <https://claude.ai/admin-settings/directory/submissions>).
-- **Who can submit:** an **Owner** (or, on Enterprise, a custom role with the
-  *Directory management* permission) of a Claude **Team or Enterprise
-  organization**. There is no submission path for individual plans.
+- **Portal:** <https://claude.ai/directory/manage> — the same page shows
+  each listing's status and reviewer feedback afterwards.
+- **Who can submit:** anyone on a **paid Claude plan**, through the portal.
+  (The docs no longer restrict submission to an Owner of a Team or Enterprise
+  organization.)
 - **Governing documents:**
   [Anthropic Software Directory Policy](https://support.claude.com/en/articles/13145358)
   (effective 2026-04-15) and
@@ -35,11 +60,19 @@ details (e.g. exact icon dimensions) not published in the docs.
 - **Process docs:**
   [Submission](https://claude.com/docs/connectors/building/submission),
   [Review criteria](https://claude.com/docs/connectors/building/review-criteria),
-  [Authentication](https://claude.com/docs/connectors/building/authentication).
+  [Authentication](https://claude.com/docs/connectors/building/authentication),
+  [Submission status](https://claude.com/docs/directory/submission-status).
 - **Review:** automated policy scan first, then listing as a *Community*
-  connector; Anthropic may escalate to a human *Verified* review on its own.
-  No published SLA ("review times vary with queue volume"). Escalations and
-  special requests: <mcp-review@anthropic.com>.
+  connector; Anthropic may escalate to a human *Verified* review on its own,
+  in which reviewers run a functional test of each tool. No published SLA
+  ("review times vary with queue volume"). Escalations and special requests:
+  <mcp-review@anthropic.com> — include the listing name, the submitting
+  organization, and the status the portal shows.
+- **Listing status** (MCP connectors): *Draft*, *In review*, *Changes
+  requested*, *Not approved*, *Approved*, *Published*. *In review* means a
+  person is checking the listing and Anthropic acts next. Editing an
+  *Approved* listing before it is published returns it to *Draft* for another
+  review — so leave the listing alone once approved until it is published.
 - **Not required:** listing in the open MCP Registry
   (registry.modelcontextprotocol.io) — the directory docs state its
   domain-ownership proof "applies only to the open MCP Registry, not the
@@ -150,7 +183,8 @@ current draft: the identifier-linkability wording and the updated third-party
 list). The MCP server no longer serves a copy:
 `https://mcp.internetcomputer.org/privacy-policy` answers with a permanent
 redirect to that home ([#165](https://github.com/dfinity/imcp2/pull/165); the
-gateway front redirects it as well). Enter the canonical URL in the portal.
+gateway front redirects it as well). The canonical URL is the one entered in
+the portal (submission of 2026-09-28).
 The reviewed source
 text is [`icp-mcp-privacy-policy-draft.md`](icp-mcp-privacy-policy-draft.md).
 
@@ -207,8 +241,10 @@ financial-transactions acknowledgment is made on that basis, without
 qualifications.
 
 **mcp-review thread:** an email to <mcp-review@anthropic.com> (2026-07-31)
-asked ahead about this acknowledgment. No reply is needed to submit; if one
-arrives, answer with the posture above.
+asked ahead about this acknowledgment. It got an automated acknowledgement
+(ticket #120537913) and no human reply, and the question it asked is moot —
+the funding tools it described are gone (see the submission log). No reply
+was needed to submit; if one arrives, answer with the posture above.
 
 Related point for the same step: the **model-readable metadata describes the
 surface and the constraints on using it, without attempting to manipulate
@@ -254,8 +290,9 @@ device-bound, so a "shared account" would mean circulating a recovery phrase,
 and every read-only tool works against public network state, so a
 freshly-created identity exercises the bulk of the surface within a minute.
 
-One tension to be ready for: the review criteria say *"Test credentials are
-required and must be a fully populated account."* Self-serve sign-up is a
+One tension to be ready for: the review criteria say *"Test credentials:
+required, and they must be for a fully populated account,"* and a *Verified*
+review runs a functional test of each tool. Self-serve sign-up is a
 reasonable answer for an authentication system nobody can pre-provision into,
 but a reviewer may still ask for a populated account — most plausibly to
 exercise `canister_update_call` against an app where the identity has data.
@@ -432,10 +469,10 @@ conversation beyond tool arguments and generates no media.
 
 ## Submission-day checklist
 
-- [ ] Privacy policy entered in the portal — enter `https://internetcomputer.org/icp-mcp/privacy-policy/`, the page's one home (live; the old mcp.internetcomputer.org URL permanently redirects there) (blocker 1)
+- [x] Privacy policy entered in the portal — `https://internetcomputer.org/icp-mcp/privacy-policy/`, the page's one home (live; the old mcp.internetcomputer.org URL permanently redirects there) (blocker 1)
 - [x] Financial-transactions acknowledgment is a clean yes (blocker 2): the server does not support financial transactions. No mcp-review reply is needed; if one arrives, answer with the stated posture. The first-party-API/data-handling question was NOT in the 2026-07-31 email: raise it with mcp-review only if the portal's data-handling options don't fit
 - [x] Reviewer access settled: self-serve Internet Identity, instructions in the test-credentials field (blocker 3) — if a reviewer asks for a populated account, provision a demo-app account (no funding needed: there are no funding or canister-management tools)
-- [ ] `vX.Y.Z` release cut (promoted from a staging candidate) and picked up by the gateway; production confirmed to run the intended commit by the operators — externally `/version` is cut off by the gateway front, so the check is on-host or via the deploy workflow's record (blocker 4)
+- [x] `vX.Y.Z` release cut: the crates are at `0.5.1` (`v0.5.1` tagged), under the `rc-X.Y.Z-N` → `vX.Y.Z` scheme from [#204](https://github.com/dfinity/imcp2/pull/204) (an `rc-*` tag deploys the candidate to staging, the matching `v*` tag publishes the crates; production embeds the published crate). Externally `/version` is still cut off by the gateway front, so which commit production runs is checked on-host or via the deploy workflow's record (blocker 4)
 - [x] Square PNG icon exported — `docs/assets/icp-logo-{1024,512}.png` (blocker 5)
 - [ ] Every tool exercised once by the submitter (portal asks you to confirm this; MCP Inspector or a custom connector in Claude both count)
-- [ ] Submitter has Owner / Directory-management access in DFINITY's Claude Team/Enterprise org
+- [ ] Submitter is on a paid Claude plan (the docs no longer require an Owner of a Team/Enterprise org); follow-ups and escalations go from the same submitting organization the listing was filed under