Grade tools: OAuth 2.1 + OIDC setup evaluation (#3360 Part B)

[bokelley]

Part B of #3360. Part A (webhook signing on-ramp fail) shipped in #4292.

Scope

New universal compliance storyboard at static/compliance/source/universal/oauth-setup.yaml that grades an agent's OAuth 2.1 + OIDC setup if the agent advertises OAuth as a supported auth scheme.

What to grade

Three RFCs the AdCP 3.0 spec already references for OAuth setup:

1. RFC 8414 — OAuth 2.0 Authorization Server Metadata

   • Assert .well-known/oauth-authorization-server resolves and parses
   • Assert required fields per spec (issuer, authorization_endpoint, token_endpoint, jwks_uri, etc.)
   • Assert issuer matches the agent's domain (no off-host issuer leakage)

2. RFC 9728 — OAuth 2.0 Protected Resource Metadata

   • Assert .well-known/oauth-protected-resource resolves and parses
   • Assert authorization_servers is non-empty and references a real AS
   • Assert resource identifier matches the agent's MCP/A2A endpoint

3. RFC 7591 — Dynamic Client Registration

   • Assert registration_endpoint is reachable (per AS metadata)
   • Optional: dry-run register a client and assert minimum-required fields are accepted

Gating

Universal storyboard, gated on auth.oauth.supported: true (or equivalent capability flag — TBD whether this needs a schema add). Same gating model as signed-requests.yaml (gated on request_signing.supported: true).

Why 3.2.0

3.1.0 timeline (May 29) is too tight for a new universal that needs:

• New test-kit contract (similar to signed-requests-runner.yaml)
• Test vectors covering metadata edge cases (issuer mismatches, missing fields, unreachable endpoints)
• Runner-side support for fetching well-known paths and parsing metadata
• Possibly a capability schema add if auth.oauth.supported doesn't already exist

3.2.0 (Aug 31) gives one cycle to get this right after 3.1.0 ships.

Why this matters

The #3360 issue body called out OAuth grading as the gap alongside RFC 9421. Part A handled signing; Part B handles auth. Together they let an operator validate "is this agent set up correctly" across the two cross-cutting transport-layer mechanisms AdCP relies on.

Refs

• Grade tools: add OAuth and request signing setup evaluation #3360 (parent — issue body covers both signing and OAuth)
• fix(grader): fail agents without published 9421 webhook-signing JWKS (#3360 part A) #4292 (Part A — webhook signing on-ramp fail, 3.1.0)
• docs/building/implementation/security.mdx — already references RFC 8414 / 9728 / 7591 normatively