Forge's half of the platform token resolver (design §19; layer split per §18/§14.2). Fixes the deployed-agent dead end — mcp: no stored token — login required: "atlassian" — where config materialization worked (client_id + endpoints resolved) but no grant could ever exist: forge mcp login is laptop-only and there is no browser in a pod.

The constraint that shapes it

MCP auth is connection-scoped: the token is presented at initialize for the whole session — one connection = one identity. So per-operation identity materializes as per-identity server entries (same URL, split platform-side), and Forge needs only per-server auth config — the shape it already has. Two resolver types, nothing more:

platform:
  token_endpoint: ${INITIALIZ_TOKEN_ENDPOINT}
  agent_identity: ${FORGE_PLATFORM_TOKEN}

mcp:
  servers:
    - name: atlassian-read
      auth: { type: platform, ref: mcp.atlassian }
      required: true            # startup-viable: no human needed
    - name: atlassian-write
      auth: { type: user, ref: mcp.atlassian }
      required: false           # inherently lazy: no user at startup

What's here

• auth.type=platform — agent-principal (service) identity. New top-level platform block; both fields ${VAR}-expanded at use (like token_env — rotated pod secrets apply without restart). The resolver POSTs {"server": <ref>} with the agent credential as Bearer, caches the access token to TTL (30s skew), re-fetches on expiry, and ignores any refresh_token in the response — the agent never holds one (invariant 8). Missing platform block fails at NewServer, not on the first call. The resolver host merges into the egress allowlist.
• auth.type=user — delegated user identity, inherently lazy: required:true is rejected at both validate and NewServer; auth attempts fail with ErrNoToken + an actionable message until the platform consent flow (Epic: runtime per-user, ephemeral per-session MCP OAuth (interactive login via Slack / A2A UI) #317) completes. Never blocks startup.
• MCPAuth.Ref — the platform tool-registry entry the token resolver authorizes against (platform-materialized; defaults to the server name).

Acceptance mapping (Forge side)

• platform server starts with no human/login/stored token ✓ (TestNewServer_PlatformAndUserRules, resolver tests)
• token cached to TTL, re-fetched on expiry, refresh token never held ✓ (TestPlatformTokenSource_FetchCacheAndIgnoreRefresh, _RefetchOnExpiry — the fake resolver emits a forbidden refresh_token and the source ignores it)
• resolver's entitlement rejection surfaces ✓
• type: user + required: true rejected at validate ✓ (TestValidateMCPConfig_ManagedIdentityTypes)
• user server lazy, non-blocking ✓
• air-gap regression: oauth/forge mcp login path untouched; full suites green, golangci-lint 0 issues

Platform half (Connect grant storage, POST /mcp/token with entitlement, materialization split) lands in agent-builder alongside this.

🤖 Generated with Claude Code