Review: Spike: Penny MCP services + OAuth wiring (v2)

review-227-2026-03-27-v2 Review

review block

Project

Verdict: BLOCK

Template Completeness

[ ] Type — MISSING (issue body is $NEW_BODY — a literal unexpanded shell variable)
[ ] Lineage — MISSING (body destroyed)
[ ] Repo — MISSING (body destroyed)
[ ] Question — MISSING (body destroyed)
[ ] What to Explore — MISSING (body destroyed)
[ ] Success Criteria — MISSING (body destroyed)
[ ] Time-box — MISSING (body destroyed)
[ ] Related — MISSING (body destroyed)

Root cause: The issue body was overwritten with the literal string $NEW_BODY — likely a shell script that used single quotes around a heredoc or failed to expand a variable during the previous review's refinement pass. The second comment on the issue says "Issue body updated per scope review corrections" but the update destroyed the content instead of fixing it.

Traceability

[x] story:superuser-manage — present on board item #227
[x] arch:mcp-tools — present on board item #227 (fixed since previous review)
[x] Forgejo issue — forgejo_admin/claude-custom#133, open (but body destroyed)

File Targets

Spike template: no file targets expected. Previous review verified the following paths which remain valid:

[x] ~/secrets/google-oauth/ — verified: contains desktop/credentials.json, desktop/token.json, gcal-mcp-remote.json
[x] ~/secrets/linkedin/credentials.env — verified: exists
[x] ~/claude-custom/agents/penny.md — verified: exists, mcpServers lists only pal-e-docs and notion
[x] ~/.mcp.json — verified: 8 MCP servers wired (chrome-devtools, forgejo, gmail, groupme, notion, pal-e-docs, playwright, woodpecker)

Repo Placement

OK. Issue is on forgejo_admin/claude-custom — correct repo for agent config and MCP wiring.

Dependencies

depends:132 — claude-custom#132 ("Bug: Penny agent type missing from spawn schema") is closed. Board item #226 is in done column. Dependency satisfied.

Acceptance Criteria

Cannot assess — issue body destroyed. The previous review (review-227-2026-03-27) confirmed 4 success criteria were verifiable. These need to be restored.

Blast Radius

Spike is research-only. No code changes. Low risk. However, the script that destroyed the issue body may have damaged other issues — recommend auditing recent Forgejo issue updates for $NEW_BODY or similar unexpanded variables.

Decomposition

Cannot fully assess without issue body, but previous review confirmed: 1 repo, 4 acceptance criteria, time-boxed to 1 session. No decomposition needed once body is restored.

Stale Facts from Previous Review (still relevant)

The previous review (review-227-2026-03-27, verdict: NEEDS_REFINEMENT) found stale assumptions that should be incorporated when restoring the body:

Gmail MCP is deployed — wired in ~/.mcp.json with 41 tools active. agents/penny.md says "NOT DEPLOYED" — wrong.
Notion MCP is deployed — wired in ~/.mcp.json, active. Listed correctly in penny.md mcpServers.
GroupMe MCP is deployed — wired in ~/.mcp.json but not mentioned in penny.md at all.
GCal MCP and LinkedIn MCP are NOT wired — repos exist on Forgejo (gcal-mcp, gcal-mcp-remote, linkedin-mcp-scheduler) but are not in ~/.mcp.json. These are the real gaps.
agents/penny.md mcpServers lists only pal-e-docs and notion — gmail and groupme are missing from frontmatter even though the MCP servers are active.

Recommendation

[BODY] CRITICAL: Restore the issue body. Current body is the literal string $NEW_BODY. The original content was destroyed by a botched update script. Reconstruct from: (a) the previous review note review-227-2026-03-27 which quoted the original sections, (b) the spike template (template-issue-spike), and (c) the stale-fact corrections from that review. The restored body must use the spike template structure with corrected "What to Explore" section reflecting current MCP deployment reality.
[SCOPE] Audit the update script that produced $NEW_BODY. If this was skill-refine-ticket or a hook, the variable expansion bug may affect other issues. This is discovered scope — warrants a separate Forgejo issue.