Restore Render MCP deployment parity after verified website release #88

FROM → TO

From a newly verified GitHub Pages website with an older Render MCP runtime → to the same commit-pinned skill-lib projection visible through the human page and the remote tools/list / tiw_list_skills tools.

Evidence

• Website PR WebMCP: publish full skill-lib catalogue and invoke live MCP tools #87 merged as c955f2f9c36e69a68b8d3a7e0acb70e8fca6c36b; Pages workflow run 39075102110 passed build, browser checks, deployment and custom-domain identity.
• The same run's Trigger Render MCP deploy step emitted RENDER_DEPLOY_HOOK_URL is unset; Render MCP deployment remains hmmm.
• Render services the-interdependency-mcp (default website endpoint) and the-interdependency-mcp-live have latest recorded deployed commits 02938d9... and 6d8f12b..., respectively (September 2026). Render reports both as configured with autoDeploy=yes but no newer deployment in the observed deployment list.
• Public website source already contains full-catalogue projection and a tested browser MCP client, but a stale server cannot be claimed to mirror its registry.

DONE WHEN

1. Resolve which service is authoritative; the website runtime constant and documented default endpoint agree with it.
2. Repair the supported Render auto-deploy/GitHub integration or provision RENDER_DEPLOY_HOOK_URL securely in Actions to match that authoritative service. Never expose the hook value in source, logs or user-facing output.
3. A merged-commit release produces a successful Render deploy with a recorded commit identity at least as new as the website's deployed source.
4. Execute live /health, tools/list, tiw_list_skills from the website origin; compare source identity, count and complete skill identities to the deployed website's generated registry.
5. Verify unauthenticated MCP operations are still read-only; an execution tool is not introduced merely to fix registry parity.

PROVEN BY

Deployed Render commit, parity test with exact identities and endpoint, GitHub Pages identity, and explicit failure-mode tests.

FAILS IF

A run reports success because an unset deploy hook was treated as a no-op, either endpoint silently returns stale skills, or registry synchronization grants execution/write authority.

hmmm

The controlling Render hook and GitHub integration are not represented by a verified current deployment; do not infer the missing credential or silently promote the second service.

Relates to #87.