---
id: w4/m16/t006
title: "Render parity — superset check: ADR018 bex-ahead section + cross-surface consistency of the consent policy"
worker: worker4
status: done
estimate: 15m
depends_on: [w4/m16/t003, w4/m16/t005]
---

## Objective

Standing Render-parity closing task, in **superset** form: Render has no OAuth2 provider surface at all (agents/CI use dashboard-minted API keys), so there is no Render shape to mirror — the comparison targets are (a) ADR018's "bex ahead of Render" section, which should gain/extend an entry for user-consented third-party agent clients now that consent is self-serve, and (b) bex's own cross-surface consistency: the consent policy the dashboard enforces must match what the REST/GraphQL/MCP token-auth path (`lego/backend`) accepts — a token from a user-consented (non-blessed) client must pass introspection/audience checks at `/mcp` exactly like a blessed client's.

## Context

- ADR018 § bex ahead of Render already lists "API-key management over the API"; the OAuth 2.1 provider (w4/m9) is referenced from the git-connections row — check whether it has its own bex-ahead entry to extend or needs one.
- The backend accepts introspected tokens regardless of how consent was granted (`lego/backend` auth gate, ADR012 §7 audience check) — verify no code path special-cases trusted clients.
- Re-verify against render.com docs (api-docs.render.com) that Render still has no OAuth provider/consent surface; note the check date.

## Steps

1. Verify a consented-but-unblessed client's token is indistinguishable to bex-api from a blessed client's (code read + the t004 e2e evidence).
2. Update ADR018's bex-ahead section (+ any row that referenced the operator-blessing requirement); date the Render re-check.
3. File any discovered drift as follow-up notes rather than fixing inline.

## Files

- `docs/ADR018-render-parity.md`

## Acceptance criteria

- [ ] ADR018 records the self-serve consent capability as a dated bex-ahead superset with evidence pointers (m16, `scripts/auth-oauth21-e2e.sh`).
- [ ] Cross-surface check done: bex-api treats consented and blessed clients' tokens identically, or the drift is filed.
- [ ] Prettier clean.

## Out of scope

- Building any Render-mirroring surface (none exists to mirror).
