Compress public listing JSON and sample successful access logs in staging - #1798

…uction (#1799)

Enable negotiated gzip for credential-free public listing responses and
10% retention of fast successful listing access logs, using the
implementation in #1798. Preserve errors, slow reads, retries,
authentication and publishing routes, audit logs and unsampled metrics.
Application templates, cache lifetime, database resources and capacity
remain unchanged.

Document the narrowly scoped deployment role needed to manage this
exclusion. The existing deployment service accounts have only
get/list/create/update exclusion permissions through that additional
role; no log or bucket deletion permission is added.

Validation: live staging encoding, identity fallback and decoded-content
checks passed; bounded read probes, CPU/throttling checks and service
health passed. A later sample after log-router propagation confirmed
selective retention. Repository CI and the exact-head production
saved-plan preview passed; the plan permits only the ingress ConfigMap,
its in-place update provider setting and the named exclusion. Detailed
evidence remains private.

<!-- claude-slack-attribution -->
_Requested by **Den Delimarsky, David Soria Parra** · [Slack
thread](https://ant-mcp-oss.slack.com/archives/C0BDGKP4PC6/p1793430342149349)_

Squash-merge with this description as the commit message. The two
trailers on the last lines must stay in it, so that the next subtree
pull starts from this one.

**Before:** `docs/registry/` reflects the registry docs as of 2026-01-22
(registry commit 817e1216), plus six local edits made since. The FAQ
says servers cannot be deleted, the P-384 login command lacks the
`--algorithm` flag, the organization namespace rules are missing, and
the remote servers page says a remote URL can be used by only one server
name.

**After:** `docs/registry/` is byte-identical to
`docs/modelcontextprotocol-io` in modelcontextprotocol/registry at tag
`v1.8.9` (commit ba94f657). Seven pages change (+308/-25):
authentication, faq, github-actions, package-types, quickstart,
registry-aggregators and remote-servers.

## How

`scripts/pull-registry-docs.sh` was run against a clone of the registry,
first at `v1.8.7` and then at `v1.8.9`. The script splits
`docs/modelcontextprotocol-io` and squash-pulls the result into
`docs/registry/`. `npm run prep` passes, link check included.

The `v1.8.9` pull adds two upstream changes. Since `v1.8.8` several
server names can share one remote URL
(modelcontextprotocol/registry#1806), which replaces the sentence at
remote-servers.mdx L41. The aggregators page gains an "Efficient
synchronization" section (modelcontextprotocol/registry#1798).

A later run of the script was tested against a single squash commit that
carries these trailers. It merged cleanly and changed only
`docs/registry/`.

## Conflict resolutions

Three files conflicted in the `v1.8.7` pull. In each case upstream had
added content next to a line that a local commit had also touched, and
upstream already carried the local change, so upstream's side was taken.
The `v1.8.9` pull had no conflicts.

- `github-actions.mdx`: new troubleshooting row for the `"invalid
audience"` error.
- `package-types.mdx`: new paragraph on the `mcp-name:` token boundary,
placed before the Cargo section that both sides carry identically.
- `quickstart.mdx`: the npm account prerequisite reworded to apply to
package-based servers only.

## Local commits since January

All six are carried by upstream, so nothing needs to go upstream.

- 5abdf44 removed `.mdx` suffixes from internal links. Upstream did the
same in modelcontextprotocol/registry#1052, and no suffixed links remain
there.
- 31dae91 pointed the server.json schema link at
`draft/server.schema.json`. Upstream has it from
modelcontextprotocol/registry#884.
- 91dcd51 added the SSE deprecation note to remote-servers. It was
superseded locally by 85bbf0e.
- 85bbf0e set the final SSE deprecation wording. Upstream has the
identical sentence from modelcontextprotocol/registry#1590.
- 0d17c43 changed `PyPi` to `PyPI` in the FAQ. Upstream has it at
faq.mdx L55.
- c0b3579 added the Cargo (Rust) package type section. Upstream has the
identical section from modelcontextprotocol/registry#1207 and
modelcontextprotocol/registry#1331.

## Upstream follow-ups for the registry repo (not fixed here)

1. `authentication.mdx` contradicts itself on stale DNS records. L81
says a stale TXT record left behind "will be tried first and cause
verification to fail". L404 says the registry tries all published keys
and a different key in another record does not take precedence. The code
agrees with L404: `VerifySignatureWithKeys` in
`internal/api/handlers/v0/auth/common.go` accepts the first matching key
and fails only when none match.
2. `quickstart.mdx` L130 and L134 install `mcp-publisher` from
`releases/latest`, while `github-actions.mdx` L14-17 tells readers not
to use that URL. The three workflow examples in `github-actions.mdx`
(L35, L115, L191) pin `MCP_PUBLISHER_VERSION: v1.8.1`, behind the
`v1.8.9` tag.
3. `registry-aggregators.mdx` L78 still says a `"deleted"` status
typically indicates a moderation takedown. Since publisher-managed
deletion (modelcontextprotocol/registry#893) publishers set that status
themselves. `moderation-policy.mdx` also needs attention. Neither
passage has changed upstream.

This PR was drafted with AI assistance (Claude Code).

git-subtree-dir: docs/registry
git-subtree-split: 5d7060497a1d4535dc448dd56ec699ea03c89efd

---------

Co-authored-by: Claude <[email protected]>
Co-authored-by: David Soria Parra <[email protected]>