# Known issues
> Confirmed connection and signup email problems, tested recovery steps, and what remains unresolved. Last checked September 15, 2026 (UTC).
## KI-001 · Connection fails with invalid_scope
Status: Provider scope fix verified September 15, 2026 at 01:32 UTC. The default Codex client now passes fresh authorization and immediate token renewals. Native recovery after a future expiry or restart remains under investigation in KI-002.
You may see “The OAuth 2.0 Client is not allowed to request scope 'user:org:read'” while connecting or reconnecting Arch Studio. The connection may appear enabled while its tools are unavailable.
Affected path: the production hosted MCP through local Codex configuration, including desktop sessions that use that same configuration. Fresh authorization with the automatic Codex client reproduced the error. The standalone local plugin does not use this MCP OAuth connection.
The automatic client was missing permission to request organization membership information. That permission has now been corrected in production. Retry the normal authorization flow once, select the intended firm, and ask the assistant to check Arch Studio status. Users do not need to change their firm membership or reinstall the plugin.
The explicit-client fallback below remains available if normal authorization still fails. A working fallback connection can stay configured. It applies only to local Codex MCP configuration. Hosted ChatGPT web uses a different connection path: do not paste this loopback callback into its connector settings. This failure has not been reproduced on Claude; keep a working Claude connection as it is.
## Fallback: update the existing local connection
Open your existing Codex configuration, normally ~/.codex/config.toml. Keep a backup and merge the OAuth settings below into the existing Arch Studio server entry. Do not replace the whole file or create duplicate TOML sections.
This example uses the server name arch_studio. If yours has another name, use that same name in both table headers and in the login command in the next step. The endpoint must be https://mcp.architecturestudio.ai. This configuration is for production, not a staging server.
The client ID is public; no client secret is required. Port 58687 must be free while signing in. If it is occupied or your app does not support these settings, stop and ask for support rather than choosing an unregistered callback.
```toml
[mcp_servers.arch_studio]
enabled = true
url = "https://mcp.architecturestudio.ai"
[mcp_servers.arch_studio.oauth]
client_id = "KwcbrbiJQb5xQEyw"
callback_url = "http://127.0.0.1:58687/callback"
callback_port = 58687
```
## Authorize and verify
Run this command in your terminal, using your existing server name. Complete sign-in and select the intended firm. Reopen the affected app or session, then ask “Check Arch Studio status.”
Recovery is verified when the assistant can call as_status and receive a release result. An enabled setting or a successful website sign-in alone is not proof that MCP tools loaded. If the same error remains, use the support steps below.
```sh
codex mcp login arch_studio --scopes openid,profile,email,offline_access,user:org:read
```
## What we verified
The explicit-client configuration restored an affected local connection, and its native AS status call succeeded. A separate test-account grant also completed sign-in, two consecutive token renewals and three authenticated AS status calls with organization context preserved.
After the provider scope correction, the automatic Codex client also passed a fresh authorization-code exchange, two rotating refresh-token exchanges and three authenticated AS status calls with organization context preserved. This verifies the reported scope failure at the protocol level. A clean native installation, renewal after natural expiry and restart, and the hosted ChatGPT web path remain unverified. No MCP redeploy was required.
## KI-002 · A previously working connection loses authorization
Status: Investigating — reauthorization recovered the observed connection. Last checked September 15, 2026 (UTC).
An observed desktop connection failed to renew an expired access token with invalid_grant / “refresh token malformed or not valid,” and its tools became unavailable. The reason that stored refresh token became invalid is not established.
Try the host’s reconnect or authorization flow once. In local Codex, run codex mcp login with your existing server name. If it then fails with invalid_scope for user:org:read, follow KI-001 above. Hosted ChatGPT users should use their host’s reconnect controls rather than the local configuration.
If the error returns after reauthorization, report the host, version, approximate failure time and sanitized error. Do not repeatedly reinstall, delete credential stores, or assume that a successful immediate renewal proves recovery after a future app restart.
- [KI-001: scope workaround](https://architecturestudio.ai/docs/known-issues#connection-scope)
## KI-003 · Norma welcome email does not arrive
Status: Signup email repair verified September 15, 2026 (UTC). A personal account received its welcome and a same-thread reply from Norma. The release opens eligibility beyond the former internal pilot. A separate server error in internal signup notices was also repaired and verified with an inbox delivery and a duplicate-event check.
Hosted email support requires a verified account email and membership in a firm. Complete the existing sign-up flow and select your intended firm. A personal email address can qualify when it belongs to a verified account with firm membership. Do not create a second account to retry a missing welcome.
After signing in, open Your firm and use Start with Norma to choose the intended firm and release a waiting welcome. This does not resend an existing welcome or create one for every historical account. If firm selection is blank or stuck during sign-in, use Restart sign-in when shown and complete the firm step again. That recovery was tested; the cause of the blank provider screen remains under investigation.
Check spam and look for mail from norma@architecturestudio.ai. If no welcome arrives, use the support contact below with your approximate signup time and mention KI-003. Do not send passwords, sign-in codes, tokens or full authorization links. Support must check eligibility and delivery before retrying; a successful signup or webhook response alone does not establish inbox delivery.
A missing welcome does not establish an MCP connection failure. You can continue with the installation guide and authorize Arch Studio in your assistant. Norma may request account confirmation when your email reply needs additional verification.
- [Your firm](https://architecturestudio.ai/profile/firm)
- [Support channels](https://architecturestudio.ai/contact)
- [Installation guide](https://architecturestudio.ai/docs/install)
## Get help with a connection
Tell Norma which assistant and surface you use (desktop, browser or CLI), whether this is hosted MCP or the local plugin, the exact sanitized error, and the step that failed. Mention the matching issue ID.
If Arch Studio tools are unavailable, your host assistant can still read this public page. You do not need a working MCP connection to read the workaround. Never send access tokens, refresh tokens, client secrets, authorization codes, or complete callback URLs.
Norma should match the error and host before offering a workaround, explain what is verified and what remains open, and ask you to complete sign-in. Email support can explain the steps; it cannot edit your local configuration or verify a live connection on your behalf. An issue is resolved only after the relevant connection path passes verification.
- [Installation guide](https://architecturestudio.ai/docs/install)
- [Support channels](https://architecturestudio.ai/contact)
- [Official Codex MCP configuration](https://learn.chatgpt.com/docs/extend/mcp?surface=cli)