[MCP 2026] Build requirement traceability and cross-era conformance harness

[xizhibei]

MCP 2026 Program child of #459

Stage: Foundation
Workstream: Conformance
Target release: Compatibility minor
Blocked by: none

Purpose: create the independent release evidence foundation before production
behavior changes.

Scope:

• pin conformance 0.2.0-alpha.11 and frozen 2025-11-25/2026-07-28 requirements;
• add TypeScript v2, TypeScript v1, server-legacy, and Python fixture drivers;
• implement all four era pairings and required transport profiles;
• capture and schema-validate both gateway hops;
• create the machine-validated Requirement Traceability Manifest; and
• add local scenarios for official subscription, stdio, raw HTTP, header, schema,
  legacy replay, and gateway gaps.

Out of scope:

• production adapter behavior;
• Tasks; and
• expected-failure waivers for scored requirements.

Owning surfaces:

• new conformance and test fixture directories;
• Vitest E2E/conformance configuration; and
• CI conformance lane.

Acceptance:

• client and server requirements execute for both canonical revisions and produce classified product verdicts;
• baseline mode may record product-red compatibility gaps, while gate mode requires a green product verdict;
• all five retained legacy revisions have version-applicable fixtures;
• every matrix cell has three peer variants;
• no traceability mapping is missing or stale;
• first-attempt results are preserved with retries disabled; and
• sanitized machine-readable evidence is produced for an exact SHA.

Verification:

• add and run a dedicated pnpm test:conformance command;
• run focused E2E transport lanes; and
• run traceability-manifest validation.

Ready condition: compatibility owner approves fixture pins, manifest schema, and
wire-capture privacy.

---

Planning umbrella: #459

[xizhibei]

This was generated by AI during triage.

Agent Brief

Category: enhancement
Summary: Establish the exact-pinned MCP 2026 dual-era conformance and traceability foundation before production protocol behavior changes.

Current behavior:
The Aggregated Runtime uses the monolithic TypeScript MCP SDK v1 and has broad unit and E2E coverage for legacy HTTP, SSE, Streamable HTTP, stdio, lifecycle, OAuth, and capability behavior. Those tests are not a protocol conformance system: the E2E configuration retries failures once, there is no official conformance runner dependency or dedicated conformance command, peer fixtures do not cover both protocol eras, and there is no Requirement Traceability Manifest or Sanitized Wire Evidence for both gateway hops.

Desired behavior:
Add a hermetic Conformance Harness that pins the accepted official requirements and released peer fixtures, exercises the complete inbound/upstream protocol-era matrix, and produces machine-validated exact-source evidence. Harness readiness is distinct from product conformance: this foundation may close when the harness correctly records a deterministic red Conformance Baseline for modern behavior that later issues must implement. These failures remain ordinary blocking product failures, not expected-failure entries, skips, or waivers. The Stage 1 release gate must run the same evidence in gate mode and require a green product verdict.

All fixtures must use repository-owned synthetic inputs, loopback networking, temporary Runtime Scopes, controlled clocks/randomness, test CAs and OAuth servers, and owned subprocesses. Public services, mutable endpoints, live credentials, and user configuration are forbidden. Sanitized Wire Evidence must be allowlisted and redacted before persistence; it may retain protocol revision, method, structural envelope/header facts, correlation facts, schema-validation results, bounded sizes, and fixture identities, but must not retain authorization/cookie values, OAuth codes or tokens, secret-bearing request metadata, raw tool arguments/results, environment values, or user paths/configuration.

Key interfaces:

• Conformance Harness: supports explicit baseline and gate verdict modes. Both modes fail on harness, fixture, manifest, schema-validation, or evidence-integrity defects. Baseline mode may emit a red product verdict without treating known missing behavior as a waiver; gate mode fails whenever the product verdict is red.
• Fixture Driver: identifies its client/server role, modern/legacy era, protocol revision, transport profile, exact package/release version and integrity, startup contract, and produced evidence. Pin @modelcontextprotocol/conformance@0.2.0-alpha.11, TypeScript split SDK/server-legacy 2.0.0, TypeScript monolithic SDK 1.30.0, Go SDK 1.7.0, and Python SDK 2.0.0.
• Requirement Traceability Manifest: a versioned Zod-validated schema mapping each applicable normative MCP requirement and accepted 1MCP contract to its source revision and strength, applicability or classified exclusion, delivery stage, matrix cells, peer roles/versions, transport profiles, stable test IDs, evidence artifact IDs, and fixture/source digests.
• Sanitized Wire Evidence: schema-validates the inbound and upstream gateway hops independently under their negotiated eras. Redaction/allowlisting happens before records enter an artifact buffer, logger, reporter, or failure message.
• Conformance Baseline: binds the source SHA, requirement revisions, dependency/fixture integrity, first-attempt outcomes, product verdict, and sanitized evidence digests. Unsupported behavior must be a deterministic failing result linked to the downstream implementation issue, never an xfail or unclassified skip.
• test:conformance: a dedicated package command and CI lane separate from retry-enabled general E2E. Conformance execution disables automatic retries and preserves first-attempt results.

Acceptance criteria:

• Exact pins and integrity are enforced for conformance 0.2.0-alpha.11, the tagged MCP 2026-07-28 specification, frozen 2025-11-25 and 2026-07-28 requirement sets, and all five released peer fixtures; moving dist-tags or branches cannot influence evidence.
• Official client and server conformance drivers self-validate against both canonical requirement sets, while local version-applicable fixtures also cover 2025-06-18, 2025-03-26, 2024-11-05, and 2024-10-07.
• All four inbound/upstream modern/legacy cells are enumerated, and each cell has a TypeScript baseline, a Go-or-Python inbound variant, and a Go-or-Python upstream variant.
• Required profiles cover modern and legacy inbound Streamable HTTP, retained inbound HTTP+SSE, direct serve stdio, proxy stdio, modern and legacy upstream Streamable HTTP, retained upstream SSE, and modern and legacy upstream stdio.
• The manifest validator rejects missing or stale test IDs, missing normative or accepted-contract mappings, unclassified skips, required behavior exercised on only one era, and source/fixture/evidence digest mismatches.
• Baseline mode completes with an infrastructure-green/product-red result for currently unsupported modern gateway behavior; deliberate harness or fixture defects make the infrastructure verdict fail. Gate mode fails for the same red product verdict.
• Unsupported product behavior is represented by deterministic failing outcomes linked to downstream implementation work, with no expected-failure waiver for scored or normative requirements.
• Both gateway hops are captured and schema-validated independently, and an adversarial synthetic corpus proves forbidden headers, tokens, credentials, metadata, arguments/results, environment values, and paths appear in no retained artifact, log, report, or failure output.
• Conformance runs disable retries, preserve first-attempt outcomes, bind artifacts to the exact source SHA, and produce deterministic machine-readable evidence and digests.
• The dedicated conformance command, focused transport lanes, manifest validator tests, redaction/property tests, and CI conformance lane all pass for the foundation contract.

Out of scope:

• Production modern inbound/outbound adapters, SDK-boundary migration, capability activation, and protocol translation behavior owned by later MCP 2026 issues
• MCP Tasks and its lifecycle, persistence, Admin, or packaging surfaces
• Release publication, canary, rollback, and exact-SHA artifact pipelines owned by release issues
• Live product accounts, public services, production credentials, or user configuration
• Expected-failure waivers for scored or normative requirements

[xizhibei]

Scope update: the Go peer fixture was removed after reviewing its marginal legacy-only coverage against PR cost. TypeScript v1/v2 plus Python still provide three variants for every era cell. PR #514 at a30516f is reduced from 293 files / 74,304 additions to 60 files / 11,688 additions, with exact-SHA baseline and gate semantics unchanged.