mcp: serve current 2026-07-28 stateless protocol without dropping legacy clients

[seonghobae]

Buyer / interoperability gap

Protected main@83eba56149eb802cd63642c507c324c9976ec78e already pins the official Python MCP SDK mcp==2.0.0, but LineageWeave's executable MCP client/acceptance contract still hard-codes the handshake-era 2025-11-25 path: initialize / notifications/initialized, Mcp-Session-Id, and no server/discover or modern request path.

The official MCP 2026-07-28 specification is now current. It removes protocol-level handshake/session state, makes every request self-describing, introduces optional server/discover, and requires Mcp-Method / Mcp-Name routing headers over Streamable HTTP. The official Python SDK v2 supports 2026-07-28 and earlier revisions simultaneously from the same streamable_http_app(), so this does not require a LineageWeave-local protocol fork or removal of legacy compatibility.

This is an interoperability/operability gap, not a reason to copy MCP implementation or contextual-orchestrator functionality into LineageWeave.

Existing authority to preserve

• ADR 0218 owns the authenticated Global Ask MCP boundary and remains the product decision authority until a superseding Proposed ADR is reviewed.
• submit_global_ask / read_global_ask_job must continue to delegate to the same durable application-service contract as REST; MCP must not compute a second answer.
• Keyverse OAuth audience/scope, exact Host/Origin admission, request-byte framing, Valkey per-principal quota, PostgreSQL evidence authorization, and contextual-orchestrator boundaries remain unchanged.
• The pinned official mcp SDK is the protocol implementation owner. Do not hand-roll a second MCP parser/router where the released SDK already supports the current protocol.
• Legacy 2025-11-25 clients remain supported through the SDK's dual-era compatibility during the upstream deprecation window; do not break them merely to make the modern tests pass.

Realistic RED → GREEN acceptance

1. RED current protected contract: a modern 2026-07-28 authenticated request to the existing MCP app is exercised without initialize / Mcp-Session-Id. The test must fail on the current LineageWeave client/acceptance assumptions rather than on an invented mock protocol.
2. Add an explicit modern interoperability contract using the released SDK behavior: server/discover succeeds where applicable; a direct tools/call request carries protocol/client/capability metadata and the required routing headers, and reaches the same durable Global Ask tools without transport session state.
3. Preserve a separate legacy regression proving a 2025-11-25 client can still initialize, receive/use Mcp-Session-Id, and call the same tools. Do not conflate the two eras.
4. Modern requests must not require sticky routing or a shared MCP session. Prove two sequential authenticated modern tool requests can be served without a transport session identifier and without loss of application-level ownership/authorization.
5. Keep JSON-RPC response identity/protocol validation fail-closed in load/acceptance tooling. A response with the wrong/missing id, wrong protocol envelope, or both result/error must never be attributed to the current observation; response content remains absent from diagnostics.
6. Keep Host/Origin/OAuth/body-admission/rate-limit order unchanged. Add modern-header allow/expose handling only where the official SDK/spec requires it; do not broaden CORS origins or authorization.
7. Update scripts/k6_mcp_e2e.js so load evidence can exercise the modern stateless path. Legacy-path k6 may remain as a separate explicitly named compatibility lane if useful; do not silently call the legacy handshake the current protocol.
8. Measure authenticated modern MCP submit/read buyer-path latency with realistic PostgreSQL/Valkey/Keyverse dependencies. Record p95 and profile if an applicable synchronous boundary exceeds 20 ms; do not shrink samples or hide cold/error paths to meet the target. Multi-minute Global Ask orchestration remains asynchronous and outside transport latency.
9. Update ADR/doctoring/ARCHITECTURE/OPERABILITY/TEST_STRATEGY and docs/product-technical-gap-baseline.md with a code-current dual-era boundary. Keep the decision Proposed while unmerged and cite current authoritative MCP sources in APA 7th form.
10. Exact-head tests/security/SAST/CodeQL, authenticated PostgreSQL acceptance, reproducible dependency lock, and qualifying independent review must be fresh before normal merge. No self-approval, gate weakening, force push, or predecessor evidence transfer.

Standards / released dependency evidence

• Model Context Protocol. (2026, July 28). The 2026-07-28 specification. https://blog.modelcontextprotocol.io/posts/2026-07-28/
• Model Context Protocol Python SDK. (2026). What's new in v2: The protocol: 2025-11-25 to 2026-07-28. https://github.com/modelcontextprotocol/python-sdk/blob/main/docs/whats-new.md
• PyPI mcp==2.0.0 was released 2026-07-28 as the stable v2 line and explicitly supports the 2026-07-28 specification and every earlier revision.

Scope boundary

This issue owns current-protocol interoperability and transport acceptance only. It does not expand Global Ask semantics, add a LineageWeave-local LLM/provider path, replace Keyverse, duplicate canonical MCP SDK code, or absorb #269's separate browser/request-byte/rate-limit product slices. If implementation discovers an upstream SDK defect, reduce it to an owner-path reproduction and repair/upgrade the released dependency rather than forking protocol behavior locally.

[seonghobae]

Stack boundary after fresh review: #964 currently owns the same scripts/k6_mcp_e2e.js response-confidentiality / JSON-RPC identity surface on exact 2fd2f49d68b0faff5eb33b05fbb5c4dc0725a413. Implement #965 from protected main only after that valid parser delta is merged or explicitly reconstructed into a successor; do not create a competing k6 parser branch that drops #964's realistic wrong/missing-id and result/error regressions. The server-side modern-protocol work can be designed independently, but any product PR must preserve #964's valid tests/fix by ordinary ancestry/convergence.