2026-07-28 spec support — tracking #2891

Umbrella for the 2026-07-28 release work. Bar: the conformance suite passes with no expected-failures waivers attributable to this release (the SEP-990 enterprise-auth waiver is unrelated and remains). Each sub-issue lists the scenarios it's responsible for; design is owned by whoever takes the issue.

This sits alongside the broader v2.0 SDK rework tracked in #1253 — that umbrella covers SDK-ergonomics breaking changes; this one covers spec compliance for the 2026-07-28 protocol revision.

What's in it

• Sub-issues:
  • Backwards compatibility & version negotiation #2892
  • New HTTP serving path (modern + dual-era) #2893
  • New Client (all-versions, low-level + high-level) #2894
  • Context object (layered, per-request) #2895
  • Capabilities API + server/discover handler #2896
  • MCPServer as a thin composition of the 2026 helpers #2897
  • MRTR (multi-round-trip requests) #2898
  • Caching hints (ttlMs / cacheScope) #2899
  • HTTP standard headers + x-mcp-header #2900
  • subscriptions/listen #2901
  • Auth — 2026 client-side requirements #2902
  • SEP-2106 — JSON Schema 2020-12 + structuredContent #2903
  • Spec corrections & deprecation markers #2904
  • Test foundations (safety nets) #2905
• Architecture (direction, not law): lowlevel Server = protocol interface, minimal state, no magic. The 2026 features ship as public helpers/classes usable directly against lowlevel Server. MCPServer is a thin composition of those same public helpers — a pre-built convenience, not a monolith with private machinery.
• Capability checkpoints (shared targets, not tickets):
  • M1 — a modern client makes a stateless tools/call against a modern server over HTTP, no initialize (minimum slice of Backwards compatibility & version negotiation + New HTTP serving path (modern + dual-era) + New Client (all-versions, low-level + high-level))
  • M2 — the server-stateless conformance scenario passes end-to-end (Backwards compatibility & version negotiation + New HTTP serving path (modern + dual-era) + Context object (layered, per-request) + Capabilities API + server/discover handler + subscriptions/listen all in)
  • M3 — all release-attributable waivers gone
• Landing model: PRs land to main. 2026-07-28 stays modeled-but-not-negotiable until the version-negotiation work flips it on, so partial work doesn't change behaviour for existing users.
• Standing maintenance (not a sub-issue): when bumping the conformance pin, reconcile expected-failures.yml in the same PR; when in-flight spec PRs merge, re-vendor schema/2026-07-28.json + regenerate.
• Stretch (optional): contribute missing scenarios upstream — discover caching-hints check, dedicated subscriptions/listen server scenario, client-direction sessionless scenario.

Conformance

• (all release-attributable waivers removed across the sub-issues)

Dependencies

• Depends on: none

References

• Draft changelog
• Draft schema
• Conformance suite
• python-sdk expected-failures