conformance: sep-2640.yaml is pinned at a retired SEP revision — 7 of 30 rows test requirements that no longer exist #1335

Summary

src/seps/sep-2640.yaml in the conformance fork is pinned at SEP commit 556154c (extracted 2026-06-05, with a forward reference to 2e04c48d for resources/directory/read). The file carries a deliberate in-file note to hold there "until #780 lands". The 2026-08-21 SEP rewrite makes that pin actively wrong rather than merely behind.

Counting the 30 requirement rows against the current sep/skills-extension branch text.

7 rows now assert requirements the SEP does not contain

• sep-2640-server-expose-index — skill://index.json appears zero times in the current text.
• sep-2640-index-entry-type-enum — the entry type field is gone along with archives.
• sep-2640-archive-format
• sep-2640-host-support-archive-formats
• sep-2640-archive-skillmd-at-root
• sep-2640-archive-no-traversal
• sep-2640-host-archive-safety

Archives were removed by the core maintainers during review and now live in "Appendix: Deferred Features".

4 rows changed meaning

• sep-2640-index-name-required — entries carry a verbatim frontmatter object, not a top-level name.
• sep-2640-index-digest-required — the digest moved into resources[].
• sep-2640-host-no-empty-index-assumption — now about empty or partial skills/list results, not an absent index resource.
• sep-2640-host-verify-digest — strengthened. A read of a URI not listed in resources, and a read whose byte length differs from the entry's size, are each verification failures.

19 rows survive

The SKILL.md format and URI rows, plus all six resources/directory/read rows. Directory read survived the rewrite behind the same directoryRead capability gate, though the SEP now scopes its purpose to dynamic skills, non-skill resource trees, and refreshing a server's current view.

Roughly 23 new requirement families have zero coverage

• skills/list: method, entry shape, pagination with atomic entries, ttlMs and cacheScope on protocol 2026-07-28+, empty-or-partial listings permitted, hosts MUST NOT read a listing as proof of no skills.
• skills/get: method, and that it serves skills absent from the listing.
• Entry schema {frontmatter, uri, resources}, all three required.
• resources completeness, the "dynamic" sentinel, and the invalid-entry rule (hosts MUST NOT load).
• resources[].size required, and size mismatch as a verification failure.
• Limits: 512 entries and 16 MiB per skill.
• Hosts MUST NOT prefetch, not on connection, listing, or approval.
• Host MUST compare fetched SKILL.md frontmatter field-by-field against the entry.
• Content-bound approval and its revocation when the resources set changes.
• The "acting on a skill" window, and unlisted-URI reads within it.
• Skill identity is (server, uri).
• Disk caches write-isolated or re-hashed on every read.

Backing scenarios

The split runs through them too. manifest.ts and directory.ts largely survive. index.ts tests the removed skill://index.json resource end to end and needs retiring or rewriting against skills/list.

Proposed work

1. Delete the 7 dead rows, retire or rewrite index.ts.
2. Reword the 4 changed rows.
3. Add rows for the new surface, split into wire-observable (methods, pagination, entry schema, resources shape, size, limits, capability declaration) and traceability-only (host caching, approval binding, context-window behavior), following the existing excluded: convention for the host-internal ones.
4. Add a capability-declaration row asserting the settings object sits inline under the extension identifier per SEP-2133. The current check accepts both shapes, which is why core: extension capability declaration wraps settings in a 'config' envelope; SEP-2133 (Final) specifies them inline #1334 went unnoticed.
5. Re-extract file-level provenance at the CM-stamped head and drop the "hold until ext/skills: align Indexer + IndexEntry + Catalog with the final SEP-2640 index schema (WG shape pending) #780" note.

Sequencing

Wait for the CM vote to close, expected around 2026-09-01, then re-extract in one pass rather than chasing the branch. Depends on #1333 for the server-side surface to test against.

Rebuild the ../conf-skills dist after any branch bump or the runner keeps executing the old scenarios.

Upstream PR: modelcontextprotocol/conformance 330, currently OPEN and REVIEW_REQUIRED, last updated 2026-08-04.