[Schema][Server] Close the 2026-07-28 conformance gaps

[chr-hertel]

Stacked on feature/2026-07-28 (#2). Closes the gaps an audit of the branch against
schema/2026-07-28/schema.ts and the 2026-07-28 spec docs turned up.

Full findings, evidence and what is left: spec-report.md.

Bugs

	Summary
High	ClientGateway's six supports*() probes returned false for every stateless request — the session key they read is only written by InitializeHandler
High	resources/subscribe / resources/unsubscribe still dispatched and answered 200 OK
High	Mcp-Name compared without Base64-sentinel decoding, refusing any non-ASCII resource URI with -32020
High	A missing MCP-Protocol-Version header was accepted
Medium	-32002 emitted where the revision forbids it; unknown tool answered -32601
Medium	Notification POST answered with a JSON-RPC error carrying "id": "" instead of 202
Medium	Request body taken from one read(), truncating chunked transfers into -32700
Low	-32021 only reachable from tools/call

Features

• Request-scoped SSE streaming — progress and per-request logLevel work; the stream opens after the handler's first suspension so -32021/-32602 keep their required statuses.
• subscriptions/listen delivery — NotificationBusInterface with in-memory and PSR-16 implementations; PHP-FPM needs the latter, since publisher and stream are different workers.
• Tasks (SEP-2663) — schema, two stores, tasks/* surface, capability gating.
• Extensions framework (SEP-2133) — identifier validation, message-class registration, method claims.
• MRTR completion, CachePolicy, W3C trace context, x-mcp-header nesting + validation, $ref SSRF and composition-DoS bounds, SEP-2577 deprecation tags.
• docs/stateless-lifecycle.md and an examples/server/stateless-lifecycle example.

Verification

	Before	After
make conformance-draft-server	138 / 3 failed	143 / 2 failed, baseline clean
make conformance-server	39/39	39/39
Unit	1222	1421
Integration	33	43
Inspector	97	103
PHPStan	7 pre-existing	7 pre-existing

The nine tasks-* conformance scenarios run at 36/44 — every remaining failure is the runner applying the
core schema to an extension result, which has no resultType: "task".

The Inspector cannot drive a 2026-07-28 server (it opens with initialize), so the new example is covered by
tests/Integration/StatelessLifecycleTest.php over real HTTP instead. MCP Apps did get snapshots — which
surfaced that its example was broken over HTTP entirely, the only one without a session store.

Worth a look

• Two error-code fixes change codes for handshake-era clients too (prompts/get and tools/call for unknown
  names). Marked [BC Break]; the spec has said -32602 since 2025-06-18. Only resources/read is
  version-gated.
• The auth track is shaped differently from the issue list: five of the seven 2026-07-28 auth items are
  rules for an OAuth client this SDK does not have yet ([Client] Add OAuth 2.0 credential storage interface (TokenStorageInterface) modelcontextprotocol/php-sdk#315–[Client] Implement Cross-App Access (token exchange, RFC 8693) modelcontextprotocol/php-sdk#325). [Server][Auth] SEP-2207: Audit PRM to ensure offline_access is not advertised as a required scope modelcontextprotocol/php-sdk#364 had nothing to fix and is pinned
  by test. See §3.2 of the report.

[chr-hertel]

Closing: this was a tracking PR for the 2026-07-28 audit, and the work has all landed or moved on.

Rebasing the branch onto current main leaves 10 files, none of them recoverable work:

• Merged upstream. 91 of the branch's 155 files are byte-identical on main; the rest landed reworked across Tighten the 0.8.0 CHANGELOG section modelcontextprotocol/php-sdk#431–chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 modelcontextprotocol/php-sdk#483. Where they differ, main is the newer version — McpHeader::checkAnnotations() ([Schema] Refuse an invalid x-mcp-header annotation at definition time modelcontextprotocol/php-sdk#441) took over Tool's annotation checks, StandardHeaderValidator's numeric compare gained the "042"/"4e1" guards, RequestMeta::fromParams() gained header trace context ([Server][Client] Bridge W3C trace context between HTTP headers and _meta (SEP-414) modelcontextprotocol/php-sdk#473), and SchemaGenerator gained union splitting and InjectableParameters ([Capability] Stop a union type losing a branch modelcontextprotocol/php-sdk#434, [Server] Keep injectable parameters out of the published inputSchema modelcontextprotocol/php-sdk#482).
• Carved out, still open. Tasks (SEP-2663) → [Schema][Client][Server] Add the Tasks extension (SEP-2663) modelcontextprotocol/php-sdk#428. SchemaComplexityGuard + its SchemaValidator wiring (SEP-2106) → [Capability] Bound what a schema can cost to validate (SEP-2106) modelcontextprotocol/php-sdk#436, which carries a newer guard than this branch had.
• Superseded. MethodProvidingExtensionInterface was folded into ExtensionInterface + AbstractExtension ([Schema][Server] Add the extensions framework SEP-2133 defines modelcontextprotocol/php-sdk#443); the Thing* test fixtures moved to tests/Unit/Server/Extension/; docs/stateless-lifecycle.md was split into docs/run/protocol-eras.md, docs/handlers/input-required.md, docs/run/caching.md and docs/run/subscriptions.md ([Docs] Render the guides with Zensical instead of phpDocumentor modelcontextprotocol/php-sdk#414).
• spec-report.md was scaffolding for tracking this across PRs and is not needed now.

The report's §3 open items are the only thing outliving the branch, and each has an upstream home: MCP Apps ergonomics (modelcontextprotocol#351/modelcontextprotocol#352), the auth findings (five of the seven 2026-07-28 items are constraints on a client-side OAuth that does not exist yet — modelcontextprotocol#315–modelcontextprotocol#325), anyOf for a union of two array shapes (modelcontextprotocol#356), and conformance SEP traceability (modelcontextprotocol#367/modelcontextprotocol#368).

Branch tips, if any of this needs to come back: pre-rebase 87b40ce, rebased fdc4eae, decomposed 679a227 / ddf2518.