Files
Rohit Ghumare ed6d0c0196 feat: add agent skills track and stateless MCP curriculum (#422)
* feat(phase-13/22): teach portable agent skill contracts

Agent skills need a portable contract before host-specific metadata and runtime policy can be reasoned about.

* fix(phase-13/23): make the ecosystem capstone accurate

The capstone should model current A2A operations, portable artifact metadata, and deterministic trace timing.

* feat(phase-13/24): teach skill discovery and disclosure

A useful skill catalog needs explicit scope precedence and bounded progressive disclosure before instructions are loaded.

* feat(phase-13/25): teach invocation policy and routing

Human, model, application, and skill activation need separate policy decisions before relevance ranking can be trusted.

* feat(phase-13/26): teach skill sandbox and trust boundaries

Skill instructions are untrusted input, so authority must remain host-owned and every filesystem, network, and command boundary must fail closed.

* feat(phase-13/27): add the skill release gate

A distributable skill needs adversarial structure, routing, safety, artifact, provenance, installation, and portability evidence before release.

* feat(skills): install and render complete skill bundles

Progressive-disclosure skills must keep companion references, scripts, assets, and evals intact across discovery, installation, and lesson rendering.

* docs(curriculum): index the agent skills mini-course

The expanded Phase 13 sequence needs consistent lesson links, durations, translations, and shared terminology across every learner entry point.

* feat(certification/11): teach stateless MCP integration

Certification learners need the same stateless wire model as the production curriculum.

* feat(phase-11/14): modernize MCP protocol contracts

The foundational MCP lesson must no longer teach the removed session lifecycle.

* fix(phase-13/01): align tool terms with stateless MCP

The tool interface introduction should point to the current protocol vocabulary.

* feat(phase-13/06): teach stateless MCP fundamentals

Learners need the current per-request contract before building clients or servers.

* feat(phase-13/07): build a stateless MCP server

The server lab should model the protocol that new implementations actually ship.

* feat(phase-13/08): build a stateless MCP client

The client lab must negotiate every request without relying on session state.

* feat(phase-13/09): teach current Streamable HTTP

Transport examples need the current POST-only lifecycle and notification behavior.

* feat(phase-13/10): teach stateless resources and prompts

Resource and prompt discovery must reflect stateless cache and result contracts.

* feat(phase-13/11): teach per-request sampling

Sampling calls must carry current capabilities and stateless response semantics.

* feat(phase-13/12): teach roots and elicitation retries

Elicitation retries and roots handling need current capability and MRTR boundaries.

* feat(phase-13/13): teach stateless MCP tasks

Task storage and subscriptions must survive cross-instance stateless requests.

* feat(phase-13/14): update MCP Apps contracts

Apps learners need current bridge, subscription, and discovery boundaries.

* feat(phase-13/15): update MCP threat boundaries

Threat modeling must cover current routing and MRTR state boundaries.

* feat(phase-13/16): update MCP OAuth contracts

OAuth examples must bind issuers and resources while using current errors.

* feat(phase-13/17): update gateway and registry contracts

Registry admission must separate publication identity from runtime discovery.

* feat(phase-13/18): teach production MCP authentication

Production auth should implement real PKCE, CIMD, and resource-bound caching.

* docs(phase-13/22): add a runnable skill quickstart

Beginners need an exact repository-root path from bundle inspection to host use.

* fix(phase-13/23): make the capstone stateless

The ecosystem capstone must compose the same current contracts taught upstream.

* docs(phase-13/24): clarify host discovery limits

Learners should distinguish known context budgets from host fallback behavior.

* docs(phase-13/26): clarify sandbox prerequisites

The safety lab needs explicit prerequisites and a viable conceptual fallback.

* docs(phase-13/27): add real-host release evidence

A production claim should require installed-host evidence beyond deterministic fixtures.

* docs(phase-16/02): update MCP legacy comparison

The interoperability comparison should use the current stateless MCP lifecycle.

* feat(phase-19/13): modernize the MCP registry capstone

The production capstone must separate Registry publication from stateless runtime discovery.

* docs(curriculum): index agent skills and stateless MCP

Learners need one coherent route through the skills track and current MCP sequence.

* feat(skills): add a focused agent skills learner path

A dedicated route removes placement and navigation friction for focused learners.

* feat(mcp): add production engineering track

* fix(cert-11): harden MCP integration contract

* fix(phase-11-14): classify MCP handler failures

* fix(mcp-07): validate JSON-RPC request identifiers

* fix(mcp-08): reuse strict response decoding

* fix(mcp-09): harden HTTP transport boundaries

* fix(mcp-11): isolate returned tool descriptors

* fix(mcp-12): make continuation state single-use

* fix(mcp-14): align lesson response metadata

* fix(mcp-15): expire and consume continuation state

* fix(mcp-16): bind OAuth enrollment and code exchange

* fix(mcp-18): enforce redirect and code lifetimes

* fix(mcp-23): validate task identifiers

* fix(skills-24): clarify discovery boundaries

* fix(skills-25): deny unknown invocation actors

* fix(skills-26): validate approval policy shape

* fix(mcp-28): terminate unsafe cursor pagination

* fix(mcp-29): preserve completed request state

* fix(mcp-30): require secure remote endpoints

* fix(mcp-31): strengthen conformance checks

* fix(agent-skills): align route prerequisites

* fix(scripts): harden skill bundle installation

* fix(site): validate learning and artifact boundaries

* fix(course): address review edge cases

* fix(mcp): tighten notification and redirect validation

* fix(mcp): secure reproducible lesson state

* fix(mcp): use required lesson header comments
2026-08-23 18:01:53 +01:00

79 lines
3.5 KiB
JSON

{
"lesson": "31-mcp-conformance-versioning-and-operations",
"title": "MCP Conformance Engineering: Versioning, Evidence, and Operations",
"questions": [
{
"stage": "pre",
"question": "Why is one successful SDK tools/list call insufficient conformance evidence?",
"options": [
"The normalized value may hide wire fields, version behavior, proxy changes, and invalid responses",
"SDKs cannot call MCP tools",
"A successful call always selects the legacy era",
"Conformance applies only to Registry publishers"
],
"correct": 0,
"explanation": "Conformance must inspect the raw request and response, selected version era, intermediaries, and SDK transformation."
},
{
"stage": "check",
"question": "A modern probe returns JSON-RPC error -32021. What should a fallback-capable client do?",
"options": [
"Immediately send initialize for the legacy era",
"Treat the peer as offline",
"Keep the modern era and correct or report the missing capability declaration",
"Ignore the error and retry without capabilities"
],
"correct": 2,
"explanation": "A recognized modern error proves modern behavior. It is correction evidence, not permission to downgrade."
},
{
"stage": "check",
"question": "How should a modern client handle a result with resultType complete and an unfamiliar additive field?",
"options": [
"Change resultType to input_required",
"Reject every result containing an unknown key",
"Accept the known result type and preserve or deliberately ignore the additive field according to its role",
"Treat the unfamiliar field as a legacy handshake"
],
"correct": 2,
"explanation": "Additive fields support forward compatibility. They are different from an unknown lifecycle discriminator."
},
{
"stage": "check",
"question": "What is the required JSON-RPC response to a notification with no id?",
"options": [
"A server/discover result",
"No JSON-RPC response",
"A complete result with null content",
"An error with id null"
],
"correct": 1,
"explanation": "Notifications are one-way. The final transport serializer must not emit a JSON-RPC success or error."
},
{
"stage": "post",
"question": "Which evidence best proves that a proxy preserved an origin protocol error?",
"options": [
"Redacted ingress, origin, and egress status and body evidence with stable digests",
"A screenshot of the gateway dashboard",
"The SDK exception class alone",
"The proxy process uptime"
],
"correct": 0,
"explanation": "Three-boundary evidence reveals status collapse, body rewriting, and the exact hop where behavior changed."
},
{
"stage": "post",
"question": "A candidate fails its negative transcripts and the previous version has no admission or health evidence. What should the release gate do?",
"options": [
"Select the newest Registry version",
"Promote because golden transcripts passed",
"Roll back to the package tagged latest",
"Hold the release until an eligible rollback target or a corrected candidate is proven"
],
"correct": 3,
"explanation": "A rollback without exact admission and health evidence is another unverified release, so the safe action is to hold."
}
]
}