Pin the pre-registered-credentials divergence and the DCR application_type pass-through

Pre-registered credentials bound to a different issuer are silently
discarded and re-registered - the path the spec blesses only for
DCR-persisted credentials; for manually provisioned ones it says an error
should surface. The new test pins the silent replacement (flow completes,
no error, the seeded credential never presented, storage rebound to the
current AS) under a recorded divergence scoped to the issuer-stamped arm;
the unbound arm is a documented limitation in the entry note, since a
mismatch cannot be detected for credentials that never recorded a binding.

A consumer-set application_type of web on a loopback redirect - a value
the derivation heuristic would never produce - reaches the /register body
verbatim, distinguishing pass-through from any future heuristic.

Also: the last caching deferral gains its greppable re-open token, the
omit_iss precedence is documented in the harness, and the app-type
heuristic note cross-references its tested override sibling. 944 -> 946
cells; suite green three runs.

Author: maxisbey

tests/interaction/_requirements.py

@@ -3419,7 +3419,7 @@ def __post_init__(self) -> None:
         added_in="2026-07-28",
         deferred=(
             "Not implemented in the SDK: the per-receipt freshness clock and independent expiry "
-            "need a client response cache that records per-page receipt times; none exists. The "
+            "need a SEP-2549 response cache that records per-page receipt times; none exists. The "
             "carriage half (each page carries its own ttlMs, set per handler invocation) is "
             "expressible today and can be split out if wanted."
         ),
@@ -5375,14 +5375,33 @@ def __post_init__(self) -> None:
             "registration body carries it, pinned incidentally by the "
             "client-auth:dcr:grant-types-default body snapshot. Only the derive-from-redirect-"
             "URIs strategy for the 'web' SHOULD is unimplemented; a web-app consumer sets "
-            "application_type='web' explicitly and it is transmitted verbatim."
+            "application_type='web' explicitly and it is transmitted verbatim; the consumer-set "
+            "half is pinned by client-auth:dcr:app-type-override."
         ),
         deferred=(
             "Not implemented in the SDK: application_type is a static model default ('native') "
             "on OAuthClientMetadata (src/mcp/shared/auth.py); no code path inspects the "
             "redirect URIs to choose between 'native' and 'web'."
         ),
     ),
+    "client-auth:dcr:app-type-override": Requirement(
+        source=(
+            f"{SPEC_2026_BASE_URL}"
+            "/basic/authorization/client-registration#application-type-and-redirect-uri-constraints"
+        ),
+        behavior=(
+            "A consumer-set application_type is sent verbatim in the dynamic-registration "
+            "request; the SDK never rewrites it (SEP-837)."
+        ),
+        added_in="2026-07-28",
+        transports=("streamable-http",),
+        note=(
+            "OAuth is HTTP-only. At this pin nothing could rewrite it -- python has no "
+            "redirect-URI derivation strategy (client-auth:dcr:app-type-heuristic, deferred) "
+            "-- so this entry pins the pass-through: a future heuristic may only fill the "
+            "omitted case, never overwrite an explicit choice."
+        ),
+    ),
     "client-auth:dcr:grant-types-default": Requirement(
         source=f"{SPEC_2026_BASE_URL}/basic/authorization#refresh-tokens",
         behavior=(
@@ -5422,6 +5441,34 @@ def __post_init__(self) -> None:
         transports=("streamable-http",),
         note="OAuth is HTTP-only.",
     ),
+    "client-auth:as-binding:prereg-mismatch-error": Requirement(
+        source=f"{SPEC_2026_BASE_URL}/basic/authorization/client-registration#authorization-server-binding",
+        behavior=(
+            "Pre-registered credentials are specific to one authorization server: when the "
+            "authorization server indicated by protected resource metadata no longer matches "
+            "the issuer recorded with the credentials, the client surfaces an error rather "
+            "than silently attempting to use them (SEP-2352)."
+        ),
+        added_in="2026-07-28",
+        transports=("streamable-http",),
+        note=(
+            "OAuth is HTTP-only. The divergence covers only credentials stored with an issuer. "
+            "A pre-registered credential stored without one carries no binding to compare: "
+            "credentials_match_issuer (src/mcp/client/auth/utils.py) leaves it as-is and the "
+            "flow silently presents it to whatever authorization server discovery finds -- a "
+            "documented limitation rather than a divergence, because the SHOULD's trigger "
+            "('no longer matches the one the credentials were registered with') presupposes a "
+            "recorded binding."
+        ),
+        divergence=Divergence(
+            note=(
+                "The SDK has no pre-registered marker: an issuer-stamped credential whose "
+                "issuer mismatches the discovered authorization server takes the same path as "
+                "a DCR-persisted one -- silently discarded and re-registered, the path the "
+                "spec blesses only for DCR-persisted credentials -- and no error is surfaced."
+            ),
+        ),
+    ),
     "client-auth:invalid-client-clears-all": Requirement(
         source="sdk",
         behavior=(

tests/interaction/auth/_harness.py

@@ -147,8 +147,8 @@ class HeadlessOAuth:
     rejection path.
 
     `omit_iss`: when set, `callback_handler` returns no iss regardless of what the redirect
-    carried, so tests can drive the missing-iss paths (the `iss_override` sentinel cannot
-    express absence).
+    carried or what `iss_override` supplies (omission wins when both are set), so tests can
+    drive the missing-iss paths (the `iss_override` sentinel cannot express absence).
     """
 
     def __init__(

tests/interaction/auth/test_flow.py

@@ -283,6 +283,39 @@ async def test_dcr_sends_consumer_set_grant_types_verbatim() -> None:
     assert json.loads(register.content)["grant_types"] == ["authorization_code"]
 
 
+@requirement("client-auth:dcr:app-type-override")
+async def test_dcr_sends_a_consumer_set_application_type_verbatim() -> None:
+    """A consumer-set `application_type` is sent on the registration request verbatim, never rewritten.
+
+    The application-type section (SEP-837) says web applications SHOULD register
+    `application_type: 'web'`; the SDK transmits a consumer-set value verbatim. The metadata
+    sets `'web'` against the suite's loopback redirect URI -- deliberately the value
+    redirect-URI derivation would NOT produce, so verbatim pass-through stays distinguishable
+    from any future derivation strategy (which may only fill the omitted case, pinned as
+    deferred on `client-auth:dcr:app-type-heuristic`).
+    """
+    requests: list[httpx.Request] = []
+    provider = InMemoryAuthorizationServerProvider()
+    server = Server("guarded", on_list_tools=list_tools)
+    client_metadata = OAuthClientMetadata(
+        client_name="interaction-suite",
+        redirect_uris=[AnyUrl(REDIRECT_URI)],
+        application_type="web",
+    )
+
+    with anyio.fail_after(5):
+        async with connect_with_oauth(
+            server, provider=provider, client_metadata=client_metadata, on_request=requests.append
+        ) as (client, _):
+            result = await client.list_tools()
+
+    # The flow completed: the real AS accepted a registration carrying `application_type: "web"`.
+    assert result.tools[0].name == "whoami"
+
+    register = next(r for r in requests if r.url.path == "/register")
+    assert json.loads(register.content)["application_type"] == "web"
+
+
 async def test_shimmed_app_serves_overrides_404s_and_otherwise_forwards_to_the_wrapped_app() -> None:
     """Harness self-test: `shimmed_app` serves canned bodies, 404s, and forwards everything else.
 

tests/interaction/auth/test_lifecycle.py

@@ -319,6 +319,53 @@ async def test_credentials_bound_to_a_different_issuer_are_discarded_and_the_cli
     assert storage.client_info.issuer == f"{BASE_URL}/"
 
 
+@requirement("client-auth:as-binding:prereg-mismatch-error")
+async def test_preregistered_credentials_bound_to_a_different_issuer_are_silently_replaced_without_an_error() -> None:
+    """Pre-registered credentials with a mismatched issuer are silently replaced rather than erroring.
+
+    The 2026 binding section says a client holding pre-registered credentials SHOULD surface an
+    error when the authorization server no longer matches the issuer they were registered with,
+    rather than silently attempting to use them. The SDK cannot tell pre-registered from
+    DCR-persisted credentials, so the issuer-stamped credential takes the DCR
+    discard-and-re-register path and the flow completes with no error -- a known divergence,
+    recorded on the requirement; the mismatched credential is at least never presented.
+    """
+    recorded, on_request = record_requests()
+    provider = InMemoryAuthorizationServerProvider()
+    prereg = seeded_client(
+        provider,
+        client_id="prereg-old-as",
+        client_secret="prereg-secret",
+        token_endpoint_auth_method="client_secret_post",
+        issuer="https://old-as.example.com",
+    )
+    storage = InMemoryTokenStorage(client_info=prereg)
+    server = Server("guarded", on_list_tools=list_tools)
+
+    with anyio.fail_after(5):
+        async with connect_with_oauth(server, provider=provider, storage=storage, on_request=on_request) as (client, _):
+            result = await client.list_tools()
+
+    # The flow completed: no error surfaced -- the divergent observable everything below qualifies.
+    assert result.tools[0].name == "echo"
+
+    # The replacement happened via a silent dynamic registration.
+    assert path_counts(recorded)[("POST", "/register")] == 1
+
+    # The mismatched credential was never presented anywhere: the SDK does not "silently attempt
+    # to use" it -- only the error half of the SHOULD is missed.
+    for r in recorded:
+        assert "prereg-old-as" not in r.url.query.decode()
+        assert "prereg-old-as" not in r.content.decode()
+        assert "prereg-secret" not in r.content.decode()
+
+    # The pre-registered identity is gone and its replacement is bound to the current AS:
+    # "silently replaced" made concrete rather than inferred from a changed client_id.
+    assert storage.client_info is not None
+    assert storage.client_info.client_id != "prereg-old-as"
+    assert storage.client_info.issuer == f"{BASE_URL}/"
+
+
 @requirement("client-auth:401-after-auth-throws")
 async def test_a_second_401_after_a_completed_oauth_flow_surfaces_without_looping() -> None:
     """A 401 on the post-auth retry surfaces as an error rather than re-entering discovery.