Backlog hardening: complete the push-API divergence matrix and sharpen three tests

Add the HTTP request-scoped loud-fail test, completing all four legs of the
push-API divergence record (both transports x both legs). Add the missing
templates/list decorator on the static-and-templated listing test. Redesign
the post-connect registration fixture to mutate the tool set between
requests rather than from inside a handler, so the fixture itself no longer
violates the 2026 list-stability requirement on live cells. Assert that an
iss-mismatch rejection never exchanges the authorization code (with a
liveness guard on the recorded /token calls). 909 -> 910 cells.

Author: maxisbey

tests/interaction/auth/test_authorize_token.py

@@ -192,8 +192,10 @@ async def test_a_mismatched_iss_on_the_callback_aborts_the_flow() -> None:
     """A callback whose RFC 9207 iss does not match the authorization server issuer aborts the flow.
 
     `iss_override` makes the headless callback return an issuer the AS never advertised; the SDK
-    compares it to `oauth_metadata.issuer` and raises `OAuthFlowError` before the token exchange.
+    compares it to `oauth_metadata.issuer` and raises `OAuthFlowError` before the token exchange --
+    the recorded traffic shows no /token POST, so the tainted authorization code is never exchanged.
     """
+    recorded, on_request = record_requests()
     provider = InMemoryAuthorizationServerProvider()
     server = Server("guarded", on_list_tools=list_tools)
     headless = HeadlessOAuth(iss_override="https://attacker.example.com")
@@ -202,7 +204,11 @@ async def test_a_mismatched_iss_on_the_callback_aborts_the_flow() -> None:
         with pytest.RaisesGroup(
             pytest.RaisesExc(OAuthFlowError, match="^Authorization response iss mismatch:"), flatten_subgroups=True
         ):
-            await connect_with_oauth(server, provider=provider, headless=headless).__aenter__()
+            await connect_with_oauth(server, provider=provider, headless=headless, on_request=on_request).__aenter__()
+
+    # The recorded unauthenticated trigger POST guards the negative below against an unwired hook.
+    assert find(recorded, "POST", "/mcp") != []
+    assert find(recorded, "POST", "/token") == []
 
 
 @requirement("client-auth:resource-parameter")

tests/interaction/mcpserver/test_resources.py

@@ -41,6 +41,7 @@ def app_config() -> str:
 
 
 @requirement("mcpserver:resource:static")
+@requirement("mcpserver:resource:template")
 async def test_list_static_and_templated_resources(connect: Connect) -> None:
     """Statically-registered resources appear in resources/list; templated ones only in templates/list.
 

tests/interaction/mcpserver/test_tools.py

@@ -394,9 +394,11 @@ async def test_adding_and_removing_tools_does_not_notify_connected_clients(conne
 
     add_tool and remove_tool only update the registry: a connected client that listed the tools
     before the mutation has no way to learn it should list them again. The spec provides
-    notifications/tools/list_changed for exactly this; MCPServer never sends it. The tool emits
-    one log message as a sentinel so the test proves notifications do reach the collector -- the
-    log message arrives, a list_changed does not.
+    notifications/tools/list_changed for exactly this; MCPServer never sends it. The mutation
+    happens out-of-band, between requests -- the spec's "MAY change over time" allowance; varying
+    the set as a side effect of another request on the connection is forbidden at 2026-07-28. The
+    sentinel tool logs one message after the mutation so the test proves notifications do reach
+    the collector -- the log message arrives, a list_changed does not.
     """
     received: list[IncomingMessage] = []
     mcp = MCPServer("mutable")
@@ -411,22 +413,23 @@ def doomed() -> str:
         raise NotImplementedError
 
     @mcp.tool()
-    async def grow(ctx: Context) -> str:
-        mcp.add_tool(extra, name="extra")
-        mcp.remove_tool("doomed")
-        await ctx.info("tool set changed")  # pyright: ignore[reportDeprecated]
-        return "mutated"
+    async def sentinel(ctx: Context) -> str:
+        await ctx.info("after the mutation")  # pyright: ignore[reportDeprecated]
+        return "sentinel ran"
 
     async def collect(message: IncomingMessage) -> None:
         received.append(message)
 
     async with connect(mcp, message_handler=collect) as client:
         before = await client.list_tools()
-        await client.call_tool("grow", {})
+        # Out-of-band: no request is in flight while the set changes.
+        mcp.add_tool(extra, name="extra")
+        mcp.remove_tool("doomed")
+        await client.call_tool("sentinel", {})
         after = await client.list_tools()
 
-    assert [tool.name for tool in before.tools] == ["doomed", "grow"]
-    assert [tool.name for tool in after.tools] == ["grow", "extra"]
+    assert [tool.name for tool in before.tools] == ["doomed", "sentinel"]
+    assert [tool.name for tool in after.tools] == ["sentinel", "extra"]
     assert received == snapshot(
-        [LoggingMessageNotification(params=LoggingMessageNotificationParams(level="info", data="tool set changed"))]
+        [LoggingMessageNotification(params=LoggingMessageNotificationParams(level="info", data="after the mutation"))]
     )

tests/interaction/transports/test_hosting_http_modern.py

@@ -4,7 +4,9 @@
 asserting the wire contract for a 2026-07-28 POST -- one self-contained request, no initialize
 handshake, no ``Mcp-Session-Id``, JSON response body -- and that 2025-era traffic on the same
 endpoint is byte-unchanged. The SDK client never exposes the response headers or the raw
-result-envelope shape, so every assertion here is necessarily wire-level.
+result-envelope shape, so every assertion here is necessarily wire-level. A handful of tests
+instead drive the SDK client against the mounted entry, for serving behaviour that is specific
+to this transport but observable through the public API.
 """
 
 import json
@@ -21,12 +23,15 @@
     HEADER_MISMATCH,
     INTERNAL_ERROR,
     INVALID_PARAMS,
+    INVALID_REQUEST,
     METHOD_NOT_FOUND,
     MISSING_REQUIRED_CLIENT_CAPABILITY,
     PROTOCOL_VERSION_META_KEY,
     CallToolRequestParams,
     CallToolResult,
     DiscoverResult,
+    ElicitRequestParams,
+    ElicitResult,
     EmptyResult,
     ErrorData,
     GetPromptRequestParams,
@@ -55,10 +60,12 @@
 from starlette.requests import Request as StarletteRequest
 
 from mcp import MCPError
+from mcp.client import ClientRequestContext
 from mcp.client.client import Client
 from mcp.client.session import ClientSession
 from mcp.client.streamable_http import streamable_http_client
 from mcp.server import Server, ServerRequestContext
+from mcp.shared.exceptions import NoBackChannelError
 from tests.interaction._connect import (
     BASE_URL,
     base_headers,
@@ -1419,6 +1426,81 @@ async def call_tool(ctx: ServerRequestContext, params: CallToolRequestParams) ->
     )
 
 
+@requirement("mrtr:push-api:loud-fail-2026")
+async def test_modern_request_scoped_push_elicit_loud_fails_locally_and_the_call_still_completes() -> None:
+    """A request-scoped push elicit over the modern HTTP entry raises the typed local error and the
+    call still completes -- the related_request_id leg that the in-memory pair transmits (the
+    divergence pinned in lowlevel/test_mrtr.py) loud-fails here, byte-identical to the standalone
+    legs, because this entry's per-request dispatch context hard-codes its back-channel away.
+
+    The outcome is spec-mandated (the previous server-initiated request pattern is no longer
+    supported) but the enforcement at this pin is incidental -- no back-channel, not an era gate.
+    Transport-pinned: the modern entry's gate is the only enforcement of the 2026 push prohibition
+    that holds on this leg, so it gets its own regression pin against the requirement's divergence
+    matrix.
+    """
+    caught: list[NoBackChannelError] = []
+
+    async def list_tools(ctx: ServerRequestContext, params: PaginatedRequestParams | None) -> ListToolsResult:
+        # Live (not NotImplementedError): the client's output-schema cache refresh invokes
+        # tools/list right after the tools/call result.
+        return ListToolsResult(tools=[Tool(name="ask", input_schema={"type": "object"})])
+
+    async def call_tool(ctx: ServerRequestContext, params: CallToolRequestParams) -> CallToolResult:
+        assert params.name == "ask"
+        assert ctx.request_id is not None
+        try:
+            # The related id selects the per-request dispatch channel -- the leg whose in-memory
+            # twin still transmits the forbidden frame.
+            await ctx.session.elicit_form(
+                "Need a name",
+                {"type": "object", "properties": {"name": {"type": "string"}}, "required": ["name"]},
+                related_request_id=ctx.request_id,
+            )
+        except NoBackChannelError as exc:
+            caught.append(exc)
+        return CallToolResult(content=[TextContent(text="fallback")])
+
+    server = Server("scoped-push", on_list_tools=list_tools, on_call_tool=call_tool)
+
+    # Registered so the client declares the elicitation capability in the per-request envelope,
+    # isolating the failure to the missing back-channel rather than to capability gating; the
+    # body is itself the never-delivered assertion.
+    async def never_deliverable(context: ClientRequestContext, params: ElicitRequestParams) -> ElicitResult:
+        raise NotImplementedError
+
+    discover = DiscoverResult(
+        supported_versions=[LATEST_MODERN_VERSION],
+        capabilities=ServerCapabilities(),
+        server_info=Implementation(name="srv", version="0"),
+    )
+    with anyio.fail_after(5):
+        async with (
+            mounted_app(server) as (http, _),
+            Client(
+                streamable_http_client(f"{BASE_URL}/mcp", http_client=http),
+                mode=LATEST_MODERN_VERSION,
+                prior_discover=discover,
+                elicitation_callback=never_deliverable,
+            ) as client,
+        ):
+            result = await client.call_tool("ask", {})
+
+    # The failed push did not poison the request: the call completes with the handler's fallback.
+    assert result == snapshot(CallToolResult(content=[TextContent(text="fallback")]))
+    assert len(caught) == 1
+    assert caught[0].method == "elicitation/create"
+    assert caught[0].error == snapshot(
+        ErrorData(
+            code=INVALID_REQUEST,
+            message=(
+                "Cannot send 'elicitation/create': this transport context has no back-channel "
+                "for server-initiated requests."
+            ),
+        )
+    )
+
+
 @requirement("hosting:http:request-headers-in-handler")
 async def test_custom_request_header_reaches_the_handler_request_context_on_both_serving_paths() -> None:
     """A custom HTTP header sent by the client reaches the handler's ctx.request on both serving paths.