[Roadmap]: Rebuild the agent-facing capability protocol around canonical identity, typed handoffs, and bounded execution

[morluto]

Purpose

This issue is the dependency map for the critical systemic defects found in the agent-facing capability audit. It does not replace the owning issues or prescribe one mathematical research workflow. It exists to prevent the repair program from becoming another sequence of isolated tag, description, example, preview, and transport patches.

The central finding is that Jacobian’s mathematical kernels are often correct, while information needed by agents is lost at the boundaries around them:

canonical server
    -> packaged host
       identity/schema/recovery can drift

mathematical intent
    -> discovery
       vocabulary/taxonomy can lose the applicable operation

selected capability
    -> execution call
       capability-specific type is erased into payload: object

canonical result
    -> model-facing result
       primary value, labels, completeness, and full-resource path can be lost

capability implementation
    -> host execution UX
       effects, deadlines, progress, cancellation, and retry semantics can be lost

component correctness
    -> release confidence
       no single cross-host journey proves that every handoff still works

Architectural invariants

Every implementation under this roadmap should preserve the following invariants.

Canonical identity

One capability/tool/contract has one canonical identity. Host bindings may sanitize function symbols, but they must preserve canonical metadata, validation-equivalent contracts, telemetry identity, and callable recovery actions.

Make invalid states unrepresentable at the nearest boundary

A host that has selected a capability should receive a capability-specific construction contract. Wrong wrapper levels, stale contracts, incompatible modes, and invalid browse/search/inspect combinations should be rejected before mathematical execution with one bounded repair path.

Search metadata is not policy or proof

Retrieval aliases, mathematical domains, deployment policy classes, provider features, effects, assurance ceilings, and producer/checker relationships are different typed namespaces. Similarity or ranking never implies mathematical suitability, availability, authorization, or verification.

Canonical result is not the model-facing projection

The complete mathematical result, the bounded immediate primary value, and the MCP transport representation are distinct objects. A preview is source-bound convenience, never independent evidence. Mathematical completeness and preview completeness remain separate.

Execution, effects, and assurance are orthogonal

EXPLORE does not imply COMPUTED; VERIFY does not imply VERIFIED. Read-only/additive/destructive behavior, idempotence, deadline, cancellation, progress, completeness, and assurance are separately declared and enforced.

Stateless protocol, explicit handles

Cross-call state is represented by typed server-minted handles/URIs bound to tenant, policy, provider, and contract identity—not by hidden connection-local mutation.

Runtime remains authoritative

Host validation, generated examples, Skills, retrieval indices, and annotations improve ergonomics but do not replace runtime validation, operator policy, provider identity checks, tenant isolation, checker authorization, or verification-record binding.

Dependency graph

                           ┌────────────────────────────┐
                           │  Wave 0: callable surface  │
                           └──────────────┬─────────────┘
                                          │
        #935/#1017 ──> #1029 ──> #1076 ──┴──> cross-surface baseline
             HTTP       identity          final MCP
             schema     /connector        lifecycle
                                          │
                                          ▼
                     ┌──────────────────────────────────┐
                     │ Wave 1: canonical contract model │
                     └──────────────┬───────────────────┘
                                    │
       #1062 ──> #1059               #1067     #1034     #1077
       metadata    retrieval         assurance  effects   execution
       namespaces  representation    ceilings   model     lifecycle
            │            │                │         │         │
            └────────────┴────────────────┴─────────┴─────────┘
                                    │
                                    ▼
                              #1073 contract
                              identity/digest
                                    │
                      ┌─────────────┴─────────────┐
                      ▼                           ▼
             #1064 catalog snapshot       #1072 construction schema
                      │                           │
                      └─────────────┬─────────────┘
                                    ▼
                         #1031 selected typed call
                                    │
                             #1071 recovery
                                    │
                                    ▼
                    ┌────────────────────────────────┐
                    │ Wave 3: result and composition │
                    └──────────────┬─────────────────┘
                                   │
                         #1033 primary result
                                   │
                         #1074 bounded transport
                                   │
                 #1018 relationships / typed compatibility
                                   │
                #896 explicit batch preflight where justified
                                   │
                                   ▼
                     ┌──────────────────────────┐
                     │ Wave 4: guidance/release │
                     └────────────┬─────────────┘
                                  │
                         #1070 managed Skill
                         #988 guidance emphasis
                         #1078 journey conformance
                                  │
                                  ▼
                         measured rollout gates

The diagram shows the main dependency direction, not a requirement that every issue land in one monolithic PR. Some leaf fixes can ship earlier when they preserve the eventual contract.

Wave 0 — restore one callable protocol across every surface

#935 / #1017 — Streamable HTTP output-schema compatibility

A client must be able to complete tools/list before any ergonomics work is measurable. Restack the root-union output-schema repair on current MCP architecture and retain real HTTP coverage.

#1029 — canonical MCP identity through packaged aliases

Ensure math.find and math.run retain validation-equivalent schemas, annotations, results, and callable recovery semantics through packaged Codex and installed connector bindings.

#1076 — final MCP 2026-07-28 stateless lifecycle

Define supported protocol versions, test real latest-protocol HTTP requests, make request-stateless deployment the preferred path, and update doctor. This constrains #1031: connection-local temporary tool mutation is not the preferred final design; explicit prepared-contract handles are.

Wave-0 gate

The same deterministic browse → search → inspect → invoke → invalid-recover → resource-read sequence succeeds through in-process, stdio, final-protocol HTTP, packaged Codex, and installed connector surfaces.

Wave 1 — define the capability contract the agent is actually using

#1062 — split overloaded metadata namespaces

Separate canonical mathematical domains, retrieval aliases, policy classes, and provider features. This must precede or accompany a new retrieval index so search tuning cannot alter deployment policy or provider identity.

#1059 — versioned hybrid retrieval index

Replace ASCII exact-overlap-only retrieval and unbounded manual synonym patching with a transparent, deterministic, versioned hybrid index and held-out multilingual/notation-aware query corpus.

#1067 — descriptor-owned assurance ceilings

Stop deriving COMPUTED from EXPLORE. Publish mode-specific HEURISTIC / COMPUTED / VERIFIED ceilings from the same typed contract that constructs results.

#1034 — descriptor-owned effects

Separate read-only, additive, mutating, and destructive effects plus idempotence. Move destructive controls out of an otherwise non-destructive mathematical executor where necessary.

#1077 — descriptor-owned execution lifecycle

Declare synchronous/durable/task execution, maximum deadline, progress, cancellation guarantee, retry semantics, and concurrency weight. Remove SAT/SMT prefix inference and bound late-worker admission.

#1073 — content-addressed per-capability contract identity

Bind the exact input/output/semantic/assurance/effect/execution contract to a digest/URI. Keep human version, provider identity, policy identity, and catalog snapshot identity separate. This is the compatibility key for prepared calls, generated guidance, results, and historical traces.

#1010 — installation/lifetime separation

The provider/checker/tenant-state architecture remains a prerequisite for truthful availability and scalable stateless deployment. Do not let catalog caching or prepared handles recreate producer/checker or host/tenant coupling.

Wave-1 gate

For each installed capability, a machine-readable descriptor can answer independently:

What mathematical domains and search representation does it have?
Which inputs/outputs and exact contract digest does it use?
Which modes and assurance ceilings can it reach?
What external effects and idempotence does it have?
How long can it run, how is progress/cancellation handled, and how is it retried?
Which provider is present/ready and which checker is separately authorized?

No answer is inferred from a generic tag bag, ID prefix, or mode alone.

Wave 2 — make the first valid call the default outcome

#952 — encode browse/search/inspect modes in math.find schema

Publish actual mutually exclusive forms, including typed artifact dependencies and exact-only fields.

#1072 — generation-oriented capability schemas

Retain bounded descriptions, examples/default semantics, and branch/discriminator routing needed to construct calls. Separate canonical, validation, and construction projections.

#1031 — schema-bound selected execution

Use a stable executor plus an explicit prepared-contract handle or equivalent final-protocol-compatible mechanism. Bind capability ID, contract digest, mode, policy/catalog/provider identity, and tenant. Do not expose the full catalog as permanent tools or rely on connection-local tool mutation.

#990 — sole-mode default

Once the selected contract is trustworthy, remove unnecessary mode ceremony for single-mode capabilities without collapsing EXPLORE/VERIFY lanes.

#1071 — machine-actionable outer-tool diagnostics

Preserve path, rule, accepted form, and one callable recovery action for remaining top-level/envelope errors. Use tool execution errors for model-correctable input mistakes where supported.

#941 / PR #929 — verifier examples as immediate compatibility fixes

Land schema-valid examples/envelope corrections where they help current users. Treat them as acceptance fixtures for #1072/#1031 rather than the complete architecture.

Wave-2 gate

Across scalar, nested matrix, sparse polynomial, discriminated union, graph search, inline verifier, and artifact verifier fixtures:

• the first generated call is host-constrained by the selected contract;
• wrong wrapper levels are rejected before adapter execution;
• stale contracts fail closed;
• one retry using returned recovery succeeds;
• no complete catalog is returned on error.

Wave 3 — make successful results usable without losing truth

#1033 — common bounded primary-result projection

Every capability declares one source-bound immediate primary value or NO_PRIMARY_VALUE. Preview completeness, interpretation-critical labels/order/domain, and omission semantics are explicit and separate from mathematical completeness.

#1074 — bound both math.run result channels

Do not leave an unbounded canonical result in structuredContent while compacting only text. Persist large complete results under typed resources, bound ResourceLink fanout, and preserve exact recovery identity.

#1018 — typed producer/consumer/checker compatibility

Restore only factual, contract-proven compatibility metadata after reasoning-workflow removal. Use artifact types and contract identities; do not prescribe strategy or materialize ordinary values merely to pass them between operations.

#932 — semantic pagination and transport limits

Apply the same distinction to discovery/inspection: recoverable semantic collections versus operator transport safeguards. CONTRACT/FULL remain complete or link to exact complete resources.

#896 — explicit batch preflight

Batch only where repeated homogeneous work is measured. Validate the whole requested batch before execution and preserve per-member effects, status, provenance, cancellation, and assurance.

Tactical result PRs

PR #992 and PR #986 are useful immediate improvements and should remain acceptance fixtures:

• projective flats test partial but proof-critical previews;
• distance matrices test labels/order as inseparable interpretation data.

Wave-3 gate

Agents can extract the correct proof-critical value, retain labels/order, follow the complete resource when required, and invoke a linked verifier without manual reconstruction or transcription. Structured and text channels agree on the bounded result and trust envelope.

Wave 4 — remove stale guidance and make regressions releasable

#1070 — managed Codex Skill lifecycle

Version generated Skills, distinguish untouched old generated content from real user modifications, update or report stale guidance during upgrade, and remove unbound mutable payload fast paths.

#988 — guidance emphasis

After #1067 establishes truthful ceilings, foreground COMPLETED + COMPUTED as the common producer success path while keeping requested independent verification fail-closed.

#1078 — end-to-end agent journey conformance

Create deterministic cross-surface journeys plus repeated model-in-the-loop evaluations. Measure exposure, discovery, first-call validity, recovery, execution contribution, result consumption, resource follow-through, verification binding, final value preservation, scope/assurance calibration, bytes/tokens, and latency separately.

Existing evaluation owners

• [Evaluation]: Jacobian is available but unused across a four-case conjecture canary #845 remains the available-but-unused/adoption evidence owner.
• [Evaluation]: Successful exact matrix workflow reproducibly times out under selective grounding #938 remains the successful-operation-but-timeout reproduction.
• PR Add a passive external reasoning observer #985 remains the passive observer; production tools must not change to record model self-reports.

Wave-4 gate

A release cannot pass by showing only that the server initialized or an operation completed. The journey suite verifies the complete handoff on every supported surface and reports repeated behavioral evidence with uncertainty where a model is involved.

Tactical PR disposition

Current leaf PRs should be reviewed against this map:

PR	Immediate value	Systemic owner
#929	valid verifier envelope examples	#1072 / #1031
#934	sequence/polynomial discovery aliases	#1059 / #1062
#935	HTTP tools/list compatibility	#1017 / Wave 0
#936	expansion vocabulary + verifier relation	#1059 / #1018
#986	labelled distance matrix	#1033
#992	projective-flat preview	#1033 / #1074

Do not block a sound high-value leaf fix merely because the shared architecture is not complete. Do prevent leaf fixes from establishing new incompatible conventions that the owning systemic issue will immediately have to remove.

Existing issues to revalidate rather than duplicate

#951 — unknown-capability recovery size

Current main appears to bound unknown-ID recovery to nearby IDs and canonical catalog/search paths. Re-run the issue’s original wire probe against current main before deciding whether to close it as completed or update its reproduction.

#953 — open nested math.find output dictionaries

Current main now contains many explicit nested projection models and closed output-schema assertions. Re-run the original schema-drift probe; keep only any remaining open fields not covered by current models.

Program-level acceptance criteria

• Every issue above has one clear owner and does not duplicate another layer.
• Tool identity, capability contract, provider, policy, catalog, tenant, artifact, checker, and verification-record identities remain separate and explicitly bound where they interact.
• Discovery quality no longer depends on an endless series of generic tag additions.
• The selected capability’s construction contract reaches the host call-generation boundary.
• Results are bounded, source-bound, correctly labelled, and recoverably complete.
• Effects, assurance, execution lifecycle, and cancellation are truthful and descriptor-owned.
• Latest-protocol stateless deployment and cross-host parity are release-tested.
• Managed guidance cannot remain silently stale after runtime upgrades.
• End-to-end evaluations score mathematical contribution and final evidence preservation, not tool invocation itself.
• No ergonomic layer can authorize a checker, widen scope, upgrade assurance, or replace runtime validation.

Non-goals

• One universal mathematical object/schema.
• Hundreds of permanent top-level tools.
• One mandated decomposition, verification order, or stopping policy.
• A general expression language introduced without held-out evidence.
• Treating semantic retrieval, examples, previews, annotations, Skills, or model self-reports as mathematical evidence.
• A monolithic implementation PR spanning the entire roadmap.

[morluto]

Control-plane extension discovered in the second audit pass

The agent-facing dependency graph in this roadmap remains valid. A deeper pass over remote authentication, tenant routing, durable jobs, state storage, raw protocol parsing, migration, and multi-instance deployment found a second dependency graph that must gate #1076 production stateless rollout.

These are not additional agent-workflow features; they are the trust, effect, and persistence conditions under which the agent protocol can be safely exposed remotely.

                    remote bytes / endpoint
                              │
                 #1093 TLS / trusted proxy
                 #1102 unambiguous raw JSON
                              │
                              ▼
                 #1084 stable grant identity
                 #1087 caller authorization
                              │
                              ▼
                 #1083 execution admission
                 #1088 logical idempotency
                              │
                              ▼
                 #1091 runtime/run ownership
                 #1111 release/migration fencing
                              │
                    ┌─────────┴─────────┐
                    ▼                   ▼
             #1009 supervisor      #1050 atomic result
             #1021 shutdown        operation commit
                    │                   │
                    └─────────┬─────────┘
                              ▼
                 #1094 trust-event ledger
                              │
              ┌───────────────┴────────────────┐
              ▼                                ▼
       #1098 tenant/global              #1085 retention/GC
       storage admission                #1092 snapshot/restore
              │                                │
              └───────────────┬────────────────┘
                              ▼
                    #1076 stateless rollout
                    #1078 full conformance

Newly confirmed systemic owners

• [Security][Architecture]: Enforce caller authorization per capability and effect instead of treating jacobian:use as universal authority #1087 — caller authorization per capability/effect. AccessToken.scopes is minted but request routing currently retains only subject; every grant inherits the server-wide CapabilityPolicy. Authentication, tenant identity, caller authority, deployment policy, and checker authority must remain separate.
• [Architecture][Reliability]: Add request-level idempotency for side-effecting and durable MCP operations #1088 — request-level idempotency. Transport request IDs are telemetry-only. A lost response followed by retry can start a second experiment because start_enumeration allocates a fresh random URI and launches on every accepted call.
• [Architecture][Distributed]: Add fenced tenant/runtime and durable-worker ownership before round-robin stateless deployment #1091 — fenced tenant/runtime and durable-worker ownership. Two processes can construct runtimes over one tenant root; construction-time recovery can interpret another healthy process's live job as interrupted. Shared durable bytes do not establish one live coordinator.
• [Security]: Fail closed on cleartext remote bearer-token deployments and model trusted TLS termination explicitly #1093 — secure bearer-token transport. Non-loopback cleartext HTTP with reusable bearer tokens currently starts successfully; public_base_url=https://... is metadata, not TLS. Production needs direct TLS or an explicit trusted proxy boundary.
• [Security]: Add an append-only, integrity-verifiable trust-event ledger for control-plane mutations #1094 — append-only integrity-verifiable trust-event ledger. Process logs and domain-local lifecycle events are not a complete actor/policy/configuration/control-plane audit boundary. [Security]: Add an append-only, integrity-verifiable trust-event ledger for control-plane mutations #1094 is the canonical ledger owner; duplicate [Architecture][Security]: Add a durable actor-bound operational audit ledger for privileged and state-changing actions #1095/[Security][Architecture]: Add a tenant-scoped tamper-evident audit ledger for trust and policy changes #1097 were closed.
• [Architecture][Security]: Add durable tenant provisioning and global storage admission across persistent tenant roots #1098 — durable tenant provisioning and aggregate storage admission. max_tenant_runtimes limits resident objects, not historical tenant roots. Each tenant independently receives the default 1 GiB blob budget, with no global tenant count/physical-byte reservation.
• [Protocol][Security]: Reject duplicate JSON object names and non-standard numeric values before MCP/Pydantic decoding #1102 — strict raw protocol/config JSON. Jacobian's strict parser rejects duplicate names, but MCP handlers see already-decoded dictionaries after the SDK parser has collapsed duplicate object names. Unique-name/non-finite/size/depth validation must happen before the lossy parse.
• [Superseded]: Do not build mixed-version writer-fencing infrastructure for deleted core state #1111 — mixed-version state compatibility and writer fencing. The migration ledger rejects an already-newer database on startup, but an old process opened before another process migrates is not fenced from later writes. Migration atomicity is not rolling-upgrade compatibility.

Existing owners that complete this control plane

• [Architecture]: Make effective runtime configuration typed, content-addressed, and consistent across entrypoints #1082 — effective runtime/deployment configuration identity.
• [Architecture][Security]: Add tenant-aware execution admission, quotas, and backpressure before worker creation #1083 — process/tenant/provider admission, quotas, queueing, and backpressure.
• [Security]: Separate stable tenant identity from rotating credentials and make remote grants reloadable and revocable #1084 — stable tenant/grant identity, credential reload, rotation, expiry, and revocation.
• [Architecture]: Give durable background work one runtime-owned lifecycle supervisor #1009 / [Architecture]: Model fallible resource shutdown as an explicit terminal state machine #1021 — worker supervision and fallible shutdown/drain ownership.
• [Architecture]: Commit operation artifact lineages through one atomic unit of work #1050 — atomic operation result/artifact lineage publication.
• [Architecture]: Add explicit retention roots, crash-safe artifact reclamation, and tenant-state export/restore #1085 — typed retention roots, crash-safe GC, tenant export/restore.
• [Superseded]: Do not build snapshot/scrub/restore infrastructure for deleted core state #1092 — consistent full-state snapshots, scrub, and verified restore.
• [Superseded]: Do not replace DomainBundle with provider inventories and component graphs #1010 / [Superseded]: Do not add verification protocol declarations/compilers; use concrete checker requests and results #1025 / [Superseded]: Do not replace VerificationService with plan/outcome/transition frameworks #1035 / [Architecture][Operations]: Separate startup, liveness, readiness, draining, and deep diagnostics #1100 — provider/checker separation and finite trust-state enforcement.

Required change to the Wave-0 gate

The current Wave-0 cross-surface browse → search → inspect → invoke sequence is necessary but not sufficient for a production remote release.

Before #1076 can claim supported request-stateless, round-robin deployment, add a control-plane gate proving:

1. non-loopback bearer traffic uses direct TLS or a validated trusted proxy (#1093);
2. ambiguous raw JSON never reaches application routing (#1102);
3. authenticated grants have least-privilege operation/effect authority (#1087);
4. unauthorized work is rejected before admission/provider/storage effects (#1083);
5. a lost response and duplicate delivery cannot duplicate a durable effect (#1088);
6. one durable run has one current fenced owner across processes (#1091);
7. an old release cannot write after an incompatible state migration/activation (#1111);
8. every privileged/control/recovery/configuration action has a durable trust event (#1094);
9. new tenant roots and aggregate persistent bytes are globally admitted (#1098);
10. snapshot/restore/retention operations preserve the complete artifact/checker/audit closure (#1085/#1092).

Recommended implementation order

A. Wire/security identity
   #1102 -> #1093 -> #1084 -> #1087

B. Effect admission and replay safety
   #1034/#1077 -> #1083 -> #1088 -> #1050

C. Durable ownership and deployment generations
   #1009/#1021 -> #1091 -> #1111

D. Persistent resource lifecycle
   #1098 -> #1085 -> #1092

E. Trust and release evidence
   #1094 + #1078

F. Enable final remote topology
   #1076

The agent-facing contract work can continue in parallel, but model-in-the-loop adoption results should not be interpreted as production safety evidence until the relevant transport, authorization, effect, and state topology is frozen.

Program invariant

A host-valid tool call is not automatically:

authorized
admitted once
owned by one worker generation
safe to retry
safe across releases
safe to persist under global capacity
or durably auditable

Each of those is a separately typed/enforced contract. None may be inferred from successful authentication, a capability ID, an MCP annotation, a migration lock, a content-addressed artifact, or a passing mathematical verifier.

[morluto]

MCP SDK 2.0 boundary correction

After reviewing the exact pinned mcp==2.0.0 implementation, this roadmap should not treat MCP protocol, session lifecycle, HTTP parsing, Host/Origin checks, bearer middleware, response framing, or transport ingress as Jacobian architecture to rebuild.

The following issues have been closed as not planned because they duplicated the SDK or deployment boundary:

• [Compatibility]: Migrate remote MCP and doctor to the final 2026-07-28 stateless protocol lifecycle #1076 — custom/forked final-protocol lifecycle migration;
• [Security]: Fail closed on cleartext remote bearer-token deployments and model trusted TLS termination explicitly #1093 — parallel MCP transport-security mode/framework;
• [Protocol][Security]: Reject duplicate JSON object names and non-standard numeric values before MCP/Pydantic decoding #1102 — Jacobian-owned raw MCP JSON parser;
• [Security][Architecture]: Bound pre-auth HTTP ingress before JSON parsing, credential verification, and tenant admission #1114 and [Security][Architecture]: Add transport-edge admission, pre-auth rate limits, and slow-client request budgets #1116 — custom pre-auth HTTP ingress/admission stacks.

The supported MCP boundary is now:

pin MCP Python SDK 2.0
→ use its public server/client APIs and transport-security settings
→ keep the maintained backend loopback-only behind supported TLS ingress
→ test the real SDK surface end to end

MCP SDK 2.0 already owns modern sessionless Streamable HTTP routing, body-size enforcement, Host/Origin/Content-Type validation, authentication middleware, protocol headers, JSON-RPC decoding, response framing, and cancellation behavior. ASGI process concurrency, listener/backlog policy, proxy rate limits, and TLS ingress remain deployment concerns.

Jacobian continues to own only its application semantics above that boundary: canonical tool identity, capability schemas/contracts, tenant/state ownership, authorization policy after SDK authentication facts, idempotency, execution admission, persistence, result projection, and verification. Any stricter MCP wire behavior should be proposed upstream to the SDK rather than implemented as a Jacobian transport fork.

Accordingly, references to #1076 in Wave 0 should be read as pin and conformance-test SDK 2.0, not implement a Jacobian protocol lifecycle.

[morluto]

MCP SDK 2.0 second-pass: shrink the roadmap around native 2026 primitives

I re-audited the MCP-facing roadmap against exact mcp==2.0.0 / protocol 2026-07-28. Several things currently modeled as Jacobian architecture are now SDK/protocol responsibilities and should be deleted or narrowed rather than rebuilt.

Native SDK/protocol primitives to treat as authoritative

Concern	MCP SDK 2.0 / 2026 primitive	Jacobian owner after correction
request tracing/correlation	default OpenTelemetry middleware + W3C context	#1130: semantic child telemetry only
request-scoped runtime hook	public ServerMiddleware / ServerRequestContext	#1134: one tenant/runtime scope middleware
final HTTP routing	Mcp-Method, Mcp-Name, x-mcp-header -> Mcp-Param-*	#1116/#1031/#1131: use canonical capability_id, no custom routing header/body parser
modern lifecycle	2026 requests inherently sessionless	#1076: remove legacy assumptions; stateless_http is only a 2025 compatibility knob
operator/client probe	first-class SDK Client	#1076: delete handwritten MCP client in doctor.cjs
in-flight progress	ctx.report_progress(...)	#1077: synchronous request progress only
cross-call change notification	subscriptions/listen + notify_resource_updated	#1077: advisory experiment-resource invalidation, durable handles remain authoritative
ordinary sync offload	SDK runs def handlers on worker thread	#1077: retain custom worker owner only where late-worker/cancellation/lease semantics require it
Tasks	removed from core; official extension not yet implemented by Python SDK	#1077: do not build TASK_AUGMENTED core semantics; use durable Jacobian handles for now
protocol errors	standardized MCP codes including -32020/-32021/-32022	#1135/#1071: preserve normative code, layer Jacobian diagnostics beneath it
result/list caching	ttlMs / cacheScope; deterministic ordering	#1136: measure/use for stable lists, don't confuse with model prompt compression
input/output schemas	SDK high-level type inference + structured output	#1107/#1031: single-source domain contract; don't add another MCP schema DSL

Native feature that is not sufficient by itself

The audit also found places where keeping Jacobian logic is justified:

• SDK v2 currently still ignores unexpected tool arguments in a known upstream issue; JacobianMCPServer's strict unknown-argument guard remains necessary until the pinned SDK fixes it and conformance proves parity.
• Static resource functions in exact SDK 2.0.0 cannot request Context; the current workaround is justified, but [Architecture]: Use MCP SDK 2.0 middleware as the single request runtime-scope boundary #1134 can eliminate the duplicate routing logic by binding request scope in middleware first.
• SDK worker-thread execution does not prove Jacobian's late-worker tenant lease, process cancellation, or shutdown guarantees; those stronger semantics remain product-owned where required.
• Cache hints are method-level in the Python high-level server. A single long resources/read TTL would be wrong for a surface mixing immutable artifacts/catalogs with mutable experiment:// views.
• subscriptions/listen is advisory delivery, not durable experiment state and not mathematical evidence.

Roadmap consequence

The MCP layer should get smaller as this program lands:

SDK v2 owns
    protocol/version/sessionlessness
    framing/transports
    standard routing headers
    request middleware
    request tracing
    basic schema/function binding
    sync offload
    progress
    subscriptions
    cache/result protocol fields
    standard protocol errors

Jacobian owns
    tenant/runtime authority
    capability contract + mathematical types
    discovery semantics
    effects/authorization/idempotency
    provider/checker identity
    durable experiment lifecycle
    artifact/verification truth
    bounded agent-facing projections

If an MCP PR introduces a local substitute for an SDK-v2 feature in the first block, require an explicit tested gap in the exact pinned SDK before accepting it.

New second-pass owners

• [Architecture]: Use MCP SDK 2.0 OpenTelemetry as the protocol observability boundary #1130 — remove parallel traceparent/request-digest/log-protocol observability.
• [Architecture]: Use MCP SDK 2.0 middleware as the single request runtime-scope boundary #1134 — centralize tenant/runtime acquisition in SDK request middleware.

Existing issues updated with SDK-specific constraints:

• [Compatibility]: Migrate remote MCP and doctor to the final 2026-07-28 stateless protocol lifecycle #1076 — 2026 sessionlessness, doctor client, SSE/legacy split.
• [Architecture]: Make execution shape, deadlines, progress, and cancellation descriptor-owned #1077 — no core Tasks, selective SDK sync offload, native progress/subscriptions.
• [Security][Architecture]: Add transport-edge admission, pre-auth rate limits, and slow-client request budgets #1116 — native MCP routing headers and x-mcp-header.
• [Architecture]: Unify MCP protocol errors, discovery errors, and capability diagnostics into one recoverable taxonomy #1135 — preserve standardized v2 protocol errors.
• [Architecture]: Bound and measure the complete model-facing MCP context, not only tool-result bytes #1136 — distinguish MCP response caching from model-facing context caching.

This should be used as an architectural deletion gate: the target is not a richer Jacobian MCP framework; it is a thin product layer over the v2 SDK.

[morluto]

Closing as superseded by #1148.

This roadmap was the predecessor to the product surface cleanup roadmap (#1148). Its content is heavily stale:

• References EXPLORE/VERIFY modes, CapabilityMode, and assurance_ceiling — all removed in [Architecture]: Retire EXPLORE/VERIFY mode — tool identity owns role, assurance owns trust #1143/Remove dual-mode tools and mode from MCP agent surface (#1143, #1148) #1158
• References [Feature]: Default math.run mode to the capability's sole advertised mode #990 (closed as stale — mode is gone)
• References [Bug]: Publish descriptor-owned assurance ceilings instead of inferring COMPUTED from EXPLORE #1067 (closed as stale — assurance_ceiling is gone)
• References "foreground COMPUTED" ([Feature]: Foreground COMPUTED as the default success path in agent guidance #988, closed as absorbed by the product blueprint)
• Frames the repair around mode-specific assurance ceilings and EXPLORE/VERIFY lanes

#1148 is the active roadmap. It tracks the same structural concerns (canonical identity, typed handoffs, bounded execution, result projection) under the math-first product framing where ordinary tools return values and checkers are separate catalog IDs.