Make draft and HTTP sessions mutually exclusive; gate Tasks to draft

Over HTTP the draft revision is unconditionally sessionless, so the server now enforces that the draft protocol and an Mcp-Session-Id can never coexist:

- Reject any request that carries the draft MCP-Protocol-Version together with an Mcp-Session-Id (POST/GET/DELETE).

- When Stateless = false, refuse a sessionless draft request with -32004 UnsupportedProtocolVersion so a dual-era client downgrades to the legacy initialize handshake and obtains the session the author opted into. Stateless = true (the default) still serves sessionless draft natively.

- Gate the SEP-2663 Tasks extension to the draft revision on the server: tasks/* handlers reject non-draft requests with MethodNotFound, and task augmentation is only applied for draft clients that opt in. This lets the per-request capability sync overwrite rather than merge a partial legacy envelope.

- Mark the stateful-only HttpServerTransportOptions knobs obsolete (MCP9006) now that the default is stateless, and remove the dead fan-out / forceStateless plumbing left over from the stateful draft path.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: halter73

src/ModelContextProtocol.AspNetCore/DistributedCacheEventStreamStoreOptionsSetup.cs

@@ -4,7 +4,7 @@
 
 namespace ModelContextProtocol.AspNetCore;
 
-#pragma warning disable MCP9005 // This type only exists to configure the obsolete legacy resumability store.
+#pragma warning disable MCP9006 // This type only exists to configure the obsolete legacy resumability store.
 
 /// <summary>
 /// Configures <see cref="DistributedCacheEventStreamStoreOptions"/> by resolving

src/ModelContextProtocol.AspNetCore/DistributedCacheEventStreamStoreOptionsValidator.cs

@@ -5,7 +5,7 @@
 
 namespace ModelContextProtocol.AspNetCore;
 
-#pragma warning disable MCP9005 // This type only exists to validate the obsolete legacy resumability store options.
+#pragma warning disable MCP9006 // This type only exists to validate the obsolete legacy resumability store options.
 
 /// <summary>
 /// Validates that <see cref="DistributedCacheEventStreamStoreOptions.Cache"/> is set.

src/ModelContextProtocol.AspNetCore/HttpMcpServerBuilderExtensions.cs

@@ -85,7 +85,7 @@ public static IMcpServerBuilder AddAuthorizationFilters(this IMcpServerBuilder b
     /// </para>
     /// </remarks>
     [Obsolete(ModelContextProtocol.Obsoletions.LegacyStatefulHttp_Message, DiagnosticId = ModelContextProtocol.Obsoletions.LegacyStatefulHttp_DiagnosticId, UrlFormat = ModelContextProtocol.Obsoletions.LegacyStatefulHttp_Url)]
-#pragma warning disable MCP9005 // The method is itself obsolete and intentionally wires up the legacy resumability store.
+#pragma warning disable MCP9006 // The method is itself obsolete and intentionally wires up the legacy resumability store.
     public static IMcpServerBuilder WithDistributedCacheEventStreamStore(this IMcpServerBuilder builder, Action<DistributedCacheEventStreamStoreOptions>? configureOptions = null)
     {
         ArgumentNullException.ThrowIfNull(builder);
@@ -101,5 +101,5 @@ public static IMcpServerBuilder WithDistributedCacheEventStreamStore(this IMcpSe
 
         return builder;
     }
-#pragma warning restore MCP9005
+#pragma warning restore MCP9006
 }

src/ModelContextProtocol.AspNetCore/HttpServerTransportOptions.cs

@@ -61,9 +61,12 @@ public class HttpServerTransportOptions
     /// might arrive at another ASP.NET Core application process.
     /// Client sampling, elicitation, and roots capabilities are also disabled in stateless mode, because the server cannot make requests.
     /// <para>
-    /// Requests that declare the <c>2026-07-28</c> draft protocol revision via the <c>MCP-Protocol-Version</c> header
-    /// are always routed through the stateless path regardless of this property's value, because that revision
-    /// removes <c>Mcp-Session-Id</c> entirely (SEP-2567).
+    /// The <c>2026-07-28</c> draft protocol revision is sessionless and removes <c>Mcp-Session-Id</c> entirely
+    /// (SEP-2567), so over HTTP draft requests are only ever served when <see langword="true"/>. When this
+    /// property is <see langword="false"/>, a sessionless draft request is refused with a
+    /// <c>-32004 UnsupportedProtocolVersion</c> error so that a dual-era client downgrades to the legacy
+    /// <c>initialize</c> handshake and obtains the session that the server was configured to provide. A draft
+    /// request that carries an <c>Mcp-Session-Id</c> is always rejected, regardless of this property's value.
     /// </para>
     /// </remarks>
     public bool Stateless { get; set; } = true;

src/ModelContextProtocol.AspNetCore/HttpServerTransportOptionsSetup.cs

@@ -12,9 +12,9 @@ internal sealed class HttpServerTransportOptionsSetup(IServiceProvider servicePr
 {
     public void Configure(HttpServerTransportOptions options)
     {
-#pragma warning disable MCP9005 // Stateful Streamable HTTP options are obsolete but still wired up internally.
+#pragma warning disable MCP9006 // Stateful Streamable HTTP options are obsolete but still wired up internally.
         options.EventStreamStore ??= serviceProvider.GetService<ISseEventStreamStore>();
         options.SessionMigrationHandler ??= serviceProvider.GetService<ISessionMigrationHandler>();
-#pragma warning restore MCP9005
+#pragma warning restore MCP9006
     }
 }

src/ModelContextProtocol.AspNetCore/IdleTrackingBackgroundService.cs

@@ -1,4 +1,4 @@
-using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 
@@ -18,14 +18,14 @@ public IdleTrackingBackgroundService(
         ILogger<IdleTrackingBackgroundService> logger)
     {
         // Still run loop given infinite IdleTimeout to enforce the MaxIdleSessionCount and assist graceful shutdown.
-#pragma warning disable MCP9005 // Stateful Streamable HTTP options are obsolete but still wired up internally.
+#pragma warning disable MCP9006 // Stateful Streamable HTTP options are obsolete but still wired up internally.
         if (options.Value.IdleTimeout != Timeout.InfiniteTimeSpan)
         {
             ArgumentOutOfRangeException.ThrowIfLessThan(options.Value.IdleTimeout, TimeSpan.Zero);
         }
 
         ArgumentOutOfRangeException.ThrowIfLessThan(options.Value.MaxIdleSessionCount, 0);
-#pragma warning restore MCP9005
+#pragma warning restore MCP9006
 
         _sessions = sessions;
         _options = options;

src/ModelContextProtocol.AspNetCore/SseEventStreamReaderExtensions.cs

@@ -7,7 +7,7 @@
 
 namespace ModelContextProtocol.AspNetCore;
 
-#pragma warning disable MCP9005 // These extensions only operate on the obsolete legacy resumability reader.
+#pragma warning disable MCP9006 // These extensions only operate on the obsolete legacy resumability reader.
 
 /// <summary>
 /// Provides extension methods for <see cref="ISseEventStreamReader"/>.

src/ModelContextProtocol.AspNetCore/StatefulSessionManager.cs

@@ -1,4 +1,4 @@
-using System.Collections.Concurrent;
+using System.Collections.Concurrent;
 using System.Diagnostics;
 using System.Diagnostics.CodeAnalysis;
 using System.Runtime.InteropServices;
@@ -17,11 +17,11 @@ internal sealed partial class StatefulSessionManager(
     private readonly ConcurrentDictionary<string, StreamableHttpSession> _sessions = new(StringComparer.Ordinal);
 
     private readonly TimeProvider _timeProvider = httpServerTransportOptions.Value.TimeProvider;
-#pragma warning disable MCP9005 // Stateful Streamable HTTP options are obsolete but still wired up internally.
+#pragma warning disable MCP9006 // Stateful Streamable HTTP options are obsolete but still wired up internally.
     private readonly TimeSpan _idleTimeout = httpServerTransportOptions.Value.IdleTimeout;
     private readonly long _idleTimeoutTicks = GetIdleTimeoutInTimestampTicks(httpServerTransportOptions.Value.IdleTimeout, httpServerTransportOptions.Value.TimeProvider);
     private readonly int _maxIdleSessionCount = httpServerTransportOptions.Value.MaxIdleSessionCount;
-#pragma warning restore MCP9005
+#pragma warning restore MCP9006
 
     private readonly object _idlePruningLock = new();
     private readonly List<long> _idleTimestamps = [];