test(conformance): bump referee 0.2.0-alpha.4 -> 0.2.0-alpha.5

The alpha.5 referee carries conformance#353 (the spec#2907 error-code
renumber), so the SDK and referee are aligned on -32020/-32021/-32022 and
the renumber-mismatch expected-failures recorded in the previous commit
burn here:

- expected-failures.yaml: drop client request-metadata; drop the entire
  server section (http-custom-header-server-validation, http-header-validation,
  server-stateless) -> server: [].
- expected-failures.2026-07-28.yaml: drop client request-metadata; drop the
  three server renumber cells (json-schema-2020-12 stays).

alpha.5 also carries conformance#359 which gates the SEP-2350 scope-step-up
WARNING to 2026-07-28+, so auth/scope-step-up burns on the 2025 client leg
(it remains in the 2026-07-28 baseline where it still fails on the 2026
connection-lifecycle gap).

alpha.5 ships the conformance#262 SEP-2663 tasks-* scenarios, but they are
extension-sourced (source.extensionId io.modelcontextprotocol/tasks) and do
not run against a server that does not advertise the extension, so no new
expected-failures entries are needed; they will appear when ext-tasks lands.

Header NOTE in both files flipped from 'AHEAD of this referee' to 'aligned
with what this referee asserts'. README unchanged (does not reference the
pin version).

Author: felixweinberger

pnpm-lock.yaml

@@ -15,12 +15,9 @@
 # release pinned in package.json. Newer conformance releases are adopted by
 # deliberately bumping the pin and reconciling this file in the same change.
 #
-# NOTE: the SDK's modern-path rejection codes are AHEAD of this referee's
-# assignments — the SDK has adopted the spec#2907 / conformance#353 renumber
-# (-32020 / -32021 / -32022) on both the emission and recognition paths,
-# while the 0.2.0-alpha.4 referee still asserts the pre-renumber codes
-# (-32001 / -32003 / -32004). The affected cells are listed below and burn when
-# the conformance pin bumps to >=0.2.0-alpha.5 (carries conformance#353).
+# NOTE: the SDK's modern-path rejection codes are aligned with what this
+# referee asserts — both sides have adopted the spec#2907 / conformance#353
+# renumber (-32020 / -32021 / -32022) on emission and recognition.
 #
 # Entries are grouped by what unblocks them. As each gap closes the
 # corresponding scenarios start passing and MUST be removed from this list
@@ -69,23 +66,10 @@ client:
     # when PRM authorization_servers changes.
     - auth/authorization-server-migration
 
-    # --- spec#2907 error-code renumber (SDK ahead of referee) ---
-    # SDK adopted spec#2907 renumber; burns when conformance pin bumps to
-    # >=0.2.0-alpha.5 (carries conformance#353). Same failure as the 2025 leg.
-    - request-metadata
-
 server:
     # --- Carried-forward scenarios (also run by the 2025 legs) ---
     # Pre-existing fixture/baseline bug: the fixture tool's schema is a plain
     # Zod object with none of the JSON Schema 2020-12 keywords the scenario
     # checks; it fails identically at 2025 in `--suite all` (not a 2026-path
     # regression).
     - json-schema-2020-12
-    # --- spec#2907 error-code renumber (SDK ahead of referee) ---
-    # SDK adopted spec#2907 renumber; burns when conformance pin bumps to
-    # >=0.2.0-alpha.5 (carries conformance#353). SDK emits -32020/-32021/-32022; the
-    # alpha.4 referee asserts -32001/-32003/-32004. Same failure as the 2025
-    # leg.
-    - http-custom-header-server-validation
-    - http-header-validation
-    - server-stateless

test/conformance/expected-failures.2026-07-28.yaml

@@ -2,19 +2,16 @@
 # CI exits 0 if only these fail, exits 1 on unexpected failures or stale entries.
 #
 # Baseline established against the published @modelcontextprotocol/conformance
-# release pinned in package.json (0.2.0-alpha.4). Newer conformance releases
+# release pinned in package.json (0.2.0-alpha.5). Newer conformance releases
 # are adopted by deliberately bumping the package.json pin and reconciling
 # this file in the same change.
 #
-# NOTE: the SDK's modern-path rejection codes are AHEAD of this referee's
-# assignments — the SDK has adopted the spec#2907 / conformance#353 renumber
-# (-32020 HeaderMismatch / -32021 MissingRequiredClientCapability / -32022
-# UnsupportedProtocolVersion) on both the emission and recognition paths,
-# while the 0.2.0-alpha.4 referee still asserts the pre-renumber codes
-# (-32001 / -32003 / -32004). The affected cells are listed below and burn
-# when the conformance pin bumps to >=0.2.0-alpha.5 (carries conformance#353).
-# A missing _meta envelope (or missing protocolVersion key) still answers
-# -32602 on both sides.
+# NOTE: the SDK's modern-path rejection codes are aligned with what this
+# referee asserts — both sides have adopted the spec#2907 / conformance#353
+# renumber (-32020 HeaderMismatch / -32021 MissingRequiredClientCapability /
+# -32022 UnsupportedProtocolVersion) on emission and recognition. A missing
+# _meta envelope (or missing protocolVersion key) still answers -32602 on
+# both sides.
 #
 # Entries are grouped by SEP. As each SEP/milestone is implemented in the SDK the
 # corresponding scenarios start passing and MUST be removed from this list (the
@@ -40,26 +37,10 @@ client:
     - auth/offline-access-not-supported
 
     # --- Pre-existing scenarios that fail on checks added after conformance 0.1.15 ---
-    # SEP-2350 (scope step-up): WARNING-only — client does not compute the union of
-    # previously requested and newly challenged scopes on re-authorization; the
-    # expected-failures evaluator counts WARNINGs as failures.
-    - auth/scope-step-up
     # SEP-990 (enterprise-managed authorization extension): no fixture handler /
     # client support for the token-exchange + JWT bearer flow.
     - auth/enterprise-managed-authorization
 
-    # --- spec#2907 error-code renumber (SDK ahead of referee) ---
-    # SDK adopted spec#2907 renumber; burns when conformance pin bumps to
-    # >=0.2.0-alpha.5 (carries conformance#353). The alpha.4 mock rejects with
-    # -32004 where the SDK probe classifier now recognises -32022, so the
-    # corrective continuation never fires.
-    - request-metadata
-
-server:
-    # --- spec#2907 error-code renumber (SDK ahead of referee) ---
-    # SDK adopted spec#2907 renumber; burns when conformance pin bumps to
-    # >=0.2.0-alpha.5 (carries conformance#353). SDK emits -32020/-32021/-32022;
-    # the alpha.4 referee asserts -32001/-32003/-32004.
-    - http-custom-header-server-validation
-    - http-header-validation
-    - server-stateless
+# No server entries at the 0.2.0-alpha.5 referee — the spec#2907 renumber-mismatch
+# cells burned at this pin.
+server: []

test/conformance/expected-failures.yaml

@@ -40,7 +40,7 @@
         "test:conformance:all": "pnpm run test:conformance:client:all && pnpm run test:conformance:server:all"
     },
     "devDependencies": {
-        "@modelcontextprotocol/conformance": "0.2.0-alpha.4",
+        "@modelcontextprotocol/conformance": "0.2.0-alpha.5",
         "@modelcontextprotocol/client": "workspace:^",
         "@modelcontextprotocol/server": "workspace:^",
         "@modelcontextprotocol/core": "workspace:^",