Re-pin the negative-ttl and Mcp-Param mismatch tests to the landed behaviour

The client now clamps a negative inbound ttlMs to 0 before validation, and
the modern HTTP entry validates Mcp-Param-* headers against the tool's
advertised schema. Both tests flip from pinning the old gap to asserting
the spec-mandated outcome, and their divergence records are removed.

Author: maxisbey

tests/interaction/_requirements.py

@@ -4443,20 +4443,10 @@ def __post_init__(self) -> None:
         source=f"{SPEC_2026_BASE_URL}/server/utilities/caching#time-to-live-ttl-field",
         behavior="A negative ttlMs on an inbound result is ignored and treated as 0.",
         added_in="2026-07-28",
-        divergence=Divergence(
-            note=(
-                "The client rejects a negative ttlMs with a pydantic ValidationError out of the "
-                "request call instead of ignoring it and treating it as 0: Field(ge=0) on the "
-                "2026-07-28 wire surface (and on the monolith CacheableResult) raises before any "
-                "coerce-to-zero leniency could run, and there is no response cache for 'treat as "
-                "0' to act on. The gap is asymmetric: ge=0 on server-authored EMISSION is correct "
-                "by-construction strictness (a conformant server can never author a negative "
-                "ttlMs through the typed API); the gap is ONLY the client's inbound parse, which "
-                "validates before any clamp-to-0 could apply. The remedy is receive-side leniency "
-                "-- clamp a negative inbound ttlMs to 0 before validation -- NOT loosening the "
-                "shared type, which would silently bless negative emission server-side."
-            ),
-            issue="L112",
+        note=(
+            "The leniency is receive-side only: the client clamps a negative inbound ttlMs to 0 "
+            "before validation, while emission keeps ge=0 on the shared type -- a conformant "
+            "server can never author a negative ttlMs through the typed API."
         ),
     ),
     "caching:ttl:positive-fresh-window": Requirement(
@@ -6183,22 +6173,11 @@ def __post_init__(self) -> None:
         ),
         added_in="2026-07-28",
         transports=("streamable-http",),
-        divergence=Divergence(
-            note=(
-                "The server performs no Mcp-Param-* header validation: the inbound ladder "
-                "compares only MCP-Protocol-Version, Mcp-Method and Mcp-Name, so a request "
-                "whose decoded Mcp-Param header disagrees with the body argument is accepted "
-                "and the handler runs on the body value; the same gap covers the spec's "
-                "'client omits header but value is in body' reject row. The SDK has no notion "
-                "of a 'recognized' param header (the inbound ladder never sees a tool schema); "
-                "the pinned accept uses a header that name-matches a body argument -- the "
-                "strongest candidate for any future validation -- and the unknown-header arm "
-                "(a header with no corresponding body argument) is deliberately not pinned: "
-                "its reject-vs-ignore consequence must be decided when validation lands."
-            ),
-            issue="L110",
+        note=(
+            "TS implements this (createMcpHandler) with no requirement id of its own. When the "
+            "server registers no tools/list handler the validation deliberately fails open and "
+            "the call is served."
         ),
-        note="TS implements this (createMcpHandler) with no requirement id of its own.",
     ),
     "hosting:http:modern:invalid-header-chars-rejected": Requirement(
         source=f"{SPEC_2026_BASE_URL}/basic/transports/streamable-http#server-behavior-for-custom-headers",

tests/interaction/lowlevel/test_caching.py

@@ -27,7 +27,6 @@
     Tool,
 )
 from mcp_types.version import LATEST_MODERN_VERSION
-from pydantic import ValidationError
 
 from mcp.client import ClientRequestContext
 from mcp.client.client import Client
@@ -257,10 +256,10 @@ async def answer_who(context: ClientRequestContext, params: types.ElicitRequestP
 
 
 @requirement("caching:ttl:negative-treated-as-zero")
-async def test_a_negative_ttl_from_a_nonconformant_server_is_rejected_not_coerced_to_zero() -> None:
-    """An inbound ttlMs of -1 raises ValidationError instead of being treated as 0 (pinned Divergence).
+async def test_a_negative_ttl_from_a_nonconformant_server_is_clamped_to_zero() -> None:
+    """An inbound ttlMs of -1 surfaces as ttl_ms 0 instead of failing validation. Spec-mandated (SHOULD).
 
-    When coerce-to-zero leniency lands: re-pin to ttl_ms == 0 and delete the Divergence.
+    Scripted peer: the typed Server cannot author a negative ttlMs (emission keeps ge=0).
     """
     async with create_client_server_memory_streams() as (client_streams, server_streams):
         client_read, client_write = client_streams
@@ -295,12 +294,9 @@ async def scripted_server() -> None:
                     server_info=Implementation(name="srv", version="0"),
                 )
             )
-            with pytest.raises(ValidationError) as excinfo:
-                with anyio.fail_after(5):
-                    await session.list_tools()
-
-            errors = excinfo.value.errors()
-            assert len(errors) == 1
-            assert errors[0]["loc"] == ("ttlMs",)
-            # Stable pydantic-core identifier; the message text is third-party and deliberately unpinned.
-            assert errors[0]["type"] == "greater_than_equal"
+            with anyio.fail_after(5):
+                result = await session.list_tools()
+
+            assert result.ttl_ms == 0
+            assert result.cache_scope == "public"
+            assert result.tools == []

tests/interaction/transports/test_hosting_http_modern.py

@@ -1450,19 +1450,24 @@ async def call_tool(ctx: ServerRequestContext, params: CallToolRequestParams) ->
 
 
 @requirement("hosting:http:modern:mcp-param-mismatch-400")
-async def test_modern_entry_accepts_a_mismatching_mcp_param_header_without_validation() -> None:
-    """A tools/call whose Mcp-Param header disagrees with the body argument is accepted, pinning the gap.
+async def test_modern_mcp_param_header_disagreeing_with_body_argument_is_rejected_400_header_mismatch() -> None:
+    """A ``Mcp-Param-*`` header disagreeing with its body argument is rejected with HTTP 400 and HeaderMismatch.
 
-    Pins a recorded divergence: the spec mandates 400/-32020 HeaderMismatch on a decoded-header /
-    body disagreement, but the ladder compares only MCP-Protocol-Version, Mcp-Method and Mcp-Name,
-    so the handler runs on the body value. When validation lands: this test flips to 400 and
-    re-pins, while the null-and-absent acceptance test above must stay green.
+    Spec-mandated: the server resolves the ``x-mcp-header`` annotation from the tool's advertised
+    ``inputSchema`` via its own tools/list handler and rejects the decoded-header/body disagreement
+    before dispatch. Raw httpx because the HTTP status is a wire-only observable and the typed
+    client cannot emit a mismatching header by construction.
     """
 
+    async def list_tools(ctx: ServerRequestContext, params: PaginatedRequestParams | None) -> ListToolsResult:
+        tool = Tool(
+            name="run",
+            input_schema={"type": "object", "properties": {"region": {"type": "string", "x-mcp-header": "Region"}}},
+        )
+        return ListToolsResult(tools=[tool])
+
     async def call_tool(ctx: ServerRequestContext, params: CallToolRequestParams) -> CallToolResult:
-        assert params.name == "run"
-        assert params.arguments == {"region": "us-west1"}
-        return CallToolResult(content=[TextContent(text="ok")])
+        raise NotImplementedError  # The mismatch is rejected before dispatch reaches the handler.
 
     body = {
         "jsonrpc": "2.0",
@@ -1472,13 +1477,15 @@ async def call_tool(ctx: ServerRequestContext, params: CallToolRequestParams) ->
     }
     headers = _modern_headers(method="tools/call", name="run") | {"mcp-param-region": "eu-central1"}
     with anyio.fail_after(5):
-        async with mounted_app(Server("param-mismatch", on_call_tool=call_tool)) as (http, _):
+        async with mounted_app(Server("param-mismatch", on_list_tools=list_tools, on_call_tool=call_tool)) as (
+            http,
+            _,
+        ):
             response = await http.post("/mcp", json=body, headers=headers)
 
-    # 200, not the spec-mandated 400: the request is served despite the mismatching header.
-    assert response.status_code == 200
-    parsed = JSONRPCResponse.model_validate(response.json())
-    assert parsed.id == 1
-    assert parsed.result == snapshot(
-        {"content": [{"text": "ok", "type": "text"}], "isError": False, "resultType": "complete"}
+    assert response.status_code == 400
+    assert JSONRPCError.model_validate(response.json()).error == snapshot(
+        ErrorData(
+            code=HEADER_MISMATCH, message="Mcp-Param-Region header does not match the request body's 'region' argument"
+        )
     )