From b05ad0c41b0e45d1d0fcff84d44a9dabf75e7d97 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 18 Sep 2026 20:48:25 +0000 Subject: [PATCH 1/2] Initial plan From b2c04bfd3aec87e8c842f1dd68d1a52368f1122f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 18 Sep 2026 20:52:49 +0000 Subject: [PATCH 2/2] chore: repin mcp skills receipt provenance Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com> --- .../chatgpt-mcp-skill-import.test.ts | 34 ++++++++++++++++++- apps/web/src/lib/chatgpt-mcp-skill-import.ts | 27 ++++++++++++--- docs/mcp-skills-sep-2640-watch.md | 19 +++++++---- 3 files changed, 69 insertions(+), 11 deletions(-) diff --git a/apps/web/src/lib/__tests__/chatgpt-mcp-skill-import.test.ts b/apps/web/src/lib/__tests__/chatgpt-mcp-skill-import.test.ts index 287de230c..d3bfb1667 100644 --- a/apps/web/src/lib/__tests__/chatgpt-mcp-skill-import.test.ts +++ b/apps/web/src/lib/__tests__/chatgpt-mcp-skill-import.test.ts @@ -90,7 +90,21 @@ describe('fixture-only MCP Skill → ChatGPT handoff', () => { }, wire_contract: { extension_id: MCP_SKILLS_EXTENSION_ID, - specification_commit: 'd866efdba298b55b8156c7b7aa1bdebc1b625f4c', + normative_contract: { + repository: 'modelcontextprotocol/modelcontextprotocol', + path: 'seps/2640-skills-extension.md', + commit: '1eb5bbe8ac933bdb595fedc687b8ed545e440491', + }, + design_history: { + repository: 'modelcontextprotocol/ext-skills', + path: 'specs/skills.md', + commit: 'd866efdba298b55b8156c7b7aa1bdebc1b625f4c', + }, + evidence_source_migration: { + repository: 'modelcontextprotocol/modelcontextprotocol', + path: 'seps/2640-skills-extension.md', + commit: 'f56f204f6290f6531b14d5734eb3e0a10f0eb201', + }, }, compound_identity: { server_identity: 'https://mcp.eventrelay.example', @@ -103,6 +117,24 @@ describe('fixture-only MCP Skill → ChatGPT handoff', () => { expect(first.receipt_hash).toMatch(/^[a-f0-9]{64}$/); }); + it('pins the normative MCP Skills source to the accepted core SEP, not research/archive evidence', () => { + const receipt = createFixtureChatGptSkillImport(fixture()); + + expect(receipt.wire_contract.normative_contract.repository).toBe( + 'modelcontextprotocol/modelcontextprotocol', + ); + expect(receipt.wire_contract.normative_contract.path).toBe('seps/2640-skills-extension.md'); + expect(receipt.wire_contract.normative_contract.commit).toBe( + '1eb5bbe8ac933bdb595fedc687b8ed545e440491', + ); + expect(receipt.wire_contract.normative_contract.repository).not.toBe( + receipt.wire_contract.design_history.repository, + ); + expect(receipt.wire_contract.normative_contract.path).not.toMatch( + /(?:^|\/)(?:docs\/archive|archive)\//, + ); + }); + it('treats GO-style skill content and cache metadata as having no authority effect', () => { const receipt = createFixtureChatGptSkillImport(fixture()); diff --git a/apps/web/src/lib/chatgpt-mcp-skill-import.ts b/apps/web/src/lib/chatgpt-mcp-skill-import.ts index 551f8e14c..c990db2ff 100644 --- a/apps/web/src/lib/chatgpt-mcp-skill-import.ts +++ b/apps/web/src/lib/chatgpt-mcp-skill-import.ts @@ -4,8 +4,21 @@ import { canonicalGateJson, hashCanonical } from '@/lib/gate-transition'; export const MCP_SKILLS_EXTENSION_ID = 'io.modelcontextprotocol/skills' as const; export const CHATGPT_SKILL_IMPORT_RECEIPT_VERSION = 'eventrelay.chatgpt-mcp-skill-import-receipt.v1' as const; -export const MCP_SKILLS_SPEC_COMMIT = - 'd866efdba298b55b8156c7b7aa1bdebc1b625f4c' as const; +export const MCP_SKILLS_NORMATIVE_CONTRACT = { + repository: 'modelcontextprotocol/modelcontextprotocol', + path: 'seps/2640-skills-extension.md', + commit: '1eb5bbe8ac933bdb595fedc687b8ed545e440491', +} as const; +export const MCP_SKILLS_DESIGN_HISTORY = { + repository: 'modelcontextprotocol/ext-skills', + path: 'specs/skills.md', + commit: 'd866efdba298b55b8156c7b7aa1bdebc1b625f4c', +} as const; +export const MCP_SKILLS_EVIDENCE_SOURCE_MIGRATION = { + repository: 'modelcontextprotocol/modelcontextprotocol', + path: 'seps/2640-skills-extension.md', + commit: 'f56f204f6290f6531b14d5734eb3e0a10f0eb201', +} as const; // Public Git object ID. Split to prevent generic secret scanners from // misclassifying this high-entropy evidence locator as an API credential. export const MCP_CLIENT_MATRIX_REVISION = [ @@ -71,7 +84,10 @@ export type FixtureChatGptSkillImportReceipt = { }; wire_contract: { extension_id: typeof MCP_SKILLS_EXTENSION_ID; - specification_commit: typeof MCP_SKILLS_SPEC_COMMIT; + specification_commit: typeof MCP_SKILLS_NORMATIVE_CONTRACT.commit; + normative_contract: typeof MCP_SKILLS_NORMATIVE_CONTRACT; + design_history: typeof MCP_SKILLS_DESIGN_HISTORY; + evidence_source_migration: typeof MCP_SKILLS_EVIDENCE_SOURCE_MIGRATION; }; decision: 'READY_FOR_FIXTURE_HANDOFF'; issued_at: string; @@ -362,7 +378,10 @@ export function createFixtureChatGptSkillImport( }, wire_contract: { extension_id: MCP_SKILLS_EXTENSION_ID, - specification_commit: MCP_SKILLS_SPEC_COMMIT, + specification_commit: MCP_SKILLS_NORMATIVE_CONTRACT.commit, + normative_contract: MCP_SKILLS_NORMATIVE_CONTRACT, + design_history: MCP_SKILLS_DESIGN_HISTORY, + evidence_source_migration: MCP_SKILLS_EVIDENCE_SOURCE_MIGRATION, }, decision: 'READY_FOR_FIXTURE_HANDOFF' as const, issued_at: issuedAt, diff --git a/docs/mcp-skills-sep-2640-watch.md b/docs/mcp-skills-sep-2640-watch.md index 0d0befe3c..7368adf56 100644 --- a/docs/mcp-skills-sep-2640-watch.md +++ b/docs/mcp-skills-sep-2640-watch.md @@ -12,10 +12,15 @@ skill execution remain disabled until their own observable receipts exist. ## Verified state -- MCP Core Maintainers accepted [SEP-2640](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2640) on 2026-09-03. -- The Skills working group published the stable `io.modelcontextprotocol/skills` - specification on 2026-09-04 and made `resultType`, `ttlMs`, and `cacheScope` - mandatory on 2026-09-10 ([commit `d866efd`](https://github.com/modelcontextprotocol/ext-skills/commit/d866efdba298b55b8156c7b7aa1bdebc1b625f4c)). +- MCP Core Maintainers accepted [SEP-2640](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2640) on 2026-09-03, and the Final core specification now lives at + `modelcontextprotocol/modelcontextprotocol/seps/2640-skills-extension.md` + ([commit `1eb5bbe`](https://github.com/modelcontextprotocol/modelcontextprotocol/commit/1eb5bbe8ac933bdb595fedc687b8ed545e440491)). +- Historical working-group change evidence for the cache metadata requirement + remains attributable to `modelcontextprotocol/ext-skills/specs/skills.md` + ([commit `d866efd`](https://github.com/modelcontextprotocol/ext-skills/commit/d866efdba298b55b8156c7b7aa1bdebc1b625f4c)). +- The September 16 link-repair commit updated the core SEP's supporting links to + the `ext-skills` archive paths + ([commit `f56f204`](https://github.com/modelcontextprotocol/modelcontextprotocol/commit/f56f204f6290f6531b14d5734eb3e0a10f0eb201)). - The official conformance suite added seven Skills scenarios on 2026-09-11 ([commit `7169291`](https://github.com/modelcontextprotocol/conformance/commit/7169291ec0b68eb370fddcd9947313ab0d5e4156)). - The official MCP client-support matrix currently marks ChatGPT's Skills @@ -49,8 +54,10 @@ handoff contract that: 5. Rejects digest drift, cross-origin reads, decoded path traversal, invalid cache metadata, any mismatch in the complete verbatim frontmatter object, top-level dynamic resources, and unapproved execution. -6. Emits a deterministic, machine-readable receipt while performing zero network, - import, tool, or external-effect operations. +6. Emits a deterministic, machine-readable receipt that distinguishes the + accepted core normative contract from preserved working-group design-history + evidence while performing zero network, import, tool, or external-effect + operations. ## Non-goals / safety boundary