chore(factory): repin MCP Skills evidence to accepted core SEP

apps/web/src/lib/__tests__/chatgpt-mcp-skill-import.test.ts

@@ -90,7 +90,21 @@ describe('fixture-only MCP Skill → ChatGPT handoff', () => {
       },
       wire_contract: {
         extension_id: MCP_SKILLS_EXTENSION_ID,
-        specification_commit: 'd866efdba298b55b8156c7b7aa1bdebc1b625f4c',
+        normative_contract: {
+          repository: 'modelcontextprotocol/modelcontextprotocol',
+          path: 'seps/2640-skills-extension.md',
+          commit: '1eb5bbe8ac933bdb595fedc687b8ed545e440491',
+        },
+        design_history: {
+          repository: 'modelcontextprotocol/ext-skills',
+          path: 'specs/skills.md',
+          commit: 'd866efdba298b55b8156c7b7aa1bdebc1b625f4c',
+        },
+        evidence_source_migration: {
+          repository: 'modelcontextprotocol/modelcontextprotocol',
+          path: 'seps/2640-skills-extension.md',
+          commit: 'f56f204f6290f6531b14d5734eb3e0a10f0eb201',
+        },
       },
       compound_identity: {
         server_identity: 'https://mcp.eventrelay.example',
@@ -103,6 +117,24 @@ describe('fixture-only MCP Skill → ChatGPT handoff', () => {
     expect(first.receipt_hash).toMatch(/^[a-f0-9]{64}$/);
   });
 
+  it('pins the normative MCP Skills source to the accepted core SEP, not research/archive evidence', () => {
+    const receipt = createFixtureChatGptSkillImport(fixture());
+
+    expect(receipt.wire_contract.normative_contract.repository).toBe(
+      'modelcontextprotocol/modelcontextprotocol',
+    );
+    expect(receipt.wire_contract.normative_contract.path).toBe('seps/2640-skills-extension.md');
+    expect(receipt.wire_contract.normative_contract.commit).toBe(
+      '1eb5bbe8ac933bdb595fedc687b8ed545e440491',
+    );
+    expect(receipt.wire_contract.normative_contract.repository).not.toBe(
+      receipt.wire_contract.design_history.repository,
+    );
+    expect(receipt.wire_contract.normative_contract.path).not.toMatch(
+      /(?:^|\/)(?:docs\/archive|archive)\//,
+    );
+  });
+
   it('treats GO-style skill content and cache metadata as having no authority effect', () => {
     const receipt = createFixtureChatGptSkillImport(fixture());
 

apps/web/src/lib/chatgpt-mcp-skill-import.ts

@@ -4,8 +4,21 @@ import { canonicalGateJson, hashCanonical } from '@/lib/gate-transition';
 export const MCP_SKILLS_EXTENSION_ID = 'io.modelcontextprotocol/skills' as const;
 export const CHATGPT_SKILL_IMPORT_RECEIPT_VERSION =
   'eventrelay.chatgpt-mcp-skill-import-receipt.v1' as const;
-export const MCP_SKILLS_SPEC_COMMIT =
-  'd866efdba298b55b8156c7b7aa1bdebc1b625f4c' as const;
+export const MCP_SKILLS_NORMATIVE_CONTRACT = {
+  repository: 'modelcontextprotocol/modelcontextprotocol',
+  path: 'seps/2640-skills-extension.md',
+  commit: '1eb5bbe8ac933bdb595fedc687b8ed545e440491',
+} as const;
+export const MCP_SKILLS_DESIGN_HISTORY = {
+  repository: 'modelcontextprotocol/ext-skills',
+  path: 'specs/skills.md',
+  commit: 'd866efdba298b55b8156c7b7aa1bdebc1b625f4c',
+} as const;
+export const MCP_SKILLS_EVIDENCE_SOURCE_MIGRATION = {
+  repository: 'modelcontextprotocol/modelcontextprotocol',
+  path: 'seps/2640-skills-extension.md',
+  commit: 'f56f204f6290f6531b14d5734eb3e0a10f0eb201',
+} as const;
 // Public Git object ID. Split to prevent generic secret scanners from
 // misclassifying this high-entropy evidence locator as an API credential.
 export const MCP_CLIENT_MATRIX_REVISION = [
@@ -71,7 +84,10 @@ export type FixtureChatGptSkillImportReceipt = {
   };
   wire_contract: {
     extension_id: typeof MCP_SKILLS_EXTENSION_ID;
-    specification_commit: typeof MCP_SKILLS_SPEC_COMMIT;
+    specification_commit: typeof MCP_SKILLS_NORMATIVE_CONTRACT.commit;
+    normative_contract: typeof MCP_SKILLS_NORMATIVE_CONTRACT;
+    design_history: typeof MCP_SKILLS_DESIGN_HISTORY;
+    evidence_source_migration: typeof MCP_SKILLS_EVIDENCE_SOURCE_MIGRATION;
   };
   decision: 'READY_FOR_FIXTURE_HANDOFF';
   issued_at: string;
@@ -362,7 +378,10 @@ export function createFixtureChatGptSkillImport(
     },
     wire_contract: {
       extension_id: MCP_SKILLS_EXTENSION_ID,
-      specification_commit: MCP_SKILLS_SPEC_COMMIT,
+      specification_commit: MCP_SKILLS_NORMATIVE_CONTRACT.commit,
+      normative_contract: MCP_SKILLS_NORMATIVE_CONTRACT,
+      design_history: MCP_SKILLS_DESIGN_HISTORY,
+      evidence_source_migration: MCP_SKILLS_EVIDENCE_SOURCE_MIGRATION,
     },
     decision: 'READY_FOR_FIXTURE_HANDOFF' as const,
     issued_at: issuedAt,

docs/mcp-skills-sep-2640-watch.md

@@ -12,10 +12,15 @@ skill execution remain disabled until their own observable receipts exist.
 
 ## Verified state
 
-- MCP Core Maintainers accepted [SEP-2640](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2640) on 2026-09-03.
-- The Skills working group published the stable `io.modelcontextprotocol/skills`
-  specification on 2026-09-04 and made `resultType`, `ttlMs`, and `cacheScope`
-  mandatory on 2026-09-10 ([commit `d866efd`](https://github.com/modelcontextprotocol/ext-skills/commit/d866efdba298b55b8156c7b7aa1bdebc1b625f4c)).
+- MCP Core Maintainers accepted [SEP-2640](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2640) on 2026-09-03, and the Final core specification now lives at
+  `modelcontextprotocol/modelcontextprotocol/seps/2640-skills-extension.md`
+  ([commit `1eb5bbe`](https://github.com/modelcontextprotocol/modelcontextprotocol/commit/1eb5bbe8ac933bdb595fedc687b8ed545e440491)).
+- Historical working-group change evidence for the cache metadata requirement
+  remains attributable to `modelcontextprotocol/ext-skills/specs/skills.md`
+  ([commit `d866efd`](https://github.com/modelcontextprotocol/ext-skills/commit/d866efdba298b55b8156c7b7aa1bdebc1b625f4c)).
+- The September 16 link-repair commit updated the core SEP's supporting links to
+  the `ext-skills` archive paths
+  ([commit `f56f204`](https://github.com/modelcontextprotocol/modelcontextprotocol/commit/f56f204f6290f6531b14d5734eb3e0a10f0eb201)).
 - The official conformance suite added seven Skills scenarios on 2026-09-11
   ([commit `7169291`](https://github.com/modelcontextprotocol/conformance/commit/7169291ec0b68eb370fddcd9947313ab0d5e4156)).
 - The official MCP client-support matrix currently marks ChatGPT's Skills
@@ -49,8 +54,10 @@ handoff contract that:
 5. Rejects digest drift, cross-origin reads, decoded path traversal, invalid cache
    metadata, any mismatch in the complete verbatim frontmatter object, top-level
    dynamic resources, and unapproved execution.
-6. Emits a deterministic, machine-readable receipt while performing zero network,
-   import, tool, or external-effect operations.
+6. Emits a deterministic, machine-readable receipt that distinguishes the
+   accepted core normative contract from preserved working-group design-history
+   evidence while performing zero network, import, tool, or external-effect
+   operations.
 
 ## Non-goals / safety boundary