feat: transport deprecation markers — SEP-2596 + 2026-lane enable_get_sse

- Client SseTransport (HTTP+SSE, protocol ≤ 2024-11-05) now carries
  #[deprecated]: the transport is deprecated upstream (SEP-2596,
  2025-03-26 — "new implementations SHOULD NOT adopt it; existing
  implementations SHOULD migrate to Streamable HTTP"). Crate docs and
  README carry migration notes; the type stays functional for unmigrated
  servers (factory/fallback sites carry scoped allows).
- The server's legacy session_handler module documents the same SEP-2596
  status (it serves ≤ 2024-11-05 clients on the 2025 lane only; the 2026
  lane never routes there).
- ServerConfig.enable_get_sse and HttpMcpServerBuilder::get_sse() are
  deprecated on the 2026-07-28 lane only (cfg_attr): the stateless
  endpoint is POST-only (GET = 405) and the long-lived notification
  stream is subscriptions/listen. No warning on the protocol-2025-11-25
  opt-in, where stateful GET SSE remains first-class. Internal 2025-lane
  plumbing carries scoped allows.

Gates: scripts/ci-gates.sh all → ALL GATES PASSED.
Closes spec-compliance driver gap DEP-GAP-1 (P2).

Author: hortovanyi

CHANGELOG.md

@@ -20,6 +20,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **Transport deprecation markers (2026-06-11, SEP-2596 + 2026 lane).** The client's `SseTransport` (HTTP+SSE, ≤ 2024-11-05) now carries `#[deprecated]` with migration notes in the crate docs and README — the transport is deprecated upstream (SEP-2596, 2025-03-26: "new implementations SHOULD NOT adopt it"); it remains functional for unmigrated servers. The server's legacy `session_handler` module documents the same. `ServerConfig.enable_get_sse` and the `get_sse()` builder setter are deprecated on the 2026-07-28 lane only (`cfg_attr`): the stateless endpoint is POST-only (GET = 405) and the long-lived stream is `subscriptions/listen`; stateful GET SSE remains first-class on the `protocol-2025-11-25` opt-in. Closes spec-compliance driver gap **DEP-GAP-1 (P2)**.
 - **Client disconnect now cancels the in-flight request (2026-06-11).** Streamable HTTP §Cancellation: "Closing the SSE response stream MUST be treated by the server as cancellation of that request. The server SHOULD stop work … and MUST NOT send any further messages for it." The streaming dispatch task previously ran detached to completion after a disconnect; it now races the dispatch future against the response channel's `closed()` signal — on disconnect the future is dropped (the handler stops at its next await point), the progress task is shut down, and nothing further is sent. Wire test: a slow tool's completion flag stays unset when the client drops mid-execution (`cancellation_2026.rs`; control test pins the connected path). Closes spec-compliance driver gaps **PAT/G1 + TX/GAP-2 (both P1)** — the final open P1s.
 - **Request-scoped progress on the 2026 path (2026-06-11).** Tools and resources can now emit spec-compliant `notifications/progress`: the request's `_meta.progressToken` is surfaced through the session extensions (`SessionContext::progress_token()`), and the new `notify_request_progress(progress, total)` references exactly that token — no-op when the request declared none ("Progress notifications MUST only reference tokens that were provided in an active request"). Numeric tokens now round-trip as JSON numbers end-to-end; the session→StreamManager bridge previously dropped non-string tokens (`as_str()`) and stringified the rest. Wire tests in `progress_2026.rs` (string echo, numeric round-trip, no-token-no-notifications); revert-and-fail recorded. Closes spec-compliance driver gap **PAT/G2 (P1)**.
 - **Real-HTTP OAuth acceptance on the 2026 default transport (2026-06-11, tests + manifest).** New `crates/turul-mcp-server/tests/oauth_2026.rs`: missing/garbage bearers → 401 with the RFC 9728 `WWW-Authenticate` challenge (`resource_metadata=`, `error="invalid_token"`), 401 outranks the missing-`_meta` 400 (auth before validation), and both RFC 9728 well-known routes (root + path form) serve the metadata unauthenticated — all through Builder → `server.run()` → wire. To ride `turul-mcp-server`'s dev-deps without tripping the ADR-029 spec mutex, `turul-mcp-oauth` is now spec-neutral: its transport/storage deps drop default features and it gains its own `protocol-2025-11-25`/`protocol-2026-07-28` forwarding features (default 2026 standalone; unification supplies the spec when used with `default-features = false`). Closes spec-compliance driver gap **AUTH-1 (P1)**.

crates/turul-http-mcp-server/src/server.rs

@@ -32,7 +32,19 @@ pub struct ServerConfig {
     pub enable_cors: bool,
     /// Maximum request body size
     pub max_body_size: usize,
-    /// Enable GET SSE support (persistent event streams)
+    /// Enable GET SSE support (persistent event streams).
+    ///
+    /// 2025-11-25 stateful lane only. On the 2026-07-28 stateless lane this
+    /// flag has no effect: the MCP endpoint is POST-only (GET returns 405
+    /// Method Not Allowed) and the long-lived notification stream is the
+    /// `subscriptions/listen` POST stream instead.
+    #[cfg_attr(
+        feature = "protocol-2026-07-28",
+        deprecated(
+            since = "0.4.0",
+            note = "no effect on the 2026-07-28 stateless lane (POST-only endpoint; GET = 405) — use subscriptions/listen for the long-lived stream; stateful GET SSE remains on the protocol-2025-11-25 opt-in"
+        )
+    )]
     pub enable_get_sse: bool,
     /// Enable POST SSE support (streaming tool call responses) - disabled by default for compatibility
     pub enable_post_sse: bool,
@@ -54,6 +66,7 @@ pub struct ServerConfig {
 }
 
 impl Default for ServerConfig {
+    #[allow(deprecated)] // enable_get_sse is 2026-lane-deprecated but must default
     fn default() -> Self {
         Self {
             bind_address: "127.0.0.1:8000".parse().unwrap(),
@@ -172,7 +185,17 @@ impl HttpMcpServerBuilder {
         self
     }
 
-    /// Enable or disable GET SSE for persistent event streams
+    /// Enable or disable GET SSE for persistent event streams.
+    ///
+    /// 2025-11-25 stateful lane only — see [`ServerConfig::enable_get_sse`].
+    #[cfg_attr(
+        feature = "protocol-2026-07-28",
+        deprecated(
+            since = "0.4.0",
+            note = "no effect on the 2026-07-28 stateless lane (POST-only endpoint; GET = 405)"
+        )
+    )]
+    #[allow(deprecated)]
     pub fn get_sse(mut self, enable: bool) -> Self {
         self.config.enable_get_sse = enable;
         self
@@ -184,7 +207,10 @@ impl HttpMcpServerBuilder {
         self
     }
 
-    /// Enable or disable both GET and POST SSE (convenience method)
+    /// Enable or disable both GET and POST SSE (convenience method).
+    ///
+    /// The GET half is 2025-11-25-lane-only — see [`ServerConfig::enable_get_sse`].
+    #[allow(deprecated)]
     pub fn sse(mut self, enable: bool) -> Self {
         self.config.enable_get_sse = enable;
         self.config.enable_post_sse = enable;

crates/turul-http-mcp-server/src/session_handler.rs

@@ -1,5 +1,11 @@
 //! JSON-RPC 2.0 over HTTP handler for MCP requests with SessionStorage integration
 //!
+//! **Deprecated transport (SEP-2596).** This is the legacy HTTP+SSE path
+//! (protocol ≤ 2024-11-05), deprecated upstream on 2025-03-26: "new
+//! implementations SHOULD NOT adopt it; existing implementations SHOULD
+//! migrate to Streamable HTTP." It remains wired for backward compatibility
+//! on the 2025-11-25 lane only; the 2026-07-28 lane never routes here.
+//!
 //! This handler implements proper JSON-RPC 2.0 server over HTTP transport with
 //! MCP 2025-11-25 compliance, including:
 //! - SessionStorage trait integration (defaults to InMemory)
@@ -850,6 +856,7 @@ impl SessionMcpHandler {
         }
 
         // Check if GET SSE is enabled on the server
+        #[allow(deprecated)] // 2026-lane deprecation; this is the legacy GET SSE path itself
         if !self.config.enable_get_sse {
             warn!("GET SSE request received but GET SSE is disabled on server");
             let error = JsonRpcError::new(

crates/turul-mcp-aws-lambda/src/builder.rs

@@ -795,6 +795,9 @@ impl LambdaMcpServerBuilder {
         self.enable_sse = enable;
 
         // Update SSE endpoints in ServerConfig based on enable flag
+        // (enable_get_sse is 2026-lane-deprecated; the setter remains the
+        // 2025-lane control and a harmless no-op on 2026)
+        #[allow(deprecated)]
         if enable {
             self.server_config.enable_get_sse = true;
             self.server_config.enable_post_sse = true;
@@ -1661,6 +1664,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[allow(deprecated)] // asserts the 2025-lane enable_get_sse plumbing
     async fn test_sse_toggle_functionality() {
         // Test that SSE can be toggled on/off/on correctly
         let mut builder =

crates/turul-mcp-client/README.md

@@ -79,11 +79,15 @@ let client = McpClientBuilder::new()
     .build();
 ```
 
-### SSE Transport (HTTP+SSE)
+### SSE Transport (HTTP+SSE, deprecated — SEP-2596)
 
-For servers supporting server-sent events:
+> **Deprecated upstream** (SEP-2596, 2025-03-26): "new implementations
+> SHOULD NOT adopt it; existing implementations SHOULD migrate to
+> Streamable HTTP." Use `HttpTransport` unless you must talk to an
+> unmigrated ≤ 2024-11-05 server.
 
 ```rust
+#![allow(deprecated)]
 use turul_mcp_client::transport::SseTransport;
 
 let transport = SseTransport::new("http://localhost:8080/mcp")?;
@@ -456,6 +460,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 ### Transport Comparison
 
 ```rust
+#![allow(deprecated)] // SseTransport: HTTP+SSE is deprecated upstream (SEP-2596)
 use turul_mcp_client::transport::{HttpTransport, SseTransport, TransportCapabilities};
 
 // Compare transport capabilities

crates/turul-mcp-client/src/client.rs

@@ -1893,6 +1893,7 @@ impl McpClientBuilder {
                 crate::transport::TransportType::Sse => {
                     // SSE is a legacy transport — ConnectionConfig not wired (no with_config)
                     Box::new(
+                        #[allow(deprecated)] // ≤2024-11-05 fallback (SEP-2596)
                         crate::transport::sse::SseTransport::new(url)
                             .expect("URL was validated in with_url() but SSE construction failed"),
                     )

crates/turul-mcp-client/src/lib.rs

@@ -78,14 +78,18 @@
 //! # }
 //! ```
 //!
-//! ### SSE Transport (HTTP+SSE, legacy)
+//! ### SSE Transport (HTTP+SSE, deprecated — SEP-2596)
 //!
-//! For servers using the pre-2025-03-26 SSE-based protocol. Like the HTTP
-//! transport, `connect()` is a no-op marker — the SSE subscription is
-//! established lazily during message exchange.
+//! For servers using the pre-2025-03-26 SSE-based protocol. The HTTP+SSE
+//! transport is deprecated upstream ("new implementations SHOULD NOT adopt
+//! it") — use [`HttpTransport`](transport::HttpTransport) unless you must
+//! talk to an unmigrated ≤ 2024-11-05 server. Like the HTTP transport,
+//! `connect()` is a no-op marker — the SSE subscription is established
+//! lazily during message exchange.
 //!
 //! ```rust,no_run
 //! # fn main() -> Result<(), Box<dyn std::error::Error>> {
+//! #![allow(deprecated)]
 //! use turul_mcp_client::transport::SseTransport;
 //!
 //! let transport = SseTransport::new("http://localhost:8080/mcp")?;

crates/turul-mcp-client/src/transport.rs

@@ -17,6 +17,7 @@ pub mod sse;
 
 // Re-export transport implementations
 pub use http::HttpTransport;
+#[allow(deprecated)] // re-exported for unmigrated ≤2024-11-05 servers (SEP-2596)
 pub use sse::SseTransport;
 
 // Re-exports for future transport implementations
@@ -327,6 +328,7 @@ impl TransportFactory {
 
         match transport_type {
             TransportType::Http => Ok(Box::new(HttpTransport::new(url)?)),
+            #[allow(deprecated)] // factory keeps serving ≤2024-11-05 servers (SEP-2596)
             TransportType::Sse => Ok(Box::new(SseTransport::new(url)?)),
         }
     }
@@ -338,6 +340,7 @@ impl TransportFactory {
     ) -> McpClientResult<BoxedTransport> {
         match transport_type {
             TransportType::Http => Ok(Box::new(HttpTransport::new(endpoint)?)),
+            #[allow(deprecated)] // factory keeps serving ≤2024-11-05 servers (SEP-2596)
             TransportType::Sse => Ok(Box::new(SseTransport::new(endpoint)?)),
         }
     }

crates/turul-mcp-client/src/transport/sse.rs

@@ -17,7 +17,17 @@ use crate::transport::{
     TransportStatistics, TransportType,
 };
 
-/// SSE transport for MCP client (HTTP+SSE 2024-11-05)
+/// SSE transport for MCP client (HTTP+SSE, protocol 2024-11-05).
+///
+/// The HTTP+SSE transport is deprecated upstream (SEP-2596, deprecated
+/// 2025-03-26): "new implementations SHOULD NOT adopt it; existing
+/// implementations SHOULD migrate to Streamable HTTP." Use
+/// [`HttpTransport`](crate::transport::HttpTransport) instead; this type
+/// remains for talking to unmigrated ≤ 2024-11-05 servers.
+#[deprecated(
+    since = "0.4.0",
+    note = "HTTP+SSE transport is deprecated upstream (SEP-2596) — use HttpTransport (Streamable HTTP)"
+)]
 #[derive(Debug)]
 pub struct SseTransport {
     /// HTTP client
@@ -40,6 +50,7 @@ pub struct SseTransport {
     session_id: parking_lot::Mutex<Option<String>>,
 }
 
+#[allow(deprecated)]
 impl SseTransport {
     /// Create a new SSE transport
     pub fn new(endpoint: &str) -> McpClientResult<Self> {
@@ -298,6 +309,7 @@ impl SseTransport {
 }
 
 #[async_trait]
+#[allow(deprecated)]
 impl Transport for SseTransport {
     fn transport_type(&self) -> TransportType {
         TransportType::Sse
@@ -609,6 +621,7 @@ impl Transport for SseTransport {
     }
 }
 
+#[allow(deprecated)]
 impl Drop for SseTransport {
     fn drop(&mut self) {
         debug!("🔥 DROP: SseTransport (CLIENT) - SSE transport being cleaned up");

crates/turul-mcp-server/src/server.rs

@@ -471,6 +471,7 @@ impl McpServer {
         // Build HTTP server with shared session storage from SessionManager
         let session_storage = self.session_manager.get_storage();
         debug!("Configuring HTTP MCP server with session storage backend");
+        #[allow(deprecated)] // get_sse: 2026-lane-deprecated; pass-through stays for the 2025 lane
         let mut builder =
             turul_http_mcp_server::HttpMcpServer::builder_with_storage(session_storage)
                 .bind_address(self.bind_address)
@@ -748,6 +749,7 @@ impl McpServer {
         // Build HTTP server with shared session storage from SessionManager
         let session_storage = self.session_manager.get_storage();
         debug!("Configuring HTTP MCP server with session storage backend");
+        #[allow(deprecated)] // get_sse: 2026-lane-deprecated; pass-through stays for the 2025 lane
         let mut builder =
             turul_http_mcp_server::HttpMcpServer::builder_with_storage(session_storage)
                 .bind_address(self.bind_address)