feat: client subscriptions/listen; ADR-025 shim cut; final release-prep reconciliation

- Client-side subscriptions/listen: McpClient::subscriptions_listen(filter)
  on 2026 connections, via the new additive
  Transport::send_request_streaming (Streamable HTTP implements it; default
  is unsupported for non-HTTP transports). Consumes/validates the mandatory
  acknowledgement first; SubscriptionStream exposes the honored filter +
  subscription id and yields notifications; drop = close = cancellation.
  e2e: real client <-> real server, cross-request broadcast, only the
  opted-in type arrives, stamped with the subscription id.

- ADR-025 framework shim cut: the four non-frozen framework crates (+ the
  2026-default middleware-auth-lambda example) depend on turul-rpc directly
  (146 path swaps; shim mirrors turul-rpc paths 1:1, identical types — no
  public API change; cargo tree confirms turul-mcp-server is shim-free).
  Shim stays in-workspace for the frozen 2025 snapshots and 2025-pinned
  test/example crates only, manifest repinned to the terminal 0.3.47
  (the 0.4.0 sweep value was never publishable). ADR-025 revision log
  records the cut; ADR-027 records the 2025 regression lane as the
  per-crate matrix (workspace-wide flag sweeps trip the spec mutex by
  design — closure by revision with rationale).

- Release-readiness review: final status banner with the true remaining
  exceptions only (audit-journal P2 lows, requestState integrity =
  tool-author concern, cyclic/non-local $ref = documented rejections,
  client-side CIMD = future OAuth client flow, final disposition =
  maintainer's call per the Branch Lock).

Author: hortovanyi

CHANGELOG.md

@@ -37,6 +37,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added (2026-06-10, release-prep sweep)
 
+- **Client-side `subscriptions/listen`** — `McpClient::subscriptions_listen(filter)` (2026 connections only) opens the long-lived stream via a new additive `Transport::send_request_streaming` (Streamable HTTP implements it; other transports default to unsupported). The client consumes and validates the mandatory acknowledgement first and returns a `SubscriptionStream` exposing the honored filter subset and the subscription id, then yields each notification; dropping the stream closes it (= cancellation per Streamable HTTP). e2e: real client ↔ real server — open stream, trigger server-wide broadcasts from a second request, receive only the opted-in type stamped with the subscription id.
+- **ADR-025 framework shim cut landed** — `turul-mcp-server`/`turul-http-mcp-server`/`turul-mcp-builders`/`turul-mcp-aws-lambda` now depend on `turul-rpc` directly (146 path swaps; the shim mirrors `turul-rpc` paths 1:1 and re-exports the same types, so no public API changed). The shim remains in-workspace solely for the frozen 2025 protocol snapshots and 2025-pinned test/example crates, with its manifest restored to the terminal `0.3.47` (the mechanical 0.4.0 sweep value was never publishable). ADR-025/ADR-027 revision logs updated; the 2025 regression lane is recorded as the per-crate matrix (a workspace-wide flag sweep trips the spec mutex by design).
+
 - **MRTR on `resources/read` and `prompts/get`** — completes the SEP-2322 triple (the only methods permitted to return `input_required`). The conversion + client-capability gate is now one shared helper (`handlers::input_required_to_result`, also adopted by `tools/call`). Resources surface the retry's `inputResponses`/`requestState` via the session extensions (same as tools); prompts receive them in the render args under reserved `io.modelcontextprotocol/*` keys, because `McpPrompt::render` has no session parameter and changing it would break the public trait (documented on the trait; reserved-namespace keys cannot collide with wire prompt arguments, which are plain strings). Tests: two-leg round trips for both methods + a `-32003`/400 capability-gate case on `resources/read` (all real-HTTP; the handlers previously leaked the sentinel to `-32603`).
 - **`resources.subscribe` capability truthfulness** — with `subscriptions/listen` serving per-URI `resources/updated`, both capability-construction sites now advertise `subscribe: true` on the 2026 lane (still `false` on 2025, which has no `resources/subscribe` handler). Wire test asserts the `server/discover` advertisement.
 - **`completion/complete` e2e coverage** — sessionless dispatch + `CompleteResult` wire shape (`completion.values`) + capability advertisement, closing the last zero-e2e core method on the 2026 path.

Cargo.toml

@@ -211,7 +211,7 @@ turul-rpc = { version = "0.2", default-features = false }
 # path+version resolution. Frozen historical protocol crates (`2025-06-18`,
 # `2025-11-25`) stay at their last 0.3.x publish — everything else moves on
 # its own cadence.
-turul-mcp-json-rpc-server = { version = "0.4.0", path = "crates/turul-mcp-json-rpc-server" }
+turul-mcp-json-rpc-server = { version = "0.3.47", path = "crates/turul-mcp-json-rpc-server" }
 turul-mcp-protocol-2025-06-18 = { version = "0.3.47", path = "crates/turul-mcp-protocol-2025-06-18" }
 turul-mcp-protocol-2025-11-25 = { version = "0.3.47", path = "crates/turul-mcp-protocol-2025-11-25" }
 turul-mcp-protocol-2026-07-28 = { version = "0.4.0", path = "crates/turul-mcp-protocol-2026-07-28" }

crates/turul-http-mcp-server/Cargo.toml

@@ -15,9 +15,7 @@ protocol-2026-07-28 = ["turul-mcp-protocol/protocol-2026-07-28", "turul-mcp-sess
 sse = []          # Server-Sent Events support
 
 [dependencies]
-turul-mcp-json-rpc-server = { workspace = true, features = [
-  "streams",
-] }
+turul-rpc = { workspace = true, features = ["async", "streams"] }
 turul-mcp-protocol = { path = "../turul-mcp-protocol", version = "0.4.0", default-features = false }
 turul-mcp-session-storage = { path = "../turul-mcp-session-storage", version = "0.4.0", default-features = false }
 serde.workspace = true

crates/turul-http-mcp-server/src/json_rpc_responses.rs

@@ -9,9 +9,7 @@ use hyper::{Response, StatusCode, header};
 use serde_json::Value;
 use tracing::error;
 
-use turul_mcp_json_rpc_server::{
-    JsonRpcError, JsonRpcResponse, error::JsonRpcErrorObject, types::RequestId,
-};
+use turul_rpc::{JsonRpcError, JsonRpcResponse, error::JsonRpcErrorObject, types::RequestId};
 
 /// HTTP body type for JSON-RPC responses
 type JsonRpcBody = Full<Bytes>;

crates/turul-http-mcp-server/src/lib.rs

@@ -93,10 +93,10 @@ pub trait ToolChangeNotifier: Send + Sync {
 }
 
 // Re-export foundational types
-/// JSON-RPC 2.0 dispatcher and handler trait for protocol operations
-pub use turul_mcp_json_rpc_server::{JsonRpcDispatcher, JsonRpcHandler};
 /// Core MCP protocol types and error handling
 pub use turul_mcp_protocol::*;
+/// JSON-RPC 2.0 dispatcher and handler trait for protocol operations
+pub use turul_rpc::{JsonRpcDispatcher, JsonRpcHandler};
 
 /// Result type for HTTP MCP operations
 pub type Result<T> = std::result::Result<T, HttpMcpError>;
@@ -108,7 +108,7 @@ pub enum HttpMcpError {
     Http(#[from] hyper::Error),
 
     #[error("JSON-RPC error: {0}")]
-    JsonRpc(#[from] turul_mcp_json_rpc_server::JsonRpcError),
+    JsonRpc(#[from] turul_rpc::JsonRpcError),
 
     #[error("MCP protocol error: {0}")]
     Mcp(#[from] turul_mcp_protocol::McpError),

crates/turul-http-mcp-server/src/notification_bridge.rs

@@ -18,12 +18,12 @@ use std::sync::Arc;
 use tracing::{debug, error, info};
 
 use crate::StreamManager;
-use turul_mcp_json_rpc_server::JsonRpcNotification;
 use turul_mcp_protocol::notifications::{
     CancelledNotification, LoggingMessageNotification, ProgressNotification,
     PromptListChangedNotification, ResourceListChangedNotification, ResourceUpdatedNotification,
     ToolListChangedNotification,
 };
+use turul_rpc::JsonRpcNotification;
 
 /// MCP-compliant notification broadcaster trait for sending ALL notification types over SSE
 ///

crates/turul-http-mcp-server/src/server.rs

@@ -14,9 +14,9 @@ use std::sync::Arc;
 use tokio::net::TcpListener;
 use tracing::{debug, error, info, warn};
 
-use turul_mcp_json_rpc_server::{JsonRpcDispatcher, JsonRpcHandler};
 use turul_mcp_protocol::McpError;
 use turul_mcp_session_storage::InMemorySessionStorage;
+use turul_rpc::{JsonRpcDispatcher, JsonRpcHandler};
 
 use crate::streamable_http::{McpProtocolVersion, StreamableHttpHandler};
 use crate::{CorsLayer, Result, SessionMcpHandler, StreamConfig, StreamManager};

crates/turul-http-mcp-server/src/session_handler.rs

@@ -23,15 +23,15 @@ use hyper::{Method, Request, Response, StatusCode};
 
 use crate::middleware::bearer::{extract_bearer_token, is_bearer_scheme};
 use chrono;
-use turul_mcp_json_rpc_server::{
+use turul_mcp_protocol::McpError;
+use turul_mcp_protocol::ServerCapabilities;
+use turul_mcp_session_storage::{InMemorySessionStorage, SessionView};
+use turul_rpc::{
     JsonRpcDispatcher,
     r#async::SessionContext,
     dispatch::{JsonRpcMessage, JsonRpcMessageResult, parse_json_rpc_message},
     error::{JsonRpcError, JsonRpcErrorObject},
 };
-use turul_mcp_protocol::McpError;
-use turul_mcp_protocol::ServerCapabilities;
-use turul_mcp_session_storage::{InMemorySessionStorage, SessionView};
 use uuid::Uuid;
 
 use crate::{
@@ -517,13 +517,12 @@ impl SessionMcpHandler {
                                 error!("Failed to create session during initialize: {}", err);
                                 // Return error response using proper JSON-RPC error format
                                 let error_msg = format!("Session creation failed: {}", err);
-                                let error_response =
-                                    turul_mcp_json_rpc_server::JsonRpcResponse::error(
-                                        turul_mcp_json_rpc_server::JsonRpcError::internal_error(
-                                            Some(request.id),
-                                            Some(error_msg),
-                                        ),
-                                    );
+                                let error_response = turul_rpc::JsonRpcResponse::error(
+                                    turul_rpc::JsonRpcError::internal_error(
+                                        Some(request.id),
+                                        Some(error_msg),
+                                    ),
+                                );
                                 (error_response, None, Vec::new())
                             }
                         }
@@ -646,12 +645,10 @@ impl SessionMcpHandler {
 
                     // Convert JsonRpcResponse to JsonRpcMessageResult
                     let message_result = match response {
-                        turul_mcp_json_rpc_server::JsonRpcResponse::Success(resp) => {
+                        turul_rpc::JsonRpcResponse::Success(resp) => {
                             JsonRpcMessageResult::Response(resp)
                         }
-                        turul_mcp_json_rpc_server::JsonRpcResponse::Error(err) => {
-                            JsonRpcMessageResult::Error(err)
-                        }
+                        turul_rpc::JsonRpcResponse::Error(err) => JsonRpcMessageResult::Error(err),
                     };
                     (
                         message_result,
@@ -745,9 +742,7 @@ impl SessionMcpHandler {
                         self.stream_manager
                             .create_post_sse_stream_with_notifications(
                                 response_session_id.clone().unwrap(),
-                                turul_mcp_json_rpc_server::JsonRpcResponse::Success(
-                                    response.clone(),
-                                ),
+                                turul_rpc::JsonRpcResponse::Success(response.clone()),
                                 collected_notifications,
                             )
                             .await
@@ -756,9 +751,7 @@ impl SessionMcpHandler {
                         self.stream_manager
                             .create_post_sse_stream(
                                 response_session_id.clone().unwrap(),
-                                turul_mcp_json_rpc_server::JsonRpcResponse::Success(
-                                    response.clone(),
-                                ),
+                                turul_rpc::JsonRpcResponse::Success(response.clone()),
                             )
                             .await
                     };
@@ -774,7 +767,7 @@ impl SessionMcpHandler {
                                 e
                             );
                             Ok(jsonrpc_response_with_session(
-                                turul_mcp_json_rpc_server::JsonRpcResponse::Success(response),
+                                turul_rpc::JsonRpcResponse::Success(response),
                                 response_session_id,
                             )?
                             .map(convert_to_unified_body))
@@ -786,7 +779,7 @@ impl SessionMcpHandler {
                         accept_mode, method_name
                     );
                     Ok(jsonrpc_response_with_session(
-                        turul_mcp_json_rpc_server::JsonRpcResponse::Success(response),
+                        turul_rpc::JsonRpcResponse::Success(response),
                         response_session_id,
                     )?
                     .map(convert_to_unified_body))
@@ -1127,12 +1120,12 @@ impl SessionMcpHandler {
     /// Shared logic between StreamableHttpHandler and SessionMcpHandler
     async fn run_middleware_and_dispatch(
         &self,
-        request: turul_mcp_json_rpc_server::JsonRpcRequest,
+        request: turul_rpc::JsonRpcRequest,
         headers: HashMap<String, String>,
-        session: turul_mcp_json_rpc_server::SessionContext,
+        session: turul_rpc::SessionContext,
         pre_session_extensions: Option<HashMap<String, serde_json::Value>>,
     ) -> (
-        turul_mcp_json_rpc_server::JsonRpcResponse,
+        turul_rpc::JsonRpcResponse,
         Option<crate::middleware::SessionInjection>,
     ) {
         // Fast path: if middleware stack is empty, dispatch directly
@@ -1157,10 +1150,10 @@ impl SessionMcpHandler {
 
         // Convert params to Option<Value>
         let params = request.params.clone().map(|p| match p {
-            turul_mcp_json_rpc_server::RequestParams::Object(map) => {
+            turul_rpc::RequestParams::Object(map) => {
                 serde_json::Value::Object(map.into_iter().collect())
             }
-            turul_mcp_json_rpc_server::RequestParams::Array(arr) => serde_json::Value::Array(arr),
+            turul_rpc::RequestParams::Array(arr) => serde_json::Value::Array(arr),
         });
         let mut ctx = crate::middleware::RequestContext::new(&method, params);
 
@@ -1228,15 +1221,15 @@ impl SessionMcpHandler {
         // Execute after_dispatch
         // Convert JsonRpcMessage to DispatcherResult for middleware
         let mut dispatcher_result = match &result {
-            turul_mcp_json_rpc_server::JsonRpcResponse::Success(resp) => match &resp.result {
-                turul_mcp_json_rpc_server::response::ResponseResult::Success(val) => {
+            turul_rpc::JsonRpcResponse::Success(resp) => match &resp.result {
+                turul_rpc::response::ResponseResult::Success(val) => {
                     crate::middleware::DispatcherResult::Success(val.clone())
                 }
-                turul_mcp_json_rpc_server::response::ResponseResult::Null => {
+                turul_rpc::response::ResponseResult::Null => {
                     crate::middleware::DispatcherResult::Success(serde_json::Value::Null)
                 }
             },
-            turul_mcp_json_rpc_server::JsonRpcResponse::Error(err) => {
+            turul_rpc::JsonRpcResponse::Error(err) => {
                 crate::middleware::DispatcherResult::Error(err.error.message.clone())
             }
         };
@@ -1265,39 +1258,33 @@ impl SessionMcpHandler {
     /// - Error → Success: middleware recovered (only when error has request ID)
     /// - Error → Error: error message mutated
     fn apply_dispatcher_result(
-        result: turul_mcp_json_rpc_server::JsonRpcResponse,
+        result: turul_rpc::JsonRpcResponse,
         dispatcher_result: crate::middleware::DispatcherResult,
-    ) -> turul_mcp_json_rpc_server::JsonRpcResponse {
+    ) -> turul_rpc::JsonRpcResponse {
         match dispatcher_result {
             crate::middleware::DispatcherResult::Success(val) => match result {
-                turul_mcp_json_rpc_server::JsonRpcResponse::Success(mut resp) => {
-                    resp.result = turul_mcp_json_rpc_server::response::ResponseResult::Success(val);
-                    turul_mcp_json_rpc_server::JsonRpcResponse::Success(resp)
+                turul_rpc::JsonRpcResponse::Success(mut resp) => {
+                    resp.result = turul_rpc::response::ResponseResult::Success(val);
+                    turul_rpc::JsonRpcResponse::Success(resp)
                 }
-                turul_mcp_json_rpc_server::JsonRpcResponse::Error(err) => {
+                turul_rpc::JsonRpcResponse::Error(err) => {
                     // Error→Success recovery: only when error has a request ID
                     match err.id {
-                        Some(id) => {
-                            turul_mcp_json_rpc_server::JsonRpcResponse::success(id, val.into())
-                        }
-                        None => turul_mcp_json_rpc_server::JsonRpcResponse::Error(err),
+                        Some(id) => turul_rpc::JsonRpcResponse::success(id, val.into()),
+                        None => turul_rpc::JsonRpcResponse::Error(err),
                     }
                 }
             },
             crate::middleware::DispatcherResult::Error(msg) => match result {
-                turul_mcp_json_rpc_server::JsonRpcResponse::Success(resp) => {
-                    turul_mcp_json_rpc_server::JsonRpcResponse::Error(
-                        turul_mcp_json_rpc_server::error::JsonRpcError::new(
-                            Some(resp.id),
-                            turul_mcp_json_rpc_server::error::JsonRpcErrorObject::internal_error(
-                                Some(msg),
-                            ),
-                        ),
-                    )
+                turul_rpc::JsonRpcResponse::Success(resp) => {
+                    turul_rpc::JsonRpcResponse::Error(turul_rpc::error::JsonRpcError::new(
+                        Some(resp.id),
+                        turul_rpc::error::JsonRpcErrorObject::internal_error(Some(msg)),
+                    ))
                 }
-                turul_mcp_json_rpc_server::JsonRpcResponse::Error(mut err) => {
+                turul_rpc::JsonRpcResponse::Error(mut err) => {
                     err.error.message = msg;
-                    turul_mcp_json_rpc_server::JsonRpcResponse::Error(err)
+                    turul_rpc::JsonRpcResponse::Error(err)
                 }
             },
         }
@@ -1306,8 +1293,8 @@ impl SessionMcpHandler {
     /// Map MiddlewareError to JSON-RPC error with semantic error codes
     fn map_middleware_error_to_jsonrpc(
         err: crate::middleware::MiddlewareError,
-        request_id: turul_mcp_json_rpc_server::RequestId,
-    ) -> turul_mcp_json_rpc_server::JsonRpcResponse {
+        request_id: turul_rpc::RequestId,
+    ) -> turul_rpc::JsonRpcResponse {
         use crate::middleware::MiddlewareError;
         use crate::middleware::error::error_codes;
 
@@ -1332,22 +1319,16 @@ impl SessionMcpHandler {
         };
 
         let error_obj = if let Some(d) = data {
-            turul_mcp_json_rpc_server::error::JsonRpcErrorObject::server_error(
-                code,
-                &message,
-                Some(d),
-            )
+            turul_rpc::error::JsonRpcErrorObject::server_error(code, &message, Some(d))
         } else {
-            turul_mcp_json_rpc_server::error::JsonRpcErrorObject::server_error(
+            turul_rpc::error::JsonRpcErrorObject::server_error(
                 code,
                 &message,
                 None::<serde_json::Value>,
             )
         };
 
-        turul_mcp_json_rpc_server::JsonRpcResponse::Error(
-            turul_mcp_json_rpc_server::JsonRpcError::new(Some(request_id), error_obj),
-        )
+        turul_rpc::JsonRpcResponse::Error(turul_rpc::JsonRpcError::new(Some(request_id), error_obj))
     }
 }
 

crates/turul-http-mcp-server/src/stream_manager.rs

@@ -686,7 +686,7 @@ impl StreamManager {
     pub async fn create_post_sse_stream(
         &self,
         session_id: String,
-        response: turul_mcp_json_rpc_server::JsonRpcResponse,
+        response: turul_rpc::JsonRpcResponse,
     ) -> Result<
         hyper::Response<
             http_body_util::combinators::BoxBody<bytes::Bytes, std::convert::Infallible>,
@@ -791,7 +791,7 @@ impl StreamManager {
     pub async fn create_post_sse_stream_with_notifications(
         &self,
         session_id: String,
-        response: turul_mcp_json_rpc_server::JsonRpcResponse,
+        response: turul_rpc::JsonRpcResponse,
         notifications: Vec<SseEvent>,
     ) -> Result<
         hyper::Response<