examples: four new 2026 examples + subscriptions client leg (slice 4)

New packages (all live-verified):
- mrtr-elicitation-server (8642, server+client bins): full MRTR round
  trip — input_required → call_tool_with_input_responses → completion;
  README diagrams both legs and the -32003 capability gate
- origin-policy-server (8643): OriginPolicy default/AllowList/Disabled
  via CLI flags; verified 200/403 matrix (no-Origin, evil, allowlisted,
  loopback); probe uses server/discover (ping is gone per SEP-2575)
- header-bound-tools-server (8644): SEP-2243 x-mcp-header →
  Mcp-Param-Region mirroring; verified -32001 omitted/mismatch contract
- bilingual-fleet-client: mixed 2025/2026 fleet sweep — verified 2026
  discover negotiation + 2025 initialize fallback on one binary

streamable-http-client: added the subscriptions_listen leg (ack-first
filter + subscriptionId; drives trigger_changes against
notification-server — deliveries verified live, unrequested
prompts/list_changed correctly filtered).

Proposals 1/3/5/8 dispositioned as satisfied by existing work (review
doc updated). Client-using packages stay out of default-members; built
by explicit gate steps in ci-gates.sh + ci.yml. EXAMPLES.md: new rows,
pairing table, counts (53 active), last --example forms fixed.

Full ci-gates.sh all green.

Author: hortovanyi

.github/workflows/ci.yml

@@ -70,6 +70,8 @@ jobs:
         run: cargo test -p turul-mcp-client
       - name: 2026 client example (pairs with minimal-server)
         run: cargo build -p streamable-http-client
+      - name: Client-using examples (not in default-members)
+        run: cargo build -p mrtr-elicitation-server --bins -p bilingual-fleet-client
 
   opt-in-2025:
     name: Opt-in lane (2025-11-25)

Cargo.toml

@@ -22,6 +22,7 @@ members = [
 
   # Active examples (33 total)
   "examples/audit-trail-server",
+  "examples/bilingual-fleet-client",
   "examples/calculator-add-builder-server",
   "examples/calculator-add-function-server",
   "examples/calculator-add-manual-server",
@@ -35,7 +36,9 @@ members = [
   "examples/lambda-mcp-client",
   "examples/lambda-mcp-server",
   "examples/minimal-server",
+  "examples/mrtr-elicitation-server",
   "examples/notification-server",
+  "examples/origin-policy-server",
   "examples/pagination-server",
   "examples/prompts-server",
   "examples/prompts-test-server",
@@ -55,6 +58,7 @@ members = [
   "examples/zero-config-getting-started",
 
   # MCP 2025-11-25 feature showcases
+  "examples/header-bound-tools-server",
   "examples/icon-showcase",
 
   # Tasks E2E test examples
@@ -124,6 +128,7 @@ default-members = [
   "examples/derive-macro-server",
   "examples/function-macro-server",
   "examples/function-resource-server",
+  "examples/header-bound-tools-server",
   "examples/icon-showcase",
   "examples/lambda-authorizer",
   "examples/middleware-auth-lambda",
@@ -132,6 +137,7 @@ default-members = [
   "examples/middleware-rate-limit-server",
   "examples/minimal-server",
   "examples/notification-server",
+  "examples/origin-policy-server",
   "examples/oauth-resource-server",
   "examples/pagination-server",
   "examples/prompts-server",

EXAMPLES.md

@@ -1,6 +1,6 @@
 # MCP Framework Examples
 
-This document provides a comprehensive overview of all **50 active examples** in the MCP Framework (plus `examples/archived/` — grown by 5 in the 2026-06-12 archive slice, see `docs/plans/2026-07-28-examples-review.md`), organized by learning progression from basic concepts to advanced implementations.
+This document provides a comprehensive overview of all **53 active examples** in the MCP Framework (plus `examples/archived/` — grown by 5 in the 2026-06-12 archive slice, see `docs/plans/2026-07-28-examples-review.md`), organized by learning progression from basic concepts to advanced implementations.
 
 **✅ All active examples compile under their lane's CI gates** (2026-07-28 default lane
 + per-manifest 2025-11-25 pins). Per-example functional re-verification against the
@@ -15,7 +15,9 @@ lane** — run the server first, then point the client at it.
 
 | Client example | Lane | Corresponding server | Notes |
 |---|---|---|---|
-| `streamable-http-client` | **2026-07-28** | `minimal-server` (port 8641) | The canonical 2026 stateless pair: `connect()` negotiation, discover retention, `call_tool`, and the request-scoped progress API (shape demo — `echo` emits no progress events) |
+| `streamable-http-client` | **2026-07-28** | `minimal-server` (port 8641); point at `notification-server` (port 8005) for live subscription deliveries | The canonical 2026 stateless pair: `connect()` negotiation, discover retention, `call_tool`, request-scoped progress, and the ack-first `subscriptions_listen` stream |
+| `mrtr-elicitation-client` (in `mrtr-elicitation-server`) | **2026-07-28** | `mrtr-elicitation-server` (port 8642) | The MRTR round trip: `input_required` → answer → `call_tool_with_input_responses` |
+| `bilingual-fleet-client` | **both** | any mix (demo: `minimal-server` + `client-initialise-server`) | One binary sweeping a mixed 2025/2026 fleet — per-connection negotiation |
 | `streamable-http-client-2025-11-25` | 2025-11-25 | `client-initialise-server` (alternatives: any 2025-pinned server) | Hand-parsed 2025 POST SSE framing |
 | `client-initialise-report` | 2025-11-25 (wire-pinned) | `client-initialise-server` | Raw-wire lifecycle compliance probe |
 | `session-management-compliance-test` | 2025-11-25 (wire-pinned) | `client-initialise-server` | Session-contract regression client |
@@ -45,7 +47,7 @@ lane** — run the server first, then point the client at it.
 **Quick Start Command**:
 ```bash
 # Start with the minimal server
-cargo run --example minimal-server
+cargo run -p minimal-server
 # Server: http://127.0.0.1:8641/mcp
 ```
 
@@ -71,7 +73,7 @@ cargo run --example minimal-server
 | **function-resource-server** | 8008 | ✅ VALIDATED | Function-based resources | Resource function patterns |
 | **session-aware-resource-server** | 8008 | ✅ VALIDATED | Session-aware resources (2025-11-25 pinned) | Session context integration on the stateful lane |
 
-## 🟢 **FEATURE-SPECIFIC SERVERS** (8 examples) - Specialized MCP Features
+## 🟢 **FEATURE-SPECIFIC SERVERS** (11 examples) - Specialized MCP Features
 
 | Example | Port | Status | Description | Key Features |
 |---------|------|--------|-------------|--------------|
@@ -83,6 +85,9 @@ cargo run --example minimal-server
 | **pagination-server** | 8044 | ✅ VALIDATED | Result pagination | Large dataset pagination support |
 | **notification-server** | 8005 | ✅ VALIDATED | Notifications (2026: subscriptions/listen stream) | Real-time notification patterns |
 | **roots-server** | 8050 | ✅ VALIDATED | Root directories | MCP roots/list endpoint demonstration |
+| **mrtr-elicitation-server** | 8642 | ✅ VALIDATED | MRTR elicitation round trip (2026) | `InputRequired` → retry with `inputResponses`; paired client bin |
+| **origin-policy-server** | 8643 | ✅ VALIDATED | Origin validation / DNS-rebinding (2026) | `OriginPolicy` default/AllowList/Disabled; 403 matrix verified live |
+| **header-bound-tools-server** | 8644 | ✅ VALIDATED | SEP-2243 header-bound tool params (2026) | `x-mcp-header` → `Mcp-Param-*` mirroring; -32001 contract verified live |
 
 ## 🔵 **ADVANCED/COMPOSITE SERVERS** (5 examples) - Complex Functionality
 
@@ -99,24 +104,25 @@ cargo run --example minimal-server
 | **session-logging-proof-test** | 8001 | ✅ VALIDATED | Session logging validation | Session-based logging verification |
 | **logging-test-server** | 8052 | ✅ VALIDATED | Logging test suite | Comprehensive logging test suite |
 
-## 🟠 **CLIENT EXAMPLES** (5 examples) - Client Implementation
+## 🟠 **CLIENT EXAMPLES** (6 examples) - Client Implementation
 
 | Example | Type | Status | Description | Purpose |
 |---------|------|--------|-------------|---------|
 | **client-initialise-server** | Server | ✅ VALIDATED | Client connectivity test server | MCP session initialization testing |
 | **client-initialise-report** | Client | ✅ VALIDATED | MCP client implementation | Tests server initialization |
 | **streamable-http-client** | Client | ✅ VALIDATED | 2026-07-28 stateless client (pairs with minimal-server) | connect() negotiation, discover retention, request-scoped progress API |
 | **streamable-http-client-2025-11-25** | Client | ✅ VALIDATED | Hand-parsed 2025 Streamable HTTP client | MCP 2025-11-25 streaming demo |
+| **bilingual-fleet-client** | Client | ✅ VALIDATED | Mixed 2025/2026 fleet sweep | Per-connection negotiation (server/discover → initialize fallback) |
 | **logging-test-client** | Client | ✅ VALIDATED | Logging client | Tests logging functionality |
 | **session-management-compliance-test** | Combined | ✅ VALIDATED | Session compliance testing | MCP session spec compliance |
 
 **Client Testing**:
 ```bash
 # Start the test server
-cargo run --example client-initialise-server
+cargo run -p client-initialise-server
 
 # Test with client (in another terminal)
-cargo run --example client-initialise-report -- --url http://127.0.0.1:8641/mcp
+cargo run -p client-initialise-report -- --url http://127.0.0.1:8641/mcp
 ```
 
 ## ☁️ **AWS LAMBDA** (4 examples) - Serverless Deployment
@@ -156,10 +162,10 @@ cargo run --example client-initialise-report -- --url http://127.0.0.1:8641/mcp
 **Task E2E Testing**:
 ```bash
 # Start the task-enabled server
-cargo run --example tasks-e2e-inmemory-server
+cargo run -p tasks-e2e-inmemory-server
 
 # Run the client test suite (in another terminal)
-cargo run --example tasks-e2e-inmemory-client -- --url http://127.0.0.1:8080/mcp
+cargo run -p tasks-e2e-inmemory-client -- --url http://127.0.0.1:8080/mcp
 ```
 
 ## 📖 **TYPE SHOWCASES** (4 examples) - Print-Only Demonstrations
@@ -207,9 +213,9 @@ re-verified its six examples live on the wire.
 - **Zero Breaking Changes**: All existing examples continue to work
 
 ### 📊 **Statistics**
-- **Total Examples**: 58 (25 archived in `examples/archived/`)
+- **Total Examples**: 53 active (30 archived in `examples/archived/`)
 - **Session-Aware Resources**: 6 examples demonstrating session context integration
-- **Client-Server Pairs**: 5 examples validating communication patterns
+- **Client-Server Pairs**: 9 pairing-table rows validating communication patterns
 - **Task Support**: 3 examples demonstrating MCP 2025-11-25 task lifecycle (InMemory storage)
 - **Middleware**: 4 examples (HTTP auth, logging, rate-limiting, Lambda auth)
 - **Storage Backends**: All 4 session backends (InMemory, SQLite, PostgreSQL, DynamoDB) working
@@ -219,11 +225,11 @@ re-verified its six examples live on the wire.
 
 **Basic Pattern**:
 ```bash
-# Run any example
-cargo run --example <example-name>
+# Run any example (examples are packages with [[bin]] targets — use -p)
+cargo run -p <example-name>
 
 # Examples with custom ports
-cargo run --example client-initialise-server -- --port 8641
+cargo run -p client-initialise-server -- --port 8641
 ```
 
 **With Features** (for PostgreSQL/DynamoDB examples):

docs/plans/2026-07-28-examples-review.md

@@ -191,6 +191,39 @@ Each proposal names **why it should exist**, the **learning value** for a human
 reader, the **spec match** (the driver-doc table it demonstrates), and its
 **practical usefulness**. None exist today in any form.
 
+> **EXECUTED 2026-06-12** (slice 4) — per-proposal disposition:
+>
+> 1. **subscriptions pair** — satisfied without a new package: the
+>    notification-server rewrite (slice 2) is the server side;
+>    `streamable-http-client` gained the client leg (`subscriptions_listen`
+>    ack + filter + `subscriptionId`, drives `trigger_changes` when pointed
+>    at notification-server). Live-verified: deliveries land, the
+>    un-requested `prompts/list_changed` is correctly filtered out.
+> 2. **mrtr-elicitation-server** — BUILT (port 8642, server + client bins).
+>    Live-verified full round trip: `input_required` →
+>    `call_tool_with_input_responses` → "deployed billing-api ✅".
+> 3. **request-scoped-observability** — satisfied without a new package:
+>    notification-server's `long_job` (progress + log under the per-request
+>    opt-ins) plus `streamable-http-client`'s `call_tool_with_progress`.
+> 4. **origin-policy-server** — BUILT (port 8643, was "browser-facing-server").
+>    Live-verified matrix: no-Origin 200 / evil 403 / allowlisted 200 /
+>    loopback 200.
+> 5. **oauth-scoped-server** — folded into `oauth-resource-server` as the
+>    audit suggested (`--required-scope` via manual middleware construction,
+>    slice 3); no new package.
+> 6. **bilingual-fleet-client** — BUILT. Live-verified sweep: 2026 peer
+>    negotiates stateless (discover retained), 2025 peer falls back to the
+>    initialize handshake; same `list_tools` works on both.
+> 7. **header-bound-tools-server** — BUILT (port 8644). Live-verified
+>    SEP-2243 contract: matching header 200; omitted/mismatched header →
+>    400 + `-32001` with the exact mismatch messages.
+> 8. **completion-provider-server** — satisfied by the completion-server
+>    rewrite (slice 2); no new package.
+>
+> Client-using packages (`mrtr-elicitation-server`, `bilingual-fleet-client`)
+> stay out of default-members and are built by an explicit gate step
+> (ci-gates.sh + ci.yml), like `streamable-http-client`.
+
 ### 1. `subscriptions-listen-server` + `subscriptions-listen-client` (pair)
 
 - **Why**: `subscriptions/listen` is THE replacement for the entire 2025

examples/bilingual-fleet-client/Cargo.toml

@@ -0,0 +1,20 @@
+# Uses the bilingual turul-mcp-client (out of default-members, like
+# streamable-http-client); built by an explicit gate step.
+[package]
+name = "bilingual-fleet-client"
+version = "0.4.0"
+edition.workspace = true
+authors.workspace = true
+license.workspace = true
+
+[dependencies]
+turul-mcp-client.workspace = true
+tokio.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+serde_json.workspace = true
+
+[[bin]]
+name = "bilingual-fleet-client"
+path = "src/main.rs"
+test = false

examples/bilingual-fleet-client/src/main.rs

@@ -0,0 +1,94 @@
+//! # Bilingual Fleet Client
+//!
+//! One client binary talking to a mixed 2025-11-25 / 2026-07-28 fleet — the
+//! rolling-upgrade story. For each URL the bilingual `McpClient` probes
+//! `server/discover`; a 2026 server answers, a 2025 server returns `-32601`
+//! (or `-32004`) and the client falls back to the `initialize` handshake.
+//! The negotiated wire spec then locks for that connection's lifetime.
+//!
+//! Upgrade sequencing this enables: upgrade servers first (the client
+//! negotiates each one independently), clients are never blocked.
+//!
+//! ```bash
+//! # Start one server from each generation:
+//! cargo run -p minimal-server               # 2026-07-28, port 8641
+//! cargo run -p client-initialise-server -- --port 52940   # 2025-11-25
+//!
+//! # Then sweep the fleet:
+//! cargo run -p bilingual-fleet-client -- \
+//!     http://127.0.0.1:8641/mcp http://127.0.0.1:52940/mcp
+//! ```
+
+use turul_mcp_client::transport::HttpTransport;
+use turul_mcp_client::{McpClient, McpVersion};
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| "warn".into()),
+        )
+        .init();
+
+    let urls: Vec<String> = std::env::args().skip(1).collect();
+    let urls = if urls.is_empty() {
+        println!("No URLs given — using the default demo fleet.");
+        println!("(start them with: cargo run -p minimal-server  and");
+        println!("  cargo run -p client-initialise-server -- --port 52940)\n");
+        vec![
+            "http://127.0.0.1:8641/mcp".to_string(),
+            "http://127.0.0.1:52940/mcp".to_string(),
+        ]
+    } else {
+        urls
+    };
+
+    for url in &urls {
+        println!("── {url}");
+        match probe(url).await {
+            Ok(()) => {}
+            Err(e) => println!("   unreachable: {e}"),
+        }
+        println!();
+    }
+
+    Ok(())
+}
+
+/// Connect, report the negotiated spec, and run one version-appropriate call.
+async fn probe(url: &str) -> Result<(), Box<dyn std::error::Error>> {
+    let transport = Box::new(HttpTransport::new(url)?);
+    let client = McpClient::new(transport, Default::default());
+    client.connect().await?;
+
+    let version = client.negotiated_version().await;
+    match version {
+        Some(McpVersion::V2026_07_28) => {
+            println!("   negotiated: 2026-07-28 (server/discover answered — stateless wire)");
+            // 2026-only surface: the retained discover body.
+            if let Some(d) = client.discovered_server().await {
+                println!("   serverInfo: {:?}", d.server_info);
+                println!("   supported : {:?}", d.supported_versions);
+            }
+        }
+        Some(other) => {
+            println!(
+                "   negotiated: {other:?} (discover refused — fell back to the initialize handshake; Mcp-Session-Id session is live)"
+            );
+        }
+        None => {
+            println!("   negotiation failed — no common spec");
+            return Ok(());
+        }
+    }
+
+    // Version-neutral surface: the same list_tools call works on both wires.
+    let tools = client.list_tools().await?;
+    let names: Vec<&str> = tools.iter().map(|t| t.name.as_str()).collect();
+    println!("   tools ({}): {names:?}", names.len());
+
+    // disconnect() is a no-op on 2026 (nothing to tear down) and a DELETE on
+    // a 2025 session — the client routes by the negotiated version.
+    client.disconnect().await?;
+    Ok(())
+}

examples/header-bound-tools-server/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "header-bound-tools-server"
+version = "0.4.0"
+edition.workspace = true
+authors.workspace = true
+license.workspace = true
+
+[dependencies]
+turul-mcp-server.workspace = true
+turul-mcp-protocol.workspace = true
+turul-mcp-builders.workspace = true
+async-trait.workspace = true
+tokio.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+serde_json.workspace = true
+
+[[bin]]
+name = "header-bound-tools-server"
+path = "src/main.rs"
+test = false