feat: L0 transport — MCP caller, server, error taxonomy, auth (Track 3)

CLAUDE.md

@@ -21,7 +21,7 @@ If a task contradicts a confirmed decision, **stop and ask** before coding aroun
 
 ## Build commands
 
-JDK 21 required. The Gradle wrapper is committed.
+JDK 21 and [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) required. The Gradle wrapper is committed. Install cosign via `brew install cosign` (macOS) — the build uses it to verify schema bundle signatures.
 
 ```bash
 ./gradlew build           # full build, all 8 modules

CONTRIBUTING.md

@@ -28,6 +28,7 @@ Before designing anything new, read the [21 confirmed post-RFC decisions](ROADMA
 
 Requirements:
 - JDK 21 (Temurin recommended)
+- [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) — the build shells out to `cosign verify-blob` to verify the schema bundle signature (per D4). Install via `brew install cosign` (macOS) or `go install github.com/sigstore/cosign/v2/cmd/cosign@latest`.
 - The Gradle wrapper (committed) — don't install Gradle separately.
 
 Local build:

ROADMAP.md

@@ -223,7 +223,7 @@ The RFC's M+12 target is the realistic line. Pre-committing M+9 and slipping is
 
 ### Track 3 — L0 transport: MCP + A2A
 
-**ID:** `transport` | **Owner:** TBD | **Size:** 1.5 person-months
+**ID:** `transport` | **Owner:** @MichielDean (#17) | **Size:** 1.5 person-months
 
 **Scope:**
 
@@ -528,6 +528,6 @@ Additional decisions added post-RFC that remain open:
 | Implementation plan drafted | ✅ (this doc) |
 | Confirmed decisions D1–D21 locked | ✅ |
 | Funding / staffing confirmed | ⏳ Decision pending |
-| Tracks claimed | 0 / 14 |
+| Tracks claimed | 3 / 14 — `infra` (Track 1, #2), `codegen` (Track 2, #11), `transport` (Track 3, #17) |
 | Pre-contributor harness | 🟡 In progress — Gradle skeleton, codegen MVP, SSRF skeleton, schema fetcher, mock-server CI gate, IPR workflow, commitlint, changesets, MCP prototype findings all landed. Foundation admin actions outstanding: IPR Bot install, DNS TXT for Sonatype, @MichielDean collaborator. |
 | v0.1 alpha | Not Started |

adcp-cli/gradle.lockfile

@@ -2,13 +2,21 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.ethlo.time:itu:1.10.3=runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.2=runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.20=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.core:jackson-core:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.core:jackson-databind:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson:jackson-bom:2.20.1=runtimeClasspath,testRuntimeClasspath
 com.networknt:json-schema-validator:1.5.6=runtimeClasspath,testRuntimeClasspath
+io.modelcontextprotocol.sdk:mcp-core:1.1.2=runtimeClasspath,testRuntimeClasspath
+io.modelcontextprotocol.sdk:mcp-json-jackson2:1.1.2=runtimeClasspath,testRuntimeClasspath
+io.projectreactor:reactor-core:3.7.0=runtimeClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=compileClasspath,testCompileClasspath
 org.jspecify:jspecify:1.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.junit.jupiter:junit-jupiter-api:5.11.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -19,7 +27,8 @@ org.junit.platform:junit-platform-engine:1.11.4=testRuntimeClasspath
 org.junit.platform:junit-platform-launcher:1.11.4=testRuntimeClasspath
 org.junit:junit-bom:5.11.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.reactivestreams:reactive-streams:1.0.4=runtimeClasspath,testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.slf4j:slf4j-simple:2.0.16=runtimeClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.3=runtimeClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.4=runtimeClasspath,testRuntimeClasspath
 empty=annotationProcessor,testAnnotationProcessor

adcp-kotlin/gradle.lockfile

@@ -2,13 +2,21 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.ethlo.time:itu:1.10.3=runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.18.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.18.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.18.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.2=runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.18.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.18.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata
+com.fasterxml.jackson.core:jackson-annotations:2.20=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.18.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata
+com.fasterxml.jackson.core:jackson-core:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.18.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata
+com.fasterxml.jackson.core:jackson-databind:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.18.2=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata
+com.fasterxml.jackson:jackson-bom:2.20.1=runtimeClasspath,testRuntimeClasspath
 com.networknt:json-schema-validator:1.5.6=runtimeClasspath,testRuntimeClasspath
+io.modelcontextprotocol.sdk:mcp-core:1.1.2=runtimeClasspath,testRuntimeClasspath
+io.modelcontextprotocol.sdk:mcp-json-jackson2:1.1.2=runtimeClasspath,testRuntimeClasspath
+io.projectreactor:reactor-core:3.7.0=runtimeClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata
 org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-build-common:2.1.10=kotlinBuildToolsApiClasspath
@@ -43,6 +51,7 @@ org.junit.platform:junit-platform-engine:1.11.4=testRuntimeClasspath
 org.junit.platform:junit-platform-launcher:1.11.4=testRuntimeClasspath
 org.junit:junit-bom:5.11.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.reactivestreams:reactive-streams:1.0.4=runtimeClasspath,testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.16=apiDependenciesMetadata,compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.yaml:snakeyaml:2.3=runtimeClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.4=runtimeClasspath,testRuntimeClasspath
 empty=annotationProcessor,intransitiveDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDefExtensions,testAnnotationProcessor,testApiDependenciesMetadata,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDefExtensions

adcp-mutiny/gradle.lockfile

@@ -2,13 +2,21 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.ethlo.time:itu:1.10.3=runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.2=runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.20=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.core:jackson-core:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.core:jackson-databind:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson:jackson-bom:2.20.1=runtimeClasspath,testRuntimeClasspath
 com.networknt:json-schema-validator:1.5.6=runtimeClasspath,testRuntimeClasspath
+io.modelcontextprotocol.sdk:mcp-core:1.1.2=runtimeClasspath,testRuntimeClasspath
+io.modelcontextprotocol.sdk:mcp-json-jackson2:1.1.2=runtimeClasspath,testRuntimeClasspath
+io.projectreactor:reactor-core:3.7.0=runtimeClasspath,testRuntimeClasspath
 io.smallrye.common:smallrye-common-annotation:2.8.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.smallrye.reactive:mutiny:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
@@ -22,6 +30,7 @@ org.junit.platform:junit-platform-engine:1.11.4=testRuntimeClasspath
 org.junit.platform:junit-platform-launcher:1.11.4=testRuntimeClasspath
 org.junit:junit-bom:5.11.4=testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
+org.reactivestreams:reactive-streams:1.0.4=runtimeClasspath,testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.3=runtimeClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.4=runtimeClasspath,testRuntimeClasspath
 empty=annotationProcessor,testAnnotationProcessor

adcp-reactor/gradle.lockfile

@@ -2,13 +2,20 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.ethlo.time:itu:1.10.3=runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-annotations:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.2=runtimeClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.18.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.core:jackson-annotations:2.20=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.core:jackson-core:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.core:jackson-databind:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.20.1=runtimeClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.18.2=compileClasspath,testCompileClasspath
+com.fasterxml.jackson:jackson-bom:2.20.1=runtimeClasspath,testRuntimeClasspath
 com.networknt:json-schema-validator:1.5.6=runtimeClasspath,testRuntimeClasspath
+io.modelcontextprotocol.sdk:mcp-core:1.1.2=runtimeClasspath,testRuntimeClasspath
+io.modelcontextprotocol.sdk:mcp-json-jackson2:1.1.2=runtimeClasspath,testRuntimeClasspath
 io.projectreactor:reactor-core:3.7.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
 org.jspecify:jspecify:1.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -22,5 +29,5 @@ org.junit:junit-bom:5.11.4=testCompileClasspath,testRuntimeClasspath
 org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
 org.reactivestreams:reactive-streams:1.0.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.slf4j:slf4j-api:2.0.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:2.3=runtimeClasspath,testRuntimeClasspath
+org.yaml:snakeyaml:2.4=runtimeClasspath,testRuntimeClasspath
 empty=annotationProcessor,testAnnotationProcessor

adcp-server/src/main/java/org/adcontextprotocol/adcp/server/AdcpContext.java

@@ -0,0 +1,27 @@
+package org.adcontextprotocol.adcp.server;
+
+import org.adcontextprotocol.adcp.AdcpVersion;
+import org.jspecify.annotations.Nullable;
+
+import java.util.Map;
+
+/**
+ * Context passed to {@link AdcpPlatform} tool handlers.
+ *
+ * <p>Carries per-request metadata: the caller's identity, the negotiated
+ * protocol version, and any headers the handler might need.
+ *
+ * @param adcpVersion the protocol version from the request envelope
+ * @param headers     all inbound request headers
+ * @param requestId   the MCP request ID (for correlation)
+ */
+public record AdcpContext(
+        @Nullable AdcpVersion adcpVersion,
+        Map<String, String> headers,
+        @Nullable String requestId
+) {
+
+    public AdcpContext {
+        headers = Map.copyOf(headers);
+    }
+}