[mcp-2026] Hide tasks on 2026 wire until tasks/update exists

[manish-wekan]

Context

PR #21 registered a Tasks surface that does not match 2026-07-28 (SEP-2663 needs tasks/get + tasks/update + tasks/cancel).

Today (nitrostack/core/app.py _register_task_handlers):

• Registers tasks/list, tasks/get, tasks/cancel, tasks/result
• Sets server.has_task_support = True unconditionally
• Discover advertises io.modelcontextprotocol/tasks only if a tool has task_support optional/required (_advertise_tasks_extension) — so low-level capabilities and discover can disagree
• No tasks/update
• tasks/result and tasks/list are in MODERN_METHOD_CONTRACTS and only rejected when era is modern; auto still serves them
• core/task.py TaskStatus includes expired; tasks/types.py terminal set is completed|failed|cancelled
• TaskStatusRouter in nitrostack/tasks/notify.py has no production callers
• InFlightRegistry is register/discard on tools/call; nothing handles notifications/cancelled so cancel is dead
• create_task ids are task_ + 12 hex chars
• InMemoryTaskStore is an unlocked dict
• check_task_access(context=None) returns (isolation bypass if HTTP forgets request_ctx)
• ttl_ms_to_seconds uses max(1, int(ttl_ms/1000)) (500ms → 1s)
• Tool task_support == "required" raises INVALID_REQUEST, not -32021

Official Python mcp SDK skipped Tasks. Default for this issue: hide tasks on the 2026 wire. Do not implement full tasks/update unless product explicitly asks in this issue’s comments.

Handoff: #21 (comment)

Goal (Hide)

Auto/modern:

• Do not advertise tasks extension
• Do not register tasks/*
• tools/call with params.task → error (-32021 or invalid-params: server does not support tasks), not CreateTaskResult

Keep TaskManager / @tool(task_support=...) for in-process and era legacy if those tests still need them.

Probe

rg -n "add_request_handler\(\"tasks/|has_task_support|_advertise_tasks_extension|tasks/update" nitrostack
rg -n "TaskStatusRouter|notify_task_status" nitrostack
rg -n "InFlightRegistry|_in_flight" nitrostack

Read:

• nitrostack/core/app.py — _register_task_handlers, _call_tool task branch, _advertise_tasks_extension
• nitrostack/core/mcp_server.py — has_task_support → caps.tasks including list
• nitrostack/protocol/method_contract.py — tasks rows
• nitrostack/core/task.py vs nitrostack/tasks/types.py
• nitrostack/tasks/notify.py, nitrostack/tasks/authorization.py, nitrostack/tasks/memory.py
• tests/test_mcp20_tasks.py, tests/test_tasks.py, tests/test_mcp20_task_authorization.py

Implementation (Hide — do this)

1. has_task_support = False on auto/modern. Do not set True unconditionally.
2. Do not register tasks/list, tasks/result, tasks/get, tasks/cancel on auto/modern.
3. Discover: advertise_tasks=False on auto/modern (even if tools have task_support flags).
4. _call_tool: if era is auto/modern and task_metadata is present → -32021 (once WP2 adds the code) or -32602 with a clear message. Do not spawn TaskManager background work for HTTP 2026.
5. Remove tasks/result / tasks/list from any “live modern methods” table (WP2 owns the table; coordinate).
6. notify.py: delete if still unhooked, or leave unused only if Hide makes it obviously dead — prefer delete to avoid a fake fan-out.
7. InFlightRegistry: if cancel is still unwired, delete register/discard on the 2026 path or wire notifications/cancelled. Do not leave a registry tests poke that HTTP never cancels.

Legacy era: you may keep existing task handlers if tests/test_tasks.py depends on them. Do not expand 2025 task list onto 2026.

Do not do “Finish” in this issue

Finish would mean tasks/get + tasks/update + tasks/cancel, no list/result on modern, one status enum, store lock, UUID ids, access context always passed, notify hooked, -32021 for capability mismatches. That is a separate product epic. If you start Finish, you must complete it — do not ship half.

Test / verify

pytest tests/test_mcp20_tasks.py tests/test_tasks.py tests/test_mcp20_task_store.py tests/test_mcp20_task_authorization.py -q

Those files likely expect 2026 task RPCs. Update them to match Hide:

• HTTP TestClient, era modern/auto: tasks/get / tasks/list / tasks/result → -32601
• Discover capabilities: no io.modelcontextprotocol/tasks
• tools/call with task: {} on modern → not a task result
• Keep in-process TaskManager unit tests if the class remains

Add one test that get_capabilities does not include tasks for a modern/auto app.

Review

• No new task persistence backend.
• Discover and has_task_support agree (both off on 2026).
• No silent CreateTaskResult on modern.

Success

• Auto/modern: no tasks/* handlers, no tasks extension in discover
• Auto/modern: task-augmented tools/call does not return TaskData
• has_task_support not unconditionally True
• Unhooked TaskStatusRouter not advertised as live
• Updated tests pass; do not keep tests that require ping-era sidecar task intercept

Related

Depends on WP0 (who handles /mcp) and WP2 (-32021, method table). Do not block on a full Tasks spec implementation.