Serve MCP 2026-07-28 stateless requests through the streamable proxy

[jhrozek]

Part of #5755. Design: RFC THV-0081; arch doc §Changes → "Streamable proxy" and §Security invariant (branch stateless-transport-proxies-design, PR #5808). Security-critical.

Serve Modern (2026-07-28) stateless requests through the streamable (HTTP→stdio) proxy.

Changes

• Wire ClassifyRevision into resolveSessionForRequest; add a Legacy/Modern mode flag as a transport property (not driven off the client-controlled MCP-Protocol-Version header).
• Modern stateless routing: unconditionally mint a fresh per-request routing token and ignore/strip any client-supplied Mcp-Session-Id; do not mint a session or consult the session manager. (The existing sessionless branch is guarded on an absent session header, so a Modern request carrying one would otherwise fall through to session lookup and risk response cross-delivery.)
• Modern message-shape enforcement: reject JSON-RPC batches and client-sent responses; GET/DELETE → 405.

Dependencies

Depends on #5755 foundation issue (the deepened classifier).

Verification

• Concurrency cross-delivery test: two concurrent Modern requests sharing a JSON-RPC id, one carrying a foreign Mcp-Session-Id, must not cross-deliver responses.
• Modern batches / client-sent responses rejected; GET/DELETE → 405.
• MRTR InputRequiredResult pass-through: an ordinary response with an id, must traverse the dispatcher unchanged.
• Legacy behavior unchanged.

May split into routing and shape-enforcement PRs.

[jhrozek]

Note from the #5834 review (classifier + method vocabulary):

#5834 initially allow-listed server/discover as always-allowed in MCPMethodToFeatureOperation. On review we removed that entry so the method default-denies (403) for now. An always-allowed entry means its response never runs through ResponseFilteringWriter, so once a Modern backend actually answers server/discover, a Cedar-restricted client could enumerate the full tool/resource catalog that tools/list / resources/list filtering exists to scrub — and it would come back as HTTP 200, invisible to audit.

So when this issue wires Modern serving through the streamable proxy, server/discover needs to become allow + response-filter (route it through the same Cedar-scoped filtering path as the list methods), not just routed. The current issue text only mentions routing server/discover, so flagging the authorization/filtering requirement here as part of the security-critical scope.