v0.8.44 — MCP 2026-07-28 stateless conformance (SEP-2567 / SEP-2575)

Contract-level conformance for the MCP 2026-07-28 stateless model — which removed the server-side session lifecycle (no initialize→session handshake, no Mcp-Session-Id header, SEP-2575) and now passes state explicitly as an ordinary typed tool argument (SEP-2567).

What's new

• mcp_stateless_conformance_2026_07_defaults() / MCP_STATELESS_CONFORMANCE_2026_07 — an opt-in preset composed from existing airlock primitives (no new engine, Pydantic-only core):
  • check_request(request) rejects a call still carrying Mcp-Session-Id (top level or under headers/meta/_meta/transport) or invoking a removed lifecycle method (initialize / notifications/initialized) → StatefulSessionError, deny-by-default. (SEP-2575)
  • check_tool_call(tool, kwargs) requires any state-handle arg (state/state_handle/cursor/resume_token/session_state) to be an explicit declared contract parameter, not absorbed by **kwargs or a ghost arg — reuses the shipped get_valid_parameters / GhostArgumentError. (SEP-2567)
• agent_airlock.mcp_spec.statelessness holds the validators; the factory is auto-registered in list_active(), mirroring the SEP-2468 preset shape.

Notes

• SEP-2567 / SEP-2575 are spec proposal ids, not CVEs — the preset cites no CVE.
• The core stays zero-dependency; this preset is pure stdlib + existing airlock.
• 3,327 tests pass, coverage 85.25%, green across Python 3.10–3.13. No regression on the existing SEP-2468 preset (pinned by test).