Bump the conformance pin to 0.2.0-alpha.8 and baseline the listen checks it surfaces

.github/actions/conformance/expected-failures.2026-07-28.yml

@@ -23,6 +23,9 @@
 client: []
 
 server:
+  # SEP-2575 subscriptions/listen is not implemented yet; see the matching
+  # entry in expected-failures.yml for the full rationale.
+  - server-stateless
   # SEP-2243 Mcp-Param-* server-side validation is not implemented yet; see
   # the matching entry in expected-failures.yml for the full rationale.
   - http-custom-header-server-validation

.github/actions/conformance/expected-failures.yml

@@ -13,6 +13,16 @@
 client: []
 
 server:
+  # SEP-2575 subscriptions/listen is not implemented yet. The everything-
+  # server's legacy resources/subscribe handlers make it advertise
+  # `resources.subscribe` in server/discover, and as of conformance #372 a
+  # server that advertises a subscription capability but answers
+  # subscriptions/listen with -32601 fails the three listen MUST checks
+  # ("Not testable") instead of skipping them. Remove this entry when the
+  # listen runtime lands. NOTE: while listed, this entry also masks new
+  # failures in the scenario's other 25 (currently passing) checks — the
+  # baseline is per-scenario, not per-check.
+  - server-stateless
   # SEP-2243 Mcp-Param-* server-side validation is not implemented yet. The
   # everything-server's `test_x_mcp_header` tool arms these checks (without an
   # x-mcp-header-annotated tool the harness skips all of them silently); the

.github/workflows/conformance.yml

@@ -19,17 +19,17 @@ env:
   # Bump deliberately and reconcile both
   # .github/actions/conformance/expected-failures*.yml files in the same change.
   #
-  # Temporarily pinned to the pkg.pr.new build of conformance main@b18aa918
-  # (the merge of #371, which fixes the http-custom-headers fixture's
-  # spec-forbidden `number`-typed x-mcp-header annotations) — no published
-  # release includes it yet. Pinned by commit SHA so the tarball cannot move
-  # under us; CONFORMANCE_PKG_SHA256 pins the bytes and the fetch-and-verify
-  # step below downloads, checks the digest, and repoints CONFORMANCE_PKG at the
+  # Temporarily pinned to the pkg.pr.new build of conformance main@4944b268
+  # (0.2.0-alpha.8, which includes #372: fail checks whose prerequisite is
+  # missing instead of skipping them) — alpha.8 is not published to npm yet.
+  # Pinned by commit SHA so the tarball cannot move under us;
+  # CONFORMANCE_PKG_SHA256 pins the bytes and the fetch-and-verify step below
+  # downloads, checks the digest, and repoints CONFORMANCE_PKG at the
   # verified local copy. Repin to the next published @modelcontextprotocol/
-  # conformance release (>0.2.0-alpha.7) once it ships, then drop
+  # conformance release (>=0.2.0-alpha.8) once it ships, then drop
   # CONFORMANCE_PKG_SHA256 and the fetch-and-verify steps.
-  CONFORMANCE_PKG: "https://pkg.pr.new/@modelcontextprotocol/conformance@b18aa918"
-  CONFORMANCE_PKG_SHA256: "e9f6bc25085b4692e988cbdbd024a4203d54a52a6aaa065376cf8ecaa09bb680"
+  CONFORMANCE_PKG: "https://pkg.pr.new/@modelcontextprotocol/conformance@4944b268"
+  CONFORMANCE_PKG_SHA256: "0f70c035782d319d72ab427653c5275db5c50429d59fae0241a645b33aeda1a7"
 
 jobs:
   server-conformance: