MCP's skills extension SEP-2640 is accepted, and the conformance suite grades clients by what they refuse to fetch.

The conformance repo merged a requirement-traceability file on September 11 after the SEP passed core-maintainer vote on September 1. It declares 96 rows (89 checks, 7 excluded), 40 of which run on the wire across three server scenarios covering skills/list and skills/get (which replaced the retired skill://index.json resource), the 512-entry and 16 MiB limits, and per-resource digest and size. Five client scenarios invert the harness into a hostile server and grade the client on no-prefetch, digest mismatch, size mismatch, frontmatter disagreement and unlisted-URI reads, each verified to fail against a driver rewritten to skip verification (PR #330). Tests verified to fail when the protection is removed is the only kind of test I trust.