feat: add 2026-05-13 weekly meeting notes (#38)

meetings/2026-05-13_weekly.md

@@ -0,0 +1,94 @@
+# **2026-05-13 MCP: Transport Working Group (Weekly)**
+
+# **TL;DR**
+
+The meeting finalized task notification semantics and introduced the Triggers
+and Events Working Group proposal. The group reached consensus on explicitly
+disallowing progress and logging notifications on tasks under the subscription
+model, choosing to table these in favor of defining a robust intermediate
+results pattern later. Peter Alexander presented the three delivery modes of the
+triggers and events primitive: polling, push stream, and web hooks. Tensions
+arose concerning web hook security, specifically DDoS amplification attacks, and
+whether cursor compatibility should be mandated between polling and web hook
+delivery to ensure reliable pub/sub delivery.
+
+# **Detailed Summary**
+
+## **Task Notification Strategy**
+
+* **Reworking Notifications:** The team discussed how progress and logging
+  notifications fit into tasks. Under the stateless SEP, normal requests use an
+  SSE stream for notifications, which is incompatible with task polling.  
+* **Tension Point \- Fragmented Notifications:** The group debated three
+  options: subscribing to all task notifications in `subscriptionslist`
+  (disjointed from base spec), opening an SSE stream on `tasks.get` (fragmented
+  and complex for polling), or disallowing progress/logging on tasks
+  temporarily.  
+* **Consensus \- Temporary Disallowance:** The group agreed to Solution 3, which
+  explicitly disallows SSE streams on tasks, supporting only the
+  `subscriptionslist` for task status updates.  
+* **Tension Point \- Progress vs Intermediary Results:** Shaun Smith advocated
+  for progress notifications as a major UX improvement. Caitie McCaffrey and
+  Peter Alexander argued that progress is too simple and what users actually
+  want is intermediate results with steering input (e.g., telling a task to
+  change a generated color).
+
+## **Triggers and Events Primitive**
+
+* **Events Primitive Introduction:** Peter Alexander introduced a new events
+  primitive (`events.list`) for low-rate server-side events (e.g., Discord
+  messages, build alerts), excluding high-throughput or multimedia streams.  
+* **Three Delivery Modes:** The proposal supports polling (clients pull at
+  intervals), push streams (single SSE connection per subscription), and web
+  hooks (soft TTL-based subscription where the server posts to the client).  
+* **Tension Point \- Cursors and Reliability:** Caitie McCaffrey noted that
+  implementing cursors for replay makes this more like pub/sub than best-effort
+  notifications. Cursors are generated by the server and passed by the client to
+  resume streams.
+
+## **Web Hook Architecture & Security**
+
+* **Two-Hop Architecture:** Shaun Smith noted that web hooks require an open
+  HTTP point on both the MCP server and the host client, creating an extra hop.
+  Peter Alexander defended this, stating it provides a constrained, filtered API
+  for hosts.  
+* **Tension Point \- DDoS and Handshake Security:** Kurtis Van Gent raised
+  concerns that malicious actors could register fake web hook endpoints to
+  orchestrate amplification DDoS attacks. The team agreed on adding an endpoint
+  verification challenge-response step and client-generated HMAC signing
+  secrets.  
+* **Tension Point \- Web Hook Cursors:** Kurtis Van Gent questioned the
+  necessity of cursors for web hooks, arguing that standard web hooks start from
+  the subscription moment. Caitie McCaffrey and Clare Liguori noted that
+  combining web hooks as a "wake up" signal with background polling is a common,
+  reliable pattern.  
+* **Tension Point \- Mandating Cursor Compatibility:** Kurtis Van Gent expressed
+  concerns about not mandating cursor compatibility if both polling and web
+  hooks are supported, as arbitrary clients and servers must align.
+
+# **Next Steps & Timeline**
+
+Core maintainers will move forward with task notification specifications without
+progress/logging. Peter Alexander will update the triggers and events proposal
+with details on transport rationale and handshake verification, while Caitie
+McCaffrey will follow up on official task acceptance votes.
+
+# **Action Items**
+
+- [ ] Caitie McCaffrey Follow up on the official acceptance status of tasks and
+  check the necessity of a voting process.  
+- [ ] Caitie McCaffrey Investigate real-world progress notification use cases
+  and compare them against Shaun Smith's examples.  
+- [ ] Peter Alexander Update the events proposal document to clarify the
+  coexistence rationale for pull, push, and web hook modes.  
+- [ ] Peter Alexander Add endpoint verification steps and security measures to
+  the web hook specification to prevent DDoS attacks.  
+- [ ] Shaun Smith Analyze the complexities of many-to-many relationships between
+  servers, hosts, and multiple web hooks.  
+- [ ] Clare Liguori Develop and test client-side architectures showing protocol
+  implementation based on these definitions.  
+- [ ] All Participants Conduct larger system demos with external event sources
+  (Discord, Telegram) to evaluate production readiness.
+
+Source: [Meeting Notes — May 13,
+2026](https://docs.google.com/document/d/1KFwTal-yFzfszl6VOsCjNLu7L6joNLbipBversMrM6Q/edit?usp=meet_tnfm_email)