@@ -88,3 +88,28 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - run: pnpm dogfood:confine
+
+  protocol-sandbox:
+    name: published stdio compatibility (container)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 26.11.1
+
+      - name: Compare pinned peers directly and through the published guard
+        run: |
+          node --test scripts/protocol-sandbox/launcher-check.mjs
+          bash scripts/dogfood-protocol.sh "$RUNNER_TEMP/protocol-evidence"
+
+      - name: Preserve synthetic compatibility evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: protocol-evidence
+          path: ${{ runner.temp }}/protocol-evidence
+          if-no-files-found: error
+          retention-days: 14
@@ -8,6 +8,14 @@ _Add entries here, never under a stamped version_ — a release commit renames t
 heading, and a branch that wrote beneath it merges without conflict straight into a
 published section (it happened to #170).
 
+### Added
+
+- Reproducible offline container validation of the pinned published CLI against
+  SDK v1/v2 peers and Inspector, with direct/guarded comparisons, bounded
+  synthetic evidence and explicit unsupported/not-tested results. CI preserves
+  the compatibility report. This adds test tooling, not runtime behavior or an
+  installed-client/full-conformance guarantee.
+
 ## [0.47.0] - 2026-10-09
 
 MINOR by content: new modern MCP carrier coverage and an additive diagnostic
 
@@ -59,6 +59,11 @@ macOS-only end-to-end check for the `--confine` sandbox:
 pnpm dogfood:confine    # hermetic; must print "✓ confine dogfood PASSED"
 ```
 
+For offline direct/guarded stdio comparisons using the pinned published release
+and official SDK v1/v2 peers, run `bash scripts/dogfood-protocol.sh /tmp/mcpm-protocol-evidence`.
+Docker provisions the test dependencies, then runs with no network or host
+mounts. See [the matrix, evidence and limits](docs/PROTOCOL-VALIDATION.md).
+
 ## Ground rules
 
 - **Tests first, and they must pass.** New behaviour needs a test; bug fixes need a
 
@@ -76,6 +76,12 @@ measure adoption or interoperability in installed IDE clients, and do not certif
 all 2026-07-28 protocol behavior. `mcpm serve` still uses the existing SDK; no SDK
 upgrade or negotiation behavior is included in this change.
 
+The separate [sandbox compatibility harness](PROTOCOL-VALIDATION.md) compares
+the pinned published release with official SDK v1/v2 peers and Inspector over
+stdio. It records named protocol outcomes, guard errors and persistence under
+container isolation. Installed native clients and full conformance remain
+unverified; the matrix states the tested operations and exclusions.
+
 ### Full message flow
 
 The relay inspects each direction independently — a request (parent → child) and the matching response (child → parent) each run the full pattern + pin + policy pipeline before anything is forwarded:
 
@@ -0,0 +1,112 @@
+# Sandboxed stdio compatibility validation
+
+Run the pinned **published** CLI against official SDK reference peers, both
+directly and through `mcpm guard run --inner`:
+
+```sh
+bash scripts/dogfood-protocol.sh /tmp/mcpm-protocol-evidence
+```
+
+Requires Docker and a host Node.js to enforce the outer execution deadline.
+Provisioning the image needs registry access; the test container has no network.
+CI runs this command on Ubuntu and uploads the evidence even when comparisons
+fail. This job tests the released baseline, independently of the source tests.
+It does **not** test a candidate runtime change or automatically follow `latest`.
+The isolated manifest's `npm test` is the container entry point; use the wrapper
+above on the host. Host-only launcher regression checks run with
+`node --test scripts/protocol-sandbox/launcher-check.mjs`.
+
+## Reproducible inputs and isolation
+
+`scripts/protocol-sandbox/package-lock.json` freezes the complete test-only
+dependency tree. The initial inputs are CLI **0.47.0**, SDK v1 **1.32.1**, SDK v2
+client/server **2.3.1**, Inspector **2.10.1**, and Node **26.11.1** on Debian
+Bookworm. The Docker base is pinned by its multi-platform manifest digest.
+Production dependencies and the root lockfile are unchanged. To update a peer
+or release baseline, change its exact version in the isolated package manifest,
+regenerate that lockfile with npm, rerun the matrix, and update the measured scope
+here. Do not infer compatibility from the package's major version alone.
+
+Only the harness and existing public `modern-*.json` fixtures enter the Docker
+build context. No host home, client configuration, credentials, SSH agent, Docker
+socket, or host directory is mounted. Dependencies install with scripts disabled.
+At execution the container uses UID 1000, a read-only root, no network, no Linux
+capabilities, no privilege escalation, and limits of 768 MiB, two CPUs and 128
+processes. Each comparison has separate synthetic state in a disposable tmpfs.
+A fresh anonymous Docker volume holds evidence; cleanup removes both it and the
+container after exporting files. The built image remains cached locally.
+
+The harness verifies its UID, effective capabilities, addressed network
+interfaces, read-only application directory and absence of host paths/sockets.
+The exported container configuration records the actual network/mount/resource
+settings. Requests and child shutdowns have deadlines; the outer test run has a
+120-second deadline. On timeout the launcher kills the attach process and stops
+the container before exporting evidence. Raw wire captures have message/byte
+budgets; SDK captures are limited by the tmpfs and checked against a 1 MiB budget
+when read. Large raw messages are represented by size/hash instead of full wire
+text. Everything is
+public or synthetic. These checks are evidence of this container boundary, not a
+claim that containers resist a kernel exploit.
+
+## Measured matrix
+
+Initial local run on **2026-10-10**, Docker Desktop Linux/arm64: **40 pass, zero
+fail, two expected unsupported combinations**, from **42 direct/guarded
+comparisons**, plus four explicit excluded scope categories. Seven harness
+self-checks cover comparison failures, recovery contents, unsupported-error
+correlation, invalid JSON-RPC envelopes, out-of-order correlation, silent/closed
+peers, and unterminated output. A host launcher regression covers successful,
+failed and timed-out runs, stop-before-export, cleanup and stale-evidence refusal.
+CI separately supplies Linux runner evidence.
+
+| Cases | Observations |
+| --- | --- |
+| SDK v1 → v1; v2 auto → v1; v1 → v2 dual-era; v2 pinned → v2 | Ordinary tools/resources/prompts and concurrent tool calls; observed legacy `2025-11-25` or modern `2026-07-28`, with matched opening messages and declaration pins. |
+| Interactive calls for all four pairs | Deterministic sampling, elicitation and roots callbacks. Modern retry carries four keyed responses, a fresh id, unchanged arguments and exact opaque state. SDK v2's legacy shim is exercised too. |
+| Modern decline/cancel, progress, timeout and abort | Expected callback outcomes, progress delivery and successful calls after cancellation/timeouts. |
+| Tool-output and server-input attacks | Correlated block errors and subsequent recovery. Legacy input blocks return to the server's request id; modern input blocks return to the client and do not trigger the input callbacks. |
+| Legacy client → modern-only server | **Unsupported**: observed `-32022`, preserved through the guard. |
+| Modern pinned client → legacy server | **Unsupported**: discovery returns `-32601`; the SDK reports failed era negotiation without fallback. |
+| SDK v1 and v2 auto → `mcpm serve` | Legacy initialization/fallback and actual tool listing only; no registry/model API calls. |
+| Eleven existing modern public fixtures | Benign payload identity, intended blocks and explicit unsupported-shape warnings. |
+| Raw shapes and policies | 512 nested arrays, a 100 KB result, unknown version `-32022`, discovery drift across restart without repinning, coverage-warning ignore/block overrides. |
+| Malformed/oversize/closed/silent peers | Bounded rejection; malformed frame block and `frame-too-large` event; silence reaches a deadline. |
+| Inspector CLI → SDK v2 | Actual tool listing through an explicit server configuration, directly and guarded. No Inspector web proxy is started. |
+
+SDK/Inspector agreement is not an independent conformance oracle: these tools
+share upstream code. Additional assertions check observed version metadata,
+result discriminators, error codes, request ids, retry arguments/state, callback
+counts, cancellation forwarding, persisted pins/events and benign/recovery
+contents. The relevant requirements are
+the [versioning contract](https://modelcontextprotocol.io/specification/2026-07-28/basic/versioning)
+and [MRTR contract](https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/mrtr).
+
+## Reading the evidence
+
+`report.json` records package versions, npm artifact URL/integrity, lockfile,
+CLI entrypoint and harness hashes, OS/architecture/Node, boundary checks,
+per-case outcomes and counts. Each successful comparison links separate direct
+and guarded files containing observed protocol, synthetic wire data where
+applicable, stderr, pins and events. Assertion failures retain links to observations
+already captured. `container.json` and `image.json` identify the executed settings
+and image. `execution.json` records the overall run status and exit code, including
+deadline failures (124), which may leave a partial `report.json`. Failed assertions
+produce `fail` and a nonzero exit; unsupported outcomes require the expected client
+error and a correlated protocol rejection. The launcher requires an empty output
+directory so older files cannot be mistaken for new evidence. The JSON schema is
+local harness output, not a public CLI contract.
+
+## Remaining verification
+
+Installed native clients and their configuration-adapter lifecycles, model/skill
+behavior, HTTP/OAuth, and universal protocol conformance remain **not tested**.
+This matrix does not cover every method, extension, subscription or repeated
+MRTR depth; it does not claim complete schema validation or detection coverage.
+It neither upgrades `mcpm serve` nor translates protocols in the guard.
+
+Next, use a disposable macOS VM with synthetic settings to validate VS Code and
+Claude Code, including real harmless tool calls and the user-global files mcpm
+actually manages. Isolated-profile connection tests alone do not establish
+adapter compatibility. Expand to other clients/platforms only with named
+versions and observed results; test-account access may be needed for real agent
+tool invocation.
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+OUTPUT="${1:?Usage: bash scripts/dogfood-protocol.sh OUTPUT_DIRECTORY}"
+mkdir -p "$OUTPUT"
+OUTPUT="$(cd "$OUTPUT" && pwd -P)"
+node -e 'if(require("node:fs").readdirSync(process.argv[1]).length)throw Error("Evidence directory must be empty")' "$OUTPUT"
+CONTEXT="$(mktemp -d)"
+CONTAINER=""
+cleanup() {
+  local status=$?
+  if [ -n "$CONTAINER" ]; then docker rm -fv "$CONTAINER" >/dev/null || status=1; fi
+  rm -rf "$CONTEXT" || status=1
+  exit "$status"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+# Send only the harness and public fixtures to Docker, never the entire checkout.
+for file in Dockerfile package.json package-lock.json harness.mjs self-check.mjs peer.mjs run.mjs; do
+  cp "$ROOT/scripts/protocol-sandbox/$file" "$CONTEXT/$file"
+done
+mkdir "$CONTEXT/fixtures"
+for group in benign warn attacks; do
+  cp "$ROOT/src/guard/__tests__/fixtures/mcptox/$group"/modern-*.json "$CONTEXT/fixtures/"
+done
+IMAGE="$(docker build -q "$CONTEXT")"
+CONTAINER="$(docker create --network none --read-only --user 1000:1000 --cap-drop ALL \
+  --security-opt no-new-privileges --pids-limit 128 --memory 768m --cpus 2 --init \
+  --mount type=volume,destination=/evidence \
+  --tmpfs /work:rw,noexec,nosuid,size=128m,uid=1000,gid=1000 "$IMAGE")"
+set +e
+node - "$CONTAINER" "$OUTPUT" <<'NODE'
+const r = require('node:child_process').spawnSync('docker', ['start', '-a', process.argv[2]], {
+  stdio: 'inherit', timeout: 120000, killSignal: 'SIGKILL',
+});
+const status = r.error?.code === 'ETIMEDOUT' ? 124 : (r.status ?? 1);
+require('node:fs').writeFileSync(`${process.argv[3]}/execution.json`, JSON.stringify({
+  status: status === 0 ? 'pass' : 'fail', exitCode: status, error: r.error?.code, signal: r.signal,
+}));
+process.exitCode = status;
+NODE
+RESULT=$?
+set -e
+# Killing the attach client does not stop its container. Freeze evidence first.
+if [ "$(docker inspect --format '{{.State.Running}}' "$CONTAINER")" = true ]; then
+  docker kill "$CONTAINER" >/dev/null || [ "$(docker inspect --format '{{.State.Running}}' "$CONTAINER")" = false ]
+fi
+docker cp "$CONTAINER:/evidence/." "$OUTPUT"
+docker inspect --format '{{json .HostConfig}}' "$CONTAINER" > "$OUTPUT/container.json"
+docker image inspect --format '{{json .}}' "$IMAGE" > "$OUTPUT/image.json"
+echo "Protocol evidence: $OUTPUT/report.json"
+exit "$RESULT"
@@ -0,0 +1,11 @@
+FROM node:26.11.1-bookworm-slim@sha256:86f07bc9c5dce4578cf37e5a418b7bfc7f817cda25cde66e2b66e95ed86c4567
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci --ignore-scripts --no-audit --no-fund && npm cache clean --force
+RUN mkdir /evidence && chown 1000:1000 /evidence
+COPY harness.mjs self-check.mjs peer.mjs run.mjs ./
+COPY fixtures ./fixtures
+ENV HOME=/work/home TMPDIR=/work
+USER 1000:1000
+WORKDIR /work
+CMD ["npm", "--prefix", "/app", "test"]
@@ -0,0 +1,105 @@
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { createInterface } from 'node:readline';
+import { createHash } from 'node:crypto';
+
+export function equivalent(direct, guarded) {
+  assert.notEqual(direct, undefined, 'missing direct observation');
+  assert.notEqual(guarded, undefined, 'missing guarded observation');
+  assert.deepEqual(guarded, direct, 'guard changed benign semantics');
+}
+
+export function assertEcho(result, expected) {
+  assert.ok(!result.isError, 'echo returned a tool error');
+  assert.deepEqual(result.content, [{ type: 'text', text: JSON.stringify(expected) }]);
+}
+
+export function assertUnsupported(observation, method, wireCode, clientCode) {
+  assert.equal(observation.value.code, clientCode);
+  const request = observation.wire.find(w => w.direction === 'to-server' && w.message.method === method)?.message;
+  assert.ok(request, `missing ${method} request`);
+  const response = observation.wire.find(w => w.direction === 'from-server' && w.message.id === request.id)?.message;
+  assert.equal(response?.error?.code, wireCode);
+}
+
+export function record(wire, direction, message) {
+  const json = JSON.stringify(message);
+  assert.ok(wire.length < 256, 'wire message budget exceeded');
+  wire.push({ direction, ...(json.length <= 32768 ? { message } : {
+    bytes: Buffer.byteLength(json), sha256: createHash('sha256').update(json).digest('hex'), truncated: true,
+  }) });
+}
+
+export function exchange(command, args, options = {}) {
+  const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, ...options });
+  const wire = [];
+  const pending = new Map();
+  let nextId = 0;
+  let stderr = '';
+  let closed = false;
+  let failure;
+  const rejectAll = error => {
+    failure = error;
+    for (const p of pending.values()) { clearTimeout(p.timer); p.reject(error); }
+    pending.clear();
+  };
+  const done = new Promise(resolve => {
+    child.on('close', () => { closed = true; rejectAll(new Error('peer disconnected')); resolve(); });
+    child.on('error', rejectAll);
+  });
+  child.stdin.on('error', rejectAll);
+  child.stderr.on('data', b => { stderr = (stderr + b).slice(-32768); });
+  const reader = createInterface({ input: child.stdout });
+  let bytes = 0;
+  child.stdout.on('data', chunk => {
+    bytes += chunk.length;
+    if (bytes > 16 * 1024 * 1024) {
+      rejectAll(new Error('wire byte budget exceeded'));
+      reader.close(); child.stdout.destroy();
+    }
+  });
+  reader.on('line', line => {
+    try {
+      assert.ok(line.length <= 11 * 1024 * 1024, 'wire frame budget exceeded');
+      const message = JSON.parse(line);
+      assert.ok(message && typeof message === 'object' && !Array.isArray(message), 'invalid JSON-RPC object');
+      assert.equal(message.jsonrpc, '2.0', 'invalid JSON-RPC version');
+      record(wire, 'from-server', message);
+      if ('method' in message) return;
+      assert.notEqual('result' in message, 'error' in message, 'response needs exactly one result or error');
+      const p = pending.get(message.id);
+      assert.ok(p, `unmatched response ${message.id}`);
+      clearTimeout(p.timer); pending.delete(message.id); p.resolve(message);
+    } catch (error) { rejectAll(error); }
+  });
+  function send(message) {
+    if (failure) throw failure;
+    record(wire, 'to-server', message);
+    child.stdin.write(JSON.stringify(message) + '\n');
+  }
+  return {
+    child, wire, get stderr() { return stderr; },
+    send,
+    request(method, params = {}, timeout = 3000) {
+      const id = ++nextId;
+      return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => { pending.delete(id); reject(new Error(`deadline: ${method}`)); }, timeout);
+        pending.set(id, { resolve, reject, timer });
+        try { send({ jsonrpc: '2.0', id, method, params }); }
+        catch (e) { clearTimeout(timer); pending.delete(id); reject(e); }
+      });
+    },
+    async close() {
+      child.stdin.end();
+      const pause = ms => new Promise(resolve => { const t = setTimeout(resolve, ms); done.then(() => { clearTimeout(t); resolve(); }); });
+      await pause(500);
+      for (const signal of ['SIGTERM', 'SIGKILL']) {
+        // The guard owns a child too; tear down this test's entire process group.
+        try { process.kill(-child.pid, signal); } catch (e) { if (e.code !== 'ESRCH') throw e; }
+        if (!closed) await pause(1000);
+      }
+      reader.close();
+      assert.ok(closed, 'peer did not terminate');
+    },
+  };
+}