cMCP documentation

Design notes, operational guides, and policy for the cMCP library. Start with `architecture.md`; the rest is grouped by topic below.

Architecture & design

• `architecture.md` — layering, threading model, memory-ownership rules.
• `agentic-readiness.md` — the Tier-5 quality plan (real-agent-in-loop readiness).

JSON Schema validator

• `schema-conformance.md` — the supported validator surface, benchmarked against Ajv.
• `schema-audit.md` — keyword-by-keyword gap analysis vs the TS SDK's Ajv reference.

Security & deployment

• `threat-model.md` — attack surface, trust boundaries, hardening knobs.
• `deployment-tls.md` — running the HTTP transport behind TLS.
• `case-study-symlink-escape.md` — how agent-in-the-loop testing found a sandbox-escape P0 in filesystem-mcp, and the regression net that pins the fix.

Performance

• `perf-baselines.md` — captured throughput/latency baselines.
• `perf-regression-gate.md` — how bench/ gates regressions (Tier 7.1).

Engineering report

• cmcp-engineering-report.pdf — the headline report: spec conformance (cross-impl vs the TS reference SDK), performance vs the official SDKs, test posture + quality gates, hardening, and operating envelope. A point-in-time snapshot; the live numbers and policy are in the topic-specific docs below.

Quality gates (nightly / CI)

• `fuzz-nightly.md` — nightly libFuzzer baselines + weekly corpus fold (Tier 7.2).
• `soak-nightly.md` — long-running stability soak (Tier 7.3).
• `coverage-policy.md` — coverage targets and the delta gate (Tier 7.4).

Release & versioning

• `SEMVER.md` — versioning policy.
• `spec-version-upgrade.md` — checklist for bumping CMCP_PROTOCOL_VERSION.
• `v0.6.0-acceptance.md` — acceptance criteria for the v0.6.0 release.

Dogfooding

• `dogfood-cragmcp.md` — findings from driving crag-mcp through a real agent loop.