Date: 2026-10-29 Source: Lane-3 re-verify of the staged go-sdk bearer-audience candidate (modelcontextprotocol/go-sdk), 23 days after staging.
When a finding's thesis is "SDK X shipped an audience/resource check that sibling SDK Y omits" (a cross-language / cross-sibling PARITY gap whose eligibility hinges on a by-design-vs-bug crux), the standard re-verify of {is the sink still unpatched?} + {is it still undisclosed?} is INSUFFICIENT. You must ALSO re-check whether the target maintainers have SIGNALLED a by-design stance in the interim - via: - example-code changes (e.g. go-sdk PR #1388 merged 2026-10-12 made the EXAMPLE server's own verifier callback check audience => signals "audience validation is the callback's job, not the SDK middleware's"), - docs edits, maintainer comments, or an open PR evolving the adjacent area (PR #1386 resource identifiers).
Such a signal can ERODE the finding's eligibility (strengthen the by-design counter, raise dup/overlap risk) EVEN WHILE the sink stays unpatched and the class stays undisclosed. The sink being unpatched is necessary but not sufficient; the maintainer's revealed position is load-bearing for a parity/by-design finding.