@openwop/openwop-conformance 1.1.1 → 1.2.0

package/src/scenarios/kv-cross-tenant-isolation.test.ts

@@ -0,0 +1,85 @@
+/**
+ * kv-cross-tenant-isolation — RFC 0015 §B + SECURITY/invariants.yaml
+ * `kv-cross-tenant-isolation`.
+ *
+ * Status: ACTIVE (advertisement + behavioral). The behavioral half drives
+ * cross-tenant proof through the optional reference-host test seam at
+ * `POST /v1/host/sample/test/surface` (env-gated on `OPENWOP_TEST_SEAM_ENABLED=true`).
+ * Hosts that don't expose the seam (HTTP 404) soft-skip the behavioral
+ * assertions and verify advertisement shape only.
+ *
+ * Summary: host.kvStorage MUST partition values by tenant. A `set` issued
+ * under tenant A MUST NOT be visible to a `get` under tenant B at the
+ * same key.
+ *
+ * @see RFCS/0015-host-kv-storage-capability.md
+ * @see SECURITY/invariants.yaml — kv-cross-tenant-isolation
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+interface DiscoveryDoc {
+  capabilities?: Record<string, unknown>;
+}
+
+async function readCap(): Promise<Record<string, unknown> | null> {
+  const res = await driver.get('/.well-known/openwop');
+  const body = res.json as DiscoveryDoc | undefined;
+  const top = body?.capabilities as Record<string, unknown> | undefined;
+  const final = (top && typeof top === 'object') ? (top as Record<string, unknown>)["kvStorage"] : undefined;
+  return (final && typeof final === 'object' ? (final as Record<string, unknown>) : null);
+}
+
+async function call(tenantId: string, op: string, args: Record<string, unknown>) {
+  return driver.post('/v1/host/sample/test/surface', { tenantId, surface: 'kv', op, args });
+}
+
+describe('kv-cross-tenant-isolation: advertisement shape (RFC 0015)', () => {
+  it('capabilities.kvStorage is either absent or a well-formed object', async () => {
+    const cap = await readCap();
+    if (cap === null) return;
+    expect(
+      typeof cap.supported,
+      driver.describe(
+        'capabilities.schema.json §kvStorage',
+        'capabilities.kvStorage.supported MUST be a boolean when present',
+      ),
+    ).toBe('boolean');
+  });
+});
+
+describe('kv-cross-tenant-isolation: behavioral (RFC 0015 §B)', () => {
+  it('set under tenant A → get under tenant B with same key returns found:false', async () => {
+    const cap = await readCap();
+    if (!cap || cap.supported !== true) return;
+    const key = `xtenant-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    const setRes = await call('tenant-a', 'set', { key, value: 'from-A' });
+    if (setRes.status === 404) return; // host doesn't expose test seam
+    expect(setRes.status, driver.describe('RFC 0015 §B', 'set MUST succeed')).toBe(200);
+
+    const getRes = await call('tenant-b', 'get', { key });
+    expect(getRes.status).toBe(200);
+    const body = getRes.json as { value?: unknown; found?: boolean };
+    expect(
+      body.found,
+      driver.describe(
+        'SECURITY/invariants.yaml kv-cross-tenant-isolation',
+        'tenant B MUST NOT see tenant A value at the same key',
+      ),
+    ).toBe(false);
+  });
+
+  it('same-tenant set→get round-trips the value', async () => {
+    const cap = await readCap();
+    if (!cap || cap.supported !== true) return;
+    const key = `roundtrip-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    const setRes = await call('tenant-a', 'set', { key, value: 'rt-A' });
+    if (setRes.status === 404) return;
+    expect(setRes.status).toBe(200);
+    const getRes = await call('tenant-a', 'get', { key });
+    const body = getRes.json as { value?: unknown; found?: boolean };
+    expect(body.found, 'same-tenant get MUST succeed').toBe(true);
+    expect(body.value, 'same-tenant get MUST return the stored value').toBe('rt-A');
+  });
+});

package/src/scenarios/kv-ttl-expiry.test.ts

@@ -0,0 +1,47 @@
+/**
+ * kv-ttl-expiry — RFC 0015 advertisement-shape verification + behavioral placeholders.
+ *
+ * Status: ACTIVE (advertisement-shape). RFC 0015 promoted to `Active`
+ * 2026-05-17. The matching `capabilities.kvStorage` block has landed in
+ * `schemas/capabilities.schema.json`. This scenario asserts the advertisement
+ * shape against any host that boots the conformance suite, and keeps the
+ * deeper behavioral assertions as `it.todo()` until a reference host wires
+ * a test seam.
+ *
+ * Summary: TTL honored with at most a 1-second drift on expiry visibility.
+ *
+ * @see RFCS/0015-*.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+interface DiscoveryDoc {
+  capabilities?: Record<string, unknown>;
+}
+
+async function readCap(): Promise<Record<string, unknown> | null> {
+  const res = await driver.get('/.well-known/openwop');
+  const body = res.json as DiscoveryDoc | undefined;
+  const top = body?.capabilities as Record<string, unknown> | undefined;
+  const final = (top && typeof top === 'object') ? (top as Record<string, unknown>)["kvStorage"] : undefined;
+  return (final && typeof final === 'object' ? (final as Record<string, unknown>) : null);
+}
+
+describe('kv-ttl-expiry: advertisement shape (RFC 0015)', () => {
+  it('capabilities.kvStorage is either absent or a well-formed object', async () => {
+    const cap = await readCap();
+    if (cap === null) return; // host doesn't advertise — skip
+    expect(
+      typeof cap.supported,
+      driver.describe(
+        'capabilities.schema.json §kvStorage',
+        'capabilities.kvStorage.supported MUST be a boolean when present',
+      ),
+    ).toBe('boolean');
+  });
+});
+
+describe('kv-ttl-expiry: behavioral assertions (placeholders — need host test seam)', () => {
+  it.todo("set with ttl=2 → get at t+1 returns the value; get at t+3 returns not-found");
+});

package/src/scenarios/mcp-server-elicitation-bridge.test.ts

@@ -0,0 +1,92 @@
+/**
+ * mcp-server-elicitation-bridge — RFC 0020 §A point 3 (bidirectional elicitation).
+ *
+ * Status: ACTIVE (advertisement + behavioral). Asserts that when a workflow
+ * has a `core.openwop.mcp.handle-elicitation` node, inbound `elicitation/create`
+ * is bridged into the workflow's `ctx.suspend({kind: 'clarification', profile:
+ * 'openwop-mcp-elicitation'})`. The host returns either a `pending` action
+ * (run suspended awaiting input) OR an accept/decline/cancel response (run
+ * completed without suspending).
+ *
+ * @see RFCS/0020-host-mcp-server-composition.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+interface DiscoveryDoc {
+  capabilities?: Record<string, unknown>;
+}
+
+async function readCap(): Promise<Record<string, unknown> | null> {
+  const res = await driver.get('/.well-known/openwop');
+  const body = res.json as DiscoveryDoc | undefined;
+  const top = body?.capabilities as Record<string, unknown> | undefined;
+  const cur = (top && typeof top === 'object') ? (top as Record<string, unknown>)["mcp"] : undefined;
+  const final = (cur && typeof cur === 'object') ? (cur as Record<string, unknown>)["serverMount"] : undefined;
+  return (final && typeof final === 'object' ? (final as Record<string, unknown>) : null);
+}
+
+async function rpc(method: string, params?: Record<string, unknown>) {
+  const id = Math.floor(Math.random() * 1e6);
+  const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
+  if (params !== undefined) req.params = params;
+  const res = await driver.post('/v1/host/sample/mcp', req);
+  return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string } } };
+}
+
+async function registerElicitationHandlerWorkflow(): Promise<boolean> {
+  const res = await driver.post('/v1/host/sample/workflows', {
+    workflowId: `mcp.elicit.${Date.now()}`,
+    nodes: [
+      { nodeId: 'elicit', typeId: 'core.openwop.mcp.handle-elicitation' },
+    ],
+  });
+  return res.status === 200 || res.status === 201;
+}
+
+describe('mcp-server-elicitation-bridge: advertisement shape (RFC 0020)', () => {
+  it('elicitationBridge is a boolean when serverMount.supported', async () => {
+    const cap = await readCap();
+    if (!cap || cap.supported !== true) return;
+    if (cap.elicitationBridge === undefined) return;
+    expect(
+      typeof cap.elicitationBridge,
+      driver.describe('RFC 0020 §B', 'mcp.serverMount.elicitationBridge MUST be boolean when present'),
+    ).toBe('boolean');
+  });
+});
+
+describe('mcp-server-elicitation-bridge: behavioral (RFC 0020 §A point 3)', () => {
+  it('elicitation/create bridges into a handle-elicitation workflow', async () => {
+    const cap = await readCap();
+    if (!cap || cap.supported !== true || cap.elicitationBridge !== true) return;
+    if (!(await registerElicitationHandlerWorkflow())) return;
+
+    const r = await rpc('elicitation/create', {
+      message: 'What is your name?',
+      requestedSchema: {
+        type: 'object',
+        properties: { name: { type: 'string' } },
+        required: ['name'],
+      },
+    });
+    if (r.status === 404) return;
+    expect(r.status, 'JSON-RPC envelope MUST 200').toBe(200);
+    const dispatched = !!r.body.result || (!!r.body.error && r.body.error.code !== -32601);
+    expect(
+      dispatched,
+      driver.describe(
+        'RFC 0020 §A point 3',
+        'elicitation/create MUST dispatch to handle-elicitation workflow (not return method_not_found)',
+      ),
+    ).toBe(true);
+    if (r.body.result) {
+      const result = r.body.result as { action?: string };
+      expect(
+        ['pending', 'accept', 'decline', 'cancel'].includes(result.action ?? ''),
+        'elicitation response action MUST be one of {pending,accept,decline,cancel}',
+      ).toBe(true);
+    }
+  });
+});

package/src/scenarios/mcp-server-prompt-roundtrip.test.ts

@@ -0,0 +1,80 @@
+/**
+ * mcp-server-prompt-roundtrip — RFC 0020 §A (prompts/list + prompts/get).
+ *
+ * Status: ACTIVE (advertisement + behavioral).
+ *
+ * @see RFCS/0020-host-mcp-server-composition.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+interface DiscoveryDoc {
+  capabilities?: Record<string, unknown>;
+}
+
+async function readCap(): Promise<Record<string, unknown> | null> {
+  const res = await driver.get('/.well-known/openwop');
+  const body = res.json as DiscoveryDoc | undefined;
+  const top = body?.capabilities as Record<string, unknown> | undefined;
+  const cur = (top && typeof top === 'object') ? (top as Record<string, unknown>)["mcp"] : undefined;
+  const final = (cur && typeof cur === 'object') ? (cur as Record<string, unknown>)["serverMount"] : undefined;
+  return (final && typeof final === 'object' ? (final as Record<string, unknown>) : null);
+}
+
+async function rpc(method: string, params?: Record<string, unknown>) {
+  const id = Math.floor(Math.random() * 1e6);
+  const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
+  if (params !== undefined) req.params = params;
+  const res = await driver.post('/v1/host/sample/mcp', req);
+  return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string } } };
+}
+
+const PROMPT_NAME = `prompt_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
+
+async function registerPromptWorkflow(): Promise<boolean> {
+  const res = await driver.post('/v1/host/sample/workflows', {
+    workflowId: `mcp.prompt.${Date.now()}`,
+    nodes: [
+      {
+        nodeId: 'expose',
+        typeId: 'core.openwop.mcp.expose-prompt',
+        config: {
+          name: PROMPT_NAME,
+          description: 'Conformance prompt',
+          arguments: [{ name: 'topic', description: 'subject of the prompt', required: false }],
+        },
+      },
+    ],
+  });
+  return res.status === 200 || res.status === 201;
+}
+
+describe('mcp-server-prompt-roundtrip: advertisement shape (RFC 0020)', () => {
+  it('capabilities.mcp.serverMount is either absent or a well-formed object', async () => {
+    const cap = await readCap();
+    if (cap === null) return;
+    expect(typeof cap.supported).toBe('boolean');
+  });
+});
+
+describe('mcp-server-prompt-roundtrip: behavioral (RFC 0020)', () => {
+  it('prompts/list returns the exposed prompt and prompts/get returns messages', async () => {
+    const cap = await readCap();
+    if (!cap || cap.supported !== true) return;
+    if (!(await registerPromptWorkflow())) return;
+
+    const list = await rpc('prompts/list');
+    if (list.status === 404) return;
+    const prompts = (list.body.result as { prompts?: Array<{ name: string }> } | undefined)?.prompts ?? [];
+    expect(
+      prompts.find((p) => p.name === PROMPT_NAME),
+      driver.describe('RFC 0020 §A', 'prompts/list MUST include exposed prompts'),
+    ).toBeDefined();
+
+    const get = await rpc('prompts/get', { name: PROMPT_NAME, arguments: { topic: 'openwop' } });
+    expect(get.status).toBe(200);
+    const messages = (get.body.result as { messages?: Array<{ role: string }> } | undefined)?.messages;
+    expect(Array.isArray(messages), 'prompts/get MUST return messages[]').toBe(true);
+  });
+});

package/src/scenarios/mcp-server-resource-roundtrip.test.ts

@@ -0,0 +1,82 @@
+/**
+ * mcp-server-resource-roundtrip — RFC 0020 §A (resources/list + resources/read).
+ *
+ * Status: ACTIVE (advertisement + behavioral). Registers a workflow with
+ * `core.openwop.mcp.expose-resource`, then asserts the resource appears
+ * in `resources/list` and yields bound content from `resources/read`.
+ *
+ * @see RFCS/0020-host-mcp-server-composition.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+interface DiscoveryDoc {
+  capabilities?: Record<string, unknown>;
+}
+
+async function readCap(): Promise<Record<string, unknown> | null> {
+  const res = await driver.get('/.well-known/openwop');
+  const body = res.json as DiscoveryDoc | undefined;
+  const top = body?.capabilities as Record<string, unknown> | undefined;
+  const cur = (top && typeof top === 'object') ? (top as Record<string, unknown>)["mcp"] : undefined;
+  const final = (cur && typeof cur === 'object') ? (cur as Record<string, unknown>)["serverMount"] : undefined;
+  return (final && typeof final === 'object' ? (final as Record<string, unknown>) : null);
+}
+
+async function rpc(method: string, params?: Record<string, unknown>) {
+  const id = Math.floor(Math.random() * 1e6);
+  const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
+  if (params !== undefined) req.params = params;
+  const res = await driver.post('/v1/host/sample/mcp', req);
+  return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string } } };
+}
+
+const RESOURCE_URI = `mcp://test/${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+
+async function registerResourceWorkflow(): Promise<boolean> {
+  const res = await driver.post('/v1/host/sample/workflows', {
+    workflowId: `mcp.resource.${Date.now()}`,
+    nodes: [
+      {
+        nodeId: 'expose',
+        typeId: 'core.openwop.mcp.expose-resource',
+        config: {
+          uri: RESOURCE_URI,
+          name: 'conformance-test-resource',
+          mimeType: 'text/plain',
+        },
+      },
+    ],
+  });
+  return res.status === 200 || res.status === 201;
+}
+
+describe('mcp-server-resource-roundtrip: advertisement shape (RFC 0020)', () => {
+  it('capabilities.mcp.serverMount is either absent or a well-formed object', async () => {
+    const cap = await readCap();
+    if (cap === null) return;
+    expect(typeof cap.supported, 'mcp.serverMount.supported MUST be boolean').toBe('boolean');
+  });
+});
+
+describe('mcp-server-resource-roundtrip: behavioral (RFC 0020)', () => {
+  it('resources/list returns the exposed resource and resources/read returns content', async () => {
+    const cap = await readCap();
+    if (!cap || cap.supported !== true) return;
+    if (!(await registerResourceWorkflow())) return;
+
+    const list = await rpc('resources/list');
+    if (list.status === 404) return;
+    const resources = (list.body.result as { resources?: Array<{ uri: string }> } | undefined)?.resources ?? [];
+    expect(
+      resources.find((r) => r.uri === RESOURCE_URI),
+      driver.describe('RFC 0020 §A', 'resources/list MUST include exposed resources'),
+    ).toBeDefined();
+
+    const read = await rpc('resources/read', { uri: RESOURCE_URI });
+    expect(read.status).toBe(200);
+    const contents = (read.body.result as { contents?: Array<{ uri: string }> } | undefined)?.contents;
+    expect(Array.isArray(contents), 'resources/read MUST return contents[]').toBe(true);
+  });
+});

package/src/scenarios/mcp-server-sampling-bridge.test.ts

@@ -0,0 +1,84 @@
+/**
+ * mcp-server-sampling-bridge — RFC 0020 §A point 3 (bidirectional sampling).
+ *
+ * Status: ACTIVE (advertisement + behavioral). Asserts that when a workflow
+ * has a `core.openwop.mcp.handle-sampling` node, inbound `sampling/createMessage`
+ * is bridged into the workflow's `ctx.callAI` and returns a sampling result.
+ * Gated on `capabilities.mcp.serverMount.samplingBridge: true`.
+ *
+ * Acceptance test: dispatch produces either a sampling response (when AI
+ * keys are provisioned) OR a clean error envelope (proves bridge dispatched
+ * but BYOK is absent). Either outcome proves the bridge wired up correctly;
+ * a method_not_found (-32601) means the bridge did NOT dispatch.
+ *
+ * @see RFCS/0020-host-mcp-server-composition.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+interface DiscoveryDoc {
+  capabilities?: Record<string, unknown>;
+}
+
+async function readCap(): Promise<Record<string, unknown> | null> {
+  const res = await driver.get('/.well-known/openwop');
+  const body = res.json as DiscoveryDoc | undefined;
+  const top = body?.capabilities as Record<string, unknown> | undefined;
+  const cur = (top && typeof top === 'object') ? (top as Record<string, unknown>)["mcp"] : undefined;
+  const final = (cur && typeof cur === 'object') ? (cur as Record<string, unknown>)["serverMount"] : undefined;
+  return (final && typeof final === 'object' ? (final as Record<string, unknown>) : null);
+}
+
+async function rpc(method: string, params?: Record<string, unknown>) {
+  const id = Math.floor(Math.random() * 1e6);
+  const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
+  if (params !== undefined) req.params = params;
+  const res = await driver.post('/v1/host/sample/mcp', req);
+  return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string } } };
+}
+
+async function registerSamplingHandlerWorkflow(): Promise<boolean> {
+  const res = await driver.post('/v1/host/sample/workflows', {
+    workflowId: `mcp.sampling.${Date.now()}`,
+    nodes: [
+      { nodeId: 'sample', typeId: 'core.openwop.mcp.handle-sampling' },
+    ],
+  });
+  return res.status === 200 || res.status === 201;
+}
+
+describe('mcp-server-sampling-bridge: advertisement shape (RFC 0020)', () => {
+  it('samplingBridge is a boolean when serverMount.supported', async () => {
+    const cap = await readCap();
+    if (!cap || cap.supported !== true) return;
+    if (cap.samplingBridge === undefined) return;
+    expect(
+      typeof cap.samplingBridge,
+      driver.describe('RFC 0020 §B', 'mcp.serverMount.samplingBridge MUST be boolean when present'),
+    ).toBe('boolean');
+  });
+});
+
+describe('mcp-server-sampling-bridge: behavioral (RFC 0020 §A point 3)', () => {
+  it('sampling/createMessage bridges into a handle-sampling workflow', async () => {
+    const cap = await readCap();
+    if (!cap || cap.supported !== true || cap.samplingBridge !== true) return;
+    if (!(await registerSamplingHandlerWorkflow())) return;
+
+    const r = await rpc('sampling/createMessage', {
+      messages: [{ role: 'user', content: { type: 'text', text: 'ping' } }],
+      maxTokens: 16,
+    });
+    if (r.status === 404) return;
+    expect(r.status, 'JSON-RPC envelope MUST 200').toBe(200);
+    const dispatched = !!r.body.result || (!!r.body.error && r.body.error.code !== -32601);
+    expect(
+      dispatched,
+      driver.describe(
+        'RFC 0020 §A point 3',
+        'sampling/createMessage MUST dispatch to handle-sampling workflow (not return method_not_found)',
+      ),
+    ).toBe(true);
+  });
+});

package/src/scenarios/mcp-server-tool-roundtrip.test.ts

@@ -0,0 +1,107 @@
+/**
+ * mcp-server-tool-roundtrip — RFC 0020 §A points 1-2 (workflow → MCP tool).
+ *
+ * Status: ACTIVE (advertisement + behavioral). The behavioral half registers
+ * a workflow with `core.openwop.mcp.expose-tool` via the host's workflow
+ * registration endpoint, then issues JSON-RPC `tools/list` + `tools/call`
+ * against the reference-host MCP server mount at `/v1/host/sample/mcp`
+ * (env-gated on `OPENWOP_MCP_SERVER_ENABLED=true`). Hosts that don't expose
+ * the seam (HTTP 404) soft-skip the behavioral assertions and verify
+ * advertisement shape only.
+ *
+ * @see RFCS/0020-host-mcp-server-composition.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+interface DiscoveryDoc {
+  capabilities?: Record<string, unknown>;
+}
+
+async function readCap(): Promise<Record<string, unknown> | null> {
+  const res = await driver.get('/.well-known/openwop');
+  const body = res.json as DiscoveryDoc | undefined;
+  const top = body?.capabilities as Record<string, unknown> | undefined;
+  const cur = (top && typeof top === 'object') ? (top as Record<string, unknown>)["mcp"] : undefined;
+  const final = (cur && typeof cur === 'object') ? (cur as Record<string, unknown>)["serverMount"] : undefined;
+  return (final && typeof final === 'object' ? (final as Record<string, unknown>) : null);
+}
+
+async function rpc(method: string, params?: Record<string, unknown>): Promise<{ status: number; body: { result?: unknown; error?: { code: number; message: string } } }> {
+  const id = Math.floor(Math.random() * 1e6);
+  const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
+  if (params !== undefined) req.params = params;
+  const res = await driver.post('/v1/host/sample/mcp', req);
+  return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string } } };
+}
+
+const TEST_TOOL_NAME = `tool_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+
+async function registerToolWorkflow(): Promise<boolean> {
+  const res = await driver.post('/v1/host/sample/workflows', {
+    workflowId: `mcp.scenario.${TEST_TOOL_NAME}`,
+    nodes: [
+      {
+        nodeId: 'expose',
+        typeId: 'core.openwop.mcp.expose-tool',
+        config: {
+          name: TEST_TOOL_NAME,
+          description: 'Conformance-test tool',
+          inputSchema: {
+            type: 'object',
+            properties: { text: { type: 'string' } },
+            required: ['text'],
+            additionalProperties: false,
+          },
+        },
+      },
+    ],
+  });
+  return res.status === 200 || res.status === 201;
+}
+
+describe('mcp-server-tool-roundtrip: advertisement shape (RFC 0020)', () => {
+  it('capabilities.mcp.serverMount is either absent or a well-formed object', async () => {
+    const cap = await readCap();
+    if (cap === null) return;
+    expect(
+      typeof cap.supported,
+      driver.describe(
+        'capabilities.schema.json §mcp.serverMount',
+        'capabilities.mcp.serverMount.supported MUST be a boolean when present',
+      ),
+    ).toBe('boolean');
+  });
+});
+
+describe('mcp-server-tool-roundtrip: behavioral (RFC 0020 §A points 1-2)', () => {
+  it('tools/list returns the exposed workflow + tools/call returns a CallToolResult', async () => {
+    const cap = await readCap();
+    if (!cap || cap.supported !== true) return;
+    const registered = await registerToolWorkflow();
+    if (!registered) return; // host doesn't expose workflow registration
+
+    const list = await rpc('tools/list');
+    if (list.status === 404) return; // host doesn't expose the seam
+    expect(list.status, 'tools/list MUST 200').toBe(200);
+    const tools = (list.body.result as { tools?: Array<{ name: string }> } | undefined)?.tools ?? [];
+    const found = tools.find((t) => t.name === TEST_TOOL_NAME);
+    expect(
+      found,
+      driver.describe(
+        'RFC 0020 §A point 2',
+        'tools/list MUST include workflows exposed via core.openwop.mcp.expose-tool',
+      ),
+    ).toBeDefined();
+
+    const call = await rpc('tools/call', { name: TEST_TOOL_NAME, arguments: { text: 'hello' } });
+    expect(call.status, 'tools/call MUST 200').toBe(200);
+    const result = call.body.result as { content?: Array<{ type: string }>; isError?: boolean } | undefined;
+    expect(
+      Array.isArray(result?.content),
+      driver.describe('RFC 0020 §C', 'CallToolResult MUST contain content[]'),
+    ).toBe(true);
+    expect(typeof result?.isError, 'CallToolResult.isError MUST be boolean').toBe('boolean');
+  });
+});