@openwop/openwop-conformance 1.106.0 → 1.123.0

package/src/scenarios/mcp-2026-07-28-discover.test.ts

@@ -0,0 +1,207 @@
+/**
+ * RFC 0153 §B — `server/discover`, stateless `_meta`, header/body agreement,
+ * and the version error — pinned on the suite's own MCP server (server-free),
+ * plus the host half against a host that claims `mcp-2026-07-28`.
+ *
+ * Peer half (always-on): `McpFakeServer` became dual-era at suite 1.113.0.
+ * A server that is 2026-07-28-shaped only in its comments would let every §B/§C
+ * host leg pass against a 2025-06-18 wire and prove nothing, so this file
+ * drives it from the wire: `server/discover` (`resultType`, `supportedVersions`,
+ * cache hints, `_meta.serverInfo`), `_meta.protocolVersion` REQUIRED, header ≠
+ * body ⇒ `-32020`, unsupported ⇒ `-32022` + `data.supported[]`, header-less ⇒
+ * legacy semantics on a dual-era server / `-32022` on a current-only server,
+ * `initialize` under the current revision ⇒ method-not-found (loud).
+ *
+ * Host half (gated on `mcp.profiles ∋ mcp-2026-07-28`, hard-fails under
+ * `OPENWOP_REQUIRE_BEHAVIOR=true`): the host's own MCP mount answers
+ * `server/discover` with `supportedVersions[]` EQUAL to
+ * `capabilities.mcp.protocolVersions` (two documents, one fact — `mcp-integration.md`
+ * §B), `resultType: "complete"`, `ttlMs`/`cacheScope`; a header/body mismatch is
+ * refused `400` + `-32020`; an unsupported revision is refused `400` + `-32022`.
+ * A 2025-06-18 host soft-skips (`blocked`).
+ *
+ * @see spec/v1/mcp-integration.md §"MCP 2026-07-28 versioned composition" §B
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { McpFakeServer, MCP_ERR } from '../lib/mcp-fake-server.js';
+
+// The first describe drives the in-process McpFakeServer itself; the second (gated) describe
+// talks to the host's own MCP server mount and hands it nothing harness-hosted.
+export const HOST_CALLBACK_NOT_REQUIRED = 'the suite drives both ends itself: the fake-server legs read the in-process McpFakeServer directly and the host-as-server legs POST to the host mount; no harness endpoint is handed to the host';
+
+const META_V = 'io.modelcontextprotocol/protocolVersion';
+const META_C = 'io.modelcontextprotocol/clientCapabilities';
+const META_S = 'io.modelcontextprotocol/serverInfo';
+
+async function call(endpoint: string, method: string, params: Record<string, unknown>, opts: { version?: string; mcpMethod?: string; mcpName?: string; withMeta?: boolean } = {}) {
+  const headers: Record<string, string> = { 'content-type': 'application/json' };
+  if (opts.version !== undefined) headers['MCP-Protocol-Version'] = opts.version;
+  if (opts.mcpMethod !== undefined) headers['Mcp-Method'] = opts.mcpMethod;
+  if (opts.mcpName !== undefined) headers['Mcp-Name'] = opts.mcpName;
+  const withMeta = opts.withMeta ?? true;
+  const p = withMeta && opts.version ? { ...params, _meta: { [META_V]: opts.version, [META_C]: {}, ...((params['_meta'] as Record<string, unknown> | undefined) ?? {}) } } : params;
+  const res = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params: p }) });
+  const body = (await res.json()) as { result?: Record<string, unknown>; error?: { code: number; message: string; data?: Record<string, unknown> } };
+  return { status: res.status, ...body };
+}
+
+describe('RFC 0153 §B — the suite MCP server speaks 2026-07-28 (dual-era McpFakeServer)', () => {
+  const server = new McpFakeServer();
+  beforeAll(async () => server.start(0));
+  afterAll(async () => server.stop());
+
+  it('server/discover: resultType complete, supportedVersions, capabilities, cache hints, _meta.serverInfo', async () => {
+    const r = await call(server.endpoint(), 'server/discover', {}, { version: '2026-07-28', mcpMethod: 'server/discover' });
+    expect(r.error).toBeUndefined();
+    expect(r.result?.['resultType']).toBe('complete');
+    expect(r.result?.['supportedVersions']).toEqual(['2026-07-28', '2025-06-18']);
+    expect(typeof r.result?.['ttlMs']).toBe('number');
+    expect(['public', 'private']).toContain(r.result?.['cacheScope']);
+    expect((r.result?.['_meta'] as Record<string, unknown>)[META_S]).toBeDefined();
+  });
+
+  it('a request without _meta.protocolVersion under the current revision is refused -32020', async () => {
+    const r = await call(server.endpoint(), 'tools/list', {}, { version: '2026-07-28', withMeta: false });
+    expect(r.status).toBe(400);
+    expect(r.error?.code).toBe(MCP_ERR.HEADER_MISMATCH);
+  });
+
+  it('header ≠ body revision ⇒ -32020 HeaderMismatch (400); Mcp-Method ≠ method ⇒ -32020', async () => {
+    const r1 = await call(server.endpoint(), 'tools/list', { _meta: { [META_V]: '2025-11-25', [META_C]: {} } }, { version: '2026-07-28', withMeta: false });
+    expect(r1.status).toBe(400);
+    expect(r1.error?.code).toBe(MCP_ERR.HEADER_MISMATCH);
+    const r2 = await call(server.endpoint(), 'tools/list', {}, { version: '2026-07-28', mcpMethod: 'tools/call' });
+    expect(r2.error?.code).toBe(MCP_ERR.HEADER_MISMATCH);
+  });
+
+  it('an unsupported revision ⇒ -32022 UnsupportedProtocolVersion with data.supported[] (400)', async () => {
+    const r = await call(server.endpoint(), 'tools/list', {}, { version: '1999-01-01' });
+    expect(r.status).toBe(400);
+    expect(r.error?.code).toBe(MCP_ERR.UNSUPPORTED_PROTOCOL_VERSION);
+    expect(r.error?.data?.['supported']).toEqual(['2026-07-28', '2025-06-18']);
+    expect(r.error?.data?.['requested']).toBe('1999-01-01');
+  });
+
+  it('header-less ⇒ legacy semantics on a dual-era server (initialize works); ⇒ -32022 on a current-only server', async () => {
+    const legacy = await call(server.endpoint(), 'initialize', { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'x', version: '0' } });
+    expect(legacy.error).toBeUndefined();
+    expect(typeof legacy.result?.['protocolVersion']).toBe('string');
+    const only = new McpFakeServer({ protocolVersions: ['2026-07-28'] });
+    await only.start(0);
+    try {
+      const r = await call(only.endpoint(), 'tools/list', {});
+      expect(r.status).toBe(400);
+      expect(r.error?.code).toBe(MCP_ERR.UNSUPPORTED_PROTOCOL_VERSION);
+    } finally {
+      await only.stop();
+    }
+  });
+
+  it('initialize under 2026-07-28 is method-not-found — the handshake does not exist in this revision', async () => {
+    const r = await call(server.endpoint(), 'initialize', {}, { version: '2026-07-28' });
+    expect(r.status).toBe(404);
+    expect(r.error?.code).toBe(-32601);
+  });
+
+  it('tools/list @2026-07-28 carries resultType + CacheableResult hints and lists the MRTR tool', async () => {
+    const r = await call(server.endpoint(), 'tools/list', {}, { version: '2026-07-28', mcpMethod: 'tools/list' });
+    expect(r.result?.['resultType']).toBe('complete');
+    expect(typeof r.result?.['ttlMs']).toBe('number');
+    expect(r.result?.['cacheScope']).toBe('public');
+    const names = (r.result?.['tools'] as Array<{ name: string }>).map((t) => t.name);
+    expect(names).toEqual(['echo', 'needs_input']);
+    // legacy list does NOT carry the current-revision fields
+    const legacy = await call(server.endpoint(), 'tools/list', {});
+    expect(legacy.result?.['ttlMs']).toBeUndefined();
+  });
+
+  it('MRTR: needs_input answers input_required (elicitation + opaque requestState) and completes on the retry; missing capability ⇒ -32021', async () => {
+    server.reset();
+    const noCap = await call(server.endpoint(), 'tools/call', { name: 'needs_input', arguments: {} }, { version: '2026-07-28', mcpMethod: 'tools/call', mcpName: 'needs_input' });
+    expect(noCap.error?.code).toBe(MCP_ERR.MISSING_REQUIRED_CLIENT_CAPABILITY);
+    expect(noCap.error?.data?.['requiredCapabilities']).toEqual(['elicitation']);
+
+    const first = await call(server.endpoint(), 'tools/call', { name: 'needs_input', arguments: {}, _meta: { [META_C]: { elicitation: {} } } }, { version: '2026-07-28', mcpMethod: 'tools/call', mcpName: 'needs_input' });
+    expect(first.error).toBeUndefined();
+    expect(first.result?.['resultType']).toBe('input_required');
+    const reqs = first.result?.['inputRequests'] as Record<string, { method: string; params: { mode: string } }>;
+    expect(reqs['who']?.method).toBe('elicitation/create');
+    expect(reqs['who']?.params.mode).toBe('form');
+    const state = first.result?.['requestState'];
+    expect(typeof state).toBe('string');
+
+    // Retry: NEW id, inputResponses + requestState echoed exactly.
+    const retry = await call(server.endpoint(), 'tools/call', {
+      name: 'needs_input', arguments: {}, requestState: state,
+      inputResponses: { who: { action: 'accept', content: { name: 'Ada' } } },
+      _meta: { [META_C]: { elicitation: {} } },
+    }, { version: '2026-07-28', mcpMethod: 'tools/call', mcpName: 'needs_input' });
+    expect(retry.error).toBeUndefined();
+    expect(retry.result?.['resultType']).toBe('complete');
+    expect(((retry.result?.['content'] as Array<{ text: string }>)[0]).text).toBe('hello Ada');
+
+    // Tampered / missing state ⇒ refused
+    const bad = await call(server.endpoint(), 'tools/call', {
+      name: 'needs_input', arguments: {}, requestState: 'forged',
+      inputResponses: { who: { action: 'accept', content: { name: 'Eve' } } },
+      _meta: { [META_C]: { elicitation: {} } },
+    }, { version: '2026-07-28', mcpMethod: 'tools/call', mcpName: 'needs_input' });
+    expect(bad.error?.code).toBe(-32602);
+    // Both calls were independent requests recorded under the current revision.
+    expect(server.invocations().filter((i) => i.revision === '2026-07-28').length).toBeGreaterThanOrEqual(3);
+  });
+});
+
+// ─── Host half ───────────────────────────────────────────────────────────────
+
+const PROFILE = 'mcp-2026-07-28';
+interface McpCaps { readonly supported?: boolean; readonly protocolVersions?: readonly string[]; readonly profiles?: readonly string[]; readonly serverMount?: { supported?: boolean } }
+async function mcp(): Promise<McpCaps | undefined> {
+  const disco = await driver.get('/.well-known/openwop');
+  return capabilityFamily<McpCaps>(disco.json, 'mcp');
+}
+async function claimsCurrent(): Promise<boolean> {
+  const caps = await mcp();
+  return caps?.supported === true && (caps.profiles ?? []).includes(PROFILE) && caps.serverMount?.supported === true;
+}
+async function hostRpc(method: string, params: Record<string, unknown>, headers: Record<string, string>) {
+  // The reference host mounts its MCP server at /v1/host/sample/mcp (mcp-server-* scenarios).
+  const res = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 1, method, params }, { headers });
+  return { status: res.status, body: res.json as { result?: Record<string, unknown>; error?: { code: number; data?: Record<string, unknown> } } };
+}
+
+describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §B — host as MCP server: server/discover and version refusal (gated on mcp.profiles ∋ mcp-2026-07-28)', () => {
+  it('server/discover reports supportedVersions equal to capabilities.mcp.protocolVersions, with resultType + cache hints', async () => {
+    if (!behaviorGate(PROFILE, await claimsCurrent())) return;
+    const caps = (await mcp())!;
+    const r = await hostRpc('server/discover', { _meta: { [META_V]: '2026-07-28', [META_C]: {} } }, { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'server/discover' });
+    if (r.status === 404 || r.status === 403) return; // mount not wired at the sample path — the mcp-server-* legs cover that gap
+    expect(r.status, driver.describe('mcp-integration.md §B', 'server/discover is a server MUST under 2026-07-28')).toBe(200);
+    expect(r.body.result?.['resultType']).toBe('complete');
+    expect([...((r.body.result?.['supportedVersions'] as string[] | undefined) ?? [])].sort(), driver.describe('mcp-integration.md §B', 'server/discover.supportedVersions MUST equal capabilities.mcp.protocolVersions — two documents, one fact')).toEqual([...(caps.protocolVersions ?? [])].sort());
+    expect(typeof r.body.result?.['ttlMs'], driver.describe('mcp-integration.md §D', 'server/discover is cacheable: ttlMs REQUIRED')).toBe('number');
+    expect(['public', 'private']).toContain(r.body.result?.['cacheScope']);
+  });
+
+  it('a header/body revision mismatch is refused 400 + -32020; an unsupported revision 400 + -32022', async () => {
+    if (!behaviorGate(PROFILE, await claimsCurrent())) return;
+    // Header ≠ body with a body revision the host DOES support, so the leg
+    // isolates HeaderMismatchError (-32020) from UnsupportedProtocolVersion
+    // (-32022). The earlier vector (`2025-11-25` in the body) was BOTH
+    // mismatched and unsupported, and a host that checked support first
+    // answered -32022 — the leg was testing an unstated precedence
+    // (mcp-integration.md §B: agreement is checked before selection).
+    const mismatch = await hostRpc('tools/list', { _meta: { [META_V]: '2025-06-18', [META_C]: {} } }, { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/list' });
+    if (mismatch.status === 404 || mismatch.status === 403) return;
+    expect(mismatch.status, driver.describe('mcp-integration.md §B', 'header ≠ body MUST be refused 400 (HeaderMismatchError -32020) — fail closed')).toBe(400);
+    expect(mismatch.body.error?.code).toBe(MCP_ERR.HEADER_MISMATCH);
+    const unsupported = await hostRpc('tools/list', { _meta: { [META_V]: '1999-01-01', [META_C]: {} } }, { 'MCP-Protocol-Version': '1999-01-01', 'Mcp-Method': 'tools/list' });
+    expect(unsupported.status, driver.describe('mcp-integration.md §B', 'an unsupported revision MUST be refused 400 (UnsupportedProtocolVersionError -32022)')).toBe(400);
+    expect(unsupported.body.error?.code).toBe(MCP_ERR.UNSUPPORTED_PROTOCOL_VERSION);
+    expect(Array.isArray(unsupported.body.error?.data?.['supported']), driver.describe('mcp-integration.md §B', 'the refusal MUST list data.supported[]')).toBe(true);
+  });
+});

package/src/scenarios/mcp-cache-tenant-scope.test.ts

@@ -0,0 +1,66 @@
+/**
+ * RFC 0153 §D — cache scope follows the tenant boundary (invariant
+ * `mcp-cache-tenant-scoped`, named by RFC 0153 §E).
+ *
+ * `mcp-integration.md` §D: an OpenWOP host acting as MCP server derives its
+ * lists from a tenant-scoped registry, so `cacheScope` MUST be `"private"`
+ * whenever the result depends on the caller's tenant/workspace/principal/
+ * authorization — on a multi-tenant host, always. `"public"` is permitted only
+ * when the result is byte-identical for every caller.
+ *
+ * Non-vacuity: with a second credential (`OPENWOP_TEST_SECONDARY_API_KEY`) the
+ * leg lists tools under both callers; if the lists DIFFER the host MUST have
+ * said `private` — a `public` list that differs per caller is exactly the
+ * cross-context cache poisoning the invariant forbids. Without a second key the
+ * leg can only check the shape and says so (`blocked` for the cross-caller
+ * half via the ledger note).
+ *
+ * Gate: `mcp.profiles ∋ mcp-2026-07-28` + `serverMount.supported`.
+ *
+ * @see spec/v1/mcp-integration.md §"MCP 2026-07-28 versioned composition" §D
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+
+const PROFILE = 'mcp-2026-07-28';
+const META_V = 'io.modelcontextprotocol/protocolVersion';
+const META_C = 'io.modelcontextprotocol/clientCapabilities';
+
+interface McpCaps { readonly supported?: boolean; readonly profiles?: readonly string[]; readonly serverMount?: { supported?: boolean } }
+async function claimsCurrent(): Promise<boolean> {
+  const disco = await driver.get('/.well-known/openwop');
+  const caps = capabilityFamily<McpCaps>(disco.json, 'mcp');
+  return caps?.supported === true && (caps.profiles ?? []).includes(PROFILE) && caps.serverMount?.supported === true;
+}
+async function listAs(bearer?: string) {
+  const headers: Record<string, string> = { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/list' };
+  if (bearer) headers['authorization'] = `Bearer ${bearer}`;
+  const res = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 1, method: 'tools/list', params: { _meta: { [META_V]: '2026-07-28', [META_C]: {} } } }, { headers });
+  return { status: res.status, body: res.json as { result?: { tools?: unknown[]; cacheScope?: string; ttlMs?: number } } };
+}
+
+describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §D — mcp-cache-tenant-scope (host as server, gated)', () => {
+  it('a per-caller list is cacheScope private; a public list is byte-identical across callers', async () => {
+    if (!behaviorGate(PROFILE, await claimsCurrent())) return;
+    const mine = await listAs();
+    if (mine.status === 404 || mine.status === 403) return;
+    expect(['public', 'private'], driver.describe('mcp-integration.md §D', 'cacheScope MUST be present on tools/list')).toContain(mine.body.result?.cacheScope);
+    const other = process.env.OPENWOP_TEST_SECONDARY_API_KEY;
+    if (!other) {
+      // Shape only; the cross-caller half is unobservable without a second credential.
+      // eslint-disable-next-line no-console
+      console.warn('[mcp-cache-tenant-scope] OPENWOP_TEST_SECONDARY_API_KEY not set — cross-caller half not exercised (blocked)');
+      return;
+    }
+    const theirs = await listAs(other);
+    if (theirs.status !== 200) return;
+    const same = JSON.stringify(mine.body.result?.tools) === JSON.stringify(theirs.body.result?.tools);
+    if (!same) {
+      expect(mine.body.result?.cacheScope, driver.describe('mcp-integration.md §D', 'a list that differs per caller MUST be cacheScope private — a public list that differs is cross-context cache poisoning (mcp-cache-tenant-scoped)')).toBe('private');
+      expect(theirs.body.result?.cacheScope).toBe('private');
+    }
+  });
+});

package/src/scenarios/mcp-current-auth-boundary.test.ts

@@ -0,0 +1,55 @@
+/**
+ * RFC 0153 §E — an anonymous MCP principal MUST NOT be the production default
+ * for an advertised current profile (invariant `mcp-peer-no-authority-escalation`
+ * is the sibling; this leg is the authentication boundary).
+ *
+ * `mcp-integration.md` §E: a host that advertises `mcp-2026-07-28` MUST require
+ * authentication on its MCP endpoint in production, unless it advertises RFC
+ * 0132 `anonymousActor` and routes anonymous MCP callers through that surface's
+ * rules. Black-box: an UNAUTHENTICATED `tools/list` at the current-profile mount
+ * MUST be refused (`401`/`403`), or the host MUST advertise `anonymousActor`.
+ *
+ * Gate: `mcp.profiles ∋ mcp-2026-07-28` + `serverMount.supported`. Non-vacuous:
+ * the leg first proves the authenticated call succeeds at the same path, so a
+ * refusal cannot be a wrong-path 404.
+ *
+ * @see spec/v1/mcp-integration.md §"MCP 2026-07-28 versioned composition" §E
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+
+const PROFILE = 'mcp-2026-07-28';
+const META_V = 'io.modelcontextprotocol/protocolVersion';
+const META_C = 'io.modelcontextprotocol/clientCapabilities';
+
+interface McpCaps { readonly supported?: boolean; readonly profiles?: readonly string[]; readonly serverMount?: { supported?: boolean } }
+async function disco() {
+  const d = await driver.get('/.well-known/openwop');
+  return { mcp: capabilityFamily<McpCaps>(d.json, 'mcp'), anon: capabilityFamily<{ supported?: boolean }>(d.json, 'anonymousActor') };
+}
+const REQ = { jsonrpc: '2.0', id: 1, method: 'tools/list', params: { _meta: { [META_V]: '2026-07-28', [META_C]: {} } } };
+const HDR = { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/list' };
+
+describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §E — mcp-current-auth-boundary (host as server, gated)', () => {
+  it('an unauthenticated current-profile request is refused, unless anonymousActor is advertised', async () => {
+    const { mcp, anon } = await disco();
+    const claims = mcp?.supported === true && (mcp.profiles ?? []).includes(PROFILE) && mcp.serverMount?.supported === true;
+    if (!behaviorGate(PROFILE, claims)) return;
+    const authed = await driver.post('/v1/host/sample/mcp', REQ, { headers: HDR });
+    if (authed.status === 404 || authed.status === 403) return; // mount not at the sample path
+    expect(authed.status, driver.describe('mcp-integration.md §E', 'the authenticated call MUST succeed at the same path, so a refusal below is not a wrong path')).toBe(200);
+    const anonymous = await driver.post('/v1/host/sample/mcp', REQ, { headers: HDR, authenticated: false });
+    if (anon?.supported === true) {
+      // Anonymous is permitted only through the RFC 0132 surface; a 200 here is that surface answering.
+      expect([200, 401, 403]).toContain(anonymous.status);
+      return;
+    }
+    expect(
+      [401, 403],
+      driver.describe('mcp-integration.md §E', 'an anonymous MCP principal MUST NOT be the production default for an advertised current profile — refuse (401/403) or advertise anonymousActor'),
+    ).toContain(anonymous.status);
+  });
+});

package/src/scenarios/mcp-extension-opacity.test.ts

@@ -0,0 +1,79 @@
+/**
+ * RFC 0153 §D — extensions and `_meta` are opaque; they never confer authority
+ * (invariant `mcp-extension-no-authority`, named by RFC 0153 §E).
+ *
+ * CLIENT half (host calls the suite's server): the tool result carries
+ * `_meta['io.example/authority']: { grantScopes, approve: true }` and an
+ * `io.modelcontextprotocol/ui` key. `mcp-integration.md` §D: every extension and
+ * every `_meta` key is opaque unless a named mapping exists (only OTel context
+ * and `logLevel` are named); none may widen scopes, advance approvals, or reach
+ * secrets. Observed via the ADDITIVE seam field: request `scenario:
+ * "extension-asserts-authority"` → response `extensionAuthority: {
+ * scopesWidened, approvalAdvanced }` (`host-sample-test-seams.md` §23); a host
+ * that does not report it is `blocked`.
+ *
+ * SERVER half (host as 2026-07-28 server): a request whose `_meta` carries an
+ * unknown extension key and an unknown `capabilities.extensions` entry MUST be
+ * processed normally (`resultType: complete`) — opacity means ignored, not
+ * refused and not honoured.
+ *
+ * @see spec/v1/mcp-integration.md §"MCP 2026-07-28 versioned composition" §D
+ */
+
+import { describe, it, expect } from 'vitest';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
+
+export const REQUIRES_HOST_CALLBACK = "the host issues MCP JSON-RPC calls to the suite's fake server via /v1/host/sample/mcp/invoke (serverUrl), which the server records";
+
+const META_V = 'io.modelcontextprotocol/protocolVersion';
+const META_C = 'io.modelcontextprotocol/clientCapabilities';
+interface McpCaps { readonly supported?: boolean; readonly protocolVersions?: readonly string[]; readonly profiles?: readonly string[]; readonly serverMount?: { supported?: boolean } }
+async function mcp(): Promise<McpCaps | undefined> {
+  const d = await driver.get('/.well-known/openwop');
+  return capabilityFamily<McpCaps>(d.json, 'mcp');
+}
+
+describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §D — mcp-extension-opacity (gated)', () => {
+  it('client half: an extension _meta asserting authority in a tool result changes nothing the host authorizes', async () => {
+    const caps = await mcp();
+    if (!behaviorGate('mcp.extensionOpacity', caps?.supported === true && (caps.protocolVersions ?? []).includes('2026-07-28'))) return;
+    const server = getMcpFakeServer();
+    if (server === null) return softSkip('blocked', 'the suite MCP fake server is not started in this run — the host-as-client leg cannot be driven');
+    server.reset();
+    server.setNextResultAssertsAuthority(true);
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint(), tool: 'echo', arguments: { text: 'opaque' }, scenario: 'extension-asserts-authority' });
+    if (drive.status === 404 || drive.status === 403) {
+      // Advertised mcp-2026-07-28 but the invoke seam answered {drive.status}: not observable here.
+      // Default mode records `blocked` (RFC 0148 §A); OPENWOP_REQUIRE_BEHAVIOR=true fails
+      // an advertised-missing seam (RFC 0148 §B). A 403 is NOT a pass.
+      return seamAbsent(`host advertises mcp-2026-07-28 but the invoke seam /v1/host/sample/mcp/invoke answered ${drive.status}`);
+    }
+    expect(server.invocations().some((i) => i.method === 'tools/call'), 'the host MUST have called the tool').toBe(true);
+    const rep = (drive.json as { extensionAuthority?: { scopesWidened?: boolean; approvalAdvanced?: boolean } }).extensionAuthority;
+    if (rep === undefined) {
+      expect(rep, driver.describe('host-sample-test-seams.md §23', 'the seam SHOULD report `extensionAuthority: { scopesWidened, approvalAdvanced }` for scenario "extension-asserts-authority"; until it does the requirement is `blocked`, not passed')).toBeDefined();
+      return;
+    }
+    expect(rep.scopesWidened, driver.describe('mcp-integration.md §D', 'an extension MUST NOT gain tool authority or scope by appearing in _meta (mcp-extension-no-authority)')).toBe(false);
+    expect(rep.approvalAdvanced, driver.describe('mcp-integration.md §D/§E', 'MCP content MUST NOT advance approval gates')).toBe(false);
+  });
+
+  it('server half: unknown _meta extension keys on a request are ignored, not refused and not honoured', async () => {
+    const caps = await mcp();
+    const claims = caps?.supported === true && (caps.profiles ?? []).includes('mcp-2026-07-28') && caps.serverMount?.supported === true;
+    if (!behaviorGate('mcp-2026-07-28', claims)) return;
+    const res = await driver.post('/v1/host/sample/mcp', {
+      jsonrpc: '2.0', id: 1, method: 'tools/list',
+      params: { _meta: { [META_V]: '2026-07-28', [META_C]: { extensions: { 'io.example/authority': { admin: true } } }, 'io.example/authority': { grantScopes: ['*'] } } },
+    }, { headers: { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/list' } });
+    if (res.status === 404 || res.status === 403) return seamAbsent(`host advertises mcp-2026-07-28 but the MCP server mount /v1/host/sample/mcp answered ${res.status}`);
+    const body = res.json as { result?: { resultType?: string }; error?: { code: number } };
+    expect(res.status, driver.describe('mcp-integration.md §D', 'an unknown extension is opaque: the request MUST be processed normally, neither refused nor granted anything')).toBe(200);
+    expect(body.error).toBeUndefined();
+    expect(body.result?.resultType).toBe('complete');
+  });
+});

package/src/scenarios/mcp-mrtr-roundtrip.test.ts

@@ -0,0 +1,140 @@
+/**
+ * RFC 0153 §C — Multi Round-Trip Requests, both directions.
+ *
+ * CLIENT half (host calls the suite's MCP server): `mcp-integration.md` §C.1 —
+ * when a tool answers `input_required`, the host MUST NOT hold a live callback;
+ * it MUST treat the initial request and the retry as ONE logical invocation,
+ * gather the elicitation input (a `clarification` interrupt in a real run; the
+ * seam MAY answer it programmatically), retry with a NEW JSON-RPC id carrying
+ * `inputResponses[key]` and the `requestState` echoed EXACTLY, and MUST NOT
+ * cache the interim result. Observed through the ADDITIVE seam contract
+ * (`host-sample-test-seams.md` §23): `POST /v1/host/sample/mcp/invoke
+ * { serverUrl, tool: "needs_input", clientCapabilities: { elicitation: {} },
+ * elicitationAnswer: { name: "Ada" } }` → `200 { negotiatedVersion, mrtr: {
+ * inputRequiredSeen, retried, requestStateEchoed, result } }`. The suite's server
+ * records both calls, so `requestStateEchoed` is cross-checked from the wire, not
+ * taken from the host's report. A host without the `mrtr` block is `blocked`.
+ *
+ * SERVER half (host as 2026-07-28 MCP server): §C.2 — a `tools/call` on an
+ * exposed workflow that reaches `waiting-input` MUST answer `input_required`
+ * with an `elicitation/create` in `inputRequests` and a `requestState`, and the
+ * retry with `inputResponses` MUST resolve it (`resultType: complete`). Uses the
+ * same `core.openwop.mcp.expose-tool` + `handle-elicitation` fixture shape the
+ * legacy bridge leg uses. A tampered `requestState` MUST be refused.
+ *
+ * Gate: `mcp.supported && mcp.protocolVersions ∋ 2026-07-28` for the client
+ * half (the seam is version-independent); `mcp.profiles ∋ mcp-2026-07-28` +
+ * `serverMount.supported` for the server half. Needs the fake server
+ * (`OPENWOP_MCP_FAKE_SERVER=true`) for the client half.
+ *
+ * @see spec/v1/mcp-integration.md §"MCP 2026-07-28 versioned composition" §C
+ */
+
+import { describe, it, expect } from 'vitest';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
+
+export const REQUIRES_HOST_CALLBACK = "the host issues MCP JSON-RPC calls (including the MRTR input_required round trip) to the suite's fake server via /v1/host/sample/mcp/invoke (serverUrl)";
+
+const META_V = 'io.modelcontextprotocol/protocolVersion';
+const META_C = 'io.modelcontextprotocol/clientCapabilities';
+
+interface McpCaps { readonly supported?: boolean; readonly protocolVersions?: readonly string[]; readonly profiles?: readonly string[]; readonly serverMount?: { supported?: boolean; elicitationBridge?: boolean } }
+async function mcp(): Promise<McpCaps | undefined> {
+  const d = await driver.get('/.well-known/openwop');
+  return capabilityFamily<McpCaps>(d.json, 'mcp');
+}
+
+describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §C — mcp-mrtr-roundtrip, client half (host calls a 2026-07-28 server; gated)', () => {
+  it('input_required → gather → retry with inputResponses + echoed requestState, as one logical invocation', async () => {
+    const caps = await mcp();
+    if (!behaviorGate('mcp.mrtr.client', caps?.supported === true && (caps.protocolVersions ?? []).includes('2026-07-28'))) return;
+    const server = getMcpFakeServer();
+    if (server === null) return softSkip('blocked', 'the suite MCP fake server is not started in this run — the client half cannot be driven');
+    server.reset();
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', {
+      serverUrl: server.endpoint(),
+      tool: 'needs_input',
+      clientCapabilities: { elicitation: {} },
+      elicitationAnswer: { name: 'Ada' },
+    });
+    if (drive.status === 404 || drive.status === 403) {
+      // Advertised mcp-2026-07-28 but the invoke seam answered {drive.status}: not observable here.
+      // Default mode records `blocked` (RFC 0148 §A); OPENWOP_REQUIRE_BEHAVIOR=true fails
+      // an advertised-missing seam (RFC 0148 §B). A 403 is NOT a pass.
+      return seamAbsent(`host advertises mcp-2026-07-28 but the invoke seam /v1/host/sample/mcp/invoke answered ${drive.status}`);
+    }
+    const calls = server.invocations().filter((i) => i.method === 'tools/call');
+    expect(calls.length, driver.describe('RFCS/0153 §C', 'the host MUST have called the tool at least once for this leg to mean anything')).toBeGreaterThan(0);
+    const mrtr = (drive.json as { mrtr?: { inputRequiredSeen?: boolean; retried?: boolean; requestStateEchoed?: boolean; result?: unknown } }).mrtr;
+    if (mrtr === undefined) {
+      expect(mrtr, driver.describe('host-sample-test-seams.md §23', 'the invoke seam SHOULD report `mrtr: { inputRequiredSeen, retried, requestStateEchoed, result }` for tool "needs_input"; until it does this requirement is unobservable and resolves to `blocked`')).toBeDefined();
+      return;
+    }
+    expect(mrtr.inputRequiredSeen, driver.describe('mcp-integration.md §C.1', 'the host MUST recognise resultType input_required')).toBe(true);
+    expect(mrtr.retried, driver.describe('mcp-integration.md §C.1', 'the host MUST retry the ORIGINAL request with inputResponses (a live callback is not the current profile)')).toBe(true);
+    // Cross-check from the wire: two tools/call, second carries requestState identical to what the server issued.
+    expect(calls.length, driver.describe('mcp-integration.md §C.1', 'initial + retry = two independent JSON-RPC requests on the wire')).toBeGreaterThanOrEqual(2);
+    const retry = calls[calls.length - 1]!.params as { requestState?: string; inputResponses?: Record<string, unknown> };
+    expect(typeof retry.requestState, driver.describe('mcp-integration.md §C.1', 'requestState MUST be echoed exactly on the retry')).toBe('string');
+    expect(retry.requestState?.startsWith('mrtr:needs_input:'), 'the echoed requestState is the value the server issued, byte-exact').toBe(true);
+    expect(retry.inputResponses?.['who'], driver.describe('mcp-integration.md §C.1', 'inputResponses MUST answer every requested key')).toBeDefined();
+    expect(mrtr.requestStateEchoed).toBe(true);
+    for (const c of calls) {
+      expect(c.revision, driver.describe('mcp-integration.md §B', 'both calls MUST carry the current revision')).toBe('2026-07-28');
+    }
+  });
+});
+
+describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §C — mcp-mrtr-roundtrip, server half (host as 2026-07-28 server; gated on mcp-2026-07-28 + serverMount)', () => {
+  it('a suspending tool answers input_required with elicitation + requestState; the retry resolves it; a forged requestState is refused', async () => {
+    const caps = await mcp();
+    const claims = caps?.supported === true && (caps.profiles ?? []).includes('mcp-2026-07-28') && caps.serverMount?.supported === true;
+    if (!behaviorGate('mcp-2026-07-28', claims)) return;
+    // Register a workflow that exposes a tool and asks for input (the legacy
+    // elicitation-bridge fixture shape); under the current profile the ask MUST
+    // surface as MRTR, not as a live elicitation/create callback.
+    const TOOL = `mrtr_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`;
+    const reg = await driver.post('/v1/host/sample/workflows', {
+      workflowId: `mcp.mrtr.${TOOL}`,
+      nodes: [
+        { nodeId: 'expose', typeId: 'core.openwop.mcp.expose-tool', config: { name: TOOL, description: 'MRTR conformance tool', inputSchema: { type: 'object', properties: {} } } },
+        { nodeId: 'ask', typeId: 'core.openwop.mcp.handle-elicitation', config: { message: 'What is your name?', requestedSchema: { type: 'object', properties: { name: { type: 'string' } }, required: ['name'] } } },
+      ],
+      // The sample-workflow seam's registration shape (`nodeId` / `edgeId` /
+      // `sourceNodeId` / `targetNodeId` — the same convention every other leg
+      // posting to `/v1/host/sample/workflows` uses for nodes), NOT the RFC 0013
+      // workflow-CHAIN `{ from, to }` shape this leg posted until 2026-08-16
+      // (S17: the first 2026-07-28 host answered 400 validation_error and the
+      // leg walked on to tools/call for a tool that was never registered).
+      // Note the seam shape differs from the canonical WorkflowDefinition
+      // (`workflow-definition.schema.json` keys nodes and edges by `id`); the
+      // divergence is recorded in host-sample-test-seams.md.
+      edges: [{ edgeId: 'expose-ask', sourceNodeId: 'expose', targetNodeId: 'ask' }],
+    });
+    if (reg.status === 404 || reg.status === 403) return seamAbsent(`host advertises mcp-2026-07-28 with a server mount but the sample-workflow seam /v1/host/sample/workflows answered ${reg.status}`);
+    // A 4xx here is a SUITE defect (the fixture this leg posts is malformed),
+    // not seam absence and not a host finding — fail loudly at the source.
+    expect(reg.status, driver.describe('host-sample-test-seams.md §"sample workflows"', `the registration fixture MUST be accepted; a 4xx means the fixture this leg posts is malformed (suite defect): ${JSON.stringify(reg.json).slice(0, 200)}`)).toBeLessThan(400);
+    const hdr = { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/call', 'Mcp-Name': TOOL };
+    const first = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: TOOL, arguments: {}, _meta: { [META_V]: '2026-07-28', [META_C]: { elicitation: {} } } } }, { headers: hdr });
+    if (first.status === 404) return seamAbsent('host advertises an MCP server mount but /v1/host/sample/mcp answered 404');
+    const r1 = first.json as { result?: { resultType?: string; inputRequests?: Record<string, { method?: string }>; requestState?: string }; error?: { code: number } };
+    expect(r1.error, driver.describe('mcp-integration.md §C.2', `tools/call MUST NOT error: ${JSON.stringify(r1.error)}`)).toBeUndefined();
+    expect(r1.result?.resultType, driver.describe('mcp-integration.md §C.2', 'a run reaching waiting-input MUST answer the in-flight tools/call with resultType input_required (not a live callback)')).toBe('input_required');
+    const key = Object.keys(r1.result?.inputRequests ?? {})[0];
+    expect(key, driver.describe('mcp-integration.md §C.2', 'inputRequests MUST carry the elicitation')).toBeDefined();
+    expect(r1.result?.inputRequests?.[key!]?.method).toBe('elicitation/create');
+    expect(typeof r1.result?.requestState, driver.describe('mcp-integration.md §C.2', 'requestState MUST be present (opaque, integrity-protected, bound to principal/TTL/request/runId/interrupt token)')).toBe('string');
+    const retry = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: TOOL, arguments: {}, requestState: r1.result!.requestState, inputResponses: { [key!]: { action: 'accept', content: { name: 'Ada' } } }, _meta: { [META_V]: '2026-07-28', [META_C]: { elicitation: {} } } } }, { headers: hdr });
+    const r2 = retry.json as { result?: { resultType?: string }; error?: { code: number } };
+    expect(r2.error).toBeUndefined();
+    expect(['complete', 'input_required'], driver.describe('mcp-integration.md §C.2', 'the retry MUST resolve the interrupt (complete) or ask for the next pending input')).toContain(r2.result?.resultType);
+    const forged = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: TOOL, arguments: {}, requestState: 'forged', inputResponses: { [key!]: { action: 'accept', content: { name: 'Eve' } } }, _meta: { [META_V]: '2026-07-28', [META_C]: { elicitation: {} } } } }, { headers: hdr });
+    const r3 = forged.json as { result?: { resultType?: string }; error?: { code: number } };
+    expect(r3.error !== undefined || forged.status >= 400, driver.describe('mcp-integration.md §C.2', 'a requestState that fails integrity verification MUST be refused (upstream: attacker-controlled input)')).toBe(true);
+  });
+});