@openwop/openwop-conformance 1.133.0 → 1.134.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.133.0",
+  "version": "1.134.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.133.0",
-  "corpusCommit": "01d2c45b0cc72ac953bc3c996f9bc3004d3ec297"
+  "suiteVersion": "1.134.0",
+  "corpusCommit": "fbb82fa8ea94c25358a63fda98bd49fdb528693a"
 }

package/src/lib/driver.ts

@@ -35,7 +35,9 @@ class OpenWOPDriver {
     init: OpenWOPRequestInit = {},
   ): Promise<OpenWOPResponse> {
     const env = loadEnv();
-    const url = `${env.baseUrl}${path}`;
+    // An absolute URL is used as-is (a host may advertise its MCP server mount or
+    // an A2A endpoint on another origin); a path is joined to the base URL.
+    const url = /^https?:\/\//i.test(path) ? path : `${env.baseUrl}${path}`;
 
     const headers: Record<string, string> = {
       Accept: 'application/json',

package/src/lib/mcp-mount.ts

@@ -0,0 +1,39 @@
+/**
+ * Where a host mounts its MCP server (RFC 0153 §B / `mcp-integration.md`
+ * §"MCP server composition").
+ *
+ * The reference boots mount it at the sample-seam path
+ * `/v1/host/sample/mcp`, and until suite 1.134.0 every server-side MCP
+ * scenario hard-coded that path. The v1.0 discovery baseline has always let a
+ * host SAY where its mount is — `capabilities.mcp.serverUrls: string[]`
+ * (`mcp-discoverability.test.ts`) — and the first deployed host to advertise
+ * `mcp-2026-07-28` mounted at `/v1/host/openwop-app/mcp`, advertised exactly
+ * that, and watched ten `server/discover` legs 404 against the sample path and
+ * return early (S25, openwop-app H38, 2026-08-17). So: read the advert first,
+ * fall back to the sample path, and never treat "the mount answered 404" as a
+ * pass — that is `seamAbsent` (the host advertised a server mount it does not
+ * serve where it said).
+ */
+import { driver } from './driver.js';
+import { capabilityFamily } from './discovery-capabilities.js';
+
+export const SAMPLE_MCP_MOUNT = '/v1/host/sample/mcp';
+
+interface McpAdvert {
+  readonly supported?: boolean;
+  readonly serverUrls?: unknown;
+  readonly serverMount?: { readonly supported?: boolean };
+}
+
+/**
+ * The MCP server mount to POST JSON-RPC to: `capabilities.mcp.serverUrls[0]`
+ * when the host advertises one (a path is joined to the base URL by the driver;
+ * an absolute URL is used as-is), else the sample-seam path.
+ */
+export async function mcpServerMount(): Promise<string> {
+  const disco = await driver.get('/.well-known/openwop');
+  const mcp = capabilityFamily<McpAdvert>(disco.json, 'mcp');
+  const urls = Array.isArray(mcp?.serverUrls) ? (mcp?.serverUrls as unknown[]) : [];
+  const first = urls.find((u): u is string => typeof u === 'string' && u.length > 0);
+  return first ?? SAMPLE_MCP_MOUNT;
+}

package/src/scenarios/mcp-2026-07-28-discover.test.ts

@@ -25,6 +25,8 @@
 
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { McpFakeServer, MCP_ERR } from '../lib/mcp-fake-server.js';
@@ -170,7 +172,7 @@ async function claimsCurrent(): Promise<boolean> {
 }
 async function hostRpc(method: string, params: Record<string, unknown>, headers: Record<string, string>) {
   // The reference host mounts its MCP server at /v1/host/sample/mcp (mcp-server-* scenarios).
-  const res = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 1, method, params }, { headers });
+  const res = await driver.post(await mcpServerMount(), { jsonrpc: '2.0', id: 1, method, params }, { headers });
   return { status: res.status, body: res.json as { result?: Record<string, unknown>; error?: { code: number; data?: Record<string, unknown> } } };
 }
 
@@ -179,7 +181,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §B — host as MCP ser
     if (!behaviorGate(PROFILE, await claimsCurrent())) return;
     const caps = (await mcp())!;
     const r = await hostRpc('server/discover', { _meta: { [META_V]: '2026-07-28', [META_C]: {} } }, { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'server/discover' });
-    if (r.status === 404 || r.status === 403) return; // mount not wired at the sample path — the mcp-server-* legs cover that gap
+    if (r.status === 404 || r.status === 403) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${r.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     expect(r.status, driver.describe('mcp-integration.md §B', 'server/discover is a server MUST under 2026-07-28')).toBe(200);
     expect(r.body.result?.['resultType']).toBe('complete');
     expect([...((r.body.result?.['supportedVersions'] as string[] | undefined) ?? [])].sort(), driver.describe('mcp-integration.md §B', 'server/discover.supportedVersions MUST equal capabilities.mcp.protocolVersions — two documents, one fact')).toEqual([...(caps.protocolVersions ?? [])].sort());
@@ -196,7 +198,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §B — host as MCP ser
     // answered -32022 — the leg was testing an unstated precedence
     // (mcp-integration.md §B: agreement is checked before selection).
     const mismatch = await hostRpc('tools/list', { _meta: { [META_V]: '2025-06-18', [META_C]: {} } }, { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/list' });
-    if (mismatch.status === 404 || mismatch.status === 403) return;
+    if (mismatch.status === 404 || mismatch.status === 403) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${mismatch.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     expect(mismatch.status, driver.describe('mcp-integration.md §B', 'header ≠ body MUST be refused 400 (HeaderMismatchError -32020) — fail closed')).toBe(400);
     expect(mismatch.body.error?.code).toBe(MCP_ERR.HEADER_MISMATCH);
     const unsupported = await hostRpc('tools/list', { _meta: { [META_V]: '1999-01-01', [META_C]: {} } }, { 'MCP-Protocol-Version': '1999-01-01', 'Mcp-Method': 'tools/list' });

package/src/scenarios/mcp-cache-tenant-scope.test.ts

@@ -22,6 +22,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
@@ -38,7 +40,7 @@ async function claimsCurrent(): Promise<boolean> {
 async function listAs(bearer?: string) {
   const headers: Record<string, string> = { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/list' };
   if (bearer) headers['authorization'] = `Bearer ${bearer}`;
-  const res = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 1, method: 'tools/list', params: { _meta: { [META_V]: '2026-07-28', [META_C]: {} } } }, { headers });
+  const res = await driver.post(await mcpServerMount(), { jsonrpc: '2.0', id: 1, method: 'tools/list', params: { _meta: { [META_V]: '2026-07-28', [META_C]: {} } } }, { headers });
   return { status: res.status, body: res.json as { result?: { tools?: unknown[]; cacheScope?: string; ttlMs?: number } } };
 }
 
@@ -46,7 +48,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §D — mcp-cache-tenan
   it('a per-caller list is cacheScope private; a public list is byte-identical across callers', async () => {
     if (!behaviorGate(PROFILE, await claimsCurrent())) return;
     const mine = await listAs();
-    if (mine.status === 404 || mine.status === 403) return;
+    if (mine.status === 404 || mine.status === 403) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${mine.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     expect(['public', 'private'], driver.describe('mcp-integration.md §D', 'cacheScope MUST be present on tools/list')).toContain(mine.body.result?.cacheScope);
     const other = process.env.OPENWOP_TEST_SECONDARY_API_KEY;
     if (!other) {

package/src/scenarios/mcp-current-auth-boundary.test.ts

@@ -18,6 +18,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
@@ -38,10 +40,10 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §E — mcp-current-aut
     const { mcp, anon } = await disco();
     const claims = mcp?.supported === true && (mcp.profiles ?? []).includes(PROFILE) && mcp.serverMount?.supported === true;
     if (!behaviorGate(PROFILE, claims)) return;
-    const authed = await driver.post('/v1/host/sample/mcp', REQ, { headers: HDR });
-    if (authed.status === 404 || authed.status === 403) return; // mount not at the sample path
+    const authed = await driver.post(await mcpServerMount(), REQ, { headers: HDR });
+    if (authed.status === 404 || authed.status === 403) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${authed.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     expect(authed.status, driver.describe('mcp-integration.md §E', 'the authenticated call MUST succeed at the same path, so a refusal below is not a wrong path')).toBe(200);
-    const anonymous = await driver.post('/v1/host/sample/mcp', REQ, { headers: HDR, authenticated: false });
+    const anonymous = await driver.post(await mcpServerMount(), REQ, { headers: HDR, authenticated: false });
     if (anon?.supported === true) {
       // Anonymous is permitted only through the RFC 0132 surface; a 200 here is that surface answering.
       expect([200, 401, 403]).toContain(anonymous.status);

package/src/scenarios/mcp-extension-opacity.test.ts

@@ -23,6 +23,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
@@ -66,7 +67,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §D — mcp-extension-o
     const caps = await mcp();
     const claims = caps?.supported === true && (caps.profiles ?? []).includes('mcp-2026-07-28') && caps.serverMount?.supported === true;
     if (!behaviorGate('mcp-2026-07-28', claims)) return;
-    const res = await driver.post('/v1/host/sample/mcp', {
+    const res = await driver.post(await mcpServerMount(), {
       jsonrpc: '2.0', id: 1, method: 'tools/list',
       params: { _meta: { [META_V]: '2026-07-28', [META_C]: { extensions: { 'io.example/authority': { admin: true } } }, 'io.example/authority': { grantScopes: ['*'] } } },
     }, { headers: { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/list' } });

package/src/scenarios/mcp-mrtr-roundtrip.test.ts

@@ -33,6 +33,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
@@ -120,7 +121,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §C — mcp-mrtr-roundt
     // not seam absence and not a host finding — fail loudly at the source.
     expect(reg.status, driver.describe('host-sample-test-seams.md §"sample workflows"', `the registration fixture MUST be accepted; a 4xx means the fixture this leg posts is malformed (suite defect): ${JSON.stringify(reg.json).slice(0, 200)}`)).toBeLessThan(400);
     const hdr = { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/call', 'Mcp-Name': TOOL };
-    const first = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: TOOL, arguments: {}, _meta: { [META_V]: '2026-07-28', [META_C]: { elicitation: {} } } } }, { headers: hdr });
+    const first = await driver.post(await mcpServerMount(), { jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: TOOL, arguments: {}, _meta: { [META_V]: '2026-07-28', [META_C]: { elicitation: {} } } } }, { headers: hdr });
     if (first.status === 404) return seamAbsent('host advertises an MCP server mount but /v1/host/sample/mcp answered 404');
     const r1 = first.json as { result?: { resultType?: string; inputRequests?: Record<string, { method?: string }>; requestState?: string }; error?: { code: number } };
     expect(r1.error, driver.describe('mcp-integration.md §C.2', `tools/call MUST NOT error: ${JSON.stringify(r1.error)}`)).toBeUndefined();
@@ -129,11 +130,11 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §C — mcp-mrtr-roundt
     expect(key, driver.describe('mcp-integration.md §C.2', 'inputRequests MUST carry the elicitation')).toBeDefined();
     expect(r1.result?.inputRequests?.[key!]?.method).toBe('elicitation/create');
     expect(typeof r1.result?.requestState, driver.describe('mcp-integration.md §C.2', 'requestState MUST be present (opaque, integrity-protected, bound to principal/TTL/request/runId/interrupt token)')).toBe('string');
-    const retry = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: TOOL, arguments: {}, requestState: r1.result!.requestState, inputResponses: { [key!]: { action: 'accept', content: { name: 'Ada' } } }, _meta: { [META_V]: '2026-07-28', [META_C]: { elicitation: {} } } } }, { headers: hdr });
+    const retry = await driver.post(await mcpServerMount(), { jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: TOOL, arguments: {}, requestState: r1.result!.requestState, inputResponses: { [key!]: { action: 'accept', content: { name: 'Ada' } } }, _meta: { [META_V]: '2026-07-28', [META_C]: { elicitation: {} } } } }, { headers: hdr });
     const r2 = retry.json as { result?: { resultType?: string }; error?: { code: number } };
     expect(r2.error).toBeUndefined();
     expect(['complete', 'input_required'], driver.describe('mcp-integration.md §C.2', 'the retry MUST resolve the interrupt (complete) or ask for the next pending input')).toContain(r2.result?.resultType);
-    const forged = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: TOOL, arguments: {}, requestState: 'forged', inputResponses: { [key!]: { action: 'accept', content: { name: 'Eve' } } }, _meta: { [META_V]: '2026-07-28', [META_C]: { elicitation: {} } } } }, { headers: hdr });
+    const forged = await driver.post(await mcpServerMount(), { jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: TOOL, arguments: {}, requestState: 'forged', inputResponses: { [key!]: { action: 'accept', content: { name: 'Eve' } } }, _meta: { [META_V]: '2026-07-28', [META_C]: { elicitation: {} } } } }, { headers: hdr });
     const r3 = forged.json as { result?: { resultType?: string }; error?: { code: number } };
     expect(r3.error !== undefined || forged.status >= 400, driver.describe('mcp-integration.md §C.2', 'a requestState that fails integrity verification MUST be refused (upstream: attacker-controlled input)')).toBe(true);
   });

package/src/scenarios/mcp-server-elicitation-bridge.test.ts

@@ -13,6 +13,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -31,7 +33,7 @@ async function rpc(method: string, params?: Record<string, unknown>) {
   const id = Math.floor(Math.random() * 1e6);
   const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
   if (params !== undefined) req.params = params;
-  const res = await driver.post('/v1/host/sample/mcp', req);
+  const res = await driver.post(await mcpServerMount(), req);
   return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string } } };
 }
 
@@ -71,7 +73,7 @@ describe('mcp-server-elicitation-bridge: behavioral (RFC 0020 §A point 3)', ()
         required: ['name'],
       },
     });
-    if (r.status === 404) return;
+    if (r.status === 404) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${r.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     expect(r.status, 'JSON-RPC envelope MUST 200').toBe(200);
     const dispatched = !!r.body.result || (!!r.body.error && r.body.error.code !== -32601);
     expect(

package/src/scenarios/mcp-server-prompt-roundtrip.test.ts

@@ -8,6 +8,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -26,7 +28,7 @@ async function rpc(method: string, params?: Record<string, unknown>) {
   const id = Math.floor(Math.random() * 1e6);
   const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
   if (params !== undefined) req.params = params;
-  const res = await driver.post('/v1/host/sample/mcp', req);
+  const res = await driver.post(await mcpServerMount(), req);
   return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string } } };
 }
 
@@ -65,7 +67,7 @@ describe('mcp-server-prompt-roundtrip: behavioral (RFC 0020)', () => {
     if (!(await registerPromptWorkflow())) return;
 
     const list = await rpc('prompts/list');
-    if (list.status === 404) return;
+    if (list.status === 404) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${list.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     const prompts = (list.body.result as { prompts?: Array<{ name: string }> } | undefined)?.prompts ?? [];
     expect(
       prompts.find((p) => p.name === PROMPT_NAME),

package/src/scenarios/mcp-server-resource-roundtrip.test.ts

@@ -10,6 +10,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -28,7 +30,7 @@ async function rpc(method: string, params?: Record<string, unknown>) {
   const id = Math.floor(Math.random() * 1e6);
   const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
   if (params !== undefined) req.params = params;
-  const res = await driver.post('/v1/host/sample/mcp', req);
+  const res = await driver.post(await mcpServerMount(), req);
   return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string } } };
 }
 
@@ -67,7 +69,7 @@ describe('mcp-server-resource-roundtrip: behavioral (RFC 0020)', () => {
     if (!(await registerResourceWorkflow())) return;
 
     const list = await rpc('resources/list');
-    if (list.status === 404) return;
+    if (list.status === 404) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${list.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     const resources = (list.body.result as { resources?: Array<{ uri: string }> } | undefined)?.resources ?? [];
     expect(
       resources.find((r) => r.uri === RESOURCE_URI),

package/src/scenarios/mcp-server-sampling-bridge.test.ts

@@ -16,6 +16,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -34,7 +36,7 @@ async function rpc(method: string, params?: Record<string, unknown>) {
   const id = Math.floor(Math.random() * 1e6);
   const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
   if (params !== undefined) req.params = params;
-  const res = await driver.post('/v1/host/sample/mcp', req);
+  const res = await driver.post(await mcpServerMount(), req);
   return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string } } };
 }
 
@@ -70,7 +72,7 @@ describe('mcp-server-sampling-bridge: behavioral (RFC 0020 §A point 3)', () =>
       messages: [{ role: 'user', content: { type: 'text', text: 'ping' } }],
       maxTokens: 16,
     });
-    if (r.status === 404) return;
+    if (r.status === 404) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${r.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     expect(r.status, 'JSON-RPC envelope MUST 200').toBe(200);
     const dispatched = !!r.body.result || (!!r.body.error && r.body.error.code !== -32601);
     expect(

package/src/scenarios/mcp-server-tool-roundtrip.test.ts

@@ -14,6 +14,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -32,7 +34,7 @@ async function rpc(method: string, params?: Record<string, unknown>): Promise<{
   const id = Math.floor(Math.random() * 1e6);
   const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
   if (params !== undefined) req.params = params;
-  const res = await driver.post('/v1/host/sample/mcp', req);
+  const res = await driver.post(await mcpServerMount(), req);
   return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string } } };
 }
 
@@ -83,7 +85,7 @@ describe('mcp-server-tool-roundtrip: behavioral (RFC 0020 §A points 1-2)', () =
     if (!registered) return; // host doesn't expose workflow registration
 
     const list = await rpc('tools/list');
-    if (list.status === 404) return; // host doesn't expose the seam
+    if (list.status === 404) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${list.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     expect(list.status, 'tools/list MUST 200').toBe(200);
     const tools = (list.body.result as { tools?: Array<{ name: string }> } | undefined)?.tools ?? [];
     const found = tools.find((t) => t.name === TEST_TOOL_NAME);

package/src/scenarios/mcp-server-untrusted-args.test.ts

@@ -12,6 +12,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -30,7 +32,7 @@ async function rpc(method: string, params?: Record<string, unknown>) {
   const id = Math.floor(Math.random() * 1e6);
   const req: Record<string, unknown> = { jsonrpc: '2.0', id, method };
   if (params !== undefined) req.params = params;
-  const res = await driver.post('/v1/host/sample/mcp', req);
+  const res = await driver.post(await mcpServerMount(), req);
   return { status: res.status, body: res.json as { result?: unknown; error?: { code: number; message: string; data?: unknown } } };
 }
 
@@ -77,7 +79,7 @@ describe('mcp-server-untrusted-args: behavioral (RFC 0020 §D)', () => {
       name: TEST_TOOL_NAME,
       arguments: { wrongField: 'no' },
     });
-    if (r.status === 404) return;
+    if (r.status === 404) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${r.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     expect(r.status, 'JSON-RPC envelope MUST 200').toBe(200);
     expect(
       r.body.error?.code,
@@ -96,7 +98,7 @@ describe('mcp-server-untrusted-args: behavioral (RFC 0020 §D)', () => {
       name: TEST_TOOL_NAME,
       arguments: { text: 'hello' },
     });
-    if (r.status === 404) return;
+    if (r.status === 404) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${r.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     expect(r.status).toBe(200);
     if (r.body.error) {
       expect(r.body.error.code, 'valid args MUST NOT trigger -32602').not.toBe(-32602);

package/src/scenarios/mcp-stateless-request.test.ts

@@ -20,9 +20,10 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { mcpServerMount } from '../lib/mcp-mount.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 
 const PROFILE = 'mcp-2026-07-28';
 const META_V = 'io.modelcontextprotocol/protocolVersion';
@@ -37,7 +38,7 @@ async function claimsCurrent(): Promise<boolean> {
 }
 async function list() {
   const res = await driver.post(
-    '/v1/host/sample/mcp',
+    await mcpServerMount(),
     { jsonrpc: '2.0', id: 1, method: 'tools/list', params: { _meta: { [META_V]: '2026-07-28', [META_C]: {}, [META_I]: { name: 'openwop-conformance', version: 'suite' } } } },
     { headers: { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/list' } },
   );
@@ -49,12 +50,12 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §B — mcp-header-body
     if (!behaviorGate(PROFILE, await claimsCurrent())) return;
     const meta = { [META_V]: '2026-07-28', [META_C]: {}, [META_I]: { name: 'openwop-conformance', version: 'suite' } };
     // (a) Mcp-Method header disagrees with the JSON-RPC method
-    const m = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 1, method: 'tools/list', params: { _meta: meta } }, { headers: { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'resources/list' } });
+    const m = await driver.post(await mcpServerMount(), { jsonrpc: '2.0', id: 1, method: 'tools/list', params: { _meta: meta } }, { headers: { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'resources/list' } });
     if (m.status === 404 || m.status === 403) return softSkip('blocked', `MCP server mount /v1/host/sample/mcp answered ${m.status}`);
     expect(m.status, driver.describe('mcp-integration.md §B', 'Mcp-Method MUST equal the body method; disagreement MUST be refused 400 (mcp-header-body-consistent)')).toBe(400);
     expect((m.json as { error?: { code?: number } }).error?.code, driver.describe('mcp-integration.md §B', 'the refusal is HeaderMismatchError -32020')).toBe(-32020);
     // (b) Mcp-Name header disagrees with params.name on tools/call
-    const n = await driver.post('/v1/host/sample/mcp', { jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'echo', arguments: {}, _meta: meta } }, { headers: { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/call', 'Mcp-Name': 'not-echo' } });
+    const n = await driver.post(await mcpServerMount(), { jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'echo', arguments: {}, _meta: meta } }, { headers: { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/call', 'Mcp-Name': 'not-echo' } });
     expect(n.status, driver.describe('mcp-integration.md §B', 'Mcp-Name MUST equal params.name; disagreement MUST be refused 400 (mcp-header-body-consistent)')).toBe(400);
     expect((n.json as { error?: { code?: number } }).error?.code, driver.describe('mcp-integration.md §B', 'the refusal is HeaderMismatchError -32020')).toBe(-32020);
   });
@@ -64,7 +65,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §B — mcp-stateless-r
   it('tools/list succeeds with no initialize and no session; result carries resultType + cache hints; two connections agree', async () => {
     if (!behaviorGate(PROFILE, await claimsCurrent())) return;
     const a = await list();
-    if (a.status === 404 || a.status === 403) return; // mount not at the sample path — covered by mcp-server-* legs
+    if (a.status === 404 || a.status === 403) return seamAbsent(`host advertises an MCP server mount but the mount (capabilities.mcp.serverUrls[0], else /v1/host/sample/mcp) answered ${a.status} — RFC 0153 §B is unobservable at the path the host itself advertised`);
     expect(a.status, driver.describe('mcp-integration.md §B', 'a core request MUST succeed without a prior initialize or a session header')).toBe(200);
     expect(a.body.error, driver.describe('mcp-integration.md §B', `stateless tools/list MUST NOT error: ${JSON.stringify(a.body.error)}`)).toBeUndefined();
     expect(a.body.result?.resultType, driver.describe('mcp-integration.md §B', 'every current-revision result carries resultType')).toBe('complete');

package/src/scenarios/mcp-version-negotiation.test.ts

@@ -26,6 +26,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { seamAbsent } from '../lib/soft-skip.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
@@ -123,8 +124,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
     const caps = await mcp();
     server.reset();
     const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint() });
-    if (drive.status === 404 || drive.status === 403) return;
-    // Discovery is a promise about behavior. A host that negotiates a revision
+    if (drive.status === 404 || drive.status === 403) return seamAbsent(`host advertises mcp version negotiation but the invoke seam /v1/host/sample/mcp/invoke answered ${drive.status} — the host-as-client legs are unobservable (host-sample-test-seams.md)`);
     // it never advertised has made its own discovery document unreliable, which
     // is worse than advertising nothing — a consumer that read it made a
     // decision on a fact that was not true.
@@ -149,7 +149,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
       serverUrl: server.endpoint(),
       requestVersion: '1999-01-01',
     });
-    if (drive.status === 404 || drive.status === 403) return;
+    if (drive.status === 404 || drive.status === 403) return seamAbsent(`host advertises mcp version negotiation but the invoke seam /v1/host/sample/mcp/invoke answered ${drive.status} — the host-as-client legs are unobservable (host-sample-test-seams.md)`);
     expect(
       drive.status >= 400,
       driver.describe('RFCS/0153 §B', 'an unsupported revision MUST fail rather than silently proceed'),