@openwop/openwop-conformance 1.135.0 → 1.135.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.135.0",
+  "version": "1.135.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.135.0",
-  "corpusCommit": "1b8327c673b8a11c004c17b848ba0a8d2128c2b8"
+  "suiteVersion": "1.135.2",
+  "corpusCommit": "101bf981f0431710e81a3e7ac108c5b6b49cddd9"
 }

package/schemas/capabilities.schema.json

@@ -3332,6 +3332,16 @@
           "type": "boolean",
           "description": "Host advertises a client-side MCP surface (ctx.mcp.*). See spec/v1/mcp-integration.md."
         },
+        "serverUrls": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "Where the host's MCP server mount(s) answer JSON-RPC \u2014 an absolute URL or a path relative to the discovery origin (S25: a path is joined to the base URL, an absolute URL is used as-is). The v1.0 conformance baseline (`mcp-discoverability.test.ts`, spec/v1/mcp-integration.md \u00a7Conformance + interop) REQUIRES a non-empty `serverUrls` whenever `supported: true`, and since suite 1.134.0 every server-side scenario POSTs to `serverUrls[0]`. Required by the scenario and absent from this schema until 2026-08-17 (S27) \u2014 the second sibling host emitted it and measured the contradiction."
+        },
         "serverMount": {
           "type": "object",
           "description": "Server-side MCP composition (workflow IS an MCP server). When supported, the host mounts an MCP endpoint and routes inbound tools/call, resources/read, prompts/get into workflows. Inbound MUST be treated as `trustBoundary: 'untrusted'`.",

package/src/scenarios/a2a-version-negotiation.test.ts

@@ -28,6 +28,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { getA2AFakePeer } from '../lib/a2a-fake-peer.js';
+import { readErrorCode } from '../lib/error-envelope.js';
 
 /**
  * Callback-shaped: the host issues A2A calls to the suite's fake peer, which records the negotiated version header.
@@ -153,9 +154,10 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     });
     if (drive.status === 404 || drive.status === 403) return;
     expect(drive.status >= 400, driver.describe('RFCS/0152 §B', 'an unsupported version MUST fail')).toBe(true);
-    const err = (drive.json as { error?: { code?: string; retriable?: boolean } }).error;
+    // S28: canonical envelope is FLAT (`error: "<code>"`, error-envelope.schema.json);
+    // the nested `error.code` is tolerated by the lib only through the deprecation window.
     expect(
-      err?.code,
+      readErrorCode(drive.json),
       driver.describe(
         'RFCS/0152 §B',
         'the upstream version error MUST be projected through the canonical OpenWOP interop error ' +

package/src/scenarios/discovery.test.ts

@@ -183,8 +183,7 @@ const AUTH_SCOPED_PROFILE = 'openwop-discovery-auth-scoped';
 
 async function readDiscoveryCaps(): Promise<DiscoveryCaps | undefined> {
   const disco = await driver.get('/.well-known/openwop', { authenticated: false });
-  return (disco.json as { capabilities?: { discovery?: DiscoveryCaps } }).capabilities
-    ?.discovery;
+  return (discoveryFamilies(disco.json) as { discovery?: DiscoveryCaps }).discovery;
 }
 
 function isAuthScopedAdvertised(disc: DiscoveryCaps | undefined): boolean {

package/src/scenarios/mcp-toolcall-redaction.test.ts

@@ -22,13 +22,12 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
-import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { capabilityFamily, discoveryFamilies } from '../lib/discovery-capabilities.js';
 
 async function isMcpClientSupported(): Promise<boolean> {
   const disco = await driver.get('/.well-known/openwop');
-  const caps = (disco.json as { capabilities?: { mcpClient?: { supported?: boolean } } })
-    .capabilities;
-  return caps?.mcpClient?.supported === true;
+  const caps = discoveryFamilies(disco.json) as { mcpClient?: { supported?: boolean } };
+  return caps.mcpClient?.supported === true;
 }
 
 describe('mcp-toolcall-redaction: capability advertisement contract', () => {

package/src/scenarios/mcp-version-negotiation.test.ts

@@ -26,6 +26,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { readErrorCode } from '../lib/error-envelope.js';
 import { seamAbsent } from '../lib/soft-skip.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
@@ -154,8 +155,10 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
       drive.status >= 400,
       driver.describe('RFCS/0153 §B', 'an unsupported revision MUST fail rather than silently proceed'),
     ).toBe(true);
+    // S28: canonical envelope is FLAT (`error: "<code>"`, error-envelope.schema.json);
+    // the nested `error.code` is tolerated by the lib only through the deprecation window.
     expect(
-      (drive.json as { error?: { code?: string } }).error?.code,
+      readErrorCode(drive.json),
       driver.describe(
         'RFCS/0153 §B',
         'the upstream error MUST be projected through the canonical OpenWOP interop envelope — a ' +

package/src/scenarios/media-url-inline-cap.test.ts

@@ -32,7 +32,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { driver } from '../lib/driver.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
-import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { capabilityFamily, discoveryFamilies } from '../lib/discovery-capabilities.js';
 
 const MEDIA_KINDS = ['media.image', 'media.audio', 'media.file'] as const;
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
@@ -136,10 +136,8 @@ describe.skipIf(HTTP_SKIP)('media-url-inline-cap: advertisement shape (RFC 0055
     // that emits a media.* envelope into a run (so no media payload appears).
     const disc = await driver.get('/.well-known/openwop');
     if (disc.status !== 200) return;
-    const caps = (disc.json as {
-      capabilities?: { aiProviders?: { maxInlineMediaBytes?: unknown }; debugBundle?: { supported?: unknown } };
-    }).capabilities;
-    if (caps?.aiProviders?.maxInlineMediaBytes === undefined || caps.debugBundle?.supported !== true) {
+    const caps = discoveryFamilies(disc.json) as { aiProviders?: { maxInlineMediaBytes?: unknown }; debugBundle?: { supported?: unknown } };
+    if (caps.aiProviders?.maxInlineMediaBytes === undefined || caps.debugBundle?.supported !== true) {
       return; // host doesn't serve media + export debug bundles — contract not exercisable
     }
     // Find a recent run and inspect its debug bundle for any media.* event.

package/src/scenarios/metric-emission.test.ts

@@ -21,6 +21,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
+import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { getCollector } from '../lib/otel-collector.js';
@@ -43,10 +44,8 @@ interface MetricsCaps {
 async function metricsAdvertised(): Promise<MetricsCaps | null> {
   try {
     const disco = await driver.get('/.well-known/openwop');
-    const caps = (disco.json as {
-      capabilities?: { observability?: { metrics?: MetricsCaps } };
-    }).capabilities;
-    return caps?.observability?.metrics ?? null;
+    const caps = discoveryFamilies(disco.json) as { observability?: { metrics?: MetricsCaps } };
+    return caps.observability?.metrics ?? null;
   } catch {
     return null;
   }

package/src/scenarios/node-module-required-capabilities-shape.test.ts

@@ -20,6 +20,7 @@
 
 import { describe, it, expect, beforeAll } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 
 /** RFC 0031 §C — spec-reserved capability identifiers. */
 const RESERVED_IDENTIFIERS: ReadonlySet<string> = new Set([
@@ -58,7 +59,7 @@ beforeAll(async () => {
     SKIP_REASON = 'discovery doc unreachable';
     return;
   }
-  const caps = (disco.json as DiscoveryDoc).capabilities ?? {};
+  const caps = discoveryFamilies(disco.json) as NonNullable<DiscoveryDoc['capabilities']>;
   if (caps.modelCapabilities?.supported !== true) {
     SKIP_REASON = 'host does not advertise capabilities.modelCapabilities.supported: true';
     return;

package/src/scenarios/otel-emission-grpc.test.ts

@@ -28,6 +28,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
+import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { getCollector, waitForRunSpans } from '../lib/otel-collector.js';
@@ -45,12 +46,8 @@ const FIXTURE = 'conformance-noop';
 async function advertisesGrpcExport(): Promise<boolean> {
   try {
     const disco = await driver.get('/.well-known/openwop');
-    const caps = (disco.json as {
-      capabilities?: {
-        observability?: { otel?: { exportProtocols?: unknown } };
-      };
-    }).capabilities;
-    const protocols = caps?.observability?.otel?.exportProtocols;
+    const caps = discoveryFamilies(disco.json) as { observability?: { otel?: { exportProtocols?: unknown } } };
+    const protocols = caps.observability?.otel?.exportProtocols;
     return Array.isArray(protocols) && protocols.includes('grpc');
   } catch {
     return false;

package/src/scenarios/otel-emission.test.ts

@@ -26,6 +26,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
+import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { getCollector, waitForRunSpans } from '../lib/otel-collector.js';
@@ -43,7 +44,7 @@ const FIXTURE = 'conformance-noop';
 async function isObservabilityAdvertised(): Promise<boolean> {
   try {
     const disco = await driver.get('/.well-known/openwop');
-    const caps = (disco.json as { capabilities?: { observability?: unknown } }).capabilities ?? {};
+    const caps = discoveryFamilies(disco.json) as { observability?: unknown };
     return caps.observability !== undefined;
   } catch {
     return false;

package/src/scenarios/otel-trace-propagation-subworkflow.test.ts

@@ -36,6 +36,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
+import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { isScenarioOptedOut } from '../lib/env.js';
@@ -70,7 +71,7 @@ function makeTraceparent(): { header: string; traceId: string } {
 async function isObservabilityAdvertised(): Promise<boolean> {
   try {
     const disco = await driver.get('/.well-known/openwop');
-    const caps = (disco.json as { capabilities?: { observability?: unknown } }).capabilities ?? {};
+    const caps = discoveryFamilies(disco.json) as { observability?: unknown };
     return caps.observability !== undefined;
   } catch {
     return false;

package/src/scenarios/otel-trace-propagation.test.ts

@@ -20,6 +20,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
+import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { getCollector, waitForRunSpans } from '../lib/otel-collector.js';
@@ -45,7 +46,7 @@ function makeTraceparent(): { header: string; traceId: string } {
 async function isObservabilityAdvertised(): Promise<boolean> {
   try {
     const disco = await driver.get('/.well-known/openwop');
-    const caps = (disco.json as { capabilities?: { observability?: unknown } }).capabilities ?? {};
+    const caps = discoveryFamilies(disco.json) as { observability?: unknown };
     return caps.observability !== undefined;
   } catch {
     return false;

package/src/scenarios/self-hosted-runner.test.ts

@@ -35,6 +35,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
+import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
 
 const GATE = 'openwop-self-hosted-runner';
 
@@ -51,23 +52,14 @@ function readSchema(name: string): JsonSchema {
   return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as JsonSchema;
 }
 
-/** Read the canonical error code from a response body (tolerant of shapes). */
-function errCode(json: unknown): string | undefined {
-  const j = json as { error?: unknown; code?: unknown };
-  if (typeof j?.code === 'string') return j.code;
-  if (typeof j?.error === 'string') return j.error;
-  const e = j?.error as { code?: unknown } | undefined;
-  if (e && typeof e.code === 'string') return e.code;
-  return undefined;
-}
-
-/** Read a boolean `retriable` flag from either `{retriable}` or `{error:{retriable}}`. */
-function retriable(json: unknown): boolean | undefined {
-  const j = json as { retriable?: unknown; error?: { retriable?: unknown } };
-  if (typeof j?.retriable === 'boolean') return j.retriable;
-  if (j?.error && typeof j.error.retriable === 'boolean') return j.error.retriable;
-  return undefined;
-}
+// S28 (2026-08-17): the HTTP error envelope is READ through lib/error-envelope.ts —
+// flat `{ error: "<code>", message, details.retriable }` per error-envelope.schema.json
+// (S22), with the pre-S22 nested `{ error: { code, retriable } }` tolerated only through
+// the deprecation window. The local readers this replaced accepted top-level `retriable`
+// or nested `error.retriable` and never `details.retriable`, so a schema-valid host could
+// not pass the retriable-flag leg at all (openwop-app H27 → S28).
+const errCode = readErrorCode;
+const retriable = readRetriable;
 
 interface SelfHostedRunner {
   supported?: boolean;

package/src/scenarios/versioned-composition-profiles.test.ts

@@ -137,6 +137,24 @@ describe('RFC 0153 §A — MCP versioned discovery', () => {
     ).toBe(true);
   });
 
+  it('the v1.0 baseline `serverUrls` (required by mcp-discoverability when supported:true) validates — path or absolute URL, non-empty, no duplicates', () => {
+    // S27 (2026-08-17): the schema was `additionalProperties: false` and did not
+    // list `serverUrls`, while mcp-discoverability.test.ts REQUIRED it — a host
+    // could not satisfy the scenario and the schema at once. The second sibling
+    // host measured the contradiction on its own advert.
+    expect(
+      validate({ supported: true, serverUrls: ['/v1/host/openwop-app/mcp'], protocolVersions: ['2026-07-28'] }),
+      JSON.stringify(validate.errors),
+    ).toBe(true);
+    expect(
+      validate({ supported: true, serverUrls: ['https://example.test/canvasApi/v1/mcp'], protocolVersions: ['2024-11-05'], preferredVersion: '2024-11-05' }),
+      JSON.stringify(validate.errors),
+    ).toBe(true);
+    expect(validate({ supported: true, serverUrls: [] }), 'empty serverUrls is the bare `supported: true` problem').toBe(false);
+    expect(validate({ supported: true, serverUrls: ['/a', '/a'] }), 'duplicates').toBe(false);
+    expect(validate({ supported: true, serverUrls: [''] }), 'an empty string is not a mount').toBe(false);
+  });
+
   it('versions use MCP date form exactly', () => {
     // MCP revisions ARE dates. `latest` or a non-padded month would let two
     // hosts disagree about which revision they share while both validate.

package/src/scenarios/webhook-negative.test.ts

@@ -22,13 +22,13 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { discoverOwnedTenant } from '../lib/webhook-receiver.js';
 
 async function isWebhookSupported(): Promise<boolean> {
   const disco = await driver.get('/.well-known/openwop');
-  const caps = (disco.json as { capabilities?: { webhooks?: { supported?: boolean } } })
-    .capabilities;
-  return caps?.webhooks?.supported === true;
+  const caps = discoveryFamilies(disco.json) as { webhooks?: { supported?: boolean } };
+  return caps.webhooks?.supported === true;
 }
 
 describe('webhook-negative: SSRF guard rejects private destinations', () => {

package/src/scenarios/webhook-sig-algorithm.test.ts

@@ -15,6 +15,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 
 interface DiscoveryWebhooks {
   webhooks?: {
@@ -26,7 +27,7 @@ interface DiscoveryWebhooks {
 describe('webhook-sig-algorithm: host advertises supported algorithm set', () => {
   it('discovery surfaces a webhooks.signatureAlgorithms array including "v1"', async () => {
     const disco = await driver.get('/.well-known/openwop');
-    const caps = (disco.json as { capabilities?: DiscoveryWebhooks }).capabilities ?? {};
+    const caps = discoveryFamilies(disco.json) as DiscoveryWebhooks;
     const webhooks = caps.webhooks;
 
     if (!webhooks?.supported) {

package/src/scenarios/webhook-signed-delivery.test.ts

@@ -28,6 +28,7 @@ import { softSkip } from '../lib/soft-skip.js';
 import { createHmac } from 'node:crypto';
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
 import { driver } from '../lib/driver.js';
+import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { discoverOwnedTenant } from '../lib/webhook-receiver.js';
@@ -70,8 +71,8 @@ afterEach(async () => {
 
 async function isWebhookSupported(): Promise<boolean> {
   const disco = await driver.get('/.well-known/openwop');
-  const caps = (disco.json as { capabilities?: { webhooks?: { supported?: boolean } } }).capabilities;
-  return caps?.webhooks?.supported === true;
+  const caps = discoveryFamilies(disco.json) as { webhooks?: { supported?: boolean } };
+  return caps.webhooks?.supported === true;
 }
 
 describe('webhook-signed-delivery: end-to-end HMAC v1', () => {

package/src/scenarios/workflow-chain-host-expansion.test.ts

@@ -46,7 +46,7 @@ import { loadEnv } from '../lib/env.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { FIXTURES_DIR } from '../lib/paths.js';
 import { expandChain, expandChainWithCompensation, type WorkflowChain, type WorkflowChainWithCompensation } from '../lib/workflow-chain-expansion.js';
-import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { capabilityFamily, discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 
@@ -84,9 +84,7 @@ interface ChainCaps {
 
 async function isExpansionAdvertised(): Promise<boolean> {
   const disco = await driver.get('/.well-known/openwop');
-  const caps =
-    (disco.json as { capabilities?: { workflowChainPacks?: ChainCaps } }).capabilities
-      ?.workflowChainPacks ?? {};
+  const caps = (discoveryFamilies(disco.json) as { workflowChainPacks?: ChainCaps }).workflowChainPacks ?? {};
   return caps.hostExpansionSeam === true;
 }
 
@@ -105,8 +103,7 @@ describe('workflow-chain-host-expansion: live host wraps expansion algorithm cor
     if (!behaviorGate(PROFILE, await isExpansionAdvertised())) return;
 
     const disco = await driver.get('/.well-known/openwop');
-    const caps = (disco.json as { capabilities?: { workflowChainPacks?: ChainCaps } }).capabilities
-      ?.workflowChainPacks;
+    const caps = (discoveryFamilies(disco.json) as { workflowChainPacks?: ChainCaps }).workflowChainPacks;
     expect(
       caps,
       driver.describe(