@openwop/openwop-conformance 2.35.0 → 2.36.0

package/src/scenarios/v2-a2a-agent-cards.test.ts

@@ -0,0 +1,305 @@
+/**
+ * RFC 0202 — each inventoried agent is published as an A2A 1.0 Agent Card,
+ * reached by the opaque routing value `a2aTenant` (`R`) through
+ * `GetExtendedAgentCard { tenant: R }`, without making the card an existence
+ * oracle across tenants (`spec/v2/core/interop.md` §"Per-agent cards").
+ * Target major 2.
+ *
+ * Gate: the v2 `a2a` record carries `agentCards` (else `inapplicable`), and the
+ * caller's `GET /agents` returns at least one entry with `a2aTenant` (else
+ * `inapplicable` — a tenant-scoped inventory MAY be empty). The suite speaks
+ * A2A 1.0 JSON-RPC to the first `JSONRPC` interface at `1.0` of the host's own
+ * public card (`a2a.agentCardUrl`); every request carries `A2A-Version: 1.0`.
+ *
+ * Cross-tenant legs (`identical-refusal`, `tenant-of-record`) need
+ * `OPENWOP_TEST_TENANT_B_API_KEY`, a credential bound to a SECOND tenant
+ * (not `OPENWOP_TEST_SECONDARY_API_KEY`, a same-principal rotation key), and an
+ * agent tenant B has that the caller's inventory lacks. The suite finds it as
+ * the set difference of the two inventories, or takes
+ * `OPENWOP_TEST_TENANT_B_AGENT_ID` when the operator names one. Missing ⇒
+ * `blocked`, never a pass.
+ *
+ * SR-1 leg: the canary strings are defined by `conformance/fixtures.md`
+ * §"Agent Pack Install" for the `core.conformance.agent-pack` pack
+ * (`conformance-agent-pack-install`'s `requiresInstalledPack`); the leg runs
+ * only when the caller's inventory carries an agent of that pack.
+ *
+ * What `routing-value` does NOT witness (RFC 0202 G4): that `R` encodes no
+ * identifier the host keeps private. It checks stability and that `R` contains
+ * no identifier the host itself disclosed on a run snapshot (tenant, workspace,
+ * subject); a host that encodes an undisclosed identifier is not caught.
+ * Response latency is not compared (G7).
+ *
+ * @see spec/v2/core/interop.md §"Per-agent cards"
+ * @see schemas/v2/agent-inventory-response.schema.json `a2aTenant`
+ * @see RFCS/0202-per-agent-a2a-agent-cards.md
+ */
+import { describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+export const HOST_CALLBACK_NOT_REQUIRED = 'the suite is the A2A client: every leg POSTs JSON-RPC to the interface the host\'s own public card lists; nothing harness-hosted is handed to the host';
+
+const DOC = 'spec/v2/core/interop.md §"Per-agent cards" (RFC 0202)';
+const PROFILE = 'a2a-1.0';
+const R = (slug: string): string => `openwop.requirement.0202.${slug}`;
+/** conformance/fixtures.md §"Agent Pack Install" — the pack and the two canaries it carries. */
+const CANARY_PACK = 'core.conformance.agent-pack';
+const CANARIES = ['OPENWOP-CONFORMANCE-CANARY-0202-PROMPT', 'OPENWOP-CONFORMANCE-CANARY-0202-HANDOFF'];
+
+interface RpcError { code: number; message?: string; data?: unknown }
+interface Rpc { status: number; body: Record<string, unknown>; result?: Record<string, unknown> | undefined; error?: RpcError | undefined }
+interface Iface { url?: string; protocolBinding?: string; protocolVersion?: string; tenant?: string }
+interface Card { name?: string; description?: string; version?: string; supportedInterfaces?: Iface[]; capabilities?: Record<string, unknown>; securitySchemes?: unknown; securityRequirements?: unknown; skills?: Array<{ id?: string; name?: string; description?: string; tags?: unknown }> }
+interface Entry { agentId: string; persona?: string; label?: string; description?: string; packName?: string; packVersion?: string; hasHandoffSchemas?: boolean; a2aTenant?: string; roster?: Array<{ workflows?: string[] }> }
+
+async function rpc(url: string, method: string, params: unknown, bearer: string | null = process.env.OPENWOP_API_KEY ?? null): Promise<Rpc> {
+  const headers: Record<string, string> = { 'content-type': 'application/json', accept: 'application/json', 'A2A-Version': '1.0' };
+  if (bearer) headers['authorization'] = `Bearer ${bearer}`;
+  const res = await fetch(url, { method: 'POST', headers, body: JSON.stringify({ jsonrpc: '2.0', id: randomBytes(4).readUInt32BE(0), method, params }) });
+  const text = await res.text();
+  let body: Record<string, unknown> = {};
+  try { const parsed = JSON.parse(text) as unknown; if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) body = parsed as Record<string, unknown>; } catch { body = { nonJson: text }; }
+  return { status: res.status, body, result: body['result'] as Record<string, unknown> | undefined, error: body['error'] as RpcError | undefined };
+}
+
+/** What two refusals must share: HTTP status and the body apart from the JSON-RPC `id`. */
+const refusalOf = (r: Rpc): string => { const { id: _id, ...rest } = r.body; void _id; return JSON.stringify({ status: r.status, body: rest }); };
+
+async function inventory(bearer?: string): Promise<{ status: number; body: unknown; agents: Entry[] }> {
+  const res = bearer === undefined
+    ? await driver.get('/agents')
+    : await driver.get('/agents', { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } });
+  const agents = res.status === 200 && Array.isArray((res.json as { agents?: unknown[] } | undefined)?.agents) ? ((res.json as { agents: Entry[] }).agents) : [];
+  return { status: res.status, body: res.json, agents };
+}
+
+async function publicCard(url: string, withVersion: boolean): Promise<{ status: number; text: string; card: Card }> {
+  const res = await fetch(url, { headers: withVersion ? { accept: 'application/json', 'A2A-Version': '1.0' } : { accept: 'application/json' } });
+  const text = await res.text();
+  let card: Card = {};
+  try { card = JSON.parse(text) as Card; } catch { /* non-JSON card */ }
+  return { status: res.status, text, card };
+}
+
+type Target =
+  | { ok: true; url: string; card: Card; cardUrl: string; entries: Entry[]; routed: Entry[] }
+  | { ok: false; kind: 'inapplicable' | 'blocked'; reason: string }
+  | { ok: false; kind: 'fail'; reason: string };
+
+async function target(): Promise<Target> {
+  if (!(await v2Discovery())) return { ok: false, kind: 'blocked', reason: 'v2 discovery unreachable' };
+  const a2a = await familyAdvertised('a2a');
+  if (!a2a) return { ok: false, kind: 'inapplicable', reason: 'a2a not advertised at major 2' };
+  if (a2a['agentCards'] !== true) return { ok: false, kind: 'inapplicable', reason: 'a2a.agentCards not advertised — the host publishes no per-agent card' };
+  const cardUrl = a2a['agentCardUrl'];
+  if (typeof cardUrl !== 'string') return { ok: false, kind: 'fail', reason: 'a host advertising a2a.agentCards offers the a2a-1.0 profile and MUST advertise a2a.agentCardUrl' };
+  const pub = await publicCard(cardUrl, true);
+  if (pub.status !== 200) return { ok: false, kind: 'fail', reason: `the advertised agentCardUrl answered ${pub.status}` };
+  const iface = (pub.card.supportedInterfaces ?? []).find((i) => i.protocolBinding === 'JSONRPC' && i.protocolVersion === '1.0');
+  if (typeof iface?.url !== 'string') return { ok: false, kind: 'fail', reason: 'claiming a2a-1.0 requires a JSONRPC interface at 1.0 in the public card' };
+  const inv = await inventory();
+  if (inv.status !== 200) return { ok: false, kind: 'fail', reason: `a2a.agentCards requires agents.manifestRuntime, and GET /agents MUST be served (got ${inv.status})` };
+  const routed = inv.agents.filter((e) => typeof e.a2aTenant === 'string' && e.a2aTenant.length > 0);
+  if (routed.length === 0) return { ok: false, kind: 'inapplicable', reason: 'the caller\'s GET /agents carries no entry with a2aTenant (a tenant-scoped inventory MAY be empty, and an agent with no routed workflow has no card)' };
+  return { ok: true, url: iface.url, card: pub.card, cardUrl, entries: inv.agents, routed };
+}
+
+function skip(t: Exclude<Target, { ok: true }>, id: string): undefined {
+  if (t.kind === 'fail') { expect(t.reason, req(id, DOC, t.reason)).toBe(''); return undefined; }
+  return softSkip(t.kind, t.reason);
+}
+
+const neverMinted = (): string => `ag-never-${randomBytes(9).toString('hex')}`;
+const message = (): Record<string, unknown> => ({ messageId: `conf-0202-${randomBytes(8).toString('hex')}`, role: 'ROLE_USER', parts: [{ text: 'openwop conformance RFC 0202' }] });
+const taskIdOf = (r: Rpc): string | undefined => {
+  const t = (r.result?.['task'] ?? r.result) as { id?: unknown } | undefined;
+  return typeof t?.id === 'string' ? t.id : undefined;
+};
+const ifaceKey = (i: Iface): string => JSON.stringify([i.url, i.protocolBinding, i.protocolVersion]);
+
+/** Tenant B's entry that the caller's inventory lacks, or why the leg cannot run. */
+async function foreignAgent(mine: Entry[]): Promise<{ ok: true; bearer: string; entry: Entry; theirs: Entry[] } | { ok: false; reason: string }> {
+  const bearer = process.env.OPENWOP_TEST_TENANT_B_API_KEY;
+  if (!bearer) return { ok: false, reason: 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set — the cross-tenant leg cannot run' };
+  if (bearer === process.env.OPENWOP_API_KEY) return { ok: false, reason: 'OPENWOP_TEST_TENANT_B_API_KEY equals OPENWOP_API_KEY — the leg needs a second tenant' };
+  const inv = await inventory(bearer);
+  if (inv.status !== 200) return { ok: false, reason: `GET /agents as tenant B answered ${inv.status}` };
+  const mineIds = new Set(mine.map((e) => e.agentId));
+  const mineR = new Set(mine.map((e) => e.a2aTenant).filter((x): x is string => typeof x === 'string'));
+  const named = process.env.OPENWOP_TEST_TENANT_B_AGENT_ID;
+  const candidates = inv.agents.filter((e) => typeof e.a2aTenant === 'string' && !mineIds.has(e.agentId) && !mineR.has(e.a2aTenant) && (named === undefined || named === '' || e.agentId === named));
+  const entry = candidates[0];
+  if (entry === undefined) return { ok: false, reason: `tenant B's inventory has no entry with a2aTenant that the caller's lacks${named ? ` (OPENWOP_TEST_TENANT_B_AGENT_ID=${named})` : ''} — provision an agent in tenant B only` };
+  return { ok: true, bearer, entry, theirs: inv.agents };
+}
+
+describe('RFC 0202 — v2-a2a-agent-cards (per-agent A2A cards, gated on a2a.agentCards)', () => {
+  it('a2a.agentCards implies the a2a-1.0 profile, agents.manifestRuntime and capabilities.extendedAgentCard on the public card', async () => {
+    const t = await target();
+    if (!t.ok) return skip(t, R('advertisement'));
+    const a2a = (await familyAdvertised('a2a'))!;
+    const profiles = Array.isArray(a2a['profiles']) ? (a2a['profiles'] as unknown[]) : [];
+    expect(profiles, req(R('advertisement'), DOC, 'a host advertising a2a.agentCards MUST offer the a2a-1.0 profile')).toContain(PROFILE);
+    const agents = await familyAdvertised('agents');
+    const mr = agents?.['manifestRuntime'];
+    expect(mr !== null && typeof mr === 'object' && !Array.isArray(mr), req(R('advertisement'), DOC, 'a host advertising a2a.agentCards MUST advertise agents.manifestRuntime')).toBe(true);
+    expect(t.card.capabilities?.['extendedAgentCard'], req(R('advertisement'), `${DOC}; A2A v1.0.1 §3.1.11`, 'the public card (A2A-Version: 1.0) MUST declare capabilities.extendedAgentCard: true — GetExtendedAgentCard is served only when it is')).toBe(true);
+  });
+
+  it('a2aTenant is schema-valid, stable across reads, and contains no identifier the host disclosed', async () => {
+    const t = await target();
+    if (!t.ok) return skip(t, R('routing-value'));
+    const again = await inventory();
+    const validate = v2Validator('agent-inventory-response');
+    const v = validate(again.body);
+    expect(v.ok, req(R('routing-value'), 'schemas/v2/agent-inventory-response.schema.json', `GET /agents MUST validate (a2aTenant is path-segment-safe, 1-128 chars): ${v.errors}`)).toBe(true);
+    const first = new Map(t.entries.map((e) => [e.agentId, e.a2aTenant]));
+    const second = new Map(again.agents.map((e) => [e.agentId, e.a2aTenant]));
+    for (const [agentId, r] of first) {
+      expect(second.get(agentId), req(R('routing-value'), DOC, `a2aTenant MUST be stable for the agent and host version: ${agentId} read ${String(r)} then ${String(second.get(agentId))}`)).toBe(r);
+    }
+    const rs = t.routed.map((e) => e.a2aTenant!);
+    expect(new Set(rs).size, req(R('routing-value'), DOC, 'each agent has its own routing value: two entries MUST NOT share an a2aTenant')).toBe(rs.length);
+    // Identifiers the host itself discloses: a run's tenant segment and its owner triple.
+    const entry = t.routed[0]!;
+    const sent = await rpc(t.url, 'SendMessage', { tenant: entry.a2aTenant, message: message() });
+    const taskId = taskIdOf(sent);
+    expect(typeof taskId, req(R('routing-value'), DOC, `SendMessage through a minted R MUST start a task so the suite can read the identifiers the host discloses (got ${JSON.stringify(sent.error ?? sent.result)})`)).toBe('string');
+    const snap = await driver.get(`/runs/${encodeURIComponent(taskId!)}`);
+    const owner = (snap.json as { owner?: { tenant?: unknown; workspace?: unknown; subject?: { subjectId?: unknown; issuer?: unknown } } } | undefined)?.owner;
+    const disclosed = [taskId!.includes('/') ? taskId!.slice(0, taskId!.indexOf('/')) : undefined, owner?.tenant, owner?.workspace, owner?.subject?.subjectId]
+      .filter((x): x is string => typeof x === 'string' && x.length >= 3);
+    expect(disclosed.length, req(R('routing-value'), 'identity.md §5', 'precondition: the run snapshot discloses at least the tenant of record')).toBeGreaterThan(0);
+    for (const r of rs) {
+      for (const id of disclosed) {
+        expect(r.toLowerCase().includes(id.toLowerCase()), req(R('routing-value'), DOC, `a2aTenant ${r} MUST NOT encode a tenant, workspace or principal — it contains the disclosed identifier ${id}`)).toBe(false);
+      }
+    }
+    await rpc(t.url, 'CancelTask', { tenant: entry.a2aTenant, id: taskId });
+  });
+
+  it('GetExtendedAgentCard with tenant R returns that agent\'s card, projected from the entry and the host card', async () => {
+    const t = await target();
+    if (!t.ok) return skip(t, R('card-projection'));
+    const hostIfaces = new Set((t.card.supportedInterfaces ?? []).map(ifaceKey));
+    for (const e of t.routed) {
+      const r = await rpc(t.url, 'GetExtendedAgentCard', { tenant: e.a2aTenant });
+      expect(r.error, req(R('card-projection'), DOC, `GetExtendedAgentCard {tenant: ${e.a2aTenant}} MUST return ${e.agentId}'s card (got ${JSON.stringify(r.error)})`)).toBeUndefined();
+      const card = (r.result ?? {}) as Card;
+      expect(card.name, req(R('card-projection'), DOC, `card.name MUST be the entry's persona (${e.agentId})`)).toBe(e.persona);
+      expect(card.version, req(R('card-projection'), DOC, `card.version MUST be the entry's packVersion (${e.agentId})`)).toBe(e.packVersion);
+      expect(card.description, req(R('card-projection'), DOC, `card.description MUST be the entry's description, else its label (${e.agentId})`)).toBe(e.description ?? e.label);
+      const ifaces = card.supportedInterfaces ?? [];
+      expect(new Set(ifaces.map(ifaceKey)), req(R('card-projection'), DOC, 'supportedInterfaces[] MUST be the host card\'s interfaces ({url, protocolBinding, protocolVersion})')).toEqual(hostIfaces);
+      for (const i of ifaces) expect(i.tenant, req(R('card-projection'), `${DOC}; A2A v1.0.1 AgentInterface.tenant`, `every interface of ${e.agentId}'s card MUST carry tenant: R`)).toBe(e.a2aTenant);
+      expect(card.capabilities, req(R('card-projection'), DOC, 'capabilities MUST equal the host card\'s')).toEqual(t.card.capabilities);
+      expect(card.securitySchemes, req(R('card-projection'), DOC, 'securitySchemes MUST equal the host card\'s')).toEqual(t.card.securitySchemes);
+      expect(card.securityRequirements, req(R('card-projection'), 'RFC 0202 §C.4', 'securityRequirements MUST equal the host card\'s')).toEqual(t.card.securityRequirements);
+      const skills = card.skills ?? [];
+      expect(skills.length, req(R('card-projection'), `${DOC}; A2A AgentCard.skills REQUIRED`, `an entry with a2aTenant has at least one routed workflow, so its card has ≥1 skill (${e.agentId})`)).toBeGreaterThanOrEqual(1);
+      const ids = skills.map((s) => s.id);
+      expect(new Set(ids).size, req(R('card-projection'), 'spec/v2/interop-map.json a2a.card skills[]', 'one skill per routed workflow: skills[].id is unique')).toBe(ids.length);
+      for (const s of skills) {
+        expect(typeof s.id === 'string' && typeof s.name === 'string' && typeof s.description === 'string' && Array.isArray(s.tags), req(R('card-projection'), 'A2A v1.0.1 AgentSkill (id, name, description, tags REQUIRED)', `skill ${JSON.stringify(s)} MUST carry id, name, description and tags`)).toBe(true);
+      }
+      const portfolio = (e.roster ?? []).flatMap((x) => x.workflows ?? []);
+      if (portfolio.length > 0) {
+        for (const id of ids) expect(portfolio, req(R('card-projection'), DOC, `the inventory names ${e.agentId}'s workflows (roster[].workflows); skill ${String(id)} MUST be one of them`)).toContain(id);
+      }
+    }
+  });
+
+  it('the per-agent card carries nothing the inventory entry may not (SR-1)', async () => {
+    const t = await target();
+    if (!t.ok) return skip(t, R('card-sr1'));
+    const fixture = t.routed.find((e) => e.packName === CANARY_PACK);
+    if (fixture === undefined) return softSkip('inapplicable', `the caller's inventory carries no routed agent of ${CANARY_PACK} (conformance/fixtures.md §"Agent Pack Install"), so no canary is installed to look for`);
+    if (fixture.hasHandoffSchemas !== true) return softSkip('blocked', `${fixture.agentId} does not declare handoff schemas — the fixture pack's agent MUST, or the handoff canary is not installed`);
+    const r = await rpc(t.url, 'GetExtendedAgentCard', { tenant: fixture.a2aTenant });
+    expect(r.error, req(R('card-sr1'), DOC, `GetExtendedAgentCard MUST return ${fixture.agentId}'s card (got ${JSON.stringify(r.error)})`)).toBeUndefined();
+    const text = JSON.stringify(r.result ?? {});
+    for (const canary of CANARIES) {
+      expect(text.includes(canary), req(R('card-sr1'), `${DOC}; SR-1`, `the card MUST NOT carry the system-prompt body or a resolved handoff schema — it contains the fixture canary ${canary}`)).toBe(false);
+    }
+  });
+
+  it('an unauthenticated request carrying R is refused exactly as one carrying a never-minted value', async () => {
+    const t = await target();
+    if (!t.ok) return skip(t, R('auth-before-resolve'));
+    const real = t.routed[0]!.a2aTenant!;
+    const a = await rpc(t.url, 'GetExtendedAgentCard', { tenant: real }, null);
+    const b = await rpc(t.url, 'GetExtendedAgentCard', { tenant: neverMinted() }, null);
+    expect(a.result === undefined || (a.result as Card).name === undefined, req(R('auth-before-resolve'), `${DOC}; A2A v1.0.1 §13.1`, `an unauthenticated GetExtendedAgentCard MUST NOT return a card (got HTTP ${a.status} ${JSON.stringify(a.body).slice(0, 200)})`)).toBe(true);
+    expect(a.status >= 400 || a.error !== undefined, req(R('auth-before-resolve'), `${DOC}; A2A v1.0.1 §13.1`, `an unauthenticated request carrying R MUST be refused (got HTTP ${a.status})`)).toBe(true);
+    expect(refusalOf(a), req(R('auth-before-resolve'), `${DOC}; A2A v1.0.1 §13.1 ("Authorization checks MUST occur before any database queries…")`, 'authentication MUST precede resolving R: the refusal for a real R and for a never-minted value MUST be identical (status, code, body)')).toBe(refusalOf(b));
+  });
+
+  it('another tenant\'s R is answered exactly as a never-minted one on every A2A operation', async () => {
+    const t = await target();
+    if (!t.ok) return skip(t, R('identical-refusal'));
+    const f = await foreignAgent(t.entries);
+    if (!f.ok) return softSkip('blocked', f.reason);
+    const theirR = f.entry.a2aTenant!;
+    // Positive control: B's own card resolves for B, so the value is real, not a typo.
+    const own = await rpc(t.url, 'GetExtendedAgentCard', { tenant: theirR }, f.bearer);
+    expect((own.result as Card | undefined)?.name, req(R('identical-refusal'), DOC, `positive control: tenant B's R MUST resolve to B's card for B (got ${JSON.stringify(own.error ?? own.result)})`)).toBe(f.entry.persona);
+    const started: string[] = [];
+    for (const [method, params] of [
+      ['GetExtendedAgentCard', (r: string) => ({ tenant: r })],
+      ['SendMessage', (r: string) => ({ tenant: r, message: message() })],
+      ['ListTasks', (r: string) => ({ tenant: r })],
+    ] as const) {
+      const foreign = await rpc(t.url, method, params(theirR));
+      const unminted = await rpc(t.url, method, params(neverMinted()));
+      for (const x of [foreign, unminted]) { const id = taskIdOf(x); if (method === 'SendMessage' && id !== undefined) started.push(id); }
+      if (method === 'GetExtendedAgentCard') {
+        expect((foreign.result as Card | undefined)?.name === f.entry.persona, req(R('identical-refusal'), DOC, 'tenant A MUST NOT receive tenant B\'s agent card')).toBe(false);
+      }
+      expect(refusalOf(foreign), req(R('identical-refusal'), DOC, `${method} carrying another tenant's R MUST return what it returns for an R the host never minted — same HTTP status, error code and body apart from the JSON-RPC id`)).toBe(refusalOf(unminted));
+    }
+    for (const id of started) await rpc(t.url, 'CancelTask', { id });
+  });
+
+  it('the public card lists no per-agent routing value', async () => {
+    const t = await target();
+    if (!t.ok) return skip(t, R('public-card-no-r'));
+    const seen = new Set(t.routed.map((e) => e.a2aTenant!));
+    const b = process.env.OPENWOP_TEST_TENANT_B_API_KEY;
+    if (b) for (const e of (await inventory(b)).agents) if (typeof e.a2aTenant === 'string') seen.add(e.a2aTenant);
+    for (const withVersion of [false, true]) {
+      const pub = await publicCard(t.cardUrl, withVersion);
+      expect(pub.status, req(R('public-card-no-r'), DOC, `the public card MUST be served ${withVersion ? 'with' : 'without'} A2A-Version`)).toBe(200);
+      const tenants = (pub.card.supportedInterfaces ?? []).map((i) => i.tenant).filter((x): x is string => typeof x === 'string');
+      for (const r of seen) {
+        expect(tenants, req(R('public-card-no-r'), DOC, `the unauthenticated card at agentCardUrl (${withVersion ? 'A2A-Version: 1.0' : 'header-less'}) MUST NOT list any R as an interface tenant`)).not.toContain(r);
+        expect(pub.text.includes(r), req(R('public-card-no-r'), DOC, `the unauthenticated card MUST NOT carry the routing value ${r} anywhere`)).toBe(false);
+      }
+    }
+  });
+
+  it('a task started through R is a run in the caller\'s tenant of record', async () => {
+    const t = await target();
+    if (!t.ok) return skip(t, R('tenant-of-record'));
+    const b = process.env.OPENWOP_TEST_TENANT_B_API_KEY;
+    if (!b || b === process.env.OPENWOP_API_KEY) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set — the leg cannot show the run is invisible to another tenant');
+    const e = t.routed[0]!;
+    const sent = await rpc(t.url, 'SendMessage', { tenant: e.a2aTenant, message: message() });
+    const id = taskIdOf(sent);
+    expect(typeof id, req(R('tenant-of-record'), DOC, `SendMessage {tenant: R} MUST start a task (got ${JSON.stringify(sent.error ?? sent.result)})`)).toBe('string');
+    const mine = await driver.get(`/runs/${encodeURIComponent(id!)}`);
+    expect(mine.status, req(R('tenant-of-record'), 'interop.md §"The operation mappings" Isolation', 'Task.id MUST be a run the caller can read through getRun')).toBe(200);
+    const control = await rpc(t.url, 'SendMessage', { message: message() });
+    const controlId = taskIdOf(control);
+    if (typeof controlId === 'string' && controlId.includes('/') && id!.includes('/')) {
+      expect(id!.slice(0, id!.indexOf('/')), req(R('tenant-of-record'), `${DOC}; identity.md §5`, 'the run MUST carry the caller\'s tenant segment — the same one a run started on the host interface carries')).toBe(controlId.slice(0, controlId.indexOf('/')));
+    }
+    const theirs = await driver.get(`/runs/${encodeURIComponent(id!)}`, { authenticated: false, headers: { Authorization: `Bearer ${b}` } });
+    expect(theirs.status >= 200 && theirs.status < 300, req(R('tenant-of-record'), `${DOC}; interop.md Isolation`, `R is resolved within the caller's tenant: another tenant MUST NOT read the run (got ${theirs.status})`)).toBe(false);
+    await rpc(t.url, 'CancelTask', { id });
+    if (typeof controlId === 'string') await rpc(t.url, 'CancelTask', { id: controlId });
+  });
+});

package/src/scenarios/v2-a2a-operation-map.test.ts

@@ -0,0 +1,310 @@
+/**
+ * RFC 0208 §B–§E — the host as an A2A 1.0 server, held to the rows of
+ * `spec/v2/interop-map.json` (`spec/v2/core/interop.md` §"The operation
+ * mappings"). Target major 2.
+ *
+ * Gate: the v2 `a2a` record lists profile `a2a-1.0` (a host serving an A2A
+ * interface). A host that advertises `a2a` for its client path only (no
+ * `a2a-1.0` profile) is `inapplicable` here — it serves no interface to hold.
+ * A host that claims the profile MUST advertise `agentCardUrl`, and the card
+ * MUST list a JSONRPC interface at 1.0 (the `a2a.card` supportedInterfaces row);
+ * every request carries `A2A-Version: 1.0`.
+ *
+ * Skill routing (a suite requirement, `conformance/fixtures.md`, not a spec
+ * MUST): an A2A 1.0 `Message` carries no skill selector — the caller picks the
+ * agent and the agent picks the skill — so the legs that start a task need the
+ * host's interface to route to exactly one skill, `conformance-approval`
+ * (skill id = workflowId, the `a2a.card` skills[] row). A card listing another
+ * or several skills records `blocked`: the suite cannot choose one.
+ *
+ * Every leg starts its own task(s), so no leg depends on another's side effect.
+ * `a2a-list-scoped` needs `OPENWOP_TEST_TENANT_B_API_KEY`, a credential bound to
+ * a SECOND tenant; without it the leg is `blocked`, never passed.
+ *
+ * @see spec/v2/core/interop.md §"The operation mappings" (Isolation, A2A multi-turn)
+ * @see spec/v2/interop-map.json a2a.operations / a2a.taskState / a2a.errors
+ * @see RFCS/0208-v2-a2a-mcp-operation-mappings.md §C, §D, §E
+ * @see RFCS/0199-outbound-oauth-client-and-credential-interrupt.md §D.1 (the credential leg; interop-map.json a2a.taskState override row)
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
+import { SEAMS_PREFIX } from '../lib/seams.js';
+
+export const HOST_CALLBACK_NOT_REQUIRED = 'the suite is the A2A client: every leg POSTs JSON-RPC to the interface the host\'s own card lists; nothing harness-hosted is handed to the host';
+
+const DOC = 'spec/v2/core/interop.md §"The operation mappings" (RFC 0208)';
+const PROFILE = 'a2a-1.0';
+const SKILL = 'conformance-approval';
+const R = (slug: string): string => `openwop.requirement.0208.${slug}`;
+const ACCEPT = { action: 'accept' };
+
+interface MapStateRow { runStatus: string; wire: string; interruptKind?: string }
+const MAP = JSON.parse(readFileSync(join(SCHEMAS_DIR, '..', 'spec', 'v2', 'interop-map.json'), 'utf8')) as { a2a: { taskState: MapStateRow[] } };
+/** The map's forward projection (default rows only; an `interruptKind` override needs its interrupt kind). */
+const WIRE_OF = new Map(MAP.a2a.taskState.filter((r) => r.interruptKind === undefined).map((r) => [r.runStatus, r.wire]));
+/** RFC 0199 §D.1 — the override row for a run suspended on a `credential` interrupt. */
+const CREDENTIAL_WIRE = MAP.a2a.taskState.find((r) => r.runStatus === 'waiting-input' && r.interruptKind === 'credential')?.wire;
+
+interface RpcError { code: number; message?: string; data?: unknown }
+interface Rpc { status: number; result?: Record<string, unknown> | undefined; error?: RpcError | undefined }
+interface Task { id?: string; contextId?: string; status?: { state?: string } }
+
+async function rpc(url: string, method: string, params: unknown, opts: { bearer?: string; version?: string } = {}): Promise<Rpc> {
+  const headers: Record<string, string> = { 'content-type': 'application/json', accept: 'application/json', 'A2A-Version': opts.version ?? '1.0' };
+  const key = opts.bearer ?? process.env.OPENWOP_API_KEY;
+  if (key) headers['authorization'] = `Bearer ${key}`;
+  const res = await fetch(url, { method: 'POST', headers, body: JSON.stringify({ jsonrpc: '2.0', id: randomBytes(4).readUInt32BE(0), method, params }) });
+  const body = (await res.json().catch(() => ({}))) as { result?: Record<string, unknown>; error?: RpcError };
+  return { status: res.status, ...body };
+}
+
+/** `SendMessageResponse` is a oneof `{ task } | { message }`; a run-backed answer is a task. */
+function taskOf(r: Rpc): Task | undefined {
+  const res = r.result ?? {};
+  const t = (res['task'] ?? (res['id'] !== undefined ? res : undefined)) as Task | undefined;
+  return t;
+}
+
+type Target = { ok: true; url: string } | { ok: false; kind: 'inapplicable' | 'blocked'; reason: string } | { ok: false; kind: 'fail'; reason: string };
+
+/** The JSON-RPC 1.0 interface the host's own card lists, and whether it routes the one suite skill. */
+async function target(needsSkill: boolean): Promise<Target> {
+  if (!(await v2Discovery())) return { ok: false, kind: 'blocked', reason: 'v2 discovery unreachable' };
+  const a2a = await familyAdvertised('a2a');
+  if (!a2a) return { ok: false, kind: 'inapplicable', reason: 'a2a not advertised at major 2' };
+  const profiles = Array.isArray(a2a['profiles']) ? (a2a['profiles'] as unknown[]) : [];
+  if (!profiles.includes(PROFILE)) return { ok: false, kind: 'inapplicable', reason: 'a2a is advertised without profile a2a-1.0 — the host serves no A2A interface (client path only)' };
+  const cardUrl = a2a['agentCardUrl'];
+  if (typeof cardUrl !== 'string') return { ok: false, kind: 'fail', reason: 'a host claiming profile a2a-1.0 MUST advertise a2a.agentCardUrl' };
+  const res = await fetch(cardUrl, { headers: { accept: 'application/json', 'A2A-Version': '1.0' } });
+  if (res.status !== 200) return { ok: false, kind: 'fail', reason: `the advertised agentCardUrl answered ${res.status}` };
+  const card = (await res.json().catch(() => ({}))) as { supportedInterfaces?: Array<{ url?: string; protocolBinding?: string; protocolVersion?: string }>; skills?: Array<{ id?: string }> };
+  const iface = (card.supportedInterfaces ?? []).find((i) => i.protocolBinding === 'JSONRPC' && i.protocolVersion === '1.0');
+  if (typeof iface?.url !== 'string') return { ok: false, kind: 'fail', reason: 'the a2a.card supportedInterfaces row: claiming a2a-1.0 requires a JSONRPC interface at 1.0 in the card' };
+  if (needsSkill) {
+    const skills = (card.skills ?? []).map((s) => s.id);
+    if (skills.length !== 1 || skills[0] !== SKILL) return { ok: false, kind: 'blocked', reason: `the card routes skills [${skills.join(', ')}]; A2A 1.0 carries no skill selector, so the suite needs the interface to route exactly one skill, ${SKILL} (conformance/fixtures.md)` };
+    if (!isFixtureAdvertised(SKILL)) return { ok: false, kind: 'blocked', reason: `fixture ${SKILL} is not in the advertised fixtures[]` };
+  }
+  return { ok: true, url: iface.url };
+}
+
+function skip(t: Exclude<Target, { ok: true }>, id: string): undefined {
+  if (t.kind === 'fail') { expect(t.reason, req(id, DOC, t.reason)).toBe(''); return undefined; }
+  return softSkip(t.kind, t.reason);
+}
+
+const message = (extra: Record<string, unknown> = {}): Record<string, unknown> => ({ messageId: `conf-0208-${randomBytes(8).toString('hex')}`, role: 'ROLE_USER', parts: [{ text: 'openwop conformance RFC 0208' }], ...extra });
+const acceptMessage = (taskId: string, extra: Record<string, unknown> = {}): Record<string, unknown> => message({ taskId, parts: [{ data: ACCEPT }], metadata: { openwop: { interrupt: ACCEPT } }, ...extra });
+
+async function startApprovalTask(url: string, bearer?: string): Promise<{ rpc: Rpc; task: Task | undefined }> {
+  const r = await rpc(url, 'SendMessage', { message: message() }, bearer === undefined ? {} : { bearer });
+  return { rpc: r, task: taskOf(r) };
+}
+
+async function runStatus(taskId: string): Promise<string | undefined> {
+  const r = await driver.get(`/runs/${encodeURIComponent(taskId)}`);
+  return r.status === 200 ? ((r.json as { status?: string }).status) : undefined;
+}
+async function eventCount(taskId: string): Promise<number> {
+  const r = await driver.get(`/runs/${encodeURIComponent(taskId)}/events/poll?timeout=1`);
+  return Array.isArray((r.json as { events?: unknown[] } | undefined)?.events) ? ((r.json as { events: unknown[] }).events.length) : -1;
+}
+async function settle(taskId: string, want: (s: string | undefined) => boolean, ms = 8000): Promise<string | undefined> {
+  const end = Date.now() + ms;
+  let s = await runStatus(taskId);
+  while (!want(s) && Date.now() < end) { await new Promise((ok) => setTimeout(ok, 100)); s = await runStatus(taskId); }
+  return s;
+}
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+describe('RFC 0208 — v2-a2a-operation-map (host as A2A 1.0 server, gated on a2a.profiles ∋ a2a-1.0)', () => {
+  it('a message carrying taskId without contextId is answered with the task\'s contextId', async () => {
+    const t = await target(true);
+    if (!t.ok) return skip(t, R('a2a-context-inferred'));
+    const first = await startApprovalTask(t.url);
+    expect(first.rpc.error, req(R('a2a-context-inferred'), DOC, `SendMessage (no taskId) MUST start a run of the routed skill: ${JSON.stringify(first.rpc.error)}`)).toBeUndefined();
+    expect(first.task?.status?.state, req(R('a2a-context-inferred'), DOC, 'a run at waiting-approval projects as TASK_STATE_INPUT_REQUIRED (a2a.taskState)')).toBe(WIRE_OF.get('waiting-approval'));
+    const ctx = first.task?.contextId;
+    expect(typeof ctx === 'string' && ctx.length > 0, req(R('a2a-context-inferred'), DOC, 'the Task MUST carry a contextId (Message.contextId row: persisted as A2ATaskState.contextId)')).toBe(true);
+    const reply = await rpc(t.url, 'SendMessage', { message: acceptMessage(first.task!.id!) });
+    expect(reply.error, req(R('a2a-context-inferred'), DOC, `a message resolving the open interrupt by taskId MUST be accepted: ${JSON.stringify(reply.error)}`)).toBeUndefined();
+    expect(taskOf(reply)?.contextId, req(R('a2a-context-inferred'), 'interop.md §"A2A multi-turn" (A2A §3.4.3)', 'a message carrying taskId without contextId MUST be answered with the task\'s contextId — not a fresh one, not omitted')).toBe(ctx);
+    await settle(first.task!.id!, (s) => s !== undefined && TERMINAL.has(s));
+  });
+
+  it('a message whose contextId is not its task\'s is refused invalid-parameters and changes nothing', async () => {
+    const t = await target(true);
+    if (!t.ok) return skip(t, R('a2a-context-mismatch-refused'));
+    const first = await startApprovalTask(t.url);
+    const id = first.task?.id;
+    expect(typeof id, req(R('a2a-context-mismatch-refused'), DOC, `SendMessage MUST start a task: ${JSON.stringify(first.rpc.error)}`)).toBe('string');
+    await settle(id!, (s) => s === 'waiting-approval');
+    const before = await eventCount(id!);
+    const bad = await rpc(t.url, 'SendMessage', { message: acceptMessage(id!, { contextId: `ctx-mismatch-${randomBytes(6).toString('hex')}` }) });
+    expect(bad.error?.code, req(R('a2a-context-mismatch-refused'), 'interop.md §"A2A multi-turn"; a2a.errors (invalid parameters)', `a message whose contextId is not its task's MUST be refused with the JSON-RPC invalid-parameters error -32602 (got ${JSON.stringify(bad.error ?? bad.result)})`)).toBe(-32602);
+    expect(await runStatus(id!), req(R('a2a-context-mismatch-refused'), DOC, 'the refused message MUST NOT change the run: it is still waiting-approval (the interrupt did not resolve)')).toBe('waiting-approval');
+    expect(await eventCount(id!), req(R('a2a-context-mismatch-refused'), DOC, 'the refused message MUST NOT append an event to the run')).toBe(before);
+    await rpc(t.url, 'CancelTask', { id });
+  });
+
+  it('a message to a retained terminal task is refused UnsupportedOperationError, and appends no event', async () => {
+    const t = await target(true);
+    if (!t.ok) return skip(t, R('a2a-terminal-unsupported'));
+    const first = await startApprovalTask(t.url);
+    const id = first.task?.id;
+    expect(typeof id, req(R('a2a-terminal-unsupported'), DOC, `SendMessage MUST start a task: ${JSON.stringify(first.rpc.error)}`)).toBe('string');
+    await rpc(t.url, 'SendMessage', { message: acceptMessage(id!) });
+    const status = await settle(id!, (s) => s !== undefined && TERMINAL.has(s));
+    expect(status, req(R('a2a-terminal-unsupported'), DOC, 'precondition: the accepted approval task reaches completed and stays readable through getRun (retained)')).toBe('completed');
+    const before = await eventCount(id!);
+    const late = await rpc(t.url, 'SendMessage', { message: message({ taskId: id }) });
+    expect(late.error?.code, req(R('a2a-terminal-unsupported'), 'interop.md §"A2A multi-turn"; a2a.operations SendMessage (taskId, run terminal and retained)', `a message to a retained terminal task MUST be refused UnsupportedOperationError -32004, not TaskNotFoundError -32001 (got ${JSON.stringify(late.error ?? late.result)})`)).toBe(-32004);
+    expect(await eventCount(id!), req(R('a2a-terminal-unsupported'), DOC, 'the refusal appends no event (a2a.operations: "No event is appended")')).toBe(before);
+  });
+
+  it('an unknown task and another tenant\'s task are answered by the same TaskNotFoundError', async () => {
+    const t = await target(true);
+    if (!t.ok) return skip(t, R('a2a-unreadable-not-found'));
+    const first = await startApprovalTask(t.url);
+    const id = first.task?.id;
+    expect(typeof id === 'string' && id.includes('/'), req(R('a2a-unreadable-not-found'), 'identity.md §5; a2a.operations GetTask', `Task.id is the tenant-bound runId <tenant>/<opaque> (got ${JSON.stringify(id)})`)).toBe(true);
+    const [tenant, opaque] = [id!.slice(0, id!.indexOf('/')), id!.slice(id!.indexOf('/') + 1)];
+    const fabricated = `${tenant}/${randomBytes(16).toString('base64url').replace(/[^A-Za-z0-9]/g, 'x').slice(0, 22)}`;
+    const foreign = `zz-conformance-foreign/${opaque}`;
+    const a = await rpc(t.url, 'GetTask', { id: fabricated });
+    const b = await rpc(t.url, 'GetTask', { id: foreign });
+    expect(a.error?.code, req(R('a2a-unreadable-not-found'), 'a2a.errors TaskNotFoundError', `an unknown task MUST be TaskNotFoundError -32001 (got ${JSON.stringify(a.error ?? a.result)})`)).toBe(-32001);
+    expect(b.error?.code, req(R('a2a-unreadable-not-found'), 'interop.md §"The operation mappings" Isolation', `a task the caller cannot read — here a foreign tenant segment REST refuses 403 — MUST be answered exactly as a nonexistent one, -32001 (got ${JSON.stringify(b.error ?? b.result)}, HTTP ${b.status})`)).toBe(-32001);
+    const shape = (e: RpcError | undefined): string => JSON.stringify({ http: e === undefined ? null : 'rpc', dataKeys: e?.data && typeof e.data === 'object' ? Object.keys(e.data as object).sort() : typeof e?.data });
+    expect(shape(b.error) + String(b.status), req(R('a2a-unreadable-not-found'), 'interop.md §"The operation mappings" Isolation (A2A 1.0.1 §3.3.2)', 'the foreign-tenant answer MUST be indistinguishable from the unknown-id answer: same HTTP status and the same error.data shape')).toBe(shape(a.error) + String(a.status));
+    await rpc(t.url, 'CancelTask', { id });
+  });
+
+  it('Task.status.state is the map\'s projection of the run status at every observed state', async () => {
+    const t = await target(true);
+    if (!t.ok) return skip(t, R('a2a-state-projection'));
+    const observed: string[] = [];
+    const check = async (id: string, label: string): Promise<void> => {
+      const status = await runStatus(id);
+      const got = taskOf(await rpc(t.url, 'GetTask', { id }))?.status?.state;
+      observed.push(`${label}: run ${String(status)} → ${String(got)}`);
+      expect(got, req(R('a2a-state-projection'), 'interop-map.json a2a.taskState', `GetTask state MUST equal taskState[${String(status)}].wire (${String(WIRE_OF.get(String(status)))}); observed ${observed.join('; ')}`)).toBe(WIRE_OF.get(String(status)));
+    };
+    const one = (await startApprovalTask(t.url)).task?.id;
+    const two = (await startApprovalTask(t.url)).task?.id;
+    expect(typeof one === 'string' && typeof two === 'string', req(R('a2a-state-projection'), DOC, 'SendMessage MUST start tasks')).toBe(true);
+    await settle(one!, (s) => s === 'waiting-approval');
+    await check(one!, 'suspended');
+    await rpc(t.url, 'SendMessage', { message: acceptMessage(one!) });
+    await settle(one!, (s) => s !== undefined && TERMINAL.has(s));
+    await check(one!, 'accepted');
+    await settle(two!, (s) => s === 'waiting-approval');
+    const cancel = await rpc(t.url, 'CancelTask', { id: two });
+    expect([WIRE_OF.get('cancelling'), WIRE_OF.get('cancelled')], req(R('a2a-state-projection'), 'a2a.operations CancelTask', `CancelTask answers the Task at TASK_STATE_WORKING while cancelling, TASK_STATE_CANCELED once cancelled (got ${JSON.stringify(cancel.error ?? taskOf(cancel)?.status)})`)).toContain(taskOf(cancel)?.status?.state);
+    await settle(two!, (s) => s !== undefined && TERMINAL.has(s));
+    await check(two!, 'cancelled');
+  });
+
+  it('the JSON-RPC error codes the suite can cause are the A2A 1.0.1 codes', async () => {
+    const t = await target(true);
+    if (!t.ok) return skip(t, R('a2a-error-codes'));
+    const first = await startApprovalTask(t.url);
+    const id = first.task?.id;
+    expect(typeof id, req(R('a2a-error-codes'), DOC, 'SendMessage MUST start a task')).toBe('string');
+    await rpc(t.url, 'SendMessage', { message: acceptMessage(id!) });
+    await settle(id!, (s) => s !== undefined && TERMINAL.has(s));
+    const cancel = await rpc(t.url, 'CancelTask', { id });
+    expect(cancel.error?.code, req(R('a2a-error-codes'), 'a2a.errors TaskNotCancelableError', `CancelTask on a terminal run MUST be TaskNotCancelableError -32002 (got ${JSON.stringify(cancel.error ?? cancel.result)})`)).toBe(-32002);
+    const version = await rpc(t.url, 'GetTask', { id }, { version: '9.9' });
+    expect(version.error?.code, req(R('a2a-error-codes'), 'a2a.errors VersionNotSupportedError', `an A2A-Version the interface does not serve MUST be VersionNotSupportedError -32009 (got ${JSON.stringify(version.error ?? version.result)})`)).toBe(-32009);
+  });
+
+  it('a row whose requires facet is not advertised is refused with the row\'s error', async () => {
+    const t = await target(true);
+    if (!t.ok) return skip(t, R('row-requires-refused'));
+    const a2a = (await familyAdvertised('a2a'))!;
+    if (a2a['streaming'] === true) return softSkip('inapplicable', 'a2a.streaming is advertised — SubscribeToTask is a served row here, not a refused one');
+    const first = await startApprovalTask(t.url);
+    const id = first.task?.id;
+    expect(typeof id, req(R('row-requires-refused'), DOC, 'SendMessage MUST start a task')).toBe('string');
+    const sub = await rpc(t.url, 'SubscribeToTask', { id });
+    expect(sub.error?.code, req(R('row-requires-refused'), 'interop.md §"The operation mappings"; a2a.operations SubscribeToTask requires a2a.streaming', `a host not advertising a2a.streaming MUST refuse SubscribeToTask with UnsupportedOperationError -32004 (got ${JSON.stringify(sub.error ?? sub.result)})`)).toBe(-32004);
+    await rpc(t.url, 'CancelTask', { id });
+  });
+
+  it('ListTasks returns only what listRuns returns to the same Subject; tenant and contextId never select', async () => {
+    const other = process.env.OPENWOP_TEST_TENANT_B_API_KEY;
+    if (!other) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set — the cross-caller leg cannot run');
+    const t = await target(true);
+    if (!t.ok) return skip(t, R('a2a-list-scoped'));
+    const mine = await startApprovalTask(t.url);
+    const theirs = await startApprovalTask(t.url, other);
+    const id = mine.task?.id;
+    const ctx = mine.task?.contextId;
+    const theirId = theirs.task?.id;
+    if (typeof id !== 'string' || typeof theirId !== 'string' || !id.includes('/')) {
+      expect(typeof id === 'string' && typeof theirId === 'string', req(R('a2a-list-scoped'), DOC, `SendMessage MUST start a task under both credentials: ${JSON.stringify(mine.rpc.error ?? theirs.rpc.error)}`)).toBe(true);
+    }
+    const tenantA = id!.slice(0, id!.indexOf('/'));
+    if (theirId!.startsWith(`${tenantA}/`)) {
+      await rpc(t.url, 'CancelTask', { id });
+      await rpc(t.url, 'CancelTask', { id: theirId }, { bearer: other });
+      return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY binds the same tenant as OPENWOP_API_KEY — the leg needs a second tenant');
+    }
+    const ids = (r: Rpc): string[] => (Array.isArray(r.result?.['tasks']) ? (r.result!['tasks'] as Task[]).map((x) => String(x.id)) : []);
+    const own = await rpc(t.url, 'ListTasks', { contextId: ctx });
+    expect(ids(own), req(R('a2a-list-scoped'), 'a2a.operations ListTasks', `positive control: the owner's ListTasks filtered by the task's contextId MUST list it (got ${JSON.stringify(own.error ?? own.result)})`)).toContain(id);
+    const plain = await rpc(t.url, 'ListTasks', {}, { bearer: other });
+    expect(plain.error, req(R('a2a-list-scoped'), 'a2a.operations ListTasks', `ListTasks MUST be served to the second caller: ${JSON.stringify(plain.error)}`)).toBeUndefined();
+    expect(ids(plain).filter((x) => x.startsWith(`${tenantA}/`)), req(R('a2a-list-scoped'), 'interop.md §"The operation mappings" Isolation', 'ListTasks MUST return only runs listRuns would return to the same Subject — no task of another tenant')).toEqual([]);
+    const hinted = await rpc(t.url, 'ListTasks', { tenant: tenantA, contextId: ctx }, { bearer: other });
+    expect(ids(hinted).filter((x) => x.startsWith(`${tenantA}/`)), req(R('a2a-list-scoped'), 'interop.md §"The operation mappings" Isolation', '`tenant` and `contextId` never select a tenant: naming the owner\'s tenant and contextId MUST NOT reveal the owner\'s task')).toEqual([]);
+    const peek = await rpc(t.url, 'GetTask', { id }, { bearer: other });
+    expect(peek.error?.code, req(R('a2a-list-scoped'), 'interop.md §"The operation mappings" Isolation', `another tenant's real task MUST be TaskNotFoundError for this caller (got ${JSON.stringify(peek.error ?? peek.result)})`)).toBe(-32001);
+    await rpc(t.url, 'CancelTask', { id });
+    await rpc(t.url, 'CancelTask', { id: theirId }, { bearer: other });
+  });
+
+  it('a run suspended on a credential interrupt projects to TASK_STATE_AUTH_REQUIRED, naming the provider and carrying connectUrl', async () => {
+    const id = 'openwop.requirement.0199.a2a-auth-required';
+    const t = await target(false);
+    if (!t.ok) return skip(t, id);
+    const oauth = await familyAdvertised('oauth');
+    if (oauth?.['credentialInterrupt'] !== true) return softSkip('inapplicable', 'oauth.credentialInterrupt is not advertised — the host raises no credential interrupt to project (RFC 0199 §C.1)');
+    if (!isFixtureAdvertised('conformance-credential')) return softSkip('blocked', 'fixture conformance-credential is not in the advertised fixtures[]');
+    // A fresh Subject, so no credential another scenario acquired satisfies the node.
+    const minted = await driver.post(`${SEAMS_PREFIX}/sample/auth/credential/mint`, { lane: 'api-key' }).catch(() => null);
+    const bearer = (minted?.json as { credential?: unknown } | undefined)?.credential;
+    if (typeof bearer !== 'string') return softSkip('blocked', 'the credential mint seam did not mint a fresh Subject — a Subject that may already hold a credential makes the leg vacuous');
+    const created = await driver.post('/runs', { workflowId: 'conformance-credential', inputs: {} }, { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } });
+    const runId = (created.json as { runId?: string } | undefined)?.runId;
+    expect(typeof runId, req(id, 'runs.md createRun', `createRun of conformance-credential MUST be accepted (got ${created.status})`)).toBe('string');
+    const end = Date.now() + 8000;
+    let snap = await driver.get(`/runs/${encodeURIComponent(runId!)}`, { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } });
+    while ((snap.json as { status?: string } | undefined)?.status !== 'waiting-input' && Date.now() < end) {
+      await new Promise((ok) => setTimeout(ok, 100));
+      snap = await driver.get(`/runs/${encodeURIComponent(runId!)}`, { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } });
+    }
+    expect((snap.json as { status?: string } | undefined)?.status, req(id, 'oauth.md §The credential interrupt', 'precondition: the run suspends on the credential interrupt (waiting-input)')).toBe('waiting-input');
+    const got = await rpc(t.url, 'GetTask', { id: runId }, { bearer });
+    const task = taskOf(got) as (Task & { status?: { state?: string; message?: { parts?: Array<{ text?: string }> } }; metadata?: { openwop?: { interrupt?: { kind?: string } } } }) | undefined;
+    expect(CREDENTIAL_WIRE, req(id, 'interop-map.json a2a.taskState', 'the map carries the (waiting-input, credential) override row')).toBe('TASK_STATE_AUTH_REQUIRED');
+    expect(task?.status?.state, req(id, 'interop.md §The durable-task projection; interop-map.json a2a.taskState (waiting-input, credential)', `a run suspended on a credential interrupt MUST project to TASK_STATE_AUTH_REQUIRED, not INPUT_REQUIRED (got ${JSON.stringify(got.error ?? task?.status)})`)).toBe(CREDENTIAL_WIRE);
+    expect(task?.metadata?.openwop?.interrupt?.kind, req(id, 'RFC 0199 §D.1', 'metadata.openwop.interrupt.kind (the interruptKind carrier) MUST be credential')).toBe('credential');
+    const text = (task?.status?.message?.parts ?? []).map((p) => p.text ?? '').join(' ');
+    const events = await driver.get(`/runs/${encodeURIComponent(runId!)}/events/poll?timeout=1`, { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } });
+    const asked = ((events.json as { events?: Array<{ type?: string; payload?: { kind?: string; data?: { connectUrl?: string; provider?: string } } }> } | undefined)?.events ?? []).find((e) => e.type === 'interrupt.requested' && e.payload?.kind === 'credential');
+    const connectUrl = asked?.payload?.data?.connectUrl ?? '\u0000';
+    expect(text.includes(connectUrl) && text.includes(asked?.payload?.data?.provider ?? '\u0000'), req(id, 'RFC 0199 §D.1 (A2A v1.0.1 §7.6.1)', `the TaskStatus message MUST name the provider and carry connectUrl (got ${JSON.stringify(text)})`)).toBe(true);
+    await driver.post(`/runs/${encodeURIComponent(runId!)}:cancel`, {}, { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } });
+  });
+});