@openwop/openwop-conformance 2.35.0 → 2.36.0

package/src/scenarios/v2-lane-issuer-advertised.test.ts

@@ -5,8 +5,25 @@
  * Witness class: witnessable — unaided. Every member of `auth.lanes[]` MUST
  * name `lane`, `issuers[]` (min 1, the realm), `revocation` and
  * `minimumAssurance`; `revocationWindowSeconds` MUST accompany a rule that
- * names a window (`exp-and-recheck`, `short-lived`, `rebind`). A host that does
+ * names a window (`exp-and-recheck`, `exp-only`, `short-lived`, `rebind`). A host that does
  * not advertise the `auth` family records `inapplicable`.
+ *
+ * Third leg (suite 2.36.0): a lane advertises only a revocation rule that
+ * `identity.md` §2.2's row FOR THAT LANE lists. §2.2 has stated the per-lane
+ * rule since RFC 0170 §B.3, and until now nothing measured it: the facet schema
+ * relates `revocation` to `lane` nowhere, and the two legs above check only
+ * enum membership and window presence. So any of the nine values passed on any
+ * of the ten lanes, which is how `short-lived` — a rule §2.2 defines only for
+ * `mtls`, as an obligation on the CREDENTIAL ISSUER — came to be advertised on
+ * an `oidc` lane by a host that performs no revocation re-check at all.
+ *
+ * `LANE_RULES` below is the §2.2 table, transcribed. It is not a second
+ * declaration: `scripts/check-lane-revocation-rules.mjs` parses the table out
+ * of `spec/v2/core/identity.md` and fails when this map, the table and the
+ * facet schema's `revocation` enum disagree. `anonymous` is `null` — its §2.2
+ * row's revocation cell is `—` while the facet schema REQUIRES the field, so
+ * the table names no legal value for it; the leg exempts that one lane and
+ * says so in its message rather than inventing a rule (RFC 0210 register G1).
  */
 
 import { describe, it, expect } from 'vitest';
@@ -16,11 +33,27 @@ import { req } from '../lib/requirement-ids.js';
 
 const DOC = 'spec/v2/core/identity.md §2.1';
 const LANES = new Set(['api-key', 'oauth2', 'oidc', 'mtls', 'saml', 'scim', 'ldap', 'workload', 'session', 'anonymous']);
-const REVOCATION = new Set(['next-request', 'exp-and-recheck', 'crl', 'ocsp', 'short-lived', 'not-on-or-after', 'bound-connection', 'rebind', 'delegation-expiry']);
-const WINDOWED = new Set(['exp-and-recheck', 'short-lived', 'rebind']);
+const REVOCATION = new Set(['next-request', 'exp-and-recheck', 'exp-only', 'crl', 'ocsp', 'short-lived', 'not-on-or-after', 'bound-connection', 'rebind', 'delegation-expiry']);
+const WINDOWED = new Set(['exp-and-recheck', 'exp-only', 'short-lived', 'rebind']);
 const ASSURANCE = new Set(['bearer', 'sender-constrained', 'key-bound']);
 const PROOFS = new Set(['mtls-key-binding', 'dpop', 'svid-chain']);
 
+// LANE_RULES — `spec/v2/core/identity.md` §2.2, `revocation` column, one entry
+// per lane. `null` means the table names no rule for that lane. Parsed by
+// scripts/check-lane-revocation-rules.mjs; keep the literal shape.
+const LANE_RULES: Record<string, string[] | null> = {
+  'api-key': ['next-request'],
+  'oauth2': ['exp-and-recheck', 'exp-only'],
+  'oidc': ['exp-and-recheck', 'exp-only'],
+  'mtls': ['crl', 'ocsp', 'short-lived'],
+  'saml': ['not-on-or-after'],
+  'scim': ['bound-connection'],
+  'ldap': ['rebind'],
+  'workload': ['delegation-expiry'],
+  'session': ['next-request'],
+  'anonymous': null,
+};
+
 async function lanes(): Promise<Array<Record<string, unknown>> | { reason: string }> {
   let doc: Record<string, unknown> | null;
   try { doc = await v2Discovery(); } catch { doc = null; }
@@ -59,4 +92,20 @@ describe('v2 lane-issuer-advertised (RFC 0170 §B.2–§B.4)', () => {
       expect(Number.isInteger(w) && (w as number) >= 1, req('openwop.requirement.0170.lane-issuer-advertised.window', 'spec/v2/core/identity.md §2.2', `lane ${String(l['lane'])} (revocation ${String(l['revocation'])}) MUST advertise revocationWindowSeconds (integer ≥ 1)`)).toBe(true);
     }
   });
+
+  it('a lane advertises only a revocation rule its identity.md §2.2 row lists', async () => {
+    const ls = await lanes();
+    if (!Array.isArray(ls)) return softSkip(ls.reason.startsWith('FAIL-SHAPED') ? 'blocked' : 'inapplicable', ls.reason);
+    // Only lanes the table constrains are measured. `anonymous` is exempt
+    // because §2.2 names no rule for it at all (RFC 0210 register G1), not
+    // because any value is acceptable there.
+    const bound = ls.filter((l) => LANE_RULES[String(l['lane'])] != null);
+    if (bound.length === 0) return softSkip('inapplicable', `no advertised lane has a revocation rule stated in identity.md §2.2 (advertised: ${ls.map((l) => String(l['lane'])).join(', ') || 'none'}; the anonymous lane is exempt, its §2.2 revocation cell is "—")`);
+    for (const l of bound) {
+      const name = String(l['lane']);
+      const rule = String(l['revocation']);
+      const allowed = LANE_RULES[name] as string[];
+      expect(allowed.includes(rule), req('openwop.requirement.0170.lane-issuer-advertised.lane-rule', 'spec/v2/core/identity.md §2.2', `lane ${name} advertises revocation "${rule}", which §2.2's row for that lane does not list (it lists ${allowed.map((r) => `"${r}"`).join(' | ')}) — a host MUST NOT advertise a revocation rule its lane's row does not name`)).toBe(true);
+    }
+  });
 });

package/src/scenarios/v2-mcp-client-results.test.ts

@@ -0,0 +1,202 @@
+/**
+ * RFC 0204 §A — the v2 host MCP client returns MCP results (suite 2.36.0,
+ * target major 2; gated on `mcp.client` + the `conformance-mcp-client` fixture).
+ *
+ * `spec/v2/core/host-services.md` §`mcp`: a host advertising `mcp.client`
+ * exposes `ctx.mcp.callTool` / `listTools` / `readResource` / `serverHealth`
+ * to pack code, and each resolves to the MCP result UNALTERED. The fixture's
+ * node calls the host's own `ctx.mcp.<method>` with the run's inputs and
+ * records the resolved value as `node.completed.outputs.result` (the v2
+ * RunSnapshot carries no run outputs, so the event log is the observation
+ * path — `GET /runs/{runId}/events/poll`).
+ *
+ * The expected value is never read from the host. Every leg compares the host's
+ * output with the JSON-RPC result the suite's own fake MCP server recorded
+ * sending (`McpFakeServer.exchanges()`), so a host that re-wraps, drops `_meta`,
+ * merges pages or answers from a stub cannot reproduce it.
+ *
+ *   call-tool-verbatim       structured-echo with a per-run nonce → deep-equal
+ *                            to the server's CallToolResult, `_meta` included;
+ *   call-tool-iserror-resolves  always-error → the run completes and resolves
+ *                            `isError: true` with the server's `content[]`;
+ *   list-tools-page          run 1: one page, deep-equal, with `nextCursor`;
+ *                            run 2 with that cursor: the server saw the cursor,
+ *                            the page is deep-equal and has no `nextCursor`;
+ *   server-health            `conformance` → reachable + the DiscoverResult;
+ *                            `conformance.down` → unreachable; never
+ *                            `connected` / `disconnected`;
+ *   reject-unknown-server    an unconfigured `serverId` fails the node
+ *                            `not_found`.
+ *
+ * Sabotage (RFC 0204 §Conformance), each run once against the v2 reference
+ * host: resolve `{ result }`; strip `_meta`; throw on `isError`; merge pages;
+ * drop the cursor; report `connected`; report `reachable` always; resolve
+ * `undefined` for an unknown id — each turns its row red.
+ *
+ * @see spec/v2/core/host-services.md §mcp
+ * @see RFCS/0204-host-mcp-client-returns-mcp-results.md §A
+ * @see conformance/fixtures.md §"The `ctx.mcp` fixture (RFC 0204)"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { randomUUID } from 'node:crypto';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { getMcpFakeServer, ALWAYS_ERROR_CONTENT, TOOLS_PAGE_SIZE, type McpExchange, type McpFakeServer } from '../lib/mcp-fake-server.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+export const REQUIRES_HOST_CALLBACK = "the host's ctx.mcp client calls the suite's fake MCP server (serverId \"conformance\")";
+
+const FIXTURE = 'conformance-mcp-client';
+const NODE_ID = 'mcp-client';
+const DOC = 'spec/v2/core/host-services.md §mcp';
+const ID = {
+  verbatim: 'openwop.requirement.0204.call-tool-verbatim',
+  isError: 'openwop.requirement.0204.call-tool-iserror-resolves',
+  page: 'openwop.requirement.0204.list-tools-page',
+  health: 'openwop.requirement.0204.server-health',
+  reject: 'openwop.requirement.0204.reject-unknown-server',
+} as const;
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+const SESSION_WORDS = /"(dis)?connected"/i;
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
+const enc = (id: string): string => encodeURIComponent(id);
+
+/** The gate: the fake server, or the recorded reason the leg cannot run. */
+type Gate = { fake: McpFakeServer } | { skip: ['inapplicable' | 'blocked', string] };
+async function gate(): Promise<Gate> {
+  const doc = await v2Discovery().catch(() => null);
+  if (!doc) return { skip: ['blocked', 'v2 discovery unreachable'] };
+  const facet = await familyAdvertised('mcp');
+  if (!facet || facet['client'] !== true) return { skip: ['inapplicable', 'mcp.client not advertised — the host exposes no ctx.mcp to pack code (RFC 0204 §A.1)'] };
+  if (!isFixtureAdvertised(FIXTURE)) return { skip: ['blocked', `the host advertises mcp.client but not the ${FIXTURE} fixture — ctx.mcp is claimed and cannot be observed`] };
+  const fake = getMcpFakeServer();
+  if (fake === null) return { skip: ['blocked', 'the suite MCP fake server (OPENWOP_MCP_FAKE_SERVER=true) is not started in this run'] };
+  return { fake };
+}
+
+interface Outcome {
+  readonly status: string;
+  readonly result: unknown;
+  readonly hasResult: boolean;
+  readonly errorCode: string | null;
+}
+
+/** Run the fixture with `inputs` and read the node's terminal event. */
+async function runFixture(inputs: Record<string, unknown>): Promise<Outcome | { reason: string }> {
+  const created = await http(() => driver.post('/runs', { workflowId: FIXTURE, inputs }));
+  if (created === null) return { reason: 'POST /runs unreachable (fetch failed)' };
+  const runId = (created.json as { runId?: unknown } | null)?.runId;
+  if (created.status !== 201 || typeof runId !== 'string') return { reason: `POST /runs answered ${created.status} ${readErrorCode(created.json) ?? ''} — the fixture run was refused`.trim() };
+  const t0 = Date.now(); let status = '';
+  while (Date.now() - t0 < 30_000) {
+    const snap = await http(() => driver.get(`/runs/${enc(runId)}`));
+    status = String((snap?.json as { status?: unknown } | null)?.status ?? '');
+    if (TERMINAL.has(status)) break;
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  if (!TERMINAL.has(status)) return { reason: `the ${FIXTURE} run did not reach a terminal status within 30 s (last: ${status || 'unreadable'})` };
+  const ev = await http(() => driver.get(`/runs/${enc(runId)}/events/poll?timeout=1`));
+  const events = (ev?.json as { events?: unknown } | null)?.events;
+  if (ev?.status !== 200 || !Array.isArray(events)) return { reason: `GET /runs/{runId}/events/poll answered ${ev?.status ?? 'nothing'}` };
+  const node = (type: string) => (events as Array<{ type?: unknown; payload?: Record<string, unknown> }>).find((e) => e.type === type && e.payload?.['nodeId'] === NODE_ID)?.payload;
+  const completed = node('node.completed');
+  const failed = node('node.failed');
+  const outputs = (completed?.['outputs'] ?? {}) as Record<string, unknown>;
+  const error = (failed?.['error'] ?? null) as { code?: unknown } | null;
+  return { status, result: outputs['result'], hasResult: 'result' in outputs, errorCode: typeof error?.code === 'string' ? error.code : null };
+}
+
+function lastExchange(fake: McpFakeServer, pred: (x: McpExchange) => boolean): McpExchange | undefined {
+  return [...fake.exchanges()].reverse().find(pred);
+}
+const paramsOf = (x: McpExchange): Record<string, unknown> => (x.params ?? {}) as Record<string, unknown>;
+
+describe('RFC 0204 §A — ctx.mcp returns MCP results (gated on mcp.client)', () => {
+  it('callTool resolves to the server CallToolResult unaltered, _meta included', async () => {
+    const g = await gate(); if ('skip' in g) return softSkip(...g.skip);
+    const fake = g.fake;
+    const nonce = randomUUID();
+    const out = await runFixture({ method: 'callTool', serverId: 'conformance', name: 'structured-echo', arguments: { nonce } });
+    if ('reason' in out) return softSkip('blocked', out.reason);
+    const sent = lastExchange(fake, (x) => x.method === 'tools/call' && paramsOf(x)['name'] === 'structured-echo' && (paramsOf(x)['arguments'] as { nonce?: unknown } | undefined)?.nonce === nonce);
+    if (!sent) return softSkip('blocked', 'the suite fake server received no structured-echo call carrying this run\'s nonce — the host\'s "conformance" binding does not reach this suite\'s server');
+    expect(out.status, req(ID.verbatim, DOC, `the run MUST complete (got ${out.status}, node error ${out.errorCode ?? 'none'})`)).toBe('completed');
+    expect(out.hasResult, req(ID.verbatim, 'fixtures.md §The ctx.mcp fixture', 'node.completed.outputs.result MUST carry the resolved value')).toBe(true);
+    expect(out.result, req(ID.verbatim, DOC, 'callTool MUST resolve to the server\'s CallToolResult unaltered — content[], structuredContent, isError and _meta, deep-equal to what the server sent')).toEqual(sent.result);
+    expect((out.result as { _meta?: Record<string, unknown> } | undefined)?._meta?.['dev.openwop.conformance/nonce'], req(ID.verbatim, DOC, 'the result\'s _meta MUST survive (the per-run nonce is in it)')).toBe(nonce);
+  });
+
+  it('callTool resolves (does not reject) a result with isError: true', async () => {
+    const g = await gate(); if ('skip' in g) return softSkip(...g.skip);
+    const fake = g.fake;
+    const out = await runFixture({ method: 'callTool', serverId: 'conformance', name: 'always-error', arguments: {} });
+    if ('reason' in out) return softSkip('blocked', out.reason);
+    const sent = lastExchange(fake, (x) => x.method === 'tools/call' && paramsOf(x)['name'] === 'always-error');
+    if (!sent) return softSkip('blocked', 'the suite fake server received no always-error call — the host\'s "conformance" binding does not reach this suite\'s server');
+    expect(out.status, req(ID.isError, DOC, `a tool error is a result, not a rejection: the run MUST complete (got ${out.status}, node error ${out.errorCode ?? 'none'})`)).toBe('completed');
+    const r = out.result as { isError?: unknown; content?: unknown } | undefined;
+    expect(r?.isError, req(ID.isError, DOC, 'the resolved CallToolResult MUST carry isError: true')).toBe(true);
+    expect(r?.content, req(ID.isError, DOC, 'the resolved CallToolResult MUST carry the server\'s content[]')).toEqual([...ALWAYS_ERROR_CONTENT]);
+    expect(out.result, req(ID.isError, DOC, 'the isError result MUST be the server\'s, unaltered')).toEqual(sent.result);
+  });
+
+  it('listTools resolves one ListToolsResult page unaltered and forwards the cursor', async () => {
+    const g = await gate(); if ('skip' in g) return softSkip(...g.skip);
+    const fake = g.fake;
+    const first = await runFixture({ method: 'listTools', serverId: 'conformance' });
+    if ('reason' in first) return softSkip('blocked', first.reason);
+    const sent1 = lastExchange(fake, (x) => x.method === 'tools/list' && paramsOf(x)['cursor'] === undefined);
+    if (!sent1) return softSkip('blocked', 'the suite fake server received no tools/list — the host\'s "conformance" binding does not reach this suite\'s server');
+    expect(first.status, req(ID.page, DOC, `the listTools run MUST complete (got ${first.status}, node error ${first.errorCode ?? 'none'})`)).toBe('completed');
+    const page1 = first.result as { tools?: Array<Record<string, unknown>>; nextCursor?: unknown } | undefined;
+    expect(page1, req(ID.page, DOC, 'listTools MUST resolve to ONE ListToolsResult page unaltered — tools with outputSchema and annotations, nextCursor, ttlMs, cacheScope')).toEqual(sent1.result);
+    expect(page1?.tools?.length, req(ID.page, DOC, `the page MUST NOT be merged with later pages (the server pages ${TOOLS_PAGE_SIZE} at a time)`)).toBe(TOOLS_PAGE_SIZE);
+    expect(page1?.tools?.some((t) => t['outputSchema'] !== undefined && t['annotations'] !== undefined), req(ID.page, DOC, 'outputSchema and annotations MUST survive')).toBe(true);
+    const cursor = page1?.nextCursor;
+    expect(typeof cursor, req(ID.page, DOC, 'the first page MUST carry the server\'s nextCursor')).toBe('string');
+    if (typeof cursor !== 'string') return softSkip('blocked', 'unreachable: the nextCursor assertion above failed');
+    const second = await runFixture({ method: 'listTools', serverId: 'conformance', cursor });
+    if ('reason' in second) return softSkip('blocked', second.reason);
+    const sent2 = lastExchange(fake, (x) => x.method === 'tools/list' && paramsOf(x)['cursor'] === cursor);
+    expect(sent2 !== undefined, req(ID.page, DOC, 'listTools MUST forward the pack\'s cursor to the server (no tools/list carried it)')).toBe(true);
+    expect(second.status, req(ID.page, DOC, `the cursor run MUST complete (got ${second.status}, node error ${second.errorCode ?? 'none'})`)).toBe('completed');
+    expect(second.result, req(ID.page, DOC, 'the cursor page MUST be the server\'s second page, unaltered')).toEqual(sent2?.result);
+    expect((second.result as { nextCursor?: unknown } | undefined)?.nextCursor, req(ID.page, DOC, 'the last page carries no nextCursor')).toBeUndefined();
+  });
+
+  it('serverHealth reports reachability from server/discover, never a session state', async () => {
+    const g = await gate(); if ('skip' in g) return softSkip(...g.skip);
+    const fake = g.fake;
+    const up = await runFixture({ method: 'serverHealth', serverId: 'conformance' });
+    if ('reason' in up) return softSkip('blocked', up.reason);
+    expect(up.status, req(ID.health, DOC, `the serverHealth run MUST complete (got ${up.status}, node error ${up.errorCode ?? 'none'})`)).toBe('completed');
+    const h = up.result as { state?: unknown; discover?: { supportedVersions?: unknown } } | undefined;
+    if (h?.state === 'unreachable' && !fake.exchanges().some((x) => x.method === 'server/discover')) {
+      return softSkip('blocked', 'serverHealth("conformance") is unreachable and the suite fake server received no server/discover — the host\'s "conformance" binding does not reach this suite\'s server');
+    }
+    expect(h?.state, req(ID.health, DOC, 'a server whose server/discover succeeded with a revision the host negotiates MUST be reachable')).toBe('reachable');
+    expect(h?.discover?.supportedVersions, req(ID.health, DOC, 'serverHealth MUST carry the DiscoverResult it received')).toEqual([...fake.protocolVersions()]);
+    const sentDiscover = lastExchange(fake, (x) => x.method === 'server/discover');
+    if (sentDiscover) expect(h?.discover, req(ID.health, DOC, 'the DiscoverResult MUST be the server\'s, unaltered')).toEqual(sentDiscover.result);
+    expect(SESSION_WORDS.test(JSON.stringify(up.result ?? null)), req(ID.health, DOC, 'serverHealth MUST NOT report a connection or session state (connected / disconnected)')).toBe(false);
+    const down = await runFixture({ method: 'serverHealth', serverId: 'conformance.down' });
+    if ('reason' in down) return softSkip('blocked', down.reason);
+    if (down.errorCode === 'not_found') return softSkip('blocked', 'the host has no "conformance.down" binding (fixtures.md operator contract) — the unreachable half cannot be observed');
+    expect(down.status, req(ID.health, DOC, `serverHealth on an unanswering server resolves, it does not reject (got ${down.status}, node error ${down.errorCode ?? 'none'})`)).toBe('completed');
+    expect((down.result as { state?: unknown } | undefined)?.state, req(ID.health, DOC, 'a server nothing answers MUST be unreachable')).toBe('unreachable');
+    expect(SESSION_WORDS.test(JSON.stringify(down.result ?? null)), req(ID.health, DOC, 'serverHealth MUST NOT report a connection or session state')).toBe(false);
+  });
+
+  it('an unknown serverId rejects with not_found', async () => {
+    const g = await gate(); if ('skip' in g) return softSkip(...g.skip);
+    const out = await runFixture({ method: 'callTool', serverId: `no-such-${randomUUID().slice(0, 8)}`, name: 'echo', arguments: { text: 'x' } });
+    if ('reason' in out) return softSkip('blocked', out.reason);
+    expect(out.status, req(ID.reject, DOC, `a call to an unconfigured serverId MUST reject, failing the node (got ${out.status})`)).toBe('failed');
+    expect(out.errorCode, req(ID.reject, DOC, 'the rejection MUST be not_found')).toBe('not_found');
+  });
+});

package/src/scenarios/v2-mcp-mount-map.test.ts

@@ -0,0 +1,308 @@
+/**
+ * RFC 0208 §A/§B — the host as an MCP 2026-07-28 server, held to the `mcp.*`
+ * rows of `spec/v2/interop-map.json` (`spec/v2/core/interop.md` §"The
+ * operation mappings"). Target major 2.
+ *
+ * Gate: the v2 `mcp` record carries `serverMount` and lists profile
+ * `mcp-2026-07-28`. The mount is `mcp.serverUrls[0]` (an absolute URL, or a
+ * path joined to the base URL); a host that advertises a mount with no URL is
+ * `blocked`, never a silent return. A host advertising `mcp` for its client
+ * path only is `inapplicable`.
+ *
+ * Tools (a suite requirement, `conformance/fixtures.md`, not a spec MUST): each
+ * advertised fixture the legs call — `conformance-noop`, `conformance-failure`,
+ * `conformance-approval` — is exposed as a tool under its workflowId.
+ *
+ * The v1 host-as-server legs (`mcp-2026-07-28-discover`, `mcp-stateless-request`,
+ * `mcp-mrtr-roundtrip` server half, `mcp-cache-tenant-scope`,
+ * `mcp-extension-opacity` server half, `mcp-current-auth-boundary`) are ported
+ * here as v2 twins: they cannot join `BOTH_MAJORS`, because they gate on v1
+ * `.supported` seats that do not exist at major 2.
+ *
+ * @see spec/v2/core/interop.md §"The operation mappings"
+ * @see spec/v2/interop-map.json mcp.features / methods / headers / meta / mrtr / cache / authorization
+ * @see RFCS/0208-v2-a2a-mcp-operation-mappings.md §A, §B
+ * @see RFCS/0199-outbound-oauth-client-and-credential-interrupt.md §D.2 (the URL-mode and form-mode legs; interop-map.json mcp.mrtr InputRequiredResult (host as server))
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { loadEnv } from '../lib/env.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
+import { SEAMS_PREFIX } from '../lib/seams.js';
+
+export const HOST_CALLBACK_NOT_REQUIRED = 'the suite is the MCP client: every leg POSTs JSON-RPC to the mount the host advertises in mcp.serverUrls; nothing harness-hosted is handed to the host';
+
+const DOC = 'spec/v2/core/interop.md §"The operation mappings" (RFC 0208)';
+const PROFILE = 'mcp-2026-07-28';
+const REV = '2026-07-28';
+const R = (slug: string): string => `openwop.requirement.0208.${slug}`;
+const META_V = 'io.modelcontextprotocol/protocolVersion';
+const META_C = 'io.modelcontextprotocol/clientCapabilities';
+const ERR = { HEADER_MISMATCH: -32020, MISSING_CAPABILITY: -32021, UNSUPPORTED_VERSION: -32022, INVALID_PARAMS: -32602 } as const;
+
+const MAP = JSON.parse(readFileSync(join(SCHEMAS_DIR, '..', 'spec', 'v2', 'interop-map.json'), 'utf8')) as { mcp: { features: Array<{ id: string; requiredFor: string[] }> } };
+const REQUIRED_FEATURES = MAP.mcp.features.filter((f) => f.requiredFor.includes(PROFILE)).map((f) => f.id).sort();
+
+interface RpcError { code: number; message?: string; data?: Record<string, unknown> }
+interface Rpc { status: number; headers: Headers; result?: Record<string, unknown> | undefined; error?: RpcError | undefined }
+type Mount = { ok: true; url: string; facet: Record<string, unknown> } | { ok: false; kind: 'inapplicable' | 'blocked'; reason: string };
+
+async function mount(): Promise<Mount> {
+  if (!(await v2Discovery())) return { ok: false, kind: 'blocked', reason: 'v2 discovery unreachable' };
+  const facet = await familyAdvertised('mcp');
+  if (!facet) return { ok: false, kind: 'inapplicable', reason: 'mcp not advertised at major 2' };
+  const profiles = Array.isArray(facet['profiles']) ? (facet['profiles'] as unknown[]) : [];
+  if (facet['serverMount'] === undefined || !profiles.includes(PROFILE)) return { ok: false, kind: 'inapplicable', reason: 'mcp is advertised without serverMount + profile mcp-2026-07-28 — the host serves no MCP mount (client path only)' };
+  const urls = Array.isArray(facet['serverUrls']) ? (facet['serverUrls'] as unknown[]).filter((u): u is string => typeof u === 'string' && u.length > 0) : [];
+  if (urls.length === 0) return { ok: false, kind: 'blocked', reason: 'mcp.serverMount is advertised with no mcp.serverUrls[0] — the mount is unaddressable' };
+  const u = urls[0]!;
+  return { ok: true, url: /^https?:\/\//i.test(u) ? u : `${loadEnv().baseUrl}${u.startsWith('/') ? '' : '/'}${u}`, facet };
+}
+const skip = (m: Exclude<Mount, { ok: true }>): undefined => softSkip(m.kind, m.reason);
+
+interface CallOpts { version?: string | null; bodyVersion?: string | null; mcpMethod?: string | null; mcpName?: string; caps?: Record<string, unknown>; bearer?: string | null; extraMeta?: Record<string, unknown>; headers?: Record<string, string> }
+async function call(url: string, method: string, params: Record<string, unknown>, o: CallOpts = {}): Promise<Rpc> {
+  const version = o.version === undefined ? REV : o.version;
+  const bodyVersion = o.bodyVersion === undefined ? version : o.bodyVersion;
+  const headers: Record<string, string> = { 'content-type': 'application/json', accept: 'application/json, text/event-stream', ...(o.headers ?? {}) };
+  if (version !== null) headers['MCP-Protocol-Version'] = version;
+  const mcpMethod = o.mcpMethod === undefined ? method : o.mcpMethod;
+  if (mcpMethod !== null) headers['Mcp-Method'] = mcpMethod;
+  if (o.mcpName !== undefined) headers['Mcp-Name'] = o.mcpName;
+  const bearer = o.bearer === undefined ? loadEnv().apiKey : o.bearer;
+  if (bearer) headers['authorization'] = `Bearer ${bearer}`;
+  const meta: Record<string, unknown> = { [META_C]: o.caps ?? {}, ...(o.extraMeta ?? {}) };
+  if (bodyVersion !== null) meta[META_V] = bodyVersion;
+  const res = await fetch(url, { method: 'POST', headers, body: JSON.stringify({ jsonrpc: '2.0', id: Math.floor(Math.random() * 1e9), method, params: { ...params, _meta: meta } }) });
+  const body = (await res.json().catch(() => ({}))) as { result?: Record<string, unknown>; error?: RpcError };
+  return { status: res.status, headers: res.headers, ...body };
+}
+const toolCall = (url: string, name: string, extra: Record<string, unknown> = {}, o: CallOpts = {}): Promise<Rpc> => call(url, 'tools/call', { name, arguments: {}, ...extra }, { mcpName: name, ...o });
+
+function needFixtures(ids: string[]): string | null {
+  const missing = ids.filter((id) => !isFixtureAdvertised(id));
+  return missing.length === 0 ? null : `fixture(s) ${missing.join(', ')} not in the advertised fixtures[] — the leg calls them as tools`;
+}
+
+describe('RFC 0208 — v2-mcp-mount-map (host as MCP 2026-07-28 server, gated on mcp.serverMount + profile)', () => {
+  it('a host claiming mcp-2026-07-28 lists every feature the map requires for it', async () => {
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const features = Array.isArray(m.facet['features']) ? (m.facet['features'] as unknown[]).map(String) : [];
+    expect(REQUIRED_FEATURES.filter((f) => !features.includes(f)), req(R('mcp-features-required'), 'interop.md §"The operation mappings"; interop-map.json mcp.features requiredFor', `a host advertising ${PROFILE} MUST list every feature the map requires for it (${REQUIRED_FEATURES.join(', ')}); advertised [${features.join(', ')}]`)).toEqual([]);
+  });
+
+  it('server/discover supportedVersions equals mcp.revisions, with resultType and cache hints', async () => {
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const r = await call(m.url, 'server/discover', {});
+    expect(r.error, req(R('mcp-discover-revisions'), 'interop-map.json mcp.methods server/discover', `server/discover MUST be served (feature server-discover): ${r.status} ${JSON.stringify(r.error)}`)).toBeUndefined();
+    const revisions = (Array.isArray(m.facet['revisions']) ? (m.facet['revisions'] as string[]) : []).slice().sort();
+    expect([...((r.result?.['supportedVersions'] as string[] | undefined) ?? [])].sort(), req(R('mcp-discover-revisions'), 'interop-map.json mcp.methods server/discover', 'supportedVersions[] MUST equal mcp.revisions — two documents, one fact')).toEqual(revisions);
+    expect(r.result?.['resultType'], req(R('mcp-discover-revisions'), 'interop-map.json mcp.features cacheable-lists', 'a current-revision result carries resultType complete')).toBe('complete');
+    expect(typeof r.result?.['ttlMs'], req(R('mcp-discover-revisions'), 'interop-map.json mcp.features cacheable-lists', 'server/discover is cacheable: ttlMs')).toBe('number');
+    expect(['public', 'private'], req(R('mcp-discover-revisions'), 'interop-map.json mcp.cache cacheScope', 'cacheScope is public | private')).toContain(r.result?.['cacheScope']);
+  });
+
+  it('header/body disagreement fails closed -32020 before version selection; an unsupported revision is -32022', async () => {
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const id = R('mcp-header-body-consistent');
+    const mismatch = await call(m.url, 'tools/list', {}, { version: REV, bodyVersion: '2025-06-18' });
+    expect([mismatch.status, mismatch.error?.code], req(id, 'interop-map.json mcp.headers MCP-Protocol-Version', `MCP-Protocol-Version ≠ _meta protocolVersion MUST be 400 HeaderMismatchError -32020, checked before version selection (got ${mismatch.status} ${JSON.stringify(mismatch.error)})`)).toEqual([400, ERR.HEADER_MISMATCH]);
+    const method = await call(m.url, 'tools/list', {}, { mcpMethod: 'resources/list' });
+    expect([method.status, method.error?.code], req(id, 'interop-map.json mcp.headers Mcp-Method | Mcp-Name', `Mcp-Method ≠ method MUST fail closed 400 -32020 (got ${method.status} ${JSON.stringify(method.error)})`)).toEqual([400, ERR.HEADER_MISMATCH]);
+    const name = await call(m.url, 'tools/call', { name: 'conformance-noop', arguments: {} }, { mcpName: 'not-conformance-noop' });
+    expect([name.status, name.error?.code], req(id, 'interop-map.json mcp.headers Mcp-Method | Mcp-Name', `Mcp-Name ≠ params.name MUST fail closed 400 -32020 (got ${name.status} ${JSON.stringify(name.error)})`)).toEqual([400, ERR.HEADER_MISMATCH]);
+    const unsupported = await call(m.url, 'tools/list', {}, { version: '1999-01-01' });
+    expect([unsupported.status, unsupported.error?.code], req(id, 'interop-map.json mcp.methods server/discover', `a revision outside mcp.revisions MUST be refused 400 -32022 (got ${unsupported.status} ${JSON.stringify(unsupported.error)})`)).toEqual([400, ERR.UNSUPPORTED_VERSION]);
+    expect(Array.isArray(unsupported.error?.data?.['supported']), req(id, 'interop-map.json mcp.methods server/discover', 'the refusal lists data.supported[]')).toBe(true);
+  });
+
+  it('tools/list needs no initialize and no session; results carry cache hints and agree across requests', async () => {
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const id = R('mcp-stateless');
+    const a = await call(m.url, 'tools/list', {});
+    expect(a.error, req(id, 'interop-map.json mcp.methods initialize | Mcp-Session-Id', `a current-profile request MUST NOT require initialize or a session: ${a.status} ${JSON.stringify(a.error)}`)).toBeUndefined();
+    expect(a.status, req(id, 'interop-map.json mcp.methods tools/list', 'tools/list answers 200')).toBe(200);
+    expect(a.result?.['resultType'], req(id, 'interop-map.json mcp.features cacheable-lists', 'resultType complete')).toBe('complete');
+    expect(typeof a.result?.['ttlMs'] === 'number' && (a.result['ttlMs'] as number) >= 0, req(id, 'interop-map.json mcp.features cacheable-lists', 'tools/list MUST carry ttlMs >= 0')).toBe(true);
+    expect(['public', 'private'], req(id, 'interop-map.json mcp.cache cacheScope', 'tools/list MUST carry cacheScope')).toContain(a.result?.['cacheScope']);
+    const names = ((a.result?.['tools'] as Array<{ name?: string }> | undefined) ?? []).map((t) => String(t.name));
+    expect(names, req(id, 'interop-map.json mcp.methods tools/list', 'the tool list is sorted by name')).toEqual([...names].sort());
+    const b = await call(m.url, 'tools/list', {});
+    expect(JSON.stringify(b.result?.['tools']), req(id, 'interop-map.json mcp.methods tools/list', 'tools/list MUST be identical for every connection of one caller')).toBe(JSON.stringify(a.result?.['tools']));
+  });
+
+  it('tools/call answers a completed run isError false and a failed run isError true, never a JSON-RPC error', async () => {
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const missing = needFixtures(['conformance-noop', 'conformance-failure']);
+    if (missing) return softSkip('blocked', missing);
+    const ok = await toolCall(m.url, 'conformance-noop');
+    expect(ok.error, req(R('mcp-tool-outcome'), 'interop-map.json mcp.methods tools/call', `tools/call on a completing workflow MUST answer a result: ${JSON.stringify(ok.error)}`)).toBeUndefined();
+    expect([ok.result?.['resultType'], ok.result?.['isError']], req(R('mcp-tool-outcome'), 'interop-map.json mcp.methods tools/call', 'completed is CallToolResult isError false')).toEqual(['complete', false]);
+    const bad = await toolCall(m.url, 'conformance-failure');
+    expect(bad.error, req(R('mcp-tool-outcome'), 'interop-map.json mcp.methods tools/call', `a failed run MUST be a CallToolResult, not a JSON-RPC error (got ${JSON.stringify(bad.error)})`)).toBeUndefined();
+    expect(bad.result?.['isError'], req(R('mcp-tool-outcome'), 'interop-map.json mcp.methods tools/call', 'failed is CallToolResult isError true')).toBe(true);
+    const invalid = await call(m.url, 'tools/call', { name: 'conformance-noop', arguments: 'not-an-object' }, { mcpName: 'conformance-noop' });
+    expect(invalid.error?.code, req(R('mcp-tool-outcome'), 'interop-map.json mcp.methods tools/call', `arguments are validated against inputSchema before any run is created (else -32602); got ${JSON.stringify(invalid.error ?? invalid.result)}`)).toBe(ERR.INVALID_PARAMS);
+  });
+
+  it('a run started by tools/call records run.started.transport mcp', async () => {
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const missing = needFixtures(['conformance-noop']);
+    if (missing) return softSkip('blocked', missing);
+    if (!(await familyAdvertised('runList'))) return softSkip('inapplicable', 'runList not advertised — the suite has no black-box way to find the run a tools/call started');
+    const list = async (): Promise<string[]> => {
+      const r = await driver.get('/runs?workflowId=conformance-noop&limit=50');
+      return ((r.json as { runs?: Array<{ runId?: string }> } | undefined)?.runs ?? []).map((x) => String(x.runId));
+    };
+    const before = new Set(await list());
+    const ok = await toolCall(m.url, 'conformance-noop');
+    const fresh = (await list()).filter((x) => !before.has(x));
+    expect(fresh.length, req(R('mcp-run-transport'), 'interop-map.json mcp.methods tools/call', `tools/call MUST start a run (v2Operation createRun) that listRuns shows the same Subject (got ${fresh.length} new run(s); result ${JSON.stringify(ok.error ?? ok.result)})`)).toBe(1);
+    const poll = await driver.get(`/runs/${encodeURIComponent(fresh[0]!)}/events/poll?timeout=1`);
+    const started = ((poll.json as { events?: Array<{ type?: string; payload?: { transport?: string } }> } | undefined)?.events ?? []).find((e) => e.type === 'run.started');
+    expect(started?.payload?.transport, req(R('mcp-run-transport'), 'interop-map.json mcp.methods tools/call; runs.md run.started', 'the run starts with run.started.transport mcp')).toBe('mcp');
+  });
+
+  it('a suspending tool answers InputRequiredResult; the retry resolves it; requestState is single use and forgery-proof', async () => {
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const missing = needFixtures(['conformance-approval']);
+    if (missing) return softSkip('blocked', missing);
+    const id = R('mcp-mrtr-server');
+    const TOOL = 'conformance-approval';
+    const caps = { elicitation: {} };
+    const noCap = await toolCall(m.url, TOOL);
+    expect(noCap.error?.code, req(id, 'interop-map.json mcp.meta clientCapabilities', `a request that needs elicitation but did not declare it MUST be MissingRequiredClientCapabilityError -32021, never assumed (got ${JSON.stringify(noCap.error ?? noCap.result)})`)).toBe(ERR.MISSING_CAPABILITY);
+    const first = await toolCall(m.url, TOOL, {}, { caps });
+    expect(first.result?.['resultType'], req(id, 'interop-map.json mcp.mrtr InputRequiredResult (host as server)', `a run reaching waiting-approval MUST answer the in-flight tools/call with InputRequiredResult (got ${JSON.stringify(first.error ?? first.result)})`)).toBe('input_required');
+    const requests = (first.result?.['inputRequests'] ?? {}) as Record<string, { method?: string }>;
+    const key = Object.keys(requests)[0];
+    expect(key !== undefined && requests[key]?.method === 'elicitation/create', req(id, 'interop-map.json mcp.mrtr InputRequiredResult (host as server)', 'inputRequests carries { <interruptId>: elicitation/create }')).toBe(true);
+    const state = first.result?.['requestState'];
+    expect(typeof state, req(id, 'interop-map.json mcp.mrtr requestState (host as server)', 'a requestState accompanies the input request')).toBe('string');
+    const retry = await toolCall(m.url, TOOL, { requestState: state, inputResponses: { [key!]: { action: 'accept', content: { action: 'accept' } } } }, { caps });
+    expect([retry.error, retry.result?.['resultType'], retry.result?.['isError']], req(id, 'interop-map.json mcp.mrtr inputResponses[key] (host as server)', `ElicitResult accept resumes the run to completion (got ${JSON.stringify(retry.error ?? retry.result)})`)).toEqual([undefined, 'complete', false]);
+    const again = await toolCall(m.url, TOOL, { requestState: state, inputResponses: { [key!]: { action: 'accept', content: { action: 'accept' } } } }, { caps });
+    expect(again.error !== undefined || again.status >= 400, req(id, 'interop-map.json mcp.mrtr requestState (host as server)', `requestState is single use: a second retry with it MUST fail (got ${again.status} ${JSON.stringify(again.result)})`)).toBe(true);
+    const forged = await toolCall(m.url, TOOL, { requestState: `${String(state)}x`, inputResponses: { [key!]: { action: 'accept', content: { action: 'accept' } } } }, { caps });
+    expect(forged.error !== undefined || forged.status >= 400, req(id, 'interop-map.json mcp.mrtr requestState (host as server)', `a requestState that fails integrity verification MUST be refused (got ${forged.status} ${JSON.stringify(forged.result)})`)).toBe(true);
+  });
+
+  it('a list that differs per caller is cacheScope private', async () => {
+    const other = process.env.OPENWOP_TEST_TENANT_B_API_KEY;
+    if (!other) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set — the cross-caller half cannot run');
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const mine = await call(m.url, 'tools/list', {});
+    const theirs = await call(m.url, 'tools/list', {}, { bearer: other });
+    if (mine.status === 200 && theirs.status === 200 && JSON.stringify(mine.result?.['tools']) === JSON.stringify(theirs.result?.['tools'])) {
+      // A byte-identical list may be public; the private-scope rule binds only a
+      // list that differs per caller. Passing here would be a row that cannot fail.
+      return softSkip('inapplicable', 'the tool list is byte-identical for both tenants — the cacheScope private rule has nothing to bind on this host');
+    }
+    expect([mine.status, theirs.status], req(R('mcp-cache-scope'), 'interop-map.json mcp.methods tools/list', 'tools/list is served to both callers')).toEqual([200, 200]);
+    const scopes = [mine.result?.['cacheScope'], theirs.result?.['cacheScope']];
+    expect(scopes.every((s) => s === 'private'), req(R('mcp-cache-scope'), 'interop-map.json mcp.cache cacheScope', `a list that differs per caller MUST be cacheScope private — public only when byte-identical for every caller (mcp-cache-tenant-scoped); scopes ${JSON.stringify(scopes)}`)).toBe(true);
+  });
+
+  it('unknown _meta extension keys and capabilities.extensions are opaque: processed normally, granting nothing', async () => {
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const r = await call(m.url, 'tools/list', {}, { caps: { extensions: { 'io.example/authority': { admin: true } } }, extraMeta: { 'io.example/authority': { grantScopes: ['*'] } } });
+    expect([r.status, r.error, r.result?.['resultType']], req(R('mcp-extension-opacity'), `${DOC} (what the map does not name is opaque); mcp-extension-no-authority`, `an unknown extension is opaque — neither refused nor honoured (got ${r.status} ${JSON.stringify(r.error)})`)).toEqual([200, undefined, 'complete']);
+    const plain = await call(m.url, 'tools/list', {});
+    expect(JSON.stringify(r.result?.['tools']), req(R('mcp-extension-opacity'), 'mcp-extension-no-authority', 'an extension asserting authority MUST NOT widen what the caller sees')).toBe(JSON.stringify(plain.result?.['tools']));
+  });
+
+  it('an unauthenticated request is refused at the boundary unless anonymousActor is advertised', async () => {
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    if (await familyAdvertised('anonymousActor')) return softSkip('inapplicable', 'anonymousActor is advertised — anonymous MCP callers are routed through that surface\'s rules');
+    const authed = await call(m.url, 'tools/list', {});
+    expect(authed.status, req(R('mcp-auth-boundary'), 'interop-map.json mcp.authorization', 'the authenticated call succeeds at the same URL, so a refusal below is not a wrong path')).toBe(200);
+    const anon = await call(m.url, 'tools/list', {}, { bearer: null });
+    expect([401, 403], req(R('mcp-auth-boundary'), 'interop-map.json mcp.authorization', `every tools/* request MUST be authenticated at the OpenWOP boundary (got ${anon.status})`)).toContain(anon.status);
+    const cookies = (anon.headers as Headers & { getSetCookie?: () => string[] }).getSetCookie?.() ?? [];
+    if (cookies.length > 0) {
+      const withSession = await call(m.url, 'tools/list', {}, { bearer: null, headers: { Cookie: cookies.map((c) => c.split(';')[0]).join('; ') } });
+      expect([401, 403], req(R('mcp-auth-boundary'), 'interop-map.json mcp.authorization', `a host-minted anonymous session is still an anonymous principal (got ${withSession.status})`)).toContain(withSession.status);
+    }
+  });
+
+  // ── RFC 0199 §D.2 — what the bridge sends for a credential interrupt, and what it refuses to send in form mode ──
+
+  it('a credential interrupt is answered in URL mode (url = connectUrl), isError without URL support, and input_required again on an accept retry with no credential', async () => {
+    const id = 'openwop.requirement.0199.mcp-url-mode';
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const oauth = await familyAdvertised('oauth');
+    if (oauth?.['credentialInterrupt'] !== true) return softSkip('inapplicable', 'oauth.credentialInterrupt is not advertised — the host raises no credential interrupt to bridge (RFC 0199 §C.1)');
+    const missing = needFixtures(['conformance-credential']);
+    if (missing) return softSkip('blocked', missing);
+    const minted = await driver.post(`${SEAMS_PREFIX}/sample/auth/credential/mint`, { lane: 'api-key' }).catch(() => null);
+    const bearer = (minted?.json as { credential?: unknown } | undefined)?.credential;
+    if (typeof bearer !== 'string') return softSkip('blocked', 'the credential mint seam did not mint a fresh Subject — a Subject that may already hold a credential makes the leg vacuous');
+    const TOOL = 'conformance-credential';
+    const urlCaps = { elicitation: { url: {} } };
+    const first = await toolCall(m.url, TOOL, {}, { caps: urlCaps, bearer });
+    expect(first.result?.['resultType'], req(id, 'interop-map.json mcp.mrtr InputRequiredResult (host as server)', `a run suspended on a credential interrupt MUST answer input_required (got ${JSON.stringify(first.error ?? first.result)})`)).toBe('input_required');
+    const requests = (first.result?.['inputRequests'] ?? {}) as Record<string, { method?: string; params?: { mode?: string; url?: string; message?: string } }>;
+    const key = Object.keys(requests)[0];
+    const params = key === undefined ? undefined : requests[key]?.params;
+    expect([requests[key ?? '']?.method, params?.mode], req(id, 'RFC 0199 §D.2(a); interop-map.json mcp.mrtr', `a credential interrupt MUST be elicitation/create in mode url, never form (got ${JSON.stringify(requests)})`)).toEqual(['elicitation/create', 'url']);
+    let connectUrl: string | undefined;
+    if (await familyAdvertised('runList')) {
+      const runs = await driver.get('/runs?workflowId=conformance-credential&limit=5', { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } });
+      const runId = ((runs.json as { runs?: Array<{ runId?: string }> } | undefined)?.runs ?? [])[0]?.runId;
+      if (runId !== undefined) {
+        const poll = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`, { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } });
+        connectUrl = ((poll.json as { events?: Array<{ type?: string; payload?: { kind?: string; data?: { connectUrl?: string } } }> } | undefined)?.events ?? []).find((e) => e.type === 'interrupt.requested' && e.payload?.kind === 'credential')?.payload?.data?.connectUrl;
+      }
+    }
+    if (connectUrl !== undefined) {
+      expect(params?.url, req(id, 'RFC 0199 §D.2(a)', 'the url MUST be the credential interrupt\'s connectUrl')).toBe(connectUrl);
+    } else {
+      expect(typeof params?.url === 'string' && params.url.startsWith('https://'), req(id, 'RFC 0199 §D.2(a)', `the url MUST be an https connectUrl (runList unavailable, so it is not compared with the log; got ${params?.url})`)).toBe(true);
+    }
+    const formOnly = await toolCall(m.url, TOOL, {}, { caps: { elicitation: {} }, bearer });
+    expect([formOnly.error, formOnly.result?.['isError'], formOnly.result?.['inputRequests']], req(id, 'RFC 0199 §D.2(b) (an empty elicitation capability is form mode only)', `without elicitation.url the host MUST answer CallToolResult isError true and MUST NOT fall back to form mode (got ${JSON.stringify(formOnly.error ?? formOnly.result)})`)).toEqual([undefined, true, undefined]);
+    const retry = await toolCall(m.url, TOOL, { requestState: first.result?.['requestState'], inputResponses: { [key!]: { action: 'accept' } } }, { caps: urlCaps, bearer });
+    const again = (retry.result?.['inputRequests'] ?? {}) as Record<string, { params?: { mode?: string; url?: string } }>;
+    const againParams = Object.values(again)[0]?.params;
+    expect([retry.error, retry.result?.['resultType'], againParams?.mode, againParams?.url], req(id, 'RFC 0199 §D.2(c); interop-map.json mcp.mrtr inputResponses[key] (host as server)', `an accept retry with no credential MUST answer input_required again with the same url, not an error (got ${JSON.stringify(retry.error ?? retry.result)})`)).toEqual([undefined, 'input_required', 'url', params?.url]);
+  });
+
+  it('form mode is never emitted for a nested schema or a sensitive (format password) field', async () => {
+    const id = 'openwop.requirement.0199.form-mode-no-secret';
+    const m = await mount();
+    if (!m.ok) return skip(m);
+    const missing = needFixtures(['conformance-clarification', 'conformance-clarification-nested', 'conformance-clarification-sensitive']);
+    if (missing) return softSkip('blocked', missing);
+    const modes = (r: Rpc): string[] => Object.values((r.result?.['inputRequests'] ?? {}) as Record<string, { params?: { mode?: string } }>).map((x) => String(x.params?.mode));
+    // Positive control: a flat primitive clarification IS bridged in form mode, so a refusal below is not a bridge that never answers.
+    const flat = await toolCall(m.url, 'conformance-clarification', {}, { caps: { elicitation: {} } });
+    expect([flat.result?.['resultType'], modes(flat)], req(id, 'interop-map.json mcp.mrtr InputRequiredResult (host as server)', `positive control: a flat primitive clarification is bridged in form mode (got ${JSON.stringify(flat.error ?? flat.result)})`)).toEqual(['input_required', ['form']]);
+    for (const tool of ['conformance-clarification-nested', 'conformance-clarification-sensitive']) {
+      for (const caps of [{ elicitation: {} }, { elicitation: { url: {} } }]) {
+        const r = await toolCall(m.url, tool, {}, { caps });
+        expect(r.error, req(id, 'RFC 0199 §D.2(d)', `${tool} MUST be answered with a result, not a JSON-RPC error (got ${JSON.stringify(r.error)})`)).toBeUndefined();
+        expect(modes(r).includes('form'), req(id, 'RFC 0199 §D.2(d); invariant elicitation-form-no-secret (MCP Elicitation §Requested Schema / §User Interaction Model)', `${tool} with ${JSON.stringify(caps)}: form mode MUST NOT be emitted for a non-flat or sensitive schema — URL mode when declared, else isError (got ${JSON.stringify(r.result)})`)).toBe(false);
+        const urlDeclared = (caps.elicitation as Record<string, unknown>)['url'] !== undefined;
+        if (urlDeclared) expect(modes(r), req(id, 'RFC 0199 §D.2(d)', `${tool}: with elicitation.url declared the host emits URL mode (a host-owned resolve page)`)).toEqual(['url']);
+        else expect(r.result?.['isError'], req(id, 'RFC 0199 §D.2(d)/(b)', `${tool}: without elicitation.url the host answers isError true`)).toBe(true);
+      }
+    }
+  });
+});