@openwop/openwop-conformance 2.35.1 → 2.36.0

package/src/scenarios/auth-challenge-no-oracle.test.ts

@@ -0,0 +1,122 @@
+/**
+ * RFC 0200 §B.3 — a challenge never becomes an existence oracle (suite 2.36.0, both
+ * majors; invariant `auth-challenge-no-oracle`).
+ *
+ * This is the positive control for the §B challenge rules: the thing a host is TEMPTED to
+ * do once it starts answering "you lack `tools:read`" is answer it everywhere, including
+ * on the routes OpenWOP requires to be a non-disclosing `404` for an unknown **or
+ * unauthorized** resource. RFC 6750 §3 and MCP's §"Runtime Insufficient Scope Errors" say
+ * nothing about existence oracles; OpenWOP's rule is stronger and wins.
+ *
+ * The routes that carry the identical-404 rule:
+ *   - `tool-catalog.md` §`GET /v1/tools/{toolId}` (v2: `spec/v2/core/tool-catalog.md`)
+ *   - the RFC 0074 / 0072 / 0086 / 0087 agent inventory (`api/openapi.yaml` getAgent:
+ *     "404s identically to 'not installed'")
+ *   - `capabilities-change-detection.md` ("Hosts MUST NOT let scoped discovery become an
+ *     authorization oracle")
+ *
+ * One requirement id, three legs that share it — every leg is an instance of the same
+ * MUST, and a host that leaks on any of them has the oracle:
+ *   1. `GET <tools>/<unknown>` → `404`, and no `WWW-Authenticate` carrying
+ *      `insufficient_scope` or `scope`.
+ *   2. `GET <agents>/<unknown>` → the same.
+ *   3. with `OPENWOP_TEST_TENANT_B_API_KEY`, a cross-tenant run read → the refusal
+ *      carries no `insufficient_scope`, because no scope would cure a resource-binding
+ *      refusal.
+ *
+ * Each leg carries its own positive control: leg 1 and 2 assert the route is LIVE for the
+ * same credential (the collection read answers 200), so a `404` from "this host serves no
+ * catalog at all" cannot be mistaken for the silent non-disclosure under test. Leg 3
+ * asserts the owner can read the run it then reads cross-tenant.
+ *
+ * How it FAILS (the sabotage run before citing the row):
+ *   (a) the host 403s an unauthorized tool with a scope challenge → leg 1
+ *   (b) the host attaches `insufficient_scope` to EVERY 403            → leg 3
+ *   (c) the host turns the unknown-id 404 into a 401 challenge         → legs 1, 2
+ *
+ * @see spec/v2/core/identity.md §2.5; spec/v1/auth.md §Challenges
+ * @see RFCS/0200-host-as-oauth-protected-resource.md §B.3
+ * @see SECURITY/invariants.yaml id: auth-challenge-no-oracle
+ */
+
+import { describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { driver } from '../lib/driver.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { targetMajor } from '../lib/seams.js';
+import { toolCatalogGate, toolsPath } from '../lib/toolCatalog.js';
+import { parseChallenge } from '../lib/protected-resource.js';
+import { projectBoundId } from '../lib/bound-id.js';
+
+const DOC = 'spec/v1/auth.md §Challenges; spec/v2/core/identity.md §2.5 (RFC 0200 §B.3)';
+const ID = 'openwop.requirement.0200.no-challenge-on-nondisclosure-404';
+
+const agentsPath = (suffix = ''): string => `${targetMajor() === 2 ? '' : '/v1'}/agents${suffix}`;
+const runsPath = (suffix = ''): string => `${targetMajor() === 2 ? '' : '/v1'}/runs${suffix}`;
+
+/** The scope-disclosing part of a challenge, or null — this is the whole measurement. */
+function scopeDisclosure(raw: string | null): string | null {
+  const c = parseChallenge(raw);
+  if (c === null) return null;
+  if (c.params['error'] === 'insufficient_scope') return `error="insufficient_scope"`;
+  if (typeof c.params['scope'] === 'string') return `scope="${c.params['scope']}"`;
+  return null;
+}
+
+describe('RFC 0200 §B.3 — auth-challenge-no-oracle (a challenge never replaces a required 404)', () => {
+  it('an unknown tool id stays a silent 404 — no scope challenge, no status change', async () => {
+    if (!(await toolCatalogGate('openwop-tool-catalog'))) return;
+    // Positive control: the catalog is LIVE for this credential, so the 404 below is the
+    // non-disclosure rule and not "this host serves no catalog".
+    const list = await driver.get(toolsPath());
+    if (list.status !== 200) return softSkip('blocked', `the catalog collection answered ${list.status}, so an unknown-id 404 would prove nothing about non-disclosure`);
+    const unknown = `conformance.absent-${randomBytes(8).toString('hex')}`;
+    const res = await driver.get(toolsPath(`/${encodeURIComponent(unknown)}`));
+    expect(
+      res.status,
+      req(ID, `${DOC}; spec/v1/tool-catalog.md §GET /v1/tools/{toolId}`, `an unknown or unauthorized tool id MUST answer 404 — a challenge attaches only to a response that is ALREADY 401/403 and MUST NOT change a status (got ${res.status})`),
+    ).toBe(404);
+    expect(
+      scopeDisclosure(res.headers.get('www-authenticate')),
+      req(ID, DOC, `the 404 MUST NOT carry error="insufficient_scope" or a scope parameter — that is what turns the catalog into an enumeration oracle (WWW-Authenticate: ${res.headers.get('www-authenticate') ?? 'absent'})`),
+    ).toBeNull();
+  }, 30_000);
+
+  it('an unknown agent id stays a silent 404 — no scope challenge, no status change', async () => {
+    const list = await driver.get(agentsPath());
+    if (list.status !== 200) return softSkip('inapplicable', `the agent inventory answered ${list.status} — this host serves no RFC 0074 inventory, so its identical-404 rule does not bind it`);
+    const unknown = `absent-agent-${randomBytes(8).toString('hex')}`;
+    const res = await driver.get(agentsPath(`/${encodeURIComponent(unknown)}`));
+    expect(
+      res.status,
+      req(ID, `${DOC}; api/openapi.yaml getAgent (RFC 0074)`, `an unknown or unauthorized agent id MUST answer 404 identically to "not installed" (got ${res.status})`),
+    ).toBe(404);
+    expect(
+      scopeDisclosure(res.headers.get('www-authenticate')),
+      req(ID, DOC, `the inventory 404 MUST NOT carry a scope challenge (WWW-Authenticate: ${res.headers.get('www-authenticate') ?? 'absent'})`),
+    ).toBeNull();
+  }, 30_000);
+
+  it('a resource-binding refusal carries no insufficient_scope, because no scope would cure it', async () => {
+    const other = process.env['OPENWOP_TEST_TENANT_B_API_KEY']?.trim();
+    if (!other) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY is not set — a resource-binding refusal needs a SECOND principal, and the suite will not fabricate one');
+    const created = await driver.post(runsPath(), { workflowId: 'conformance-noop' });
+    if (created.status !== 201) return softSkip('blocked', `could not create a run to read cross-tenant (POST ${runsPath()} answered ${created.status})`);
+    const runId = String((created.json as { runId?: unknown } | null)?.runId ?? '');
+    if (runId === '') return softSkip('blocked', 'the create response carried no runId');
+    // Positive control: the OWNER can read it, so the refusal below is about the second
+    // principal's binding and not about a run that does not exist.
+    const owner = await driver.get(runsPath(`/${projectBoundId(runId)}`));
+    if (owner.status !== 200) return softSkip('blocked', `the owner could not read its own run (${owner.status}) — the cross-tenant read would prove nothing`);
+    const res = await driver.get(runsPath(`/${projectBoundId(runId)}`), { authenticated: false, headers: { Authorization: `Bearer ${other}` } });
+    expect(
+      res.status === 403 || res.status === 404,
+      req(ID, DOC, `a second principal's read of another tenant's run MUST be refused 403 (run_forbidden / id_tenant_mismatch) or 404, never served (got ${res.status})`),
+    ).toBe(true);
+    expect(
+      scopeDisclosure(res.headers.get('www-authenticate')),
+      req(ID, DOC, `a refusal that failed RESOURCE binding MUST NOT carry error="insufficient_scope" or a scope parameter — no scope would cure it, and naming one tells the caller the resource exists (WWW-Authenticate: ${res.headers.get('www-authenticate') ?? 'absent'})`),
+    ).toBeNull();
+  }, 60_000);
+});

package/src/scenarios/auth-oauth2-client-credentials.test.ts

@@ -155,7 +155,17 @@ describe('auth-oauth2-client-credentials: malformed JWT rejected', () => {
 });
 
 describe('auth-oauth2-client-credentials: harness-minted negative cases', () => {
-  it('wrong-audience token returns 401 when host trusts the harness', async () => {
+  /**
+   * RFC 0200 §C — before this RFC, `auth-profiles.md` said only that a wrong-audience
+   * token "uses the canonical error envelope"; the REJECTION itself was assumed by this
+   * very assertion and by the schema description of `capabilities.auth.oauth2.audience`,
+   * and stated nowhere. The profile now carries it as a MUST.
+   *
+   * Major-1 only and NON-GATING: `check-accepted-predicate` rule 4 reads only certified
+   * v2 bundles and no v2 cut reaches this file, so this id carries no rule-4 weight. v2
+   * needs nothing here — `identity.md` §2.1 already requires every lane to check audience.
+   */
+  it('a wrong-audience access token is rejected 401 unauthenticated (RFC 0200 §C)', async () => {
     const auth = await readAuthCaps();
 
     if (!behaviorGate(PROFILE, isProfileAdvertised(auth))) {
@@ -179,7 +189,6 @@ describe('auth-oauth2-client-credentials: harness-minted negative cases', () =>
       algorithm: 'RS256',
     });
 
-    // Wrong audience.
     const wrongAud = issuer.mint({ aud: 'wrong-audience', sub: 'conformance-suite' });
     const wrongAudRes = await driver.post(
       '/v1/runs',
@@ -189,10 +198,42 @@ describe('auth-oauth2-client-credentials: harness-minted negative cases', () =>
         headers: { Authorization: `Bearer ${wrongAud.token}` },
       },
     );
-    expect(wrongAudRes.status, req('openwop.it.auth-oauth2-client-credentials.wrong-audience-token-returns-401-when-host-trusts-the-harness', 
-      'auth-profiles.md §`openwop-auth-oauth2-client-credentials`',
-      'token with wrong aud claim MUST return 401',
+    // RFC 0200 §C made the obligation explicit: before this, `auth-profiles.md` said only
+    // that a wrong-audience token "uses the canonical error envelope", and the rejection
+    // itself was assumed by this very assertion and by the schema description of
+    // `capabilities.auth.oauth2.audience` — never stated. The profile now says the host
+    // MUST reject such a token 401 unauthenticated, before any authorization decision.
+    // Major-1 only and NON-GATING: v2 needs nothing here, because `identity.md` §2.1
+    // already requires every lane to check audience, and no v2 cut reaches this file.
+    expect(wrongAudRes.status, req('openwop.requirement.0200.oauth2cc-wrong-aud-401',
+      'spec/v1/auth-profiles.md §`openwop-auth-oauth2-client-credentials` (RFC 0200 §C.1)',
+      'an access token whose `aud` does not contain the advertised capabilities.auth.oauth2.audience MUST be rejected 401 unauthenticated, before any authorization decision',
     )).toBe(401);
+  });
+
+  it('wrong-audience token returns 401 when host trusts the harness', async () => {
+    const auth = await readAuthCaps();
+
+    if (!behaviorGate(PROFILE, isProfileAdvertised(auth))) {
+      return;
+    }
+
+    if (process.env.OPENWOP_TEST_OAUTH_ISSUER_TRUSTED !== 'true') {
+      // eslint-disable-next-line no-console
+      console.warn(
+        '[auth-oauth2-client-credentials] OPENWOP_TEST_OAUTH_ISSUER_TRUSTED not set; skipping harness-minted negative cases (operator must pre-configure the host to trust the conformance harness)',
+      );
+      return softSkip('blocked', 'precondition not met — `process.env.OPENWOP_TEST_OAUTH_ISSUER_TRUSTED !== \'true\'` returned early ([auth-oauth2-client-credentials] OPENWOP_TEST_OAUTH_ISSUER_TRUSTED not set; skipping harness-minted negative cases (ope…');
+    }
+
+    const issuerUrl =
+      process.env.OPENWOP_TEST_OAUTH_ISSUER_URL ?? 'http://127.0.0.1:0/oauth';
+    const audience = auth?.oauth2?.audience ?? 'openwop-conformance';
+    const issuer = createSyntheticOIDCIssuer({
+      issuer: issuerUrl,
+      audience,
+      algorithm: 'RS256',
+    });
 
     // Expired token.
     const expired = issuer.mint(

package/src/scenarios/cross-host-traceparent-propagation.test.ts

@@ -1,71 +1,105 @@
 /**
- * cross-host-traceparent-propagation — RFC 0040 §B behavioral (capability-gated).
+ * cross-host-traceparent-propagation — RFC 0040 §B, carriers named by RFC 0207
+ * (major 1; supplementary, non-gating — the gating home of the same ids is
+ * `v2-interop-trace-context.test.ts`).
  *
- * Status: ACTIVE (capability-gated; behavioral assertion soft-skipped
- * until a cross-host MCP/A2A composition test fixture ships). Gated on
- * `capabilities.multiAgent.executionModel.version >= 3` AND
- * `capabilities.multiAgent.executionModel.crossHostCausation.supported: true`.
+ * `spec/v1/multi-agent-execution.md` §"W3C tracecontext across MCP + A2A
+ * composition": a host that dispatches MCP tool calls AND advertises
+ * `multiAgent.executionModel.version >= 3` MUST inject the parent run's W3C
+ * trace context into every outbound MCP request — in `params._meta.traceparent`
+ * or, on Streamable HTTP, in the HTTP `traceparent` header (SHOULD `_meta`) —
+ * and outbound A2A messages MUST carry it in
+ * `Message.metadata.openwop.traceparent` or the HTTP header (SHOULD the
+ * metadata).
  *
- * Asserts (when host advertises Phase 3 + a real MCP/A2A composition
- * endpoint is reachable):
+ * Until suite 2.36.0 this file was two `it.skip` placeholders that read the
+ * carrier as an HTTP header only and waited on a peer harness. The harness is
+ * the suite's own fake MCP server and fake A2A peer, which record every
+ * request's params, body and headers; the run is started with the suite's own
+ * `traceparent` (a fresh trace id) on `POST /v1/runs`, so the request the host
+ * sends the fake is where the carrier is read. The verdict is the D4 rule
+ * (`../lib/trace-context.ts`): neither carrier ⇒ fail; a different trace id ⇒
+ * fail; the header alone ⇒ PASS (logged `header-only`).
  *
- *   1. An outbound MCP tool call dispatched from a Phase 3 host MUST
- *      carry the parent run's W3C `traceparent` header. The MCP server
- *      receives the header AND uses it as the parent trace for any
- *      spans it emits (closing the cross-host span linkage that
- *      RFC 0023's same-host coverage left open).
- *
- *   2. An inbound MCP tool reply OR A2A message handler MUST adopt the
- *      `traceparent` header from the inbound envelope as the trace
- *      parent for any subsequent events the receiving agent emits.
- *
- *   3. (Symmetric) Outbound A2A messages MUST carry the parent run's
- *      `traceparent`; inbound A2A handlers MUST adopt it.
- *
- * Behavioral wiring requires a cross-host test harness: either a real
- * MCP server peer (`OPENWOP_MCP_REAL_SERVER_URL`) or an A2A peer
- * (`OPENWOP_A2A_REAL_PEER_URL`) the host can call into. Without those,
- * the assertion soft-skips and only the shape probe in
- * cross-host-causation-shape.test.ts applies.
+ * Gates: `version >= 3`; the fixture (`conformance-mcp-tool-roundtrip` /
+ * `conformance-a2a-task-roundtrip`) advertised; the fake server / peer started
+ * (`OPENWOP_MCP_FAKE_SERVER=true` / `OPENWOP_A2A_FAKE_PEER=true`), else
+ * `blocked`, never a pass.
  *
  * @see RFCS/0040-multi-agent-cross-host-causation.md §B
+ * @see RFCS/0207-trace-context-across-mcp-and-a2a.md §A, §B
  * @see spec/v1/multi-agent-execution.md §"W3C tracecontext across MCP + A2A composition"
- * @see RFCS/0023-conformance-agent-event-emitters.md (the same-host predecessor)
  */
 
-import { describe, it } from 'vitest';
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { discoveryFamilies } from '../lib/discovery-capabilities.js';
+import { pollUntilTerminal } from '../lib/polling.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
+import { getA2AFakePeer } from '../lib/a2a-fake-peer.js';
+import { makeTraceparent, classifyCarriers, mcpMetaTraceparent, a2aMetadataTraceparent } from '../lib/trace-context.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+export const REQUIRES_HOST_CALLBACK = "the host's MCP / A2A client calls the suite's fake MCP server / fake A2A peer";
+
+const DOC = 'multi-agent-execution.md §"W3C tracecontext across MCP + A2A composition" (RFC 0040 §B, RFC 0207)';
+const MCP_FIXTURE = 'conformance-mcp-tool-roundtrip';
+const A2A_FIXTURE = 'conformance-a2a-task-roundtrip';
+
+async function executionModelVersion(): Promise<number> {
+  try {
+    const res = await driver.get('/.well-known/openwop');
+    const caps = discoveryFamilies(res.json) as { multiAgent?: { executionModel?: { version?: unknown } } };
+    const v = caps.multiAgent?.executionModel?.version;
+    return typeof v === 'number' ? v : 0;
+  } catch {
+    return 0;
+  }
+}
+
+const MCP_CARRIED = 'openwop.requirement.0207.mcp-traceparent-carried';
+const A2A_CARRIED = 'openwop.requirement.0207.a2a-traceparent-carried';
 
-// Behavioral assertions in this file are currently `it.skip` placeholders;
-// the cross-host MCP / A2A peer harness (gated on OPENWOP_MCP_REAL_SERVER_URL
-// / OPENWOP_A2A_REAL_PEER_URL) hasn't landed yet. When it does, the
-// `it.skip` calls flip back to runnable `it(...)` bodies that read discovery
-// (via `driver.get('/.well-known/openwop')`), gate on `Phase 3` advertisement,
-// and drive the workflow through the configured real peer.
+function carried(leg: string, inMessage: unknown, header: string | undefined, traceId: string, inMessageName: string): { ok: boolean; message: string } {
+  const v = classifyCarriers(inMessage, header, traceId, { inMessage: inMessageName });
+  // eslint-disable-next-line no-console
+  console.info(`[cross-host-traceparent-propagation] ${leg}: carrier ${v.ok ? v.detail : 'none'}`);
+  return { ok: v.ok, message: v.ok ? `the outbound request carries the parent run's trace (carrier: ${v.detail})` : v.reason };
+}
 
-describe('cross-host-traceparent-propagation: behavioral (RFC 0040 §B)', () => {
-  // Behavioral assertion drives a workflow that calls an MCP tool via the
-  // host's `core.mcp.toolCall` node. The MCP peer (configured via
-  // OPENWOP_MCP_REAL_SERVER_URL) records inbound headers; the test reads
-  // the recorded headers and asserts `traceparent` is present + matches
-  // the format `00-{traceId}-{spanId}-{flags}` per W3C tracecontext.
-  // Until the peer harness lands, the assertion is surfaced as `it.skip` so
-  // test reporters track the gap rather than reporting a vacuous PASS.
-  // Marked out of stable profile via RFC 0042 §B (experimental tier):
-  // RFC 0040 is Accepted, but the cross-host behavioral scenario stays
-  // experimental until a non-steward host produces the behavioral
-  // traceparent evidence — RFC status (Accepted) and conformance-profile
-  // tier (experimental) are separate axes per RFC 0042 §B. Hosts that wire
-  // Phase 3 cross-host causation SHOULD advertise
-  // `multiAgent.executionModel.tier: 'experimental'` per RFC 0042 §A
-  // until that behavioral evidence lands. Path-to-runnable
-  // requires the MCP peer harness (OPENWOP_MCP_REAL_SERVER_URL) +
-  // inbound-header recorder; flips to a real `it()` on first non-steward
-  // Phase 3 host advertising matching capabilities.
-  it.skip('Phase 3 host MUST inject parent run\'s traceparent into outbound MCP requests — out of stable profile via RFC 0042');
+describe('cross-host-traceparent-propagation (RFC 0040 §B, RFC 0207 carriers)', () => {
+  it('a version >= 3 host carries the parent run\'s trace into its outbound MCP tools/call', async () => {
+    if ((await executionModelVersion()) < 3) return softSkip('inapplicable', 'multiAgent.executionModel.version < 3 — RFC 0040 §B binds only Phase 3 hosts');
+    if (!isFixtureAdvertised(MCP_FIXTURE)) return softSkip('inapplicable', `fixture ${MCP_FIXTURE} not advertised — the host does not consume MCP through the conformance node`);
+    const server = getMcpFakeServer();
+    if (!server) return softSkip('blocked', 'the suite fake MCP server is not started (OPENWOP_MCP_FAKE_SERVER=true)');
+    server.reset();
+    const tp = makeTraceparent();
+    const create = await driver.post('/v1/runs', { workflowId: MCP_FIXTURE, inputs: { text: 'traceparent-probe' } }, { headers: { traceparent: tp.header } });
+    if (create.status !== 201) return softSkip('blocked', `POST /v1/runs answered ${create.status} — the fixture run was refused`);
+    await pollUntilTerminal((create.json as { runId: string }).runId, { timeoutMs: 30_000 });
+    const call = server.invocations().find((i) => i.method === 'tools/call');
+    if (!call) return softSkip('blocked', 'the fixture run made no tools/call to the suite fake server — the host\'s MCP binding does not reach it');
+    const v = carried('tools/call', mcpMetaTraceparent(call.params), call.headers['traceparent'], tp.traceId, 'params._meta.traceparent');
+    expect(v.ok, req(MCP_CARRIED, DOC, v.message)).toBe(true);
+  });
 
-  // Same routing — out of stable profile via RFC 0042 §B until behavioral
-  // A2A cross-host evidence lands (RFC 0040 itself is already Accepted); the
-  // A2A test seam contract is still to be designed alongside the
-  // corresponding peer harness.
-  it.skip('Phase 3 host MUST inject parent run\'s traceparent into outbound A2A messages — out of stable profile via RFC 0042');
+  it('a version >= 3 host carries the parent run\'s trace into its outbound A2A message', async () => {
+    if ((await executionModelVersion()) < 3) return softSkip('inapplicable', 'multiAgent.executionModel.version < 3 — RFC 0040 §B binds only Phase 3 hosts');
+    if (!isFixtureAdvertised(A2A_FIXTURE)) return softSkip('inapplicable', `fixture ${A2A_FIXTURE} not advertised — the host does not consume A2A peers`);
+    const peer = getA2AFakePeer();
+    if (!peer) return softSkip('blocked', 'the suite fake A2A peer is not started (OPENWOP_A2A_FAKE_PEER=true)');
+    peer.reset();
+    peer.setNextState('REJECTED');
+    const tp = makeTraceparent();
+    const create = await driver.post('/v1/runs', { workflowId: A2A_FIXTURE, inputs: { driftScenario: 'rejected' } }, { headers: { traceparent: tp.header } });
+    if (create.status !== 201) return softSkip('blocked', `POST /v1/runs answered ${create.status} — the fixture run was refused`);
+    await pollUntilTerminal((create.json as { runId: string }).runId, { timeoutMs: 15_000 });
+    const sent = peer.invocations().find((i) => i.rpcMethod === 'SendMessage' || i.rpcMethod === 'message/send');
+    if (!sent) return softSkip('blocked', 'the fixture run sent no message to the suite fake peer — the host\'s A2A binding does not reach it');
+    const v = carried('SendMessage', a2aMetadataTraceparent(sent.body), sent.headers['traceparent'], tp.traceId, 'params.message.metadata.openwop.traceparent');
+    expect(v.ok, req(A2A_CARRIED, DOC, v.message)).toBe(true);
+  });
 });

package/src/scenarios/debugBundle.test.ts

@@ -22,6 +22,13 @@
  *   5. **Canary safety** — bundles MUST inherit redaction. A canary
  *      injected through workflow inputs MUST NOT echo verbatim in the
  *      bundle response.
+ *   6. **Spans join the trace (RFC 0207 §C, v1 only, non-gating)** — for a
+ *      run started with the suite's `traceparent`, every span's optional
+ *      `traceId` / `kind` / `status` has the schema's shape, and the
+ *      `openwop.run` span's `traceId` is the suite's. A host that returns
+ *      `spans: []` records `inapplicable` ("host emits no spans"), never a
+ *      pass. v2 has no debug-bundle read (RFC 0207 §C.11), so this leg carries
+ *      no requirement id and no Accepted bar.
  *
  * Cross-references SECURITY/invariants.yaml `secret-leakage-debug-bundle`.
  *
@@ -37,6 +44,7 @@ import { CANARY_MARKER, getCanary } from '../lib/canaries.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip } from '../lib/soft-skip.js';
+import { makeTraceparent } from '../lib/trace-context.js';
 
 const NOOP_WORKFLOW_ID = 'conformance-noop';
 const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);
@@ -222,3 +230,36 @@ describe.skipIf(SKIP_NO_NOOP)('debug-bundle: redaction inheritance per SECURITY/
     )).toBe(false);
   });
 });
+
+describe.skipIf(SKIP_NO_NOOP)('debug-bundle: spans join the trace (RFC 0207 §C, v1 only, non-gating)', () => {
+  const LEG = 'openwop.it.debugBundle.spans-join-the-trace';
+  const KINDS = new Set(['internal', 'server', 'client', 'producer', 'consumer']);
+  const CODES = new Set(['unset', 'ok', 'error']);
+  it('span traceId / kind / status have the RFC 0207 shape and the run span joins the caller trace', async () => {
+    if (!(await isAdvertised())) return softSkip('inapplicable', 'debugBundle not advertised by this host');
+    const tp = makeTraceparent();
+    const create = await driver.post('/v1/runs', { workflowId: NOOP_WORKFLOW_ID }, { headers: { traceparent: tp.header } });
+    expect(create.status).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+    await pollUntilTerminal(runId);
+    const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/debug-bundle`);
+    expect(res.status).toBe(200);
+    const spans = ((res.json as DebugBundleShape | undefined)?.spans ?? []) as Array<Record<string, unknown>>;
+    if (spans.length === 0) return softSkip('inapplicable', 'host emits no spans (spans: []) — the RFC 0207 §C trace-join rule has nothing to hold');
+    for (const s of spans) {
+      const where = `span ${String(s['name'])}`;
+      if (s['traceId'] !== undefined) {
+        expect(typeof s['traceId'] === 'string' && /^[0-9a-f]{32}$/.test(s['traceId']) && s['traceId'] !== '0'.repeat(32), req(LEG, 'debug-bundle.md §"spans field" (RFC 0207 §C)', `${where}: traceId MUST be 32 lowercase hex, not all zeros (got ${JSON.stringify(s['traceId'])})`)).toBe(true);
+      }
+      if (s['kind'] !== undefined) expect(KINDS.has(String(s['kind'])), req(LEG, 'debug-bundle.md §"spans field"', `${where}: kind MUST be internal | server | client | producer | consumer (got ${JSON.stringify(s['kind'])})`)).toBe(true);
+      if (s['status'] !== undefined) {
+        const st = s['status'] as Record<string, unknown> | null;
+        const ok = st !== null && typeof st === 'object' && CODES.has(String(st['code'])) && Object.keys(st).every((k) => k === 'code' || (k === 'message' && typeof st['message'] === 'string'));
+        expect(ok, req(LEG, 'debug-bundle.md §"spans field"', `${where}: status MUST be the closed { code: unset | ok | error, message? } (got ${JSON.stringify(st)})`)).toBe(true);
+      }
+    }
+    const run = spans.find((s) => s['name'] === 'openwop.run');
+    if (run === undefined || run['traceId'] === undefined) return softSkip('inapplicable', 'the bundle carries no openwop.run span with a traceId (traceId is SHOULD) — the trace-join half has nothing to compare');
+    expect(run['traceId'], req(LEG, 'debug-bundle.md §"spans field" (RFC 0207 §C)', 'the openwop.run span of a run started with an honoured inbound traceparent MUST carry that trace id')).toBe(tp.traceId);
+  });
+});

package/src/scenarios/fixtures-valid.test.ts

@@ -328,3 +328,75 @@ describe('fixtures: prompt-template schema validity', () => {
     }
   });
 });
+
+describe('fixtures: interrupt-payload kind binding (v1 + v2 suspend-request)', () => {
+  // `fixtures/interrupt-payloads/` holds one minimal InterruptPayload per kind
+  // (`interrupt-payload-<kind>.json`) and mismatched kind/data pairs
+  // (`negative-<kind>-with-<data-kind>-data.json`). Suite 2.36.0: the `data`
+  // union was an unbound `oneOf`, so the minimal `conversation.start` and
+  // `conversation.close` payloads — both `{ conversationId }` — matched two
+  // branches and FAILED, while a payload whose `data` belonged to another kind
+  // passed. The schema now binds each kind to its own shape; every positive
+  // MUST validate and every negative MUST NOT, under v1 AND v2.
+  //
+  // A negative is load-bearing only if it fails for the binding and nothing
+  // else, so each one's `data` is also validated under the kind it actually
+  // belongs to — a negative that is malformed on its own would pass this test
+  // with or without the binding.
+  const KINDS = ['approval', 'clarification', 'external-event', 'custom', 'conversation.start', 'conversation.exchange', 'conversation.close', 'low-confidence'];
+  const slug = (k: string): string => k.replace('.', '-');
+  const dir = join(FIXTURES_DIR, 'interrupt-payloads');
+  const files = readdirSync(dir).filter((f) => f.endsWith('.json')).sort();
+  const positives = files.filter((f) => f.startsWith('interrupt-payload-'));
+  const negatives = files.filter((f) => f.startsWith('negative-'));
+
+  function validator(version: 'v1' | 'v2'): (doc: unknown) => { ok: boolean; errors: string } {
+    const ajv = new Ajv2020({ allErrors: true, strict: false });
+    addFormats(ajv);
+    const schemaDir = version === 'v1' ? SCHEMAS_DIR : join(SCHEMAS_DIR, 'v2');
+    for (const f of readdirSync(schemaDir).filter((n) => n.endsWith('.schema.json'))) {
+      const s = JSON.parse(readFileSync(join(schemaDir, f), 'utf8')) as { $id?: string };
+      if (s.$id && ajv.getSchema(s.$id)) continue;
+      ajv.addSchema(s);
+    }
+    const fn = ajv.getSchema(`https://openwop.dev/spec/${version}/suspend-request.schema.json`);
+    if (!fn) throw new Error(`suspend-request.schema.json (${version}) did not register`);
+    return (doc) => {
+      const ok = fn(doc) === true;
+      return { ok, errors: (fn.errors ?? []).map((e: ErrorObject) => `${e.instancePath || '/'}: ${e.message}`).join('\n') };
+    };
+  }
+  const load = (f: string): { kind: string; key: string; data: unknown } =>
+    JSON.parse(readFileSync(join(dir, f), 'utf8')) as { kind: string; key: string; data: unknown };
+
+
+  it('v1 + v2: one positive per kind, and every one validates — including the minimal conversation.start / conversation.close', () => {
+    expect(
+      positives.map((f) => f.slice('interrupt-payload-'.length, -'.json'.length)).sort(),
+      req('openwop.it.fixtures-valid.interrupt-payloads-positive-per-kind-validates', 'spec/v1/interrupt.md §Per-kind payloads; spec/v2/core/interrupt.md', 'fixtures/interrupt-payloads/ MUST carry exactly one interrupt-payload-<kind>.json per InterruptPayload kind'),
+    ).toEqual(KINDS.map(slug).sort());
+    for (const version of ['v1', 'v2'] as const) {
+      const validate = validator(version);
+      for (const f of positives) {
+        const { ok, errors } = validate(load(f));
+        expect(ok, req('openwop.it.fixtures-valid.interrupt-payloads-positive-per-kind-validates', 'spec/v1/interrupt.md §Per-kind payloads; spec/v2/core/interrupt.md', `${version}: interrupt-payloads/${f} MUST validate against suspend-request.schema.json:\n${errors}`)).toBe(true);
+      }
+    }
+  });
+
+  it('v1 + v2: every mismatched kind/data negative is refused, and only because of the binding', () => {
+    expect(negatives.length, req('openwop.it.fixtures-valid.interrupt-payloads-mismatched-kind-data-refused', 'spec/v1/interrupt.md §Per-kind payloads; spec/v2/core/interrupt.md', 'fixtures/interrupt-payloads/ MUST carry at least one mismatched kind/data negative')).toBeGreaterThan(0);
+    for (const version of ['v1', 'v2'] as const) {
+      const validate = validator(version);
+      for (const f of negatives) {
+        const doc = load(f);
+        const dataKind = KINDS.find((k) => f.endsWith(`-with-${slug(k)}-data.json`));
+        expect(dataKind, req('openwop.it.fixtures-valid.interrupt-payloads-mismatched-kind-data-refused', 'spec/v1/interrupt.md §Per-kind payloads; spec/v2/core/interrupt.md', `interrupt-payloads/${f} MUST be named negative-<kind>-with-<data-kind>-data.json`)).toBeDefined();
+        expect(dataKind === doc.kind, req('openwop.it.fixtures-valid.interrupt-payloads-mismatched-kind-data-refused', 'spec/v1/interrupt.md §Per-kind payloads; spec/v2/core/interrupt.md', `interrupt-payloads/${f}: the data kind MUST differ from the declared kind`)).toBe(false);
+        expect(validate(doc).ok, req('openwop.it.fixtures-valid.interrupt-payloads-mismatched-kind-data-refused', 'spec/v1/interrupt.md §Per-kind payloads; spec/v2/core/interrupt.md', `${version}: interrupt-payloads/${f} (kind ${doc.kind} carrying ${String(dataKind)} data) MUST NOT validate — data is bound to kind`)).toBe(false);
+        const rebound = validate({ ...doc, kind: dataKind });
+        expect(rebound.ok, req('openwop.it.fixtures-valid.interrupt-payloads-mismatched-kind-data-refused', 'spec/v1/interrupt.md §Per-kind payloads; spec/v2/core/interrupt.md', `${version}: interrupt-payloads/${f}'s data MUST validate under its own kind ${String(dataKind)}, or the negative fails for a reason other than the binding:\n${rebound.errors}`)).toBe(true);
+      }
+    }
+  });
+});

package/src/scenarios/inbound-credential-no-passthrough.test.ts

@@ -0,0 +1,115 @@
+/**
+ * RFC 0200 §E — a credential the host received inbound never leaves it (suite 2.36.0,
+ * both majors; invariant `inbound-credential-no-passthrough`).
+ *
+ * A host that calls a webhook receiver, an MCP server or an A2A peer on a caller's behalf
+ * is a confused deputy the moment it reuses the caller's own `Authorization`, `Cookie` or
+ * `Proxy-Authorization` on the outbound request: the destination receives a credential
+ * minted for the HOST, carrying the caller's full privilege, and can replay it back. MCP
+ * states the same rule for its mounts ("the MCP server MUST NOT pass through the token it
+ * received from the MCP client"); OpenWOP had only `trigger-bridge.md` §F.1, which covers
+ * inbound headers into RUN DATA and says nothing about egress.
+ *
+ * **The witness is the suite's own credential.** The suite knows its API key, and it mints
+ * two more canaries it sends on the run-creating request. Every outbound request the host
+ * makes lands at a receiver the SUITE owns, so the comparison is against bytes the suite
+ * controls end to end — not against the host's report of its own behaviour.
+ *
+ * One requirement id. The unaided leg is the webhook one; it is `blocked`, never a pass,
+ * when no delivery is captured, because a hop that never happened leaks nothing.
+ *
+ * NOT witnessed, and deliberately: a credential the host re-derives or re-encodes, one
+ * copied into a nested body field under a name the suite cannot guess, and a DPoP proof
+ * (no committed host advertises a sender-constrained lane). The header and raw-body
+ * canaries are the witnessed subset of a wider MUST — `SECURITY/invariants.yaml` and
+ * `SECURITY/threat-model-secret-leakage.md` §6 say so too.
+ *
+ * How it FAILS (the sabotage run before citing the row):
+ *   (a) the host copies the inbound Authorization onto the webhook delivery → the key is
+ *       found in a captured header
+ *   (b) the host forwards the inbound Cookie into the delivery body        → c1 is found
+ *
+ * @see spec/v1/auth.md §"Onward hops"; spec/v2/core/security-defaults.md §"Onward hops"
+ * @see RFCS/0200-host-as-oauth-protected-resource.md §E
+ * @see SECURITY/invariants.yaml id: inbound-credential-no-passthrough
+ */
+
+import { afterEach, describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { driver } from '../lib/driver.js';
+import { loadEnv } from '../lib/env.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { targetMajor } from '../lib/seams.js';
+import { startModalReceiver } from '../lib/webhook-receiver.js';
+import { projectBoundId } from '../lib/bound-id.js';
+
+const DOC = 'spec/v1/auth.md §"Onward hops"; spec/v2/core/security-defaults.md §"Onward hops" (RFC 0200 §E)';
+const ID = 'openwop.requirement.0200.inbound-credential-no-passthrough';
+const FIXTURE = 'conformance-noop';
+const WAIT_MS = 15_000;
+
+const webhooksPath = (suffix = ''): string => `${targetMajor() === 2 ? '' : '/v1'}/webhooks${suffix}`;
+const runsPath = (suffix = ''): string => `${targetMajor() === 2 ? '' : '/v1'}/runs${suffix}`;
+
+let cleanup: (() => Promise<void>) | null = null;
+afterEach(async () => {
+  if (cleanup) { const c = cleanup; cleanup = null; await c(); }
+});
+
+async function waitFor(pred: () => boolean, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (pred()) return true;
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  return pred();
+}
+
+describe('RFC 0200 §E — inbound-credential-no-passthrough (the caller\'s credential never leaves the host)', () => {
+  it('no webhook delivery carries the caller\'s Authorization, Cookie or Proxy-Authorization', async () => {
+    const env = loadEnv();
+    const rx = await startModalReceiver();
+    let subscriptionId: string | null = null;
+    cleanup = async () => {
+      if (subscriptionId !== null) { try { await driver.delete(webhooksPath(`/${projectBoundId(subscriptionId)}`)); } catch { /* best effort */ } }
+      await rx.close();
+    };
+    const target = rx.urlFor('no-echo');
+    const reg = await driver.post(webhooksPath(), { url: target.url, events: ['run.completed'] });
+    if (reg.status === 404 || reg.status === 501) return softSkip('inapplicable', `this host serves no webhook registration (${reg.status}) — it makes no webhook hop for §E to cover`);
+    if (reg.status !== 201) {
+      return softSkip('blocked', `the subscription could not be registered (${reg.status}) — with no delivery there is no outbound request to inspect${target.tunnelled ? '' : '; set OPENWOP_WEBHOOK_RECEIVER_URL to a public https front if the host refuses the loopback receiver'}`);
+    }
+    subscriptionId = String((reg.json as { webhookId?: unknown } | null)?.webhookId ?? '') || null;
+
+    // The three canaries, all sent on the run-creating request. The API key is the one the
+    // suite itself authenticates with, so a host that forwards it is handing a receiver a
+    // credential for this very host.
+    const c1 = `c1-${randomBytes(16).toString('hex')}`;
+    const c2 = Buffer.from(`canary:${randomBytes(16).toString('hex')}`).toString('base64');
+    const created = await driver.post(runsPath(), { workflowId: FIXTURE }, {
+      headers: { Cookie: `ow_canary=${c1}`, 'Proxy-Authorization': `Basic ${c2}` },
+    });
+    if (created.status !== 201) return softSkip('blocked', `could not start ${FIXTURE} (${created.status}) — no run, no delivery, nothing to inspect`);
+
+    const delivered = await waitFor(() => rx.hits.some((h) => !h.verification), WAIT_MS);
+    // A hop that never happened leaks nothing: this is `blocked`, not a pass.
+    if (!delivered) return softSkip('blocked', `no delivery reached the suite-owned receiver within ${WAIT_MS}ms — an unmade hop cannot witness that a credential did not cross it`);
+
+    const canaries: Array<[string, string]> = [['the suite\'s own API key', env.apiKey], ['the Cookie canary', c1], ['the Proxy-Authorization canary', c2]];
+    const found: string[] = [];
+    for (const hit of rx.hits) {
+      const headerBytes = Object.entries(hit.headers).map(([k, v]) => `${k}: ${Array.isArray(v) ? v.join(',') : String(v ?? '')}`).join('\n');
+      for (const [label, value] of canaries) {
+        if (value.length < 8) continue;
+        if (headerBytes.includes(value)) found.push(`${label} in a request header of ${hit.method} ${hit.path}`);
+        if (hit.body.includes(value)) found.push(`${label} in the delivery body of ${hit.method} ${hit.path}`);
+      }
+    }
+    expect(
+      found,
+      req(ID, DOC, `a host MUST NOT attach a credential it received inbound to any outbound request — the suite's API key and two cookie/proxy canaries were sent on the run-creating request and MUST appear in no header or body captured at the suite-owned receiver (${rx.hits.length} capture(s) inspected)`),
+    ).toEqual([]);
+  }, 90_000);
+});