@openwop/openwop-conformance 2.39.2 → 2.39.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.39.3] — 2026-09-25 — a pinned receiver port is shared, and tenant B really is tenant B
+
+- **A pinned receiver port is shared, never re-bound — the public-cut hang behind three RFC 0214 legs.** On a public cut `OPENWOP_WEBHOOK_RECEIVER_PORT` is pinned (the port the front forwards to), and `lib/scoped-receiver.ts` had every receiver call `server.listen` on it. A second receiver alive at the same time — the §B redirect and §A after-Delete legs start two, and the §A/§C delivery receiver stays open until `afterAll` — hit `EADDRINUSE` with no `error` listener attached, so its `listen` promise never settled and the leg hung to vitest's timeout: `v2-a2a-push-delivery` §A-delete, §B-redirect and §D-fork on both the 2.39.0 and 2.39.2 public cuts of the v2 reference host. Loopback binds ephemeral ports, which is why no rehearsal showed it. All receivers on a pinned port now share one ref-counted listener (routing was already per nonce); a bind failure now rejects at once with a message naming the port; `close()` no longer waits on keep-alive sockets. Three lib self-tests pin it (two concurrent receivers; close one, the sibling keeps serving; a squatted port rejects in < 5 s) — reverting to per-receiver `listen` fails the first two in milliseconds.
+- **A scenario's second credential is the one that gets sent: `workspace-cross-tenant-isolation-blackbox` never authenticated as tenant B.** It passed `OPENWOP_TEST_TENANT_B_API_KEY` as an `Authorization` header without `authenticated: false`. `lib/driver.ts` then overwrote that header with the default `OPENWOP_API_KEY`, so every "tenant B" request was the owner reading its own file. That returns `200`, which the leg records as a cross-tenant leak. openwop-app measured it as a false `executed-fail` on its in-process lane (openwop-app#4107), while a direct HTTP repro with the same two keys answered `404`. The fix is in the driver: a caller-supplied `Authorization` header (any case) is now sent as given and is the only credential on the request. The scenario also passes `authenticated: false` explicitly. It records `blocked` before any assertion when the key is absent, equals `OPENWOP_API_KEY`, or is refused `401`. A sweep of every tenant-B reader found the rest correct: `auth-challenge-no-oracle`, `v2-sse-last-event-id-cursor`, `v2-mcp-mount-map`, `v2-a2a-agent-cards`, `v2-a2a-operation-map` and `v2-oauth-client-pkce-state-iss` (via `bearerInit`) pass `authenticated: false`, and `v2-artifact-a2a-shape` and `v2-mcp-tasks` use raw `fetch`. One scenario outside the tenant-B set had the same defect: `interrupt-auth-required-resume` sent its `OPENWOP_TEST_LOW_SCOPE_KEY` the same way. Its "low-scope" resolve was really a full-scope one, a false miss on the required `403`. That is fixed by the same driver change and made explicit in the scenario. New suite self-test `src/lib/driver-caller-credential.test.ts` stubs `fetch` and pins the rule. It is sabotage-proved: on the old driver its caller-header leg fails.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.39.3` because `2.39.2` is tagged and published, and RFC 0215's six gap rows change `spec/v1/gaps.json`, which `@openwop/spec-artifacts` ships. No scenario change.
+
 ## [2.39.2] — 2026-09-25 — RFC 0208's unreadable-task leg records its own row
 
 - **`0208.a2a-unreadable-not-found` records its own row.** In `v2-a2a-operation-map`, one `it()` cited both RFC 0208's `a2a-unreadable-not-found` and RFC 0211's `a2a-unreadable-not-found-details`. The per-`it` ledger keeps only the last id, so the 0208 row never reached a bundle: it is absent from the certified 2.38.0 v2-reference cut, and it is the one row keeping RFC 0208 from `Accepted` (the other 18 pass). This is the same class as openwop#1552. RFC 0211's detail comparison now has its own `it()` with its own setup, so each id records once. `scripts/check-req-only.mjs` already failed an `it()` citing two LITERAL ids, but it read helper-built ids (`R('x')`, `R11('x')`) as no id at all, which is how this one passed. It now counts each (helper, slug) as an id, fails against the 2.39.1 scenario, and finds no other case in 633 scenario files.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.2 @openwop/spec-artifacts@2.39.2
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.3 @openwop/spec-artifacts@2.39.3
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.2",
-  "stampSha256": "d3e9417fe0ae348a07cf66c1167cefe100d1dcd43e053c238b82195c77699e9f"
+  "version": "2.39.3",
+  "stampSha256": "16b07c57b04e10df5de4d4bcf3cfbac8fbda75c1410aac9348f14a823ba31f68"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.39.2",
+  "version": "2.39.3",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.39.2"
+    "@openwop/spec-artifacts": "2.39.3"
   }
 }

package/requirements.json

@@ -35854,7 +35854,7 @@
     {
       "id": "openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent",
       "file": "workspace-cross-tenant-isolation-blackbox.test.ts",
-      "line": 46,
+      "line": 52,
       "title": "a file written by owner A is unreadable + un-enumerable by a second-tenant credential",
       "explicitId": "openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.2",
-  "corpusTag": "v2.39.2",
+  "version": "2.39.3",
+  "corpusTag": "v2.39.3",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "bac1af1953801e2e3e80cf3aa006b168611cb5b20ccb70c52674815437204e85",
-    "api/v2/asyncapi.yaml": "77f9311485f7220c28fb81937670ba415b9a3edc0adf73ad3c77e1e288247548",
-    "api/v2/openapi.yaml": "5bf2dd1dfd7762e0c108ffe51367933108d701d8dd8549aa6e21f1cbece7291b",
+    "api/seams-v2.yaml": "e51c61c5d0fe876b5851e6583a08a61e0563d44985654299db98dbcc5d7ff6ce",
+    "api/v2/asyncapi.yaml": "150a48f15f5c3b984aff61055304f30299a75f5b9561ff1b4c788c4a40b64325",
+    "api/v2/openapi.yaml": "c3969b2fbfde19dfd9a42af4a67da8d34cf3135ad8314fe7211173a37d58ed96",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "4b144e92eae7afe2e541888d89c5461853f0cf1b929e9dca6a253fbe78d3e591",
+    "spec/v1/core-standard-manifest.json": "796de9d8793ff2243fee9c5ffe3b9adc49b0f2e663147b965043de92594352e9",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "c20fe027514c8778b34c8fadde8bc7d1db5c4034638d76d297cc89a5bcae7ba2",
+    "spec/v1/gaps.json": "76b986a5d12be1c5dc9368bc79c6d8aa99a5e916b3cca3fc3eb6a84577f1f32a",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -292,9 +292,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "00fba2903eb7f34d8c98a7cd11fee02590f5390f3109e5bfdba85f9ceeeddf83",
+    "spec/v2/release.json": "a8988f480ec268554cdc9cb0a6019172c89aa09cd588f81bfd6166ab5c65a260",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "314e72a7687918b11a89875d0b735ea4ec1589bd6ccb8abcf574d5e2fbba5333"
+    "spec/v2/surface-baseline.json": "7a67a1a935db83145b1fffad3828e09c38f89170d360d2a793ae0634c3164c11"
   },
-  "corpusCommit": "57cc8d88f96abb980c605cc386167861b227ff97"
+  "corpusCommit": "c62b05884b9b83f4016890582e8606e3bc74ad6a"
 }

package/src/lib/driver.ts

@@ -22,6 +22,8 @@ export interface OpenWOPResponse {
 export interface OpenWOPRequestInit {
   readonly headers?: Record<string, string>;
   readonly body?: unknown;
+  /** `false` sends no default credential. A caller-supplied `Authorization`
+   *  header is always sent as given, whatever this says. */
   readonly authenticated?: boolean;
 }
 
@@ -54,7 +56,14 @@ class OpenWOPDriver {
     if (init.body !== undefined && headers['Content-Type'] === undefined) {
       headers['Content-Type'] = 'application/json';
     }
-    if (init.authenticated !== false) {
+    // A caller-supplied Authorization header (any case) is the credential the
+    // scenario chose — a second tenant's key, a low-scope key — and is sent as
+    // given. Until 2.39.3 the default key overwrote it unless the caller also
+    // passed `authenticated: false`, so "tenant B reads A's file" was really the
+    // owner reading its own file (200 → a false cross-tenant leak), and a
+    // low-scope resolve was really a full-scope one (a false 403 miss).
+    const callerAuth = Object.keys(headers).some((h) => h.toLowerCase() === 'authorization');
+    if (init.authenticated !== false && !callerAuth) {
       headers.Authorization = `Bearer ${env.apiKey}`;
     }
 

package/src/lib/scoped-receiver.ts

@@ -97,11 +97,69 @@ export interface ScopedReceiver {
  * with the nonce prefix stripped — exactly what it would see on a listener of
  * its own. It owns the response.
  */
+/**
+ * The listener behind every scoped receiver.
+ *
+ * On a public cut the operator PINS the receiver port (`OPENWOP_WEBHOOK_RECEIVER_PORT`,
+ * the one the front forwards to), so every receiver alive at once must share ONE
+ * server on it: routing is already per-nonce (`routeFronted`), so the listener
+ * only has to exist. Until 2.39.3 each receiver bound the pinned port itself; a
+ * second concurrent receiver hit EADDRINUSE with no `error` listener attached,
+ * its `listen` promise never settled, and the leg hung to vitest's timeout — the
+ * three `v2-a2a-push-delivery` legs lost on the 2.39.0 and 2.39.2 public cuts.
+ * Loopback runs bind ephemeral ports, which is why no rehearsal ever showed it.
+ *
+ * Unpinned, each receiver keeps a listener of its own (ephemeral port).
+ */
+interface Listener { server: Server; port: number; origin: string; members: Set<Member>; refs: number }
+interface Member { nonce: string; foreign: number }
+const sharedByPort = new Map<string, Promise<Listener>>();
+
+function handlerFor(members: Set<Member>) {
+  return (request: IncomingMessage, res: ServerResponse): void => {
+    // Counted BEFORE routing, per live receiver: `routeFronted` answers an
+    // unknown nonce itself and cannot report that it did, and a request that is
+    // not an exercise's own must still be visible in that exercise's failure detail.
+    const path = withoutFrontPath(WEBHOOK_FRONT_ENV, request.url ?? '/');
+    for (const m of members) if (!path.startsWith(`${FRONT_MUX_PREFIX}${m.nonce}`)) m.foreign += 1;
+    if (routeFronted(WEBHOOK_FRONT_ENV, request, res)) return;
+    // Not an `/fx/` path at all: a stranger, or a host that dropped the path it
+    // was given. Answered, never recorded — a receiver that counts what it was
+    // not addressed to is the defect this helper exists to remove.
+    request.resume();
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'this receiver serves one conformance exercise; address its nonce path' }));
+  };
+}
+
+async function listen(port: number, binding: { bind: string; advertise: string }): Promise<Listener> {
+  const members = new Set<Member>();
+  const server = createServer(handlerFor(members));
+  await new Promise<void>((resolve, reject) => {
+    const onError = (err: Error): void => {
+      reject(new Error(`scoped receiver could not bind ${binding.bind}:${port} — ${err.message}. A pinned OPENWOP_WEBHOOK_RECEIVER_PORT must be free for this process (another process holds it?)`));
+    };
+    server.once('error', onError);
+    server.listen(port, binding.bind, () => { server.off('error', onError); resolve(); });
+  });
+  const addr = server.address();
+  if (typeof addr !== 'object' || addr === null) throw new Error('receiver address unavailable');
+  return { server, port: addr.port, origin: `http://${binding.advertise}:${addr.port}`, members, refs: 0 };
+}
+
+function shut(server: Server): Promise<void> {
+  return new Promise<void>((resolve) => {
+    // A keep-alive socket held open through a tunnel must not keep close() pending.
+    (server as Server & { closeIdleConnections?: () => void }).closeIdleConnections?.();
+    server.close(() => resolve());
+    (server as Server & { closeAllConnections?: () => void }).closeAllConnections?.();
+  });
+}
+
 export async function startScopedReceiver(
   respond: (hit: ScopedHit, res: ServerResponse) => void,
 ): Promise<ScopedReceiver> {
   const nonce = randomBytes(9).toString('hex');
-  let foreign = 0;
   const own = (request: IncomingMessage, res: ServerResponse): void => {
     const chunks: Buffer[] = [];
     request.on('data', (c: Buffer) => chunks.push(c));
@@ -117,41 +175,47 @@ export async function startScopedReceiver(
       );
     });
   };
-  registerBehindFront(WEBHOOK_FRONT_ENV, nonce, own);
-  const server = createServer((request: IncomingMessage, res: ServerResponse) => {
-    // Counted BEFORE routing: `routeFronted` answers an unknown nonce itself and
-    // cannot report that it did, and a request that is not this exercise's must
-    // still be visible in the failure detail.
-    if (!withoutFrontPath(WEBHOOK_FRONT_ENV, request.url ?? '/').startsWith(`${FRONT_MUX_PREFIX}${nonce}`)) foreign += 1;
-    if (routeFronted(WEBHOOK_FRONT_ENV, request, res)) return;
-    // Not an `/fx/` path at all: a stranger, or a host that dropped the path it
-    // was given. Answered, never recorded — a receiver that counts what it was
-    // not addressed to is the defect this helper exists to remove.
-    request.resume();
-    res.writeHead(404, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ error: 'this receiver serves one conformance exercise; address its nonce path' }));
-  });
   const pinned = Number(process.env['OPENWOP_WEBHOOK_RECEIVER_PORT'] ?? '');
-  const bindPort = Number.isInteger(pinned) && pinned > 0 && pinned < 65536 ? pinned : 0;
+  const isPinned = Number.isInteger(pinned) && pinned > 0 && pinned < 65536;
   const binding = receiverBinding();
-  await new Promise<void>((resolve) => server.listen(bindPort, binding.bind, () => resolve()));
-  const addr = server.address();
-  if (typeof addr !== 'object' || addr === null) throw new Error('receiver address unavailable');
-  const origin = `http://${binding.advertise}:${addr.port}`;
-  const front = resolvePublicFront(WEBHOOK_FRONT_ENV, origin);
+  let listener: Listener;
+  let key: string | undefined;
+  if (isPinned) {
+    key = `${binding.bind}:${pinned}`;
+    let p = sharedByPort.get(key);
+    if (!p) {
+      p = listen(pinned, binding);
+      sharedByPort.set(key, p);
+      p.catch(() => { if (sharedByPort.get(key!) === p) sharedByPort.delete(key!); });
+    }
+    listener = await p;
+  } else {
+    listener = await listen(0, binding);
+  }
+  const member: Member = { nonce, foreign: 0 };
+  listener.members.add(member);
+  listener.refs += 1;
+  registerBehindFront(WEBHOOK_FRONT_ENV, nonce, own);
+  const front = resolvePublicFront(WEBHOOK_FRONT_ENV, listener.origin);
+  let closed = false;
   return {
-    server,
+    server: listener.server,
     url: `${front.url.replace(/\/+$/, '')}${FRONT_MUX_PREFIX}${nonce}`,
     tunnelled: front.tunnelled,
-    localUrl: `${origin}${FRONT_MUX_PREFIX}${nonce}`,
+    localUrl: `${listener.origin}${FRONT_MUX_PREFIX}${nonce}`,
     nonce,
-    port: addr.port,
-    foreign: () => foreign,
-    close: () =>
-      new Promise<void>((resolve) => {
-        unregisterBehindFront(WEBHOOK_FRONT_ENV, nonce);
-        server.close(() => resolve());
-      }),
+    port: listener.port,
+    foreign: () => member.foreign,
+    close: async () => {
+      if (closed) return;
+      closed = true;
+      unregisterBehindFront(WEBHOOK_FRONT_ENV, nonce);
+      listener.members.delete(member);
+      listener.refs -= 1;
+      if (listener.refs > 0) return;
+      if (key !== undefined && sharedByPort.get(key) !== undefined) sharedByPort.delete(key);
+      await shut(listener.server);
+    },
   };
 }
 

package/src/scenarios/interrupt-auth-required-resume.test.ts

@@ -76,7 +76,8 @@ describe.skipIf(SKIP)('interrupt: auth-required — insufficient scope returns 4
     const resolve = await driver.post(
       `/v1/runs/${encodeURIComponent(runId)}/interrupts/${encodeURIComponent(NODE_ID)}`,
       { resumeValue: { action: 'accept' } },
-      { headers: { Authorization: `Bearer ${lowScopeKey}` } },
+      // `authenticated: false`: the low-scope key alone, never the full-scope default.
+      { authenticated: false, headers: { Authorization: `Bearer ${lowScopeKey}` } },
     );
     expect(resolve.status, req('openwop.it.interrupt-auth-required-resume.bearer-without-approvals-respond-scope-is-rejected', 
       'auth.md §scopes + interrupt-profiles.md §openwop-interrupt-auth-required',

package/src/scenarios/workspace-cross-tenant-isolation-blackbox.test.ts

@@ -19,6 +19,8 @@
  * Gating: soft-skips unless `capabilities.workspace.supported` AND
  * `OPENWOP_TEST_TENANT_B_API_KEY` (a credential for a SECOND, distinct
  * tenant·workspace) is supplied — the suite cannot mint a second tenant itself.
+ * A key equal to OPENWOP_API_KEY, or one the host refuses 401, is `blocked`
+ * before any assertion: neither can measure a second-tenant read.
  *
  * @see RFCS/0059-agent-workspace.md §E WCT-1
  * @see SECURITY/invariants.yaml workspace-cross-tenant-isolation
@@ -27,6 +29,7 @@ import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { randomUUID } from 'node:crypto';
 import { driver } from '../lib/driver.js';
+import { loadEnv } from '../lib/env.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
 
@@ -40,7 +43,10 @@ async function workspaceSupported(): Promise<boolean> {
 }
 
 const tenantBKey = process.env.OPENWOP_TEST_TENANT_B_API_KEY;
-const asTenantB = { headers: { Authorization: `Bearer ${tenantBKey ?? ''}` } };
+// `authenticated: false` so the driver adds no default (owner-A) credential. Until
+// 2.39.3 it overwrote this header, so every "tenant B" request below was owner A
+// reading its own file — a false leak (200) on any host that set the key.
+const asTenantB = { authenticated: false, headers: { Authorization: `Bearer ${tenantBKey ?? ''}` } };
 
 describe('workspace-cross-tenant-isolation (black-box): a §C file MUST NOT leak across owners (RFC 0059 §E WCT-1)', () => {
   it('a file written by owner A is unreadable + un-enumerable by a second-tenant credential', async () => {
@@ -51,6 +57,13 @@ describe('workspace-cross-tenant-isolation (black-box): a §C file MUST NOT leak
       return softSkip('blocked', '[workspace-cross-tenant-isolation-blackbox] OPENWOP_TEST_TENANT_B_API_KEY not supplied; skipping the production-path cross-tenant assertion');
     }
 
+    if (tenantBKey.trim() === loadEnv().apiKey) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY equals OPENWOP_API_KEY — the second credential must resolve to a DIFFERENT tenant·workspace, or the leg measures nothing');
+
+    // Decided before any assertion: a tenant-B key the host refuses 401 is a
+    // harness precondition, not an isolation verdict either way.
+    const probeB = await driver.get('/v1/host/workspace/files', asTenantB);
+    if (probeB.status === 401) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY was refused 401 — it does not authenticate on this host, so no second-tenant read can be measured');
+
     const path = `wct-blackbox-${randomUUID()}.md`;
     const secret = `WCT1-BLACKBOX-SECRET-${randomUUID()}`;