@openwop/openwop-conformance 2.45.10 → 2.45.12

package/src/scenarios/v2-provider-conflict.test.ts

@@ -9,7 +9,19 @@
  * precedence is gone. A connector MAY name a provider by the qualified form
  * `<packName>#<id>`, which resolves only to the named pack's definition.
  *
- * Seam-gated: driven through the RFC 0095 install/resolve seams
+ * TWO WITNESS PATHS (RFC 0233), and a host is measured on every path it offers.
+ * The NORMATIVE-SURFACE path reads `GET /connection-providers` and
+ * `GET /connection-providers/{providerId}` when the host advertises
+ * `connections.providerRead`; the conflict was caused operator-side by
+ * installing the §D fixture pair, and the registry describes the outcome
+ * (`lib/provider-registry-witness.ts`). Without the fixture installed, its
+ * legs are `inapplicable`; the uniqueness leg runs on any host with the facet.
+ * With neither `providerRead` nor the seams the legs are `inapplicable`
+ * (RFC 0233 §Decisions 2) — a host advertising `packsSupported` SHOULD
+ * advertise `providerRead`. Until 2.45.12 that case recorded `blocked`, a
+ * seam-only MUST that `conformance.md` §Witness class forbids.
+ *
+ * The SEAM path is driven through the RFC 0095 install/resolve seams
  * (`POST /v1/host/sample/connection-packs/{install,resolve}`,
  * `spec/v1/host-sample-test-seams.md` §10; the driver rewrites the v1 seam path
  * to `/conformance/seams/sample/…` under target major 2), gated on
@@ -37,6 +49,7 @@
  * rather than assumed.
  *
  * @see RFCS/0177-v2-registry-packs-and-extension-tail.md §D.1
+ * @see RFCS/0233-connection-provider-registry-read.md
  * @see spec/v2/core/connection-packs.md
  * @see spec/v1/host-sample-test-seams.md §10
  */
@@ -50,7 +63,9 @@ import { behaviorGate } from '../lib/behavior-gate.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip, type SoftSkipKind } from '../lib/soft-skip.js';
 import { targetMajor } from '../lib/seams.js';
-import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { v2Discovery, familyAdvertised, v2Validator } from '../lib/v2.js';
+import { noteObservation } from '../lib/row-observation.js';
+import { failClosedLeg, providerReadAdvertised, qualifiedLeg, uniqueLeg, type RegistryOutcome } from '../lib/provider-registry-witness.js';
 
 const SECTION = 'connection-packs.md §"Provider identity" (RFC 0177 §D.1)';
 const FIXTURE = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-acme-widgets.json');
@@ -63,7 +78,8 @@ interface ResolveResult { resolved?: boolean; source?: 'pack' | 'builtin'; versi
 
 function fixture(): Manifest {
   const m = JSON.parse(readFileSync(FIXTURE, 'utf8')) as Manifest;
-  // The v1 fixture pins `>=1.0.0`; a v2 host reads that as `<2.0.0` (RFC 0177 §A.1).
+  // Both fixture files carry `>=2.0.0 <3.0.0` on disk since 2.45.12 (an operator installs them
+  // as-is for RFC 0233 §D). The rewrite is kept so an older checked-out fixture still installs.
   return { ...m, engines: { openwop: '>=2.0.0 <3.0.0' } };
 }
 function conflicting(base: Manifest): Manifest {
@@ -73,7 +89,7 @@ function codes(r: InstallResult | undefined): string[] {
   return (r?.errors ?? []).map((e) => e.code ?? '').filter((c) => c.length > 0);
 }
 
-async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | null> {
+async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | { connections: Record<string, unknown> | null }> {
   if (targetMajor() !== 2) return { kind: 'inapplicable', reason: 'suite 2.0.0 v2 scenario: OPENWOP_TARGET_MAJOR is not 2' };
   let doc: Record<string, unknown> | null;
   try {
@@ -85,7 +101,22 @@ async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | nul
   const connections = await familyAdvertised('connections');
   if (!behaviorGate('connections.packsSupported', connections?.['packsSupported'] === true)) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise connections.packsSupported (RFC 0095 §C)' };
   if (!existsSync(FIXTURE)) return { kind: 'blocked', reason: 'fixture connection-packs/connection-pack-acme-widgets.json is absent from this layout' };
-  return null;
+  return { connections };
+}
+
+const NO_PATH = 'connections.packsSupported is advertised, but the host serves neither connections.providerRead (RFC 0233) nor the RFC 0095 seams, so no party can observe a provider conflict here (RFC 0233 §Decisions 2: a host advertising packsSupported SHOULD advertise providerRead)';
+
+type SeamLeg = 'absent' | 'ran' | { kind: SoftSkipKind; reason: string };
+
+/** Map a normative-surface outcome to assertions. `observed` when it asserted; else the skip to fall back on. */
+function recordNormative(label: (doc: string, message: string) => string, out: RegistryOutcome): { kind: SoftSkipKind; reason: string } | 'observed' {
+  if (out.kind === 'skip') return { kind: out.disposition, reason: out.reason };
+  for (const x of out.findings) expect(x.ok, label(x.doc, x.message)).toBe(true);
+  return 'observed';
+}
+
+function noteWitnessPaths(normative: boolean, seam: boolean): void {
+  noteObservation([normative ? 'normative-surface path (RFC 0233 provider registry read)' : '', seam ? 'seam path (RFC 0095)' : ''].filter((x) => x !== '').join(' + '));
 }
 
 /** Install the fixture; null when the seam is unwired. */
@@ -97,10 +128,39 @@ async function installFixture(): Promise<{ res: InstallResult | undefined; statu
 
 describe('v2-provider-conflict (RFC 0177 §D.1)', () => {
   it('two definitions of one bare provider id fail closed: the later registration is refused with connection_provider_conflict', async () => {
-    const skip = await preflight();
-    if (skip) return softSkip(skip.kind, skip.reason);
+    const pre = await preflight();
+    if ('kind' in pre) return softSkip(pre.kind, pre.reason);
+    const normative = providerReadAdvertised(pre.connections) ? recordNormative((doc, m) => req('openwop.requirement.0177.provider-conflict.fail-closed', doc, m), await failClosedLeg()) : null;
+    const seam = await seamFailClosed();
+    if (typeof seam === 'object') return softSkip(seam.kind, seam.reason);
+    if (normative !== 'observed' && seam === 'absent') return softSkip(normative?.kind ?? 'inapplicable', normative?.reason ?? NO_PATH);
+    noteWitnessPaths(normative === 'observed', seam === 'ran');
+  });
+
+  it('the qualified form <packName>#acme-widgets resolves to the named pack\'s definition', async () => {
+    const pre = await preflight();
+    if ('kind' in pre) return softSkip(pre.kind, pre.reason);
+    const normative = providerReadAdvertised(pre.connections) ? recordNormative((doc, m) => req('openwop.requirement.0177.provider-conflict.qualified-form', doc, m), await qualifiedLeg()) : null;
+    const seam = await seamQualified();
+    if (typeof seam === 'object') return softSkip(seam.kind, seam.reason);
+    if (normative !== 'observed' && seam === 'absent') return softSkip(normative?.kind ?? 'inapplicable', normative?.reason ?? NO_PATH);
+    noteWitnessPaths(normative === 'observed', seam === 'ran');
+  });
+
+  it('the provider registry lists each bare id once and carries no endpoint or credential (RFC 0233 §B)', async () => {
+    const pre = await preflight();
+    if ('kind' in pre) return softSkip(pre.kind, pre.reason);
+    if (!providerReadAdvertised(pre.connections)) return softSkip('inapplicable', 'the host does not advertise connections.providerRead (RFC 0233): no registry read to check');
+    const out = recordNormative((doc, m) => req('openwop.requirement.0233.provider-registry.unique', doc, m), await uniqueLeg(v2Validator('connection-provider-registry')));
+    if (out !== 'observed') return softSkip(out.kind, out.reason);
+    noteWitnessPaths(true, false);
+  });
+});
+
+/** The seam path for fail-closed. `absent` when the install seam is unwired. */
+async function seamFailClosed(): Promise<SeamLeg> {
     const first = await installFixture();
-    if (!first) return softSkip('blocked', 'RFC 0095 install seam not mounted (404/403) — connections.packsSupported advertised but /conformance/seams/sample/connection-packs/install is absent');
+    if (!first) return 'absent';
     // The branch is kept for a host that somehow ships a built-in of this id:
     // the fixture is then the LATER registration and the rule fires on the
     // first install. `acme-widgets` is fictional so the normal path is the
@@ -115,19 +175,19 @@ describe('v2-provider-conflict (RFC 0177 §D.1)', () => {
         })();
     expect(later?.installed, req('openwop.requirement.0177.provider-conflict.fail-closed', SECTION, 'the later registration of a bare provider id MUST NOT install (no version precedence)')).toBe(false);
     expect(codes(later), req('openwop.requirement.0177.provider-conflict.fail-closed', SECTION, 'the later registration MUST be refused with connection_provider_conflict')).toContain('connection_provider_conflict');
-  });
+    return 'ran';
+}
 
-  it('the qualified form <packName>#acme-widgets resolves to the named pack\'s definition', async () => {
-    const skip = await preflight();
-    if (skip) return softSkip(skip.kind, skip.reason);
+/** The seam path for the qualified form. `absent` when the install seam is unwired. */
+async function seamQualified(): Promise<SeamLeg> {
     const first = await installFixture();
-    if (!first) return softSkip('blocked', 'RFC 0095 install seam not mounted (404/403) — connections.packsSupported advertised but /conformance/seams/sample/connection-packs/install is absent');
-    if (first.res?.installed !== true) return softSkip('blocked', `the fixture did not install (${codes(first.res).join(',') || first.status}) — a host with a built-in acme-widgets cannot exercise the qualified form through the pack`);
+    if (!first) return 'absent';
+    if (first.res?.installed !== true) return { kind: 'blocked', reason: `the fixture did not install (${codes(first.res).join(',') || first.status}) — a host with a built-in acme-widgets cannot exercise the qualified form through the pack` };
     const packName = fixture().name;
     const hit = await driver.post(RESOLVE, { provider: `${packName}#acme-widgets` });
-    if (hit.status === 404) return softSkip('blocked', 'RFC 0095 resolve seam not mounted (404)');
+    if (hit.status === 404) return { kind: 'blocked', reason: 'RFC 0095 resolve seam not mounted (404)' };
     const resolved = hit.json as ResolveResult | undefined;
     expect(resolved?.resolved, req('openwop.requirement.0177.provider-conflict.qualified-form', 'connection-packs.md §"The qualified form" (RFC 0177 §D.1)', `${packName}#acme-widgets MUST resolve (got ${JSON.stringify(resolved)})`)).toBe(true);
     expect(resolved?.source, req('openwop.requirement.0177.provider-conflict.qualified-form', 'connection-packs.md §"The qualified form" (RFC 0177 §D.1)', 'a qualified reference resolves only to the named pack\'s definition (source: pack)')).toBe('pack');
-  });
-});
+    return 'ran';
+}

package/src/scenarios/v2-trigger-bridge-delivery.test.ts

@@ -0,0 +1,136 @@
+/**
+ * v2 — the trigger bridge's delivery model on the normative surface
+ * (`spec/v2/core/webhooks.md` §Inbound triggers). The v1 twin is
+ * `trigger-bridge-delivery`; this file shares its requirement ids, as the v2
+ * secrets witness does, so a requirement is one id at every major. The legs
+ * live in `lib/trigger-delivery-witness.ts`; what differs between majors is the
+ * profile row in `lib/major-profile.ts`.
+ *
+ * Unaided: the suite registers a `webhook` subscription and posts Standard
+ * Webhooks-signed bodies to its `ingestUrl` with no OpenWOP credential.
+ *
+ *   1. dedup          a repeated `webhook-id` is effectively-once.
+ *   2. dead-letter    a refused post starts no run and leaves the subscription
+ *                     `active`; a correctly signed post still delivers.
+ *   2b. stale timestamp   under `required`, a `webhook-timestamp` more than
+ *                     300 s off, either way, answers `401 signature_invalid`,
+ *                     starts no run and leaves the subscription `active`
+ *                     (RFC 0230 §C).
+ *   2c. secret once   a re-read of the subscription carries no `signingSecret`
+ *                     and no `whsec_` value (RFC 0230 §B); `inapplicable` where
+ *                     the host serves no re-read.
+ *   3. causation      the delivered run's `run.started` carries the delivery.
+ *   4a. run-less attempt   a dead-lettered attempt is content-free, read through
+ *                     `GET /trigger-subscriptions/{subscriptionId}/dead-letters`.
+ *   4b. run-less state change   `inapplicable`: no wire surface causes one and
+ *                     no seam drives one at major 2 (RFC 0232 §E, gap G2).
+ *
+ * Dispositions: `triggerBridge` absent, or `ingestion.inboundSigning` not
+ * listing `standard-webhooks-1` ⇒ `inapplicable` (major 2 has no other delivery
+ * surface). Leg 4a also needs `triggerBridge.deadLetter`.
+ *
+ * Proven against a scratch double in `lib/trigger-delivery-witness.test.ts`.
+ *
+ * @see spec/v2/core/webhooks.md §Inbound triggers
+ * @see RFCS/0230-inbound-webhook-ingest-contract.md, RFCS/0232-trigger-dead-letter-read.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { familyAdvertised, v2Discovery, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { noteObservation } from '../lib/row-observation.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { adverts, causationLeg, dedupLeg, refusedLeg, runlessAttemptLeg, runlessStateChangeLeg, signingSecretOnceLeg, staleTimestampLeg, type TriggerAdverts } from '../lib/trigger-delivery-witness.js';
+
+const PROFILE = majorProfile(2);
+const R_DEDUP = 'openwop.requirement.0083.trigger-delivery.dedup';
+const R_DEAD_LETTER = 'openwop.requirement.0083.trigger-delivery.dead-letter';
+const R_STALE_TIMESTAMP = 'openwop.requirement.0230.stale-timestamp-refused';
+const R_SECRET_ONCE = 'openwop.requirement.0230.signing-secret-once';
+const R_CAUSATION = 'openwop.requirement.0083.trigger-delivery.causation';
+const R_RUNLESS_ATTEMPT = 'openwop.requirement.0083.trigger-delivery.runless-attempt-content-free';
+const R_RUNLESS_STATE = 'openwop.requirement.0083.trigger-delivery.runless-state-change-content-free';
+
+/**
+ * `familyAdvertised`, not `gateFamily`: `triggerBridge` is optional, and a host that does not advertise it
+ * has taken on no obligation here. `gateFamily` fails an unadvertised family in strict mode (the 2.45.7
+ * `v2-workspace-scope-from-identity` defect).
+ */
+async function discovered(): Promise<TriggerAdverts | string> {
+  if (!(await familyAdvertised('triggerBridge'))) return 'GATED';
+  let doc: Record<string, unknown> | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  return doc ? adverts(PROFILE, doc) : 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0';
+}
+
+describe('v2 trigger-bridge delivery (webhooks.md §Inbound triggers)', () => {
+  it('de-dups a repeated webhook-id: effectively-once', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await dedupLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_DEDUP, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('a refused post starts no run and leaves the subscription active', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await refusedLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_DEAD_LETTER, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('refuses a webhook-timestamp more than 300 s off without starting a run', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await staleTimestampLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_STALE_TIMESTAMP, x.doc, x.message)).toBe(true);
+    noteObservation('normative-surface path (RFC 0230)');
+  });
+
+  it('returns the signing secret once: a re-read carries no whsec_ value', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await signingSecretOnceLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_SECRET_ONCE, x.doc, x.message)).toBe(true);
+    noteObservation('normative-surface path (RFC 0230)');
+  });
+
+  it('links delivery to run: run.started carries the delivery as causationId', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await causationLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_CAUSATION, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('keeps a dead-lettered run-less attempt content-free', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await runlessAttemptLeg(PROFILE, a, v2Validator('trigger-dead-letter-page'));
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_RUNLESS_ATTEMPT, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('keeps a run-less subscription state change content-free', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = runlessStateChangeLeg(a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    expect(out.kind, req(R_RUNLESS_STATE, 'webhooks.md §Inbound triggers', 'unreachable: no major-2 surface causes a state change')).toBe('skip');
+  });
+});

package/src/scenarios/v2-trigger-dead-letter-read.test.ts

@@ -0,0 +1,78 @@
+/**
+ * v2 — the trigger dead-letter read's own rules (RFC 0232 §B;
+ * `spec/v2/core/webhooks.md` §Inbound triggers). The v1 twin is
+ * `trigger-dead-letter-read`; the requirement ids are shared, and the legs live
+ * in `lib/trigger-delivery-witness.ts`.
+ *
+ *   paging        `limit` is clamped, and a short page carries `nextCursor`.
+ *   cursor-bound  a cursor minted for one subscription is refused on another,
+ *                 `400 validation_error`.
+ *   tenant-bound  another tenant's bound id is refused `403 id_tenant_mismatch`
+ *                 and discloses nothing (`identity.md` §5; at v1, with bare ids,
+ *                 the same rule is `404` as for an id never minted). An id never
+ *                 minted answers `404`. Needs `OPENWOP_TEST_TENANT_B_API_KEY`,
+ *                 else `blocked`.
+ *
+ * Dispositions: `triggerBridge`, `triggerBridge.deadLetter` or
+ * `ingestion.inboundSigning` not advertised ⇒ `inapplicable`.
+ *
+ * Proven against a scratch double in `lib/trigger-delivery-witness.test.ts`.
+ *
+ * @see spec/v2/core/webhooks.md §Inbound triggers
+ * @see RFCS/0232-trigger-dead-letter-read.md §B
+ * @see spec/v2/core/identity.md §5
+ */
+
+import { describe, it, expect } from 'vitest';
+import { familyAdvertised, v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { loadEnv } from '../lib/env.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { adverts, cursorLeg, pagingLeg, tenantLeg, type TriggerAdverts } from '../lib/trigger-delivery-witness.js';
+
+const PROFILE = majorProfile(2);
+const R_PAGING = 'openwop.requirement.0232.trigger-dead-letters.paging';
+const R_CURSOR = 'openwop.requirement.0232.trigger-dead-letters.cursor-bound';
+const R_TENANT = 'openwop.requirement.0232.trigger-dead-letters.tenant-bound';
+
+/**
+ * `familyAdvertised`, not `gateFamily`: `triggerBridge` is optional, and a host that does not advertise it
+ * has taken on no obligation here. `gateFamily` fails an unadvertised family in strict mode (the 2.45.7
+ * `v2-workspace-scope-from-identity` defect).
+ */
+async function discovered(): Promise<TriggerAdverts | string> {
+  if (!(await familyAdvertised('triggerBridge'))) return 'GATED';
+  let doc: Record<string, unknown> | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  return doc ? adverts(PROFILE, doc) : 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0';
+}
+
+describe('v2 trigger dead-letter read (RFC 0232 §B)', () => {
+  it('clamps limit and continues a short page with nextCursor', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await pagingLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_PAGING, x.doc, x.message)).toBe(true);
+  });
+
+  it('refuses a cursor minted for another subscription', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await cursorLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_CURSOR, x.doc, x.message)).toBe(true);
+  });
+
+  it("refuses another tenant's bound id 403 id_tenant_mismatch and discloses nothing", async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await tenantLeg(PROFILE, a, process.env['OPENWOP_TEST_TENANT_B_API_KEY'], loadEnv().apiKey);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_TENANT, x.doc, x.message)).toBe(true);
+  });
+});