fix: fail closed on additional-property refs

src/wf_api/draft_authoring.py

@@ -59,7 +59,10 @@ from .drafts import (
     _draft_input_maps,
     _draft_output_map,
 )
-from .input_expressions import validate_and_project_input_expression
+from .input_expressions import (
+    validate_and_project_input_expression,
+    validate_supported_input_schema,
+)
 from .models import DraftWorkspaceResult, JsonProjector
 from .operation_context import WorkflowOperationContext
 from .schema_projection import (
@@ -671,11 +674,21 @@ class WorkflowDraftAuthoringApi:
                 target_schema = (
                     projected_input if source.root == "input" else projected_state
                 )
-                if not schema_location_is_explicit(
+                if schema_location_is_explicit(
                     target_schema,
                     source.parts,
                     label=f"{source.root} source schema",
                 ):
+                    source_fragment = schema_fragment_at_location(
+                        target_schema,
+                        source.parts,
+                        label=f"{source.root} source schema",
+                    )
+                    validate_supported_input_schema(
+                        source_fragment,
+                        label=f"{source.root} source schema",
+                    )
+                else:
                     target_schema = project_schema_path_to_schema_path(
                         target_schema=target_schema,
                         source_schema=capability_schema,

src/wf_api/input_expressions.py

@@ -145,19 +145,19 @@ def validate_and_project_input_expression(
             else:
                 source_document = projected_state
 
-            try:
+            if schema_location_is_explicit(
+                source_document,
+                source_path.parts,
+                label=f"{source_path.root} source schema",
+            ):
                 source_fragment = schema_fragment_at_location(
                     source_document,
                     source_path.parts,
                     label=f"{source_path.root} source schema",
                 )
-            except ValueError:
+            else:
                 source_fragment = None
-            if source_fragment is not None and schema_location_is_explicit(
-                source_document,
-                source_path.parts,
-                label=f"{source_path.root} source schema",
-            ):
+            if source_fragment is not None:
                 compatibility = _schema_assignability(
                     source_fragment,
                     fragment,
@@ -588,6 +588,11 @@ def _ensure_supported_schema(schema: Mapping[str, Any], *, label: str) -> None:
     _canonical_schema(schema, label=label)
 
 
+def validate_supported_input_schema(schema: Mapping[str, Any], *, label: str) -> None:
+    """Reject schema fragments outside the bounded input-schema subset."""
+    _ensure_supported_schema(schema, label=label)
+
+
 def _resolved_schema(
     schema: Mapping[str, Any],
     *,