musher-dev · justinmerrell · Aug 9, 2026 · Aug 9, 2026 · Aug 9, 2026 · Aug 9, 2026
diff --git a/conformance/blueprint/v1/cases.json b/conformance/blueprint/v1/cases.json
@@ -26,6 +26,11 @@
       "id": "structural-004-unsupported-spec-version",
       "phase": "structural",
       "path": "structural/004-unsupported-spec-version"
+    },
+    {
+      "id": "structural-005-nested-unknown-field",
+      "phase": "structural",
+      "path": "structural/005-nested-unknown-field"
     }
   ]
 }
diff --git a/conformance/blueprint/v1/structural/005-nested-unknown-field/case.yaml b/conformance/blueprint/v1/structural/005-nested-unknown-field/case.yaml
@@ -0,0 +1,22 @@
+# A misspelled optional field below the envelope. `lable` is a typo for
+# `label`, three levels down inside a parameter's presentation block.
+# Rejection must not depend on how deeply the typo is nested.
+specVersion: v1
+kind: BLUEPRINT
+metadata:
+  slug: web-and-database
+  version: 1
+spec:
+  components:
+    db:
+      component: postgres
+      size: general.standard.small
+      connections: {}
+  parameters:
+    siteTitle:
+      schema:
+        type: STRING
+        default: My Application
+      isRequired: false
+      ui:
+        lable: Site title
diff --git a/conformance/blueprint/v1/structural/005-nested-unknown-field/diagnostics.json b/conformance/blueprint/v1/structural/005-nested-unknown-field/diagnostics.json
@@ -0,0 +1,6 @@
+[
+  {
+    "code": "ERR_UNKNOWN_FIELD",
+    "path": "/spec/parameters/siteTitle/ui"
+  }
+]
diff --git a/conformance/blueprint/v1/structural/005-nested-unknown-field/metadata.json b/conformance/blueprint/v1/structural/005-nested-unknown-field/metadata.json
@@ -0,0 +1,7 @@
+{
+  "id": "structural-005-nested-unknown-field",
+  "phase": "structural",
+  "expected": "fail",
+  "clause": "specifications/blueprint/v1/spec.md#envelope",
+  "summary": "An undefined property nested below the envelope is rejected, not silently dropped."
+}
diff --git a/conformance/component/v1/cases.json b/conformance/component/v1/cases.json
@@ -26,6 +26,11 @@
       "id": "structural-004-unsupported-spec-version",
       "phase": "structural",
       "path": "structural/004-unsupported-spec-version"
+    },
+    {
+      "id": "structural-005-nested-unknown-field",
+      "phase": "structural",
+      "path": "structural/005-nested-unknown-field"
     }
   ]
 }
diff --git a/conformance/component/v1/structural/005-nested-unknown-field/case.yaml b/conformance/component/v1/structural/005-nested-unknown-field/case.yaml
@@ -0,0 +1,17 @@
+# A misspelled optional field below the envelope. `initialDelaySecond` is
+# singular; the defined property is `initialDelaySeconds`. Rejection must not
+# depend on how deeply the typo is nested.
+specVersion: v1
+kind: COMPONENT
+metadata:
+  version: 1
+spec:
+  workload:
+    kind: SERVICE
+    source:
+      type: IMAGE
+      ref: nginx:1.29.4-alpine
+    health:
+      readiness:
+        path: /healthz
+        initialDelaySecond: 30
diff --git a/conformance/component/v1/structural/005-nested-unknown-field/diagnostics.json b/conformance/component/v1/structural/005-nested-unknown-field/diagnostics.json
@@ -0,0 +1,6 @@
+[
+  {
+    "code": "ERR_UNKNOWN_FIELD",
+    "path": "/spec/workload/health/readiness"
+  }
+]
diff --git a/conformance/component/v1/structural/005-nested-unknown-field/metadata.json b/conformance/component/v1/structural/005-nested-unknown-field/metadata.json
@@ -0,0 +1,7 @@
+{
+  "id": "structural-005-nested-unknown-field",
+  "phase": "structural",
+  "expected": "fail",
+  "clause": "specifications/component/v1/spec.md#envelope",
+  "summary": "An undefined property nested below the envelope is rejected, not silently dropped."
+}
diff --git a/conformance/listing/v1/cases.json b/conformance/listing/v1/cases.json
@@ -26,6 +26,11 @@
       "id": "structural-004-unsupported-spec-version",
       "phase": "structural",
       "path": "structural/004-unsupported-spec-version"
+    },
+    {
+      "id": "structural-005-nested-unknown-field",
+      "phase": "structural",
+      "path": "structural/005-nested-unknown-field"
     }
   ]
 }
diff --git a/conformance/listing/v1/structural/005-nested-unknown-field/case.yaml b/conformance/listing/v1/structural/005-nested-unknown-field/case.yaml
@@ -0,0 +1,17 @@
+# A misspelled optional field below the envelope. `captions` is a typo for
+# `caption`, inside an array element. Rejection must not depend on how deeply
+# the typo is nested, nor on whether it sits inside an array.
+specVersion: v1
+kind: LISTING
+metadata:
+  slug: postgres
+  version: 1
+spec:
+  listingKind: COMPONENT
+  displayName: PostgreSQL
+  summary: The open-source relational database
+  category: INFRASTRUCTURE
+  lifecycleStage: STABLE
+  screenshots:
+    - file: media/overview.png
+      captions: Connection details after deployment
diff --git a/conformance/listing/v1/structural/005-nested-unknown-field/diagnostics.json b/conformance/listing/v1/structural/005-nested-unknown-field/diagnostics.json
@@ -0,0 +1,6 @@
+[
+  {
+    "code": "ERR_UNKNOWN_FIELD",
+    "path": "/spec/screenshots/0"
+  }
+]
diff --git a/conformance/listing/v1/structural/005-nested-unknown-field/metadata.json b/conformance/listing/v1/structural/005-nested-unknown-field/metadata.json
@@ -0,0 +1,7 @@
+{
+  "id": "structural-005-nested-unknown-field",
+  "phase": "structural",
+  "expected": "fail",
+  "clause": "specifications/listing/v1/spec.md#envelope",
+  "summary": "An undefined property nested below the envelope is rejected, not silently dropped."
+}
diff --git a/specifications/blueprint/v1/schemas/dist/blueprint.schema.json b/specifications/blueprint/v1/schemas/dist/blueprint.schema.json
diff --git a/specifications/blueprint/v1/schemas/src/blueprint.schema.json b/specifications/blueprint/v1/schemas/src/blueprint.schema.json
@@ -36,6 +36,7 @@
   "type": "object",
   "$defs": {
     "BlueprintComputeConstraintsRequest": {
+      "additionalProperties": false,
       "description": "Advanced, optional compute pins (ADR 0041) honored by Placement (ADR 0095).",
       "properties": {
         "acceleratorInterconnect": {
@@ -152,6 +153,7 @@
       "type": "object"
     },
     "BlueprintConnectionRefRequest": {
+      "additionalProperties": false,
       "description": "A consumer-anchored wire (map value; keyed by the consumer input key).\n\nThe value names only the producer end (``fromRole`` / ``fromOutput``); the\nconsumer end is derived from the enclosing node (``toRole`` = the node name)\nand the map key (``toInput``). One wire per consumer input (inbound-uniqueness,\nenforced by the publish gate).",
       "properties": {
         "fromOutput": {
@@ -174,6 +176,7 @@
       "x-additionalPropertiesName": "inputKey"
     },
     "BlueprintParameterGeneratorRequest": {
+      "additionalProperties": false,
       "properties": {
         "byteLength": {
           "default": 32,
@@ -211,6 +214,7 @@
       "type": "object"
     },
     "BlueprintParameterRequest": {
+      "additionalProperties": false,
       "description": "An install-form parameter composed at the graph layer (map value; keyed by key).",
       "properties": {
         "description": {
@@ -262,6 +266,7 @@
       "x-additionalPropertiesName": "parameterKey"
     },
     "BlueprintParameterUiRequest": {
+      "additionalProperties": false,
       "description": "Presentation metadata for an install-form parameter.",
       "properties": {
         "label": {
@@ -277,6 +282,7 @@
       "type": "object"
     },
     "BlueprintParameterValueSchemaRequest": {
+      "additionalProperties": false,
       "description": "Data contract of an install-form parameter value (JSON-Schema subset).",
       "properties": {
         "default": {