TLS13-WrongOuterRecord test fails about tls-tris HOT 1 OPEN

I asked for clarification in the tls13-spec repo. It would seem that either behaviour is acceptable without any particular preference. tlswg/tls13-spec#1127 (comment):

This sort of question tends to fall into a category where only a pragmatic answer is reasonable, namely that we can only enforce strict requirements once it is known that TLS 1.3 is definitively in use, which is the case here. But I am not entirely convinced that there is value in having a normative behavior in the spec; one could make reasonable arguments for a given implementation to go either way, and the question is irrelevant for the question of whether two compliant implementations will interoprate, so it seems just to be a venue for potential disagreement with no real upside.

That leaves the question of whether to take up BoringSSL's behaviour unbound by the spec.

from tls-tris.