@ggui-ai/protocol-conformance 0.13.0 → 0.15.0

package/dist/reporter.js

@@ -14,6 +14,7 @@
  * `reporter` config.
  */
 import { fixturesByContract } from './fixtures/index.js';
+import { PURE_FUNCTION_CATALOG_SLUGS } from './run-conformance.js';
 /**
  * Build a {@link ConformanceReporter} that writes the bar-scorecard
  * report. The return value plugs directly into
@@ -69,21 +70,37 @@ export function createDefaultReporter(options = {}) {
 // =============================================================================
 export function formatScorecard(result) {
     // Group fixtures by contract so operators see pass rates per
-    // criterion, mirroring `fixturesByContract`'s classification.
+    // criterion, mirroring `fixturesByContract`'s classification, then
+    // the pure-function catalogs, whose rows carry a `<slug>/` prefix
+    // instead of living in that map (they are not WS-observable).
     const lines = [];
     for (const [slug, fixtures] of Object.entries(fixturesByContract)) {
         const names = new Set(fixtures.map((f) => f.name));
-        const passedCount = result.passed.filter((n) => names.has(n)).length;
-        const failedCount = result.failed.filter((f) => names.has(f.name)).length;
-        const skippedCount = result.skipped.filter((s) => names.has(s.name)).length;
-        const total = passedCount + failedCount + skippedCount;
-        if (total === 0)
-            continue;
-        const tone = failedCount > 0 ? MARK_FAIL : passedCount > 0 ? MARK_PASS : MARK_SKIP;
-        lines.push(`  ${tone}  ${padRight(slug, 38)}  ${passedCount}/${total} pass${failedCount > 0 ? ` · ${failedCount} fail` : ''}${skippedCount > 0 ? ` · ${skippedCount} skip` : ''}`);
+        lines.push(...scorecardRow(slug, result, (name) => names.has(name)));
+    }
+    for (const slug of PURE_FUNCTION_CATALOG_SLUGS) {
+        const prefix = `${slug}/`;
+        lines.push(...scorecardRow(slug, result, (name) => name.startsWith(prefix)));
     }
     return lines.join('\n');
 }
+/**
+ * One scorecard line for the rows `belongs` selects, or no line at all
+ * when the group graded nothing. A group that is entirely SKIPPED still
+ * prints — an obligation nobody graded must be visible, not absent.
+ */
+function scorecardRow(slug, result, belongs) {
+    const passedCount = result.passed.filter(belongs).length;
+    const failedCount = result.failed.filter((f) => belongs(f.name)).length;
+    const skippedCount = result.skipped.filter((s) => belongs(s.name)).length;
+    const total = passedCount + failedCount + skippedCount;
+    if (total === 0)
+        return [];
+    const tone = failedCount > 0 ? MARK_FAIL : passedCount > 0 ? MARK_PASS : MARK_SKIP;
+    return [
+        `  ${tone}  ${padRight(slug, 38)}  ${passedCount}/${total} pass${failedCount > 0 ? ` · ${failedCount} fail` : ''}${skippedCount > 0 ? ` · ${skippedCount} skip` : ''}`,
+    ];
+}
 export function formatSummary(result) {
     const passed = result.passed.length;
     const failed = result.failed.length;

package/dist/run-conformance.d.ts

@@ -2,6 +2,9 @@ import type { HostContextObservedPayload } from '@ggui-ai/protocol';
 import type { ConformanceHost, SetupStep as HostSetupStep } from './conformance-host.js';
 import { type MatchResult } from './match-behavior.js';
 import type { AuthConfig, SessionStateBehavior, StreamUpdateBehavior, VersionMismatchBehavior } from './types.js';
+import { type PreGenerationRefusalInput, type ProjectedRefusalResult } from './refusal-envelope-conformance/index.js';
+import { type RefusalRegistryView } from './registry-completeness/index.js';
+import { type ProjectedTransportRefusal, type TransportRefusalInput } from './transport-refusal-conformance/index.js';
 export interface RunConformanceConfig {
     /**
      * URL of the implementation under test. `http://` / `https://`
@@ -27,7 +30,42 @@ export interface RunConformanceConfig {
     readonly host?: ConformanceHost;
     /** Per-fixture observation window. Default 2000ms. */
     readonly observationTimeoutMs?: number;
+    /**
+     * The implementation's PRE-GENERATION refusal projector (SPEC §7.1's
+     * refused arm). Given a refusal, return the tool result the server
+     * would emit for it, or `null` when the code has no envelope on this
+     * surface.
+     *
+     * Supplied ⇒ the `refusal-envelope` catalog is graded as part of this
+     * run. Omitted ⇒ its cases are reported SKIPPED with that reason, so
+     * an ungraded obligation shows up on the scorecard instead of
+     * vanishing from it.
+     */
+    readonly refusalProjector?: (refusal: PreGenerationRefusalInput) => ProjectedRefusalResult | null;
+    /**
+     * The deployment's closed refusal-code registry, keyed by code.
+     * Supplied ⇒ the `registry-completeness` pins are graded as part of
+     * this run; omitted ⇒ reported SKIPPED, same reasoning as above.
+     */
+    readonly refusalRegistry?: RefusalRegistryView;
+    /**
+     * The deployment's PER-APP ENDPOINT refusal projector (SPEC §7.1's
+     * endpoint-level refusal, ggui#825): given a registry refusal, return
+     * the HTTP status + JSON-RPC error object the endpoint answers with, or
+     * `null` when the code has no transport envelope. Supplied ⇒ the
+     * `transport-refusal` catalog is graded; omitted ⇒ SKIPPED, named.
+     */
+    readonly transportRefusalProjector?: (refusal: TransportRefusalInput) => ProjectedTransportRefusal | null;
 }
+/**
+ * Row-name prefixes for the PURE-FUNCTION catalogs the runner folds
+ * into a run. Prefixed so a catalog row can never collide with a
+ * WebSocket fixture name, and so the reporter can group them without a
+ * second registry of names.
+ */
+export declare const PURE_FUNCTION_CATALOG_SLUGS: readonly ["refusal-envelope", "registry-completeness", "transport-refusal"];
+/** One member of {@link PURE_FUNCTION_CATALOG_SLUGS}. */
+export type PureFunctionCatalogSlug = (typeof PURE_FUNCTION_CATALOG_SLUGS)[number];
 export interface ConformanceResult {
     readonly passed: readonly string[];
     readonly failed: readonly ConformanceFailure[];

package/dist/run-conformance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-conformance.d.ts","sourceRoot":"","sources":["../src/run-conformance.ts"],"names":[],"mappings":"AAuDA,OAAO,KAAK,EACV,0BAA0B,EAG3B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EACV,eAAe,EACf,SAAS,IAAI,aAAa,EAE3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAwC,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,KAAK,EAEV,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAOpB,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,aAAa,CAAC,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAClD,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACxD,UAAU,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC9C;AAMD,wBAAsB,cAAc,CAClC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA6C5B;AAsKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAWrD;AAoBD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACvD;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;CACrD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9B;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,OAAO,GAChB,qBAAqB,CAcvB;AAkOD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,eAAe,GAAG,SAAS,GAChC,OAAO,CAAC,WAAW,CAAC,CA8BtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,GACf,wBAAwB,CAmC1B;AAqED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,aAAa,CA4DhF;AAqHD,YAAY,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"run-conformance.d.ts","sourceRoot":"","sources":["../src/run-conformance.ts"],"names":[],"mappings":"AA6DA,OAAO,KAAK,EACV,0BAA0B,EAG3B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EACV,eAAe,EACf,SAAS,IAAI,aAAa,EAE3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAwC,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,KAAK,EAEV,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAMlD,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAC1B,OAAO,EAAE,yBAAyB,KAC/B,sBAAsB,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,mBAAmB,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CACnC,OAAO,EAAE,qBAAqB,KAC3B,yBAAyB,GAAG,IAAI,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,6EAI9B,CAAC;AAEX,yDAAyD;AACzD,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,aAAa,CAAC,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAClD,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACxD,UAAU,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC9C;AAMD,wBAAsB,cAAc,CAClC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA+C5B;AA+RD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAWrD;AAoBD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACvD;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;CACrD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9B;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,OAAO,GAChB,qBAAqB,CAcvB;AAkOD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,eAAe,GAAG,SAAS,GAChC,OAAO,CAAC,WAAW,CAAC,CA8BtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,GACf,wBAAwB,CAmC1B;AAqED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,aAAa,CA4DhF;AAqHD,YAAY,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/run-conformance.js

@@ -46,17 +46,37 @@
  *         (No teardown vocabulary exists in this kit version, so the
  *         loop is empty today.)
  *      l. Record the outcome via reporter + accumulate in result.
- *   3. Invoke `reporter.onComplete(result)` + return.
+ *   3. Fold in the PURE-FUNCTION catalogs (ggui#786) —
+ *      `refusal-envelope`, `registry-completeness` and `transport-refusal`. They grade a
+ *      caller-supplied projector / registry rather than the wire, so
+ *      they need no transport; when the caller supplies neither, their
+ *      rows are reported SKIPPED with that reason so an ungraded
+ *      obligation stays visible on the scorecard.
+ *   4. Invoke `reporter.onComplete(result)` + return.
  *
- * Scope v1: pure WS transport. Browser-level fixtures (bootstrap-
- * failure, props-update) automatically skip via the matcher's
- * `unmatchable-on-ws` arm.
+ * Scope v1: pure WS transport for the fixture catalog. Browser-level
+ * fixtures (bootstrap-failure, props-update) automatically skip via the
+ * matcher's `unmatchable-on-ws` arm.
  */
 import { PROTOCOL_SCHEMA_VERSION } from '@ggui-ai/protocol';
 import { allFixtures, fixturesByContract } from './fixtures/index.js';
 import { isRecord } from '@ggui-ai/protocol';
 import { behaviorIs, deepEqual, matchBehavior } from './match-behavior.js';
 import { openWsTransport } from './ws-transport.js';
+import { refusalEnvelopeCases, runRefusalEnvelopeConformance, } from './refusal-envelope-conformance/index.js';
+import { registryCompletenessPins, runRegistryCompletenessConformance, } from './registry-completeness/index.js';
+import { runTransportRefusalConformance, transportRefusalCases, } from './transport-refusal-conformance/index.js';
+/**
+ * Row-name prefixes for the PURE-FUNCTION catalogs the runner folds
+ * into a run. Prefixed so a catalog row can never collide with a
+ * WebSocket fixture name, and so the reporter can group them without a
+ * second registry of names.
+ */
+export const PURE_FUNCTION_CATALOG_SLUGS = [
+    'refusal-envelope',
+    'registry-completeness',
+    'transport-refusal',
+];
 // =============================================================================
 // Runner
 // =============================================================================
@@ -93,6 +113,7 @@ export async function runConformance(config) {
                 break;
         }
     }
+    runPureFunctionCatalogs(config, reporter, { passed, failed, skipped });
     const result = {
         passed,
         failed,
@@ -102,6 +123,106 @@ export async function runConformance(config) {
     reporter.onComplete?.(result);
     return result;
 }
+/**
+ * Fold the pure-function catalogs (ggui#786) into a run.
+ *
+ * These obligations are not WebSocket-observable — a refusal projection
+ * is a pure function and a registry is data — so they are NOT in
+ * `fixturesByContract` (see `fixtures/index.ts` for why registering a
+ * non-WS case there would be a permanent skip). But leaving them
+ * reachable only through a direct import made them invisible to every
+ * CLI run: a catalog the runner cannot report is a silent gate
+ * (docs/principles/no-silent-block.md).
+ *
+ * So they run HERE, on the same verdict buckets as the fixtures, and an
+ * absent input produces a SKIP row naming what to supply rather than
+ * nothing at all.
+ */
+function runPureFunctionCatalogs(config, reporter, buckets) {
+    const only = config.only;
+    const wanted = (name) => only === undefined || only.length === 0 || only.includes(name);
+    const pass = (name) => {
+        if (!wanted(name))
+            return;
+        buckets.passed.push(name);
+        reporter.onFixturePass?.(name, 0);
+    };
+    const skip = (name, reason) => {
+        if (!wanted(name))
+            return;
+        buckets.skipped.push({ name, reason });
+        reporter.onFixtureSkip?.(name, reason);
+    };
+    const fail = (failure) => {
+        if (!wanted(failure.name))
+            return;
+        buckets.failed.push(failure);
+        reporter.onFixtureFail?.(failure);
+    };
+    // ── refusal-envelope ──
+    const projector = config.refusalProjector;
+    if (projector === undefined) {
+        for (const testCase of refusalEnvelopeCases) {
+            skip(`refusal-envelope/${testCase.name}`, 'no `refusalProjector` supplied — pass one to runConformance(), or `--projector <module>` on the CLI, to grade SPEC §7.1\u2019s refused arm');
+        }
+    }
+    else {
+        const envelope = runRefusalEnvelopeConformance(projector);
+        for (const name of envelope.passed)
+            pass(`refusal-envelope/${name}`);
+        for (const mismatch of envelope.failed) {
+            fail({
+                name: `refusal-envelope/${mismatch.name}`,
+                criterion: 'pre-generation refusal envelope (SPEC §7.1, refused arm)',
+                expected: mismatch.expected,
+                received: mismatch.actual,
+                message: 'the projected refusal envelope does not match the catalog case',
+            });
+        }
+    }
+    // ── transport-refusal (ggui#825) ──
+    const endpointProjector = config.transportRefusalProjector;
+    if (endpointProjector === undefined) {
+        for (const testCase of transportRefusalCases) {
+            skip(`transport-refusal/${testCase.name}`, 'no `transportRefusalProjector` supplied — pass one to runConformance(), or `--transport-projector <module>` on the CLI, to grade the endpoint-level refusal (SPEC §7.1, mcp-endpoint surface)');
+        }
+    }
+    else {
+        const endpoint = runTransportRefusalConformance(endpointProjector);
+        for (const name of endpoint.passed)
+            pass(`transport-refusal/${name}`);
+        for (const mismatch of endpoint.failed) {
+            fail({
+                name: `transport-refusal/${mismatch.name}`,
+                criterion: 'endpoint-level refusal envelope (SPEC §7.1, mcp-endpoint surface)',
+                expected: mismatch.expected,
+                received: mismatch.actual,
+                message: 'the projected endpoint refusal does not match the catalog case',
+            });
+        }
+    }
+    // ── registry-completeness ──
+    const registry = config.refusalRegistry;
+    if (registry === undefined) {
+        for (const pin of registryCompletenessPins) {
+            skip(`registry-completeness/${pin.name}`, 'no `refusalRegistry` supplied — pass the deployment\u2019s refusal-code registry to runConformance(), or `--registry <file.json>` on the CLI, to grade it');
+        }
+    }
+    else {
+        const completeness = runRegistryCompletenessConformance(registry);
+        for (const name of completeness.passed)
+            pass(`registry-completeness/${name}`);
+        for (const mismatch of completeness.failed) {
+            fail({
+                name: `registry-completeness/${mismatch.name}`,
+                criterion: 'refusal-registry completeness',
+                expected: mismatch.description,
+                received: mismatch.violations,
+                message: `${String(mismatch.violations.length)} row(s) violate this pin`,
+            });
+        }
+    }
+}
 async function runOneFixture(fixture, config, _reporter) {
     const fixtureStarted = Date.now();
     if (fixture.skipReason !== null) {

package/dist/transport-refusal-conformance/cases/refuse-deprovisioned-endpoint.json

@@ -0,0 +1,25 @@
+{
+    "name": "refuse-deprovisioned-endpoint",
+    "description": "A deprovisioned app answers EVERY JSON-RPC request on its per-app MCP endpoint (initialize included) with HTTP 403 and a JSON-RPC error whose data.refusal carries the registry projection \u2014 code, message, fix, retry \u2014 so the client reads app_deprovisioned instead of guessing between a deleted app and a bad credential. error.code is -32003 (APP_NOT_FOUND \u2014 the endpoint no longer serves this app) and error.message is App not found; an untyped authorization failure answers -32001 (UNAUTHORIZED) with no data, so a client can tell the two apart by code and can tell neither from a dropped socket by mistake \u2014 -32000 is the SDK client's ConnectionClosed and a first-party server never chooses it (ggui#836).",
+    "refusal": {
+        "code": "app_deprovisioned",
+        "message": "the app record has no owner claim any more \u2014 the app was deprovisioned",
+        "fix": "provision the app again; this app id never renders again",
+        "retry": "never"
+    },
+    "expect": {
+        "httpStatus": 403,
+        "error": {
+            "code": -32003,
+            "message": "App not found",
+            "data": {
+                "refusal": {
+                    "code": "app_deprovisioned",
+                    "message": "the app record has no owner claim any more \u2014 the app was deprovisioned",
+                    "fix": "provision the app again; this app id never renders again",
+                    "retry": "never"
+                }
+            }
+        }
+    }
+}

package/dist/transport-refusal-conformance/cases/refuse-render-only-code.json

@@ -0,0 +1,11 @@
+{
+    "name": "refuse-render-only-code",
+    "description": "A REGISTERED code whose surfaces exclude mcp-endpoint has no transport envelope: the per-app endpoint's authorization never speaks it, and a projector that types it anyway would put a render-gate state on a surface the registry does not list. The three auth arms (no issuer, foreign issuer, denied subject) stay the bare 403 by the same rule \u2014 naming any of them would say which is true.",
+    "refusal": {
+        "code": "insufficient_credit",
+        "message": "the configured allowance for this app is exhausted",
+        "fix": "top up the allowance for this app, then retry",
+        "retry": "after-fix"
+    },
+    "expect": null
+}

package/dist/transport-refusal-conformance/index.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The refusal handed to the projector — the registry projection on the
+ * transport surface. Authored here rather than imported from
+ * `@ggui-ai/protocol` for the same reason as the render catalog: the kit
+ * grades the WIRE, and a stringly input keeps a stale kit from typing
+ * its way past a registry change.
+ */
+export interface TransportRefusalInput {
+    /** Registered refusal code. */
+    readonly code: string;
+    /** Precise diagnostic. */
+    readonly message: string;
+    /** The one recovery step. */
+    readonly fix: string;
+    /** Retry class (`after-fix` | `next-period` | `later` | `never`). */
+    readonly retry: string;
+}
+/** What the endpoint answers: the HTTP status and the JSON-RPC error object. */
+export interface ProjectedTransportRefusal {
+    readonly httpStatus: number;
+    readonly error: {
+        readonly code: number;
+        readonly message: string;
+        readonly data: {
+            readonly refusal: TransportRefusalInput;
+        };
+    };
+}
+/** One transport-refusal case, authored as JSON under `./cases/`. */
+export interface TransportRefusalConformanceCase {
+    readonly name: string;
+    readonly description: string;
+    readonly refusal: TransportRefusalInput;
+    /** `null` when the code has no transport envelope (surfaces exclude `mcp-endpoint`). */
+    readonly expect: ProjectedTransportRefusal | null;
+}
+export declare const transportRefusalCases: readonly TransportRefusalConformanceCase[];
+export interface TransportRefusalMismatch {
+    readonly name: string;
+    readonly expected: ProjectedTransportRefusal | null;
+    /** What the projector produced — or the message of the error it threw. */
+    readonly actual: ProjectedTransportRefusal | null | string;
+}
+export interface TransportRefusalConformanceResult {
+    readonly passed: readonly string[];
+    readonly failed: readonly TransportRefusalMismatch[];
+}
+/**
+ * Grade a per-app endpoint refusal projector against the catalog. Pure
+ * and synchronous: no server, no transport — the deterministic
+ * projection is the whole obligation.
+ */
+export declare function runTransportRefusalConformance(project: (refusal: TransportRefusalInput) => ProjectedTransportRefusal | null): TransportRefusalConformanceResult;
+//# sourceMappingURL=index.d.ts.map

package/dist/transport-refusal-conformance/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport-refusal-conformance/index.ts"],"names":[],"mappings":"AAyBA;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6BAA6B;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE;YAAE,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAA;SAAE,CAAC;KAC5D,CAAC;CACH;AAED,qEAAqE;AACrE,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAAC;CACnD;AAED,eAAO,MAAM,qBAAqB,EAAE,SAAS,+BAA+B,EAG3E,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACpD,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI,GAAG,MAAM,CAAC;CAC5D;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACtD;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,yBAAyB,GAAG,IAAI,GAC5E,iCAAiC,CAiBnC"}

package/dist/transport-refusal-conformance/index.js

@@ -0,0 +1,52 @@
+/**
+ * Transport-refusal conformance catalog (ggui#825) — grades a deployment's
+ * PER-APP ENDPOINT refusal projector: the function that turns a registry
+ * refusal into the JSON-RPC error a per-app MCP endpoint answers with when
+ * it refuses a request for a typed reason, on ANY method (`initialize`
+ * included).
+ *
+ * The contract it makes observable: a deprovisioned app answers HTTP 403
+ * with `{ code: -32003, message: "App not found", data: { refusal } }` where
+ * `refusal` is the registry projection without the render-only fields
+ * (`code`, `message`, `fix`, `retry`); an authorization failure that is
+ * NOT a registry state answers 403 with `-32001` and no `data` — the untyped
+ * arms deliberately indistinguishable among themselves, so a client never
+ * learns which one it hit (codes ruled in ggui#836).
+ *
+ * Each case ships as raw JSON under `./cases/`. The kit never imports a
+ * concrete server: the adopter supplies the projector, the catalog grades
+ * it, and a code whose `surfaces` exclude `mcp-endpoint` must project to
+ * `null` (no transport envelope exists for it).
+ */
+import refuseDeprovisionedEndpoint from './cases/refuse-deprovisioned-endpoint.json' with { type: 'json' };
+import refuseRenderOnlyCode from './cases/refuse-render-only-code.json' with { type: 'json' };
+import { jsonEqual } from '../json-equal.js';
+export const transportRefusalCases = [
+    refuseDeprovisionedEndpoint,
+    refuseRenderOnlyCode,
+];
+/**
+ * Grade a per-app endpoint refusal projector against the catalog. Pure
+ * and synchronous: no server, no transport — the deterministic
+ * projection is the whole obligation.
+ */
+export function runTransportRefusalConformance(project) {
+    const passed = [];
+    const failed = [];
+    for (const testCase of transportRefusalCases) {
+        let actual;
+        try {
+            actual = project(testCase.refusal);
+        }
+        catch (error) {
+            actual = error instanceof Error ? error.message : String(error);
+        }
+        if (typeof actual !== 'string' && jsonEqual(actual, testCase.expect)) {
+            passed.push(testCase.name);
+        }
+        else {
+            failed.push({ name: testCase.name, expected: testCase.expect, actual });
+        }
+    }
+    return { passed, failed };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ggui-ai/protocol-conformance",
-  "version": "0.13.0",
-  "description": "Conformance test kit for the ggui protocol. Drives a behavioral fixture catalog against a live implementation over WebSocket, a resources/read catalog against a live MCP server, and six pure-function catalogs (schema, registration, resolution, binding, props-schema, host-helper) for the gadget, tool-binding, and schema-precise-render and host-helper obligations, reporting a scorecard-style pass / fail / skip. MCP builders adopt this kit to prove their implementation is protocol-conformant.",
+  "version": "0.15.0",
+  "description": "Conformance test kit for the ggui protocol. Drives a behavioral fixture catalog against a live implementation over WebSocket, a resources/read catalog against a live MCP server, and nine pure-function catalogs (schema, registration, resolution, binding, props-schema, host-helper, refusal-envelope, registry-completeness, transport-refusal) for the gadget, tool-binding, schema-precise-render, host-helper and pre-generation-refusal obligations, reporting a scorecard-style pass / fail / skip. MCP builders adopt this kit to prove their implementation is protocol-conformant.",
   "license": "Apache-2.0",
   "keywords": [
     "ggui",
@@ -65,11 +65,26 @@
       "types": "./dist/host-helper-conformance/index.d.ts",
       "import": "./dist/host-helper-conformance/index.js",
       "default": "./dist/host-helper-conformance/index.js"
+    },
+    "./refusal-envelope-conformance": {
+      "types": "./dist/refusal-envelope-conformance/index.d.ts",
+      "import": "./dist/refusal-envelope-conformance/index.js",
+      "default": "./dist/refusal-envelope-conformance/index.js"
+    },
+    "./registry-completeness": {
+      "types": "./dist/registry-completeness/index.d.ts",
+      "import": "./dist/registry-completeness/index.js",
+      "default": "./dist/registry-completeness/index.js"
+    },
+    "./transport-refusal-conformance": {
+      "types": "./dist/transport-refusal-conformance/index.d.ts",
+      "import": "./dist/transport-refusal-conformance/index.js",
+      "default": "./dist/transport-refusal-conformance/index.js"
     }
   },
   "dependencies": {
     "ws": "^8.20.1",
-    "@ggui-ai/protocol": "0.13.0"
+    "@ggui-ai/protocol": "0.15.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -90,11 +105,11 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.0.0"
   },
   "author": "ggui contributors <hello@ggui.ai>",
   "scripts": {
-    "build": "rm -rf dist.staging && tsc -p tsconfig.build.json --outDir dist.staging && node ../scripts/fix-esm-imports.mjs dist.staging && chmod +x dist.staging/cli.js && node ../scripts/atomic-swap.mjs dist.staging dist",
+    "build": "rm -rf dist.staging-$$ && tsc -p tsconfig.build.json --outDir dist.staging-$$ && node ../scripts/fix-esm-imports.mjs dist.staging-$$ && chmod +x dist.staging-$$/cli.js && node ../scripts/atomic-swap.mjs dist.staging-$$ dist",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests",