@openwop/openwop-conformance 1.106.1 → 1.124.0

package/src/scenarios/compensation-profile.test.ts

@@ -31,7 +31,7 @@ import { describe, it, expect } from 'vitest';
 import { readFileSync, readdirSync } from 'node:fs';
 import { join, resolve as pathResolve } from 'node:path';
 import Ajv2020 from 'ajv/dist/2020.js';
-import { SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
+import { FIXTURES_DIR, SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
 
 /**
  * Schemas ship inside the package; RFC prose does not. The old form derived
@@ -154,6 +154,149 @@ describe('RFC 0151 §B — node compensation declaration', () => {
   });
 });
 
+describe('RFC 0151 §B — the workflow-level compensation policy (`settings.compensation`)', () => {
+  // `compensation-policy.schema.json` was the last `Affects` artifact of the whole
+  // RFC 0147 program that did not exist. It says WHEN an unwind starts and HOW it
+  // runs; the node-level declaration only says WHAT the inverse action is.
+  const POLICY_SCHEMA = 'compensation-policy.schema.json';
+
+  function ajvAll() {
+    const ajv = new Ajv2020({ strict: false, allErrors: true });
+    for (const file of readdirSync(SCHEMAS_DIR).filter((f) => f.endsWith('.schema.json'))) {
+      ajv.addSchema(schema(file), file);
+    }
+    return ajv;
+  }
+  const policyValidator = () => {
+    const ajv = ajvAll();
+    return ajv.getSchema(POLICY_SCHEMA) ?? ajv.compile(schema(POLICY_SCHEMA));
+  };
+  const workflowValidator = () => {
+    const ajv = ajvAll();
+    return ajv.getSchema('workflow-definition.schema.json') ?? ajv.compile(schema('workflow-definition.schema.json'));
+  };
+
+  const minimalPolicy = { triggers: ['node-failure'] };
+  const fullPolicy = {
+    profileVersion: '1',
+    orderingModel: 'reverse-completion',
+    triggers: ['node-failure', 'run-cancel', 'cap-breach', 'operator-request'],
+    retry: { maxAttempts: 3, backoffMs: 500 },
+    timeoutMs: 30_000,
+    exhaustedDisposition: 'manual-intervention',
+    approvalScope: 'all',
+    onParentCancel: 'pause',
+  };
+
+  it('the schema exists, is closed, and requires triggers', () => {
+    const p = schema(POLICY_SCHEMA) as { additionalProperties?: boolean; required?: string[]; $id?: string };
+    expect(p.$id).toBe('https://openwop.dev/spec/v1/compensation-policy.schema.json');
+    expect(p.additionalProperties, 'closed — a host and an author must not be able to disagree about a key').toBe(false);
+    expect(p.required, 'a policy that names no trigger is not a policy').toEqual(['triggers']);
+  });
+
+  it('a minimal and a full policy validate', () => {
+    const validate = policyValidator();
+    expect(validate(minimalPolicy), JSON.stringify(validate.errors)).toBe(true);
+    expect(validate(fullPolicy), JSON.stringify(validate.errors)).toBe(true);
+  });
+
+  it('closed vocabularies: an unknown key, trigger, ordering model, or disposition is rejected', () => {
+    const validate = policyValidator();
+    for (const bad of [
+      { ...minimalPolicy, rollback: true },
+      { triggers: [] },
+      { triggers: ['on-error'] },
+      { triggers: ['node-failure', 'node-failure'] },
+      { ...minimalPolicy, orderingModel: 'forward' },
+      { ...minimalPolicy, exhaustedDisposition: 'ignore' },
+      { ...minimalPolicy, approvalScope: 'none' },
+      { ...minimalPolicy, onParentCancel: 'abandon' },
+      { ...minimalPolicy, profileVersion: '0' },
+      { ...minimalPolicy, retry: { maxAttempts: 0 } },
+    ]) {
+      expect(validate(bad), `MUST be rejected: ${JSON.stringify(bad)}`).toBe(false);
+    }
+  });
+
+  it('there is no `none` approval scope — a policy can only escalate approval, never strip it', () => {
+    const p = schema(POLICY_SCHEMA) as { properties: { approvalScope: { enum: string[] } } };
+    expect(p.properties.approvalScope.enum).toEqual(['declared', 'all']);
+  });
+
+  it('attaches to WorkflowDefinition as `settings.compensation` and validates through the workflow schema', () => {
+    const wf = schema('workflow-definition.schema.json') as {
+      $defs: { WorkflowSettings: { properties: Record<string, { $ref?: string }> } };
+    };
+    expect(wf.$defs.WorkflowSettings.properties['compensation']?.$ref).toBe(POLICY_SCHEMA);
+    const validate = workflowValidator();
+    // A real, valid workflow fixture — so the leg proves the $ref is enforced
+    // through the workflow schema rather than that a hand-built object happens
+    // to satisfy WorkflowDefinition's required set.
+    const base = JSON.parse(
+      readFileSync(join(FIXTURES_DIR, 'conformance-subworkflow-child.json'), 'utf8'),
+    ) as { settings?: Record<string, unknown> };
+    expect(validate(base), `fixture must be valid on its own: ${JSON.stringify(validate.errors)}`).toBe(true);
+    const ok = validate({ ...base, settings: { ...(base.settings ?? {}), compensation: fullPolicy } });
+    expect(ok, JSON.stringify(validate.errors)).toBe(true);
+    const bad = validate({ ...base, settings: { ...(base.settings ?? {}), compensation: { triggers: [] } } });
+    expect(bad, 'the $ref must actually be enforced through the workflow schema').toBe(false);
+  });
+});
+
+describe('RFC 0151 §D — the run rollup `compensationStatus` (RunSnapshot)', () => {
+  // Resolves RFC 0151 UQ3: `RunSnapshot` is the sole owner. Debug bundles and the
+  // AsyncAPI `run.snapshot` reuse the snapshot by $ref, so one property covers all
+  // three surfaces — and one enum keeps them from drifting apart.
+  const RUN_SNAPSHOT_SCHEMA = 'run-snapshot.schema.json';
+  const STATUSES = ['none', 'pending', 'running', 'completed', 'partial', 'failed', 'manual'] as const;
+
+  function snapshotValidator() {
+    const ajv = new Ajv2020({ strict: false, allErrors: true });
+    for (const file of readdirSync(SCHEMAS_DIR).filter((f) => f.endsWith('.schema.json'))) {
+      ajv.addSchema(schema(file), file);
+    }
+    return ajv.getSchema(RUN_SNAPSHOT_SCHEMA) ?? ajv.compile(schema(RUN_SNAPSHOT_SCHEMA));
+  }
+
+  it('is declared on RunSnapshot as a closed enum of the seven §D values', () => {
+    const snap = schema(RUN_SNAPSHOT_SCHEMA) as {
+      properties: Record<string, { type?: string; enum?: string[] }>;
+      required: string[];
+    };
+    const field = snap.properties['compensationStatus'];
+    expect(field, 'RunSnapshot MUST declare `compensationStatus` (RFC 0151 §D, UQ3)').toBeDefined();
+    expect(field?.enum, 'the value set is closed and exactly the seven §D values').toEqual([...STATUSES]);
+    expect(
+      snap.required.includes('compensationStatus'),
+      'OPTIONAL on the schema — presence is governed by the capability gate in prose, not by `required`, ' +
+        'so a host that does not advertise `compensation` still validates',
+    ).toBe(false);
+  });
+
+  it('every §D value validates and a foreign value is rejected', () => {
+    const validate = snapshotValidator();
+    for (const value of STATUSES) {
+      const ok = validate({ runId: 'r1', workflowId: 'w1', status: 'failed', compensationStatus: value });
+      expect(ok, `compensationStatus=${value} MUST validate: ${JSON.stringify(validate.errors)}`).toBe(true);
+    }
+    for (const bad of ['compensating', 'COMPLETED', 'done', 'skipped', 'paused', 1, null, true]) {
+      const ok = validate({ runId: 'r1', workflowId: 'w1', status: 'failed', compensationStatus: bad });
+      expect(ok, `compensationStatus=${JSON.stringify(bad)} MUST be rejected — the fold is closed`).toBe(false);
+    }
+  });
+
+  it('a snapshot without the field still validates — the gate lives in prose', () => {
+    const validate = snapshotValidator();
+    expect(validate({ runId: 'r1', workflowId: 'w1', status: 'completed' })).toBe(true);
+  });
+
+  it('the forward `status` enum gained no `compensating` value — §D forbids reinterpreting it', () => {
+    const snap = schema(RUN_SNAPSHOT_SCHEMA) as { properties: { status: { enum: string[] } } };
+    expect(snap.properties.status.enum).not.toContain('compensating');
+  });
+});
+
 describe.skipIf(RFCS_DIR === null)('RFC 0151 — what this file does NOT establish', () => {
   it('records that behavioral conformance is absent, per RFC 0147 §A.5', () => {
     // Not decoration. RFC 0147 §A.5 forbids `Accepted` on shape-only evidence

package/src/scenarios/conformance-advertised-seam-required.test.ts

@@ -0,0 +1,118 @@
+/**
+ * RFC 0148 §B / RFC 0147 program scenario — `conformance-advertised-seam-required`:
+ * under `OPENWOP_REQUIRE_BEHAVIOR=true` an advertised capability whose
+ * observation seam is missing FAILS; it never soft-skips into a pass.
+ *
+ * Three mechanisms carry the rule and each is pinned here with the env
+ * toggled in-process:
+ *   - `behaviorGate(profile, advertised=false)` — a profile the host does not
+ *     advertise and did not opt out of: default mode records `inapplicable`
+ *     and returns false; strict mode THROWS (advertise or opt out explicitly);
+ *   - `behaviorGatePresent(profile, null)` — a seam helper returned nothing:
+ *     the same rule, because an advertised capability with no seam is a claim
+ *     the suite cannot check;
+ *   - `seamAbsent(reason)` — an advertised capability whose seam answered
+ *     404/403 mid-scenario: default mode notes `blocked` with the reason;
+ *     strict mode THROWS (RFC 0148 §B; RFC 0139 G14 flip). A 403 is not a
+ *     pass.
+ * `OPENWOP_OPTED_OUT_PROFILES` is the only sanctioned way to keep strict mode
+ * green for a profile a host genuinely does not implement — and it records
+ * `skipped` with the reason, never a pass.
+ *
+ * Server-free, always-on; MUST NOT capability-skip (RFC 0148 §Conformance).
+ */
+
+import { describe, it, expect, beforeEach, afterEach, beforeAll, afterAll } from 'vitest';
+import { behaviorGate, behaviorGatePresent } from '../lib/behavior-gate.js';
+import { seamAbsent, softSkipDisposition, resetSoftSkips } from '../lib/soft-skip.js';
+import { dispositionOf, resetLedger, suspendSinkForFixtures } from '../lib/requirement-ledger.js';
+import { __resetEnvCacheForTests } from '../lib/env.js';
+
+export const HOST_CALLBACK_NOT_REQUIRED = 'server-free: toggles OPENWOP_REQUIRE_BEHAVIOR in-process and pins the advertised-missing-seam rule';
+
+const PROFILE = 'openwop-conformance-advertised-seam-probe';
+const ENV_KEYS = ['OPENWOP_REQUIRE_BEHAVIOR', 'OPENWOP_OPTED_OUT_PROFILES', 'OPENWOP_BASE_URL', 'OPENWOP_API_KEY'] as const;
+let saved: Record<string, string | undefined> = {};
+let restoreSink: (() => void) | undefined;
+
+beforeAll(() => {
+  // this file records fixture profile ids into the ledger — keep them out of a live sink
+  restoreSink = suspendSinkForFixtures();
+});
+afterAll(() => restoreSink?.());
+
+beforeEach(() => {
+  resetLedger();
+  resetSoftSkips();
+  saved = {};
+  for (const k of ENV_KEYS) {
+    saved[k] = process.env[k];
+    delete process.env[k];
+  }
+  // `loadEnv()` requires a base URL and an api key even on paths that reach no
+  // host, and it caches — stub both and drop the cache per test.
+  process.env['OPENWOP_BASE_URL'] = 'https://conformance.invalid';
+  process.env['OPENWOP_API_KEY'] = 'dummy-not-used-no-request-is-made';
+  __resetEnvCacheForTests();
+});
+
+afterEach(() => {
+  for (const k of ENV_KEYS) {
+    if (saved[k] === undefined) delete process.env[k];
+    else process.env[k] = saved[k];
+  }
+  __resetEnvCacheForTests();
+  resetLedger();
+  resetSoftSkips();
+});
+
+describe('RFC 0148 §B — conformance-advertised-seam-required', () => {
+  it('default mode: an unadvertised profile records inapplicable and gates false — never a pass', () => {
+    delete process.env['OPENWOP_REQUIRE_BEHAVIOR'];
+    __resetEnvCacheForTests();
+    delete process.env['OPENWOP_OPTED_OUT_PROFILES'];
+    expect(behaviorGate(PROFILE, false)).toBe(false);
+    expect(dispositionOf(`openwop.profile.${PROFILE}`)).toBe('inapplicable');
+  });
+
+  it('strict mode: an unadvertised, un-opted-out profile FAILS (advertise or opt out explicitly)', () => {
+    process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
+    __resetEnvCacheForTests();
+    delete process.env['OPENWOP_OPTED_OUT_PROFILES'];
+    expect(() => behaviorGate(PROFILE, false)).toThrow(/OPENWOP_REQUIRE_BEHAVIOR=true/);
+  });
+
+  it('strict mode: an advertised capability whose seam helper returned nothing FAILS (behaviorGatePresent)', () => {
+    process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
+    __resetEnvCacheForTests();
+    delete process.env['OPENWOP_OPTED_OUT_PROFILES'];
+    expect(() => behaviorGatePresent(PROFILE, null)).toThrow();
+    // and with a value present it narrows and passes through
+    delete process.env['OPENWOP_REQUIRE_BEHAVIOR'];
+    __resetEnvCacheForTests();
+    expect(behaviorGatePresent(PROFILE, { ok: true })).toBe(true);
+  });
+
+  it('strict mode: seamAbsent (advertised, seam answered 404/403 mid-scenario) FAILS; default mode notes blocked with the reason', () => {
+    process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
+    __resetEnvCacheForTests();
+    expect(() => seamAbsent('host advertises X but /v1/host/sample/x answered 404')).toThrow(/RFC 0148 §B/);
+    delete process.env['OPENWOP_REQUIRE_BEHAVIOR'];
+    __resetEnvCacheForTests();
+    resetSoftSkips();
+    expect(seamAbsent('host advertises X but /v1/host/sample/x answered 403')).toBeUndefined();
+    const noted = softSkipDisposition('conformance-advertised-seam-required.test.ts');
+    expect(noted?.kind).toBe('blocked');
+    expect(noted?.reason).toContain('answered 403');
+  });
+
+  it('the sanctioned escape is an explicit opt-out, which records skipped with the reason — still never a pass', () => {
+    process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
+    __resetEnvCacheForTests();
+    process.env['OPENWOP_OPTED_OUT_PROFILES'] = PROFILE;
+    __resetEnvCacheForTests();
+    expect(behaviorGate(PROFILE, false)).toBe(false);
+    expect(dispositionOf(`openwop.profile.${PROFILE}`)).toBe('skipped');
+  });
+});
+

package/src/scenarios/conformance-execution-witness.test.ts

@@ -0,0 +1,104 @@
+/**
+ * RFC 0148 §A / RFC 0147 program scenario — `conformance-execution-witness`:
+ * an early return cannot become a pass.
+ *
+ * The runner's file-level record (`resolveFileRecord`, applied by `setup.ts`
+ * `afterAll`) is the mechanism that turned every "test returned before its
+ * first expect → vitest pass" into a disposition RFC 0148 §A can act on:
+ *
+ *   - a failed test        ⇒ executed-fail
+ *   - a witnessed pass     ⇒ executed-pass (assertionCount > 0)
+ *   - a zero-assertion pass with a noted reason (softSkip / seamAbsent /
+ *     behaviorGate) ⇒ inapplicable | skipped | blocked, with that reason
+ *   - a zero-assertion pass with NO reason ⇒ blocked + the marker detail,
+ *     which certification still treats as an UNCLASSIFIED return
+ *
+ * and the certification layer refuses a claim carrying an unwitnessed row.
+ * These legs pin the rule at each layer — runner record, emitter derivation,
+ * consumer verifier — with sabotage vectors, so the guarantee is a property
+ * the suite defends rather than a property it happens to have.
+ *
+ * Server-free, always-on; MUST NOT capability-skip (RFC 0148 §Conformance).
+ */
+
+import { describe, it, expect } from 'vitest';
+import { resolveFileRecord, deriveRequirementDispositions } from '../lib/scenario-disposition.js';
+import { UNCLASSIFIED_RETURN_DETAIL } from '../lib/soft-skip.js';
+import { PROFILE_FLOOR_SCENARIOS } from '../lib/profiles.js';
+import { requirementIdForScenario, requirementsFor } from '../lib/requirement-registry.js';
+import { verifyBundleV2, type BundleV2Requirement } from '../lib/certification-bundle-verify.js';
+
+export const HOST_CALLBACK_NOT_REQUIRED = 'server-free: pins the runner/emitter/verifier rule that an early return is never a pass';
+
+const HEX = 'c'.repeat(64);
+
+describe('RFC 0148 §A — conformance-execution-witness: the runner record', () => {
+  it('a witnessed pass is executed-pass; a failed test is executed-fail regardless of count', () => {
+    expect(resolveFileRecord(['pass', 'pass'], undefined, 7, null).disposition).toBe('executed-pass');
+    expect(resolveFileRecord(['pass', 'fail'], undefined, 7, null).disposition).toBe('executed-fail');
+    expect(resolveFileRecord(['fail'], undefined, 0, null).disposition).toBe('executed-fail');
+  });
+
+  it('a zero-assertion pass with NO reason is BLOCKED with the marker — never a pass', () => {
+    const r = resolveFileRecord(['pass', 'pass'], undefined, 0, null);
+    expect(r.disposition).toBe('blocked');
+    expect(r.detail).toBe(UNCLASSIFIED_RETURN_DETAIL);
+  });
+
+  it('a zero-assertion pass takes the noted reason (softSkip / seamAbsent) — inapplicable, skipped, or blocked with the text', () => {
+    expect(resolveFileRecord(['pass'], undefined, 0, { kind: 'inapplicable', reason: 'host does not advertise X' })).toEqual({ disposition: 'inapplicable', detail: 'host does not advertise X' });
+    expect(resolveFileRecord(['pass'], undefined, 0, { kind: 'blocked', reason: 'seam answered 404' })).toEqual({ disposition: 'blocked', detail: 'seam answered 404' });
+    expect(resolveFileRecord(['pass'], undefined, 0, { kind: 'skipped', reason: 'operator opt-out' })).toEqual({ disposition: 'skipped', detail: 'operator opt-out' });
+  });
+
+  it('a behaviorGate reason resolves a zero-assertion pass to inapplicable/skipped; a note outranks nothing but never a witnessed pass', () => {
+    expect(resolveFileRecord(['pass'], 'inapplicable', 0, null).disposition).toBe('inapplicable');
+    expect(resolveFileRecord(['pass'], 'skipped', 0, null).disposition).toBe('skipped');
+    // real assertions ran: the note is irrelevant, the file passed
+    expect(resolveFileRecord(['pass'], undefined, 3, { kind: 'blocked', reason: 'irrelevant' }).disposition).toBe('executed-pass');
+  });
+});
+
+describe('RFC 0148 §A — conformance-execution-witness: emitter and verifier refuse an unwitnessed floor row', () => {
+  const profile = 'openwop-core-standard';
+  const files = PROFILE_FLOOR_SCENARIOS[profile]!.required;
+  const ids = requirementsFor(profile, {}) ?? [];
+
+  it('the emitter derivation marks a marker-blocked floor row unclassified and rejects the claim', () => {
+    const rep = new Map<string, 'passed' | 'failed' | 'skipped'>(files.map((f) => [f, 'passed' as const]));
+    const ledger = files.map((f) => ({ requirementId: requirementIdForScenario(f), disposition: 'executed-pass' as const, assertionCount: 3 }));
+    // sabotage: one floor file returned early with no reason
+    ledger[0] = { requirementId: requirementIdForScenario(files[0]!), disposition: 'blocked' as unknown as 'executed-pass', assertionCount: 0, ...( { detail: UNCLASSIFIED_RETURN_DETAIL } as object) } as typeof ledger[number];
+    // add the prefix witness so only the sabotaged row is unclassified
+    ledger.push({ requirementId: 'openwop.scenario.interrupt-alpha', disposition: 'executed-pass' as const, assertionCount: 2 });
+    rep.set('interrupt-alpha.test.ts', 'passed');
+    const d = deriveRequirementDispositions(rep, ledger, [profile], {});
+    const v = d.verdicts.find((x) => x.profile === profile)!;
+    expect(v.unclassified).toEqual([requirementIdForScenario(files[0]!)]);
+    expect(d.rejectUnclassified).toBe(true);
+    // and the same file with a witnessed pass certifies
+    ledger[0] = { requirementId: requirementIdForScenario(files[0]!), disposition: 'executed-pass' as const, assertionCount: 3 };
+    const d2 = deriveRequirementDispositions(rep, ledger, [profile], {});
+    expect(d2.verdicts.find((x) => x.profile === profile)!.certifiable).toBe(true);
+    expect(ids.length).toBeGreaterThan(0);
+  });
+
+  it('the consumer verifier rejects a bundle whose required row is a vacuous pass or the runner marker, and accepts the witnessed twin', () => {
+    const doc = { protocolVersion: '1.0', supportedEnvelopes: ['clarification.request'], supportedTransports: ['rest'], schemaVersions: { workflow: '1.0' }, limits: { clarificationRounds: 1, schemaRounds: 1, envelopesPerTurn: 1 } };
+    const rows: BundleV2Requirement[] = files.map((f) => ({ requirementId: requirementIdForScenario(f), scenarioId: f, disposition: 'executed-pass', assertionCount: 3 }));
+    rows.push({ requirementId: 'openwop.scenario.interrupt-alpha', scenarioId: 'interrupt-alpha.test.ts', disposition: 'executed-pass', assertionCount: 2 });
+    const bundle = (rs: BundleV2Requirement[]) => ({
+      bundleVersion: '2', suite: { package: '@openwop/openwop-conformance', version: '1.123.0' }, host: { name: 'v', version: '0' },
+      discovery: { url: 'https://example.invalid/.well-known/openwop', sha256: HEX, document: doc }, claimedProfiles: [profile],
+      results: { totals: { executedPass: rs.filter((r) => r.disposition === 'executed-pass').length, executedFail: 0, skipped: 0, inapplicable: 0, blocked: rs.filter((r) => r.disposition === 'blocked').length }, requirements: rs },
+      scenarioManifestSha256: HEX, targetConfigurationSha256: HEX,
+    });
+    expect(verifyBundleV2(bundle(rows)).certified).toBe(true);
+    const vacuous = rows.map((r, i) => (i === 0 ? { ...r, assertionCount: 0 } : r));
+    expect(verifyBundleV2(bundle(vacuous)).evidenceValid).toBe(false);
+    const marker = rows.map((r, i) => (i === 0 ? { requirementId: r.requirementId, scenarioId: r.scenarioId, disposition: 'blocked', detail: UNCLASSIFIED_RETURN_DETAIL, assertionCount: 0 } : r));
+    const v = verifyBundleV2(bundle(marker));
+    expect(v.evidenceValid).toBe(false);
+    expect(v.profiles[0]?.rejections[0]?.kind).toBe('unwitnessed-requirement');
+  });
+});

package/src/scenarios/conversationCapabilityNegotiation.test.ts

@@ -17,6 +17,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { readErrorCode } from '../lib/error-envelope.js';
 import { driver } from '../lib/driver.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { isConversationPrimitiveSupported } from '../lib/multi-agent-capabilities.js';
@@ -33,8 +34,8 @@ describe.skipIf(SKIP)('conversationCapabilityNegotiation: refusal contract', ()
     // or at run-create (400). What MUST NOT happen is a successful
     // 201 followed by silent fallback.
     expect([400, 404, 422]).toContain(create.status);
-    const body = create.json as { error?: { code?: string }; code?: string };
-    const code = body.error?.code ?? body.code ?? '';
+    const body = create.json as { code?: string };
+    const code = readErrorCode(create.json) ?? body.code ?? '';
     expect(typeof code).toBe('string');
   });
 });

package/src/scenarios/core-manifest-and-extension-registry.test.ts

@@ -182,6 +182,32 @@ describe.skipIf(V1_DIR === null)('RFC 0155 §C — extension registry', () => {
     ).toEqual([]);
   });
 
+  it('the coverage block is present and accounts for every capability family (RFC 0155 §C, acceptance item 3)', () => {
+    // "Unlisted means uncovered" was a sentence; this makes it a checked list.
+    // The block is DERIVED by scripts/generate-extension-registry-coverage.mjs
+    // (--check runs in openwop:check); here we assert the invariant it encodes
+    // so a tarball consumer sees it too: every top-level capability family is
+    // either a core predicate field, covered by a record's capabilityPath, or
+    // listed as uncovered — and nothing is in two buckets.
+    const reg = registry as unknown as {
+      coverage?: { familiesTotal: number; coreFields: string[]; covered: string[]; uncovered: string[] };
+      extensions: Extension[];
+    };
+    expect(reg.coverage, 'RFC 0155 §C: the registry MUST carry a derived `coverage` block').toBeDefined();
+    const cov = reg.coverage as NonNullable<typeof reg.coverage>;
+    const families = Object.keys((caps().properties as Record<string, unknown>) ?? {}).sort();
+    expect(cov.familiesTotal).toBe(families.length);
+    const all = [...cov.coreFields, ...cov.covered, ...cov.uncovered].sort();
+    expect(all, 'core + covered + uncovered MUST partition the family set exactly').toEqual(families);
+    expect(new Set(all).size, 'no family may sit in two buckets').toBe(all.length);
+    const reached = new Set(reg.extensions.map((e) => e.capabilityPath.split('.')[0]));
+    for (const f of cov.covered) expect(reached.has(f), `${f} listed as covered MUST be reached by a record`).toBe(true);
+    for (const f of cov.uncovered) expect(reached.has(f), `${f} listed as uncovered MUST NOT be reached by a record`).toBe(false);
+    // The honest number, asserted so it cannot silently shrink by deletion of the
+    // uncovered list rather than by adding records.
+    expect(cov.uncovered.length + cov.covered.length + cov.coreFields.length).toBe(families.length);
+  });
+
   it('every record names the RFC that owns it', () => {
     // Vendor extensions may not use an `openwop-*` id without an accepted RFC
     // (§F). The owning RFC is what makes that checkable.

package/src/scenarios/credential-payload-redaction.test.ts

@@ -25,6 +25,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
@@ -50,7 +51,7 @@ async function readCredentials(): Promise<DiscoveryCredentials | null> {
 describe('credential-payload-redaction: advertisement shape (RFC 0046 §A)', () => {
   it('capabilities.credentials.supported is a boolean when advertised', async () => {
     const cred = await readCredentials();
-    if (cred === null) return;
+    if (cred === null) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `cred === null` returned early');
     expect(
       typeof cred.supported,
       driver.describe(
@@ -64,13 +65,13 @@ describe('credential-payload-redaction: advertisement shape (RFC 0046 §A)', ()
 describe('credential-payload-redaction: resolved material MUST NOT cross the wire (RFC 0046 §C.1)', () => {
   it('canary plaintext is absent from every observable run surface', async () => {
     const cred = await readCredentials();
-    if (!cred?.supported) return; // capability-gated
+    if (!cred?.supported) return softSkip('inapplicable', 'capability-gated');
 
     // Seam contract: resolve a seeded credential whose plaintext is CANARY,
     // run an echo node, and return the run's observable surfaces.
     const res = await driver.post('/v1/host/sample/credentials/echo', { canary: CANARY });
     // 404 from a host that hasn't wired the test seam is a soft-skip.
-    if (res.status === 404) return;
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam, prior step, or fixture unavailable)');
 
     expect(
       res.status,

package/src/scenarios/credentials-capability-shape.test.ts

@@ -20,6 +20,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
@@ -49,7 +50,7 @@ async function readCredentials(): Promise<DiscoveryCredentials | null> {
 describe('credentials-capability-shape: advertisement shape (RFC 0046 §A)', () => {
   it('capabilities.credentials is either absent or well-formed', async () => {
     const cred = await readCredentials();
-    if (cred === null) return; // host doesn't advertise host.credentials at all
+    if (cred === null) return softSkip('inapplicable', 'host doesn\'t advertise host.credentials at all');
     expect(
       typeof cred.supported,
       driver.describe(
@@ -61,7 +62,7 @@ describe('credentials-capability-shape: advertisement shape (RFC 0046 §A)', ()
 
   it('scopes is a subset of {user, workspace, tenant} when supported', async () => {
     const cred = await readCredentials();
-    if (!cred?.supported || cred.scopes === undefined) return;
+    if (!cred?.supported || cred.scopes === undefined) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!cred?.supported || cred.scopes === undefined` returned early');
     expect(
       Array.isArray(cred.scopes),
       driver.describe('RFC 0046 §A', 'capabilities.credentials.scopes MUST be an array'),
@@ -79,7 +80,7 @@ describe('credentials-capability-shape: advertisement shape (RFC 0046 §A)', ()
 
   it('rotation is one of {none, two-key-overlap} when present', async () => {
     const cred = await readCredentials();
-    if (!cred?.supported || cred.rotation === undefined) return;
+    if (!cred?.supported || cred.rotation === undefined) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!cred?.supported || cred.rotation === undefined` returned early');
     expect(
       VALID_ROTATION.has(cred.rotation),
       driver.describe(

package/src/scenarios/cross-engine-append-behavior.test.ts

@@ -29,6 +29,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
@@ -73,7 +74,7 @@ describe.skipIf(HTTP_SKIP)('cross-engine-append-behavior: §B cross-engine order
     const resetStatus = await resetLog();
     if (resetStatus === 404) {
       ctx.skip(); // host doesn't expose the cross-engine harness seam
-      return;
+      return softSkip('blocked', 'precondition not met — `resetStatus === 404` returned early (seam, prior step, or fixture unavailable)');
     }
     expect(resetStatus).toBe(200);
 
@@ -125,7 +126,7 @@ describe.skipIf(HTTP_SKIP)('cross-engine-append-behavior: §B cross-engine order
     const resetStatus = await resetLog();
     if (resetStatus === 404) {
       ctx.skip();
-      return;
+      return softSkip('blocked', 'precondition not met — `resetStatus === 404` returned early (seam, prior step, or fixture unavailable)');
     }
     expect(resetStatus).toBe(200);
 
@@ -153,7 +154,7 @@ describe.skipIf(HTTP_SKIP)('cross-engine-append-behavior: §B cross-engine order
     const resetStatus = await resetLog();
     if (resetStatus === 404) {
       ctx.skip();
-      return;
+      return softSkip('blocked', 'precondition not met — `resetStatus === 404` returned early (seam, prior step, or fixture unavailable)');
     }
     expect(resetStatus).toBe(200);
 
@@ -180,7 +181,7 @@ describe.skipIf(HTTP_SKIP)('cross-engine-append-behavior: §B cross-engine order
     const resetStatus = await resetLog();
     if (resetStatus === 404) {
       ctx.skip();
-      return;
+      return softSkip('blocked', 'precondition not met — `resetStatus === 404` returned early (seam, prior step, or fixture unavailable)');
     }
     expect(resetStatus).toBe(200);
 

package/src/scenarios/cross-engine-append-ordering.test.ts

@@ -25,6 +25,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
@@ -55,9 +56,9 @@ async function readDiscovery(): Promise<DiscoveryDoc | null> {
 describe.skipIf(HTTP_SKIP)('cross-engine-append-ordering: advertisement shape (RFC 0036 §B)', () => {
   it('capabilities.eventLog.crossEngineOrdering (when present) conforms to RFC 0036 §B', async () => {
     const d = await readDiscovery();
-    if (d === null) return;
+    if (d === null) return softSkip('blocked', 'precondition not met — `d === null` returned early (seam, prior step, or fixture unavailable)');
     const ceo = capabilityFamily<{ crossEngineOrdering?: { supported?: unknown; orderingModel?: unknown } }>(d, 'eventLog')?.crossEngineOrdering;
-    if (ceo === undefined) return; // host doesn't advertise — soft-skip
+    if (ceo === undefined) return softSkip('inapplicable', 'host doesn\'t advertise — soft-skip');
 
     expect(
       typeof ceo.supported,

package/src/scenarios/cross-host-ancestry-endpoint.test.ts

@@ -34,6 +34,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
@@ -69,7 +70,7 @@ describe.skipIf(HTTP_SKIP)('cross-host-ancestry-endpoint: behavioral (RFC 0040
     const chc = capabilityFamily<{ executionModel?: { [k: string]: unknown; crossHostCausation?: Record<string, unknown>; replayDeterminism?: Record<string, unknown> } }>(d, 'multiAgent')?.executionModel?.crossHostCausation;
     if (chc?.ancestryEndpointSupported !== true) {
       ctx.skip();
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `chc?.ancestryEndpointSupported !== true` returned early');
     }
 
     // Create a fresh top-level run via the host's conformance-dispatch-loop
@@ -78,7 +79,7 @@ describe.skipIf(HTTP_SKIP)('cross-host-ancestry-endpoint: behavioral (RFC 0040
     const create = await driver.post('/v1/runs', { workflowId: 'conformance-dispatch-loop' });
     if (create.status !== 201) {
       ctx.skip();
-      return;
+      return softSkip('blocked', 'precondition not met — `create.status !== 201` returned early (seam, prior step, or fixture unavailable)');
     }
     const runId = (create.json as { runId: string }).runId;
 
@@ -116,11 +117,11 @@ describe.skipIf(HTTP_SKIP)('cross-host-ancestry-endpoint: behavioral (RFC 0040
     const chc = capabilityFamily<{ executionModel?: { [k: string]: unknown; crossHostCausation?: Record<string, unknown>; replayDeterminism?: Record<string, unknown> } }>(d, 'multiAgent')?.executionModel?.crossHostCausation;
     if (chc?.supported !== true) {
       ctx.skip();
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `chc?.supported !== true` returned early');
     }
     if (chc.ancestryEndpointSupported === true) {
       ctx.skip(); // covered by the test above
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `chc.ancestryEndpointSupported === true` returned early');
     }
 
     // Use any runId — even a synthetic non-existent one. The endpoint should

package/src/scenarios/cross-host-causation-shape.test.ts

@@ -26,6 +26,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
@@ -62,12 +63,12 @@ describe.skipIf(HTTP_SKIP)('cross-host-causation-shape: advertisement shape (RFC
     const d = await readDiscovery();
     if (d === null) {
       ctx.skip();
-      return;
+      return softSkip('blocked', 'precondition not met — `d === null` returned early (seam, prior step, or fixture unavailable)');
     }
     const chc = capabilityFamily<{ executionModel?: { [k: string]: unknown; crossHostCausation?: Record<string, unknown>; replayDeterminism?: Record<string, unknown> } }>(d, 'multiAgent')?.executionModel?.crossHostCausation;
     if (chc === undefined) {
       ctx.skip(); // host doesn't advertise — soft-skip
-      return;
+      return softSkip('blocked', 'precondition not met — `chc === undefined` returned early (seam, prior step, or fixture unavailable)');
     }
 
     expect(