@openwop/openwop-conformance 1.106.1 → 1.124.0

package/coverage.md

@@ -75,6 +75,12 @@
 
 ---
 
+## Requirement dispositions and certification (RFC 0148 §A/§C — the coverage guide)
+
+Since suite `1.114.0` every scenario file records a **disposition** into the RFC 0148 §A ledger (`OPENWOP_LEDGER_PATH`, set by `--certify`): `executed-pass` (with `assertionCount` > 0), `executed-fail`, `skipped` (operator opt-out via `OPENWOP_OPTED_OUT_PROFILES`), `inapplicable` (capability / profile / fixture not advertised — `behaviorGate` or `softSkip('inapplicable', …)`), or `blocked` (seam absent, prior step failed, precondition unmet — `seamAbsent` / `softSkip('blocked', …)`). A test that returns before its first `expect` is a pass with **zero assertions**; the runner never records that as a pass — it takes the file's noted reason, or resolves it to `blocked` with a fixed marker (`UNCLASSIFIED_RETURN_DETAIL`), which certification still treats as an *unclassified return*. Rules for authors: `CONTRIBUTING.md` §Conformance suite ("never return early in silence").
+
+**How a claim certifies (bundle v2, `--certify --bundle-version 2`):** `claimedProfiles` are derived from the captured discovery document (canonical ids; `openwop-core` goes in `aliases`); every catalog profile has a floor in `PROFILE_FLOOR_SCENARIOS` (`discoveryOnly`, plain, `runtimeDerived` for `openwop-node-packs` — claimed only when held — or discovery-`conditional` for `openwop-replay-fork`); a profile is *certifiable* when every floor row is `executed-pass` (witnessed) / `skipped` / `inapplicable`; a floor row that is `blocked` or `executed-fail` makes it *not certifiable* (valid evidence, honest state); a floor row with **no ledger row, a zero-assertion pass, or the runner marker** is an *unclassified return* and **rejects** the claim (`--certify` exits 3, bundle still written). The consumer verifier `verifyBundleV2` re-derives all of this from the bundle's own rows and document (`certification-bundle-non-vacuous.test.ts`), and both emitter and verifier scrub / reject the SR-1 secret canary (`certification-bundle-redaction.test.ts`). Under `OPENWOP_REQUIRE_BEHAVIOR=true` an advertised profile with a missing seam **fails** instead of recording `blocked` (`conformance-advertised-seam-required.test.ts`); an early return can never become a pass at any layer (`conformance-execution-witness.test.ts`). Strict runs need the host's opt-out list (its conformance boot sets it) or every unadvertised gated profile fails — those totals are not findings.
+
 ## Capability-gated scenarios: shape vs behavior
 
 The scenario groups in the table below (one row per group; count the rows — the number is no longer hard-coded here because it drifts) validate optional profiles where the host's discovery advertisement is well-formed (shape grade) but no reference host yet implements the profile end-to-end (behavior grade is `host-pending`). Default suite runs skip these with a warning; set `OPENWOP_REQUIRE_BEHAVIOR=true` to convert skips into hard failures.

package/dist/cli.js

@@ -32,7 +32,10 @@ import { tmpdir } from 'node:os';
 import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { SCHEMAS_DIR } from './lib/paths.js';
-import { deriveProfiles, isCoreStandard, agentPlatformStatus, } from './lib/profiles.js';
+import { readLedgerFile } from './lib/requirement-ledger.js';
+import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
+import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
+import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, } from './lib/profiles.js';
 function parseArgs(argv) {
     let baseUrl;
     let apiKey;
@@ -249,9 +252,14 @@ async function runCertify(args, baseUrl, apiKey) {
     const conformanceRoot = resolvePath(here, '..');
     const reportDir = mkdtempSync(join(tmpdir(), 'owp-certify-'));
     const reportFile = join(reportDir, 'vitest-report.json');
+    // RFC 0148 §A ledger sink (S6): every scenario file records its disposition
+    // (and assertion count) here; the runner reads it after the run so bundle v2
+    // rows come from what scenarios RECORDED, not from per-file pass/fail/skip.
+    const ledgerFile = join(reportDir, 'requirement-ledger.jsonl');
     const env = { ...process.env };
     env.OPENWOP_BASE_URL = baseUrl;
     env.OPENWOP_API_KEY = apiKey;
+    env.OPENWOP_LEDGER_PATH = ledgerFile;
     if (args.impl)
         env.OPENWOP_IMPLEMENTATION_NAME = args.impl;
     if (args.implVersion)
@@ -270,6 +278,7 @@ async function runCertify(args, baseUrl, apiKey) {
         process.exit(2);
     }
     let report;
+    const ledgerEntries = readLedgerFile(ledgerFile);
     try {
         report = JSON.parse(readFileSync(reportFile, 'utf8'));
     }
@@ -343,6 +352,18 @@ async function runCertify(args, baseUrl, apiKey) {
     // a large `blocked` count and therefore does NOT certify. That is not a defect
     // in the emitter. It is the true state of the evidence, which v1 was unable to
     // represent and therefore reported as a clean skip.
+    // (d1) RFC 0148 acceptance item 2 — requirement-level dispositions from the
+    // ledger, and rejection of unclassified returns for a claimed profile.
+    const derived = deriveRequirementDispositions(states, ledgerEntries, claimedProfiles, document);
+    const notHeld = new Set(derived.verdicts.filter((v) => v.runtimeDerived && !v.held).map((v) => v.profile));
+    const rejectedProfiles = derived.verdicts.filter((v) => v.unclassified.length > 0);
+    if (rejectedProfiles.length > 0) {
+        process.stderr.write('openwop-conformance --certify: REJECTING certification — a claimed profile has UNCLASSIFIED floor requirements\n' +
+            '  (no disposition recorded, or an executed-pass with assertionCount 0 — a witness of nothing). RFC 0148 §A\n' +
+            '  resolves an unclassified requirement to `blocked`, never to a pass; the bundle is still written so the\n' +
+            '  evidence is inspectable, but it does not certify and this process exits 3.\n' +
+            rejectedProfiles.map((v) => `  - ${v.profile}: ${v.unclassified.join(', ')}\n`).join(''));
+    }
     if (args.bundleVersion === '2') {
         const scenarioIds = [...passed, ...failed, ...skipped].sort();
         const manifestSha = createHash('sha256').update(scenarioIds.join('\n'), 'utf8').digest('hex');
@@ -352,27 +373,15 @@ async function runCertify(args, baseUrl, apiKey) {
         const configSha = createHash('sha256')
             .update(`${args.baseUrl}\n${sha256}\n${process.env['OPENWOP_REQUIRE_BEHAVIOR'] ?? ''}`, 'utf8')
             .digest('hex');
-        const requirements = [
-            ...passed.map((f) => ({
-                requirementId: `openwop.scenario.${f.replace(/\.test\.ts$/, '')}`,
-                scenarioId: f,
-                disposition: 'executed-pass',
-            })),
-            ...failed.map((f) => ({
-                requirementId: `openwop.scenario.${f.replace(/\.test\.ts$/, '')}`,
-                scenarioId: f,
-                disposition: 'executed-fail',
-                detail: 'the scenario executed and failed',
-            })),
-            ...skipped.map((f) => ({
-                requirementId: `openwop.scenario.${f.replace(/\.test\.ts$/, '')}`,
-                scenarioId: f,
-                disposition: 'blocked',
-                detail: 'runner cannot classify a skipped file: the RFC 0148 §A requirement ledger is not ' +
-                    'populated during a run, so skipped/inapplicable/blocked are indistinguishable here. ' +
-                    '§A resolves an unclassifiable requirement to `blocked`, never to a pass.',
-            })),
-        ];
+        // Rows come from the ledger (S6). A file that recorded nothing is
+        // `blocked` — unclassified — and, if it sits on a claimed floor, rejected above.
+        const requirements = derived.requirements.map((r) => ({
+            requirementId: r.requirementId,
+            scenarioId: r.scenarioId,
+            disposition: r.disposition,
+            ...(r.detail === undefined ? {} : { detail: r.detail }),
+            ...(r.assertionCount === undefined ? {} : { assertionCount: r.assertionCount }),
+        }));
         const v2 = {
             bundleVersion: '2',
             generatedAt: new Date().toISOString(),
@@ -380,60 +389,95 @@ async function runCertify(args, baseUrl, apiKey) {
             suite: { package: '@openwop/openwop-conformance', version },
             host,
             discovery: { url: discoveryUrl, sha256, document },
-            claimedProfiles,
+            // RFC 0155 §E: canonical ids only in `claimedProfiles`; a deprecated
+            // alias that also derives (`openwop-core`, always alongside
+            // `openwop-discovery-core`) is reported in `aliases`, never as a claim.
+            // A runtime-derived profile (`PROFILE_FLOOR_SCENARIOS[p].runtimeDerived`,
+            // today `openwop-node-packs`) is claimed only when the host HOLDS it — every
+            // floor row a witnessed pass. Its discovery predicate is `openwop-core`, so
+            // deriving the claim from discovery alone made every core host "claim" a
+            // registry it never advertised (RFC 0025: the read surface has no advert).
+            claimedProfiles: claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES) && !notHeld.has(p)),
+            ...(claimedProfiles.some((p) => p in DEPRECATED_PROFILE_ALIASES)
+                ? { aliases: claimedProfiles.filter((p) => p in DEPRECATED_PROFILE_ALIASES) }
+                : {}),
             results: {
-                totals: {
-                    executedPass: passed.length,
-                    executedFail: failed.length,
-                    skipped: 0,
-                    inapplicable: 0,
-                    blocked: skipped.length,
-                },
+                totals: derived.totals,
                 requirements,
             },
             scenarioManifestSha256: manifestSha,
             targetConfigurationSha256: configSha,
         };
+        // RFC 0148 §C: secret canaries never enter evidence. Scrub the finished
+        // document with the credential this run was handed, every OPENWOP_*
+        // key/token/secret in the environment, and the conformance canary — a
+        // scenario's `detail` string, the captured discovery document, or a host
+        // field could carry any of them, and the emitter is the last place that
+        // can guarantee they do not ship.
+        const secrets = evidenceSecretsFromEnv(process.env, [apiKey]);
+        const scrubbed = scrubEvidence(v2, secrets);
+        const v2Out = scrubbed.value;
+        if (scrubbed.redactedAt.length > 0) {
+            process.stderr.write(`openwop-conformance --certify: REDACTED ${scrubbed.redactedAt.length} evidence field(s) that carried a configured secret or the conformance canary: ${scrubbed.redactedAt.slice(0, 8).join(', ')}${scrubbed.redactedAt.length > 8 ? ', …' : ''}\n`);
+        }
+        // Self-audit with the consumer verifier: the emitter MUST NOT write a
+        // document the verifier would reject on shape (duplicate rows, totals that
+        // disagree with rows, unknown dispositions, a canary). Rejections scoped to
+        // a claimed profile (unwitnessed / vacuous) are the exit-3 case below and
+        // are reported through `derived`; a bundle-wide rejection here is a bug in
+        // this emitter and exits 2.
+        const selfAudit = verifyBundleV2(v2Out);
+        if (selfAudit.rejections.length > 0) {
+            process.stderr.write('openwop-conformance --certify: assembled v2 bundle FAILED self-verification (emitter defect):\n' +
+                selfAudit.rejections.map((r) => `  - [${r.kind}] ${r.detail}`).join('\n') +
+                '\n');
+            process.exit(2);
+        }
         const v2Schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'certification-bundle-v2.schema.json'), 'utf8'));
         const v2Ajv = new Ajv2020({ allErrors: true, strict: false });
         addFormats(v2Ajv);
         const v2Validate = v2Ajv.compile(v2Schema);
-        if (!v2Validate(v2)) {
+        if (!v2Validate(v2Out)) {
             process.stderr.write('openwop-conformance --certify: assembled v2 bundle FAILED schema validation:\n' +
                 `${JSON.stringify(v2Validate.errors, null, 2)}\n`);
             process.exit(2);
         }
-        writeFileSync(outPath, `${JSON.stringify(v2, null, 2)}\n`);
+        writeFileSync(outPath, `${JSON.stringify(v2Out, null, 2)}\n`);
         process.stdout.write(`openwop-conformance --certify: wrote bundle v2 to ${outPath}\n` +
             `  host: ${host.name}@${host.version}\n` +
-            `  executed-pass ${passed.length} / executed-fail ${failed.length} / blocked ${skipped.length}\n` +
-            (skipped.length > 0
-                ? `  NOTE: ${skipped.length} requirement(s) are 'blocked', not 'skipped'. The runner cannot\n` +
-                    `  classify a skipped file until scenarios record into the RFC 0148 §A ledger, and §A\n` +
-                    `  resolves an unclassifiable requirement to 'blocked' rather than to a pass. A bundle\n` +
-                    `  with blocked > 0 does NOT certify — that is the true state of the evidence, not a\n` +
-                    `  defect in this emitter.\n`
-                : ''));
-        process.exit(failed.length > 0 ? 1 : 0);
+            `  executed-pass ${derived.totals.executedPass} / executed-fail ${derived.totals.executedFail} / skipped ${derived.totals.skipped} / inapplicable ${derived.totals.inapplicable} / blocked ${derived.totals.blocked}\n` +
+            (derived.ledgerPresent
+                ? `  dispositions come from the RFC 0148 §A ledger (${ledgerEntries.length} entries recorded by the scenarios)\n`
+                : `  NOTE: no ledger was recorded — every skipped file is 'blocked' (unclassifiable), which is the honest reading\n`) +
+            (derived.totals.blocked > 0 ? `  a bundle with blocked > 0 does NOT certify — that is the state of the evidence, not a defect in this emitter\n` : '') +
+            derived.verdicts.map((v) => `  ${v.profile}: ${v.runtimeDerived && !v.held ? `not held (runtime-derived — dropped from claimedProfiles; floor rows not witnessed passes: ${v.blocking.join(', ')})` : v.certifiable ? 'certifiable' : 'NOT certifiable'}${v.unclassified.length > 0 ? ` (unclassified: ${v.unclassified.length})` : ''}\n`).join(''));
+        process.exit(rejectedProfiles.length > 0 ? 3 : failed.length > 0 ? 1 : 0);
     }
     // (e) Validate against the bundle schema BEFORE writing.
     const schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'conformance-certification-bundle.schema.json'), 'utf8'));
     const ajv = new Ajv2020({ allErrors: true, strict: false });
     addFormats(ajv);
     const validate = ajv.compile(schema);
-    if (!validate(bundle)) {
+    const bundleScrub = scrubEvidence(bundle, evidenceSecretsFromEnv(process.env, [apiKey]));
+    if (bundleScrub.redactedAt.length > 0) {
+        process.stderr.write(`openwop-conformance --certify: REDACTED ${bundleScrub.redactedAt.length} evidence field(s) that carried a configured secret or the conformance canary\n`);
+    }
+    const bundleOut = bundleScrub.value;
+    if (!validate(bundleOut)) {
         process.stderr.write('openwop-conformance --certify: assembled bundle FAILED schema validation:\n' +
             `${JSON.stringify(validate.errors, null, 2)}\n`);
         process.exit(2);
     }
-    writeFileSync(outPath, `${JSON.stringify(bundle, null, 2)}\n`);
+    writeFileSync(outPath, `${JSON.stringify(bundleOut, null, 2)}\n`);
     process.stdout.write(`openwop-conformance --certify: wrote certification bundle to ${outPath}\n` +
         `  host: ${host.name}@${host.version}\n` +
         `  claimedProfiles: ${claimedProfiles.length > 0 ? claimedProfiles.join(', ') : '(none)'}\n` +
         `  results: ${passed.length} passed / ${failed.length} failed / ${skipped.length} skipped\n`);
     // Exit code mirrors the suite outcome: a failing run still produces a bundle
-    // (the failures are recorded), but the process exit reflects pass/fail.
-    process.exit(failed.length > 0 ? 1 : 0);
+    // (the failures are recorded), but the process exit reflects pass/fail — and
+    // 3 when a claimed profile has unclassified floor requirements (RFC 0148 §A;
+    // v1 bundles cannot express the distinction, so the exit code carries it).
+    process.exit(rejectedProfiles.length > 0 ? 3 : failed.length > 0 ? 1 : 0);
 }
 async function main() {
     const args = parseArgs(process.argv.slice(2));

package/dist/lib/certification-bundle-verify.js

@@ -0,0 +1,274 @@
+/**
+ * RFC 0148 §A/§C — consumer-side verification of a certification bundle v2,
+ * and the evidence scrubber the emitter runs before a bundle is written.
+ *
+ * `verifyBundle()` in `profiles.ts` reads bundle v1 (`results.passed` lists).
+ * v2 replaced the lists with per-requirement dispositions, and a v2 consumer
+ * MUST re-derive from those rows rather than trust `claimedProfiles` — RFC
+ * 0089 §B still binds, and RFC 0148 adds what v1 could not say:
+ *
+ *   - a required row that is MISSING is an unwitnessed requirement — the bundle
+ *     is REJECTED as evidence, not merely "not certified";
+ *   - an `executed-pass` with `assertionCount: 0` (or with no count at all) is
+ *     a witness of nothing — REJECTED;
+ *   - two rows for one requirement is exactly-one-disposition-per-requirement
+ *     broken — REJECTED;
+ *   - totals that disagree with the rows they summarize are a tampered or
+ *     hand-edited witness — REJECTED;
+ *   - the conformance secret canary anywhere in the document is evidence that
+ *     leaked a secret — REJECTED (`threat-model-secret-leakage.md` §SR-1);
+ *   - a required row that is honestly `blocked` or `executed-fail` is VALID
+ *     evidence of a claim that does NOT certify. That is the state of the
+ *     host, not a defect in the bundle, and the two verdicts are kept apart.
+ *
+ * Server-free; no I/O.
+ */
+import { createHash } from 'node:crypto';
+import { PROFILE_FLOOR_SCENARIOS, profileDerivable, } from './profiles.js';
+import { CERTIFIABLE, DISPOSITIONS } from './requirement-ledger.js';
+import { floorFilesFor, requirementIdForPrefix, requirementIdForScenario } from './requirement-registry.js';
+import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
+/**
+ * The BYOK conformance canary (`fixtures.md` §conformance-secrets-roundtrip;
+ * SR-1). Its raw value MUST NOT appear on any observable channel — variables,
+ * events, debug bundles, logs — and a certification bundle is one more
+ * observable channel. A verifier can check for THIS literal without knowing
+ * any operator secret, which is why it is the one canary the verifier binds.
+ */
+export const CONFORMANCE_SECRET_CANARY = 'openwop-conformance-canary-secret';
+const scenarioBasename = (id) => id.split('/').pop() ?? id;
+/** Walk every string in a JSON value. */
+function* strings(value, path = '$') {
+    if (typeof value === 'string') {
+        yield { path, value };
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i += 1)
+            yield* strings(value[i], `${path}[${i}]`);
+        return;
+    }
+    if (value !== null && typeof value === 'object') {
+        for (const [k, v] of Object.entries(value)) {
+            yield { path: `${path}.${k}`, value: k };
+            yield* strings(v, `${path}.${k}`);
+        }
+    }
+}
+/** Where (JSON paths) a literal appears anywhere in the value — keys included. */
+export function findLiteral(value, literal) {
+    const hits = [];
+    if (literal === '')
+        return hits;
+    for (const s of strings(value))
+        if (s.value.includes(literal))
+            hits.push(s.path);
+    return hits;
+}
+/**
+ * Required requirement ids for a claimed profile, derived from the SAME floor
+ * map the emitter uses. For a `requiredAnyPrefix` entry the requirement is
+ * satisfied by any row whose scenario matches the prefix; the id recorded for
+ * it is the prefix requirement id, and the rows that satisfy it are the
+ * matching scenario rows.
+ */
+function requiredFor(profile, document) {
+    const floor = PROFILE_FLOOR_SCENARIOS[profile];
+    if (floor === undefined)
+        return null;
+    // Discovery-conditional floors (G7) are evaluated against the bundle's own
+    // captured document — the same evidence the claim was derived from.
+    const files = floorFilesFor(profile, document);
+    if (files === null)
+        return null;
+    return {
+        files: [...files],
+        prefixes: [...(floor.requiredAnyPrefix ?? [])],
+        discoveryOnly: floor.discoveryOnly === true,
+    };
+}
+function isWitnessedPass(row) {
+    return row.disposition === 'executed-pass' && typeof row.assertionCount === 'number' && row.assertionCount > 0;
+}
+/**
+ * The emitter's own RFC 0148 §A resolution of a zero-assertion file that noted
+ * no reason: recorded `blocked` with a fixed marker detail. Honest as a row;
+ * for a REQUIRED requirement it is still an unclassified return, and a claim
+ * carrying it is rejected exactly as a vacuous pass would be.
+ */
+function isUnclassifiedReturn(row) {
+    return row.disposition === 'blocked' && row.detail === UNCLASSIFIED_RETURN_DETAIL;
+}
+/**
+ * Verify a v2 bundle. Pure; the caller validates against
+ * `certification-bundle-v2.schema.json` separately (this function tolerates a
+ * schema-invalid document and reports what it can).
+ */
+export function verifyBundleV2(bundle) {
+    const rejections = [];
+    if (bundle.bundleVersion !== '2') {
+        rejections.push({ kind: 'not-v2', detail: `bundleVersion is ${JSON.stringify(bundle.bundleVersion)}, expected "2"` });
+    }
+    const rows = bundle.results?.requirements ?? [];
+    const byId = new Map();
+    for (const r of rows) {
+        if (!DISPOSITIONS.includes(r.disposition)) {
+            rejections.push({ kind: 'unknown-disposition', requirementId: r.requirementId, detail: `${r.requirementId}: disposition ${JSON.stringify(r.disposition)} is not one of the five RFC 0148 §A names` });
+        }
+        if (r.disposition !== 'executed-pass' && (r.detail === undefined || r.detail.trim() === '')) {
+            rejections.push({ kind: 'reason-missing', requirementId: r.requirementId, detail: `${r.requirementId}: '${r.disposition}' recorded without a reason (RFC 0148 §A)` });
+        }
+        const arr = byId.get(r.requirementId) ?? [];
+        arr.push(r);
+        byId.set(r.requirementId, arr);
+    }
+    for (const [id, arr] of byId) {
+        if (arr.length > 1)
+            rejections.push({ kind: 'duplicate-requirement', requirementId: id, detail: `${id}: ${arr.length} rows — exactly one disposition per requirement per run (RFC 0148 §A)` });
+    }
+    // Totals MUST summarize the rows. A hand-edited total is a tampered witness.
+    const count = (d) => rows.filter((r) => r.disposition === d).length;
+    const t = bundle.results?.totals;
+    if (t !== undefined) {
+        const expected = { executedPass: count('executed-pass'), executedFail: count('executed-fail'), skipped: count('skipped'), inapplicable: count('inapplicable'), blocked: count('blocked') };
+        for (const k of Object.keys(expected)) {
+            if (t[k] !== expected[k])
+                rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(t[k])} but the rows count ${expected[k]}` });
+        }
+    }
+    // The canary MUST NOT be anywhere in evidence — keys included.
+    for (const p of findLiteral(bundle, CONFORMANCE_SECRET_CANARY)) {
+        rejections.push({ kind: 'secret-canary', detail: `conformance secret canary present at ${p} — evidence leaked a secret (SR-1)` });
+    }
+    const profiles = (bundle.claimedProfiles ?? []).map((profile) => {
+        const derivable = profileDerivable(bundle.discovery?.document ?? {}, profile);
+        const req = requiredFor(profile, (bundle.discovery?.document ?? {}));
+        if (req === null) {
+            return { profile, derivable, floorUnspecified: true, required: [], rejections: [], notCertifiable: [], evidenceValid: true, certified: false };
+        }
+        const required = [];
+        const profileRejections = [];
+        const notCertifiable = [];
+        for (const file of req.files) {
+            const id = requirementIdForScenario(scenarioBasename(file));
+            required.push(id);
+            const arr = byId.get(id) ?? [];
+            const row = arr[0];
+            if (row === undefined) {
+                profileRejections.push({ kind: 'unwitnessed-requirement', profile, requirementId: id, detail: `${id}: no row — an unwitnessed floor requirement (RFC 0148 §A resolves it to blocked; a claim carrying it is rejected)` });
+                continue;
+            }
+            if (row.disposition === 'executed-pass' && !isWitnessedPass(row)) {
+                profileRejections.push({ kind: 'vacuous-pass', profile, requirementId: id, detail: `${id}: executed-pass with assertionCount ${String(row.assertionCount)} — a witness of nothing` });
+                continue;
+            }
+            if (isUnclassifiedReturn(row)) {
+                profileRejections.push({ kind: 'unwitnessed-requirement', profile, requirementId: id, detail: `${id}: every test returned early with zero assertions and no recorded reason — an unclassified return the emitter resolved to blocked (RFC 0148 §A); a claim carrying it is rejected` });
+                continue;
+            }
+            if (!CERTIFIABLE.includes(row.disposition))
+                notCertifiable.push(id);
+        }
+        for (const prefix of req.prefixes) {
+            const id = requirementIdForPrefix(prefix);
+            required.push(id);
+            // Satisfied by the rows of matching scenarios; the emitter also writes a
+            // summary row under the prefix id. Either form is accepted; the rule is
+            // the same — every matching row witnessed, at least one present.
+            const matching = rows.filter((r) => scenarioBasename(r.scenarioId).startsWith(prefix) && r.requirementId !== id);
+            const summary = byId.get(id)?.[0];
+            if (matching.length === 0 && summary === undefined) {
+                profileRejections.push({ kind: 'unwitnessed-requirement', profile, requirementId: id, detail: `${id}: no scenario matching '${prefix}' recorded a row` });
+                continue;
+            }
+            const considered = matching.length > 0 ? matching : [summary];
+            const vacuous = considered.filter((r) => (r.disposition === 'executed-pass' && !isWitnessedPass(r)) || isUnclassifiedReturn(r));
+            if (vacuous.length > 0) {
+                profileRejections.push({ kind: 'vacuous-pass', profile, requirementId: id, detail: `${id}: ${vacuous.map((r) => r.scenarioId).join(', ')} executed-pass with no witnessed assertion` });
+                continue;
+            }
+            // `requiredAnyPrefix`: ANY witnessed pass among the matching scenarios
+            // satisfies the requirement (the emitter's summary row says the same).
+            if (!considered.some((r) => isWitnessedPass(r)))
+                notCertifiable.push(id);
+        }
+        const evidenceValid = profileRejections.length === 0;
+        const certified = derivable && evidenceValid && notCertifiable.length === 0 && (req.discoveryOnly || required.length > 0);
+        return { profile, derivable, floorUnspecified: false, required, rejections: profileRejections, notCertifiable, evidenceValid, certified };
+    });
+    const evidenceValid = rejections.length === 0 && profiles.every((p) => p.evidenceValid);
+    const certified = evidenceValid && profiles.length > 0 && profiles.every((p) => p.certified);
+    return { evidenceValid, certified, rejections, profiles };
+}
+/* ────────────────────────────────────────────────────────────────────────── */
+/**
+ * Replacement for a scrubbed secret: a stable, non-reversible marker that
+ * still lets two occurrences of the same secret be recognized as the same.
+ */
+export function redactionMarker(secret) {
+    return `«redacted:${createHash('sha256').update(secret).digest('hex').slice(0, 12)}»`;
+}
+/**
+ * Replace every occurrence of every secret in every string of `value` (keys
+ * included) with `redactionMarker(secret)`. Empty / whitespace-only secrets
+ * are ignored — scrubbing "" would blank every string. The emitter runs this
+ * over the finished bundle with the credentials it was given plus the
+ * conformance canary; RFC 0148 §C says secret canaries never enter evidence,
+ * and the only way to make that true regardless of what a scenario put in a
+ * `detail` string is to scrub the document, not to trust the scenarios.
+ */
+export function scrubEvidence(value, secrets) {
+    const live = [...new Set(secrets.filter((s) => typeof s === 'string' && s.trim() !== ''))].sort((a, b) => b.length - a.length);
+    const redactedAt = [];
+    if (live.length === 0)
+        return { value, redactedAt };
+    const scrubString = (s, path) => {
+        let out = s;
+        let hit = false;
+        for (const secret of live) {
+            if (out.includes(secret)) {
+                out = out.split(secret).join(redactionMarker(secret));
+                hit = true;
+            }
+        }
+        if (hit)
+            redactedAt.push(path);
+        return out;
+    };
+    const walk = (v, path) => {
+        if (typeof v === 'string')
+            return scrubString(v, path);
+        if (Array.isArray(v))
+            return v.map((x, i) => walk(x, `${path}[${i}]`));
+        if (v !== null && typeof v === 'object') {
+            const out = {};
+            for (const [k, x] of Object.entries(v)) {
+                out[scrubString(k, `${path}.${k}`)] = walk(x, `${path}.${k}`);
+            }
+            return out;
+        }
+        return v;
+    };
+    return { value: walk(value, '$'), redactedAt };
+}
+/**
+ * The secrets a `--certify` run must keep out of its own evidence: the
+ * credential it was handed, plus every `OPENWOP_*` environment value that
+ * names a key/token/secret/password, plus the conformance canary.
+ */
+export function evidenceSecretsFromEnv(env, extra = []) {
+    const out = new Set();
+    for (const [k, v] of Object.entries(env)) {
+        if (!k.startsWith('OPENWOP_'))
+            continue;
+        if (!/(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/.test(k))
+            continue;
+        if (v !== undefined && v.trim() !== '')
+            out.add(v);
+    }
+    for (const s of extra)
+        if (s !== undefined && s.trim() !== '')
+            out.add(s);
+    out.add(CONFORMANCE_SECRET_CANARY);
+    return [...out];
+}