@openwop/openwop-conformance 1.125.0 → 1.128.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.125.0",
+  "version": "1.128.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.125.0",
-  "corpusCommit": "13ab2a545d4e2a30c8da66354e39d4db7233acae"
+  "suiteVersion": "1.128.0",
+  "corpusCommit": "04f59e91eb096ce1782b16722599a9d2cfa7aae1"
 }

package/schemas/workload-identity.schema.json

@@ -52,7 +52,13 @@
             "required": ["subject"],
             "properties": {
               "subject": { "type": "string", "minLength": 1 },
-              "issuer": { "type": "string", "minLength": 1 }
+              "issuer": { "type": "string", "minLength": 1 },
+              "scopes": {
+                "type": "array",
+                "uniqueItems": true,
+                "items": { "type": "string", "minLength": 1 },
+                "description": "RFC 0154 §B — the effective scopes VERIFIED for this hop from its proof (RFC 0049 scope grammar). OPTIONAL and provenance, not authorization: the host still evaluates the resolved principal's own scopes. When present on consecutive hops, a later hop's scopes MUST NOT exceed the previous hop's (`auth.md` §\"Bounds\" — scope amplification is refused: `delegation_scope_amplified`)."
+              }
             }
           }
         },

package/src/scenarios/a2a-1-0-task-roundtrip.test.ts

@@ -53,7 +53,9 @@ async function claims10(): Promise<boolean> {
 async function jsonrpc10Url(): Promise<string | null> {
   const caps = await a2a();
   if (typeof caps?.agentCardUrl !== 'string') return null;
-  const res = await fetch(caps.agentCardUrl, { headers: { accept: 'application/json' } });
+  // S18 (#1028): a header-less card GET returns the 0.3 shape while `a2a-0.3-legacy`
+  // is advertised; a 1.0 client asks for the 1.0 card explicitly (a2a-integration.md §C).
+  const res = await fetch(caps.agentCardUrl, { headers: { accept: 'application/json', 'A2A-Version': '1.0' } });
   if (res.status !== 200) return null;
   const card = (await res.json()) as { supportedInterfaces?: Array<{ url?: string; protocolBinding?: string; protocolVersion?: string }> };
   const iface = (card.supportedInterfaces ?? []).find((i) => i.protocolBinding === 'JSONRPC' && i.protocolVersion === '1.0');

package/src/scenarios/capability-example-root-layout.test.ts

@@ -21,6 +21,27 @@
  * otherwise legal unknown server-emitted property, and nothing here reads a
  * host.
  *
+ * **Canonical-typo leg (RFC 0149 §B, second bullet; UQ2 decided 2026-08-16).** A
+ * root key within edit distance ONE of a canonical family, in a discovery-shaped
+ * example, that is not itself canonical and not vendor-namespaced, is a typo
+ * (`compensaton`, `interupts`) — an implementer copying it advertises nothing.
+ * UQ2 asked what rule avoids false positives on legitimate extension names; the
+ * answer was measured, not guessed. Over every fenced root object in `spec/v1` +
+ * `RFCS/` (218 on 2026-08-16), plain distance-one produced six near-misses —
+ * `ts`/`fs`, `agent`/`agents`, `secret`/`secrets`, `context`/`content`,
+ * `prompt`/`prompts`, `schemaVersion`/`schemaVersions` — every one of them a key
+ * of an EVENT or RUN object, not a discovery document. So the predicate is
+ * *discovery-shaped*: every root key is canonical, vendor-namespaced
+ * (`host-extensions.md` §"Canonical prefixes"), the legacy `capabilities`
+ * wrapper, or within distance one of a canonical family — and at least one key
+ * is canonical-or-near. That excludes events (`ts`/`type`/`payload` are none of
+ * those) while still catching a typo-only snippet whose single key is misspelt.
+ * Scope: `spec/v1` and RFCs numbered >= 0149 (the rule's own RFC); older RFCs
+ * are the dated record, on the same boundary logic as the wrapper leg's 0073.
+ * Under that predicate and scope the corpus measured 53 discovery-shaped
+ * objects and 0 findings; the one out-of-scope near-miss is RFC 0109's
+ * `{ "agent": … }` payload fragment.
+ *
  * `spec/v1/` and `RFCS/` ship in the repository, NOT in the published tarball,
  * so this self-skips under the published layout. That asymmetry has produced
  * three defects in this corpus — the `CORPUS-STAMP` gate, the link-checker's
@@ -66,6 +87,97 @@ function fencedExamples(dir: string): FencedExample[] {
   return found;
 }
 
+/** RFC 0149 introduced the typo lint; examples in earlier RFCs are historical record. */
+const TYPO_LINT_RFC = 149;
+
+const SCHEMA_PATH =
+  V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'schemas', 'capabilities.schema.json');
+
+/** The canonical families, read from the schema rather than hand-listed. */
+function canonicalFamilies(): Set<string> {
+  if (SCHEMA_PATH === null) return new Set();
+  const schema = JSON.parse(readFileSync(SCHEMA_PATH, 'utf8')) as { properties?: Record<string, unknown> };
+  return new Set(Object.keys(schema.properties ?? {}));
+}
+
+/** `host-extensions.md` §"Canonical prefixes". */
+function isVendorKey(key: string): boolean {
+  return /^x-host-/.test(key) || /^(vendor|private)\./.test(key);
+}
+
+/** Levenshtein distance exactly one (one substitution, insertion, or deletion). */
+export function withinOne(a: string, b: string): boolean {
+  if (a === b) return false;
+  if (Math.abs(a.length - b.length) > 1) return false;
+  if (a.length === b.length) {
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) if (a[i] !== b[i] && ++diff > 1) return false;
+    return diff === 1;
+  }
+  const [short, long] = a.length < b.length ? [a, b] : [b, a];
+  let i = 0;
+  let j = 0;
+  let skipped = false;
+  while (i < short.length && j < long.length) {
+    if (short[i] === long[j]) {
+      i++;
+      j++;
+    } else if (skipped) {
+      return false;
+    } else {
+      skipped = true;
+      j++;
+    }
+  }
+  return true;
+}
+
+export interface TypoFinding {
+  readonly key: string;
+  readonly near: readonly string[];
+}
+
+/**
+ * The UQ2 rule. Returns the near-miss root keys of a DISCOVERY-SHAPED object, or
+ * `null` when the object is not discovery-shaped (and so is out of scope: an
+ * event, a run body, a manifest). Exported so the predicate is pinned below.
+ */
+export function canonicalTypos(value: unknown, families: Set<string>): TypoFinding[] | null {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return null;
+  const keys = Object.keys(value as Record<string, unknown>);
+  if (keys.length === 0) return null;
+  const near = new Map<string, string[]>();
+  for (const k of keys) {
+    if (families.has(k) || isVendorKey(k) || k === 'capabilities') continue;
+    const n = [...families].filter((f) => withinOne(k, f));
+    if (n.length === 0) return null; // a key that is none of the four kinds ⇒ not discovery-shaped
+    near.set(k, n);
+  }
+  if (!keys.some((k) => families.has(k) || near.has(k))) return null;
+  return [...near.entries()].map(([key, n]) => ({ key, near: n }));
+}
+
+/** Every parseable fenced json/jsonc root object under `dir`, with its source line. */
+function fencedObjects(dir: string): { file: string; line: number; value: unknown }[] {
+  const out: { file: string; line: number; value: unknown }[] = [];
+  for (const name of readdirSync(dir).filter((f) => f.endsWith('.md')).sort()) {
+    const lines = readFileSync(join(dir, name), 'utf8').split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      if (!/^```(json|jsonc)\s*$/.test(lines[i]!.trim())) continue;
+      const body: string[] = [];
+      let j = i + 1;
+      while (j < lines.length && lines[j]!.trim() !== '```') body.push(lines[j++]!);
+      try {
+        out.push({ file: name, line: i + 2, value: JSON.parse(body.join('\n')) });
+      } catch {
+        // Unparseable blocks are RFC 0150 §D's problem, not this gate's.
+      }
+      i = j;
+    }
+  }
+  return out;
+}
+
 describe.skipIf(V1_DIR === null)('RFC 0149 §B — discovery examples use the document-root layout', () => {
   const v1Dir = V1_DIR as string;
 
@@ -110,4 +222,51 @@ describe.skipIf(V1_DIR === null)('RFC 0149 §B — discovery examples use the do
         late.join('\n  '),
     ).toEqual([]);
   });
+  it('the UQ2 predicate is pinned: a typo-only snippet is flagged, an event object is out of scope, a vendor key is exempt', () => {
+    const fams = new Set(['compensation', 'interrupts', 'fs', 'agents', 'content']);
+    // A misspelt single-key discovery snippet: all keys near-canonical ⇒ in scope, flagged.
+    expect(canonicalTypos({ compensaton: { supported: true } }, fams)).toEqual([{ key: 'compensaton', near: ['compensation'] }]);
+    // Canonical + a typo ⇒ flagged.
+    expect(canonicalTypos({ compensation: {}, interupts: {} }, fams)).toEqual([{ key: 'interupts', near: ['interrupts'] }]);
+    // An event: `ts` is one from `fs` but `type`/`payload` are none of the four kinds ⇒ not discovery-shaped.
+    expect(canonicalTypos({ ts: 1, type: 'x', payload: {} }, fams)).toBeNull();
+    // Vendor-namespaced keys are exempt (RFC 0149 §B) and the legacy wrapper is the wrapper leg's business.
+    expect(canonicalTypos({ compensation: {}, 'x-host-acme-agent': {} }, fams)).toEqual([]);
+    expect(canonicalTypos({ capabilities: {} }, fams)).toBeNull();
+    // Distance exactly one, both directions.
+    expect(withinOne('agent', 'agents')).toBe(true);
+    expect(withinOne('agents', 'agent')).toBe(true);
+    expect(withinOne('agent', 'agentz')).toBe(true);
+    expect(withinOne('agent', 'agenzs')).toBe(false);
+    expect(withinOne('agents', 'agents')).toBe(false);
+  });
+
+  it('no discovery-shaped example in spec/v1 or a post-0149 RFC has a root key within one edit of a canonical family', () => {
+    const families = canonicalFamilies();
+    expect(families.size, 'capabilities.schema.json MUST declare families').toBeGreaterThan(50);
+    const findings: string[] = [];
+    let shaped = 0;
+    const scan = (dir: string, rel: string, minRfc: number | null): void => {
+      for (const { file, line, value } of fencedObjects(dir)) {
+        if (minRfc !== null) {
+          const n = Number.parseInt(file.slice(0, 4), 10);
+          if (!Number.isFinite(n) || n < minRfc) continue;
+        }
+        const typos = canonicalTypos(value, families);
+        if (typos === null) continue;
+        shaped++;
+        for (const t of typos) findings.push(`${rel}/${file}:${line} → \`${t.key}\` (did you mean ${t.near.map((x) => '`' + x + '`').join(' / ')}?)`);
+      }
+    };
+    scan(v1Dir, 'spec/v1', null);
+    if (RFCS_DIR !== null && existsSync(RFCS_DIR)) scan(RFCS_DIR, 'RFCS', TYPO_LINT_RFC);
+    expect(shaped, 'the scan MUST find discovery-shaped examples, or the leg is vacuous').toBeGreaterThan(20);
+    expect(
+      findings,
+      'RFC 0149 §B: a root key within one edit of a canonical family, in a discovery-shaped example, is a ' +
+        'typo — an implementer copying it advertises nothing. Vendor surface goes under `x-host-*` / ' +
+        '`vendor.*` / `private.*` (host-extensions.md).\n  ' +
+        findings.join('\n  '),
+    ).toEqual([]);
+  });
 });

package/src/scenarios/core-manifest-and-extension-registry.test.ts

@@ -24,7 +24,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { V1_DIR } from '../lib/paths.js';
 import { PROFILE_FLOOR_SCENARIOS } from '../lib/profiles.js';
@@ -36,7 +36,7 @@ type Maturity = (typeof MATURITIES)[number];
 interface Extension {
   readonly id: string;
   readonly maturity: Maturity;
-  readonly owningRfc: string;
+  readonly owningRfc: string | null;
   readonly capabilityPath: string;
   readonly dependsOn: readonly string[];
   readonly securityTier: string;
@@ -190,35 +190,61 @@ describe.skipIf(V1_DIR === null)('RFC 0155 §C — extension registry', () => {
     // either a core predicate field, covered by a record's capabilityPath, or
     // listed as uncovered — and nothing is in two buckets.
     const reg = registry as unknown as {
-      coverage?: { familiesTotal: number; coreFields: string[]; covered: string[]; uncovered: string[] };
+      coverage?: {
+        familiesTotal: number;
+        coreFields: string[];
+        metadataFields?: string[];
+        metadataRationale?: Record<string, string>;
+        covered: string[];
+        uncovered: string[];
+      };
       extensions: Extension[];
     };
     expect(reg.coverage, 'RFC 0155 §C: the registry MUST carry a derived `coverage` block').toBeDefined();
     const cov = reg.coverage as NonNullable<typeof reg.coverage>;
+    const metadata = cov.metadataFields ?? [];
     const families = Object.keys((caps().properties as Record<string, unknown>) ?? {}).sort();
     expect(cov.familiesTotal).toBe(families.length);
-    const all = [...cov.coreFields, ...cov.covered, ...cov.uncovered].sort();
-    expect(all, 'core + covered + uncovered MUST partition the family set exactly').toEqual(families);
+    const all = [...cov.coreFields, ...metadata, ...cov.covered, ...cov.uncovered].sort();
+    expect(all, 'core + metadata + covered + uncovered MUST partition the family set exactly').toEqual(families);
     expect(new Set(all).size, 'no family may sit in two buckets').toBe(all.length);
     const reached = new Set(reg.extensions.map((e) => e.capabilityPath.split('.')[0]));
     for (const f of cov.covered) expect(reached.has(f), `${f} listed as covered MUST be reached by a record`).toBe(true);
     for (const f of cov.uncovered) expect(reached.has(f), `${f} listed as uncovered MUST NOT be reached by a record`).toBe(false);
+    // Metadata is the one bucket a family can be moved INTO by hand, so it is
+    // the one that could hide an extension: every entry MUST carry a stated
+    // rationale, and no metadata key may carry a `supported` flag — a key that
+    // gates behaviour is a family, not a description of the document.
+    for (const f of metadata) {
+      expect(typeof cov.metadataRationale?.[f], `${f}: a metadata field MUST state why it is not an extension`).toBe('string');
+      const props = (caps().properties as Record<string, { properties?: Record<string, unknown> }>)[f]?.properties ?? {};
+      expect('supported' in props, `${f} is listed as metadata but carries a \`supported\` flag — that is an extension family`).toBe(false);
+    }
     // The honest number, asserted so it cannot silently shrink by deletion of the
     // uncovered list rather than by adding records.
-    expect(cov.uncovered.length + cov.covered.length + cov.coreFields.length).toBe(families.length);
+    expect(cov.uncovered.length + cov.covered.length + cov.coreFields.length + metadata.length).toBe(families.length);
   });
 
-  it('every record names the RFC that owns it', () => {
+  it('every record names the RFC — or, for a v1 base advertisement, the spec document — that owns it', () => {
     // Vendor extensions may not use an `openwop-*` id without an accepted RFC
-    // (§F). The owning RFC is what makes that checkable.
+    // (§F). The owning RFC is what makes that checkable. Six advertisements
+    // predate the RFC process (they shipped in the v1 base corpus: `secrets`,
+    // `webhooks`, `i18n`, `aiProviders`, `envelopeContracts`, `envelopeStrictness`);
+    // those carry `owningRfc: null` and an `owningDoc` under spec/v1/ that MUST
+    // exist — the steward's own corpus is the RFC-equivalent authority for them.
     for (const e of (registry as NonNullable<typeof registry>).extensions) {
-      expect(e.owningRfc, `${e.id} MUST name an owning RFC`).toMatch(/^\d{4}$/);
-      if (e.id.startsWith('openwop-')) {
-        expect(
-          e.owningRfc.length,
-          `${e.id}: an \`openwop-*\` id requires an accepted RFC (§F)`,
-        ).toBeGreaterThan(0);
+      const rec = e as Extension & { owningDoc?: string; securityTier?: string };
+      if (rec.owningRfc === null) {
+        expect(typeof rec.owningDoc, `${e.id}: \`owningRfc: null\` requires an \`owningDoc\``).toBe('string');
+        expect(rec.owningDoc, `${e.id}: owningDoc MUST be a spec/v1 document`).toMatch(/^spec\/v1\/[a-z0-9-]+\.md$/);
+        if (V1_DIR !== null) {
+          const file = join(V1_DIR, (rec.owningDoc as string).replace(/^spec\/v1\//, ''));
+          expect(existsSync(file), `${e.id}: owningDoc ${rec.owningDoc} MUST exist`).toBe(true);
+        }
+      } else {
+        expect(e.owningRfc, `${e.id} MUST name an owning RFC`).toMatch(/^\d{4}$/);
       }
+      expect(['high', 'medium', 'low'], `${e.id}: securityTier is a closed enum`).toContain(rec.securityTier);
     }
   });
 });

package/src/scenarios/workload-identity-behavior.test.ts

@@ -167,7 +167,7 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
       ),
     ).toBe(false);
     expect(
-      ['identity_unverified', 'identity_unresolvable', 'audience_mismatch', 'delegation_expired', 'sender_constraint_missing'],
+      ['identity_unverified', 'identity_unresolvable', 'audience_mismatch', 'delegation_expired', 'sender_constraint_missing', 'delegation_chain_too_long', 'delegation_chain_cyclic', 'delegation_scope_amplified'],
       driver.describe('RFCS/0154 §A', 'failures use a closed reason vocabulary'),
     ).toContain(readErrorCode(r.json));
   });

package/src/scenarios/workload-identity-chain-bounds.test.ts

@@ -0,0 +1,141 @@
+/**
+ * RFC 0154 §B "Bounds" — the delegation chain is bounded, acyclic, and cannot
+ * amplify scope hop-to-hop (`auth.md` §"Workload identity and delegated actor
+ * chain" → Bounds; threat model A4 "chain launderer").
+ *
+ * `workload-identity-behavior.test.ts` proves the resolver verifies audience and
+ * expiry. It does not touch the chain's SHAPE as a source of authority, and that
+ * is where laundering lives: a chain that is one hop longer than the host said
+ * it would accept, a chain that loops back through a subject it already passed,
+ * or a chain whose second hop claims a scope its first hop never held. Each is a
+ * verified-looking presentation that a passthrough resolver accepts and a real
+ * one refuses, which is what makes the legs non-vacuous — `resolved: true` on
+ * any of them is the finding.
+ *
+ * All three go through the §20 seam (`host-sample-test-seams.md`) with the
+ * three closed reasons added for them: `delegation_chain_too_long`,
+ * `delegation_chain_cyclic`, `delegation_scope_amplified`. Every leg is gated on
+ * `auth.workloadIdentity.delegation.supported` via `behaviorGate` (a host doing
+ * §A-only identity resolution has not claimed §B) — soft-skips without it,
+ * HARD-FAILS under `OPENWOP_REQUIRE_BEHAVIOR=true`, and records the RFC 0148 §A
+ * disposition either way. A seam that answers 404/403 is `blocked`, not a pass.
+ *
+ * Per-hop `scopes` on the wire are OPTIONAL (`workload-identity.schema.json`,
+ * 2026-08-16); the amplification leg presents them explicitly, so a host that
+ * ignores the field will resolve the chain and fail the leg — which is the
+ * honest outcome, because a host that cannot see hop scopes cannot enforce the
+ * MUST NOT either.
+ *
+ * Registered invariants: `delegation-chain-acyclic`,
+ * `delegation-no-scope-amplification` (`SECURITY/invariants.yaml`), and the
+ * length half of `delegation-chain-bounded`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+
+const DELEGATION_PROFILE = 'openwop-workload-identity-delegation';
+const SEAM = '/v1/host/sample/test/workload-identity/resolve';
+
+interface AuthCaps {
+  readonly workloadIdentity?: {
+    readonly supported?: boolean;
+    readonly delegation?: { readonly supported?: boolean; readonly maxChainDepth?: number };
+  };
+}
+
+async function delegationCaps(): Promise<{ supported: boolean; maxChainDepth: number | null }> {
+  const disco = await driver.get('/.well-known/openwop');
+  const d = capabilityFamily<AuthCaps>(disco.json, 'auth')?.workloadIdentity?.delegation;
+  return {
+    supported: d?.supported === true,
+    maxChainDepth: typeof d?.maxChainDepth === 'number' && Number.isInteger(d.maxChainDepth) && d.maxChainDepth > 0 ? d.maxChainDepth : null,
+  };
+}
+
+async function resolve(body: Record<string, unknown>): Promise<{ status: number; json: unknown } | null> {
+  const r = await driver.post(SEAM, body);
+  if (r.status === 404 || r.status === 403) {
+    seamAbsent(`host advertises \`auth.workloadIdentity.delegation.supported: true\` but ${SEAM} answered ${r.status} — RFC 0154 §B chain bounds are unobservable (host-sample-test-seams.md §20)`);
+    return null;
+  }
+  return { status: r.status, json: r.json };
+}
+
+const IDENTITY = { scheme: 'spiffe', subject: 'spiffe://example/dispatcher', issuer: 'spiffe://example', audience: 'openwop-host' };
+const LIVE = '2099-01-01T00:00:00Z';
+
+function hop(n: number, scopes?: readonly string[]): Record<string, unknown> {
+  const h: Record<string, unknown> = { subject: `spiffe://example/hop-${n}`, issuer: 'spiffe://example' };
+  if (scopes !== undefined) h['scopes'] = [...scopes];
+  return h;
+}
+
+/** A refusal: 4xx, non-retriable, the named closed reason. */
+function expectRefusal(r: { status: number; json: unknown }, reason: string, why: string): void {
+  expect(r.status >= 400, driver.describe('RFCS/0154 §B', why)).toBe(true);
+  expect(readErrorCode(r.json), driver.describe('spec/v1/host-sample-test-seams.md §20', `closed reason \`${reason}\``)).toBe(reason);
+  expect(readRetriable(r.json), driver.describe('spec/v1/host-sample-test-seams.md §20', 'a chain the host refuses will be refused on retry')).toBe(false);
+}
+
+describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)', () => {
+  it('a chain longer than the advertised maxChainDepth is refused', async () => {
+    const caps = await delegationCaps();
+    if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
+    expect(
+      caps.maxChainDepth,
+      driver.describe('spec/v1/auth.md §Bounds', 'a host advertising delegation MUST advertise a positive integer `maxChainDepth`'),
+    ).not.toBeNull();
+    const depth = caps.maxChainDepth as number;
+    const chain = Array.from({ length: depth + 1 }, (_, i) => hop(i + 1));
+    const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
+    if (r === null) return;
+    expectRefusal(r, 'delegation_chain_too_long', `a chain of ${depth + 1} hops exceeds the advertised bound of ${depth} — each hop is another party the host trusts transitively`);
+  });
+
+  it('a chain that revisits a subject is refused as cyclic', async () => {
+    const caps = await delegationCaps();
+    if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
+    // Two distinct hops then the first subject again: length 3, so on any
+    // host with maxChainDepth >= 3 the ONLY reason to refuse it is the cycle.
+    // On a host with maxChainDepth < 3 the too-long leg already covers refusal
+    // and this leg accepts either reason, saying so.
+    const chain = [hop(1), hop(2), hop(1)];
+    const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
+    if (r === null) return;
+    const bound = caps.maxChainDepth ?? Number.POSITIVE_INFINITY;
+    if (bound < 3) {
+      expect(r.status >= 400, driver.describe('RFCS/0154 §B', 'a cyclic chain is refused')).toBe(true);
+      expect(['delegation_chain_cyclic', 'delegation_chain_too_long'], driver.describe('spec/v1/host-sample-test-seams.md §20', 'cyclic or too-long — the bound is below the cycle length')).toContain(readErrorCode(r.json));
+      expect(readRetriable(r.json)).toBe(false);
+      return;
+    }
+    expectRefusal(r, 'delegation_chain_cyclic', 'a subject appearing twice is a chain that loops back through authority it already spent — unbounded laundering with a bounded length');
+  });
+
+  it('a later hop claiming a scope the previous hop did not hold is refused', async () => {
+    const caps = await delegationCaps();
+    if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
+    const chain = [hop(1, ['runs:read']), hop(2, ['runs:read', 'runs:write'])];
+    const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
+    if (r === null) return;
+    expectRefusal(r, 'delegation_scope_amplified', 'the effective scopes at any hop MUST NOT exceed the hop before it — a chain is provenance, and provenance cannot mint `runs:write` from `runs:read`');
+  });
+
+  it('a well-formed bounded, acyclic, non-amplifying chain still resolves (the negatives are not a blanket refusal)', async () => {
+    const caps = await delegationCaps();
+    if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
+    const chain = [hop(1, ['runs:read', 'manifest:read']), hop(2, ['runs:read'])];
+    const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
+    if (r === null) return;
+    // A host that refuses EVERY chain passes the three negatives vacuously; this
+    // is the positive that keeps them honest. Scopes narrow hop-to-hop, which
+    // is the one direction §B permits.
+    expect(r.status, driver.describe('RFCS/0154 §B', 'a compliant chain resolves; the bounds refuse laundering, not delegation')).toBe(200);
+    expect((r.json as { resolved?: unknown }).resolved).toBe(true);
+  });
+});

package/src/scenarios/workload-identity-profile.test.ts

@@ -151,6 +151,15 @@ describe('RFC 0154 §B — delegated actor chain', () => {
   it('a chain hop cannot carry extra fields', () => {
     expect(validate({ ...base, delegation: { chain: [{ subject: 'x', token: 'y' }], audience: 'h' } })).toBe(false);
   });
+
+  it('a chain hop MAY carry its verified scopes, as a set of non-empty strings', () => {
+    // RFC 0154 §B "Bounds": scope amplification is only observable if a hop can
+    // state the scopes its proof carried. Provenance, not authorization.
+    expect(validate({ ...base, delegation: { chain: [{ subject: 'x', scopes: ['runs:read'] }, { subject: 'y', scopes: ['runs:read'] }], audience: 'h' } })).toBe(true);
+    expect(validate({ ...base, delegation: { chain: [{ subject: 'x', scopes: 'runs:read' }], audience: 'h' } })).toBe(false);
+    expect(validate({ ...base, delegation: { chain: [{ subject: 'x', scopes: ['runs:read', 'runs:read'] }], audience: 'h' } })).toBe(false);
+    expect(validate({ ...base, delegation: { chain: [{ subject: 'x', scopes: [''] }], audience: 'h' } })).toBe(false);
+  });
 });
 
 describe.skipIf(RFCS_DIR === null)('RFC 0154 — what this does NOT establish', () => {