@openwop/openwop-conformance 1.127.0 → 1.129.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.127.0",
+  "version": "1.129.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.127.0",
-  "corpusCommit": "5e2aefe837a81b82004c12c308cb1c3973c0233c"
+  "suiteVersion": "1.129.0",
+  "corpusCommit": "edd6a891da09af801b04e750c0219ee7cb401137"
 }

package/schemas/workload-identity.schema.json

@@ -52,7 +52,13 @@
             "required": ["subject"],
             "properties": {
               "subject": { "type": "string", "minLength": 1 },
-              "issuer": { "type": "string", "minLength": 1 }
+              "issuer": { "type": "string", "minLength": 1 },
+              "scopes": {
+                "type": "array",
+                "uniqueItems": true,
+                "items": { "type": "string", "minLength": 1 },
+                "description": "RFC 0154 §B — the effective scopes VERIFIED for this hop from its proof (RFC 0049 scope grammar). OPTIONAL and provenance, not authorization: the host still evaluates the resolved principal's own scopes. When present on consecutive hops, a later hop's scopes MUST NOT exceed the previous hop's (`auth.md` §\"Bounds\" — scope amplification is refused: `delegation_scope_amplified`)."
+              }
             }
           }
         },

package/src/scenarios/compensation-recovery.test.ts

@@ -0,0 +1,195 @@
+/**
+ * RFC 0151 §C / §E / §B+§F — the compensation RECOVERY witness: retry-stable
+ * identity, tenant-bound operator authority, recorded-facts-only inputs.
+ *
+ * `compensation-behavior.test.ts` proves the happy unwind: plan before effect,
+ * reverse order, replay does not re-fire, content-free events, rollup ⇄ events.
+ * RFC 0151 §G names three further invariants that file cannot see, and
+ * `SECURITY/threat-model-compensation.md` §7 said so and named the seam each
+ * one needs. This file is that seam's consumer (`host-sample-test-seams.md` §21
+ * "Recovery extension"):
+ *
+ *   - **`compensation-effect-id-retry-stable`** (§C). `unwind` with
+ *     `failFirstInverseAttempts: 2`: the first inverse action fails twice then
+ *     succeeds. The response's `inverseActions[]` MUST show one entry for that
+ *     ordinal with `attempts: 3` and a SINGLE distinct `downstreamKeys` value —
+ *     one obligation, three attempts, the same idempotency key at the
+ *     downstream every time. Two keys is two refunds.
+ *   - **`compensation-tenant-authority-bound`** (§E). `unwind` with `hold: true`
+ *     leaves a held plan (`compensationStatus: manual`); the `operator` seam is
+ *     then driven three times — a cross-tenant actor (404: RFC 0132 §A.2,
+ *     neutralize, do not reveal), a same-tenant non-operator (403, audited),
+ *     the operator (200, `audited: true`). A seam that answers 200 to all
+ *     three consults nothing.
+ *   - **`compensation-input-recorded-facts-only`** (§B/§F). `replay` reports the
+ *     inverse actions of the source run and of the replay with the input each
+ *     executed with; they MUST deep-equal while `refiredEffects` stays 0. An
+ *     inverse built from a re-derived value is not the inverse of what was
+ *     done, and replay is where re-derivation would happen.
+ *
+ * Every leg is capability-gated on `compensation.supported` via `behaviorGate`
+ * (soft-skips without the advert, HARD-FAILS under `OPENWOP_REQUIRE_BEHAVIOR=true`)
+ * and records its RFC 0148 §A disposition. The three sub-features are
+ * INDEPENDENTLY optional: a host that wires the base seams but not this
+ * extension is `blocked` here (named as such via `seamAbsent`) and keeps its
+ * `compensation-behavior` witness — the base and the extension are different
+ * claims and are recorded separately.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
+
+const PROFILE = 'openwop-compensation';
+const UNWIND = '/v1/host/sample/test/compensation/unwind';
+const REPLAY = '/v1/host/sample/test/compensation/replay';
+const OPERATOR = '/v1/host/sample/test/compensation/operator';
+
+interface InverseAction {
+  readonly ordinal?: number;
+  readonly effectId?: string;
+  readonly attempts?: number;
+  readonly outcome?: string;
+  readonly downstreamKeys?: readonly string[];
+  readonly input?: unknown;
+}
+
+interface UnwindResponse {
+  readonly runId?: string;
+  readonly events?: ReadonlyArray<{ type?: string; payload?: Record<string, unknown> }>;
+  readonly compensatedOrder?: readonly number[];
+  readonly inverseActions?: readonly InverseAction[];
+}
+
+interface ReplayResponse {
+  readonly runId?: string;
+  readonly refiredEffects?: number;
+  readonly source?: readonly InverseAction[];
+  readonly replayed?: readonly InverseAction[];
+}
+
+async function advertised(): Promise<boolean> {
+  const disco = await driver.get('/.well-known/openwop');
+  return capabilityFamily<{ supported?: boolean }>(disco.json, 'compensation')?.supported === true;
+}
+
+async function post(path: string, body: Record<string, unknown>): Promise<{ status: number; json: unknown } | null> {
+  const r = await driver.post(path, body);
+  if (r.status === 404 && path !== OPERATOR) {
+    seamAbsent(`host advertises \`compensation.supported: true\` but ${path} answered 404 — the RFC 0151 recovery requirements are unobservable (host-sample-test-seams.md §21)`);
+    return null;
+  }
+  return { status: r.status, json: r.json };
+}
+
+/** The recovery extension is optional; a base seam that ignores the new fields is `blocked` here, not failed. */
+function extensionAbsent(what: string): undefined {
+  return seamAbsent(`the §21 recovery extension is not wired: ${what} (host-sample-test-seams.md §21 "Recovery extension") — retry-stability / operator authority / recorded-facts are unobservable`);
+}
+
+describe('RFC 0151 §C — inverse-action identity is retry-stable (capability-gated behavior)', () => {
+  it('a transient inverse failure retries under the SAME identity and the same downstream key', async () => {
+    if (!behaviorGate(PROFILE, await advertised())) return;
+    const r = await post(UNWIND, { nodes: 2, failFirstInverseAttempts: 2 });
+    if (r === null) return;
+    expect(r.status, driver.describe('spec/v1/host-sample-test-seams.md §21', 'unwind seam answers 200')).toBe(200);
+    const body = r.json as UnwindResponse;
+    if (!Array.isArray(body.inverseActions)) return extensionAbsent('`unwind` did not return `inverseActions[]`');
+    // Under reverse-completion the first inverse to run is the highest forward ordinal (2).
+    const first = body.inverseActions.find((a) => a.ordinal === 2) ?? body.inverseActions[0];
+    expect(first, driver.describe('spec/v1/host-sample-test-seams.md §21', 'one entry per plan entry')).toBeDefined();
+    const a = first as InverseAction;
+    expect(a.attempts, driver.describe('RFCS/0151 §C', 'two transient failures then success is THREE attempts of one obligation')).toBe(3);
+    expect(a.outcome, driver.describe('RFCS/0151 §C', 'a transient failure MUST be retryable — the action completes')).toBe('completed');
+    expect(Array.isArray(a.downstreamKeys) ? a.downstreamKeys.length : -1, driver.describe('spec/v1/host-sample-test-seams.md §21', '`downstreamKeys` has one entry per attempt')).toBe(3);
+    const distinct = new Set(a.downstreamKeys ?? []);
+    expect(
+      distinct.size,
+      driver.describe(
+        'RFCS/0151 §C + RFC 0150 §B',
+        'a retry re-presents the SAME inverse-action identity as its idempotency key — a second key at the downstream is a second obligation (two refunds). `attempt` is outside the identity for exactly this reason.',
+      ),
+    ).toBe(1);
+    // One obligation per ordinal: no duplicate plan entries.
+    const ordinals = body.inverseActions.map((x) => x.ordinal);
+    expect(new Set(ordinals).size, driver.describe('RFCS/0151 §C', 'exactly one plan entry per forward ordinal')).toBe(ordinals.length);
+    expect(typeof a.effectId === 'string' && a.effectId.length > 0, driver.describe('RFCS/0151 §D', 'the identity is carried as an opaque `effectId`')).toBe(true);
+  });
+});
+
+describe('RFC 0151 §E — operator authority is bound to the plan\'s tenant (capability-gated behavior)', () => {
+  it('cross-tenant is neutralized (404), same-tenant non-operator is refused and audited (403), the operator acts (200)', async () => {
+    if (!behaviorGate(PROFILE, await advertised())) return;
+    const held = await post(UNWIND, { nodes: 2, hold: true });
+    if (held === null) return;
+    const body = held.json as UnwindResponse;
+    const runId = body.runId;
+    if (typeof runId !== 'string') return extensionAbsent('`unwind` did not return a `runId`');
+    const heldEntry = (body.inverseActions ?? []).find((x) => x.outcome === 'held');
+    const manual = (body.events ?? []).some((e) => e.type === 'compensation.manual_intervention_required');
+    if (heldEntry === undefined && !manual) return extensionAbsent('`unwind` with `hold: true` produced neither a held plan entry nor `compensation.manual_intervention_required`');
+    // Snapshot must read `manual` while held (§D fold).
+    const snap = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
+    expect(snap.status, driver.describe('rest-endpoints.md', 'GET /v1/runs/{runId} for the held run')).toBe(200);
+    expect((snap.json as { compensationStatus?: string }).compensationStatus, driver.describe('spec/v1/compensation.md §D', 'a held plan reads `manual`')).toBe('manual');
+
+    const op = async (actor: Record<string, unknown>) =>
+      driver.post(OPERATOR, { runId, action: 'retry', actor });
+    // 1. Cross-tenant actor: neutralize to the actor's tenant, do not reveal.
+    const cross = await op({ tenantId: 'conformance-other-tenant', principalId: 'conformance-operator', operator: true });
+    if (cross.status === 404 && readErrorCode(cross.json) === undefined && (cross.json === null || cross.json === undefined || Object.keys(cross.json as object).length === 0)) {
+      return extensionAbsent(`${OPERATOR} answered a bodiless 404 — the operator seam is absent (an absent seam and a neutralized cross-tenant plan must be told apart by the envelope: RFC 0132 §A.2 answers \`not_found\` in the canonical envelope)`);
+    }
+    expect(cross.status, driver.describe('RFCS/0151 §E + RFC 0132 §A.2', 'an actor from another tenant MUST NOT learn the plan exists — 404, not 403')).toBe(404);
+    expect(readErrorCode(cross.json), driver.describe('rest-endpoints.md §Error codes', '`not_found` — do not leak existence')).toBe('not_found');
+    // 2. Same tenant, no operator authority: refused AND audited.
+    const plain = await op({ tenantId: 'default', principalId: 'conformance-bystander', operator: false });
+    expect(plain.status, driver.describe('RFCS/0151 §E', 'a principal without operator authority in the plan\'s tenant is refused')).toBe(403);
+    expect(readErrorCode(plain.json), driver.describe('rest-endpoints.md §Error codes', '`forbidden`')).toBe('forbidden');
+    expect(readRetriable(plain.json), driver.describe('spec/v1/host-sample-test-seams.md §21', 'a refused override is not retriable')).toBe(false);
+    // 3. The operator: acts, audited, rollup moves off `manual`.
+    const ok = await op({ tenantId: 'default', principalId: 'conformance-operator', operator: true });
+    expect(ok.status, driver.describe('RFCS/0151 §E', 'an authorized operator MAY retry a held inverse action')).toBe(200);
+    const res = ok.json as { compensationStatus?: string; audited?: boolean; planVersion?: unknown };
+    expect(res.audited, driver.describe('RFCS/0151 §E', 'every override MUST be audited (`authorization.decided`)')).toBe(true);
+    expect(
+      ['completed', 'partial', 'failed', 'running'],
+      driver.describe('spec/v1/compensation.md §D', 'after the operator retries, the rollup is whatever the recorded outcomes yield — never still `manual` for a resolved hold'),
+    ).toContain(res.compensationStatus);
+    // The refusal in step 2 was audited too: the plan's events carry a reason.
+    const after = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
+    if (after.status === 200) {
+      const evs = (after.json as { events?: Array<{ type?: string; payload?: Record<string, unknown> }> }).events ?? [];
+      const decided = evs.filter((e) => e.type === 'authorization.decided');
+      expect(decided.length, driver.describe('RFCS/0151 §E + RFC 0049', 'both the refusal and the override are `authorization.decided` records')).toBeGreaterThanOrEqual(2);
+    }
+  });
+});
+
+describe('RFC 0151 §B/§F — inverse inputs are recorded facts, not re-derived (capability-gated behavior)', () => {
+  it('a replay executes the same inverse actions with the same inputs, and re-fires nothing', async () => {
+    if (!behaviorGate(PROFILE, await advertised())) return;
+    const r = await post(REPLAY, {});
+    if (r === null) return;
+    expect(r.status, driver.describe('spec/v1/host-sample-test-seams.md §21', 'replay seam answers 200')).toBe(200);
+    const body = r.json as ReplayResponse;
+    if (!Array.isArray(body.source) || !Array.isArray(body.replayed)) return extensionAbsent('`replay` did not return `source[]` / `replayed[]`');
+    expect(body.refiredEffects, driver.describe('RFCS/0151 §F', 'replay MUST NOT re-fire inverse effects')).toBe(0);
+    expect(body.source.length, driver.describe('spec/v1/host-sample-test-seams.md §21', 'the source run had inverse actions to compare')).toBeGreaterThan(0);
+    const norm = (xs: readonly InverseAction[]) =>
+      [...xs].sort((a, b) => (a.ordinal ?? 0) - (b.ordinal ?? 0)).map((x) => ({ ordinal: x.ordinal, effectId: x.effectId, input: x.input }));
+    expect(
+      norm(body.replayed),
+      driver.describe(
+        'RFCS/0151 §B + §F',
+        'a replay uses the RECORDED inverse inputs and identities — an inverse built from a re-derived (prompt / model / live) value is not the inverse of what was actually done',
+      ),
+    ).toEqual(norm(body.source));
+    for (const x of body.source) {
+      expect(x.input, driver.describe('RFCS/0151 §B', 'each inverse action executed with a recorded input')).toBeDefined();
+    }
+  });
+});

package/src/scenarios/workload-identity-behavior.test.ts

@@ -167,7 +167,7 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
       ),
     ).toBe(false);
     expect(
-      ['identity_unverified', 'identity_unresolvable', 'audience_mismatch', 'delegation_expired', 'sender_constraint_missing'],
+      ['identity_unverified', 'identity_unresolvable', 'audience_mismatch', 'delegation_expired', 'sender_constraint_missing', 'delegation_chain_too_long', 'delegation_chain_cyclic', 'delegation_scope_amplified'],
       driver.describe('RFCS/0154 §A', 'failures use a closed reason vocabulary'),
     ).toContain(readErrorCode(r.json));
   });

package/src/scenarios/workload-identity-chain-bounds.test.ts

@@ -0,0 +1,141 @@
+/**
+ * RFC 0154 §B "Bounds" — the delegation chain is bounded, acyclic, and cannot
+ * amplify scope hop-to-hop (`auth.md` §"Workload identity and delegated actor
+ * chain" → Bounds; threat model A4 "chain launderer").
+ *
+ * `workload-identity-behavior.test.ts` proves the resolver verifies audience and
+ * expiry. It does not touch the chain's SHAPE as a source of authority, and that
+ * is where laundering lives: a chain that is one hop longer than the host said
+ * it would accept, a chain that loops back through a subject it already passed,
+ * or a chain whose second hop claims a scope its first hop never held. Each is a
+ * verified-looking presentation that a passthrough resolver accepts and a real
+ * one refuses, which is what makes the legs non-vacuous — `resolved: true` on
+ * any of them is the finding.
+ *
+ * All three go through the §20 seam (`host-sample-test-seams.md`) with the
+ * three closed reasons added for them: `delegation_chain_too_long`,
+ * `delegation_chain_cyclic`, `delegation_scope_amplified`. Every leg is gated on
+ * `auth.workloadIdentity.delegation.supported` via `behaviorGate` (a host doing
+ * §A-only identity resolution has not claimed §B) — soft-skips without it,
+ * HARD-FAILS under `OPENWOP_REQUIRE_BEHAVIOR=true`, and records the RFC 0148 §A
+ * disposition either way. A seam that answers 404/403 is `blocked`, not a pass.
+ *
+ * Per-hop `scopes` on the wire are OPTIONAL (`workload-identity.schema.json`,
+ * 2026-08-16); the amplification leg presents them explicitly, so a host that
+ * ignores the field will resolve the chain and fail the leg — which is the
+ * honest outcome, because a host that cannot see hop scopes cannot enforce the
+ * MUST NOT either.
+ *
+ * Registered invariants: `delegation-chain-acyclic`,
+ * `delegation-no-scope-amplification` (`SECURITY/invariants.yaml`), and the
+ * length half of `delegation-chain-bounded`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { seamAbsent } from '../lib/soft-skip.js';
+
+const DELEGATION_PROFILE = 'openwop-workload-identity-delegation';
+const SEAM = '/v1/host/sample/test/workload-identity/resolve';
+
+interface AuthCaps {
+  readonly workloadIdentity?: {
+    readonly supported?: boolean;
+    readonly delegation?: { readonly supported?: boolean; readonly maxChainDepth?: number };
+  };
+}
+
+async function delegationCaps(): Promise<{ supported: boolean; maxChainDepth: number | null }> {
+  const disco = await driver.get('/.well-known/openwop');
+  const d = capabilityFamily<AuthCaps>(disco.json, 'auth')?.workloadIdentity?.delegation;
+  return {
+    supported: d?.supported === true,
+    maxChainDepth: typeof d?.maxChainDepth === 'number' && Number.isInteger(d.maxChainDepth) && d.maxChainDepth > 0 ? d.maxChainDepth : null,
+  };
+}
+
+async function resolve(body: Record<string, unknown>): Promise<{ status: number; json: unknown } | null> {
+  const r = await driver.post(SEAM, body);
+  if (r.status === 404 || r.status === 403) {
+    seamAbsent(`host advertises \`auth.workloadIdentity.delegation.supported: true\` but ${SEAM} answered ${r.status} — RFC 0154 §B chain bounds are unobservable (host-sample-test-seams.md §20)`);
+    return null;
+  }
+  return { status: r.status, json: r.json };
+}
+
+const IDENTITY = { scheme: 'spiffe', subject: 'spiffe://example/dispatcher', issuer: 'spiffe://example', audience: 'openwop-host' };
+const LIVE = '2099-01-01T00:00:00Z';
+
+function hop(n: number, scopes?: readonly string[]): Record<string, unknown> {
+  const h: Record<string, unknown> = { subject: `spiffe://example/hop-${n}`, issuer: 'spiffe://example' };
+  if (scopes !== undefined) h['scopes'] = [...scopes];
+  return h;
+}
+
+/** A refusal: 4xx, non-retriable, the named closed reason. */
+function expectRefusal(r: { status: number; json: unknown }, reason: string, why: string): void {
+  expect(r.status >= 400, driver.describe('RFCS/0154 §B', why)).toBe(true);
+  expect(readErrorCode(r.json), driver.describe('spec/v1/host-sample-test-seams.md §20', `closed reason \`${reason}\``)).toBe(reason);
+  expect(readRetriable(r.json), driver.describe('spec/v1/host-sample-test-seams.md §20', 'a chain the host refuses will be refused on retry')).toBe(false);
+}
+
+describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)', () => {
+  it('a chain longer than the advertised maxChainDepth is refused', async () => {
+    const caps = await delegationCaps();
+    if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
+    expect(
+      caps.maxChainDepth,
+      driver.describe('spec/v1/auth.md §Bounds', 'a host advertising delegation MUST advertise a positive integer `maxChainDepth`'),
+    ).not.toBeNull();
+    const depth = caps.maxChainDepth as number;
+    const chain = Array.from({ length: depth + 1 }, (_, i) => hop(i + 1));
+    const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
+    if (r === null) return;
+    expectRefusal(r, 'delegation_chain_too_long', `a chain of ${depth + 1} hops exceeds the advertised bound of ${depth} — each hop is another party the host trusts transitively`);
+  });
+
+  it('a chain that revisits a subject is refused as cyclic', async () => {
+    const caps = await delegationCaps();
+    if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
+    // Two distinct hops then the first subject again: length 3, so on any
+    // host with maxChainDepth >= 3 the ONLY reason to refuse it is the cycle.
+    // On a host with maxChainDepth < 3 the too-long leg already covers refusal
+    // and this leg accepts either reason, saying so.
+    const chain = [hop(1), hop(2), hop(1)];
+    const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
+    if (r === null) return;
+    const bound = caps.maxChainDepth ?? Number.POSITIVE_INFINITY;
+    if (bound < 3) {
+      expect(r.status >= 400, driver.describe('RFCS/0154 §B', 'a cyclic chain is refused')).toBe(true);
+      expect(['delegation_chain_cyclic', 'delegation_chain_too_long'], driver.describe('spec/v1/host-sample-test-seams.md §20', 'cyclic or too-long — the bound is below the cycle length')).toContain(readErrorCode(r.json));
+      expect(readRetriable(r.json)).toBe(false);
+      return;
+    }
+    expectRefusal(r, 'delegation_chain_cyclic', 'a subject appearing twice is a chain that loops back through authority it already spent — unbounded laundering with a bounded length');
+  });
+
+  it('a later hop claiming a scope the previous hop did not hold is refused', async () => {
+    const caps = await delegationCaps();
+    if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
+    const chain = [hop(1, ['runs:read']), hop(2, ['runs:read', 'runs:write'])];
+    const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
+    if (r === null) return;
+    expectRefusal(r, 'delegation_scope_amplified', 'the effective scopes at any hop MUST NOT exceed the hop before it — a chain is provenance, and provenance cannot mint `runs:write` from `runs:read`');
+  });
+
+  it('a well-formed bounded, acyclic, non-amplifying chain still resolves (the negatives are not a blanket refusal)', async () => {
+    const caps = await delegationCaps();
+    if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
+    const chain = [hop(1, ['runs:read', 'manifest:read']), hop(2, ['runs:read'])];
+    const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
+    if (r === null) return;
+    // A host that refuses EVERY chain passes the three negatives vacuously; this
+    // is the positive that keeps them honest. Scopes narrow hop-to-hop, which
+    // is the one direction §B permits.
+    expect(r.status, driver.describe('RFCS/0154 §B', 'a compliant chain resolves; the bounds refuse laundering, not delegation')).toBe(200);
+    expect((r.json as { resolved?: unknown }).resolved).toBe(true);
+  });
+});

package/src/scenarios/workload-identity-profile.test.ts

@@ -151,6 +151,15 @@ describe('RFC 0154 §B — delegated actor chain', () => {
   it('a chain hop cannot carry extra fields', () => {
     expect(validate({ ...base, delegation: { chain: [{ subject: 'x', token: 'y' }], audience: 'h' } })).toBe(false);
   });
+
+  it('a chain hop MAY carry its verified scopes, as a set of non-empty strings', () => {
+    // RFC 0154 §B "Bounds": scope amplification is only observable if a hop can
+    // state the scopes its proof carried. Provenance, not authorization.
+    expect(validate({ ...base, delegation: { chain: [{ subject: 'x', scopes: ['runs:read'] }, { subject: 'y', scopes: ['runs:read'] }], audience: 'h' } })).toBe(true);
+    expect(validate({ ...base, delegation: { chain: [{ subject: 'x', scopes: 'runs:read' }], audience: 'h' } })).toBe(false);
+    expect(validate({ ...base, delegation: { chain: [{ subject: 'x', scopes: ['runs:read', 'runs:read'] }], audience: 'h' } })).toBe(false);
+    expect(validate({ ...base, delegation: { chain: [{ subject: 'x', scopes: [''] }], audience: 'h' } })).toBe(false);
+  });
 });
 
 describe.skipIf(RFCS_DIR === null)('RFC 0154 — what this does NOT establish', () => {