@openwop/openwop-conformance 1.135.3 → 1.136.0

package/fixtures/conformance-mcp-tool-roundtrip.json

@@ -2,13 +2,16 @@
   "id": "conformance-mcp-tool-roundtrip",
   "name": "Conformance: MCP Tool Roundtrip",
   "version": "1.0",
-  "description": "Track 6 fixture for `mcp-tool-roundtrip.test.ts`. Workflow invokes a single MCP tool (`echo`) on a host-configured MCP server. The conformance suite stands up a synthetic MCP server at startup; operators configure the host to use that server. The fixture's tool call MUST surface in the run's event log with the trust boundary intact per `threat-model-prompt-injection.md` §UNTRUSTED marker. Hosts that don't wire MCP-aware nodes can stub this fixture as `core.noop` — the host-mediated subtest skips when no `tools/call` invocations reach the synthetic server.",
+  "description": "Track 6 fixture for `mcp-tool-roundtrip.test.ts`. Workflow invokes a single MCP tool (`echo`) on a host-configured MCP server. The conformance suite stands up a synthetic MCP server at startup; operators configure the host to use that server. The fixture's tool call MUST surface in the run's event log with the trust boundary intact per `threat-model-prompt-injection.md` §UNTRUSTED marker. Node `core.conformance.mcp-invoke` is a conformance-RESERVED typeId (renamed 2026-08-17 from `core.ai.callPrompt` + a `config.mcp` shape that vendor pack-tier node never read): a host that consumes MCP MUST map it to its own MCP invoke bridge node and honour `config.mcp { tool, arguments }`; a host that does not consume MCP MUST NOT advertise this fixture (the host-mediated leg then records inapplicable).",
   "nodes": [
     {
       "id": "mcp-call",
-      "typeId": "core.ai.callPrompt",
+      "typeId": "core.conformance.mcp-invoke",
       "name": "Invoke MCP echo tool",
-      "position": { "x": 0, "y": 0 },
+      "position": {
+        "x": 0,
+        "y": 0
+      },
       "config": {
         "mcp": {
           "tool": "echo",
@@ -22,11 +25,27 @@
   ],
   "edges": [],
   "triggers": [
-    { "id": "manual", "type": "manual", "enabled": true }
+    {
+      "id": "manual",
+      "type": "manual",
+      "enabled": true
+    }
   ],
   "variables": [
-    { "name": "text", "type": "string", "defaultValue": "roundtrip-probe" }
+    {
+      "name": "text",
+      "type": "string",
+      "defaultValue": "roundtrip-probe"
+    }
   ],
-  "metadata": { "tags": ["conformance", "mcp", "roundtrip"] },
-  "settings": { "timeout": 0 }
+  "metadata": {
+    "tags": [
+      "conformance",
+      "mcp",
+      "roundtrip"
+    ]
+  },
+  "settings": {
+    "timeout": 0
+  }
 }

package/fixtures.md

@@ -102,7 +102,7 @@ All fixtures MUST advertise:
 | Orchestrator Dispatch                     | `conformance-orchestrator-dispatch`                                                             | Phase 5 — supervisor → `next-worker` → dispatch round-trip                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `completed`                                                                         | ≤ 60s                        |
 | Orchestrator Terminate                    | `conformance-orchestrator-terminate`                                                            | Phase 5 / CO-3 — terminate decision is final                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `completed`                                                                         | ≤ 30s                        |
 | Orchestrator Low-Confidence               | `conformance-orchestrator-low-confidence`                                                       | Phase 5 / CP-1 — supervisor low-confidence suspend                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `waiting-approval` (suspends)                                                       | unbounded (suspends)         |
-| MCP Tool Roundtrip                        | `conformance-mcp-tool-roundtrip`                                                                | Track 6 — host invokes a tool on the conformance suite's synthetic MCP server; trust-boundary visibility in the event log                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `completed`                                                                         | ≤ 30s                        |
+| MCP Tool Roundtrip                        | `conformance-mcp-tool-roundtrip`                                                                | Track 6 — host invokes a tool on the conformance suite's synthetic MCP server; trust-boundary visibility in the event log. Node `core.conformance.mcp-invoke` is a **conformance-RESERVED** typeId (renamed 2026-08-17 from `core.ai.callPrompt` with a `config.mcp` shape that vendor pack-tier node never read — it requires `promptId` and ignores `config.mcp`, so the fixture could not execute as declared on the first host that shipped the vendor node): a host that consumes MCP MUST map it to its own MCP invoke bridge node and honour `config.mcp { tool, arguments }`; a host that does not consume MCP MUST NOT advertise this fixture (the host-mediated leg then records inapplicable) — the same treatment as `core.conformance.a2a-invoke`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `completed`                                                                         | ≤ 30s                        |
 | A2A Task Roundtrip                        | `conformance-a2a-task-roundtrip`                                                                | Track 6 — host consumes the conformance suite's synthetic A2A peer; covers drift points #3 (`AUTH_REQUIRED`) and #4 (`REJECTED`). Node `core.conformance.a2a-invoke` is a **conformance-RESERVED** typeId (renamed 2026-08-16 from `core.a2a.invoke`, a multi-segment `core.*` id no host shipped and the corpus never defined): a host that consumes A2A peers MUST map it to its A2A bridge node (a host-extension node — `a2a-integration.md` §"State projection"); a host that does not consume A2A MUST NOT advertise this fixture                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `failed` or `waiting-input` (per `driftScenario` input)                             | ≤ 30s                        |
 | WASM Pack Roundtrip                       | `conformance-wasm-pack-roundtrip`                                                               | RFC 0008 — invokes `vendor.openwop.rust-hello.greet` (loaded WASM pack); exercises required exports + at least one import                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `completed`                                                                         | ≤ 10s                        |
 | WASM Pack Memory-Cap Breach               | `conformance-wasm-pack-memory-cap-breach`                                                       | RFC 0008 §K — invokes the deliberately-misbehaving `vendor.openwop.misbehaving.memory-bomb` pack (allocates 1 GiB beyond the host's `memoryPagesMax`). Host MUST emit `cap.breached` with `kind: "wasm-memory"` and drive the run to terminal `failed`. Misbehaving pack lives at `openwop-examples:examples/packs/rust-misbehaving-memory/` (repo-qualified per the 2026-06 monorepo split — the `openwop-examples` sibling repo) and is fixture-only (NOT signed for registry publication).                                                                                                                                                             | `failed` (with `cap.breached`)                                                      | ≤ 10s                        |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.135.3",
+  "version": "1.136.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.135.3",
-  "corpusCommit": "ed19aa8aafa8c43e55a174abaa2010b82698f572"
+  "suiteVersion": "1.136.0",
+  "corpusCommit": "6e56e76c2abe74f8c56232f3163aba33bdd3db8c"
 }

package/src/lib/execution-model-version.ts

@@ -0,0 +1,22 @@
+/**
+ * The `capabilities.multiAgent.executionModel.version` ceiling, read from
+ * `capabilities.schema.json` so a scenario never restates it. Two scenarios
+ * carried a literal `<= 5` past RFC 0090 (version 6, Accepted 2026-06-08) and
+ * failed the very host that witnessed version 6 (S31, 2026-08-17).
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { SCHEMAS_DIR } from './paths.js';
+
+let cached: number | undefined;
+
+export function executionModelVersionMax(): number {
+  if (cached !== undefined) return cached;
+  const schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'capabilities.schema.json'), 'utf8')) as {
+    properties?: { multiAgent?: { properties?: { executionModel?: { properties?: { version?: { maximum?: number } } } } } };
+  };
+  const max = schema.properties?.multiAgent?.properties?.executionModel?.properties?.version?.maximum;
+  if (typeof max !== 'number') throw new Error('capabilities.schema.json §multiAgent.executionModel.version has no `maximum`');
+  cached = max;
+  return max;
+}

package/src/scenarios/agent-loop-version5-shape.test.ts

@@ -14,6 +14,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
+import { executionModelVersionMax } from '../lib/execution-model-version.js';
 import { readExecutionModelCap } from '../lib/agentLoop.js';
 
 describe('agent-loop-version5-shape: advertisement (RFC 0061 §A)', () => {
@@ -33,9 +34,13 @@ describe('agent-loop-version5-shape: advertisement (RFC 0061 §A)', () => {
       ).toBe(true);
     }
     if (typeof em.version === 'number') {
+      // S31 (2026-08-17): the ceiling is the schema's `maximum` (6 since RFC 0090,
+      // Accepted 2026-06-08 — MyndHyve was the version-6 witness and this leg failed
+      // it against a stale literal 5 for ten weeks). Read, never restate.
+      const max = executionModelVersionMax();
       expect(
-        (em.version as number) >= 1 && (em.version as number) <= 5,
-        driver.describe('capabilities.schema.json §multiAgent.executionModel', 'version MUST be within the 1–5 ladder'),
+        (em.version as number) >= 1 && (em.version as number) <= max,
+        driver.describe('capabilities.schema.json §multiAgent.executionModel', `version MUST be within the 1–${max} ladder (schema maximum)`),
       ).toBe(true);
     }
   });

package/src/scenarios/mcp-current-auth-boundary.test.ts

@@ -35,6 +35,14 @@ async function disco() {
 const REQ = { jsonrpc: '2.0', id: 1, method: 'tools/list', params: { _meta: { [META_V]: '2026-07-28', [META_C]: {} } } };
 const HDR = { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': 'tools/list' };
 
+/** Set-Cookie values from a fetch Headers (Node ≥ 19.7 exposes them un-joined via getSetCookie). */
+function setCookies(h: Headers): string[] {
+  const g = (h as Headers & { getSetCookie?: () => string[] }).getSetCookie;
+  if (typeof g === 'function') return g.call(h);
+  const one = h.get('set-cookie');
+  return one ? [one] : [];
+}
+
 describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §E — mcp-current-auth-boundary (host as server, gated)', () => {
   it('an unauthenticated current-profile request is refused, unless anonymousActor is advertised', async () => {
     const { mcp, anon } = await disco();
@@ -53,5 +61,23 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §E — mcp-current-aut
       [401, 403],
       driver.describe('mcp-integration.md §E', 'an anonymous MCP principal MUST NOT be the production default for an advertised current profile — refuse (401/403) or advertise anonymousActor'),
     ).toContain(anonymous.status);
+
+    // S30 (2026-08-17, openwop-app H43): a cookie-posture host may MINT an anonymous
+    // session for a credential-less caller and then treat "has a principal" as
+    // "is authenticated". The bare probe above never carries a cookie, so it can
+    // only observe the first request; replay with whatever the host just minted
+    // (from this response or from a credential-less discovery GET) and hold the
+    // same rule — an anonymous SESSION is still an anonymous principal.
+    const minted = [
+      ...setCookies(anonymous.headers),
+      ...setCookies((await driver.get('/.well-known/openwop', { authenticated: false })).headers),
+    ];
+    if (minted.length === 0) return; // host mints no anonymous session; the bare probe was the whole observation
+    const cookie = minted.map((c) => c.split(';')[0]).join('; ');
+    const withSession = await driver.post(await mcpServerMount(), REQ, { headers: { ...HDR, Cookie: cookie }, authenticated: false });
+    expect(
+      [401, 403],
+      driver.describe('mcp-integration.md §E', 'a caller holding only a host-minted anonymous session cookie is still an anonymous principal — refuse (401/403) unless anonymousActor is advertised (S30)'),
+    ).toContain(withSession.status);
   });
 });

package/src/scenarios/mcp-tool-roundtrip.test.ts

@@ -75,6 +75,10 @@ import { pollUntilTerminal } from '../lib/polling.js';
  */
 export const REQUIRES_HOST_CALLBACK = "the host issues MCP JSON-RPC calls to the suite's fake server";
 
+// The fixture's node is the conformance-RESERVED `core.conformance.mcp-invoke`
+// (S33, 2026-08-17 — was `core.ai.callPrompt` + `config.mcp`, a vendor pack-tier
+// node that never read that config): a host that consumes MCP maps it to its own
+// bridge; one that does not MUST NOT advertise the fixture.
 const ROUNDTRIP_FIXTURE = 'conformance-mcp-tool-roundtrip';
 
 /**

package/src/scenarios/multi-agent-confidence-escalation.test.ts

@@ -188,13 +188,31 @@ describe.skipIf(BEHAVIORAL_SKIP)('multi-agent-confidence-escalation: behavioral
       'payload.escalationKind ∈ {clarify, escalate}',
     ).toBe(true);
 
-    // Causation chain: escalation event causes back to the runOrchestrator.decided
-    // that named the worker.
-    const decidedEvent = events.find((e) => e.eventId === ev.causationId);
+    // Causation (S32, 2026-08-17): this leg used to REQUIRE `causationId` → a
+    // `runOrchestrator.decided`, which contradicts RFC 0011 §F CP-1 as asserted by
+    // orchestratorConservativePath.test.ts — a low-confidence decision is HELD, so
+    // no `runOrchestrator.decided` exists on the log before ratification; the
+    // escalation event carries the decision verbatim in `originalDecision` for
+    // exactly that reason (multi-agent-execution.md §"Confidence escalation").
+    // Rule now: `causationId` MAY be absent; when present it MUST resolve to an
+    // event already on this run's log (a host that does emit a pre-ratification
+    // decided event may point at it; one that honours CP-1 points at nothing or at
+    // the preceding node event).
+    if (typeof ev.causationId === 'string' && ev.causationId.length > 0) {
+      const cause = events.find((e) => e.eventId === ev.causationId);
+      expect(
+        cause !== undefined,
+        driver.describe(
+          'spec/v1/multi-agent-execution.md §"Confidence escalation"',
+          `confidence-escalated causationId (${ev.causationId}) MUST resolve to an event on this run's log when present`,
+        ),
+      ).toBe(true);
+    }
+    const original = (ev.payload as { originalDecision?: unknown } | undefined)?.originalDecision;
     expect(
-      decidedEvent?.type,
-      'confidence-escalated causationId MUST point at the runOrchestrator.decided that surfaced the low-confidence decision',
-    ).toBe('runOrchestrator.decided');
+      original !== null && typeof original === 'object',
+      driver.describe('run-event-payloads.schema.json §confidence-escalated', 'payload.originalDecision carries the escalated OrchestratorDecision verbatim — the decision is on the log HERE, not on a prior decided event'),
+    ).toBe(true);
 
     // Load-bearing: NO dispatch event fired. RFC 0039 gates BEFORE the loop.
     const chainEvents = events.filter((e) => e.type === 'core.workflowChain.event');

package/src/scenarios/multi-agent-handoff-state-machine.test.ts

@@ -33,6 +33,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
+import { executionModelVersionMax } from '../lib/execution-model-version.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
@@ -81,11 +82,14 @@ describe.skipIf(HTTP_SKIP)('multi-agent-handoff-state-machine: advertisement sha
       ),
     ).toBe('number');
     const v = executionModel.version as number;
+    // S31 (2026-08-17): ceiling read from capabilities.schema.json (`maximum`, 6 since
+    // RFC 0090) instead of a literal that went stale the day version 6 was Accepted.
+    const max = executionModelVersionMax();
     expect(
-      Number.isInteger(v) && v >= 1 && v <= 5,
+      Number.isInteger(v) && v >= 1 && v <= max,
       driver.describe(
         'RFCS/0037-multi-agent-execution-model.md §C',
-        'version MUST be an integer in [1, 5] (1 = Phase 1 only; Phases 2-5 lift the ceiling additively — Phase 5 = RFC 0061 stateful agent-loop lifecycle, matching `capabilities.schema.json` §multiAgent.executionModel.version maximum)',
+        `version MUST be an integer in [1, ${max}] (1 = Phase 1 only; later phases lift the ceiling additively — 5 = RFC 0061 stateful agent-loop lifecycle, 6 = RFC 0090 verifier; the ceiling is \`capabilities.schema.json\` §multiAgent.executionModel.version maximum)`,
       ),
     ).toBe(true);
   });

package/src/scenarios/node-failed-payload-shape.test.ts

@@ -0,0 +1,72 @@
+/**
+ * `node.failed` payload shape — `run-event-payloads.schema.json` §nodeFailed:
+ * `{ nodeId, error: { code, message, details?, retryable? }, attempts? }`. The
+ * error is an OBJECT (`_errorObject`), not a bare string, and it is REQUIRED.
+ *
+ * Why this exists (S34, 2026-08-17): nothing on the wire checked it. The second
+ * sibling host measured that it — and the reference hosts — emitted
+ * `node.failed { error: "<string>", code }` / `{ data: { code } }` for years
+ * while the schema said otherwise, and only noticed because a replay scenario
+ * happens to read `payload.error.code`. A schema nobody drives is a wish.
+ *
+ * Fixture-gated on `conformance-failure` (the run that fails at a node); a host
+ * that does not advertise the fixture records inapplicable. Every `node.failed`
+ * on that run's log MUST validate against §nodeFailed.
+ *
+ * @see spec/v1/rest-endpoints.md · schemas/run-event-payloads.schema.json
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { driver } from '../lib/driver.js';
+import { pollUntilTerminal } from '../lib/polling.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+
+const WORKFLOW_ID = 'conformance-failure';
+const SKIP_NO_FIXTURE = !isFixtureAdvertised(WORKFLOW_ID);
+
+function nodeFailedValidator() {
+  const payloads = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'run-event-payloads.schema.json'), 'utf8')) as {
+    $id?: string;
+    $defs: Record<string, unknown>;
+  };
+  const ajv = new Ajv2020({ strict: false, allErrors: true });
+  addFormats(ajv);
+  const schema = { $schema: 'https://json-schema.org/draft/2020-12/schema', $id: 'urn:openwop:node-failed-leg', $defs: payloads.$defs, $ref: '#/$defs/nodeFailed' };
+  return ajv.compile(schema);
+}
+
+describe.skipIf(SKIP_NO_FIXTURE)('run-event-payloads.schema.json §nodeFailed — node.failed carries a structured error object', () => {
+  it('every node.failed on the conformance-failure run validates against §nodeFailed (error: { code, message } is an object, not a string)', async () => {
+    const create = await driver.post('/v1/runs', { workflowId: WORKFLOW_ID });
+    expect(create.status, driver.describe('rest-endpoints.md', 'POST /v1/runs MUST return 201 for the failing fixture')).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+    const terminal = await pollUntilTerminal(runId);
+    expect(terminal.status, driver.describe('fixtures.md conformance-failure §Terminal status', 'fixture MUST reach terminal `failed`')).toBe('failed');
+
+    const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
+    expect(res.status).toBe(200);
+    const events = ((res.json as { events?: Array<{ type: string; payload?: unknown }> } | undefined)?.events ?? []);
+    const failed = events.filter((e) => e.type === 'node.failed');
+    expect(
+      failed.length,
+      driver.describe('rest-endpoints.md §Run events', 'a run that fails at a node MUST carry at least one node.failed event on its log'),
+    ).toBeGreaterThan(0);
+
+    const validate = nodeFailedValidator();
+    for (const ev of failed) {
+      const ok = validate(ev.payload);
+      expect(
+        ok,
+        driver.describe(
+          'run-event-payloads.schema.json §nodeFailed',
+          `node.failed payload MUST validate — error is a REQUIRED object { code, message } (_errorObject), not a bare string or a data.code: ${JSON.stringify(validate.errors)} — payload: ${JSON.stringify(ev.payload).slice(0, 300)}`,
+        ),
+      ).toBe(true);
+    }
+  });
+});