@openwop/openwop-conformance 1.136.11 → 1.139.0

package/coverage.md

@@ -1,6 +1,6 @@
 # OpenWOP Conformance Coverage Map
 
-> **Status: Living document. Updated 2026-06-29.** This map connects the current scenario files to the protocol surfaces they protect and records the remaining gaps from the protocol deep dive. Scenario names are source-of-truth file names under `conformance/src/scenarios/`.
+> **Status: Living document. Updated 2026-08-25.** This map connects the current scenario files to the protocol surfaces they protect and records the remaining gaps from the protocol deep dive. Scenario names are source-of-truth file names under `conformance/src/scenarios/`.
 
 > **Shape grade vs behavior grade.** Some optional-profile scenarios validate **capability shape** (the host's discovery advertisement is well-formed) without yet exercising **behavior** (the host actually implements the profile end-to-end). The "Current grade" column reflects shape; see §"Capability-gated scenarios: shape vs behavior" below for the dual-grade view and the `OPENWOP_REQUIRE_BEHAVIOR=true` strict-mode runner flag.
 
@@ -200,7 +200,7 @@ Every OpenAPI operation should have:
 4. A cited spec section in each assertion message.
 
 | Operation ID                                                                                | Positive coverage                                                                                                                                                                                                                                                                                                                                                                                                                             | Negative / auth / validation coverage                                                                                                                                                                                                                                                     | Gap                                                                                                                                                                                                                 |
-| ------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
+| ------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `getCapabilities`                                                                           | `discovery.test.ts`, `runtime-capabilities.test.ts`, `profileDerivation.test.ts`, `mcp-discoverability.test.ts`                                                                                                                                                                                                                                                                                                                               | `discovery.test.ts` covers optional `Capabilities-Etag`; `spec-corpus-validity.test.ts` validates schema shape                                                                                                                                                                            | Add scoped discovery scenario when a host advertises it.                                                                                                                                                            |
 | `getOpenApiSpec`                                                                            | `discovery.test.ts`                                                                                                                                                                                                                                                                                                                                                                                                                           | `spec-corpus-validity.test.ts` validates OpenAPI refs                                                                                                                                                                                                                                     | Add unavailable/transient error scenario only if host can simulate it.                                                                                                                                              |
 | `getWorkflow`                                                                               | `route-coverage.test.ts`; fixture-dependent lifecycle tests indirectly require seeded workflow IDs                                                                                                                                                                                                                                                                                                                                            | `route-coverage.test.ts` covers unknown workflow `404`/`403` envelope                                                                                                                                                                                                                     | Good.                                                                                                                                                                                                               |

package/dist/cli.js

@@ -17,7 +17,14 @@
  * Environment variables override flags (per the conformance harness's
  * existing convention):
  *   OPENWOP_BASE_URL, OPENWOP_API_KEY, OPENWOP_IMPLEMENTATION_NAME,
- *   OPENWOP_IMPLEMENTATION_VERSION, OPENWOP_LIFECYCLE_TIMEOUT_MS
+ *   OPENWOP_IMPLEMENTATION_VERSION, OPENWOP_LIFECYCLE_TIMEOUT_MS,
+ *   OPENWOP_POLL_TIMEOUT_SCALE, OPENWOP_MAX_WORKERS
+ *
+ * OPENWOP_LIFECYCLE_TIMEOUT_MS sets the DEFAULT poll bound only — it does
+ * not reach the many scenarios that pass an explicit `timeoutMs`.
+ * OPENWOP_POLL_TIMEOUT_SCALE (default 1) multiplies EVERY bound and is the
+ * knob to reach for when a run's failures are the endpoint (cold start,
+ * contention) rather than the host. See src/lib/polling.ts.
  *
  * Exit codes:
  *   0   all scenarios pass

package/dist/lib/requirement-ledger.js

@@ -123,6 +123,14 @@ export function readLedgerFile(path) {
  * returned early, threw and swallowed, or was never written leaves no entry, and
  * the honest reading of no entry is "this was not exercised".
  */
+/**
+ * Has this requirement already been recorded in THIS run? Distinguishes "the
+ * scenario classified itself" from "nothing has been recorded yet" — which
+ * `dispositionOf` cannot, since it folds the absent case to `blocked`.
+ */
+export function hasRequirement(requirementId) {
+    return ledger.has(requirementId);
+}
 export function dispositionOf(requirementId) {
     return ledger.get(requirementId)?.disposition ?? 'blocked';
 }

package/dist/lib/scenario-disposition.js

@@ -48,6 +48,14 @@ export function requirementIdForFile(basename) {
         ? requirementIdForScenario(basename)
         : `openwop.scenario.${basename.replace(/\.test\.ts$/, '')}`;
 }
+/**
+ * Marks an `executed-pass` row whose file ALSO recorded a soft-skip note — the
+ * file asserted something, then stopped short (gap G8). Greppable on purpose: a
+ * bundle reader filters `disposition === 'executed-pass' && detail?.startsWith(
+ * PARTIAL_WITNESS_PREFIX)` to find rows where the requirement may not have been
+ * the thing that passed.
+ */
+export const PARTIAL_WITNESS_PREFIX = 'partial-witness: ';
 /** Worker half: fold a file's per-test states (+ any gate-recorded reason) into
  *  the ONE disposition the file records. */
 export function fileDisposition(states, gateReason, assertionCount) {
@@ -115,6 +123,28 @@ export function resolveFileRecord(states, gateReason, assertionCount, noted) {
         disposition = noted.kind;
         detail = noted.reason;
     }
+    else if (noted !== null && disposition === 'executed-pass') {
+        // PARTIAL WITNESS (2026-08-19, gap G8). The file asserted something and then
+        // soft-skipped: `return softSkip(...)` yields a PASS state, not a skip, so
+        // neither branch above fires and the note used to be discarded outright. The
+        // row then read `executed-pass` for a requirement the run may never have
+        // reached — e.g. a file asserting a `201` setup precondition before
+        // returning `inapplicable`.
+        //
+        // Same defect as the note-after-`ctx.skip()` case the comment above records;
+        // note-after-ASSERTION was the half that stayed. Both hid because nothing
+        // goes red.
+        //
+        // The disposition is deliberately NOT changed. Honouring the note here would
+        // downgrade a file that legitimately completed its requirement AND
+        // soft-skipped an optional extra leg — trading a false positive for a false
+        // negative, on a per-FILE note that cannot say which leg it came from. The
+        // durable fix is per-`it` recording; this makes the affected rows
+        // self-identifying first, so that change follows measurement instead of
+        // preceding it. `detail` is permitted on `executed-pass` (RFC 0148 §A only
+        // REQUIRES it for other dispositions), so this is additive on the wire.
+        detail = `${PARTIAL_WITNESS_PREFIX}${noted.kind}: ${noted.reason}`;
+    }
     return detail === undefined ? { disposition } : { disposition, detail };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.136.11",
+  "version": "1.139.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.136.11",
-  "corpusCommit": "d52dd83825840335271db2bd1696476b4bbcb634"
+  "suiteVersion": "1.139.0",
+  "corpusCommit": "f34a41ac4c1737ca8af34d0f7f17876268f58e69"
 }

package/schemas/capabilities.schema.json

@@ -3495,7 +3495,7 @@
     },
     "idempotency": {
       "type": "object",
-      "description": "RFC 0036 \u2014 Multi-region idempotency contract. Optional v1 advertisement. The existing `crossRegion: 'single-region'|'best-effort'|'strict'` categorical claim lives under `capabilities.idempotency.crossRegion` per spec/v1/idempotency.md \u00a7'Multi-region idempotency (annex)'. The `multiRegion` sub-block here gives a granular advertisement that hosts SHOULD pair with the categorical `crossRegion` claim.",
+      "description": "RFC 0036 \u2014 Multi-region idempotency contract. Optional v1 advertisement. The existing `crossRegion: 'single-region'|'reconciled-records'|'fenced-effects'` categorical claim lives under `capabilities.idempotency.crossRegion` (this description named the pre-RFC-0150-\u00a7D vocabulary `'best-effort'|'strict'` until 2026-08-18 \u2014 both values were RETIRED by \u00a7D and the sibling `crossRegion` enum has been correct throughout, so only this prose was wrong; a reader of it would have believed two non-values were advertisable) per spec/v1/idempotency.md \u00a7'Multi-region idempotency (annex)'. The `multiRegion` sub-block here gives a granular advertisement that hosts SHOULD pair with the categorical `crossRegion` claim.",
       "additionalProperties": true,
       "properties": {
         "supported": {

package/schemas/certification-bundle-v2.schema.json

@@ -24,7 +24,17 @@
       "properties": {
         "name": { "type": "string", "minLength": 1 },
         "version": { "type": "string", "minLength": 1 },
-        "vendor": { "type": "string" }
+        "vendor": { "type": "string" },
+        "commit": {
+          "type": "string",
+          "minLength": 1,
+          "description": "OPTIONAL, self-reported source revision the host was built from. NOT sufficient to attribute the bundle: a commit does not determine the artifact unless the build is deterministic — a tier-2 host measured 283/22 vs 303/2 from two builds of one commit whose container image ran `npm install` rather than `npm ci` (conformance-certification.md §\"What a bundle attributes to\")."
+        },
+        "build": {
+          "type": "string",
+          "minLength": 1,
+          "description": "OPTIONAL, self-reported identifier of what ACTUALLY EXECUTED — this, not `commit`, is what a verifier needs to re-run the same thing. Which identifier is reachable depends on when the bundle is written: a container image digest is strongest but does not exist yet for a bundle baked INTO the image at certify time; a builder-assigned build id is available during the build; a digest of the resolved dependency manifest (lockfile or resolved tree) is available at certify time and pins the closure that actually varied in the measurement behind this field. State which kind it is rather than reaching for the strongest-sounding one. See conformance-certification.md §\"A bundle attributes to a BUILD\"."
+        }
       }
     },
     "discovery": {

package/src/cli.ts

@@ -17,7 +17,14 @@
  * Environment variables override flags (per the conformance harness's
  * existing convention):
  *   OPENWOP_BASE_URL, OPENWOP_API_KEY, OPENWOP_IMPLEMENTATION_NAME,
- *   OPENWOP_IMPLEMENTATION_VERSION, OPENWOP_LIFECYCLE_TIMEOUT_MS
+ *   OPENWOP_IMPLEMENTATION_VERSION, OPENWOP_LIFECYCLE_TIMEOUT_MS,
+ *   OPENWOP_POLL_TIMEOUT_SCALE, OPENWOP_MAX_WORKERS
+ *
+ * OPENWOP_LIFECYCLE_TIMEOUT_MS sets the DEFAULT poll bound only — it does
+ * not reach the many scenarios that pass an explicit `timeoutMs`.
+ * OPENWOP_POLL_TIMEOUT_SCALE (default 1) multiplies EVERY bound and is the
+ * knob to reach for when a run's failures are the endpoint (cold start,
+ * contention) rather than the host. See src/lib/polling.ts.
  *
  * Exit codes:
  *   0   all scenarios pass

package/src/global-setup.ts

@@ -0,0 +1,169 @@
+/**
+ * Run-end disposition summary (RFC 0148 §A, 2026-08-25).
+ *
+ * ## The gap this closes
+ *
+ * Every scenario file already records ONE honest disposition when it
+ * finishes (`setup.ts`'s `afterAll` → `resolveFileRecord`): a file that
+ * returned early with zero assertions is `blocked` / `skipped` /
+ * `inapplicable` with a reason, never a pass. That machinery is correct.
+ *
+ * It was **published on one invocation out of two**. The worker appends
+ * each recording to `OPENWOP_LEDGER_PATH`, and the ONLY writer of that
+ * variable was `cli.ts` inside `runCertify`. Under a plain `vitest run`
+ * — what `README.md` documents for host operators, and what host
+ * implementers actually run — the worker computed `blocked`, held it in
+ * memory, and discarded it at process exit. The single surviving artifact
+ * was vitest's `1 passed`.
+ *
+ * So the suite computed an honest disposition on every run and published
+ * it on one. Two host implementers independently read the console line as
+ * coverage and reported the suite as claiming a pass it had internally
+ * classified `blocked` — correctly, given the only artifact they had.
+ * RFC 0158 §"Operator preconditions are declared, not hidden" requires a
+ * blocked row be surfaced "never silently skipped or reported as a pass";
+ * the bundle honored that and the console contradicted it.
+ *
+ * ## What this does
+ *
+ * When `OPENWOP_LEDGER_PATH` is unset, point it at a temp file so the
+ * workers record there anyway, then read it at run end and print a
+ * summary. `--certify` sets the variable itself, so this defers to it
+ * completely and never interferes with bundle generation.
+ *
+ * The summary is deliberately NOT a pass/fail signal — it does not change
+ * the exit code. `vitest`'s exit code answers "did any assertion fail";
+ * this answers "what did the run actually witness", and those are
+ * different questions. Conflating them is what produced the gap.
+ *
+ * Set `OPENWOP_DISPOSITION_SUMMARY=false` to silence it.
+ */
+
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+/** Dispositions that are NOT a witnessed execution — the rows worth printing. */
+const NON_EXECUTING = new Set(['blocked', 'skipped', 'inapplicable']);
+
+/** Cap on printed rows; the overflow is always announced, never silent. */
+const MAX_ROWS = 40;
+
+// Import the REAL entry type rather than restating its shape. A hand-written
+// structural guess here read `entry.id` — a key the ledger has never written
+// (it is `requirementId`) — and the `(unnamed)` fallback made the mismatch
+// look like missing data instead of a wrong reader. A type-only import erases
+// at runtime, so this costs nothing and makes the compiler the oracle: rename
+// a ledger field and this file stops building instead of silently degrading.
+import type { LedgerEntry } from './lib/requirement-ledger.js';
+
+/** What a JSONL line parses to before validation — every field may be absent. */
+type LedgerLine = Partial<Record<keyof LedgerEntry, unknown>>;
+
+let ownedDir: string | null = null;
+let ledgerPath: string | null = null;
+
+export function setup(): void {
+  if (process.env['OPENWOP_DISPOSITION_SUMMARY'] === 'false') return;
+  // `--certify` already routes the ledger to its own report dir and reads it
+  // there. Never take it over — this exists only for the path that had no
+  // reader at all.
+  if ((process.env['OPENWOP_LEDGER_PATH'] ?? '') !== '') return;
+  ownedDir = mkdtempSync(join(tmpdir(), 'owp-dispositions-'));
+  ledgerPath = join(ownedDir, 'requirement-ledger.jsonl');
+  process.env['OPENWOP_LEDGER_PATH'] = ledgerPath;
+}
+
+/**
+ * Fold raw JSONL into the printable summary. PURE — no I/O, no env — so
+ * `global-setup.test.ts` can pin it without a vitest subprocess or a host.
+ * Returns `null` when there is nothing to say.
+ */
+export function summarise(raw: string): string | null {
+  const counts = new Map<string, number>();
+  const rows: Array<{ id: string; disposition: string; detail: string }> = [];
+  for (const line of raw.split('\n')) {
+    if (line.trim() === '') continue;
+    let entry: LedgerLine;
+    try {
+      entry = JSON.parse(line) as LedgerLine;
+    } catch {
+      continue;
+    }
+    const disposition = typeof entry.disposition === 'string' ? entry.disposition : 'unknown';
+    const id = typeof entry.requirementId === 'string' ? entry.requirementId : '(unnamed)';
+    const detail = typeof entry.detail === 'string' ? entry.detail : '';
+    counts.set(disposition, (counts.get(disposition) ?? 0) + 1);
+    if (NON_EXECUTING.has(disposition)) {
+      rows.push({ id, disposition, detail });
+    } else if (disposition === 'executed-pass' && entry.assertionCount === 0) {
+      // The other shape RFC 0148 §A rejects: a pass that asserted nothing.
+      rows.push({ id, disposition: 'executed-pass (0 assertions)', detail });
+    }
+  }
+  if (counts.size === 0) return null;
+  const total = [...counts.values()].reduce((a, b) => a + b, 0);
+  const order = ['executed-pass', 'executed-fail', 'blocked', 'skipped', 'inapplicable'];
+  const summary = [...order, ...[...counts.keys()].filter((k) => !order.includes(k))]
+    .filter((k) => counts.has(k))
+    .map((k) => `${k} ${counts.get(k)}`)
+    .join(' \u00b7 ');
+  const out: string[] = [
+    '',
+    `[openwop-conformance] RFC 0148 \u00a7A dispositions \u2014 ${total} requirement(s) recorded`,
+    `  ${summary}`,
+  ];
+  if (rows.length > 0) {
+    out.push(
+      `  ${rows.length} requirement(s) did NOT witness. vitest reports these as passes because`,
+      '  no assertion failed; that is a test outcome, not a conformance disposition.',
+    );
+    for (const r of rows.slice(0, MAX_ROWS)) {
+      const detail = r.detail.length > 120 ? `${r.detail.slice(0, 117)}...` : r.detail;
+      out.push(`    ${r.disposition.padEnd(28)} ${r.id}${detail === '' ? '' : `\n      ${detail}`}`);
+    }
+    if (rows.length > MAX_ROWS) {
+      // Never truncate silently: a capped list that does not say it was capped
+      // reads as a complete one, which is the same defect this whole summary
+      // exists to remove.
+      out.push(`    ... and ${rows.length - MAX_ROWS} more not listed (run with --certify for the full bundle)`);
+    }
+  }
+  out.push('');
+  return out.join('\n');
+}
+
+export function teardown(): void {
+  if (ledgerPath === null || ownedDir === null) return;
+  // We set the variable; unset it so a subsequent in-process run re-derives.
+  delete process.env['OPENWOP_LEDGER_PATH'];
+  let raw = '';
+  try {
+    raw = readFileSync(ledgerPath, 'utf8');
+  } catch {
+    // No file means no worker ever recorded \u2014 nothing to summarise, and a
+    // missing summary must never be mistaken for "nothing was blocked", so
+    // say so rather than printing an empty clean bill.
+    process.stderr.write(
+      '\n[openwop-conformance] no disposition ledger was written \u2014 the run recorded nothing, ' +
+        'which is NOT the same as every scenario having witnessed its requirement.\n',
+    );
+    cleanup();
+    return;
+  }
+  const text = summarise(raw);
+  if (text !== null) process.stderr.write(text);
+  cleanup();
+}
+
+function cleanup(): void {
+  if (ownedDir !== null) {
+    try {
+      rmSync(ownedDir, { recursive: true, force: true });
+    } catch {
+      /* best effort */
+    }
+  }
+  ownedDir = null;
+  ledgerPath = null;
+}

package/src/lib/fork-availability.test.ts

@@ -0,0 +1,69 @@
+/**
+ * Pins `forkDeclined` (RFC 0148 §A).
+ *
+ * The risk in a helper like this is not that it misses a status — that shows up
+ * as a red test somebody investigates. It is that it swallows one: every status
+ * it accepts turns an assertion into a skip, silently, and a suite that skips
+ * is indistinguishable from a suite that passes unless something records why.
+ * So the load-bearing cases here are the NEGATIVE ones.
+ */
+
+import { describe, expect, it, beforeEach } from 'vitest';
+import { forkDeclined } from './fork-availability.js';
+import { resetSoftSkips, softSkipDisposition } from './soft-skip.js';
+
+describe('forkDeclined', () => {
+  beforeEach(() => resetSoftSkips());
+
+  it('treats 404 and 403 the same as 501 — route absent is not weaker than route-declines', () => {
+    // The asymmetry this fixes: every replay scenario handled 501 and none
+    // handled 404. `501` means "I know this route and decline"; `404` means
+    // "there is no such route" — strictly less implemented. The suite treated
+    // the weaker signal as a skip and the stronger one as a defect, so a host
+    // had to implement the route in order to say it had not implemented it.
+    for (const status of [404, 403, 501]) {
+      expect(forkDeclined(status, 'leg'), `status ${status} means the fork did not happen`).toBe(true);
+    }
+  });
+
+  it('does NOT swallow any other status — a 500 is still a defect, not a skip', () => {
+    // If this ever goes green for one of these, a real failure has become a
+    // silent skip and no assertion downstream will ever run again.
+    for (const status of [200, 201, 202, 400, 409, 422, 500, 502, 503]) {
+      expect(forkDeclined(status, 'leg'), `status ${status} must reach the assertion`).toBe(false);
+    }
+  });
+
+  it('records WHY, so the ledger row is not an unclassified return', () => {
+    // Two of the eleven original call sites were a bare `return`. A bare return
+    // in a file whose OTHER tests assert is invisible: the file records
+    // `executed-pass` and the leg that never ran leaves no trace.
+    forkDeclined(404, 'fanout-suppression replay fork');
+    const noted = softSkipDisposition('fork-availability.test.ts');
+    expect(noted?.kind).toBe('blocked');
+    expect(noted?.reason).toContain('404');
+    expect(noted?.reason).toContain('fanout-suppression replay fork');
+    expect(noted?.reason).toContain('not mounted');
+  });
+
+  it('records nothing when the status is not a decline', () => {
+    forkDeclined(201, 'leg');
+    expect(softSkipDisposition('fork-availability.test.ts')).toBeNull();
+  });
+
+  it('names the leg, so one file with several forks stays attributable', () => {
+    forkDeclined(501, 'branch fork');
+    expect(softSkipDisposition('fork-availability.test.ts')?.reason).toContain('branch fork');
+  });
+
+  it('distinguishes the three declines in its reason text', () => {
+    forkDeclined(404, 'a');
+    const a = softSkipDisposition('fork-availability.test.ts')?.reason ?? '';
+    resetSoftSkips();
+    forkDeclined(501, 'a');
+    const b = softSkipDisposition('fork-availability.test.ts')?.reason ?? '';
+    // `blocked` alone does not tell a bundle reader whether the host lacks the
+    // route or declines the range; the reason must.
+    expect(a).not.toBe(b);
+  });
+});

package/src/lib/fork-availability.ts

@@ -0,0 +1,61 @@
+/**
+ * "The fork seam did not run" — one rule, one place (RFC 0148 §A).
+ *
+ * `POST /v1/runs/{runId}:fork` can decline in more than one way, and eleven
+ * call sites across six scenarios each decided for themselves which ways
+ * counted:
+ *
+ *   - **501** — every site handled this. "Advertised but not implemented for
+ *     this range", per the suite convention their comments cite.
+ *   - **404 / 403** — *no* site in the replay family handled it. A host that
+ *     never mounts the route hard-failed `expect(status).toBe(201)`.
+ *
+ * That asymmetry is backwards. `501` means "I know this route and decline";
+ * `404` means "there is no such route" — strictly less implemented, and the
+ * suite treated the weaker signal as a skip and the stronger one as a defect.
+ * The postgres reference host 404s, so `replay-fanout-suppression` was red in
+ * CI on every run while the other four replay scenarios skipped past the same
+ * seam for unrelated fixture reasons. **The suite required a host to implement
+ * the route in order to say it had not implemented the route.**
+ *
+ * Recording matters as much as the predicate. Two of those eleven sites were a
+ * bare `return` with no note: `replay-fork.test.ts` reported "6 tests | 6
+ * skipped" against a host whose fork surface is entirely unmeasured, and the
+ * ledger had nothing to say about why. §A resolves an unclassified return to
+ * `blocked`, but only when the file records nothing at all — a bare return in a
+ * file whose *other* tests assert is invisible.
+ *
+ * Disposition is `blocked`, not `inapplicable`: the obligation applies to this
+ * host, it simply could not be witnessed. `inapplicable` would claim the host
+ * is outside the requirement's scope, which nothing here establishes — these
+ * scenarios carry no capability gate, so the suite does not actually know
+ * whether the host advertises fork. Saying `blocked` is the claim the evidence
+ * supports.
+ */
+
+import { softSkip } from './soft-skip.js';
+
+/** Statuses that mean "the fork did not happen", with what each one tells us. */
+const DECLINED: ReadonlyMap<number, string> = new Map([
+  [404, 'the route is not mounted on this host'],
+  [403, 'the caller is not permitted to fork (route present, access refused)'],
+  [501, 'the host knows the route and declines this range as not implemented'],
+]);
+
+/**
+ * True when `status` means the fork seam did not run — and records WHY for the
+ * RFC 0148 §A ledger as a side effect, so a caller can `if (forkDeclined(...))
+ * return;` without leaving an unclassified return behind.
+ *
+ * `where` names the leg, so a bundle reader can tell which of several forks in
+ * one file declined.
+ */
+export function forkDeclined(status: number, where: string): boolean {
+  const why = DECLINED.get(status);
+  if (why === undefined) return false;
+  softSkip(
+    'blocked',
+    `${where}: POST /v1/runs/{runId}:fork returned ${status} — ${why}, so the behaviour this requirement is stated over never occurred and its absence below would prove nothing`,
+  );
+  return true;
+}

package/src/lib/global-setup.test.ts

@@ -0,0 +1,76 @@
+/**
+ * Pins the run-end disposition summary (`src/global-setup.ts`, RFC 0148 §A).
+ *
+ * The defect this guards is not "the summary is ugly" — it is that the suite
+ * computed an honest disposition on every run and PUBLISHED it on one. Two
+ * host implementers read vitest's `1 passed` as coverage for a requirement the
+ * suite had internally classified `blocked`, because the classification had no
+ * reader outside `--certify`.
+ *
+ * Server-free and pure: `summarise` takes the raw JSONL and returns the text.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { summarise } from '../global-setup.js';
+
+const line = (o: Record<string, unknown>): string => JSON.stringify(o);
+
+describe('global-setup: RFC 0148 §A disposition summary', () => {
+  it('reads the ledger key the ledger actually writes (`requirementId`, not `id`)', () => {
+    // Regression: the first draft of this reader keyed on `entry.id`, a field
+    // `recordRequirement` has never written, and fell back to `(unnamed)`.
+    // The fallback made a WRONG READER look like MISSING DATA — the same
+    // failure shape the summary exists to expose, reproduced in the exposer.
+    const out = summarise(
+      line({ requirementId: 'openwop.scenario.webhook-signed-delivery', disposition: 'blocked', detail: 'guard rejected loopback' }),
+    );
+    expect(out).toContain('openwop.scenario.webhook-signed-delivery');
+    expect(out).not.toContain('(unnamed)');
+  });
+
+  it('lists blocked / skipped / inapplicable as NOT witnessed, with the reason', () => {
+    const out = summarise(
+      [
+        line({ requirementId: 'a', disposition: 'blocked', detail: 'seam absent' }),
+        line({ requirementId: 'b', disposition: 'skipped', detail: 'operator opted out' }),
+        line({ requirementId: 'c', disposition: 'inapplicable', detail: 'profile not advertised' }),
+      ].join('\n'),
+    );
+    expect(out).toContain('did NOT witness');
+    for (const s of ['seam absent', 'operator opted out', 'profile not advertised']) {
+      expect(out).toContain(s);
+    }
+  });
+
+  it('flags an executed-pass that asserted nothing — the other RFC 0148 §A vacuity shape', () => {
+    const out = summarise(line({ requirementId: 'vacuous', disposition: 'executed-pass', assertionCount: 0 }));
+    expect(out).toContain('executed-pass (0 assertions)');
+    expect(out).toContain('vacuous');
+  });
+
+  it('does NOT flag a real executed-pass', () => {
+    const out = summarise(line({ requirementId: 'real', disposition: 'executed-pass', assertionCount: 12 }));
+    expect(out).toContain('executed-pass 1');
+    expect(out).not.toContain('did NOT witness');
+  });
+
+  it('announces truncation rather than capping silently', () => {
+    // A capped list that does not say it was capped reads as a complete one.
+    const many = Array.from({ length: 45 }, (_, i) =>
+      line({ requirementId: `r${i}`, disposition: 'blocked', detail: 'why' }),
+    ).join('\n');
+    const out = summarise(many);
+    expect(out).toContain('5 more not listed');
+  });
+
+  it('returns null on an empty ledger so teardown prints nothing', () => {
+    expect(summarise('')).toBeNull();
+    expect(summarise('\n\n')).toBeNull();
+  });
+
+  it('skips unparseable lines without discarding the rest of the run', () => {
+    const out = summarise(['{ not json', line({ requirementId: 'ok', disposition: 'blocked', detail: 'r' })].join('\n'));
+    expect(out).toContain('ok');
+    expect(out).toContain('blocked 1');
+  });
+});

package/src/lib/polling.test.ts

@@ -0,0 +1,80 @@
+/**
+ * Unit tests for `polling.ts` — the poll-bound scaling knob.
+ *
+ * These exist because the defect being fixed was a knob that did not reach
+ * what its documentation said it reached: `OPENWOP_LIFECYCLE_TIMEOUT_MS` was
+ * documented as the way to bound long polls, but it supplies only the DEFAULT,
+ * so every call site passing an explicit `timeoutMs` ignored it. Shipping the
+ * replacement untested would repeat the defect one layer up, so the scale is
+ * asserted here rather than assumed.
+ *
+ * @see polling.ts
+ */
+
+import { describe, it, expect, afterEach } from 'vitest';
+import { scaledTimeoutMs } from './polling.js';
+
+const KEY = 'OPENWOP_POLL_TIMEOUT_SCALE';
+
+function withScale(value: string | undefined, fn: () => void): void {
+  if (value === undefined) delete process.env[KEY];
+  else process.env[KEY] = value;
+  fn();
+}
+
+afterEach(() => {
+  delete process.env[KEY];
+});
+
+describe('polling: scaledTimeoutMs', () => {
+  it('is an exact no-op when the knob is unset — no existing measurement moves', () => {
+    withScale(undefined, () => {
+      for (const ms of [100, 1_000, 5_000, 10_000, 15_000, 30_000, 60_000]) {
+        expect(scaledTimeoutMs(ms)).toBe(ms);
+      }
+    });
+  });
+
+  it('is an exact no-op at scale 1, including the string form', () => {
+    withScale('1', () => expect(scaledTimeoutMs(10_000)).toBe(10_000));
+    withScale('1.0', () => expect(scaledTimeoutMs(10_000)).toBe(10_000));
+  });
+
+  it('scales explicit bounds, which the documented env var could never reach', () => {
+    withScale('3', () => {
+      expect(scaledTimeoutMs(10_000)).toBe(30_000);
+      expect(scaledTimeoutMs(15_000)).toBe(45_000);
+    });
+  });
+
+  it('preserves the ORDERING of deliberately-short bounds — the reason this scales rather than floors', () => {
+    withScale('4', () => {
+      const short = scaledTimeoutMs(100);
+      const long = scaledTimeoutMs(10_000);
+      expect(short).toBe(400);
+      expect(long).toBe(40_000);
+      // A floor would have collapsed these two to the same value, silently
+      // rewriting every negative assertion that depends on a short bound.
+      expect(short).toBeLessThan(long);
+    });
+  });
+
+  it('rounds up, so a fractional scale never shortens a bound', () => {
+    withScale('1.5', () => expect(scaledTimeoutMs(1_001)).toBe(1_502));
+    withScale('1.0001', () => expect(scaledTimeoutMs(100)).toBeGreaterThanOrEqual(100));
+  });
+
+  it('falls back to 1 for a mis-set knob rather than producing an instant failure', () => {
+    // A zero, negative, or unparseable scale would turn every poll into an
+    // immediate timeout — which reads as a catastrophic host defect, the exact
+    // misattribution this knob exists to prevent.
+    for (const bad of ['0', '-2', 'abc', 'NaN', 'Infinity', '', '  ']) {
+      withScale(bad, () => expect(scaledTimeoutMs(10_000)).toBe(10_000));
+    }
+  });
+
+  it('reads the environment at CALL time, so a harness may set it after import', () => {
+    withScale('2', () => expect(scaledTimeoutMs(1_000)).toBe(2_000));
+    withScale('5', () => expect(scaledTimeoutMs(1_000)).toBe(5_000));
+  });
+});