@openwop/openwop-conformance 1.136.11 → 1.139.0

package/src/lib/polling.ts

@@ -6,7 +6,25 @@
  * Polling is the lowest-common-denominator wire; SSE-specific scenarios
  * live in stream-modes.test.ts.
  *
- * Bound long polls with OPENWOP_LIFECYCLE_TIMEOUT_MS env var (default 10s).
+ * Bound long polls with OPENWOP_LIFECYCLE_TIMEOUT_MS env var (default 10s) —
+ * but note what that knob can and cannot reach. It supplies the DEFAULT only,
+ * so it has no effect on the ~110 call sites that pass an explicit `timeoutMs`
+ * (59 of them passing the same `10_000` the default already was). An operator
+ * measuring a host on a cold or contended endpoint would set the documented
+ * variable, observe no change in those scenarios, and record a failure that
+ * measured the environment rather than the host.
+ *
+ * `OPENWOP_POLL_TIMEOUT_SCALE` (default `1`) closes that: it multiplies EVERY
+ * poll bound, explicit or default. Scaling rather than flooring is deliberate —
+ * a floor would flatten the deliberately-short bounds (`100`, `1000`) that some
+ * negative assertions depend on, while a scale preserves every call site's
+ * intent relative to the others. At the default it is a no-op, so no existing
+ * measurement moves.
+ *
+ * Neither knob is a way to make a hanging host pass: the assertion is that a
+ * terminal state is REACHED, and a host that never reaches one fails at any
+ * bound. What they buy is the ability to say whether a timeout measured the
+ * host or the harness.
  */
 
 import { driver } from './driver.js';
@@ -33,6 +51,25 @@ export interface RunSnapshot {
 const POLL_INTERVAL_MS = 250;
 const DEFAULT_TIMEOUT_MS = Number(process.env.OPENWOP_LIFECYCLE_TIMEOUT_MS ?? 10_000);
 
+/**
+ * Multiplier applied to every poll bound (see the module docstring). Invalid,
+ * non-positive, or non-finite values fall back to `1` rather than silently
+ * producing a zero or negative deadline — a mis-set knob must not turn every
+ * poll into an instant failure that looks like a host defect.
+ */
+function pollTimeoutScale(): number {
+  const raw = process.env.OPENWOP_POLL_TIMEOUT_SCALE;
+  if (raw === undefined || raw === '') return 1;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : 1;
+}
+
+/** Apply the scale to a bound, rounding up so a scale of 1 is exactly a no-op. */
+export function scaledTimeoutMs(timeoutMs: number): number {
+  const scale = pollTimeoutScale();
+  return scale === 1 ? timeoutMs : Math.ceil(timeoutMs * scale);
+}
+
 const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
 
 export async function getRun(runId: string): Promise<RunSnapshot> {
@@ -48,7 +85,7 @@ export async function pollUntil(
   predicate: (snap: RunSnapshot) => boolean,
   opts: { timeoutMs?: number; label?: string } = {},
 ): Promise<RunSnapshot> {
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const timeoutMs = scaledTimeoutMs(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
   const deadline = Date.now() + timeoutMs;
   let last: RunSnapshot | null = null;
   while (Date.now() < deadline) {

package/src/lib/requirement-ledger.test.ts

@@ -0,0 +1,75 @@
+/**
+ * Unit tests for `requirement-ledger.ts` — recording precedence.
+ *
+ * These pin the property `setup.ts` relies on when it decides whether to write
+ * its automatic file-level record: a scenario that classified ITSELF must win
+ * outright. The comment on that line claimed as much for years while the code
+ * only delivered it on DISAGREEMENT — a same-disposition re-record reached
+ * `ledger.set` and replaced the scenario's own `detail` and `assertionCount`
+ * with the file-level ones. Harmless while details were rarely set on a pass;
+ * visible the moment `resolveFileRecord` began attaching a `partial-witness:`
+ * marker, which would have stamped "may not have witnessed this" over a
+ * scenario's own explicit finding.
+ *
+ * @see requirement-ledger.ts, setup.ts
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import {
+  recordRequirement,
+  hasRequirement,
+  entryOf,
+  dispositionOf,
+  resetLedger,
+} from './requirement-ledger.js';
+
+const ID = 'openwop.scenario.ledger-precedence-fixture';
+
+beforeEach(() => {
+  resetLedger();
+});
+
+describe('requirement-ledger: recording precedence', () => {
+  it('hasRequirement distinguishes "not recorded" from "recorded", which dispositionOf cannot', () => {
+    // `dispositionOf` folds the absent case to `blocked`, so it reads the same
+    // for a requirement nobody touched and one deliberately recorded blocked.
+    expect(hasRequirement(ID)).toBe(false);
+    expect(dispositionOf(ID)).toBe('blocked');
+
+    recordRequirement(ID, 'blocked', 'seam absent');
+    expect(hasRequirement(ID)).toBe(true);
+    expect(dispositionOf(ID)).toBe('blocked');
+  });
+
+  it('a same-disposition re-record OVERWRITES detail and assertionCount — the reason setup.ts must guard', () => {
+    recordRequirement(ID, 'executed-pass', 'witnessed the MUST NOT on the wire', { assertionCount: 9 });
+    expect(entryOf(ID).detail).toBe('witnessed the MUST NOT on the wire');
+
+    // No throw: `recordRequirement` only rejects a CONFLICTING disposition.
+    recordRequirement(ID, 'executed-pass', 'partial-witness: inapplicable: branch leg skipped', { assertionCount: 2 });
+    expect(entryOf(ID).detail).toBe('partial-witness: inapplicable: branch leg skipped');
+    expect(entryOf(ID).assertionCount).toBe(2);
+  });
+
+  it('a CONFLICTING disposition throws, which is how the explicit record already won on disagreement', () => {
+    recordRequirement(ID, 'executed-pass', undefined, { assertionCount: 4 });
+    expect(() => recordRequirement(ID, 'blocked', 'file-level fold said blocked')).toThrow(/already recorded/);
+    // The first recording survives the rejected second one.
+    expect(dispositionOf(ID)).toBe('executed-pass');
+  });
+
+  it('guarding on hasRequirement preserves the explicit record in BOTH directions', () => {
+    // This is precisely what setup.ts now does before its automatic write.
+    recordRequirement(ID, 'executed-pass', 'witnessed the MUST NOT on the wire', { assertionCount: 9 });
+    if (!hasRequirement(ID)) {
+      recordRequirement(ID, 'executed-pass', 'partial-witness: inapplicable: branch leg skipped', { assertionCount: 2 });
+    }
+    expect(entryOf(ID).detail).toBe('witnessed the MUST NOT on the wire');
+    expect(entryOf(ID).assertionCount).toBe(9);
+  });
+
+  it('still refuses a non-pass disposition with no reason — an unactionable row', () => {
+    expect(() => recordRequirement(ID, 'blocked', '   ')).toThrow(/without a reason/);
+    expect(hasRequirement(ID)).toBe(false);
+  });
+});

package/src/lib/requirement-ledger.ts

@@ -158,6 +158,15 @@ export function readLedgerFile(path: string): readonly LedgerEntry[] {
  * returned early, threw and swallowed, or was never written leaves no entry, and
  * the honest reading of no entry is "this was not exercised".
  */
+/**
+ * Has this requirement already been recorded in THIS run? Distinguishes "the
+ * scenario classified itself" from "nothing has been recorded yet" — which
+ * `dispositionOf` cannot, since it folds the absent case to `blocked`.
+ */
+export function hasRequirement(requirementId: string): boolean {
+  return ledger.has(requirementId);
+}
+
 export function dispositionOf(requirementId: string): Disposition {
   return ledger.get(requirementId)?.disposition ?? 'blocked';
 }

package/src/lib/risk-disposition.test.ts

@@ -0,0 +1,91 @@
+/**
+ * Unit tests for the closed/transferred predicate in
+ * `scripts/generate-assurance-status.mjs`.
+ *
+ * This predicate is not cosmetic. Project-wide gates have been keyed to the
+ * open-Critical count it produces, so a false closure silently loosens a
+ * constraint — and a false open silently keeps one in force.
+ *
+ * It previously matched the bare substring `closed` anywhere in a row's status
+ * cell, which produced two failures in opposite directions:
+ *
+ *   · RFC 0151 R1 ("Compensation executes twice", Critical) reads
+ *     "Open — ... unwitnessed" and was counted CLOSED from 2026-08-16 onward,
+ *     because the cell mentions "(G1 closed 2026-08-16)" — a DIFFERENT item's
+ *     closure. A substring of an adjacent concept.
+ *   · A row stating that a risk "cannot be closed by repository work" was
+ *     counted closed by saying so.
+ *
+ * The predicate is duplicated here rather than imported because the generator is
+ * a standalone ESM script with no exports; the duplication is pinned by
+ * `matches the generator's source` below, which fails if the two drift.
+ *
+ * @see scripts/generate-assurance-status.mjs
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { V1_DIR } from './paths.js';
+
+const NEGATED = /\b(cannot|can ?not|could not|will not|never|not)\s+be\s+(closed|resolved)\b|\bnot closed\b/i;
+const EXPLICIT = /\*\*(CLOSED|Closed)\b|~~|Realised and remediated/i;
+const TRANSFERRED = /\*\*(?:OPEN\s+—\s+)?TRANSFERRED\b/i;
+
+function disposition(status: string): 'closed' | 'transferred' | 'open' {
+  const closed = EXPLICIT.test(status) && !NEGATED.test(status);
+  if (closed) return 'closed';
+  return TRANSFERRED.test(status) ? 'transferred' : 'open';
+}
+
+describe('assurance risk disposition', () => {
+  it('does NOT read a nested reference to another item as this row being closed', () => {
+    // The exact RFC 0151 R1 shape. "Open", "unwitnessed", and a parenthetical
+    // about gap G1 closing — a different thing entirely.
+    const status =
+      'Open — **Sweep 2026-08-16:** **Mitigated in prose** — inverse-action identity tuple stated; ' +
+      '`compensation.md` §C now states the persistence shape (G1 closed 2026-08-16); unwitnessed for retry-stability';
+    expect(disposition(status)).toBe('open');
+  });
+
+  it('does NOT read a row that says a risk cannot be closed as closed', () => {
+    expect(disposition('**OPEN — TRANSFERRED.** This risk cannot be closed by repository work.')).not.toBe('closed');
+  });
+
+  it('reads an explicit marker as closed', () => {
+    expect(disposition('**CLOSED.** The recurrence mechanism is in the tree and executing.')).toBe('closed');
+    expect(disposition('~~superseded~~ — folded into RFC 0150 §D')).toBe('closed');
+    expect(disposition('**Realised and remediated in scope:** bundle 1 invalidated')).toBe('closed');
+  });
+
+  it('distinguishes transferred from open, because §A.1 turns on the difference', () => {
+    expect(disposition('**OPEN — TRANSFERRED to a named tracked surface.** Tracked in KNOWN-LIMITS.')).toBe('transferred');
+    expect(disposition('Open — unwitnessed. No host advertises the capability.')).toBe('open');
+  });
+
+  it('is not fooled by the word appearing in ordinary prose', () => {
+    expect(disposition('Open — the comment window closed without review.')).toBe('open');
+    expect(disposition('Open — closes when a host implements fencing.')).toBe('open');
+  });
+
+  it('matches the generator source — fails if the two drift apart', () => {
+    // `V1_DIR` is null in the PUBLISHED package layout, which ships no `spec/`
+    // and no `scripts/`. Resolving the path at module scope — or casting the
+    // null away — is what made six scenarios throw at import for every npm
+    // consumer while staying green in a repo checkout. Resolve inside the test
+    // and skip when the repo is not there.
+    if (V1_DIR === null) return;
+    const script = join(dirname(V1_DIR), '..', 'scripts', 'generate-assurance-status.mjs');
+    if (!existsSync(script)) return;
+    const src = readFileSync(script, 'utf8');
+    // Guard the shape, not the byte-for-byte text: the generator must still gate
+    // on an explicit marker AND a negation check, never on a bare substring.
+    expect(src, 'generator must keep the negation guard').toMatch(/const negated = /);
+    expect(src, 'generator must require an explicit closed marker').toMatch(/const explicitlyClosed =/);
+    expect(src, 'generator must still separate transferred rows').toMatch(/const transferred = /);
+    expect(
+      /const closed = \/\(\^\|\\s\)\(closed\|resolved/.test(src),
+      'the bare-substring test must not come back',
+    ).toBe(false);
+  });
+});

package/src/lib/scenario-disposition.ts

@@ -49,6 +49,15 @@ export function requirementIdForFile(basename: string): string {
     : `openwop.scenario.${basename.replace(/\.test\.ts$/, '')}`;
 }
 
+/**
+ * Marks an `executed-pass` row whose file ALSO recorded a soft-skip note — the
+ * file asserted something, then stopped short (gap G8). Greppable on purpose: a
+ * bundle reader filters `disposition === 'executed-pass' && detail?.startsWith(
+ * PARTIAL_WITNESS_PREFIX)` to find rows where the requirement may not have been
+ * the thing that passed.
+ */
+export const PARTIAL_WITNESS_PREFIX = 'partial-witness: ';
+
 export type FileTestState = 'pass' | 'fail' | 'skip';
 
 /** Worker half: fold a file's per-test states (+ any gate-recorded reason) into
@@ -125,6 +134,27 @@ export function resolveFileRecord(
     // dead code — which is how seven files carried notes the ledger never saw.
     disposition = noted.kind;
     detail = noted.reason;
+  } else if (noted !== null && disposition === 'executed-pass') {
+    // PARTIAL WITNESS (2026-08-19, gap G8). The file asserted something and then
+    // soft-skipped: `return softSkip(...)` yields a PASS state, not a skip, so
+    // neither branch above fires and the note used to be discarded outright. The
+    // row then read `executed-pass` for a requirement the run may never have
+    // reached — e.g. a file asserting a `201` setup precondition before
+    // returning `inapplicable`.
+    //
+    // Same defect as the note-after-`ctx.skip()` case the comment above records;
+    // note-after-ASSERTION was the half that stayed. Both hid because nothing
+    // goes red.
+    //
+    // The disposition is deliberately NOT changed. Honouring the note here would
+    // downgrade a file that legitimately completed its requirement AND
+    // soft-skipped an optional extra leg — trading a false positive for a false
+    // negative, on a per-FILE note that cannot say which leg it came from. The
+    // durable fix is per-`it` recording; this makes the affected rows
+    // self-identifying first, so that change follows measurement instead of
+    // preceding it. `detail` is permitted on `executed-pass` (RFC 0148 §A only
+    // REQUIRES it for other dispositions), so this is additive on the wire.
+    detail = `${PARTIAL_WITNESS_PREFIX}${noted.kind}: ${noted.reason}`;
   }
   return detail === undefined ? { disposition } : { disposition, detail };
 }

package/src/lib/webhook-receiver.test.ts

@@ -0,0 +1,76 @@
+/**
+ * Unit tests for `webhook-receiver.ts` — the signature-header contract.
+ *
+ * This verifier is the reference a subscriber implementer copies. It required
+ * `v1=` and therefore rejected, as malformed, the exact header `webhooks.md`
+ * §"Delivery headers" mandates (`X-openwop-Signature: sha256={hex}`). The
+ * divergence survived because `webhook-receiver-adversarial.test.ts` signs with
+ * `signPayload` and verifies with `verifyWebhookDelivery` — a closed loop that is
+ * self-consistent and wrong, and so green against every host. These cases pin the
+ * header against the SPEC rather than against the suite's own output.
+ *
+ * @see webhook-receiver.ts, spec/v1/webhooks.md §"Delivery headers"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { createHmac } from 'node:crypto';
+import {
+  SIGNATURE_PREFIX,
+  createReceiverState,
+  verifyWebhookDelivery,
+  signPayload,
+} from './webhook-receiver.js';
+
+const SECRET = 'shhh-not-a-real-secret';
+const BODY = JSON.stringify({ event: { type: 'run.completed' } });
+
+/** Build the header exactly as `webhooks.md` documents it, not as we emit it. */
+function specShapedHeader(ts: number): string {
+  const hex = createHmac('sha256', SECRET).update(`${ts}.${BODY}`).digest('hex');
+  return `sha256=${hex}`;
+}
+
+describe('webhook-receiver: the X-openwop-Signature prefix follows the spec', () => {
+  it('the constant is the spec value, not the algorithm-header value', () => {
+    // `v1` names the SIGNING SCHEME (X-openwop-Signature-Algorithm). It is not
+    // the encoding prefix. One value, two fields — the conflation this fixes.
+    expect(SIGNATURE_PREFIX).toBe('sha256=');
+  });
+
+  it('ACCEPTS a header built to the spec by hand, with no help from signPayload', () => {
+    const ts = Math.floor(Date.now() / 1000);
+    const result = verifyWebhookDelivery(
+      SECRET,
+      specShapedHeader(ts),
+      'v1',
+      String(ts),
+      BODY,
+      createReceiverState(),
+    );
+    expect(result.accepted).toBe(true);
+  });
+
+  it('REJECTS the pre-2026-08-19 `v1=` prefix as malformed — the shape the spec never defined', () => {
+    const ts = Math.floor(Date.now() / 1000);
+    const hex = createHmac('sha256', SECRET).update(`${ts}.${BODY}`).digest('hex');
+    const result = verifyWebhookDelivery(
+      SECRET,
+      `v1=${hex}`,
+      'v1',
+      String(ts),
+      BODY,
+      createReceiverState(),
+    );
+    expect(result.accepted).toBe(false);
+    if (!result.accepted) expect(result.reason).toBe('malformed_signature_header');
+  });
+
+  it('signPayload emits what the verifier accepts AND what the spec documents', () => {
+    const ts = Math.floor(Date.now() / 1000);
+    const { signatureHeader, algorithmHeader } = signPayload(SECRET, ts, BODY);
+    // Both halves matter: agreeing with the verifier alone is the closed loop
+    // that hid the bug, so this also compares against the hand-built header.
+    expect(signatureHeader).toBe(specShapedHeader(ts));
+    expect(algorithmHeader).toBe('v1');
+  });
+});

package/src/lib/webhook-receiver.ts

@@ -17,6 +17,13 @@
 
 import { createHmac, timingSafeEqual } from 'node:crypto';
 
+/**
+ * The `X-openwop-Signature` value prefix, per `webhooks.md` §"Delivery headers"
+ * (`sha256={hex}`). Distinct from the ALGORITHM header's `v1`, which names the
+ * signing scheme, not the encoding — see `verifyWebhookDelivery`.
+ */
+export const SIGNATURE_PREFIX = 'sha256=';
+
 export const DEFAULT_FRESHNESS_WINDOW_SECONDS = 300;
 
 export type WebhookRejectionReason =
@@ -75,10 +82,24 @@ export function verifyWebhookDelivery(
   }
 
   // 2. Signature header parse.
-  if (!signatureHeader.startsWith('v1=')) {
+  //
+  // `sha256=`, NOT `v1=` (corrected 2026-08-19). `webhooks.md` §"Delivery
+  // headers" specifies `X-openwop-Signature: sha256={hex}` and its verification
+  // recipe says "Strip the `sha256=` prefix". This verifier required `v1=` and
+  // rejected the spec's own header as malformed — so the reference verifier a
+  // subscriber implementer would copy refused every conforming delivery.
+  //
+  // The confusion is visible one comment above: `v1` is the value of the
+  // ALGORITHM header (`X-openwop-Signature-Algorithm: v1`), a different field.
+  // One value, two fields, conflated. It survived because
+  // `webhook-receiver-adversarial.test.ts` signs with `signPayload` and verifies
+  // with this function — a closed loop that is self-consistent and wrong, and
+  // therefore green on every host. Reported by a tier-2 host that could not
+  // adjudicate which of the suite's three signature shapes was canonical.
+  if (!signatureHeader.startsWith(SIGNATURE_PREFIX)) {
     return { accepted: false, reason: 'malformed_signature_header' };
   }
-  const providedHex = signatureHeader.slice(3);
+  const providedHex = signatureHeader.slice(SIGNATURE_PREFIX.length);
   if (!/^[0-9a-f]+$/i.test(providedHex)) {
     return { accepted: false, reason: 'malformed_signature_header' };
   }
@@ -130,7 +151,7 @@ export function signPayload(
   const bodyStr = typeof rawBody === 'string' ? rawBody : rawBody.toString('utf8');
   const hex = createHmac('sha256', secret).update(`${timestamp}.${bodyStr}`, 'utf8').digest('hex');
   return {
-    signatureHeader: `v1=${hex}`,
+    signatureHeader: `${SIGNATURE_PREFIX}${hex}`,
     timestampHeader: String(timestamp),
     algorithmHeader: 'v1',
   };

package/src/scenarios/a2a-task-roundtrip.test.ts

@@ -47,6 +47,7 @@ import { pollUntilTerminal, pollUntilStatus } from '../lib/polling.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { seamAbsent } from '../lib/soft-skip.js';
 
 /**
  * Callback-shaped: the host issues A2A JSON-RPC calls to the suite's fake peer.
@@ -403,21 +404,76 @@ describe.skipIf(HTTP_SKIP)('a2a-task-roundtrip: durable tasks/get after disconne
   });
 });
 
-describe.skipIf(HTTP_SKIP)('a2a-task-roundtrip: push-config SSRF (gated on a2a.pushNotifications; RFC 0100)', () => {
-  it('registering a pushConfig.url at a private address is refused (a2a-push-egress-ssrf)', async () => {
+/**
+ * Push-config SSRF, TWO-SIDED (RFC 0100 §4, a2a-integration.md §D.6).
+ *
+ * The RFC 0093 webhook-egress guard has two arms — `webhooks.md`
+ * §"SSRF protection" rejects non-`https://` protocols AND private/loopback/
+ * link-local/ULA/metadata addresses — and a host may implement either one
+ * alone.
+ *
+ * Until 2026-08-25 this file probed with a single `http://10.0.0.5/push`,
+ * which **violates both arms at once**. Either arm alone refuses it, so a
+ * `>= 400` witnessed *that something refused* and never *which guard ran*.
+ * A host with only the address arm passed; so did a host with only the
+ * scheme arm; so would a host that refused every push URL for an unrelated
+ * reason. The assertion was real and the conclusion drawn from it was not.
+ *
+ * The probes below isolate one arm each: `https` at a private address can
+ * only be refused by the address arm, and `http` at a public host can only
+ * be refused by the scheme arm. Two legs is the minimum that distinguishes
+ * them — the same reason a negative control is not optional.
+ *
+ * The scheme leg is new, and the obligation it checks was previously stated
+ * only by reference (every prior wording abbreviated the guard to its
+ * address arm). `COMPATIBILITY.md` §3 records the Class 3 classification: a
+ * host accepting a plaintext push target was never conforming. An
+ * implementer reddened by this leg is reading a clarification, not a new
+ * requirement — the failure message says so.
+ */
+describe.skipIf(HTTP_SKIP)('a2a-task-roundtrip: push-config SSRF, two-sided (gated on a2a.pushNotifications; RFC 0100)', () => {
+  async function registerPush(url: string): Promise<{ status: number } | null> {
     const a2a = await readCapabilityFamily<{ pushNotifications?: boolean }>('a2a');
-    if (!behaviorGate('a2a.pushNotifications', a2a?.pushNotifications === true)) return;
+    if (!behaviorGate('a2a.pushNotifications', a2a?.pushNotifications === true)) return null;
+    const res = await driver.post('/v1/host/sample/a2a/tasks/push-config', { taskId: 'run_x', url });
+    if (res.status === 404 || res.status === 403) {
+      // Previously a bare `return`, invisible to the RFC 0148 §A ledger because
+      // this file's other tests assert — so the file recorded `executed-pass`
+      // while this leg had witnessed nothing. Say why instead.
+      return seamAbsent(
+        'a2a-push-egress-ssrf — the `/v1/host/sample/a2a/tasks/push-config` seam is not mounted (404/403), so neither guard arm is observable',
+      ) ?? null;
+    }
+    return { status: res.status };
+  }
+
+  it('ADDRESS arm: an https pushConfig.url at a private address is refused', async () => {
+    // `https` on purpose: this probe is refusable ONLY by the address arm, so a
+    // host that implements the scheme arm alone cannot pass it by accident.
+    const res = await registerPush('https://10.0.0.5/push');
+    if (res === null) return;
+    expect(
+      res.status >= 400,
+      driver.describe(
+        'a2a-integration.md §D.6 (address arm)',
+        'a2a-push-egress-ssrf — a pushConfig.url at a private/loopback address MUST be refused before any push, even over https',
+      ),
+    ).toBe(true);
+  });
 
-    const res = await driver.post('/v1/host/sample/a2a/tasks/push-config', {
-      taskId: 'run_x',
-      url: 'http://10.0.0.5/push',
-    });
-    if (res.status === 404 || res.status === 403) return; // seam unwired — soft-skip
+  it('SCHEME arm: an http pushConfig.url at a public host is refused', async () => {
+    // Public hostname on purpose: refusable ONLY by the scheme arm.
+    const res = await registerPush('http://push.example.com/push');
+    if (res === null) return;
     expect(
       res.status >= 400,
       driver.describe(
-        'a2a-integration.md §"Async / durable Tasks"',
-        'a2a-push-egress-ssrf — a caller-supplied pushConfig.url at a private/loopback address MUST be refused before any push',
+        'a2a-integration.md §D.6 (scheme arm)',
+        'a2a-push-egress-ssrf — a plaintext `http://` pushConfig.url MUST be refused before any push. '
+          + 'The RFC 0093 webhook-egress guard is the `webhooks.md` §"SSRF protection" list IN FULL, whose first entry is '
+          + '"Non-`https://` protocols". Every prior wording of this requirement abbreviated the guard to its address arm; '
+          + 'COMPATIBILITY.md §3 records this as a Class 3 clarification, so a host failing here was never conforming rather '
+          + 'than newly non-conforming.',
       ),
     ).toBe(true);
   });

package/src/scenarios/agent-channel-dispatch.test.ts

@@ -38,6 +38,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { forkDeclined } from '../lib/fork-availability.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
@@ -149,8 +150,7 @@ describe.skipIf(HTTP_SKIP)('agent-channel-dispatch (RFC 0082 §B): production ru
       `/v1/runs/${encodeURIComponent(sourceRunId)}:fork`,
       { fromSeq: 0, mode: 'replay' },
     );
-    if (fork1.status === 501) {
-      // replay advertised but not implemented for this run — skip-equivalent.
+    if (forkDeclined(fork1.status, 'channel-dispatch replay fork 1')) {
       ctx.skip();
       return;
     }
@@ -213,7 +213,7 @@ describe.skipIf(HTTP_SKIP)('agent-channel-dispatch (RFC 0082 §B): production ru
       `/v1/runs/${encodeURIComponent(sourceRunId)}:fork`,
       { fromSeq: 0, mode: 'replay' },
     );
-    if (fork2.status === 501) {
+    if (forkDeclined(fork2.status, 'channel-dispatch replay fork 2')) {
       ctx.skip();
       return;
     }

package/src/scenarios/conformance-execution-witness.test.ts

@@ -51,6 +51,35 @@ describe('RFC 0148 §A — conformance-execution-witness: the runner record', ()
     expect(resolveFileRecord(['pass'], undefined, 0, { kind: 'skipped', reason: 'operator opt-out' })).toEqual({ disposition: 'skipped', detail: 'operator opt-out' });
   });
 
+  it('gap G8 — a file that asserted then soft-skipped keeps the note as a partial-witness detail, and its disposition does NOT move', () => {
+    // `return softSkip(...)` produces a PASS state, not a skip, so neither the
+    // zero-assertion branch nor the all-skipped branch fires. The note used to be
+    // discarded outright and the row read a bare `executed-pass` — for a
+    // requirement the run may never have reached, because the assertions came
+    // from a positive control or a setup precondition. Measured on this exact
+    // function by a tier-1 host writing a scenario whose first leg is a control.
+    const one = resolveFileRecord(['pass'], undefined, 1, { kind: 'blocked', reason: 'fork returned 501' });
+    expect(one.disposition).toBe('executed-pass');
+    expect(one.detail).toBe('partial-witness: blocked: fork returned 501');
+
+    const many = resolveFileRecord(['pass', 'pass'], undefined, 4, { kind: 'inapplicable', reason: 'fork unsupported' });
+    expect(many.disposition).toBe('executed-pass');
+    expect(many.detail).toBe('partial-witness: inapplicable: fork unsupported');
+
+    // The disposition deliberately does not move: honouring a per-FILE note here
+    // would downgrade a file that legitimately finished its requirement and also
+    // soft-skipped an optional extra leg. The marker makes the rows findable so
+    // the per-`it` fix can follow measurement instead of preceding it.
+    expect(many.disposition).not.toBe('inapplicable');
+
+    // A clean pass is untouched — no note, no marker, no detail at all.
+    expect(resolveFileRecord(['pass', 'pass'], undefined, 7, null)).toEqual({ disposition: 'executed-pass' });
+
+    // A FAILING file keeps its failure; the note must not dress a red as a pass.
+    const red = resolveFileRecord(['pass', 'fail'], undefined, 3, { kind: 'blocked', reason: 'seam 404' });
+    expect(red.disposition).toBe('executed-fail');
+  });
+
   it('every test ctx.skip()ped takes the noted reason when one was written before the skip, else stays the blocked marker', () => {
     // `ctx.skip()` throws — a `softSkip(...)` AFTER it is dead code. Seven files
     // carried exactly that dead note and reported as unclassified for a suite minor.

package/src/scenarios/cross-host-traceparent-propagation.test.ts

@@ -51,17 +51,21 @@ describe('cross-host-traceparent-propagation: behavioral (RFC 0040 §B)', () =>
   // Until the peer harness lands, the assertion is surfaced as `it.skip` so
   // test reporters track the gap rather than reporting a vacuous PASS.
   // Marked out of stable profile via RFC 0042 §B (experimental tier):
-  // RFC 0040 remains Active. Hosts that wire Phase 3 cross-host causation
-  // before RFC 0040 graduates SHOULD advertise
+  // RFC 0040 is Accepted, but the cross-host behavioral scenario stays
+  // experimental until a non-steward host produces the behavioral
+  // traceparent evidence — RFC status (Accepted) and conformance-profile
+  // tier (experimental) are separate axes per RFC 0042 §B. Hosts that wire
+  // Phase 3 cross-host causation SHOULD advertise
   // `multiAgent.executionModel.tier: 'experimental'` per RFC 0042 §A
-  // until cross-host evidence drives the promotion. Path-to-runnable
+  // until that behavioral evidence lands. Path-to-runnable
   // requires the MCP peer harness (OPENWOP_MCP_REAL_SERVER_URL) +
   // inbound-header recorder; flips to a real `it()` on first non-steward
   // Phase 3 host advertising matching capabilities.
   it.skip('Phase 3 host MUST inject parent run\'s traceparent into outbound MCP requests — out of stable profile via RFC 0042');
 
-  // Same routing — out of stable profile via RFC 0042 §B until RFC 0040
-  // graduates to Accepted; behavioral A2A test seam contract still to be
-  // designed alongside the corresponding peer harness.
+  // Same routing — out of stable profile via RFC 0042 §B until behavioral
+  // A2A cross-host evidence lands (RFC 0040 itself is already Accepted); the
+  // A2A test seam contract is still to be designed alongside the
+  // corresponding peer harness.
   it.skip('Phase 3 host MUST inject parent run\'s traceparent into outbound A2A messages — out of stable profile via RFC 0042');
 });