@openwop/openwop-conformance 1.138.1 → 1.139.0

package/README.md

@@ -78,7 +78,7 @@ Run `npm run test` for normal CI cadence; `npm run test:strict` when claiming fu
 | `OPENWOP_OTEL_COLLECTOR_GRPC=true`        | Boots the parallel OTLP/gRPC collector alongside the HTTP one (h2c HTTP/2 on a separate port). Shares the same `spans()` + `metrics()` store; spans captured over either transport surface in `getCollector().spans()`. Requires `OPENWOP_OTEL_COLLECTOR=true`. Same `--no-file-parallelism` requirement applies.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `OPENWOP_OTEL_COLLECTOR_GRPC_PORT=4317`   | Bind the OTLP/gRPC collector on a specific port (default `4317`, OTLP/gRPC convention). The host MUST be configured with `OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:<port>` AND `OTEL_EXPORTER_OTLP_PROTOCOL=grpc`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `OPENWOP_OTEL_COLLECTOR_PORT=14318`       | Bind the OTel collector on a specific port (default `4318`). The host MUST be configured with `OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:<port>`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `OPENWOP_WEBHOOK_ALLOW_PRIVATE=true`      | Hosts implementing the webhook SSRF guard (rejecting loopback / RFC1918 / link-local destinations) MUST advertise this flag for the loopback test receiver in `webhook-signed-delivery.test.ts` to be accepted. The SQLite reference host honors this env var; the scenario soft-skips when the host rejects the URL.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `OPENWOP_WEBHOOK_ALLOW_PRIVATE=true`      | Relaxes the webhook egress guard for the loopback test receiver used by `webhook-signed-delivery.test.ts`, `webhook-negative.test.ts`, and `replay-fanout-suppression.test.ts`. **The receiver is `http://127.0.0.1:{port}/`, which `webhooks.md` forbids three separate times, and the opt-in MUST relax all three to be witnessable:** (1) the **scheme** check — §"SSRF protection" bullet 1 rejects non-`https://`, and this gate fires FIRST on a host that validates scheme before address; (2) the **registration-time** address check — §"SSRF protection"; and (3) **delivery-time re-resolution** — §"Delivery-time egress validation (RFC 0093)". Gates 2 and 3 are independent MUSTs at different layers, so an opt-in reaching only one layer **cannot** produce a witness: delivery-only leaves registration returning `400 webhook_url_rejected`, registration-only leaves the dispatcher refusing to connect. A host whose opt-in reaches one layer is **not** non-conformant — it cannot witness these scenarios, which is a property of the test posture and not of its webhook signing. The scheme gate went unstated here until 2026-08-25; a tier-2 host validating scheme-then-address was blocked by a gate the documented contract never named. Relaxing gates 2 and 3 is **test-only posture** — see `SECURITY/threat-model-secret-leakage.md` §4.9 for why a registration-time relaxation is the more dangerous of the two. When the host rejects, the scenario records `blocked` (RFC 0148 §A), not a pass.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `OPENWOP_MCP_FAKE_SERVER=true`            | Boots the synthetic MCP peer for `mcp-tool-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `OPENWOP_MCP_REAL_SERVER_URL=<base-url>`  | Points the MCP wire-shape probe at a real MCP server. The probe POSTs JSON-RPC and reads a single-JSON response — matches MCP's `streamable-http` transport in single-response mode. **Does NOT support** stdio transport (which is what most `modelcontextprotocol/servers` references default to) or SSE-streamed responses; an operator collecting interop evidence today runs a custom `StreamableHTTPServerTransport`-style server that returns a single JSON body per request. Adding SSE-frame parsing is tracked in `docs/PROTOCOL-GAP-CLOSURE-PLAN.md` Track 6. Assertions relax to shape-only. When both this and `OPENWOP_MCP_FAKE_SERVER` are set, the real URL wins. Phase 3 T3.4 interop-evidence path.                                                                                                               |
 | `OPENWOP_A2A_FAKE_PEER=true`              | Boots the synthetic A2A peer for `a2a-task-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

package/coverage.md

@@ -1,6 +1,6 @@
 # OpenWOP Conformance Coverage Map
 
-> **Status: Living document. Updated 2026-06-29.** This map connects the current scenario files to the protocol surfaces they protect and records the remaining gaps from the protocol deep dive. Scenario names are source-of-truth file names under `conformance/src/scenarios/`.
+> **Status: Living document. Updated 2026-08-25.** This map connects the current scenario files to the protocol surfaces they protect and records the remaining gaps from the protocol deep dive. Scenario names are source-of-truth file names under `conformance/src/scenarios/`.
 
 > **Shape grade vs behavior grade.** Some optional-profile scenarios validate **capability shape** (the host's discovery advertisement is well-formed) without yet exercising **behavior** (the host actually implements the profile end-to-end). The "Current grade" column reflects shape; see §"Capability-gated scenarios: shape vs behavior" below for the dual-grade view and the `OPENWOP_REQUIRE_BEHAVIOR=true` strict-mode runner flag.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.138.1",
+  "version": "1.139.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.138.1",
-  "corpusCommit": "3555363038ce8ea7e40dc2f2a41c39066228e69c"
+  "suiteVersion": "1.139.0",
+  "corpusCommit": "f34a41ac4c1737ca8af34d0f7f17876268f58e69"
 }

package/src/global-setup.ts

@@ -0,0 +1,169 @@
+/**
+ * Run-end disposition summary (RFC 0148 §A, 2026-08-25).
+ *
+ * ## The gap this closes
+ *
+ * Every scenario file already records ONE honest disposition when it
+ * finishes (`setup.ts`'s `afterAll` → `resolveFileRecord`): a file that
+ * returned early with zero assertions is `blocked` / `skipped` /
+ * `inapplicable` with a reason, never a pass. That machinery is correct.
+ *
+ * It was **published on one invocation out of two**. The worker appends
+ * each recording to `OPENWOP_LEDGER_PATH`, and the ONLY writer of that
+ * variable was `cli.ts` inside `runCertify`. Under a plain `vitest run`
+ * — what `README.md` documents for host operators, and what host
+ * implementers actually run — the worker computed `blocked`, held it in
+ * memory, and discarded it at process exit. The single surviving artifact
+ * was vitest's `1 passed`.
+ *
+ * So the suite computed an honest disposition on every run and published
+ * it on one. Two host implementers independently read the console line as
+ * coverage and reported the suite as claiming a pass it had internally
+ * classified `blocked` — correctly, given the only artifact they had.
+ * RFC 0158 §"Operator preconditions are declared, not hidden" requires a
+ * blocked row be surfaced "never silently skipped or reported as a pass";
+ * the bundle honored that and the console contradicted it.
+ *
+ * ## What this does
+ *
+ * When `OPENWOP_LEDGER_PATH` is unset, point it at a temp file so the
+ * workers record there anyway, then read it at run end and print a
+ * summary. `--certify` sets the variable itself, so this defers to it
+ * completely and never interferes with bundle generation.
+ *
+ * The summary is deliberately NOT a pass/fail signal — it does not change
+ * the exit code. `vitest`'s exit code answers "did any assertion fail";
+ * this answers "what did the run actually witness", and those are
+ * different questions. Conflating them is what produced the gap.
+ *
+ * Set `OPENWOP_DISPOSITION_SUMMARY=false` to silence it.
+ */
+
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+/** Dispositions that are NOT a witnessed execution — the rows worth printing. */
+const NON_EXECUTING = new Set(['blocked', 'skipped', 'inapplicable']);
+
+/** Cap on printed rows; the overflow is always announced, never silent. */
+const MAX_ROWS = 40;
+
+// Import the REAL entry type rather than restating its shape. A hand-written
+// structural guess here read `entry.id` — a key the ledger has never written
+// (it is `requirementId`) — and the `(unnamed)` fallback made the mismatch
+// look like missing data instead of a wrong reader. A type-only import erases
+// at runtime, so this costs nothing and makes the compiler the oracle: rename
+// a ledger field and this file stops building instead of silently degrading.
+import type { LedgerEntry } from './lib/requirement-ledger.js';
+
+/** What a JSONL line parses to before validation — every field may be absent. */
+type LedgerLine = Partial<Record<keyof LedgerEntry, unknown>>;
+
+let ownedDir: string | null = null;
+let ledgerPath: string | null = null;
+
+export function setup(): void {
+  if (process.env['OPENWOP_DISPOSITION_SUMMARY'] === 'false') return;
+  // `--certify` already routes the ledger to its own report dir and reads it
+  // there. Never take it over — this exists only for the path that had no
+  // reader at all.
+  if ((process.env['OPENWOP_LEDGER_PATH'] ?? '') !== '') return;
+  ownedDir = mkdtempSync(join(tmpdir(), 'owp-dispositions-'));
+  ledgerPath = join(ownedDir, 'requirement-ledger.jsonl');
+  process.env['OPENWOP_LEDGER_PATH'] = ledgerPath;
+}
+
+/**
+ * Fold raw JSONL into the printable summary. PURE — no I/O, no env — so
+ * `global-setup.test.ts` can pin it without a vitest subprocess or a host.
+ * Returns `null` when there is nothing to say.
+ */
+export function summarise(raw: string): string | null {
+  const counts = new Map<string, number>();
+  const rows: Array<{ id: string; disposition: string; detail: string }> = [];
+  for (const line of raw.split('\n')) {
+    if (line.trim() === '') continue;
+    let entry: LedgerLine;
+    try {
+      entry = JSON.parse(line) as LedgerLine;
+    } catch {
+      continue;
+    }
+    const disposition = typeof entry.disposition === 'string' ? entry.disposition : 'unknown';
+    const id = typeof entry.requirementId === 'string' ? entry.requirementId : '(unnamed)';
+    const detail = typeof entry.detail === 'string' ? entry.detail : '';
+    counts.set(disposition, (counts.get(disposition) ?? 0) + 1);
+    if (NON_EXECUTING.has(disposition)) {
+      rows.push({ id, disposition, detail });
+    } else if (disposition === 'executed-pass' && entry.assertionCount === 0) {
+      // The other shape RFC 0148 §A rejects: a pass that asserted nothing.
+      rows.push({ id, disposition: 'executed-pass (0 assertions)', detail });
+    }
+  }
+  if (counts.size === 0) return null;
+  const total = [...counts.values()].reduce((a, b) => a + b, 0);
+  const order = ['executed-pass', 'executed-fail', 'blocked', 'skipped', 'inapplicable'];
+  const summary = [...order, ...[...counts.keys()].filter((k) => !order.includes(k))]
+    .filter((k) => counts.has(k))
+    .map((k) => `${k} ${counts.get(k)}`)
+    .join(' \u00b7 ');
+  const out: string[] = [
+    '',
+    `[openwop-conformance] RFC 0148 \u00a7A dispositions \u2014 ${total} requirement(s) recorded`,
+    `  ${summary}`,
+  ];
+  if (rows.length > 0) {
+    out.push(
+      `  ${rows.length} requirement(s) did NOT witness. vitest reports these as passes because`,
+      '  no assertion failed; that is a test outcome, not a conformance disposition.',
+    );
+    for (const r of rows.slice(0, MAX_ROWS)) {
+      const detail = r.detail.length > 120 ? `${r.detail.slice(0, 117)}...` : r.detail;
+      out.push(`    ${r.disposition.padEnd(28)} ${r.id}${detail === '' ? '' : `\n      ${detail}`}`);
+    }
+    if (rows.length > MAX_ROWS) {
+      // Never truncate silently: a capped list that does not say it was capped
+      // reads as a complete one, which is the same defect this whole summary
+      // exists to remove.
+      out.push(`    ... and ${rows.length - MAX_ROWS} more not listed (run with --certify for the full bundle)`);
+    }
+  }
+  out.push('');
+  return out.join('\n');
+}
+
+export function teardown(): void {
+  if (ledgerPath === null || ownedDir === null) return;
+  // We set the variable; unset it so a subsequent in-process run re-derives.
+  delete process.env['OPENWOP_LEDGER_PATH'];
+  let raw = '';
+  try {
+    raw = readFileSync(ledgerPath, 'utf8');
+  } catch {
+    // No file means no worker ever recorded \u2014 nothing to summarise, and a
+    // missing summary must never be mistaken for "nothing was blocked", so
+    // say so rather than printing an empty clean bill.
+    process.stderr.write(
+      '\n[openwop-conformance] no disposition ledger was written \u2014 the run recorded nothing, ' +
+        'which is NOT the same as every scenario having witnessed its requirement.\n',
+    );
+    cleanup();
+    return;
+  }
+  const text = summarise(raw);
+  if (text !== null) process.stderr.write(text);
+  cleanup();
+}
+
+function cleanup(): void {
+  if (ownedDir !== null) {
+    try {
+      rmSync(ownedDir, { recursive: true, force: true });
+    } catch {
+      /* best effort */
+    }
+  }
+  ownedDir = null;
+  ledgerPath = null;
+}

package/src/lib/fork-availability.test.ts

@@ -0,0 +1,69 @@
+/**
+ * Pins `forkDeclined` (RFC 0148 §A).
+ *
+ * The risk in a helper like this is not that it misses a status — that shows up
+ * as a red test somebody investigates. It is that it swallows one: every status
+ * it accepts turns an assertion into a skip, silently, and a suite that skips
+ * is indistinguishable from a suite that passes unless something records why.
+ * So the load-bearing cases here are the NEGATIVE ones.
+ */
+
+import { describe, expect, it, beforeEach } from 'vitest';
+import { forkDeclined } from './fork-availability.js';
+import { resetSoftSkips, softSkipDisposition } from './soft-skip.js';
+
+describe('forkDeclined', () => {
+  beforeEach(() => resetSoftSkips());
+
+  it('treats 404 and 403 the same as 501 — route absent is not weaker than route-declines', () => {
+    // The asymmetry this fixes: every replay scenario handled 501 and none
+    // handled 404. `501` means "I know this route and decline"; `404` means
+    // "there is no such route" — strictly less implemented. The suite treated
+    // the weaker signal as a skip and the stronger one as a defect, so a host
+    // had to implement the route in order to say it had not implemented it.
+    for (const status of [404, 403, 501]) {
+      expect(forkDeclined(status, 'leg'), `status ${status} means the fork did not happen`).toBe(true);
+    }
+  });
+
+  it('does NOT swallow any other status — a 500 is still a defect, not a skip', () => {
+    // If this ever goes green for one of these, a real failure has become a
+    // silent skip and no assertion downstream will ever run again.
+    for (const status of [200, 201, 202, 400, 409, 422, 500, 502, 503]) {
+      expect(forkDeclined(status, 'leg'), `status ${status} must reach the assertion`).toBe(false);
+    }
+  });
+
+  it('records WHY, so the ledger row is not an unclassified return', () => {
+    // Two of the eleven original call sites were a bare `return`. A bare return
+    // in a file whose OTHER tests assert is invisible: the file records
+    // `executed-pass` and the leg that never ran leaves no trace.
+    forkDeclined(404, 'fanout-suppression replay fork');
+    const noted = softSkipDisposition('fork-availability.test.ts');
+    expect(noted?.kind).toBe('blocked');
+    expect(noted?.reason).toContain('404');
+    expect(noted?.reason).toContain('fanout-suppression replay fork');
+    expect(noted?.reason).toContain('not mounted');
+  });
+
+  it('records nothing when the status is not a decline', () => {
+    forkDeclined(201, 'leg');
+    expect(softSkipDisposition('fork-availability.test.ts')).toBeNull();
+  });
+
+  it('names the leg, so one file with several forks stays attributable', () => {
+    forkDeclined(501, 'branch fork');
+    expect(softSkipDisposition('fork-availability.test.ts')?.reason).toContain('branch fork');
+  });
+
+  it('distinguishes the three declines in its reason text', () => {
+    forkDeclined(404, 'a');
+    const a = softSkipDisposition('fork-availability.test.ts')?.reason ?? '';
+    resetSoftSkips();
+    forkDeclined(501, 'a');
+    const b = softSkipDisposition('fork-availability.test.ts')?.reason ?? '';
+    // `blocked` alone does not tell a bundle reader whether the host lacks the
+    // route or declines the range; the reason must.
+    expect(a).not.toBe(b);
+  });
+});

package/src/lib/fork-availability.ts

@@ -0,0 +1,61 @@
+/**
+ * "The fork seam did not run" — one rule, one place (RFC 0148 §A).
+ *
+ * `POST /v1/runs/{runId}:fork` can decline in more than one way, and eleven
+ * call sites across six scenarios each decided for themselves which ways
+ * counted:
+ *
+ *   - **501** — every site handled this. "Advertised but not implemented for
+ *     this range", per the suite convention their comments cite.
+ *   - **404 / 403** — *no* site in the replay family handled it. A host that
+ *     never mounts the route hard-failed `expect(status).toBe(201)`.
+ *
+ * That asymmetry is backwards. `501` means "I know this route and decline";
+ * `404` means "there is no such route" — strictly less implemented, and the
+ * suite treated the weaker signal as a skip and the stronger one as a defect.
+ * The postgres reference host 404s, so `replay-fanout-suppression` was red in
+ * CI on every run while the other four replay scenarios skipped past the same
+ * seam for unrelated fixture reasons. **The suite required a host to implement
+ * the route in order to say it had not implemented the route.**
+ *
+ * Recording matters as much as the predicate. Two of those eleven sites were a
+ * bare `return` with no note: `replay-fork.test.ts` reported "6 tests | 6
+ * skipped" against a host whose fork surface is entirely unmeasured, and the
+ * ledger had nothing to say about why. §A resolves an unclassified return to
+ * `blocked`, but only when the file records nothing at all — a bare return in a
+ * file whose *other* tests assert is invisible.
+ *
+ * Disposition is `blocked`, not `inapplicable`: the obligation applies to this
+ * host, it simply could not be witnessed. `inapplicable` would claim the host
+ * is outside the requirement's scope, which nothing here establishes — these
+ * scenarios carry no capability gate, so the suite does not actually know
+ * whether the host advertises fork. Saying `blocked` is the claim the evidence
+ * supports.
+ */
+
+import { softSkip } from './soft-skip.js';
+
+/** Statuses that mean "the fork did not happen", with what each one tells us. */
+const DECLINED: ReadonlyMap<number, string> = new Map([
+  [404, 'the route is not mounted on this host'],
+  [403, 'the caller is not permitted to fork (route present, access refused)'],
+  [501, 'the host knows the route and declines this range as not implemented'],
+]);
+
+/**
+ * True when `status` means the fork seam did not run — and records WHY for the
+ * RFC 0148 §A ledger as a side effect, so a caller can `if (forkDeclined(...))
+ * return;` without leaving an unclassified return behind.
+ *
+ * `where` names the leg, so a bundle reader can tell which of several forks in
+ * one file declined.
+ */
+export function forkDeclined(status: number, where: string): boolean {
+  const why = DECLINED.get(status);
+  if (why === undefined) return false;
+  softSkip(
+    'blocked',
+    `${where}: POST /v1/runs/{runId}:fork returned ${status} — ${why}, so the behaviour this requirement is stated over never occurred and its absence below would prove nothing`,
+  );
+  return true;
+}

package/src/lib/global-setup.test.ts

@@ -0,0 +1,76 @@
+/**
+ * Pins the run-end disposition summary (`src/global-setup.ts`, RFC 0148 §A).
+ *
+ * The defect this guards is not "the summary is ugly" — it is that the suite
+ * computed an honest disposition on every run and PUBLISHED it on one. Two
+ * host implementers read vitest's `1 passed` as coverage for a requirement the
+ * suite had internally classified `blocked`, because the classification had no
+ * reader outside `--certify`.
+ *
+ * Server-free and pure: `summarise` takes the raw JSONL and returns the text.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { summarise } from '../global-setup.js';
+
+const line = (o: Record<string, unknown>): string => JSON.stringify(o);
+
+describe('global-setup: RFC 0148 §A disposition summary', () => {
+  it('reads the ledger key the ledger actually writes (`requirementId`, not `id`)', () => {
+    // Regression: the first draft of this reader keyed on `entry.id`, a field
+    // `recordRequirement` has never written, and fell back to `(unnamed)`.
+    // The fallback made a WRONG READER look like MISSING DATA — the same
+    // failure shape the summary exists to expose, reproduced in the exposer.
+    const out = summarise(
+      line({ requirementId: 'openwop.scenario.webhook-signed-delivery', disposition: 'blocked', detail: 'guard rejected loopback' }),
+    );
+    expect(out).toContain('openwop.scenario.webhook-signed-delivery');
+    expect(out).not.toContain('(unnamed)');
+  });
+
+  it('lists blocked / skipped / inapplicable as NOT witnessed, with the reason', () => {
+    const out = summarise(
+      [
+        line({ requirementId: 'a', disposition: 'blocked', detail: 'seam absent' }),
+        line({ requirementId: 'b', disposition: 'skipped', detail: 'operator opted out' }),
+        line({ requirementId: 'c', disposition: 'inapplicable', detail: 'profile not advertised' }),
+      ].join('\n'),
+    );
+    expect(out).toContain('did NOT witness');
+    for (const s of ['seam absent', 'operator opted out', 'profile not advertised']) {
+      expect(out).toContain(s);
+    }
+  });
+
+  it('flags an executed-pass that asserted nothing — the other RFC 0148 §A vacuity shape', () => {
+    const out = summarise(line({ requirementId: 'vacuous', disposition: 'executed-pass', assertionCount: 0 }));
+    expect(out).toContain('executed-pass (0 assertions)');
+    expect(out).toContain('vacuous');
+  });
+
+  it('does NOT flag a real executed-pass', () => {
+    const out = summarise(line({ requirementId: 'real', disposition: 'executed-pass', assertionCount: 12 }));
+    expect(out).toContain('executed-pass 1');
+    expect(out).not.toContain('did NOT witness');
+  });
+
+  it('announces truncation rather than capping silently', () => {
+    // A capped list that does not say it was capped reads as a complete one.
+    const many = Array.from({ length: 45 }, (_, i) =>
+      line({ requirementId: `r${i}`, disposition: 'blocked', detail: 'why' }),
+    ).join('\n');
+    const out = summarise(many);
+    expect(out).toContain('5 more not listed');
+  });
+
+  it('returns null on an empty ledger so teardown prints nothing', () => {
+    expect(summarise('')).toBeNull();
+    expect(summarise('\n\n')).toBeNull();
+  });
+
+  it('skips unparseable lines without discarding the rest of the run', () => {
+    const out = summarise(['{ not json', line({ requirementId: 'ok', disposition: 'blocked', detail: 'r' })].join('\n'));
+    expect(out).toContain('ok');
+    expect(out).toContain('blocked 1');
+  });
+});

package/src/scenarios/a2a-task-roundtrip.test.ts

@@ -47,6 +47,7 @@ import { pollUntilTerminal, pollUntilStatus } from '../lib/polling.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { seamAbsent } from '../lib/soft-skip.js';
 
 /**
  * Callback-shaped: the host issues A2A JSON-RPC calls to the suite's fake peer.
@@ -403,21 +404,76 @@ describe.skipIf(HTTP_SKIP)('a2a-task-roundtrip: durable tasks/get after disconne
   });
 });
 
-describe.skipIf(HTTP_SKIP)('a2a-task-roundtrip: push-config SSRF (gated on a2a.pushNotifications; RFC 0100)', () => {
-  it('registering a pushConfig.url at a private address is refused (a2a-push-egress-ssrf)', async () => {
+/**
+ * Push-config SSRF, TWO-SIDED (RFC 0100 §4, a2a-integration.md §D.6).
+ *
+ * The RFC 0093 webhook-egress guard has two arms — `webhooks.md`
+ * §"SSRF protection" rejects non-`https://` protocols AND private/loopback/
+ * link-local/ULA/metadata addresses — and a host may implement either one
+ * alone.
+ *
+ * Until 2026-08-25 this file probed with a single `http://10.0.0.5/push`,
+ * which **violates both arms at once**. Either arm alone refuses it, so a
+ * `>= 400` witnessed *that something refused* and never *which guard ran*.
+ * A host with only the address arm passed; so did a host with only the
+ * scheme arm; so would a host that refused every push URL for an unrelated
+ * reason. The assertion was real and the conclusion drawn from it was not.
+ *
+ * The probes below isolate one arm each: `https` at a private address can
+ * only be refused by the address arm, and `http` at a public host can only
+ * be refused by the scheme arm. Two legs is the minimum that distinguishes
+ * them — the same reason a negative control is not optional.
+ *
+ * The scheme leg is new, and the obligation it checks was previously stated
+ * only by reference (every prior wording abbreviated the guard to its
+ * address arm). `COMPATIBILITY.md` §3 records the Class 3 classification: a
+ * host accepting a plaintext push target was never conforming. An
+ * implementer reddened by this leg is reading a clarification, not a new
+ * requirement — the failure message says so.
+ */
+describe.skipIf(HTTP_SKIP)('a2a-task-roundtrip: push-config SSRF, two-sided (gated on a2a.pushNotifications; RFC 0100)', () => {
+  async function registerPush(url: string): Promise<{ status: number } | null> {
     const a2a = await readCapabilityFamily<{ pushNotifications?: boolean }>('a2a');
-    if (!behaviorGate('a2a.pushNotifications', a2a?.pushNotifications === true)) return;
+    if (!behaviorGate('a2a.pushNotifications', a2a?.pushNotifications === true)) return null;
+    const res = await driver.post('/v1/host/sample/a2a/tasks/push-config', { taskId: 'run_x', url });
+    if (res.status === 404 || res.status === 403) {
+      // Previously a bare `return`, invisible to the RFC 0148 §A ledger because
+      // this file's other tests assert — so the file recorded `executed-pass`
+      // while this leg had witnessed nothing. Say why instead.
+      return seamAbsent(
+        'a2a-push-egress-ssrf — the `/v1/host/sample/a2a/tasks/push-config` seam is not mounted (404/403), so neither guard arm is observable',
+      ) ?? null;
+    }
+    return { status: res.status };
+  }
+
+  it('ADDRESS arm: an https pushConfig.url at a private address is refused', async () => {
+    // `https` on purpose: this probe is refusable ONLY by the address arm, so a
+    // host that implements the scheme arm alone cannot pass it by accident.
+    const res = await registerPush('https://10.0.0.5/push');
+    if (res === null) return;
+    expect(
+      res.status >= 400,
+      driver.describe(
+        'a2a-integration.md §D.6 (address arm)',
+        'a2a-push-egress-ssrf — a pushConfig.url at a private/loopback address MUST be refused before any push, even over https',
+      ),
+    ).toBe(true);
+  });
 
-    const res = await driver.post('/v1/host/sample/a2a/tasks/push-config', {
-      taskId: 'run_x',
-      url: 'http://10.0.0.5/push',
-    });
-    if (res.status === 404 || res.status === 403) return; // seam unwired — soft-skip
+  it('SCHEME arm: an http pushConfig.url at a public host is refused', async () => {
+    // Public hostname on purpose: refusable ONLY by the scheme arm.
+    const res = await registerPush('http://push.example.com/push');
+    if (res === null) return;
     expect(
       res.status >= 400,
       driver.describe(
-        'a2a-integration.md §"Async / durable Tasks"',
-        'a2a-push-egress-ssrf — a caller-supplied pushConfig.url at a private/loopback address MUST be refused before any push',
+        'a2a-integration.md §D.6 (scheme arm)',
+        'a2a-push-egress-ssrf — a plaintext `http://` pushConfig.url MUST be refused before any push. '
+          + 'The RFC 0093 webhook-egress guard is the `webhooks.md` §"SSRF protection" list IN FULL, whose first entry is '
+          + '"Non-`https://` protocols". Every prior wording of this requirement abbreviated the guard to its address arm; '
+          + 'COMPATIBILITY.md §3 records this as a Class 3 clarification, so a host failing here was never conforming rather '
+          + 'than newly non-conforming.',
       ),
     ).toBe(true);
   });

package/src/scenarios/agent-channel-dispatch.test.ts

@@ -38,6 +38,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { forkDeclined } from '../lib/fork-availability.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
@@ -149,8 +150,7 @@ describe.skipIf(HTTP_SKIP)('agent-channel-dispatch (RFC 0082 §B): production ru
       `/v1/runs/${encodeURIComponent(sourceRunId)}:fork`,
       { fromSeq: 0, mode: 'replay' },
     );
-    if (fork1.status === 501) {
-      // replay advertised but not implemented for this run — skip-equivalent.
+    if (forkDeclined(fork1.status, 'channel-dispatch replay fork 1')) {
       ctx.skip();
       return;
     }
@@ -213,7 +213,7 @@ describe.skipIf(HTTP_SKIP)('agent-channel-dispatch (RFC 0082 §B): production ru
       `/v1/runs/${encodeURIComponent(sourceRunId)}:fork`,
       { fromSeq: 0, mode: 'replay' },
     );
-    if (fork2.status === 501) {
+    if (forkDeclined(fork2.status, 'channel-dispatch replay fork 2')) {
       ctx.skip();
       return;
     }

package/src/scenarios/replay-fanout-suppression.test.ts

@@ -72,7 +72,8 @@ import { afterEach, describe, expect, it } from 'vitest';
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
-import { discoveryFamilies } from '../lib/discovery-capabilities.js';
+import { forkDeclined } from '../lib/fork-availability.js';
+import { discoveryFamilies, readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { pollUntilTerminal, scaledTimeoutMs } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { discoverOwnedTenant } from '../lib/webhook-receiver.js';
@@ -213,18 +214,50 @@ describe('replay-fanout-suppression: a replay fork MUST NOT fan out re-emitted e
       ),
     ).toBeGreaterThan(0);
 
+    // ── CAPABILITY GATE (added 2026-08-25) ──────────────────────────────────
+    // This is the ONLY scenario in the replay family that never checked whether
+    // the host advertises replay before forking — every sibling reads
+    // `replay.supported` first. That omission is why it was the one scenario
+    // reaching the fork seam on a host that does not implement it, and why it
+    // hard-failed `expected 404 to be 201` on every CI run of `main` while the
+    // siblings quietly returned at their capability check.
+    //
+    // `inapplicable`, not `blocked`: a host that does not advertise replay is
+    // outside this MUST NOT's scope entirely, and `blocked` would claim the
+    // requirement applies but could not be witnessed — a stronger claim than
+    // the evidence supports. Recorded explicitly because LEG 1 above asserted,
+    // so the file-level disposition would otherwise be `executed-pass`.
+    const replayCap = await readCapabilityFamily<{ supported?: boolean; modes?: unknown }>('replay');
+    if (replayCap?.supported !== true) {
+      recordRequirement(
+        REQUIREMENT_ID,
+        'inapplicable',
+        'host does not advertise `replay.supported: true`, so a replay fork cannot occur and this MUST NOT '
+          + 'has nothing to constrain on this host',
+      );
+      ctx.skip();
+      return;
+    }
+
     // ── LEG 2 — THE MUST NOT. A replay fork re-emits; it must not deliver. ───
     const replay = await driver.post(`/v1/runs/${encodeURIComponent(sourceRunId)}:fork`, {
       mode: 'replay',
     });
-    if (replay.status === 501) {
-      // Advertised but not implemented for this range. Leg 1 already asserted,
-      // so the FILE is `executed-pass` — but the MUST NOT was never exercised,
-      // and that is what this row must say.
+    if (forkDeclined(replay.status, 'fanout-suppression replay fork')) {
+      // Leg 1 already asserted, so the FILE is `executed-pass` — but the MUST
+      // NOT was never exercised, and that is what this row must say. The
+      // explicit record wins over the file-level one (setup.ts).
+      //
+      // 404 and 403 were NOT handled here until 2026-08-25, only 501. The
+      // postgres reference host 404s this route, so this was the one scenario
+      // in the replay family that actually reached the seam — and it hard-
+      // failed `expected 404 to be 201` on every CI run of `main`, absorbed by
+      // the 85% pass-rate floor. The suite required a host to implement the
+      // route in order to say it had not implemented the route.
       recordRequirement(
         REQUIREMENT_ID,
         'blocked',
-        'replay fork returned 501 — the re-emission this requirement is stated over never happened, '
+        `replay fork returned ${replay.status} — the re-emission this requirement is stated over never happened, `
           + 'so the absence of deliveries below would prove nothing',
       );
       ctx.skip();

package/src/scenarios/replay-fork-arbitrary.test.ts

@@ -30,6 +30,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { forkDeclined } from '../lib/fork-availability.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 
@@ -122,6 +124,7 @@ describe.skipIf(SKIP_NO_MULTI)(
     it('mid-fromSeq replay fork produces a new run that reaches `completed`', async (ctx) => {
       const replay = await fetchReplayCapability();
       if (replay?.supported !== true) {
+        softSkip('inapplicable', "host does not advertise `replay.supported: true` — the replay contract does not apply to it");
         ctx.skip();
         return;
       }
@@ -129,6 +132,7 @@ describe.skipIf(SKIP_NO_MULTI)(
         ? replay.modes.filter((m): m is string => typeof m === 'string')
         : [];
       if (!modes.includes('replay')) {
+        softSkip('inapplicable', "host does not advertise the `replay` fork mode — this leg's rule has no path to apply");
         ctx.skip();
         return;
       }
@@ -140,6 +144,7 @@ describe.skipIf(SKIP_NO_MULTI)(
         // Fixture's wire shape doesn't expose node.completed(b) with a
         // numeric sequence — skip rather than fail. Conformant hosts
         // with the standard event shape will hit the assertions below.
+        softSkip('blocked', "the advertised fixture's wire shape exposes no numeric sequence for node.completed(b), so there is no mid-run point to fork from");
         ctx.skip();
         return;
       }
@@ -149,7 +154,7 @@ describe.skipIf(SKIP_NO_MULTI)(
         { fromSeq, mode: 'replay' },
       );
 
-      if (fork.status === 501) {
+      if (forkDeclined(fork.status, 'arbitrary-event fork')) {
         ctx.skip();
         return;
       }
@@ -226,7 +231,7 @@ describe.skipIf(SKIP_NO_MULTI)(
           `/v1/runs/${encodeURIComponent(sourceRunId)}:fork`,
           { fromSeq, mode: 'replay' },
         );
-        if (fork1.status === 501) {
+        if (forkDeclined(fork1.status, 'arbitrary-event fork 1')) {
           ctx.skip();
           return;
         }
@@ -238,7 +243,7 @@ describe.skipIf(SKIP_NO_MULTI)(
           `/v1/runs/${encodeURIComponent(sourceRunId)}:fork`,
           { fromSeq, mode: 'replay' },
         );
-        if (fork2.status === 501) {
+        if (forkDeclined(fork2.status, 'arbitrary-event fork 2')) {
           ctx.skip();
           return;
         }
@@ -294,6 +299,7 @@ describe.skipIf(SKIP_NO_MULTI)(
     it('mid-fromSeq branch fork with empty overlay produces a new run that reaches `completed`', async (ctx) => {
       const replay = await fetchReplayCapability();
       if (replay?.supported !== true) {
+        softSkip('inapplicable', "host does not advertise `replay.supported: true` — the replay contract does not apply to it");
         ctx.skip();
         return;
       }

package/src/scenarios/replay-fork.test.ts

@@ -25,6 +25,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { forkDeclined } from '../lib/fork-availability.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 
@@ -60,6 +62,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay: fork from fromSeq=0 in replay mode', () =
       // Visible skip — earlier this was a silent `return` that
       // collapsed to a vacuous pass and made it impossible to tell
       // unexercised tests apart from honest passes.
+      softSkip('inapplicable', "host does not advertise the `replay` fork mode — this leg's rule has no path to apply");
       ctx.skip();
       return;
     }
@@ -70,7 +73,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay: fork from fromSeq=0 in replay mode', () =
       { fromSeq: 0, mode: 'replay' },
     );
 
-    if (fork.status === 501) return; // mode advertised but not implemented; skip-equivalent
+    if (forkDeclined(fork.status, 'replay fork')) return;
     expect(fork.status, driver.describe(
       'rest-endpoints.md POST /v1/runs/{runId}:fork',
       'fork MUST return 201 on accepted replay',
@@ -101,6 +104,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay: fork from fromSeq=0 in branch mode with e
   it('produces a new run that reaches terminal `completed`', async (ctx) => {
     const modes = await fetchReplayModes();
     if (!modes.includes('branch')) {
+      softSkip('inapplicable', "host does not advertise the `branch` fork mode — this leg's rule has no path to apply");
       ctx.skip();
       return;
     }
@@ -111,7 +115,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay: fork from fromSeq=0 in branch mode with e
       { fromSeq: 0, mode: 'branch', runOptionsOverlay: {} },
     );
 
-    if (fork.status === 501) return; // mode advertised but not implemented; skip-equivalent
+    if (forkDeclined(fork.status, 'branch fork')) return;
     expect(fork.status, driver.describe(
       'rest-endpoints.md POST /v1/runs/{runId}:fork',
       'branch fork MUST return 201',
@@ -137,6 +141,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay: validation errors', () => {
   it('rejects negative fromSeq with 400', async (ctx) => {
     const modes = await fetchReplayModes();
     if (modes.length === 0) {
+      softSkip('inapplicable', "host advertises no usable fork mode for this leg");
       ctx.skip();
       return;
     }
@@ -155,6 +160,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay: validation errors', () => {
   it('rejects fromSeq beyond source event log length with 422', async (ctx) => {
     const modes = await fetchReplayModes();
     if (modes.length === 0) {
+      softSkip('inapplicable', "host advertises no usable fork mode for this leg");
       ctx.skip();
       return;
     }
@@ -179,6 +185,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay: validation errors', () => {
       // → 400) only applies on hosts that advertise the `replay` mode.
       // A `branch`-only host has no path to even attempt the request.
       // Visible skip rather than silent vacuous pass.
+      softSkip('inapplicable', "host does not advertise the `replay` fork mode — the runOptionsOverlay rejection rule only applies to hosts that do");
       ctx.skip();
       return;
     }
@@ -200,6 +207,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay: validation errors', () => {
   it('rejects fork on a non-existent run with 404', async (ctx) => {
     const modes = await fetchReplayModes();
     if (modes.length === 0) {
+      softSkip('inapplicable', "host advertises no usable fork mode for this leg");
       ctx.skip();
       return;
     }

package/src/scenarios/replay-side-effect-suppression.test.ts

@@ -48,6 +48,7 @@ import { describe, it, expect } from 'vitest';
 import { recordRequirement } from '../lib/requirement-ledger.js';
 import { requirementIdForScenario } from '../lib/requirement-registry.js';
 import { driver } from '../lib/driver.js';
+import { forkDeclined } from '../lib/fork-availability.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { readFileSync } from 'node:fs';
@@ -173,8 +174,8 @@ describe.skipIf(SKIP_NO_FIXTURE)('replay-side-effect-suppression: a replay does
     const fork = await driver.post(`/v1/runs/${encodeURIComponent(sourceRunId)}:fork`, {
       mode: 'replay',
     });
-    if (fork.status === 501) {
-      ctx.skip(); // advertised but not implemented for this range — suite convention
+    if (forkDeclined(fork.status, 'side-effect-suppression replay fork')) {
+      ctx.skip();
       return;
     }
     expect(fork.status, 'fork should be accepted').toBe(201);

package/src/scenarios/replayDeterminism.test.ts

@@ -18,6 +18,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { forkDeclined } from '../lib/fork-availability.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 
@@ -69,7 +71,7 @@ function structuralShape(events: readonly RawEvent[]): Array<{ type: unknown; no
 describe('replay-determinism: openwop-replay-fork profile gate', () => {
   it('host advertising replay.supported MUST also advertise replay.modes', async () => {
     const replay = await fetchReplayCapability();
-    if (replay === null || replay.supported !== true) return; // skip-equivalent
+    if (replay === null || replay.supported !== true) return softSkip('inapplicable', 'host does not advertise `replay.supported: true` — the replay contract does not apply to it');
 
     expect(Array.isArray(replay.modes), driver.describe(
       'spec/v1/replay.md',
@@ -91,8 +93,8 @@ describe.skipIf(SKIP_NO_NOOP)('replay-determinism: same fromSeq + same workflow
     'two replay forks of the same point produce structurally-identical event lists',
     async () => {
       const replay = await fetchReplayCapability();
-      if (replay === null || replay.supported !== true) return; // host doesn't claim replay
-      if (!Array.isArray(replay.modes) || !replay.modes.includes('replay')) return; // mode not supported
+      if (replay === null || replay.supported !== true) return softSkip('inapplicable', 'host does not advertise `replay.supported: true` — the replay contract does not apply to it');
+      if (!Array.isArray(replay.modes) || !replay.modes.includes('replay')) return softSkip('inapplicable', 'host advertises replay but not the `replay` mode — this leg is out of scope for it');
 
       // Phase 1: complete an original run.
       const create = await driver.post('/v1/runs', { workflowId: NOOP_WORKFLOW_ID });
@@ -105,7 +107,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay-determinism: same fromSeq + same workflow
         mode: 'replay',
         fromSeq: 0,
       });
-      if (fork1.status === 501) return; // mode not implemented; skip-equivalent
+      if (forkDeclined(fork1.status, 'determinism fork 1')) return;
       expect(fork1.status, driver.describe(
         'spec/v1/replay.md',
         'POST /v1/runs/{runId}:fork with mode=replay MUST return 201',
@@ -118,7 +120,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay-determinism: same fromSeq + same workflow
         mode: 'replay',
         fromSeq: 0,
       });
-      if (fork2.status === 501) return;
+      if (forkDeclined(fork2.status, 'determinism fork 2')) return;
       expect(fork2.status).toBe(201);
       const fork2Id = (fork2.json as { runId: string }).runId;
       await pollUntilTerminal(fork2Id, { timeoutMs: 10_000 });
@@ -152,7 +154,7 @@ describe.skipIf(SKIP_NO_NOOP)('replay-determinism: same fromSeq + same workflow
 describe.skipIf(SKIP_NO_NOOP)('replay-determinism: branch-mode is permitted to diverge', () => {
   it('branch mode does NOT need to produce identical event sequences (negative-control)', async () => {
     const replay = await fetchReplayCapability();
-    if (replay === null || replay.supported !== true) return;
+    if (replay === null || replay.supported !== true) return softSkip('inapplicable', 'host does not advertise `replay.supported: true` — the replay contract does not apply to it');
     if (!Array.isArray(replay.modes) || !replay.modes.includes('branch')) return;
 
     // Self-test on the spec interpretation: branch and replay are

package/src/scenarios/webhook-signed-delivery.test.ts

@@ -16,13 +16,59 @@
  * Capability-gated: skips when the host does not advertise
  * `capabilities.webhooks.supported = true`.
  *
- * Operator contract: hosts that implement a SSRF guard on
- * `POST /v1/webhooks` (rejecting loopback / RFC1918 / link-local
- * destinations to protect deployer infrastructure) MUST allow the test
- * receiver. The SQLite reference host bypasses the guard when the
- * `OPENWOP_WEBHOOK_ALLOW_PRIVATE=true` env var is set at boot. Test-only
- * hosts SHOULD provide an equivalent opt-in. When the host rejects with
- * `400 webhook_url_rejected`, this scenario skips with a warning.
+ * Operator contract — THREE gates, not one (clarified 2026-08-25).
+ *
+ * The test receiver is `http://127.0.0.1:{port}/`, and `webhooks.md`
+ * forbids it three separate times. A host honoring
+ * `OPENWOP_WEBHOOK_ALLOW_PRIVATE=true` (or an equivalent opt-in) MUST
+ * relax ALL THREE for this scenario to be witnessable:
+ *
+ *   1. **Scheme.** §"SSRF protection" bullet 1 rejects non-`https://`
+ *      protocols, and §"Register" says `url` MUST be `https://`. The
+ *      receiver is plain `http`. This gate is the one the flag's
+ *      description omitted until 2026-08-25, and it fires FIRST on a
+ *      host that validates scheme before address.
+ *   2. **Registration-time address check.** §"SSRF protection": the
+ *      server MUST validate subscription URLs at registration time and
+ *      reject loopback / RFC1918 / link-local / ULA / metadata.
+ *   3. **Delivery-time re-resolution.** §"Delivery-time egress
+ *      validation (RFC 0093)": the dispatcher MUST re-resolve at
+ *      delivery time and validate every resolved address against the
+ *      same ranges.
+ *
+ * Gates 2 and 3 are INDEPENDENT MUSTs at different layers, so "which
+ * layer must the opt-in reach" is not a matter of taste: a relaxation
+ * reaching only one layer cannot produce a witness. Delivery-only leaves
+ * registration returning `400 webhook_url_rejected` (observed on a tier-2
+ * host, 2026-08-25); registration-only leaves the dispatcher re-resolving
+ * `127.0.0.1` and refusing to connect. A host whose opt-in reaches one
+ * layer is not non-conformant — it simply cannot witness this scenario,
+ * and that is a property of the test posture, not of its webhook signing.
+ *
+ * What that costs is more than a checkmark, and it is worth stating plainly
+ * because the cost is invisible from inside such a host. This scenario is
+ * typically the ONLY automated oracle a host has on its delivery header
+ * NAMES: a host-local delivery test almost always compares a hand-written
+ * literal in the test to a hand-written literal in the implementation, which
+ * is a mirror — typo both and it stays green — while the HMAC assertion
+ * beside it recomputes from `node:crypto` and is real. So the names go
+ * unchecked exactly where the bytes are checked well. All three reference
+ * hosts emitted invented header names for 16 days (openwop-examples#22) and
+ * the runs that would have caught it were the ones this scenario could not
+ * reach. A host that runs it is not thereby careful; it is thereby measured.
+ *
+ * Relaxing gates 2 and 3 is test-only posture. See
+ * `SECURITY/threat-model-secret-leakage.md` §4.9 for why a
+ * registration-time relaxation is the more dangerous of the two: it
+ * writes a durable subscription row that survives the flag being turned
+ * back off.
+ *
+ * When the host rejects with `400 webhook_url_rejected`, this scenario
+ * records `blocked` (RFC 0148 §A) — NOT a pass. Under a plain
+ * `vitest run` the console still prints "1 passed", because that is
+ * vitest reporting test outcomes rather than conformance dispositions;
+ * the run-end disposition summary (`src/global-setup.ts`) is where the
+ * `blocked` becomes visible without `--certify`.
  *
  * @see spec/v1/webhooks.md §"Signature scheme"
  */

package/vitest.config.ts

@@ -17,5 +17,12 @@ export default defineConfig({
     // populates `lib/fixtures.ts` so `describe.skipIf(...)` predicates
     // see the cached set when scenarios register their tests.
     setupFiles: ['src/setup.ts'],
+    // RFC 0148 §A run-end disposition summary. `setup.ts` records an honest
+    // disposition per scenario file on EVERY run; before this, only
+    // `--certify` set OPENWOP_LEDGER_PATH, so on a plain `vitest run` the
+    // recording was computed and then discarded, leaving "N passed" as the
+    // sole artifact for rows the suite had classified `blocked`. This routes
+    // the ledger to a temp file and prints what did not witness.
+    globalSetup: ['src/global-setup.ts'],
   },
 });