@openwop/openwop-conformance 1.138.1 → 1.140.0

package/README.md

@@ -78,7 +78,7 @@ Run `npm run test` for normal CI cadence; `npm run test:strict` when claiming fu
 | `OPENWOP_OTEL_COLLECTOR_GRPC=true`        | Boots the parallel OTLP/gRPC collector alongside the HTTP one (h2c HTTP/2 on a separate port). Shares the same `spans()` + `metrics()` store; spans captured over either transport surface in `getCollector().spans()`. Requires `OPENWOP_OTEL_COLLECTOR=true`. Same `--no-file-parallelism` requirement applies.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `OPENWOP_OTEL_COLLECTOR_GRPC_PORT=4317`   | Bind the OTLP/gRPC collector on a specific port (default `4317`, OTLP/gRPC convention). The host MUST be configured with `OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:<port>` AND `OTEL_EXPORTER_OTLP_PROTOCOL=grpc`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `OPENWOP_OTEL_COLLECTOR_PORT=14318`       | Bind the OTel collector on a specific port (default `4318`). The host MUST be configured with `OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:<port>`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `OPENWOP_WEBHOOK_ALLOW_PRIVATE=true`      | Hosts implementing the webhook SSRF guard (rejecting loopback / RFC1918 / link-local destinations) MUST advertise this flag for the loopback test receiver in `webhook-signed-delivery.test.ts` to be accepted. The SQLite reference host honors this env var; the scenario soft-skips when the host rejects the URL.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `OPENWOP_WEBHOOK_ALLOW_PRIVATE=true`      | Relaxes the webhook egress guard for the loopback test receiver used by `webhook-signed-delivery.test.ts`, `webhook-negative.test.ts`, and `replay-fanout-suppression.test.ts`. **The receiver is `http://127.0.0.1:{port}/`, which `webhooks.md` forbids three separate times, and the opt-in MUST relax all three to be witnessable:** (1) the **scheme** check — §"SSRF protection" bullet 1 rejects non-`https://`, and this gate fires FIRST on a host that validates scheme before address; (2) the **registration-time** address check — §"SSRF protection"; and (3) **delivery-time re-resolution** — §"Delivery-time egress validation (RFC 0093)". Gates 2 and 3 are independent MUSTs at different layers, so an opt-in reaching only one layer **cannot** produce a witness: delivery-only leaves registration returning `400 webhook_url_rejected`, registration-only leaves the dispatcher refusing to connect. A host whose opt-in reaches one layer is **not** non-conformant — it cannot witness these scenarios, which is a property of the test posture and not of its webhook signing. The scheme gate went unstated here until 2026-08-25; a tier-2 host validating scheme-then-address was blocked by a gate the documented contract never named. Relaxing gates 2 and 3 is **test-only posture** — see `SECURITY/threat-model-secret-leakage.md` §4.9 for why a registration-time relaxation is the more dangerous of the two. When the host rejects, the scenario records `blocked` (RFC 0148 §A), not a pass.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `OPENWOP_MCP_FAKE_SERVER=true`            | Boots the synthetic MCP peer for `mcp-tool-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `OPENWOP_MCP_REAL_SERVER_URL=<base-url>`  | Points the MCP wire-shape probe at a real MCP server. The probe POSTs JSON-RPC and reads a single-JSON response — matches MCP's `streamable-http` transport in single-response mode. **Does NOT support** stdio transport (which is what most `modelcontextprotocol/servers` references default to) or SSE-streamed responses; an operator collecting interop evidence today runs a custom `StreamableHTTPServerTransport`-style server that returns a single JSON body per request. Adding SSE-frame parsing is tracked in `docs/PROTOCOL-GAP-CLOSURE-PLAN.md` Track 6. Assertions relax to shape-only. When both this and `OPENWOP_MCP_FAKE_SERVER` are set, the real URL wins. Phase 3 T3.4 interop-evidence path.                                                                                                               |
 | `OPENWOP_A2A_FAKE_PEER=true`              | Boots the synthetic A2A peer for `a2a-task-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

package/coverage.md

@@ -1,6 +1,6 @@
 # OpenWOP Conformance Coverage Map
 
-> **Status: Living document. Updated 2026-06-29.** This map connects the current scenario files to the protocol surfaces they protect and records the remaining gaps from the protocol deep dive. Scenario names are source-of-truth file names under `conformance/src/scenarios/`.
+> **Status: Living document. Updated 2026-08-25.** This map connects the current scenario files to the protocol surfaces they protect and records the remaining gaps from the protocol deep dive. Scenario names are source-of-truth file names under `conformance/src/scenarios/`.
 
 > **Shape grade vs behavior grade.** Some optional-profile scenarios validate **capability shape** (the host's discovery advertisement is well-formed) without yet exercising **behavior** (the host actually implements the profile end-to-end). The "Current grade" column reflects shape; see §"Capability-gated scenarios: shape vs behavior" below for the dual-grade view and the `OPENWOP_REQUIRE_BEHAVIOR=true` strict-mode runner flag.
 

package/dist/lib/scenario-disposition.js

@@ -28,6 +28,7 @@
 import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
 import { requirementIdForScenario, requirementIdForPrefix, requirementsFor } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
+import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
 import { CERTIFIABLE } from './requirement-ledger.js';
 /** All scenario basenames that appear in some profile's runtime floor. */
 export function floorScenarioFiles() {
@@ -100,7 +101,19 @@ export function fileDisposition(states, gateReason, assertionCount) {
  *   - every test `ctx.skip()`ped ⇒ the file's noted reason if it wrote one
  *     BEFORE skipping (`ctx.skip()` throws), else `blocked` + the marker.
  */
-export function resolveFileRecord(states, gateReason, assertionCount, noted) {
+export function resolveFileRecord(states, gateReason, assertionCount, noted, specCoherenceFile) {
+    // A scenario whose subject is the CORPUS, skipped because the published
+    // tarball does not bundle spec/v1/. RFC 0148 §A: `blocked` is defined over
+    // ADVERTISED BEHAVIOUR, and there is none here — nothing about the host was
+    // ever going to be exercised. `inapplicable` is the honest label, and it is
+    // CERTIFIABLE, so these rows stop counting against a host that cannot affect
+    // them. See lib/spec-coherence.ts for why not a new disposition value.
+    if (specCoherenceFile !== undefined
+        && SPEC_COHERENCE_SCENARIOS.has(specCoherenceFile)
+        && !states.includes('fail')
+        && assertionCount === 0) {
+        return { disposition: 'inapplicable', detail: SPEC_COHERENCE_DETAIL };
+    }
     let { disposition, detail } = fileDisposition(states, gateReason, assertionCount);
     if (disposition === 'executed-pass' && assertionCount === 0) {
         if (noted !== null) {

package/dist/lib/spec-coherence.js

@@ -0,0 +1,103 @@
+/**
+ * Scenarios that measure the SPEC, not the host (RFC 0148 §A).
+ *
+ * ## The defect
+ *
+ * 28 scenarios read `spec/v1/*.md` to check the corpus is internally coherent —
+ * that the `protocolVersion` grammar in the schema matches RFC 0149, that error
+ * envelopes are the shape `error-envelope.schema.json` declares, that every
+ * normative example extracts and validates. They assert nothing whatever about
+ * a host.
+ *
+ * `spec/v1/` is deliberately NOT bundled in the published tarball (`paths.ts`
+ * says so), so in a published-layout run `V1_DIR` is null and they
+ * `describe.skipIf` at COLLECTION time. No test body runs, so no `softSkip`
+ * note is recorded, and `resolveFileRecord` resolves an all-skipped file with no
+ * reason to **`blocked`** carrying "every test returned early … no recorded
+ * reason".
+ *
+ * That row then lands in a HOST's certification bundle. A host operator reads
+ * `blocked` and cannot tell it from a real gap in their implementation. A
+ * tier-2 host measured 13 such rows — **a third of their undiagnosed set** —
+ * and only discovered what they were by pointing `OPENWOP_CONFORMANCE_ROOT` at
+ * a spec checkout and watching 85 assertions pass in about a second, 59 of them
+ * against a dead `localhost:9`.
+ *
+ * ## Why `inapplicable`, and why not the other four
+ *
+ * RFC 0148 §A defines the two candidates precisely, and the definitions decide
+ * it:
+ *
+ *   - `blocked` — "**advertised behavior** could not be exercised because a
+ *     required seam, fixture, credential, or dependency was unavailable."
+ *     There is no advertised behaviour here. Nothing about the host was ever
+ *     going to be exercised, so nothing about the host failed to be.
+ *   - `inapplicable` — "the requirement does not apply to the captured
+ *     discovery/profile set." A requirement about the spec corpus does not
+ *     apply to any host's discovery set. This is the honest label.
+ *
+ * `executed-pass` is wrong for the obvious reason: in a run where the corpus is
+ * absent, nothing executed, and claiming a pass for an unrun scenario is the
+ * defect this whole disposition system exists to prevent. A NEW disposition
+ * value was considered and rejected — `certification-bundle-v2.schema.json`
+ * enumerates the five, and `verifyBundleV2` is a published consumer contract,
+ * so a sixth is a wire break for every existing verifier. Correct use of an
+ * existing value costs nothing and breaks no one.
+ *
+ * `inapplicable` is in `CERTIFIABLE`, which is the point: these rows stop
+ * counting against a host that has no way to affect them.
+ *
+ * ## Why a list and not a predicate
+ *
+ * The property is static — "gates on `V1_DIR` and never touches `driver`" — and
+ * cannot be evaluated from `setup.ts` at runtime. So it is a list, and a list
+ * drifts. `spec-coherence-registry.test.ts` re-derives it from source on every
+ * run and fails when the two disagree, which is the only thing that makes a
+ * hand-maintained set trustworthy.
+ *
+ * ## What is deliberately NOT here
+ *
+ * Seven scenarios gate on `V1_DIR` **and** drive the host
+ * (`replay-side-effect-suppression`, `data-residency-admission`,
+ * `profile-discovery-core-alias`, `workflow-variable-format`,
+ * `workflow-chain-deferred-parameters`, `artifact-type-store-emission`,
+ * `artifact-type-registration-source`). Those assert advertised host behaviour
+ * that could not be exercised because a dependency was unavailable — which is
+ * `blocked`, exactly as §A defines it. Classifying them `inapplicable` would
+ * tell a host "this does not apply to you" about a requirement that does.
+ */
+/** Scenarios whose subject is the corpus. Kept honest by `spec-coherence-registry.test.ts`. */
+export const SPEC_COHERENCE_SCENARIOS = new Set([
+    'artifact-schema-compile-bounded.test.ts',
+    'artifact-type-legacy-ids.test.ts',
+    'capability-example-root-layout.test.ts',
+    'certification-floor-enforcement.test.ts',
+    'chain-subchain-unsupported-refused.test.ts',
+    'compensation-profile.test.ts',
+    'core-manifest-and-extension-registry.test.ts',
+    'discovery-canonical-family-no-shadow.test.ts',
+    'edge-condition-truthy-falsy.test.ts',
+    'effect-identity-composition.test.ts',
+    'effect-identity-cross-scope.test.ts',
+    'error-envelope-canonical-shape.test.ts',
+    'form-content-packs.test.ts',
+    'multi-region-effect-vocabulary.test.ts',
+    'normative-example-extraction.test.ts',
+    'openapi-asyncapi-sdk-parity.test.ts',
+    'pack-manifest-extensions.test.ts',
+    'protocol-version-grammar.test.ts',
+    'registry-declarative-kinds.test.ts',
+    'rfc-0147-self-audit.test.ts',
+    'rfc-lifecycle-coherence.test.ts',
+    'semantic-digest-v2.test.ts',
+    'spec-corpus-validity.test.ts',
+    'spec-section-citations.test.ts',
+    'tool-result-trust-monotone.test.ts',
+    'versioned-composition-profiles.test.ts',
+    'workflow-chain-internal-flag.test.ts',
+    'workload-identity-profile.test.ts',
+]);
+/** The reason recorded on such a row, written for the host operator reading it. */
+export const SPEC_COHERENCE_DETAIL = 'inapplicable to any host: this scenario reads spec/v1/ to check the SPEC corpus is internally coherent and asserts nothing about a host. '
+    + 'The published tarball does not bundle spec/v1/ (see lib/paths.ts), so it does not run here. '
+    + 'Set OPENWOP_CONFORMANCE_ROOT to a spec checkout to run it; it needs no host.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.138.1",
+  "version": "1.140.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.138.1",
-  "corpusCommit": "3555363038ce8ea7e40dc2f2a41c39066228e69c"
+  "suiteVersion": "1.140.0",
+  "corpusCommit": "8fe8053bfa7436a9c9a2dbbebd304095ecd29b16"
 }

package/src/global-setup.ts

@@ -0,0 +1,169 @@
+/**
+ * Run-end disposition summary (RFC 0148 §A, 2026-08-25).
+ *
+ * ## The gap this closes
+ *
+ * Every scenario file already records ONE honest disposition when it
+ * finishes (`setup.ts`'s `afterAll` → `resolveFileRecord`): a file that
+ * returned early with zero assertions is `blocked` / `skipped` /
+ * `inapplicable` with a reason, never a pass. That machinery is correct.
+ *
+ * It was **published on one invocation out of two**. The worker appends
+ * each recording to `OPENWOP_LEDGER_PATH`, and the ONLY writer of that
+ * variable was `cli.ts` inside `runCertify`. Under a plain `vitest run`
+ * — what `README.md` documents for host operators, and what host
+ * implementers actually run — the worker computed `blocked`, held it in
+ * memory, and discarded it at process exit. The single surviving artifact
+ * was vitest's `1 passed`.
+ *
+ * So the suite computed an honest disposition on every run and published
+ * it on one. Two host implementers independently read the console line as
+ * coverage and reported the suite as claiming a pass it had internally
+ * classified `blocked` — correctly, given the only artifact they had.
+ * RFC 0158 §"Operator preconditions are declared, not hidden" requires a
+ * blocked row be surfaced "never silently skipped or reported as a pass";
+ * the bundle honored that and the console contradicted it.
+ *
+ * ## What this does
+ *
+ * When `OPENWOP_LEDGER_PATH` is unset, point it at a temp file so the
+ * workers record there anyway, then read it at run end and print a
+ * summary. `--certify` sets the variable itself, so this defers to it
+ * completely and never interferes with bundle generation.
+ *
+ * The summary is deliberately NOT a pass/fail signal — it does not change
+ * the exit code. `vitest`'s exit code answers "did any assertion fail";
+ * this answers "what did the run actually witness", and those are
+ * different questions. Conflating them is what produced the gap.
+ *
+ * Set `OPENWOP_DISPOSITION_SUMMARY=false` to silence it.
+ */
+
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+/** Dispositions that are NOT a witnessed execution — the rows worth printing. */
+const NON_EXECUTING = new Set(['blocked', 'skipped', 'inapplicable']);
+
+/** Cap on printed rows; the overflow is always announced, never silent. */
+const MAX_ROWS = 40;
+
+// Import the REAL entry type rather than restating its shape. A hand-written
+// structural guess here read `entry.id` — a key the ledger has never written
+// (it is `requirementId`) — and the `(unnamed)` fallback made the mismatch
+// look like missing data instead of a wrong reader. A type-only import erases
+// at runtime, so this costs nothing and makes the compiler the oracle: rename
+// a ledger field and this file stops building instead of silently degrading.
+import type { LedgerEntry } from './lib/requirement-ledger.js';
+
+/** What a JSONL line parses to before validation — every field may be absent. */
+type LedgerLine = Partial<Record<keyof LedgerEntry, unknown>>;
+
+let ownedDir: string | null = null;
+let ledgerPath: string | null = null;
+
+export function setup(): void {
+  if (process.env['OPENWOP_DISPOSITION_SUMMARY'] === 'false') return;
+  // `--certify` already routes the ledger to its own report dir and reads it
+  // there. Never take it over — this exists only for the path that had no
+  // reader at all.
+  if ((process.env['OPENWOP_LEDGER_PATH'] ?? '') !== '') return;
+  ownedDir = mkdtempSync(join(tmpdir(), 'owp-dispositions-'));
+  ledgerPath = join(ownedDir, 'requirement-ledger.jsonl');
+  process.env['OPENWOP_LEDGER_PATH'] = ledgerPath;
+}
+
+/**
+ * Fold raw JSONL into the printable summary. PURE — no I/O, no env — so
+ * `global-setup.test.ts` can pin it without a vitest subprocess or a host.
+ * Returns `null` when there is nothing to say.
+ */
+export function summarise(raw: string): string | null {
+  const counts = new Map<string, number>();
+  const rows: Array<{ id: string; disposition: string; detail: string }> = [];
+  for (const line of raw.split('\n')) {
+    if (line.trim() === '') continue;
+    let entry: LedgerLine;
+    try {
+      entry = JSON.parse(line) as LedgerLine;
+    } catch {
+      continue;
+    }
+    const disposition = typeof entry.disposition === 'string' ? entry.disposition : 'unknown';
+    const id = typeof entry.requirementId === 'string' ? entry.requirementId : '(unnamed)';
+    const detail = typeof entry.detail === 'string' ? entry.detail : '';
+    counts.set(disposition, (counts.get(disposition) ?? 0) + 1);
+    if (NON_EXECUTING.has(disposition)) {
+      rows.push({ id, disposition, detail });
+    } else if (disposition === 'executed-pass' && entry.assertionCount === 0) {
+      // The other shape RFC 0148 §A rejects: a pass that asserted nothing.
+      rows.push({ id, disposition: 'executed-pass (0 assertions)', detail });
+    }
+  }
+  if (counts.size === 0) return null;
+  const total = [...counts.values()].reduce((a, b) => a + b, 0);
+  const order = ['executed-pass', 'executed-fail', 'blocked', 'skipped', 'inapplicable'];
+  const summary = [...order, ...[...counts.keys()].filter((k) => !order.includes(k))]
+    .filter((k) => counts.has(k))
+    .map((k) => `${k} ${counts.get(k)}`)
+    .join(' \u00b7 ');
+  const out: string[] = [
+    '',
+    `[openwop-conformance] RFC 0148 \u00a7A dispositions \u2014 ${total} requirement(s) recorded`,
+    `  ${summary}`,
+  ];
+  if (rows.length > 0) {
+    out.push(
+      `  ${rows.length} requirement(s) did NOT witness. vitest reports these as passes because`,
+      '  no assertion failed; that is a test outcome, not a conformance disposition.',
+    );
+    for (const r of rows.slice(0, MAX_ROWS)) {
+      const detail = r.detail.length > 120 ? `${r.detail.slice(0, 117)}...` : r.detail;
+      out.push(`    ${r.disposition.padEnd(28)} ${r.id}${detail === '' ? '' : `\n      ${detail}`}`);
+    }
+    if (rows.length > MAX_ROWS) {
+      // Never truncate silently: a capped list that does not say it was capped
+      // reads as a complete one, which is the same defect this whole summary
+      // exists to remove.
+      out.push(`    ... and ${rows.length - MAX_ROWS} more not listed (run with --certify for the full bundle)`);
+    }
+  }
+  out.push('');
+  return out.join('\n');
+}
+
+export function teardown(): void {
+  if (ledgerPath === null || ownedDir === null) return;
+  // We set the variable; unset it so a subsequent in-process run re-derives.
+  delete process.env['OPENWOP_LEDGER_PATH'];
+  let raw = '';
+  try {
+    raw = readFileSync(ledgerPath, 'utf8');
+  } catch {
+    // No file means no worker ever recorded \u2014 nothing to summarise, and a
+    // missing summary must never be mistaken for "nothing was blocked", so
+    // say so rather than printing an empty clean bill.
+    process.stderr.write(
+      '\n[openwop-conformance] no disposition ledger was written \u2014 the run recorded nothing, ' +
+        'which is NOT the same as every scenario having witnessed its requirement.\n',
+    );
+    cleanup();
+    return;
+  }
+  const text = summarise(raw);
+  if (text !== null) process.stderr.write(text);
+  cleanup();
+}
+
+function cleanup(): void {
+  if (ownedDir !== null) {
+    try {
+      rmSync(ownedDir, { recursive: true, force: true });
+    } catch {
+      /* best effort */
+    }
+  }
+  ownedDir = null;
+  ledgerPath = null;
+}

package/src/lib/fork-availability.test.ts

@@ -0,0 +1,69 @@
+/**
+ * Pins `forkDeclined` (RFC 0148 §A).
+ *
+ * The risk in a helper like this is not that it misses a status — that shows up
+ * as a red test somebody investigates. It is that it swallows one: every status
+ * it accepts turns an assertion into a skip, silently, and a suite that skips
+ * is indistinguishable from a suite that passes unless something records why.
+ * So the load-bearing cases here are the NEGATIVE ones.
+ */
+
+import { describe, expect, it, beforeEach } from 'vitest';
+import { forkDeclined } from './fork-availability.js';
+import { resetSoftSkips, softSkipDisposition } from './soft-skip.js';
+
+describe('forkDeclined', () => {
+  beforeEach(() => resetSoftSkips());
+
+  it('treats 404 and 403 the same as 501 — route absent is not weaker than route-declines', () => {
+    // The asymmetry this fixes: every replay scenario handled 501 and none
+    // handled 404. `501` means "I know this route and decline"; `404` means
+    // "there is no such route" — strictly less implemented. The suite treated
+    // the weaker signal as a skip and the stronger one as a defect, so a host
+    // had to implement the route in order to say it had not implemented it.
+    for (const status of [404, 403, 501]) {
+      expect(forkDeclined(status, 'leg'), `status ${status} means the fork did not happen`).toBe(true);
+    }
+  });
+
+  it('does NOT swallow any other status — a 500 is still a defect, not a skip', () => {
+    // If this ever goes green for one of these, a real failure has become a
+    // silent skip and no assertion downstream will ever run again.
+    for (const status of [200, 201, 202, 400, 409, 422, 500, 502, 503]) {
+      expect(forkDeclined(status, 'leg'), `status ${status} must reach the assertion`).toBe(false);
+    }
+  });
+
+  it('records WHY, so the ledger row is not an unclassified return', () => {
+    // Two of the eleven original call sites were a bare `return`. A bare return
+    // in a file whose OTHER tests assert is invisible: the file records
+    // `executed-pass` and the leg that never ran leaves no trace.
+    forkDeclined(404, 'fanout-suppression replay fork');
+    const noted = softSkipDisposition('fork-availability.test.ts');
+    expect(noted?.kind).toBe('blocked');
+    expect(noted?.reason).toContain('404');
+    expect(noted?.reason).toContain('fanout-suppression replay fork');
+    expect(noted?.reason).toContain('not mounted');
+  });
+
+  it('records nothing when the status is not a decline', () => {
+    forkDeclined(201, 'leg');
+    expect(softSkipDisposition('fork-availability.test.ts')).toBeNull();
+  });
+
+  it('names the leg, so one file with several forks stays attributable', () => {
+    forkDeclined(501, 'branch fork');
+    expect(softSkipDisposition('fork-availability.test.ts')?.reason).toContain('branch fork');
+  });
+
+  it('distinguishes the three declines in its reason text', () => {
+    forkDeclined(404, 'a');
+    const a = softSkipDisposition('fork-availability.test.ts')?.reason ?? '';
+    resetSoftSkips();
+    forkDeclined(501, 'a');
+    const b = softSkipDisposition('fork-availability.test.ts')?.reason ?? '';
+    // `blocked` alone does not tell a bundle reader whether the host lacks the
+    // route or declines the range; the reason must.
+    expect(a).not.toBe(b);
+  });
+});

package/src/lib/fork-availability.ts

@@ -0,0 +1,61 @@
+/**
+ * "The fork seam did not run" — one rule, one place (RFC 0148 §A).
+ *
+ * `POST /v1/runs/{runId}:fork` can decline in more than one way, and eleven
+ * call sites across six scenarios each decided for themselves which ways
+ * counted:
+ *
+ *   - **501** — every site handled this. "Advertised but not implemented for
+ *     this range", per the suite convention their comments cite.
+ *   - **404 / 403** — *no* site in the replay family handled it. A host that
+ *     never mounts the route hard-failed `expect(status).toBe(201)`.
+ *
+ * That asymmetry is backwards. `501` means "I know this route and decline";
+ * `404` means "there is no such route" — strictly less implemented, and the
+ * suite treated the weaker signal as a skip and the stronger one as a defect.
+ * The postgres reference host 404s, so `replay-fanout-suppression` was red in
+ * CI on every run while the other four replay scenarios skipped past the same
+ * seam for unrelated fixture reasons. **The suite required a host to implement
+ * the route in order to say it had not implemented the route.**
+ *
+ * Recording matters as much as the predicate. Two of those eleven sites were a
+ * bare `return` with no note: `replay-fork.test.ts` reported "6 tests | 6
+ * skipped" against a host whose fork surface is entirely unmeasured, and the
+ * ledger had nothing to say about why. §A resolves an unclassified return to
+ * `blocked`, but only when the file records nothing at all — a bare return in a
+ * file whose *other* tests assert is invisible.
+ *
+ * Disposition is `blocked`, not `inapplicable`: the obligation applies to this
+ * host, it simply could not be witnessed. `inapplicable` would claim the host
+ * is outside the requirement's scope, which nothing here establishes — these
+ * scenarios carry no capability gate, so the suite does not actually know
+ * whether the host advertises fork. Saying `blocked` is the claim the evidence
+ * supports.
+ */
+
+import { softSkip } from './soft-skip.js';
+
+/** Statuses that mean "the fork did not happen", with what each one tells us. */
+const DECLINED: ReadonlyMap<number, string> = new Map([
+  [404, 'the route is not mounted on this host'],
+  [403, 'the caller is not permitted to fork (route present, access refused)'],
+  [501, 'the host knows the route and declines this range as not implemented'],
+]);
+
+/**
+ * True when `status` means the fork seam did not run — and records WHY for the
+ * RFC 0148 §A ledger as a side effect, so a caller can `if (forkDeclined(...))
+ * return;` without leaving an unclassified return behind.
+ *
+ * `where` names the leg, so a bundle reader can tell which of several forks in
+ * one file declined.
+ */
+export function forkDeclined(status: number, where: string): boolean {
+  const why = DECLINED.get(status);
+  if (why === undefined) return false;
+  softSkip(
+    'blocked',
+    `${where}: POST /v1/runs/{runId}:fork returned ${status} — ${why}, so the behaviour this requirement is stated over never occurred and its absence below would prove nothing`,
+  );
+  return true;
+}

package/src/lib/global-setup.test.ts

@@ -0,0 +1,76 @@
+/**
+ * Pins the run-end disposition summary (`src/global-setup.ts`, RFC 0148 §A).
+ *
+ * The defect this guards is not "the summary is ugly" — it is that the suite
+ * computed an honest disposition on every run and PUBLISHED it on one. Two
+ * host implementers read vitest's `1 passed` as coverage for a requirement the
+ * suite had internally classified `blocked`, because the classification had no
+ * reader outside `--certify`.
+ *
+ * Server-free and pure: `summarise` takes the raw JSONL and returns the text.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { summarise } from '../global-setup.js';
+
+const line = (o: Record<string, unknown>): string => JSON.stringify(o);
+
+describe('global-setup: RFC 0148 §A disposition summary', () => {
+  it('reads the ledger key the ledger actually writes (`requirementId`, not `id`)', () => {
+    // Regression: the first draft of this reader keyed on `entry.id`, a field
+    // `recordRequirement` has never written, and fell back to `(unnamed)`.
+    // The fallback made a WRONG READER look like MISSING DATA — the same
+    // failure shape the summary exists to expose, reproduced in the exposer.
+    const out = summarise(
+      line({ requirementId: 'openwop.scenario.webhook-signed-delivery', disposition: 'blocked', detail: 'guard rejected loopback' }),
+    );
+    expect(out).toContain('openwop.scenario.webhook-signed-delivery');
+    expect(out).not.toContain('(unnamed)');
+  });
+
+  it('lists blocked / skipped / inapplicable as NOT witnessed, with the reason', () => {
+    const out = summarise(
+      [
+        line({ requirementId: 'a', disposition: 'blocked', detail: 'seam absent' }),
+        line({ requirementId: 'b', disposition: 'skipped', detail: 'operator opted out' }),
+        line({ requirementId: 'c', disposition: 'inapplicable', detail: 'profile not advertised' }),
+      ].join('\n'),
+    );
+    expect(out).toContain('did NOT witness');
+    for (const s of ['seam absent', 'operator opted out', 'profile not advertised']) {
+      expect(out).toContain(s);
+    }
+  });
+
+  it('flags an executed-pass that asserted nothing — the other RFC 0148 §A vacuity shape', () => {
+    const out = summarise(line({ requirementId: 'vacuous', disposition: 'executed-pass', assertionCount: 0 }));
+    expect(out).toContain('executed-pass (0 assertions)');
+    expect(out).toContain('vacuous');
+  });
+
+  it('does NOT flag a real executed-pass', () => {
+    const out = summarise(line({ requirementId: 'real', disposition: 'executed-pass', assertionCount: 12 }));
+    expect(out).toContain('executed-pass 1');
+    expect(out).not.toContain('did NOT witness');
+  });
+
+  it('announces truncation rather than capping silently', () => {
+    // A capped list that does not say it was capped reads as a complete one.
+    const many = Array.from({ length: 45 }, (_, i) =>
+      line({ requirementId: `r${i}`, disposition: 'blocked', detail: 'why' }),
+    ).join('\n');
+    const out = summarise(many);
+    expect(out).toContain('5 more not listed');
+  });
+
+  it('returns null on an empty ledger so teardown prints nothing', () => {
+    expect(summarise('')).toBeNull();
+    expect(summarise('\n\n')).toBeNull();
+  });
+
+  it('skips unparseable lines without discarding the rest of the run', () => {
+    const out = summarise(['{ not json', line({ requirementId: 'ok', disposition: 'blocked', detail: 'r' })].join('\n'));
+    expect(out).toContain('ok');
+    expect(out).toContain('blocked 1');
+  });
+});

package/src/lib/scenario-disposition.ts

@@ -29,6 +29,7 @@
 import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
 import { requirementIdForScenario, requirementIdForPrefix, requirementsFor } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
+import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
 import { CERTIFIABLE, type Disposition, type LedgerEntry } from './requirement-ledger.js';
 
 /** All scenario basenames that appear in some profile's runtime floor. */
@@ -112,7 +113,22 @@ export function resolveFileRecord(
   gateReason: 'inapplicable' | 'skipped' | undefined,
   assertionCount: number,
   noted: { kind: 'inapplicable' | 'skipped' | 'blocked'; reason: string } | null,
+  specCoherenceFile?: string,
 ): { disposition: Disposition; detail?: string } {
+  // A scenario whose subject is the CORPUS, skipped because the published
+  // tarball does not bundle spec/v1/. RFC 0148 §A: `blocked` is defined over
+  // ADVERTISED BEHAVIOUR, and there is none here — nothing about the host was
+  // ever going to be exercised. `inapplicable` is the honest label, and it is
+  // CERTIFIABLE, so these rows stop counting against a host that cannot affect
+  // them. See lib/spec-coherence.ts for why not a new disposition value.
+  if (
+    specCoherenceFile !== undefined
+    && SPEC_COHERENCE_SCENARIOS.has(specCoherenceFile)
+    && !states.includes('fail')
+    && assertionCount === 0
+  ) {
+    return { disposition: 'inapplicable', detail: SPEC_COHERENCE_DETAIL };
+  }
   let { disposition, detail } = fileDisposition(states, gateReason, assertionCount);
   if (disposition === 'executed-pass' && assertionCount === 0) {
     if (noted !== null) {