@openwop/openwop-conformance 1.152.0 → 1.154.0

package/src/scenarios/spec-section-citations.test.ts

@@ -1,132 +0,0 @@
-/**
- * spec-section-citations — server-free. A citation of the form
- * `<doc>.md §"<Section>"` MUST resolve to a heading that exists in that doc.
- *
- * SP-04 (2026-08-18): `storage-adapters.md §"Claim acquisition"` was cited by
- * FOUR artifacts — `production-profile.md` §Durability, RFC 0009's
- * scenario-citation table, and the docstrings of `staleClaim.test.ts` and
- * `restart-during-run.test.ts` — and the section did not exist. Nothing was
- * checking, so a normative `MUST` ("Storage adapters MUST satisfy
- * `storage-adapters.md` lease and event-log invariants") pointed at nothing for
- * the life of RFC 0009.
- *
- * Scope is deliberately narrow. A corpus-wide sweep of this citation form finds
- * ~1400 citations and ~260 that do not resolve under a heading-only matcher —
- * a mix of genuinely dangling anchors and legitimate informal references to
- * table rows and capability keys rather than headings. Triaging those is its own
- * work item; gating the whole corpus on an untriaged sweep would either fail
- * immediately or need an allowlist so large it would stop meaning anything.
- * So this pins the docs whose section citations are load-bearing for the
- * durability contract, and grows as other docs are triaged.
- *
- * @see spec/v1/storage-adapters.md §"Claim acquisition"
- * @see spec/v1/production-profile.md §Durability
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync, readdirSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { V1_DIR, SCENARIOS_DIR } from '../lib/paths.js';
-
-/** Docs whose `§"Section"` citations are checked. Add a doc once its citations are triaged. */
-const CHECKED_DOCS = ['storage-adapters.md', 'production-profile.md'] as const;
-
-/** `<doc>.md §"Quoted Section"` or `<doc>.md §BareToken`. */
-const CITATION = /([A-Za-z0-9._-]+)\.md\s*§\s*(?:"([^"\n]+)"|([A-Za-z][A-Za-z0-9.-]*))/g;
-
-/**
- * Strip decoration, a leading `§` (headings in this corpus carry their own), and
- * trailing sentence punctuation — a docstring legitimately ends a sentence
- * inside the quotes (`… §"Claim acquisition."`) and still names that section.
- */
-const normalize = (t: string): string =>
-  t
-    .replace(/[`*_"]/g, '')
-    .replace(/^§\s*/, '')
-    .replace(/[.,;:]+$/, '')
-    .trim()
-    .toLowerCase();
-
-/** A heading matches its full text, or its lead token before an em-dash / period. */
-function headingKeys(raw: string): string[] {
-  const h = normalize(raw);
-  const keys = new Set<string>([h]);
-  const dash = h.split(/\s+[—–-]\s+/)[0]?.trim();
-  if (dash) keys.add(dash);
-  const dot = h.split(/\.\s+/)[0]?.trim();
-  if (dot) keys.add(dot);
-  return [...keys];
-}
-
-function walk(dir: string, keep: (n: string) => boolean, out: string[] = []): string[] {
-  for (const e of readdirSync(dir, { withFileTypes: true })) {
-    const p = join(dir, e.name);
-    if (e.isDirectory()) walk(p, keep, out);
-    else if (keep(e.name)) out.push(p);
-  }
-  return out;
-}
-
-describe.skipIf(V1_DIR === null)('spec-section-citations (SP-04)', () => {
-  it('every cited section of a checked doc exists as a heading in that doc', () => {
-    const v1 = V1_DIR as string;
-    // `V1_DIR` is `<repo>/spec/v1` in a checkout; RFCS/ sits two levels up.
-    // Both are absent from the published tarball, which is why the whole file
-    // is `skipIf(V1_DIR === null)`.
-    const rfcsDir = join(v1, '..', '..', 'RFCS');
-
-    const sources = [
-      ...walk(v1, (n) => n.endsWith('.md')),
-      ...(existsSync(rfcsDir) ? walk(rfcsDir, (n) => n.endsWith('.md')) : []),
-      ...(SCENARIOS_DIR !== null ? walk(SCENARIOS_DIR, (n) => n.endsWith('.test.ts')) : []),
-    ];
-
-    const headings = new Map<string, Set<string>>();
-    for (const doc of CHECKED_DOCS) {
-      const text = readFileSync(join(v1, doc), 'utf8');
-      const keys = new Set<string>();
-      for (const m of text.matchAll(/^#{1,6}\s+(.+?)\s*$/gm)) {
-        for (const k of headingKeys(m[1] ?? '')) keys.add(k);
-      }
-      headings.set(doc, keys);
-    }
-
-    const dangling: string[] = [];
-    let checked = 0;
-    for (const src of sources) {
-      const text = readFileSync(src, 'utf8');
-      for (const m of text.matchAll(CITATION)) {
-        const doc = `${m[1]}.md`;
-        const keys = headings.get(doc);
-        if (!keys) continue;
-        const section = (m[2] ?? m[3] ?? '').trim();
-        if (!section) continue;
-        checked++;
-        const want = normalize(section);
-        // A MULTI-WORD citation must match a heading key exactly: prefix
-        // matching would let `§"Claim acquisition"` be satisfied by a heading
-        // named `Claim acquisition considered harmful`, which is how a renamed
-        // section slips past a gate like this (caught while sabotage-testing
-        // this very leg). A single-token citation — `§B`, `§C.2`,
-        // `§host.aiProviders` — legitimately prefixes a longer heading
-        // (`## §B — Channel resolution …`), so prefix matching stays for those.
-        const hit = keys.has(want)
-          || (!want.includes(' ') && [...keys].some((k) => k.startsWith(want)));
-        if (!hit) dangling.push(`${src.split('/').slice(-2).join('/')} → ${doc} §"${section}"`);
-      }
-    }
-
-    // Non-vacuity: these docs ARE cited. A zero here means the matcher stopped
-    // matching, not that the corpus got clean — the failure mode this file exists
-    // to prevent, one level up.
-    expect(
-      checked,
-      'spec-section-citations: no citations of the checked docs were found — the matcher is broken, not the corpus clean',
-    ).toBeGreaterThan(0);
-
-    expect(
-      dangling,
-      `dangling section citations (the cited heading does not exist):\n  ${dangling.join('\n  ')}`,
-    ).toEqual([]);
-  });
-});

package/src/scenarios/tool-result-trust-monotone.test.ts

@@ -1,168 +0,0 @@
-/**
- * tool-result-trust-monotone — RFC 0143, the general rule the corpus's ~ten
- * point-invariants instance.
- *
- * The threat model fences ~ten specific untrusted-content ingresses into the
- * prompt (user input, RAG, artifacts, MCP, node-pack output, runner, card
- * inputs, form-content, voice), each with its own MUST. It never stated the
- * general rule: **a tool result is content entering model context, untrusted
- * unless the host has a named basis for trust, and trust is the MEET of a
- * composed segment's inputs — never raised by any transformation.** Absent that
- * rule the FRMD-F1-1 laundering path (untrusted → tool → "result" → prompt,
- * tag dropped in transit) is unforbidden in general, and nothing catches the
- * NEXT ingress shipped without a fence.
- *
- * Always-on, server-free, three parts:
- *
- *   PART 1 — COMPLETENESS (load-bearing). Every content-ingress surface the
- *   threat model's §4 STRIDE table names cites a fencing invariant that
- *   actually EXISTS in SECURITY/invariants.yaml — no dangling reference — AND a
- *   curated floor of prompt-ingress surfaces each resolves to a real invariant.
- *   A new ingress added to §4 without a trust invariant reds this. The
- *   general-rule analog of RFC 0138's "every manifest admits the hatch"; the
- *   thing the point-invariants alone cannot provide.
- *
- *   PART 2 — the MEET is stated normatively. The new §2a states monotone
- *   composition, untrusted-by-default with "a tool ran" NOT a basis,
- *   no-laundering-through-storage, both blessed strategies, and the isolation
- *   carve-out. Prose-pinned: the schema cannot express "MUST be the meet."
- *
- *   PART 3 — the instances name the general rule. ai-envelope.md §"Trust
- *   boundary" cross-references §2a, so the MCP/A2A special case is anchored to
- *   the general rule and cannot drift into contradicting it.
- *
- * WHAT THIS DOES NOT COVER — host behavior. Dynamic propagation through the
- * durable-store hop (strategy a) is witnessed by the reference host (memory
- * lane), not here; and the completeness leg is only as complete as §4 (an
- * ingress that exists in a host but was never added to §4 is invisible —
- * RFC 0143 unresolved-question 1).
- *
- * @see RFCS/0143-tool-result-trust-propagation.md
- * @see SECURITY/threat-model-prompt-injection.md §2a, §4, §5
- * @see spec/v1/ai-envelope.md §"Trust boundary"
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync, existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
-
-// Repo root = parent of schemas/ (the canonical anchor other scenarios use).
-// SECURITY/ is not vendored into the published package layout, so guard reads
-// and skip when absent — the same posture as V1_DIR === null.
-const REPO_ROOT: string | null = (() => {
-  const r = dirname(SCHEMAS_DIR);
-  return existsSync(join(r, 'SECURITY', 'invariants.yaml')) ? r : null;
-})();
-
-const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
-
-const TM = REPO_ROOT ? readFileSync(join(REPO_ROOT, 'SECURITY', 'threat-model-prompt-injection.md'), 'utf8') : '';
-const INV = REPO_ROOT ? readFileSync(join(REPO_ROOT, 'SECURITY', 'invariants.yaml'), 'utf8') : '';
-const ENV = V1_DIR ? readFileSync(join(V1_DIR, 'ai-envelope.md'), 'utf8') : '';
-
-/** All invariant ids declared in SECURITY/invariants.yaml. */
-function declaredInvariants(): Set<string> {
-  const ids = new Set<string>();
-  for (const m of INV.matchAll(/^\s*- id:\s*([a-z0-9-]+)\s*$/gim)) ids.add(m[1]);
-  return ids;
-}
-
-/** Every invariant id CITED in a §4 STRIDE `Invariant` column (backticked, kebab-case). */
-function citedInSection4(): string[] {
-  const start = TM.indexOf('## 4.');
-  const s4 = start >= 0 ? TM.slice(start, TM.indexOf('\n## 5.')) : '';
-  const ids = new Set<string>();
-  // Backticked kebab identifiers that look like invariant ids (contain a hyphen,
-  // lowercase). Excludes prose backticks like `core.*` (has a dot) and `exec`.
-  for (const m of s4.matchAll(/`([a-z][a-z0-9]+(?:-[a-z0-9]+)+)`/g)) {
-    const id = m[1];
-    if (!id.includes('.') && !id.includes('_')) ids.add(id);
-  }
-  return [...ids];
-}
-
-describe('tool-result-trust-monotone: COMPLETENESS — no unfenced ingress (RFC 0143 part 1)', () => {
-  const declared = declaredInvariants();
-
-  it.skipIf(REPO_ROOT === null)('every invariant the §4 STRIDE table cites actually exists (no dangling fence)', () => {
-    const cited = citedInSection4();
-    expect(cited.length, why('threat-model §4', 'the STRIDE table cites fencing invariants')).toBeGreaterThan(5);
-    // Only assert for ids that ARE invariants (present in the file) OR are
-    // clearly invariant-shaped; a cited id that resolves to nothing is drift.
-    const dangling = cited.filter((id) => /injection|trust|untrusted|marker|sandbox|exec|a2ui|voice|runner|pack/.test(id) && !declared.has(id));
-    expect(
-      dangling,
-      why('threat-model §4', `every invariant-shaped id cited in §4 MUST exist in invariants.yaml — dangling: ${dangling.join(', ')}`),
-    ).toEqual([]);
-  });
-
-  it.skipIf(REPO_ROOT === null)('the curated floor of prompt-ingress surfaces each has a real fencing invariant', () => {
-    // The core content-ingress-to-prompt surfaces. If a surface is de-fenced or
-    // its invariant renamed without updating this floor, the leg reds — this is
-    // the "next ingress shipped unfenced" guard, scoped to the known set.
-    const FLOOR: Record<string, string[]> = {
-      'user input': ['prompt-injection-input-marker'],
-      'RAG / knowledge base': ['prompt-injection-kb-marker'],
-      'prior artifact': ['prompt-injection-artifact-marker'],
-      'MCP tool result': ['prompt-injection-mcp-marker'],
-      'node-pack output': ['node-pack-output-untrusted'],
-      'self-hosted runner': ['runner-output-untrusted-transport'],
-      'chat-card input': ['chat-card-input-trust-boundary'],
-      'form-content pack strings': ['form-content-pack-string-trust-boundary'],
-      'voice transcript': ['voice-transcript-untrusted'],
-      'compose boundary (the meet)': ['prompt-composed-trust-marker'],
-    };
-    for (const [surface, inv] of Object.entries(FLOOR)) {
-      const present = inv.filter((i) => declared.has(i));
-      expect(
-        present,
-        why('threat-model §5 / invariants.yaml', `the "${surface}" ingress MUST retain a fencing invariant (${inv.join(' | ')})`),
-      ).toEqual(inv);
-    }
-  });
-
-  it.skipIf(REPO_ROOT === null)('the general rule itself is a declared invariant', () => {
-    expect(
-      declared.has('tool-result-trust-monotone'),
-      why('invariants.yaml', 'RFC 0143 mints the general monotone-composition invariant the point-invariants instance'),
-    ).toBe(true);
-  });
-});
-
-describe('tool-result-trust-monotone: the MEET is stated normatively (RFC 0143 part 2)', () => {
-  it.skipIf(REPO_ROOT === null)('§2a exists and states monotone composition (the meet)', () => {
-    expect(/## 2a\. Trust is monotone through composition/i.test(TM), why('threat-model §2a', 'the general-rule section exists')).toBe(true);
-    expect(
-      /MUST be the \*\*meet\*\*|MUST be the meet of its inputs/i.test(TM),
-      why('threat-model §2a', 'a composed segment\'s trust MUST be the MEET of its inputs — one untrusted input taints the segment'),
-    ).toBe(true);
-  });
-
-  it.skipIf(REPO_ROOT === null)('"a tool ran" is explicitly NOT a basis for trust', () => {
-    expect(
-      /tool having executed and returned is\W{0,4}\s*NOT a basis/i.test(TM),
-      why('threat-model §2a', 'untrusted-by-default — a tool having run is not a trust basis'),
-    ).toBe(true);
-  });
-
-  it.skipIf(REPO_ROOT === null)('no laundering through storage, and both strategies are blessed', () => {
-    expect(/does not launder it/i.test(TM), why('threat-model §2a', 'persist-then-recall does not launder (closes FRMD-F1-1)')).toBe(true);
-    expect(/dynamic coarse-grained propagation/i.test(TM) && /static reader classification/i.test(TM), why('threat-model §2a', 'both conforming strategies named')).toBe(true);
-    expect(/[Vv]alue-granular taint.{0,60}NOT required/i.test(TM), why('threat-model §2a', 'value-granular taint is NOT required — the floor is the coarse meet')).toBe(true);
-  });
-
-  it.skipIf(REPO_ROOT === null)('the structurally-isolated-reader carve-out is present and narrow', () => {
-    expect(/structurally isolated/i.test(TM), why('threat-model §2a', 'the isolation carve-out exists so correct sandboxing is not punished')).toBe(true);
-    expect(/missing.{0,20}`?"?trusted"?`?.{0,40}violat|absence of a trust decision is\W{0,4}\s*`?untrusted`?/i.test(TM), why('threat-model §2a', 'the fail-open (missing ⇒ trusted) default is the violation')).toBe(true);
-  });
-});
-
-describe('tool-result-trust-monotone: the instances name the general rule (RFC 0143 part 3)', () => {
-  it.skipIf(V1_DIR === null)('ai-envelope.md §"Trust boundary" cross-references §2a / RFC 0143', () => {
-    expect(
-      /named instance.{0,80}(§2a|RFC 0143|monotone-composition)/is.test(ENV),
-      why('ai-envelope.md §"Trust boundary"', 'the MCP/A2A rule cites the general rule as its instance, so it cannot drift into contradicting it'),
-    ).toBe(true);
-  });
-});

package/src/scenarios/versioned-composition-profiles.test.ts

@@ -1,201 +0,0 @@
-/**
- * RFC 0152 + RFC 0153 — versioned A2A and MCP composition, shape only.
- *
- * **Stated first, because RFC 0147 §A.5 turns on it:** this file proves the
- * discovery schema admits the versioned shapes §A describes and rejects the ones
- * it forbids. It contacts no peer. It is therefore **not** evidence that this
- * host interoperates with any A2A 1.0 or MCP 2026-07-28 implementation, and
- * neither RFC can reach a defensible `Accepted` on it. Both additionally require
- * a real upstream peer in CI, which is not a corpus deliverable.
- *
- * The defect both RFCs address is the same, which is why they land together:
- * **`supported: true` with no version is a claim a peer cannot negotiate
- * against.** It asserts the host speaks *some* A2A or *some* MCP. Two hosts can
- * both advertise it, share no revision, and discover that only when a call
- * fails — and the failure surfaces at the peer, not at the handshake that was
- * supposed to prevent it. Versioning the advertisement moves the disagreement to
- * the one place both sides are looking.
- *
- * Two shape choices worth keeping:
- *
- *   - **MCP versions are date-patterned, not free strings.** MCP revisions *are*
- *     dates. Accepting `latest` or `2026-7-28` would let two hosts disagree
- *     about which revision they share while both validate.
- *   - **The MCP feature list is closed.** An unrecognized feature name is
- *     indistinguishable from a typo, and a peer that silently ignores one has
- *     negotiated a capability neither side implements.
- *
- * Server-free.
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
-import { join, resolve as pathResolve } from 'node:path';
-import Ajv2020 from 'ajv/dist/2020.js';
-import { SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
-
-/**
- * Schemas ship inside the package; RFC prose does not. Deriving both from
- * `V1_DIR` — null in the published tarball — and casting the null away with
- * `as string` is what took this file down at import when installed from npm.
- */
-const RFCS_DIR = V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'RFCS');
-
-function caps(): Record<string, unknown> {
-  return JSON.parse(
-    readFileSync(join(SCHEMAS_DIR, 'capabilities.schema.json'), 'utf8'),
-  ) as Record<string, unknown>;
-}
-
-/** Compile one capability family in isolation. */
-function familyValidator(family: string) {
-  const schema = caps() as { properties: Record<string, object> };
-  const ajv = new Ajv2020({ strict: false, allErrors: true });
-  return ajv.compile(schema.properties[family] as object);
-}
-
-describe('RFC 0152 §A — A2A versioned discovery', () => {
-  const validate = familyValidator('a2a');
-
-  /**
-   * The `a2a` family independently requires `agentCardUrl` (RFC 0100: it must
-   * GET-resolve credential-less). Every fixture below carries it.
-   *
-   * This is not tidiness. Without it the NEGATIVE legs would have failed
-   * validation for the missing card URL rather than for the version defect they
-   * name — passing for the wrong reason, which is the vacuity this whole
-   * program exists to close, committed inside a test written to prevent it.
-   */
-  const a2a = (over: Record<string, unknown>) => ({
-    supported: true,
-    agentCardUrl: 'https://host.example/.well-known/agent-card.json',
-    ...over,
-  });
-
-  it('a versioned advertisement validates', () => {
-    expect(
-      validate(a2a({
-        protocolVersions: ['1.0', '0.3'],
-        preferredVersion: '1.0',
-        profiles: ['a2a-1.0', 'a2a-0.3-legacy'],
-        durableTasks: true,
-      })),
-      JSON.stringify(validate.errors),
-    ).toBe(true);
-  });
-
-  it('a legacy-only host can say so explicitly', () => {
-    // The point of naming the legacy profile: a deprecation you can see is one
-    // you can time-bound. A bare `supported: true` hides the same fact.
-    expect(
-      validate(a2a({ protocolVersions: ['0.3'], preferredVersion: '0.3', profiles: ['a2a-0.3-legacy'] })),
-      JSON.stringify(validate.errors),
-    ).toBe(true);
-  });
-
-  it('an empty version list is rejected', () => {
-    expect(
-      validate(a2a({ protocolVersions: [] })),
-      'RFC 0152 §A: an A2A-capable host MUST advertise a NON-EMPTY `protocolVersions`. An empty ' +
-        'array is the bare `supported: true` problem wearing a schema — it validates and tells a ' +
-        'peer nothing it can negotiate against.',
-    ).toBe(false);
-  });
-
-  it('duplicate versions are rejected', () => {
-    expect(validate(a2a({ protocolVersions: ['1.0', '1.0'] }))).toBe(false);
-  });
-
-  it('a malformed version is rejected', () => {
-    for (const v of ['1', 'v1.0', 'latest', '1.0.0']) {
-      expect(
-        validate(a2a({ protocolVersions: [v] })),
-        `RFC 0152 §A: '${v}' is not an A2A major.minor version`,
-      ).toBe(false);
-    }
-  });
-
-  it('a malformed profile id is rejected', () => {
-    expect(validate(a2a({ protocolVersions: ['1.0'], profiles: ['a2a-latest'] }))).toBe(false);
-    expect(validate(a2a({ protocolVersions: ['1.0'], profiles: ['a2a-1.0'] }))).toBe(true);
-  });
-});
-
-describe('RFC 0153 §A — MCP versioned discovery', () => {
-  const validate = familyValidator('mcp');
-
-  it('a versioned advertisement validates', () => {
-    expect(
-      validate({
-        supported: true,
-        protocolVersions: ['2026-07-28', '2025-06-18'],
-        preferredVersion: '2026-07-28',
-        profiles: ['mcp-2026-07-28', 'mcp-2025-06-18-legacy'],
-        features: ['server-discover', 'mrtr', 'cacheable-lists', 'extensions'],
-      }),
-      JSON.stringify(validate.errors),
-    ).toBe(true);
-  });
-
-  it('the v1.0 baseline `serverUrls` (required by mcp-discoverability when supported:true) validates — path or absolute URL, non-empty, no duplicates', () => {
-    // S27 (2026-08-17): the schema was `additionalProperties: false` and did not
-    // list `serverUrls`, while mcp-discoverability.test.ts REQUIRED it — a host
-    // could not satisfy the scenario and the schema at once. The second sibling
-    // host measured the contradiction on its own advert.
-    expect(
-      validate({ supported: true, serverUrls: ['/v1/host/openwop-app/mcp'], protocolVersions: ['2026-07-28'] }),
-      JSON.stringify(validate.errors),
-    ).toBe(true);
-    expect(
-      validate({ supported: true, serverUrls: ['https://example.test/canvasApi/v1/mcp'], protocolVersions: ['2024-11-05'], preferredVersion: '2024-11-05' }),
-      JSON.stringify(validate.errors),
-    ).toBe(true);
-    expect(validate({ supported: true, serverUrls: [] }), 'empty serverUrls is the bare `supported: true` problem').toBe(false);
-    expect(validate({ supported: true, serverUrls: ['/a', '/a'] }), 'duplicates').toBe(false);
-    expect(validate({ supported: true, serverUrls: [''] }), 'an empty string is not a mount').toBe(false);
-  });
-
-  it('versions use MCP date form exactly', () => {
-    // MCP revisions ARE dates. `latest` or a non-padded month would let two
-    // hosts disagree about which revision they share while both validate.
-    for (const v of ['latest', '2026-7-28', '2026-07', 'v2026-07-28']) {
-      expect(
-        validate({ supported: true, protocolVersions: [v] }),
-        `RFC 0153 §A: '${v}' is not MCP's date form`,
-      ).toBe(false);
-    }
-    expect(validate({ supported: true, protocolVersions: ['2026-07-28'] })).toBe(true);
-  });
-
-  it('the feature list is closed', () => {
-    expect(
-      validate({ supported: true, protocolVersions: ['2026-07-28'], features: ['server-discover', 'telepathy'] }),
-      'RFC 0153 §A: an unrecognized feature name is indistinguishable from a typo, and a peer ' +
-        'that silently ignores one has negotiated a capability neither side implements.',
-    ).toBe(false);
-  });
-
-  it('an empty version list is rejected', () => {
-    expect(validate({ supported: true, protocolVersions: [] })).toBe(false);
-  });
-});
-
-describe.skipIf(RFCS_DIR === null)('RFC 0152 + 0153 — what these do NOT establish', () => {
-  it('both RFCs keep their upstream-peer acceptance items unticked and annotated', () => {
-    // RFC 0147 §A.5 forbids `Accepted` on shape-only evidence for a behavioral
-    // requirement. Schema validity is not interop: nothing here speaks to a
-    // peer, and both RFCs require a real upstream implementation in CI. This
-    // leg exists so the suite cannot read as more than it is.
-    for (const [file, needle] of [
-      ['0152-a2a-1-0-versioned-composition.md', 'Real upstream A2A 1.0 peer passes in CI.'],
-      ['0153-mcp-2026-07-28-versioned-composition.md', 'Pinned real MCP current peer passes in CI.'],
-    ] as const) {
-      const rfc = readFileSync(join(RFCS_DIR as string, file), 'utf8');
-      expect(
-        new RegExp(`- \\[ \\] ${needle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*\\(`).test(rfc),
-        `${file}: the upstream-peer item MUST remain unticked and annotated — no peer is contacted ` +
-          'anywhere in this corpus, and interop is the one thing a schema cannot demonstrate.',
-      ).toBe(true);
-    }
-  });
-});

package/src/scenarios/workflow-chain-internal-flag.test.ts

@@ -1,84 +0,0 @@
-/**
- * Workflow-chain gallery visibility — `internal` chains (RFC 0135).
- *
- * Server-free corpus legs (always-on): the manifest schema's §WorkflowChain carries
- * a boolean `internal` property; a chain declaring `internal: true` validates; a
- * non-boolean `internal` is rejected; the spec documents the MUST-omit-from-default-
- * gallery rule and the not-an-authorization-boundary rule.
- *
- * The gallery-omission behavior itself is host-catalog presentation with no
- * normative wire listing endpoint, so it is witnessed at the reference host (host
- * regression test), not over the wire — see RFC 0135 §Conformance.
- *
- * @see spec/v1/workflow-chain-packs.md §"Chain visibility (RFC 0135)"
- * @see schemas/workflow-chain-pack-manifest.schema.json §WorkflowChain
- * @see RFCS/0135-workflow-chain-internal-visibility.md
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import Ajv2020 from 'ajv/dist/2020.js';
-import addFormats from 'ajv-formats';
-import { SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
-
-const cite = (section: string, requirement: string): string => `${section} — ${requirement}`;
-const MANIFEST = join(SCHEMAS_DIR, 'workflow-chain-pack-manifest.schema.json');
-// S38 (2026-08-17): `spec/` is NOT in the published package (`files`), so a path built
-// from SCHEMAS_DIR/../spec ENOENTs for every npm consumer — five always-on legs reddened
-// MyndHyve's bundle for a reason that had nothing to do with the host. Prose legs are
-// repo-layout only: `null` in the published layout and skipped, never thrown.
-const CHAIN_DOC: string | null = V1_DIR === null ? null : join(V1_DIR, 'workflow-chain-packs.md');
-
-function packWith(internal: unknown): Record<string, unknown> {
-  return {
-    name: 'vendor.acme.factory',
-    version: '1.0.0',
-    kind: 'workflow-chain',
-    engines: { openwop: '^1' },
-    chains: [
-      {
-        chainId: 'acme.child-batch',
-        version: '1.0.0',
-        label: 'Child Batch (Factory child)',
-        description: 'Composition-only child fragment; composed by acme.factory.',
-        ...(internal !== undefined ? { internal } : {}),
-        parameters: {},
-        dag: { nodes: [{ id: 'build', typeId: 'core.ai.callPrompt', config: {} }] },
-      },
-    ],
-  };
-}
-
-describe('workflow-chain-internal-flag §A: corpus (RFC 0135, always-on)', () => {
-  it('the manifest §WorkflowChain declares a boolean `internal` property', () => {
-    const schema = JSON.parse(readFileSync(MANIFEST, 'utf8')) as {
-      $defs?: Record<string, { properties?: Record<string, { type?: string }> }>;
-    };
-    const internal = schema.$defs?.WorkflowChain?.properties?.internal;
-    expect(internal, cite('§WorkflowChain', 'internal property present')).toBeTruthy();
-    expect(internal?.type, cite('§WorkflowChain', 'internal is boolean')).toBe('boolean');
-  });
-
-  it('a chain declaring internal: true validates; a non-boolean internal is rejected', () => {
-    const ajv = new Ajv2020({ allErrors: true, strict: false });
-    addFormats(ajv);
-    const validate = ajv.compile(JSON.parse(readFileSync(MANIFEST, 'utf8')) as Record<string, unknown>);
-    expect(validate(packWith(true)), cite('§WorkflowChain', `internal:true validates: ${ajv.errorsText(validate.errors)}`)).toBe(true);
-    expect(validate(packWith(undefined)), cite('§WorkflowChain', 'absent internal stays valid (absent ⇒ false)')).toBe(true);
-    expect(validate(packWith('yes')), cite('§WorkflowChain', 'non-boolean internal rejected')).toBe(false);
-  });
-
-  it.skipIf(CHAIN_DOC === null)('the spec documents the MUST-omit-from-default-gallery + not-an-authz-boundary rules', () => {
-    const doc = readFileSync(CHAIN_DOC as string, 'utf8');
-    expect(doc.includes('Chain visibility (RFC 0135)'), cite('§Chain visibility', 'section present')).toBe(true);
-    expect(
-      /internal[\s\S]{0,600}MUST omit/i.test(doc),
-      cite('§Chain visibility', 'documents MUST omit from default listing'),
-    ).toBe(true);
-    expect(
-      /NOT an authorization boundary/i.test(doc),
-      cite('§Chain visibility', 'documents internal is not an authz boundary'),
-    ).toBe(true);
-  });
-});