@openwop/openwop-conformance 1.153.0 → 1.154.0

package/src/lib/risk-disposition.test.ts

@@ -1,91 +0,0 @@
-/**
- * Unit tests for the closed/transferred predicate in
- * `scripts/generate-assurance-status.mjs`.
- *
- * This predicate is not cosmetic. Project-wide gates have been keyed to the
- * open-Critical count it produces, so a false closure silently loosens a
- * constraint — and a false open silently keeps one in force.
- *
- * It previously matched the bare substring `closed` anywhere in a row's status
- * cell, which produced two failures in opposite directions:
- *
- *   · RFC 0151 R1 ("Compensation executes twice", Critical) reads
- *     "Open — ... unwitnessed" and was counted CLOSED from 2026-08-16 onward,
- *     because the cell mentions "(G1 closed 2026-08-16)" — a DIFFERENT item's
- *     closure. A substring of an adjacent concept.
- *   · A row stating that a risk "cannot be closed by repository work" was
- *     counted closed by saying so.
- *
- * The predicate is duplicated here rather than imported because the generator is
- * a standalone ESM script with no exports; the duplication is pinned by
- * `matches the generator's source` below, which fails if the two drift.
- *
- * @see scripts/generate-assurance-status.mjs
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync, existsSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { V1_DIR } from './paths.js';
-
-const NEGATED = /\b(cannot|can ?not|could not|will not|never|not)\s+be\s+(closed|resolved)\b|\bnot closed\b/i;
-const EXPLICIT = /\*\*(CLOSED|Closed)\b|~~|Realised and remediated/i;
-const TRANSFERRED = /\*\*(?:OPEN\s+—\s+)?TRANSFERRED\b/i;
-
-function disposition(status: string): 'closed' | 'transferred' | 'open' {
-  const closed = EXPLICIT.test(status) && !NEGATED.test(status);
-  if (closed) return 'closed';
-  return TRANSFERRED.test(status) ? 'transferred' : 'open';
-}
-
-describe('assurance risk disposition', () => {
-  it('does NOT read a nested reference to another item as this row being closed', () => {
-    // The exact RFC 0151 R1 shape. "Open", "unwitnessed", and a parenthetical
-    // about gap G1 closing — a different thing entirely.
-    const status =
-      'Open — **Sweep 2026-08-16:** **Mitigated in prose** — inverse-action identity tuple stated; ' +
-      '`compensation.md` §C now states the persistence shape (G1 closed 2026-08-16); unwitnessed for retry-stability';
-    expect(disposition(status)).toBe('open');
-  });
-
-  it('does NOT read a row that says a risk cannot be closed as closed', () => {
-    expect(disposition('**OPEN — TRANSFERRED.** This risk cannot be closed by repository work.')).not.toBe('closed');
-  });
-
-  it('reads an explicit marker as closed', () => {
-    expect(disposition('**CLOSED.** The recurrence mechanism is in the tree and executing.')).toBe('closed');
-    expect(disposition('~~superseded~~ — folded into RFC 0150 §D')).toBe('closed');
-    expect(disposition('**Realised and remediated in scope:** bundle 1 invalidated')).toBe('closed');
-  });
-
-  it('distinguishes transferred from open, because §A.1 turns on the difference', () => {
-    expect(disposition('**OPEN — TRANSFERRED to a named tracked surface.** Tracked in KNOWN-LIMITS.')).toBe('transferred');
-    expect(disposition('Open — unwitnessed. No host advertises the capability.')).toBe('open');
-  });
-
-  it('is not fooled by the word appearing in ordinary prose', () => {
-    expect(disposition('Open — the comment window closed without review.')).toBe('open');
-    expect(disposition('Open — closes when a host implements fencing.')).toBe('open');
-  });
-
-  it('matches the generator source — fails if the two drift apart', () => {
-    // `V1_DIR` is null in the PUBLISHED package layout, which ships no `spec/`
-    // and no `scripts/`. Resolving the path at module scope — or casting the
-    // null away — is what made six scenarios throw at import for every npm
-    // consumer while staying green in a repo checkout. Resolve inside the test
-    // and skip when the repo is not there.
-    if (V1_DIR === null) return;
-    const script = join(dirname(V1_DIR), '..', 'scripts', 'generate-assurance-status.mjs');
-    if (!existsSync(script)) return;
-    const src = readFileSync(script, 'utf8');
-    // Guard the shape, not the byte-for-byte text: the generator must still gate
-    // on an explicit marker AND a negation check, never on a bare substring.
-    expect(src, 'generator must keep the negation guard').toMatch(/const negated = /);
-    expect(src, 'generator must require an explicit closed marker').toMatch(/const explicitlyClosed =/);
-    expect(src, 'generator must still separate transferred rows').toMatch(/const transferred = /);
-    expect(
-      /const closed = \/\(\^\|\\s\)\(closed\|resolved/.test(src),
-      'the bare-substring test must not come back',
-    ).toBe(false);
-  });
-});

package/src/lib/saml-idp.test.ts

@@ -1,127 +0,0 @@
-/**
- * Server-free unit tests for the synthetic SAML IdP harness — specifically its
- * TWO-TRUST-ROOT behaviour (RFC 0163 §B, gap G-fixture, #1163).
- *
- * These assertions prove the FIXTURE, not any host: two instances with distinct
- * `entityID`s and signing keys can mint an assertion for the SAME opaque
- * subject id (an identifier collision) while remaining cryptographically and
- * by-issuer distinguishable. That is what makes the §B same-IdP MUST
- * witnessable — a host comparing the SAML Issuer to the SCIM connection's IdP
- * entityID has a well-defined, causable negative.
- *
- * They live here rather than in `scenarios/auth-subject-link-key-class.test.ts`
- * on purpose: a scenario file that passes fixture self-tests and soft-skips its
- * host legs resolves to `executed-pass` in every host's certification bundle
- * (conformance-certification.md gap G8), which would credit a host that never
- * advertised subject linking with a witness about a fixture. `src/lib/` tests
- * run in the published suite but produce no scenario ledger row, exactly like
- * `oidc-issuer.test.ts`.
- *
- * @see conformance/src/lib/saml-idp.ts
- * @see RFCS/0163-subject-linking-hardening.md §B
- *
- * The RFC 0050 §A reference suite (1 positive + 6 negative variants against the
- * same fixture) moved here from `scenarios/auth-saml-profile.test.ts` on
- * 2026-09-02 (RFC 0163 gap G5) for the same reason.
- */
-
-import { describe, it, expect } from 'vitest';
-import { createSyntheticSamlIdp, DEFAULT_SAML_ENTITY_ID, type SamlVariant } from './saml-idp.js';
-
-const COLLIDING_SUBJECT = 'idp-op-8f3a';
-
-describe('saml-idp: two-trust-root fixture (RFC 0163 §B)', () => {
-  const idpA = createSyntheticSamlIdp({ entityID: 'urn:openwop:conformance:idp-A' });
-  const idpB = createSyntheticSamlIdp({ entityID: 'urn:openwop:conformance:idp-B' });
-
-  it('a lone instance keeps the canonical default entityID (RFC 0050 behaviour unchanged)', () => {
-    const lone = createSyntheticSamlIdp();
-    expect(lone.entityID).toBe(DEFAULT_SAML_ENTITY_ID);
-    expect(lone.verify(lone.mint('valid')).valid).toBe(true);
-  });
-
-  it('the two IdPs have distinct entityIDs and distinct signing keys (distinct trust roots)', () => {
-    expect(idpA.entityID).not.toBe(idpB.entityID);
-    expect(idpA.certificatePem).not.toBe(idpB.certificatePem);
-  });
-
-  it('both IdPs can mint a valid assertion for the SAME colliding subject id', () => {
-    const a = idpA.verify(idpA.mint('valid', { subject: COLLIDING_SUBJECT }));
-    const b = idpB.verify(idpB.mint('valid', { subject: COLLIDING_SUBJECT }));
-    expect(a.valid, `IdP-A must accept its own assertion; got ${a.reason}`).toBe(true);
-    expect(b.valid, `IdP-B must accept its own assertion; got ${b.reason}`).toBe(true);
-  });
-
-  it('the colliding assertions carry DIFFERENT signed Issuers (the trust-root discriminator)', () => {
-    const assertionA = idpA.mint('valid', { subject: COLLIDING_SUBJECT });
-    const assertionB = idpB.mint('valid', { subject: COLLIDING_SUBJECT });
-    expect(idpA.issuerOf(assertionA)).toBe('urn:openwop:conformance:idp-A');
-    expect(idpB.issuerOf(assertionB)).toBe('urn:openwop:conformance:idp-B');
-    expect(idpA.issuerOf(assertionA)).not.toBe(idpB.issuerOf(assertionB));
-  });
-
-  it('IdP-A REJECTS an assertion minted by IdP-B for the same subject (cross-root does not verify)', () => {
-    // The crux of RFC 0163 §B: an identifier collision across two trust roots
-    // is NOT a link. IdP-B signs with a different key AND stamps a different
-    // Issuer, so IdP-A's validator refuses it — a match on the opaque subject
-    // string alone can never authorize across the roots.
-    const crossRoot = idpB.mint('valid', { subject: COLLIDING_SUBJECT });
-    const r = idpA.verify(crossRoot);
-    expect(r.valid, 'an assertion from a DIFFERENT trust root MUST NOT verify against this IdP').toBe(false);
-    expect(r.reason).toBe('bad-signature');
-    expect(idpA.issuerOf(crossRoot)).not.toBe(idpA.entityID);
-  });
-
-  it('the Issuer is inside the signed element: swapping it post-signing breaks verification', () => {
-    // RFC 0163 §B.1 requires the trust-root identity to be signed so it cannot
-    // be rewritten to impersonate another root. Rewrite IdP-B's Issuer to
-    // IdP-A's entityID on an otherwise valid IdP-B assertion: the issuer now
-    // READS as A, but the signature was computed over B's canonical form.
-    const forged = idpB
-      .mint('valid', { subject: COLLIDING_SUBJECT })
-      .replace('<saml:Issuer>urn:openwop:conformance:idp-B</saml:Issuer>', '<saml:Issuer>urn:openwop:conformance:idp-A</saml:Issuer>');
-    expect(idpA.issuerOf(forged)).toBe(idpA.entityID);
-    expect(idpA.verify(forged).valid, 'a re-stamped Issuer MUST NOT verify').toBe(false);
-    expect(idpB.verify(forged).valid, 'the original root MUST NOT verify it either').toBe(false);
-  });
-});
-
-describe('saml-idp: synthetic-IdP reference suite (RFC 0050 §A)', () => {
-  // Server-free: the bundled synthetic IdP (conformance/src/lib/saml-idp.ts)
-  // mints a valid assertion + the 6 negative variants, and its verify()
-  // implements the RFC 0050 §A MUST list. This proves each negative is
-  // detectably malformed and gives the suite a reference SAML validator.
-  // A host's real ACS validates the SAME assertions over the
-  // `auth/saml/validate` seam (scenarios/auth-saml-profile.test.ts, gated on
-  // OPENWOP_TEST_SAML_IDP_URL).
-  const idp = createSyntheticSamlIdp();
-
-  it('publishes a PEM signing certificate', () => {
-    expect(idp.certificatePem).toContain('BEGIN PUBLIC KEY');
-  });
-
-  it('accepts a valid signed, in-window, non-wrapped assertion', () => {
-    const r = idp.verify(idp.mint('valid'));
-    expect(r.valid, `expected valid; got reason=${r.reason}`).toBe(true);
-  });
-
-  const negatives: ReadonlyArray<[Exclude<SamlVariant, 'valid'>, string]> = [
-    ['alg-none', 'alg-none'],
-    ['unsigned', 'unsigned'],
-    ['bad-signature', 'bad-signature'],
-    ['expired', 'expired'],
-    ['not-yet-valid', 'not-yet-valid'],
-    ['signature-wrapping', 'signature-wrapping'],
-  ];
-
-  for (const [variant, expectedReason] of negatives) {
-    it(`rejects the ${variant} assertion (RFC 0050 §A MUST)`, () => {
-      const r = idp.verify(idp.mint(variant));
-      expect(r.valid, `${variant} MUST be rejected`).toBe(false);
-      expect(
-        r.reason,
-        `${variant} MUST be rejected for the ${expectedReason} reason`,
-      ).toBe(expectedReason);
-    });
-  }
-});

package/src/lib/spec-coherence-registry.test.ts

@@ -1,155 +0,0 @@
-/**
- * Keeps `SPEC_COHERENCE_SCENARIOS` honest by re-deriving it from source.
- *
- * A hand-maintained list of filenames is a claim that decays silently: a new
- * spec-coherence scenario lands and reports `blocked` in every host's bundle
- * forever, or one grows a `driver` call and starts telling hosts a requirement
- * about their own behaviour does not apply to them. Neither shows up as a
- * failure anywhere — which is the whole reason the original defect survived.
- *
- * The membership rule is mechanical, so the check can be too:
- *   gates on `V1_DIR === null`  AND  never calls `driver.get/post/delete`.
- */
-
-import { describe, expect, it } from 'vitest';
-import { readFileSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL, SPEC_COHERENCE_EXCLUDED } from './spec-coherence.js';
-import { resolveFileRecord } from './scenario-disposition.js';
-
-const SCENARIOS = new URL('../scenarios/', import.meta.url).pathname;
-
-function derive(): { pure: string[]; hostTouching: string[] } {
-  const pure: string[] = [];
-  const hostTouching: string[] = [];
-  for (const f of readdirSync(SCENARIOS)) {
-    if (!f.endsWith('.test.ts')) continue;
-    const src = readFileSync(join(SCENARIOS, f), 'utf8');
-    if (!/V1_DIR\s*===?\s*null/.test(src)) continue;
-    (/\bdriver\.(get|post|delete)\b/.test(src) ? hostTouching : pure).push(f);
-  }
-  return { pure: pure.sort(), hostTouching: hostTouching.sort() };
-}
-
-describe('SPEC_COHERENCE_SCENARIOS is derivable, not asserted', () => {
-  it('matches every scenario that reads spec/v1 and never drives a host', () => {
-    const { pure } = derive();
-    const listed = [...SPEC_COHERENCE_SCENARIOS].sort();
-    // Named diffs rather than a bare inequality: a failure here should say
-    // which file to add or drop, not that two sets differ.
-    expect(pure.filter((f) => !SPEC_COHERENCE_SCENARIOS.has(f)), 'reads spec/v1, drives no host, NOT in the registry — it will report `blocked` in every host bundle').toEqual([]);
-    expect(listed.filter((f) => !pure.includes(f)), 'in the registry but no longer qualifies — it now drives a host, or stopped reading spec/v1').toEqual([]);
-  });
-
-  it('the EXCLUDED set is exactly the host-touching ones — the exclusions are checked, not asserted in prose', () => {
-    // These used to live only in a docblock sentence. A peer grepping this file
-    // for membership matched that sentence and read all three named scenarios
-    // as members — the opposite of the truth, and the dangerous direction: it
-    // would mean host-behaviour rows downgraded to "does not apply to you" as a
-    // credit. Naming them in prose made the file lie to a reasonable reader.
-    const { hostTouching } = derive();
-    expect([...SPEC_COHERENCE_EXCLUDED].sort()).toEqual(hostTouching);
-  });
-
-  it('the two sets are disjoint and jointly exhaustive over the V1_DIR-gated files', () => {
-    // Disjoint: no scenario can be both "does not apply to any host" and
-    // "applies but was unwitnessable". Exhaustive: every V1_DIR-gated file has
-    // a decided disposition, so none falls back to the unclassified marker.
-    const { pure, hostTouching } = derive();
-    const overlap = [...SPEC_COHERENCE_SCENARIOS].filter((f) => SPEC_COHERENCE_EXCLUDED.has(f));
-    expect(overlap, 'a scenario cannot be both inapplicable-to-all-hosts and blocked-for-this-host').toEqual([]);
-    const union = new Set([...SPEC_COHERENCE_SCENARIOS, ...SPEC_COHERENCE_EXCLUDED]);
-    expect([...union].sort()).toEqual([...pure, ...hostTouching].sort());
-  });
-
-  it('excludes the host-touching ones, which are honestly `blocked`', () => {
-    // These assert ADVERTISED behaviour that a missing dependency prevented
-    // exercising — RFC 0148 §A's definition of `blocked`, verbatim. Calling
-    // them `inapplicable` would tell a host a requirement about its own
-    // behaviour does not apply to it.
-    const { hostTouching } = derive();
-    expect(hostTouching.length, 'expected some V1_DIR-gated scenarios to also drive the host').toBeGreaterThan(0);
-    for (const f of hostTouching) {
-      expect(SPEC_COHERENCE_SCENARIOS.has(f), `${f} drives a host and must NOT be classified inapplicable`).toBe(false);
-    }
-  });
-
-  it('the registry is non-empty — an empty set would silently disable the fix', () => {
-    expect(SPEC_COHERENCE_SCENARIOS.size).toBeGreaterThan(20);
-  });
-});
-
-describe('resolveFileRecord classifies a corpus scenario as inapplicable, not blocked', () => {
-  // A published-layout run: describe.skipIf fires at COLLECTION, so vitest
-  // reports the file's tests as skipped, nothing notes a reason, and before
-  // this change resolveFileRecord returned `blocked` with the unclassified
-  // marker — the row a host operator could not tell from a real gap.
-  const CORPUS = 'protocol-version-grammar.test.ts';
-
-  it('a corpus scenario that never ran is inapplicable, with a reason aimed at the host operator', () => {
-    const r = resolveFileRecord(['skip', 'skip'], undefined, 0, null, CORPUS);
-    expect(r.disposition).toBe('inapplicable');
-    expect(r.detail).toBe(SPEC_COHERENCE_DETAIL);
-    expect(r.detail).toContain('asserts nothing about a host');
-    expect(r.detail).toContain('OPENWOP_CONFORMANCE_ROOT');
-  });
-
-  it('WITHOUT the registry it would still be blocked — the branch is what changes it', () => {
-    // Same inputs, filename withheld: the pre-change behaviour. This is the
-    // negative control; if it ever returns `inapplicable`, the branch is not
-    // what is doing the work and the test above proves nothing.
-    const r = resolveFileRecord(['skip', 'skip'], undefined, 0, null);
-    expect(r.disposition).toBe('blocked');
-  });
-
-  it('a non-corpus scenario is untouched', () => {
-    const r = resolveFileRecord(['skip', 'skip'], undefined, 0, null, 'webhook-signed-delivery.test.ts');
-    expect(r.disposition).toBe('blocked');
-  });
-
-  it('a corpus scenario that FAILED is never laundered into inapplicable', () => {
-    // The guard that matters: if the corpus IS present and an assertion fails,
-    // that is a real spec-coherence defect and must stay executed-fail.
-    const r = resolveFileRecord(['pass', 'fail'], undefined, 12, null, CORPUS);
-    expect(r.disposition).toBe('executed-fail');
-  });
-
-  it('a corpus scenario that RAN and passed stays executed-pass', () => {
-    const r = resolveFileRecord(['pass'], undefined, 40, null, CORPUS);
-    expect(r.disposition).toBe('executed-pass');
-  });
-});
-
-describe('the published layout is what makes these rows comparable across hosts', () => {
-  // Load-bearing and, until now, tested nowhere.
-  //
-  // A spec-coherence row is `inapplicable` only when V1_DIR is null, and V1_DIR
-  // is null only when the layout resolves to `published`. Two peers established
-  // by measurement what the code implies: `resolveLayout()` keys off PKG_ROOT,
-  // not the consuming repo, so an npm-installed consumer's parent is always
-  // `node_modules/@openwop/` — which never contains `schemas/` no matter where
-  // the host's checkout sits on disk. Every npm-consuming host therefore gets
-  // the same answer, and the dispositions are comparable BY CONSTRUCTION.
-  //
-  // One peer had generalised the opposite way — "the disposition is a property
-  // of where the bundle was cut" — from a host whose own runner sets
-  // OPENWOP_CONFORMANCE_ROOT when it finds a sibling checkout. True of that
-  // host, false of the artifact. The distinction only survives if something
-  // holds the artifact to it.
-  //
-  // The thing that would break it is a change that looks HELPFUL: adding
-  // `spec` to `files` so "the corpus tests run for consumers too". That would
-  // silently give npm consumers V1_DIR, the 28 would execute instead of
-  // flipping, and every host's numbers would shift with no failure anywhere.
-  it('the published package ships no spec/ — so V1_DIR is null for npm consumers', () => {
-    const pkg = JSON.parse(readFileSync(join(SCENARIOS, '../../package.json'), 'utf8')) as { files: string[] };
-    expect(
-      pkg.files.filter((f) => f === 'spec' || f.startsWith('spec/')),
-      'adding spec/ to `files` would give npm consumers a V1_DIR, so the spec-coherence rows would execute '
-        + 'instead of reporting `inapplicable` — changing every host bundle with no test going red',
-    ).toEqual([]);
-    // schemas/ IS shipped, and is what selects the `published` layout. If this
-    // ever stops being true the layout resolves to neither branch.
-    expect(pkg.files, 'schemas/ is what makes resolveLayout() pick `published`').toContain('schemas');
-  });
-});

package/src/lib/webhook-receiver.test.ts

@@ -1,144 +0,0 @@
-/**
- * Unit tests for `webhook-receiver.ts` — the signature-header contract.
- *
- * This verifier is the reference a subscriber implementer copies. It required
- * `v1=` and therefore rejected, as malformed, the exact header `webhooks.md`
- * §"Delivery headers" mandates (`X-openwop-Signature: sha256={hex}`). The
- * divergence survived because `webhook-receiver-adversarial.test.ts` signs with
- * `signPayload` and verifies with `verifyWebhookDelivery` — a closed loop that is
- * self-consistent and wrong, and so green against every host. These cases pin the
- * header against the SPEC rather than against the suite's own output.
- *
- * @see webhook-receiver.ts, spec/v1/webhooks.md §"Delivery headers"
- */
-
-import { describe, it, expect, afterEach } from 'vitest';
-import { createHmac } from 'node:crypto';
-import {
-  SIGNATURE_PREFIX,
-  createReceiverState,
-  verifyWebhookDelivery,
-  signPayload,
-  resolveRegistrationUrl,
-} from './webhook-receiver.js';
-
-const SECRET = 'shhh-not-a-real-secret';
-const BODY = JSON.stringify({ event: { type: 'run.completed' } });
-
-/** Build the header exactly as `webhooks.md` documents it, not as we emit it. */
-function specShapedHeader(ts: number): string {
-  const hex = createHmac('sha256', SECRET).update(`${ts}.${BODY}`).digest('hex');
-  return `sha256=${hex}`;
-}
-
-describe('webhook-receiver: the X-openwop-Signature prefix follows the spec', () => {
-  it('the constant is the spec value, not the algorithm-header value', () => {
-    // `v1` names the SIGNING SCHEME (X-openwop-Signature-Algorithm). It is not
-    // the encoding prefix. One value, two fields — the conflation this fixes.
-    expect(SIGNATURE_PREFIX).toBe('sha256=');
-  });
-
-  it('ACCEPTS a header built to the spec by hand, with no help from signPayload', () => {
-    const ts = Math.floor(Date.now() / 1000);
-    const result = verifyWebhookDelivery(
-      SECRET,
-      specShapedHeader(ts),
-      'v1',
-      String(ts),
-      BODY,
-      createReceiverState(),
-    );
-    expect(result.accepted).toBe(true);
-  });
-
-  it('REJECTS the pre-2026-08-19 `v1=` prefix as malformed — the shape the spec never defined', () => {
-    const ts = Math.floor(Date.now() / 1000);
-    const hex = createHmac('sha256', SECRET).update(`${ts}.${BODY}`).digest('hex');
-    const result = verifyWebhookDelivery(
-      SECRET,
-      `v1=${hex}`,
-      'v1',
-      String(ts),
-      BODY,
-      createReceiverState(),
-    );
-    expect(result.accepted).toBe(false);
-    if (!result.accepted) expect(result.reason).toBe('malformed_signature_header');
-  });
-
-  it('signPayload emits what the verifier accepts AND what the spec documents', () => {
-    const ts = Math.floor(Date.now() / 1000);
-    const { signatureHeader, algorithmHeader } = signPayload(SECRET, ts, BODY);
-    // Both halves matter: agreeing with the verifier alone is the closed loop
-    // that hid the bug, so this also compares against the hand-built header.
-    expect(signatureHeader).toBe(specShapedHeader(ts));
-    expect(algorithmHeader).toBe('v1');
-  });
-});
-
-/**
- * `OPENWOP_WEBHOOK_RECEIVER_URL` validation.
- *
- * Each case names the gate it is about, taken from `webhooks.md`, rather than
- * restating the implementation: the point of the variable is to clear all three
- * SSRF gates honestly, so a value that cannot clear one of them is an operator
- * error the suite must refuse LOUDLY. A skip here would hide a
- * misconfiguration behind a disposition that reads as "the host could not be
- * exercised", which is a claim about the host and would be false.
- */
-describe('resolveRegistrationUrl — OPENWOP_WEBHOOK_RECEIVER_URL', () => {
-  const LOCAL = 'http://127.0.0.1:54321/';
-  const saved = process.env.OPENWOP_WEBHOOK_RECEIVER_URL;
-  const set = (v: string | undefined) => {
-    if (v === undefined) delete process.env.OPENWOP_WEBHOOK_RECEIVER_URL;
-    else process.env.OPENWOP_WEBHOOK_RECEIVER_URL = v;
-  };
-  afterEach(() => set(saved));
-
-  it('unset ⇒ registers the local receiver unchanged, not tunnelled', () => {
-    set(undefined);
-    expect(resolveRegistrationUrl(LOCAL)).toEqual({ url: LOCAL, tunnelled: false });
-  });
-
-  it('whitespace-only is treated as unset rather than as a malformed URL', () => {
-    set('   ');
-    expect(resolveRegistrationUrl(LOCAL)).toEqual({ url: LOCAL, tunnelled: false });
-  });
-
-  it('a public https front is used for registration and marked tunnelled', () => {
-    set('https://tunnel.example.com/hook');
-    expect(resolveRegistrationUrl(LOCAL)).toEqual({
-      url: 'https://tunnel.example.com/hook',
-      tunnelled: true,
-    });
-  });
-
-  it('rejects http: — cannot clear gate 1 (webhooks.md §"Register": url MUST be https)', () => {
-    set('http://tunnel.example.com/hook');
-    expect(() => resolveRegistrationUrl(LOCAL)).toThrow(/MUST be https/i);
-  });
-
-  it.each([
-    ['loopback name', 'https://localhost/hook'],
-    ['loopback v4', 'https://127.0.0.1/hook'],
-    ['RFC1918 10/8', 'https://10.1.2.3/hook'],
-    ['RFC1918 192.168/16', 'https://192.168.1.9/hook'],
-    ['RFC1918 172.16/12', 'https://172.20.0.5/hook'],
-    ['link-local', 'https://169.254.169.254/hook'],
-  ])('rejects %s — cannot clear gate 2 (registration-time address check)', (_label, url) => {
-    set(url);
-    expect(() => resolveRegistrationUrl(LOCAL)).toThrow(/publicly-resolvable/i);
-  });
-
-  it('rejects a value that is not a URL at all', () => {
-    set('not a url');
-    expect(() => resolveRegistrationUrl(LOCAL)).toThrow(/not a valid URL/i);
-  });
-
-  it('does not reject a public host that merely LOOKS private (172.32 is public)', () => {
-    // 172.16.0.0/12 ends at 172.31.255.255. A naive /^172\./ check would
-    // reject this and send an operator hunting a nonexistent misconfiguration.
-    set('https://172.32.0.1/hook');
-    expect(resolveRegistrationUrl(LOCAL).tunnelled).toBe(true);
-  });
-});

package/src/scenarios/artifact-schema-compile-bounded.test.ts

@@ -1,126 +0,0 @@
-/**
- * Bounded artifact-schema compilation (RFC 0071, `Active`).
- *
- * Always-on, server-free assertion for the SECURITY invariant
- * `artifact-schema-compile-bounded`. Artifact-type packs ship third-party
- * JSON Schemas that the engine compiles (Ajv) at install + validation time;
- * an unbounded compile is a denial-of-service vector (schema bombs:
- * pathological `$ref` recursion, keyword-count explosion, oversized payloads,
- * catastrophic-backtracking `pattern`s). This scenario asserts two things
- * that must hold for every release regardless of which host runs it:
- *
- *   PART 1 — contract present. `artifact-type-packs.md` carries the normative
- *   bounded-compilation MUST (serialized-size, `$ref`-depth, keyword-count
- *   bounds + wall-clock timeout), and `host-capabilities.md` §host.artifactTypes
- *   references it. Guards against the requirement being silently dropped.
- *
- *   PART 2 — defense is well-defined + implementable. A reference bounding
- *   predicate built from representative finite limits rejects three schema
- *   bombs and admits a benign artifact schema. The specific numeric limits are
- *   host-configurable per the spec (advertised, not protocol-mandated); the
- *   point is that *some* finite bound exists and catches the bombs while
- *   passing legitimate schemas.
- *
- * The behavioral end-to-end form (a host rejects an over-bounds pack at
- * registry `PUT` with `pack_validation_failed`) is capability-gated on
- * `host.artifactTypes.supported` and is `host-pending` until a reference host
- * lands; this server-free scenario is the always-on floor.
- *
- * @see spec/v1/artifact-type-packs.md §"Bounded schema compilation (normative)"
- * @see SECURITY/threat-model-node-packs.md §"Distributed artifact schemas"
- * @see RFCS/0071-artifact-type-and-chat-card-packs.md
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { V1_DIR } from '../lib/paths.js';
-
-const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
-
-describe('artifact-schema-compile-bounded: contract present in the corpus (RFC 0071, server-free)', () => {
-  const artifactDoc = V1_DIR ? readFileSync(join(V1_DIR, 'artifact-type-packs.md'), 'utf8') : '';
-  const hostCaps = V1_DIR ? readFileSync(join(V1_DIR, 'host-capabilities.md'), 'utf8') : '';
-
-  it.skipIf(V1_DIR === null)('artifact-type-packs.md declares the bounded-compilation MUST', () => {
-    expect(
-      /Bounded schema compilation/i.test(artifactDoc),
-      why('artifact-type-packs.md', 'a "Bounded schema compilation" section MUST exist'),
-    ).toBe(true);
-    expect(
-      /MUST bound/i.test(artifactDoc) && /MUST reject/i.test(artifactDoc),
-      why('artifact-type-packs.md §"Bounded schema compilation"', 'host MUST bound + MUST reject over-limit schemas'),
-    ).toBe(true);
-    // The three structural axes + the timeout MUST all be named.
-    for (const axis of [/byte size/i, /\$ref/i, /keyword/i, /timeout/i]) {
-      expect(axis.test(artifactDoc), why('artifact-type-packs.md', `bound axis ${axis} MUST be named`)).toBe(true);
-    }
-  });
-
-  it.skipIf(V1_DIR === null)('host-capabilities.md §host.artifactTypes references the bound', () => {
-    expect(
-      /artifact-schema-compile-bounded/.test(hostCaps),
-      why('host-capabilities.md §host.artifactTypes', 'MUST reference the bounded-compilation invariant'),
-    ).toBe(true);
-  });
-});
-
-describe('artifact-schema-compile-bounded: a finite bound catches schema bombs (RFC 0071, server-free)', () => {
-  // Representative, host-configurable limits (the spec leaves the exact values
-  // to host advertisement; these stand in for "some finite bound").
-  const LIMITS = { maxBytes: 64 * 1024, maxRefDepth: 16, maxKeywords: 2000 };
-
-  function refDepth(node: unknown, seen = 0): number {
-    if (node === null || typeof node !== 'object') return seen;
-    const obj = node as Record<string, unknown>;
-    const here = '$ref' in obj ? seen + 1 : seen;
-    let max = here;
-    for (const v of Object.values(obj)) max = Math.max(max, refDepth(v, here));
-    return max;
-  }
-  function keywordCount(node: unknown): number {
-    if (node === null || typeof node !== 'object') return 0;
-    const obj = node as Record<string, unknown>;
-    let n = Object.keys(obj).length;
-    for (const v of Object.values(obj)) n += keywordCount(v);
-    return n;
-  }
-  /** Reference bound predicate — the shape a conformant host applies at PUT/install. */
-  function exceedsBounds(schema: unknown): boolean {
-    const bytes = Buffer.byteLength(JSON.stringify(schema), 'utf8');
-    if (bytes > LIMITS.maxBytes) return true;
-    if (refDepth(schema) > LIMITS.maxRefDepth) return true;
-    if (keywordCount(schema) > LIMITS.maxKeywords) return true;
-    return false;
-  }
-
-  it('admits a benign artifact schema', () => {
-    const benign = {
-      $schema: 'https://json-schema.org/draft/2020-12/schema',
-      $id: 'https://h.example/schemas/artifacts/vendor.acme.cad.model.schema.json',
-      type: 'object',
-      additionalProperties: false,
-      required: ['name'],
-      properties: { name: { type: 'string' }, dims: { type: 'array', items: { type: 'number' } } },
-    };
-    expect(exceedsBounds(benign), why('artifact-type-packs.md', 'a legitimate artifact schema MUST NOT be rejected')).toBe(false);
-  });
-
-  it('rejects a $ref-depth bomb', () => {
-    // Nest $ref-bearing objects deeper than maxRefDepth so resolution depth accumulates.
-    let node: Record<string, unknown> = { type: 'string' };
-    for (let i = 0; i < LIMITS.maxRefDepth + 4; i++) node = { $ref: '#/x', properties: { nested: node } };
-    expect(exceedsBounds({ type: 'object', properties: { deep: node } }), why('threat-model-node-packs.md', 'a $ref-depth bomb MUST be rejected')).toBe(true);
-  });
-
-  it('rejects a keyword-count bomb', () => {
-    const props: Record<string, unknown> = {};
-    for (let i = 0; i < LIMITS.maxKeywords + 100; i++) props[`p${i}`] = { type: 'string' };
-    expect(exceedsBounds({ type: 'object', properties: props }), why('threat-model-node-packs.md', 'a keyword-count bomb MUST be rejected')).toBe(true);
-  });
-
-  it('rejects an oversized schema', () => {
-    const huge = { type: 'object', description: 'x'.repeat(LIMITS.maxBytes + 1) };
-    expect(exceedsBounds(huge), why('threat-model-node-packs.md', 'an over-size schema MUST be rejected')).toBe(true);
-  });
-});