@openwop/openwop-conformance 1.153.0 → 1.154.0

package/src/scenarios/artifact-type-legacy-ids.test.ts

@@ -1,124 +0,0 @@
-/**
- * artifact-type-legacy-ids — RFC 0141, legacy identifiers and the replay
- * migration constraint.
- *
- * Hosts predating RFC 0071 carry artifact-type ids outside the canonical
- * reverse-DNS pattern (`doc.one-pager`, `canvas.checklist`). The corpus never
- * said what those values are or how a host may migrate — and the constraint
- * that matters (an identifier migration MUST NOT rewrite the run-event log)
- * was only derivable by composing THREE documents. It got mis-derived once,
- * in a merged RFC, before being corrected (RFC 0138, 2026-08-07). RFC 0141
- * states the composed conclusion in one normative place; these legs pin it.
- *
- * PROSE-PINNING, always-on, server-free (the RFC 0138 part-3 pattern): the
- * schema cannot express "MUST NOT rewrite history", so the corpus stating the
- * rule IS the testable surface. Leg 1 anchors the prose to the schema pattern
- * it interprets, so the two cannot drift apart silently.
- *
- * WHAT THIS DOES NOT COVER — stated, not discovered later:
- *  - No leg exercises a HOST's alias behavior. That a host resolves aliases in
- *    validation is witnessed at openwop-app by its own sabotage-verified tests
- *    (openwop-app#3030), not by this suite.
- *  - No leg can detect a host that rewrote its log — a rewritten log is
- *    indistinguishable from an honest one after the fact. The prohibition is
- *    enforceable only by the host's own replay integrity.
- *
- * @see spec/v1/artifact-type-packs.md §"Legacy identifiers and migration"
- * @see RFCS/0141-legacy-artifact-type-identifiers.md
- * @see spec/v1/replay.md §"Determinism guarantees"
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import Ajv2020 from 'ajv/dist/2020.js';
-import addFormats from 'ajv-formats';
-import { SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
-
-const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
-
-describe('artifact-type-legacy-ids: the canonical pattern is the anchor (RFC 0141, server-free)', () => {
-  const ajv = new Ajv2020({ allErrors: true, strict: false });
-  addFormats(ajv);
-  const schema = JSON.parse(
-    readFileSync(join(SCHEMAS_DIR, 'artifact-type-pack-manifest.schema.json'), 'utf8'),
-  ) as Record<string, unknown>;
-  const validate = ajv.compile(schema);
-  const pack = (artifactTypeId: string): Record<string, unknown> => ({
-    name: 'community.openwop.legacy-probe',
-    version: '1.0.0',
-    kind: 'artifact-type',
-    engines: { openwop: '>=1.1.0 <2.0.0' },
-    artifactTypes: [{ artifactTypeId, schemaRef: 'schemas/x.json' }],
-  });
-
-  it('leg 1a — a bare legacy id (`doc.one-pager`) is REJECTED by the manifest schema', () => {
-    expect(
-      validate(pack('doc.one-pager')),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'the canonical pattern is definitional, not aspirational — a legacy spelling has never been a conformant published identifier'),
-    ).toBe(false);
-  });
-
-  it('leg 1b — a canonical id still validates (the anchor is not over-tight)', () => {
-    expect(
-      validate(pack('community.openwop.doc.one-pager')),
-      why('artifact-type-packs.md §"The `ArtifactType` declaration"', 'the reverse-DNS form the migration targets is accepted'),
-    ).toBe(true);
-  });
-});
-
-describe('artifact-type-legacy-ids: the corpus states the migration rules normatively (RFC 0141)', () => {
-  const doc = V1_DIR ? readFileSync(join(V1_DIR, 'artifact-type-packs.md'), 'utf8') : '';
-
-  it.skipIf(V1_DIR === null)('leg 2 — never wire-conformant, no grandfather clause, no obligation to migrate', () => {
-    expect(
-      /never\W{0,4}\s*wire-conformant/i.test(doc),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'legacy identifiers were NEVER wire-conformant — status is stated, not implied'),
-    ).toBe(true);
-    expect(
-      /no grandfather clause/i.test(doc),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'no grandfather clause exists or is implied'),
-    ).toBe(true);
-    expect(
-      /no obligation to migrate/i.test(doc),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'the unregistered tier is a legitimate permanent home — migration is optional'),
-    ).toBe(true);
-  });
-
-  it.skipIf(V1_DIR === null)('leg 3 — a migrating host MUST NOT rewrite historical event-carried identifiers, tied to replay', () => {
-    expect(
-      /MUST NOT\W{0,4}\s*rewrite historical\W{0,4}\s*`artifact\.created\.artifactType`/i.test(doc),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'the rewrite prohibition is normative, naming the event field — not derivable-only across three documents'),
-    ).toBe(true);
-    expect(
-      /replay\.md.{0,80}fixed history|fixed history.{0,120}replay/is.test(doc),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'the prohibition is tied to replay.md fixed-history semantics, so the derivation travels with the rule'),
-    ).toBe(true);
-    expect(
-      /silently demoting a typed artifact|silently demot/i.test(doc),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'the silent-demotion failure mode is named — the reason a rewrite is worse than the non-conformant name'),
-    ).toBe(true);
-  });
-
-  it.skipIf(V1_DIR === null)('leg 4 — the alias is permanent and MUST resolve where validation is decided', () => {
-    expect(
-      /permanent, not transitional/i.test(doc),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'immutable history makes the alias permanent — a host planning to delete it later has misunderstood the constraint'),
-    ).toBe(true);
-    expect(
-      /everywhere registration is decided\W{0,4}\s*schema validation included/i.test(doc),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'aliasing lookup but not validation silently demotes typed artifacts behind a green result — the MUST covers validation by name'),
-    ).toBe(true);
-  });
-
-  it.skipIf(V1_DIR === null)('leg 5 — an alias map is a host shim, NOT a conformance claim', () => {
-    expect(
-      /compatibility shim\W{0,4}\s*not a conformance claim/i.test(doc),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'a host serving legacy ids through an alias is not "conformant under its old names"'),
-    ).toBe(true);
-    expect(
-      /MUST NOT\W{0,4}\s*advertise or imply otherwise/i.test(doc),
-      why('artifact-type-packs.md §"Legacy identifiers and migration"', 'the shim MUST NOT be advertised as conformance'),
-    ).toBe(true);
-  });
-});

package/src/scenarios/capability-example-root-layout.test.ts

@@ -1,272 +0,0 @@
-/**
- * RFC 0149 §B — normative discovery examples place capability families at the
- * document root.
- *
- * RFC 0073 (`Accepted`) made the root layout "the normative MUST since Phase 1"
- * and, at Phase 4, made the suite enforce it: a wrapper-only host "grades as
- * non-conformant". The `capabilities` wrapper survives only as a deprecated
- * shape that runtime discovery tolerates through the v1.x window, retiring at
- * v2.0 when `capabilities.schema.json` tightens.
- *
- * Tolerating a shape at runtime and teaching it in a normative example are
- * different things. Eight `spec/v1` examples — several under headings like
- * "Capability advertisement (normative)", introduced by prose saying hosts
- * "advertise it under `/.well-known/openwop`" — showed the deprecated wrapper.
- * An implementer copying one produced a document RFC 0073 grades as
- * non-conformant, and no gate noticed, because a fenced example is prose to
- * every validator in the corpus.
- *
- * This gate is authoring-time only. It says nothing about what a server may
- * emit: RFC 0149 §B is explicit that the runtime schema MUST NOT reject an
- * otherwise legal unknown server-emitted property, and nothing here reads a
- * host.
- *
- * **Canonical-typo leg (RFC 0149 §B, second bullet; UQ2 decided 2026-08-16).** A
- * root key within edit distance ONE of a canonical family, in a discovery-shaped
- * example, that is not itself canonical and not vendor-namespaced, is a typo
- * (`compensaton`, `interupts`) — an implementer copying it advertises nothing.
- * UQ2 asked what rule avoids false positives on legitimate extension names; the
- * answer was measured, not guessed. Over every fenced root object in `spec/v1` +
- * `RFCS/` (218 on 2026-08-16), plain distance-one produced six near-misses —
- * `ts`/`fs`, `agent`/`agents`, `secret`/`secrets`, `context`/`content`,
- * `prompt`/`prompts`, `schemaVersion`/`schemaVersions` — every one of them a key
- * of an EVENT or RUN object, not a discovery document. So the predicate is
- * *discovery-shaped*: every root key is canonical, vendor-namespaced
- * (`host-extensions.md` §"Canonical prefixes"), the legacy `capabilities`
- * wrapper, or within distance one of a canonical family — and at least one key
- * is canonical-or-near. That excludes events (`ts`/`type`/`payload` are none of
- * those) while still catching a typo-only snippet whose single key is misspelt.
- * Scope: `spec/v1` and RFCs numbered >= 0149 (the rule's own RFC); older RFCs
- * are the dated record, on the same boundary logic as the wrapper leg's 0073.
- * Under that predicate and scope the corpus measured 53 discovery-shaped
- * objects and 0 findings; the one out-of-scope near-miss is RFC 0109's
- * `{ "agent": … }` payload fragment.
- *
- * `spec/v1/` and `RFCS/` ship in the repository, NOT in the published tarball,
- * so this self-skips under the published layout. That asymmetry has produced
- * three defects in this corpus — the `CORPUS-STAMP` gate, the link-checker's
- * filesystem walk, and RFC 0146 leg A4, which ENOENT'd for every adopter
- * running from the package.
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync, readdirSync, existsSync } from 'node:fs';
-import { join, resolve as pathResolve } from 'node:path';
-import { V1_DIR } from '../lib/paths.js';
-
-/** RFC 0073 established the root layout; examples in earlier RFCs are historical record. */
-const ROOT_LAYOUT_RFC = 73;
-
-const RFCS_DIR = V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'RFCS');
-
-interface FencedExample {
-  readonly file: string;
-  readonly line: number;
-  readonly rootWrapper: boolean;
-}
-
-/** Fenced ```json / ```jsonc blocks, flagged when the root object's first key is `capabilities`. */
-function fencedExamples(dir: string): FencedExample[] {
-  const found: FencedExample[] = [];
-  for (const name of readdirSync(dir).filter((f) => f.endsWith('.md')).sort()) {
-    const lines = readFileSync(join(dir, name), 'utf8').split('\n');
-    for (let i = 0; i < lines.length; i++) {
-      if (!/^```(json|jsonc)\s*$/.test(lines[i]!.trim())) continue;
-      const body: string[] = [];
-      let j = i + 1;
-      while (j < lines.length && lines[j]!.trim() !== '```') {
-        body.push(lines[j]!);
-        j++;
-      }
-      const rootWrapper =
-        body.length > 1 && /^\s*\{\s*$/.test(body[0]!) && /^\s*"capabilities"\s*:\s*\{\s*$/.test(body[1]!);
-      found.push({ file: name, line: i + 2, rootWrapper });
-      i = j;
-    }
-  }
-  return found;
-}
-
-/** RFC 0149 introduced the typo lint; examples in earlier RFCs are historical record. */
-const TYPO_LINT_RFC = 149;
-
-const SCHEMA_PATH =
-  V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'schemas', 'capabilities.schema.json');
-
-/** The canonical families, read from the schema rather than hand-listed. */
-function canonicalFamilies(): Set<string> {
-  if (SCHEMA_PATH === null) return new Set();
-  const schema = JSON.parse(readFileSync(SCHEMA_PATH, 'utf8')) as { properties?: Record<string, unknown> };
-  return new Set(Object.keys(schema.properties ?? {}));
-}
-
-/** `host-extensions.md` §"Canonical prefixes". */
-function isVendorKey(key: string): boolean {
-  return /^x-host-/.test(key) || /^(vendor|private)\./.test(key);
-}
-
-/** Levenshtein distance exactly one (one substitution, insertion, or deletion). */
-export function withinOne(a: string, b: string): boolean {
-  if (a === b) return false;
-  if (Math.abs(a.length - b.length) > 1) return false;
-  if (a.length === b.length) {
-    let diff = 0;
-    for (let i = 0; i < a.length; i++) if (a[i] !== b[i] && ++diff > 1) return false;
-    return diff === 1;
-  }
-  const [short, long] = a.length < b.length ? [a, b] : [b, a];
-  let i = 0;
-  let j = 0;
-  let skipped = false;
-  while (i < short.length && j < long.length) {
-    if (short[i] === long[j]) {
-      i++;
-      j++;
-    } else if (skipped) {
-      return false;
-    } else {
-      skipped = true;
-      j++;
-    }
-  }
-  return true;
-}
-
-export interface TypoFinding {
-  readonly key: string;
-  readonly near: readonly string[];
-}
-
-/**
- * The UQ2 rule. Returns the near-miss root keys of a DISCOVERY-SHAPED object, or
- * `null` when the object is not discovery-shaped (and so is out of scope: an
- * event, a run body, a manifest). Exported so the predicate is pinned below.
- */
-export function canonicalTypos(value: unknown, families: Set<string>): TypoFinding[] | null {
-  if (value === null || typeof value !== 'object' || Array.isArray(value)) return null;
-  const keys = Object.keys(value as Record<string, unknown>);
-  if (keys.length === 0) return null;
-  const near = new Map<string, string[]>();
-  for (const k of keys) {
-    if (families.has(k) || isVendorKey(k) || k === 'capabilities') continue;
-    const n = [...families].filter((f) => withinOne(k, f));
-    if (n.length === 0) return null; // a key that is none of the four kinds ⇒ not discovery-shaped
-    near.set(k, n);
-  }
-  if (!keys.some((k) => families.has(k) || near.has(k))) return null;
-  return [...near.entries()].map(([key, n]) => ({ key, near: n }));
-}
-
-/** Every parseable fenced json/jsonc root object under `dir`, with its source line. */
-function fencedObjects(dir: string): { file: string; line: number; value: unknown }[] {
-  const out: { file: string; line: number; value: unknown }[] = [];
-  for (const name of readdirSync(dir).filter((f) => f.endsWith('.md')).sort()) {
-    const lines = readFileSync(join(dir, name), 'utf8').split('\n');
-    for (let i = 0; i < lines.length; i++) {
-      if (!/^```(json|jsonc)\s*$/.test(lines[i]!.trim())) continue;
-      const body: string[] = [];
-      let j = i + 1;
-      while (j < lines.length && lines[j]!.trim() !== '```') body.push(lines[j++]!);
-      try {
-        out.push({ file: name, line: i + 2, value: JSON.parse(body.join('\n')) });
-      } catch {
-        // Unparseable blocks are RFC 0150 §D's problem, not this gate's.
-      }
-      i = j;
-    }
-  }
-  return out;
-}
-
-describe.skipIf(V1_DIR === null)('RFC 0149 §B — discovery examples use the document-root layout', () => {
-  const v1Dir = V1_DIR as string;
-
-  it('the scan finds fenced examples at all', () => {
-    // Guard: an extractor that silently matched nothing would make the
-    // assertions below vacuously true, which is the failure mode RFC 0148
-    // exists to close. This gate must not become an instance of it.
-    const examples = fencedExamples(v1Dir);
-    expect(examples.length, 'spec/v1 MUST contain fenced json/jsonc examples to check').toBeGreaterThan(20);
-  });
-
-  it('no spec/v1 example wraps capability families in a top-level `capabilities` object', () => {
-    const offenders = fencedExamples(v1Dir)
-      .filter((e) => e.rootWrapper)
-      .map((e) => `spec/v1/${e.file}:${e.line}`);
-    expect(
-      offenders,
-      'RFC 0073: capability families are a property of the DOCUMENT ROOT; there is no `capabilities` wrapper. ' +
-        'A normative example showing the deprecated shape teaches a document RFC 0073 grades as non-conformant.\n  ' +
-        offenders.join('\n  '),
-    ).toEqual([]);
-  });
-
-  it('every RFC still showing the wrapper predates RFC 0073, which established root layout', () => {
-    // RFCs are a dated record of what was proposed, so their examples are NOT
-    // rewritten to match a later layout — that would make the record lie. The
-    // exemption is asserted rather than assumed: a NEW post-0073 RFC that
-    // introduces a wrapper fails here, so the historical carve-out cannot widen
-    // into a licence.
-    if (RFCS_DIR === null || !existsSync(RFCS_DIR)) return;
-    const late = fencedExamples(RFCS_DIR)
-      .filter((e) => e.rootWrapper)
-      .filter((e) => {
-        const n = Number.parseInt(e.file.slice(0, 4), 10);
-        return Number.isFinite(n) && n >= ROOT_LAYOUT_RFC;
-      })
-      .map((e) => `RFCS/${e.file}:${e.line}`);
-    expect(
-      late,
-      `an RFC numbered >= ${ROOT_LAYOUT_RFC} uses the deprecated \`capabilities\` wrapper. ` +
-        'Pre-0073 RFCs keep theirs as historical record; a later one has no such excuse.\n  ' +
-        late.join('\n  '),
-    ).toEqual([]);
-  });
-  it('the UQ2 predicate is pinned: a typo-only snippet is flagged, an event object is out of scope, a vendor key is exempt', () => {
-    const fams = new Set(['compensation', 'interrupts', 'fs', 'agents', 'content']);
-    // A misspelt single-key discovery snippet: all keys near-canonical ⇒ in scope, flagged.
-    expect(canonicalTypos({ compensaton: { supported: true } }, fams)).toEqual([{ key: 'compensaton', near: ['compensation'] }]);
-    // Canonical + a typo ⇒ flagged.
-    expect(canonicalTypos({ compensation: {}, interupts: {} }, fams)).toEqual([{ key: 'interupts', near: ['interrupts'] }]);
-    // An event: `ts` is one from `fs` but `type`/`payload` are none of the four kinds ⇒ not discovery-shaped.
-    expect(canonicalTypos({ ts: 1, type: 'x', payload: {} }, fams)).toBeNull();
-    // Vendor-namespaced keys are exempt (RFC 0149 §B) and the legacy wrapper is the wrapper leg's business.
-    expect(canonicalTypos({ compensation: {}, 'x-host-acme-agent': {} }, fams)).toEqual([]);
-    expect(canonicalTypos({ capabilities: {} }, fams)).toBeNull();
-    // Distance exactly one, both directions.
-    expect(withinOne('agent', 'agents')).toBe(true);
-    expect(withinOne('agents', 'agent')).toBe(true);
-    expect(withinOne('agent', 'agentz')).toBe(true);
-    expect(withinOne('agent', 'agenzs')).toBe(false);
-    expect(withinOne('agents', 'agents')).toBe(false);
-  });
-
-  it('no discovery-shaped example in spec/v1 or a post-0149 RFC has a root key within one edit of a canonical family', () => {
-    const families = canonicalFamilies();
-    expect(families.size, 'capabilities.schema.json MUST declare families').toBeGreaterThan(50);
-    const findings: string[] = [];
-    let shaped = 0;
-    const scan = (dir: string, rel: string, minRfc: number | null): void => {
-      for (const { file, line, value } of fencedObjects(dir)) {
-        if (minRfc !== null) {
-          const n = Number.parseInt(file.slice(0, 4), 10);
-          if (!Number.isFinite(n) || n < minRfc) continue;
-        }
-        const typos = canonicalTypos(value, families);
-        if (typos === null) continue;
-        shaped++;
-        for (const t of typos) findings.push(`${rel}/${file}:${line} → \`${t.key}\` (did you mean ${t.near.map((x) => '`' + x + '`').join(' / ')}?)`);
-      }
-    };
-    scan(v1Dir, 'spec/v1', null);
-    if (RFCS_DIR !== null && existsSync(RFCS_DIR)) scan(RFCS_DIR, 'RFCS', TYPO_LINT_RFC);
-    expect(shaped, 'the scan MUST find discovery-shaped examples, or the leg is vacuous').toBeGreaterThan(20);
-    expect(
-      findings,
-      'RFC 0149 §B: a root key within one edit of a canonical family, in a discovery-shaped example, is a ' +
-        'typo — an implementer copying it advertises nothing. Vendor surface goes under `x-host-*` / ' +
-        '`vendor.*` / `private.*` (host-extensions.md).\n  ' +
-        findings.join('\n  '),
-    ).toEqual([]);
-  });
-});

package/src/scenarios/certification-floor-enforcement.test.ts

@@ -1,204 +0,0 @@
-/**
- * RFC 0148 §C / gap G6 — an undefined floor set is UNPROVABLE, never proven.
- *
- * `conformance-certification.md` §B(2) requires every floor scenario of a
- * claimed profile to appear in `results.passed`, and `profiles.md` §"Claiming
- * vs passing" says a host claims a profile "by satisfying its predicate AND
- * passing the conformance scenarios labelled with the profile tag."
- *
- * `PROFILE_FLOOR_SCENARIOS` transcribed that prose for `openwop-core-standard`
- * alone. For every other profile the floor was `undefined`, and the verifier
- * computed `floorProven` from `missingFloor.length === 0 && prefixOk` — both
- * vacuously true over an absent floor. So a claim with nothing behind it
- * verified as PROVEN. That is a third vacuity mode alongside the two RFC 0148
- * §"Motivation" names: those let an unexecuted assertion count as a pass, this
- * lets an entire profile claim verify against nothing.
- *
- * These legs are server-free and always-on. A floor rule that only ran when a
- * host advertised something would be gated on the very claim it exists to
- * check.
- */
-
-import { describe, it, expect } from 'vitest';
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { verifyBundle, verifyBundleProfile, PROFILE_FLOOR_SCENARIOS } from '../lib/profiles.js';
-import { SCENARIOS_DIR } from '../lib/paths.js';
-
-/** Derives `openwop-core` and `openwop-stream-sse` (transports omitted ⇒ all). */
-const streamingDiscovery = {
-  protocolVersion: '1.0',
-  supportedEnvelopes: ['final', 'clarification.request'],
-  schemaVersions: { 'workflow-definition': '1.0' },
-  limits: { clarificationRounds: 3, schemaRounds: 2, envelopesPerTurn: 8 },
-};
-
-const bundleClaiming = (profiles: readonly string[], passed: readonly string[], failed: readonly string[] = []) => ({
-  discovery: { document: streamingDiscovery },
-  claimedProfiles: profiles,
-  results: { passed, failed },
-});
-
-describe('RFC 0148 §C — floor enforcement is not vacuous', () => {
-  it('a profile with NO floor definition is unprovable, not proven', () => {
-    // A profile the floor map does not know (here a name outside the catalog;
-    // until 2026-08-16 `openwop-interrupts` played this role — its floor is now
-    // transcribed, RFC 0148 §C G7). Claiming it must fail — the corpus cannot
-    // substantiate it, which is a different thing from the host having failed
-    // something.
-    const v = verifyBundleProfile(bundleClaiming(['openwop-not-in-catalog'], []), 'openwop-not-in-catalog');
-    expect(v.floorUnspecified, 'no floor set is defined for a profile outside the floor map').toBe(true);
-    expect(v.floorProven, 'RFC 0148 §C: an undefined floor MUST NOT satisfy the floor condition').toBe(false);
-    expect(v.valid).toBe(false);
-    expect(v.missingFloor, 'nothing is "missing" — the floor was never evaluable').toEqual([]);
-  });
-
-  it('G7: a discovery-conditional floor (openwop-replay-fork) requires the branch the document advertises — and nothing when it advertises none', () => {
-    const doc = (modes: string[]) => ({ protocolVersion: '1.0', supportedEnvelopes: [], schemaVersions: {}, limits: { clarificationRounds: 1, schemaRounds: 1, envelopesPerTurn: 1 }, replay: { supported: true, modes } });
-    const claim = (modes: string[], passed: string[]) => ({ discovery: { document: doc(modes) }, claimedProfiles: ['openwop-replay-fork'], results: { passed, failed: [] } });
-    // replay-only host: replayDeterminism suffices; replay-fork is NOT required
-    let v = verifyBundleProfile(claim(['replay'], ['replayDeterminism.test.ts', 'replay-side-effect-suppression.test.ts']), 'openwop-replay-fork');
-    expect(v.floorUnspecified).toBe(false);
-    expect(v.floorProven).toBe(true);
-    // determinism alone does NOT prove replay mode: caveat 1 (no re-fire) is part of the branch
-    v = verifyBundleProfile(claim(['replay'], ['replayDeterminism.test.ts']), 'openwop-replay-fork');
-    expect(v.floorProven).toBe(false);
-    expect(v.missingFloor).toEqual(['replay-side-effect-suppression.test.ts']);
-    // branch-only host: replay-fork suffices
-    v = verifyBundleProfile(claim(['branch'], ['replay-fork.test.ts']), 'openwop-replay-fork');
-    expect(v.floorProven).toBe(true);
-    // both advertised: both required
-    v = verifyBundleProfile(claim(['replay', 'branch'], ['replay-fork.test.ts', 'replay-side-effect-suppression.test.ts']), 'openwop-replay-fork');
-    expect(v.floorProven).toBe(false);
-    expect(v.missingFloor).toEqual(['replayDeterminism.test.ts']);
-    // a mode the floor does not know: nothing required → unprovable, not proven
-    v = verifyBundleProfile(claim(['exotic'], []), 'openwop-replay-fork');
-    expect(v.floorProven).toBe(false);
-  });
-
-  it('a discovery-only profile with an EXPLICIT empty floor is proven by its predicate alone', () => {
-    // The distinction the fix turns on: `openwop-fixtures` is discovery-payload
-    // -only by `profiles.md`, so an empty floor is a decision on record. Without
-    // `discoveryOnly`, "legitimately empty" and "not yet written" are the same
-    // value, which is what produced the defect.
-    const v = verifyBundleProfile(bundleClaiming(['openwop-fixtures'], []), 'openwop-fixtures');
-    expect(PROFILE_FLOOR_SCENARIOS['openwop-fixtures']?.discoveryOnly).toBe(true);
-    expect(v.floorUnspecified).toBe(false);
-    expect(v.floorProven).toBe(true);
-  });
-
-  it('a claimed streaming profile whose floor scenarios FAILED is rejected', () => {
-    // The shape of the real defect: the one published v1 bundle claimed
-    // `openwop-stream-sse` while all three `stream-modes*` scenarios sat in its
-    // own `results.failed`, and the verifier accepted it.
-    const v = verifyBundleProfile(
-      bundleClaiming(
-        ['openwop-stream-sse'],
-        [],
-        ['stream-modes.test.ts', 'stream-modes-buffer.test.ts', 'stream-modes-mixed.test.ts'],
-      ),
-      'openwop-stream-sse',
-    );
-    expect(v.derivable, 'the discovery document does derive the profile').toBe(true);
-    expect(v.floorProven, 'profiles.md §openwop-stream-sse: predicate AND those scenarios pass').toBe(false);
-    expect(v.missingFloor).toContain('stream-modes.test.ts');
-    expect(v.valid).toBe(false);
-  });
-
-  it('a claimed streaming profile whose floor scenarios all PASSED is accepted', () => {
-    const v = verifyBundleProfile(
-      bundleClaiming(['openwop-stream-sse'], [
-        'stream-modes.test.ts',
-        'stream-modes-buffer.test.ts',
-        'stream-modes-mixed.test.ts',
-      ]),
-      'openwop-stream-sse',
-    );
-    expect(v.floorProven).toBe(true);
-    expect(v.valid).toBe(true);
-  });
-
-  it('one unprovable claim invalidates the whole bundle', () => {
-    // A bundle is valid iff EVERY claim is. Mixing a provable claim with an
-    // unprovable one must not average out to valid.
-    const r = verifyBundle(bundleClaiming(['openwop-core', 'openwop-interrupts'], []));
-    expect(r.verdicts.find((v) => v.profile === 'openwop-core')?.valid).toBe(true);
-    expect(r.verdicts.find((v) => v.profile === 'openwop-interrupts')?.valid).toBe(false);
-    expect(r.valid).toBe(false);
-  });
-
-  it('every transcribed floor names scenario files that exist in this suite', () => {
-    // Guards the transcription itself: a floor citing a renamed or deleted
-    // scenario can never be satisfied, which would fail honest hosts for a
-    // reason unrelated to their behavior.
-    const all = Object.entries(PROFILE_FLOOR_SCENARIOS).flatMap(([profile, floor]) =>
-      floor.required.map((scenario) => ({ profile, scenario })),
-    );
-    expect(all.length, 'the floor map MUST NOT be empty — an empty map re-opens the vacuity').toBeGreaterThan(0);
-    for (const { profile, scenario } of all) {
-      expect(scenario, `${profile} floor cites a non-scenario filename`).toMatch(/\.test\.ts$/);
-    }
-
-    // 2026-08-18: this leg's NAME promised "files that exist" and it only
-    // matched the `.test.ts` suffix — a string check wearing an existence
-    // check's name. The phantom `audit-log-verification.test.ts` floor row sat
-    // in `openwop-core-standard` until `--certify` hit it against a live host,
-    // because nothing here opened the directory.
-    if (SCENARIOS_DIR === null) return; // published layout ships src/, but stay honest if it ever does not
-    const dir = SCENARIOS_DIR as string;
-    const missing = all
-      .filter(({ scenario }) => !existsSync(join(dir, scenario)))
-      .map(({ profile, scenario }) => `${profile} → ${scenario}`);
-    expect(
-      missing,
-      'a floor cites a scenario file that does not exist — that requirement can never be satisfied, ' +
-        'so the profile can never certify, for a reason unrelated to any host',
-    ).toEqual([]);
-  });
-
-  it('no floor scenario is corpus-only — a floor must be provable from the published package', () => {
-    // openwop-app's suggestion, and it is right that this be a red test rather
-    // than a paragraph: the failure mode is SOMEONE LATER adding a corpus
-    // self-check to a floor, and prose in a PR body will not be in front of
-    // them.
-    //
-    // A scenario that can only run in a repo checkout (it reads `spec/` or
-    // `RFCS/` through `V1_DIR`) records `blocked` in the published layout,
-    // where the package ships no corpus by design. `blocked` is correct there
-    // — RFC 0148 §A defines it as a missing dependency — but a `blocked`
-    // requirement in a claimed profile invalidates that profile. So a
-    // corpus-only scenario in a floor makes the profile UNCERTIFIABLE from the
-    // npm tarball, permanently, for a reason no host can fix. It is the mirror
-    // of the phantom-row trap above: that one named a file that does not
-    // exist, this one names a file that cannot execute where certification is
-    // measured.
-    if (SCENARIOS_DIR === null) return;
-    const dir = SCENARIOS_DIR as string;
-
-    /** Every `it`/`test` in the file is V1_DIR-guarded, or every `describe` is. */
-    const isCorpusOnly = (source: string): boolean => {
-      if (!source.includes('V1_DIR')) return false;
-      const guard = /\(V1_DIR === null\)/;
-      const its = [...source.matchAll(/\b(?:it|test)(\.skipIf\([^)]*\))?\s*\(/g)];
-      const describes = [...source.matchAll(/\bdescribe(\.skipIf\([^)]*\))?\s*\(/g)];
-      const allItsGuarded = its.length > 0 && its.every((m) => guard.test(m[1] ?? ''));
-      const allDescribesGuarded = describes.length > 0 && describes.every((m) => guard.test(m[1] ?? ''));
-      return allItsGuarded || allDescribesGuarded;
-    };
-
-    const offenders = Object.entries(PROFILE_FLOOR_SCENARIOS)
-      .flatMap(([profile, floor]) => floor.required.map((scenario) => ({ profile, scenario })))
-      .filter(({ scenario }) => {
-        const path = join(dir, scenario);
-        return existsSync(path) && isCorpusOnly(readFileSync(path, 'utf8'));
-      })
-      .map(({ profile, scenario }) => `${profile} → ${scenario}`);
-
-    expect(
-      offenders,
-      'a profile floor cites a CORPUS-ONLY scenario (all of its tests are guarded on `V1_DIR === null`). ' +
-        'It records `blocked` in the published layout, so that profile can never certify from the npm ' +
-        'tarball — no host can fix it. Keep corpus self-checks out of floors.',
-    ).toEqual([]);
-  });
-});