@openwop/openwop-conformance 1.153.0 → 1.154.0

package/src/scenarios/chain-subchain-unsupported-refused.test.ts

@@ -1,70 +0,0 @@
-/**
- * Sub-chain composition — unsupported-host refusal (RFC 0133 §1.3).
- *
- * A host that does NOT advertise `capabilities.workflowChainPacks.subChains.supported`
- * MUST refuse to instantiate a `subChains`-bearing chain with `sub_chain_unsupported`
- * (HTTP 422) — it MUST NOT silently flatten the runtime child into the parent
- * (flattening erases the child as an editable unit and changes run semantics).
- *
- * TWO parts:
- *   A. Always-on — the error code + refusal contract are present in the spec
- *      corpus (`workflow-chain-packs.md` §"Error codes" + §"Sub-chain composition").
- *   B. Capability-gated — against a host that expands chains
- *      (`workflowChainPacks.supported`) but does NOT advertise `subChains`, a
- *      `from-chain` on a `subChains`-bearing chain returns `sub_chain_unsupported`.
- *      Soft-skips until a reference host exposes the seam. The refusal is the
- *      fail-closed complement of `sub-chain-expansion-bounded`: a host that cannot
- *      run child dispatch never mis-dispatches.
- *
- * @see spec/v1/workflow-chain-packs.md §"Sub-chain composition (RFC 0133)" + §"Error codes"
- * @see RFCS/0133-workflow-chain-composition.md
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { V1_DIR } from '../lib/paths.js';
-import { behaviorGate } from '../lib/behavior-gate.js';
-import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
-
-const cite = (section: string, requirement: string): string => `${section} — ${requirement}`;
-// S38 (2026-08-17): `spec/` is NOT in the published package (`files`), so a path built
-// from SCHEMAS_DIR/../spec ENOENTs for every npm consumer — five always-on legs reddened
-// MyndHyve's bundle for a reason that had nothing to do with the host. Prose legs are
-// repo-layout only: `null` in the published layout and skipped, never thrown.
-const CHAIN_DOC: string | null = V1_DIR === null ? null : join(V1_DIR, 'workflow-chain-packs.md');
-
-describe('chain-subchain-unsupported-refused §A: corpus contract (RFC 0133, always-on)', () => {
-  it.skipIf(CHAIN_DOC === null)('spec corpus pins sub_chain_unsupported as a 422 refusal (never flatten)', () => {
-    const doc = readFileSync(CHAIN_DOC as string, 'utf8');
-    expect(doc.includes('sub_chain_unsupported'), cite('§Error codes', 'the code MUST be registered')).toBe(true);
-    // The normative refusal-not-flatten rule MUST appear in the composition section.
-    expect(
-      /sub_chain_unsupported[\s\S]{0,600}(never|MUST NOT).{0,40}(flatten|silently)/i.test(doc) ||
-        /(never|MUST NOT).{0,40}(flatten|silently)[\s\S]{0,600}sub_chain_unsupported/i.test(doc),
-      cite('§Sub-chain composition', 'an unsupported host MUST refuse, MUST NOT silently flatten'),
-    ).toBe(true);
-    expect(doc.includes('422'), cite('§Error codes', 'sub_chain_unsupported carries HTTP 422')).toBe(true);
-  });
-});
-
-describe('chain-subchain-unsupported-refused §B: host refusal (RFC 0133, capability-gated)', () => {
-  it('a host without subChains support refuses a subChains-bearing chain with sub_chain_unsupported', async () => {
-    const wcp = await readCapabilityFamily<{ supported?: boolean; subChains?: { supported?: boolean } }>(
-      'workflowChainPacks',
-    );
-    // This leg targets hosts that DO expand chains but do NOT support runtime
-    // child dispatch — the exact population that MUST refuse. Gate on the base
-    // chain-expansion capability; soft-skip hosts that don't expand at all.
-    if (!behaviorGate('workflowChainPacks.supported', wcp?.supported === true)) return;
-    if (wcp?.subChains?.supported === true) {
-      // Host DOES support sub-chains — refusal path is not applicable here; the
-      // positive path is covered by chain-subchain-fanout §B. Skip cleanly.
-      return;
-    }
-    // Behavioral assertion runs once a host exposes the from-chain seam: a
-    // subChains-bearing chain MUST return `sub_chain_unsupported` (422), not a
-    // flattened success.
-    expect(wcp?.subChains?.supported ?? false, 'unsupported host advertises no subChains block').toBe(false);
-  });
-});

package/src/scenarios/compensation-profile.test.ts

@@ -1,340 +0,0 @@
-/**
- * RFC 0151 — the compensation profile's shape contract.
- *
- * **What this proves, stated first because RFC 0147 §A.5 turns on it:** the
- * schemas admit exactly the shapes §A and §B describe and reject the ones they
- * forbid. That is *shape-only* evidence. It is **not** evidence that any host
- * orders an unwind correctly, persists a plan before the first inverse action,
- * or resumes one after a crash — and RFC 0151 cannot reach a defensible
- * `Accepted` on this alone. §A.5 requires a host executing every normative
- * behavioral path in strict mode, and none does.
- *
- * Saying that here rather than in a register keeps it next to the thing it
- * qualifies. A conformance file that verifies structure while its RFC claims
- * behavior is how "green suite" and "working protocol" come apart.
- *
- * The design constraints worth holding onto, each of which the schema encodes:
- *
- *   - **Compensation is a second effect, not an undo.** It can fail, can be
- *     partially applied, and can itself be harmful (RFC 0147 R9) — hence
- *     `requiresApproval` and the security-high tier.
- *   - **Inputs come from recorded facts.** §B forbids prompt/model regeneration
- *     from constructing a compensation input during replay, because an inverse
- *     built from a re-inferred value is not the inverse of what was done.
- *   - **`nodeTypeId` resolves at registration**, so an unwind cannot fail on a
- *     typo first discovered during a failure — the worst possible moment.
- *
- * Server-free.
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync, readdirSync } from 'node:fs';
-import { join, resolve as pathResolve } from 'node:path';
-import Ajv2020 from 'ajv/dist/2020.js';
-import { FIXTURES_DIR, SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
-
-/**
- * Schemas ship inside the package; RFC prose does not. The old form derived
- * BOTH from `V1_DIR` — null in the published tarball — and cast the null away,
- * so this file threw at import for every consumer installing from npm.
- */
-const RFCS_DIR = V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'RFCS');
-
-function schema(name: string): Record<string, unknown> {
-  return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as Record<string, unknown>;
-}
-
-/**
- * Validate a candidate node against `WorkflowNode` alone.
- *
- * Every schema in the directory is registered first: `WorkflowNode` `$ref`s
- * siblings by filename, so compiling it in isolation resolves nothing and Ajv
- * throws rather than silently accepting — which is the good failure, but only
- * if the harness registers what the schema actually depends on.
- */
-function nodeValidator() {
-  const ajv = new Ajv2020({ strict: false, allErrors: true });
-  for (const file of readdirSync(SCHEMAS_DIR).filter((f) => f.endsWith('.schema.json'))) {
-    const s = schema(file);
-    ajv.addSchema(s, file);
-  }
-  const wf = schema('workflow-definition.schema.json') as { $defs: Record<string, unknown> };
-  return ajv.compile({ ...(wf.$defs['WorkflowNode'] as object), $defs: wf.$defs });
-}
-
-describe('RFC 0151 §A — compensation capability shape', () => {
-  const caps = schema('capabilities.schema.json') as {
-    properties: Record<string, { properties?: Record<string, unknown>; required?: string[] }>;
-  };
-
-  it('the capability family exists and is closed', () => {
-    const c = caps.properties['compensation'];
-    expect(c, 'RFC 0151 §A: `compensation` MUST be a declared capability family').toBeDefined();
-    expect(c.required).toEqual(['supported']);
-    expect(Object.keys(c.properties ?? {}).sort()).toEqual(
-      ['manualIntervention', 'orderingModels', 'profileVersion', 'supported'].sort(),
-    );
-  });
-
-  it('orderingModels is a closed enum of the two named models', () => {
-    const models = (caps.properties['compensation'].properties?.['orderingModels'] as {
-      items: { enum: string[] };
-    }).items.enum;
-    expect(
-      [...models].sort(),
-      'RFC 0151 §A: an advertising host MUST implement `reverse-completion` and MAY add ' +
-        '`dependency-graph`. A third model would be an unadvertised ordering guarantee.',
-    ).toEqual(['dependency-graph', 'reverse-completion']);
-  });
-
-  it('profileVersion participates in identity, so it is constrained', () => {
-    // §C derives the inverse-action id partly from `profileVersion`. An
-    // unconstrained string there would let two hosts mint colliding identities
-    // under different ordering rules.
-    const pv = caps.properties['compensation'].properties?.['profileVersion'] as { pattern?: string };
-    expect(pv.pattern, 'RFC 0151 §C: profileVersion is part of the inverse-action id').toBe('^[1-9][0-9]*$');
-  });
-});
-
-describe('RFC 0151 §B — node compensation declaration', () => {
-  const validate = nodeValidator();
-  // A minimally VALID node — `WorkflowNode` requires `name`, `position`,
-  // `config`, and `inputs` independently of this RFC. Building the fixture from
-  // the real required set keeps the legs below testing `compensation` rather
-  // than accidentally testing whether the base node is well-formed.
-  const base = {
-    id: 'reserve-inventory',
-    typeId: 'vendor.shop.reserve',
-    name: 'Reserve inventory',
-    position: { x: 0, y: 0 },
-    config: {},
-    inputs: {},
-  };
-
-  it('a well-formed declaration validates', () => {
-    const ok = validate({
-      ...base,
-      compensation: {
-        nodeTypeId: 'vendor.shop.release',
-        inputMapping: { reservationId: '${nodes.reserve-inventory.output.id}' },
-        retry: { maxAttempts: 5, backoffMs: 1000 },
-        requiresApproval: false,
-      },
-    });
-    expect(ok, JSON.stringify(validate.errors)).toBe(true);
-  });
-
-  it('waiveRequiresApproval (S36) is an OPTIONAL boolean in the closed §B block — absent is valid (default = effective requiresApproval), non-boolean is refused', () => {
-    const decl = { nodeTypeId: 'vendor.shop.release', requiresApproval: true };
-    expect(validate({ ...base, compensation: { ...decl, waiveRequiresApproval: false } }), JSON.stringify(validate.errors)).toBe(true);
-    expect(validate({ ...base, compensation: { ...decl, waiveRequiresApproval: true } }), JSON.stringify(validate.errors)).toBe(true);
-    expect(validate({ ...base, compensation: { ...decl } }), 'absent MUST validate — the default is the obligation\'s effective requiresApproval, so no existing document changes meaning').toBe(true);
-    expect(validate({ ...base, compensation: { ...decl, waiveRequiresApproval: 'yes' } }), 'compensation.md §B: a plain boolean, not a policy language').toBe(false);
-  });
-
-  it('a node without compensation stays valid', () => {
-    // The profile is optional. Absent MUST NOT become a validation error, or
-    // every existing workflow in the corpus breaks.
-    expect(validate({ ...base }), JSON.stringify(validate.errors)).toBe(true);
-  });
-
-  it('irreversibleEffect (RFC 0151 UQ4) is a sibling boolean, mutually exclusive with a compensation declaration', () => {
-    // A statement that the effect HAS NO INVERSE. Sibling of `compensation`, so
-    // `nodeTypeId` stays required and COMPATIBILITY §2.2 is not engaged.
-    expect(validate({ ...base, irreversibleEffect: true }), JSON.stringify(validate.errors)).toBe(true);
-    expect(validate({ ...base, irreversibleEffect: false, compensation: { nodeTypeId: 'vendor.shop.release' } }), JSON.stringify(validate.errors)).toBe(true);
-    // Both = an effect that both has and lacks an inverse. The schema rejects it
-    // (`if irreversibleEffect === true then not required compensation`).
-    expect(
-      validate({ ...base, irreversibleEffect: true, compensation: { nodeTypeId: 'vendor.shop.release' } }),
-      'compensation.md §B: a node declaring both irreversibleEffect: true and compensation is contradictory and MUST be rejected',
-    ).toBe(false);
-    expect(validate({ ...base, irreversibleEffect: 'yes' }), 'irreversibleEffect is a boolean').toBe(false);
-  });
-
-  it('the declaration is closed — an unknown key is rejected', () => {
-    expect(
-      validate({ ...base, compensation: { nodeTypeId: 'x', onFailure: 'ignore' } }),
-      'RFC 0151 §B: `compensation` is closed. An unrecognized key here is a silent behavioral ' +
-        'assumption on the unwind path, which is the least observable place to have one.',
-    ).toBe(false);
-  });
-
-  it('nodeTypeId is required and non-empty', () => {
-    expect(validate({ ...base, compensation: {} }), 'nodeTypeId is required').toBe(false);
-    expect(
-      validate({ ...base, compensation: { nodeTypeId: '' } }),
-      'RFC 0151 §B: `nodeTypeId` MUST resolve at registration — an empty id resolves to nothing, ' +
-        'and the failure would surface only during an unwind.',
-    ).toBe(false);
-  });
-
-  it('retry bounds are integers within sane floors', () => {
-    expect(validate({ ...base, compensation: { nodeTypeId: 'x', retry: { maxAttempts: 0 } } })).toBe(false);
-    expect(validate({ ...base, compensation: { nodeTypeId: 'x', retry: { backoffMs: -1 } } })).toBe(false);
-    expect(validate({ ...base, compensation: { nodeTypeId: 'x', retry: { maxAttempts: 1, backoffMs: 0 } } })).toBe(true);
-  });
-});
-
-describe('RFC 0151 §B — the workflow-level compensation policy (`settings.compensation`)', () => {
-  // `compensation-policy.schema.json` was the last `Affects` artifact of the whole
-  // RFC 0147 program that did not exist. It says WHEN an unwind starts and HOW it
-  // runs; the node-level declaration only says WHAT the inverse action is.
-  const POLICY_SCHEMA = 'compensation-policy.schema.json';
-
-  function ajvAll() {
-    const ajv = new Ajv2020({ strict: false, allErrors: true });
-    for (const file of readdirSync(SCHEMAS_DIR).filter((f) => f.endsWith('.schema.json'))) {
-      ajv.addSchema(schema(file), file);
-    }
-    return ajv;
-  }
-  const policyValidator = () => {
-    const ajv = ajvAll();
-    return ajv.getSchema(POLICY_SCHEMA) ?? ajv.compile(schema(POLICY_SCHEMA));
-  };
-  const workflowValidator = () => {
-    const ajv = ajvAll();
-    return ajv.getSchema('workflow-definition.schema.json') ?? ajv.compile(schema('workflow-definition.schema.json'));
-  };
-
-  const minimalPolicy = { triggers: ['node-failure'] };
-  const fullPolicy = {
-    profileVersion: '1',
-    orderingModel: 'reverse-completion',
-    triggers: ['node-failure', 'run-cancel', 'cap-breach', 'operator-request'],
-    retry: { maxAttempts: 3, backoffMs: 500 },
-    timeoutMs: 30_000,
-    exhaustedDisposition: 'manual-intervention',
-    approvalScope: 'all',
-    onParentCancel: 'pause',
-  };
-
-  it('the schema exists, is closed, and requires triggers', () => {
-    const p = schema(POLICY_SCHEMA) as { additionalProperties?: boolean; required?: string[]; $id?: string };
-    expect(p.$id).toBe('https://openwop.dev/spec/v1/compensation-policy.schema.json');
-    expect(p.additionalProperties, 'closed — a host and an author must not be able to disagree about a key').toBe(false);
-    expect(p.required, 'a policy that names no trigger is not a policy').toEqual(['triggers']);
-  });
-
-  it('a minimal and a full policy validate', () => {
-    const validate = policyValidator();
-    expect(validate(minimalPolicy), JSON.stringify(validate.errors)).toBe(true);
-    expect(validate(fullPolicy), JSON.stringify(validate.errors)).toBe(true);
-  });
-
-  it('closed vocabularies: an unknown key, trigger, ordering model, or disposition is rejected', () => {
-    const validate = policyValidator();
-    for (const bad of [
-      { ...minimalPolicy, rollback: true },
-      { triggers: [] },
-      { triggers: ['on-error'] },
-      { triggers: ['node-failure', 'node-failure'] },
-      { ...minimalPolicy, orderingModel: 'forward' },
-      { ...minimalPolicy, exhaustedDisposition: 'ignore' },
-      { ...minimalPolicy, approvalScope: 'none' },
-      { ...minimalPolicy, onParentCancel: 'abandon' },
-      { ...minimalPolicy, profileVersion: '0' },
-      { ...minimalPolicy, retry: { maxAttempts: 0 } },
-    ]) {
-      expect(validate(bad), `MUST be rejected: ${JSON.stringify(bad)}`).toBe(false);
-    }
-  });
-
-  it('there is no `none` approval scope — a policy can only escalate approval, never strip it', () => {
-    const p = schema(POLICY_SCHEMA) as { properties: { approvalScope: { enum: string[] } } };
-    expect(p.properties.approvalScope.enum).toEqual(['declared', 'all']);
-  });
-
-  it('attaches to WorkflowDefinition as `settings.compensation` and validates through the workflow schema', () => {
-    const wf = schema('workflow-definition.schema.json') as {
-      $defs: { WorkflowSettings: { properties: Record<string, { $ref?: string }> } };
-    };
-    expect(wf.$defs.WorkflowSettings.properties['compensation']?.$ref).toBe(POLICY_SCHEMA);
-    const validate = workflowValidator();
-    // A real, valid workflow fixture — so the leg proves the $ref is enforced
-    // through the workflow schema rather than that a hand-built object happens
-    // to satisfy WorkflowDefinition's required set.
-    const base = JSON.parse(
-      readFileSync(join(FIXTURES_DIR, 'conformance-subworkflow-child.json'), 'utf8'),
-    ) as { settings?: Record<string, unknown> };
-    expect(validate(base), `fixture must be valid on its own: ${JSON.stringify(validate.errors)}`).toBe(true);
-    const ok = validate({ ...base, settings: { ...(base.settings ?? {}), compensation: fullPolicy } });
-    expect(ok, JSON.stringify(validate.errors)).toBe(true);
-    const bad = validate({ ...base, settings: { ...(base.settings ?? {}), compensation: { triggers: [] } } });
-    expect(bad, 'the $ref must actually be enforced through the workflow schema').toBe(false);
-  });
-});
-
-describe('RFC 0151 §D — the run rollup `compensationStatus` (RunSnapshot)', () => {
-  // Resolves RFC 0151 UQ3: `RunSnapshot` is the sole owner. Debug bundles and the
-  // AsyncAPI `run.snapshot` reuse the snapshot by $ref, so one property covers all
-  // three surfaces — and one enum keeps them from drifting apart.
-  const RUN_SNAPSHOT_SCHEMA = 'run-snapshot.schema.json';
-  const STATUSES = ['none', 'pending', 'running', 'completed', 'partial', 'failed', 'manual'] as const;
-
-  function snapshotValidator() {
-    const ajv = new Ajv2020({ strict: false, allErrors: true });
-    for (const file of readdirSync(SCHEMAS_DIR).filter((f) => f.endsWith('.schema.json'))) {
-      ajv.addSchema(schema(file), file);
-    }
-    return ajv.getSchema(RUN_SNAPSHOT_SCHEMA) ?? ajv.compile(schema(RUN_SNAPSHOT_SCHEMA));
-  }
-
-  it('is declared on RunSnapshot as a closed enum of the seven §D values', () => {
-    const snap = schema(RUN_SNAPSHOT_SCHEMA) as {
-      properties: Record<string, { type?: string; enum?: string[] }>;
-      required: string[];
-    };
-    const field = snap.properties['compensationStatus'];
-    expect(field, 'RunSnapshot MUST declare `compensationStatus` (RFC 0151 §D, UQ3)').toBeDefined();
-    expect(field?.enum, 'the value set is closed and exactly the seven §D values').toEqual([...STATUSES]);
-    expect(
-      snap.required.includes('compensationStatus'),
-      'OPTIONAL on the schema — presence is governed by the capability gate in prose, not by `required`, ' +
-        'so a host that does not advertise `compensation` still validates',
-    ).toBe(false);
-  });
-
-  it('every §D value validates and a foreign value is rejected', () => {
-    const validate = snapshotValidator();
-    for (const value of STATUSES) {
-      const ok = validate({ runId: 'r1', workflowId: 'w1', status: 'failed', compensationStatus: value });
-      expect(ok, `compensationStatus=${value} MUST validate: ${JSON.stringify(validate.errors)}`).toBe(true);
-    }
-    for (const bad of ['compensating', 'COMPLETED', 'done', 'skipped', 'paused', 1, null, true]) {
-      const ok = validate({ runId: 'r1', workflowId: 'w1', status: 'failed', compensationStatus: bad });
-      expect(ok, `compensationStatus=${JSON.stringify(bad)} MUST be rejected — the fold is closed`).toBe(false);
-    }
-  });
-
-  it('a snapshot without the field still validates — the gate lives in prose', () => {
-    const validate = snapshotValidator();
-    expect(validate({ runId: 'r1', workflowId: 'w1', status: 'completed' })).toBe(true);
-  });
-
-  it('the forward `status` enum gained no `compensating` value — §D forbids reinterpreting it', () => {
-    const snap = schema(RUN_SNAPSHOT_SCHEMA) as { properties: { status: { enum: string[] } } };
-    expect(snap.properties.status.enum).not.toContain('compensating');
-  });
-});
-
-describe.skipIf(RFCS_DIR === null)('RFC 0151 — what this file does NOT establish', () => {
-  it('records that behavioral conformance is absent, per RFC 0147 §A.5', () => {
-    // Not decoration. RFC 0147 §A.5 forbids `Accepted` on shape-only evidence
-    // for a behavioral requirement, and this scenario is shape-only by
-    // construction: it compiles schemas and never contacts a host. The RFC's
-    // acceptance criteria and `docs/RFC-0147-SELF-AUDIT.md` both record 0151 as
-    // violating §A.5, and this leg exists so that reading the conformance suite
-    // alone cannot leave a different impression.
-    const rfc = readFileSync(
-      join(RFCS_DIR as string, '0151-compensation-and-partial-failure-profile.md'),
-      'utf8',
-    );
-    expect(
-      /Reverse-unwind, retry, crash, partial\/manual, approval, replay, and isolation scenarios pass\.\s*\(/.test(rfc),
-      'RFC 0151\'s behavioral acceptance item MUST remain unticked and annotated: no host executes ' +
-        'an unwind, so ordering, persistence-before-first-action, and crash resumption are unproven.',
-    ).toBe(true);
-  });
-});

package/src/scenarios/core-manifest-and-extension-registry.test.ts

@@ -1,250 +0,0 @@
-/**
- * RFC 0155 §B + §C — the stable core manifest and the extension registry.
- *
- * §B's value is not the inventory. It is the sentence after it: *"prose and code
- * profile definitions MUST be generated from or checked against this manifest."*
- * Three places describe the core-standard floor independently — the profile
- * prose, `PROFILE_FLOOR_SCENARIOS`, and the requirement registry — and before
- * this they could only be assumed to agree.
- *
- * They did not. `PROFILE_FLOOR_SCENARIOS` was an incomplete transcription of
- * `profiles.md`, and every profile it omitted verified as floor-proven against
- * nothing (RFC 0148 §C). A manifest with a parity gate is the mechanism that
- * would have caught that, which is why the manifest is DERIVED and never
- * hand-listed: a hand-listed manifest drifts the moment the corpus moves and
- * then asserts the drift with a digest attached.
- *
- * §C's bar for `stable` is deliberately hard — normative prose, schemas,
- * non-vacuous conformance, SDK support, and at least one Tier-3 implementation.
- * The consequence, stated plainly rather than worked around: **nothing in this
- * corpus can currently be `stable`**, because no Tier-3 host exists. That is a
- * fact about adoption, not about the work.
- *
- * Server-free; reads the corpus.
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { V1_DIR } from '../lib/paths.js';
-import { PROFILE_FLOOR_SCENARIOS } from '../lib/profiles.js';
-import { requirementsFor } from '../lib/requirement-registry.js';
-
-const MATURITIES = ['experimental', 'draft', 'stable', 'deprecated'] as const;
-type Maturity = (typeof MATURITIES)[number];
-
-interface Extension {
-  readonly id: string;
-  readonly maturity: Maturity;
-  readonly owningRfc: string | null;
-  readonly capabilityPath: string;
-  readonly dependsOn: readonly string[];
-  readonly securityTier: string;
-  readonly minimumSuiteVersion: string | null;
-  readonly evidenceTier: string | null;
-  readonly note?: string;
-}
-
-/** The capability schema, for `capabilityPath` resolution. */
-function caps(): Record<string, unknown> {
-  return JSON.parse(
-    readFileSync(join(V1_DIR as string, '..', '..', 'schemas', 'capabilities.schema.json'), 'utf8'),
-  ) as Record<string, unknown>;
-}
-
-function readJson<T>(name: string): T {
-  return JSON.parse(readFileSync(join(V1_DIR as string, name), 'utf8')) as T;
-}
-
-describe.skipIf(V1_DIR === null)('RFC 0155 §B — core-standard manifest parity', () => {
-  const manifest = V1_DIR === null ? null : readJson<{
-    profile: string;
-    digest: string;
-    floor: { requiredScenarios: string[]; requiredAnyPrefix: string[] };
-    requirementIds: string[];
-    openapiOperations: string[];
-    schemas: { file: string; $id: string | null }[];
-  }>('core-standard-manifest.json');
-
-  it('the manifest exists and is non-trivial', () => {
-    // Guard: an empty manifest would make every parity leg below vacuously true,
-    // which is the exact shape RFC 0148 §C found in the floor verifier.
-    expect(manifest, 'RFC 0155 §B: the manifest MUST be published').not.toBeNull();
-    const m = manifest as NonNullable<typeof manifest>;
-    expect(m.profile).toBe('openwop-core-standard');
-    expect(m.digest, 'the manifest MUST carry a digest').toMatch(/^[0-9a-f]{64}$/);
-    expect(m.floor.requiredScenarios.length).toBeGreaterThan(5);
-    expect(m.openapiOperations.length).toBeGreaterThan(20);
-    expect(m.schemas.length).toBeGreaterThan(20);
-  });
-
-  it('the manifest floor matches the floor the suite actually enforces', () => {
-    // The parity §B asks for. If these drift, the manifest is asserting a floor
-    // nobody runs — worse than no manifest, because it looks authoritative.
-    const m = manifest as NonNullable<typeof manifest>;
-    const live = PROFILE_FLOOR_SCENARIOS['openwop-core-standard'];
-    expect(live, 'the suite MUST define a core-standard floor').toBeDefined();
-    expect([...m.floor.requiredScenarios].sort()).toEqual([...(live?.required ?? [])].sort());
-    expect([...m.floor.requiredAnyPrefix].sort()).toEqual([...(live?.requiredAnyPrefix ?? [])].sort());
-  });
-
-  it('the manifest requirement IDs match the requirement registry', () => {
-    const m = manifest as NonNullable<typeof manifest>;
-    const fromRegistry = requirementsFor('openwop-core-standard');
-    expect(fromRegistry, 'core-standard MUST have registered requirements').not.toBeNull();
-    expect([...m.requirementIds].sort()).toEqual([...(fromRegistry as readonly string[])].sort());
-  });
-
-  it('every schema the manifest lists declares an $id', () => {
-    const m = manifest as NonNullable<typeof manifest>;
-    const missing = m.schemas.filter((s) => s.$id === null).map((s) => s.file);
-    expect(missing, 'CONTRIBUTING.md: every schema carries an `$id` under openwop.dev/spec/v1/').toEqual([]);
-  });
-});
-
-describe.skipIf(V1_DIR === null)('RFC 0155 §C — extension registry', () => {
-  const registry = V1_DIR === null ? null : readJson<{ extensions: Extension[] }>('extensions.json');
-
-  it('the registry exists and every record is closed', () => {
-    expect(registry, 'RFC 0155 §C: `spec/v1/extensions.json` MUST exist').not.toBeNull();
-    const exts = (registry as NonNullable<typeof registry>).extensions;
-    expect(exts.length, 'the registry MUST cover the program extensions').toBeGreaterThan(3);
-    for (const e of exts) {
-      for (const k of ['id', 'maturity', 'owningRfc', 'capabilityPath', 'dependsOn', 'securityTier']) {
-        expect(e[k as keyof Extension], `${e.id} MUST declare ${k}`).toBeDefined();
-      }
-      expect(MATURITIES, `${e.id}: maturity is a closed enum`).toContain(e.maturity);
-    }
-    expect(new Set(exts.map((e) => e.id)).size, 'extension ids MUST be unique').toBe(exts.length);
-  });
-
-  it('no extension is `stable` without a Tier-3 implementation', () => {
-    // §C: stable requires normative prose, schemas, non-vacuous conformance, SDK
-    // support where applicable, and at least one Tier-3 implementation. The last
-    // one is the binding constraint here, and it is external to this repo — no
-    // Tier-3 host exists, so NOTHING can currently be stable. Recording that
-    // ceiling is the honest move; promoting anything past it would be the
-    // overclaim RFC 0147 §A bans.
-    const overclaimed = (registry as NonNullable<typeof registry>).extensions
-      .filter((e) => e.maturity === 'stable' && (e.evidenceTier === null || e.evidenceTier === undefined))
-      .map((e) => e.id);
-    expect(
-      overclaimed,
-      'RFC 0155 §C: `stable` requires at least one Tier-3 implementation, recorded in `evidenceTier`. ' +
-        'An extension marked stable with no evidence tier is a claim the corpus cannot substantiate.',
-    ).toEqual([]);
-  });
-
-  it('every dependency resolves to a known profile or listed extension', () => {
-    // A dependency on something that does not exist is a closure hole: the
-    // record looks complete and the graph does not.
-    const exts = (registry as NonNullable<typeof registry>).extensions;
-    const known = new Set<string>([...Object.keys(PROFILE_FLOOR_SCENARIOS), ...exts.map((e) => e.id)]);
-    const dangling = exts.flatMap((e) =>
-      e.dependsOn.filter((d) => !known.has(d)).map((d) => `${e.id} -> ${d}`),
-    );
-    expect(dangling, 'RFC 0155 §C: `dependsOn` MUST resolve').toEqual([]);
-  });
-
-  it('every capabilityPath resolves against the capability schema', () => {
-    // Fifth axis of the named-list check, and it found four of six broken.
-    // Three were typos introduced when this registry was written —
-    // `a2a.protocolVersion` for `protocolVersions`, the same for MCP, and
-    // `workloadIdentity.supported` omitting its `auth.` parent. The fourth,
-    // `idempotency.supported`, pointed at a field the corpus USES in its own
-    // examples but had never DECLARED; it validated only because that family
-    // carries `additionalProperties: true`, so a typo like `suported` was
-    // accepted silently.
-    //
-    // An extension whose capabilityPath does not resolve is unreachable: a
-    // consumer following the registry to find the flag finds nothing, and the
-    // registry looks complete while pointing at empty space.
-    const schema = caps() as { properties: Record<string, unknown> };
-    const unresolved: string[] = [];
-    for (const e of (registry as NonNullable<typeof registry>).extensions) {
-      let node = schema.properties as Record<string, { properties?: Record<string, unknown> }> | undefined;
-      let ok = true;
-      for (const part of e.capabilityPath.split('.')) {
-        if (node === undefined || !(part in node)) {
-          ok = false;
-          break;
-        }
-        node = node[part]?.properties as typeof node;
-      }
-      if (!ok) unresolved.push(`${e.id} -> ${e.capabilityPath}`);
-    }
-    expect(
-      unresolved,
-      'RFC 0155 §C: `capabilityPath` MUST resolve to a declared property in ' +
-        '`capabilities.schema.json`. An unresolvable path makes the extension unreachable — a ' +
-        'consumer following the registry to find the flag finds nothing, while the registry ' +
-        'still reads as complete.\n  ' + unresolved.join('\n  '),
-    ).toEqual([]);
-  });
-
-  it('the coverage block is present and accounts for every capability family (RFC 0155 §C, acceptance item 3)', () => {
-    // "Unlisted means uncovered" was a sentence; this makes it a checked list.
-    // The block is DERIVED by scripts/generate-extension-registry-coverage.mjs
-    // (--check runs in openwop:check); here we assert the invariant it encodes
-    // so a tarball consumer sees it too: every top-level capability family is
-    // either a core predicate field, covered by a record's capabilityPath, or
-    // listed as uncovered — and nothing is in two buckets.
-    const reg = registry as unknown as {
-      coverage?: {
-        familiesTotal: number;
-        coreFields: string[];
-        metadataFields?: string[];
-        metadataRationale?: Record<string, string>;
-        covered: string[];
-        uncovered: string[];
-      };
-      extensions: Extension[];
-    };
-    expect(reg.coverage, 'RFC 0155 §C: the registry MUST carry a derived `coverage` block').toBeDefined();
-    const cov = reg.coverage as NonNullable<typeof reg.coverage>;
-    const metadata = cov.metadataFields ?? [];
-    const families = Object.keys((caps().properties as Record<string, unknown>) ?? {}).sort();
-    expect(cov.familiesTotal).toBe(families.length);
-    const all = [...cov.coreFields, ...metadata, ...cov.covered, ...cov.uncovered].sort();
-    expect(all, 'core + metadata + covered + uncovered MUST partition the family set exactly').toEqual(families);
-    expect(new Set(all).size, 'no family may sit in two buckets').toBe(all.length);
-    const reached = new Set(reg.extensions.map((e) => e.capabilityPath.split('.')[0]));
-    for (const f of cov.covered) expect(reached.has(f), `${f} listed as covered MUST be reached by a record`).toBe(true);
-    for (const f of cov.uncovered) expect(reached.has(f), `${f} listed as uncovered MUST NOT be reached by a record`).toBe(false);
-    // Metadata is the one bucket a family can be moved INTO by hand, so it is
-    // the one that could hide an extension: every entry MUST carry a stated
-    // rationale, and no metadata key may carry a `supported` flag — a key that
-    // gates behaviour is a family, not a description of the document.
-    for (const f of metadata) {
-      expect(typeof cov.metadataRationale?.[f], `${f}: a metadata field MUST state why it is not an extension`).toBe('string');
-      const props = (caps().properties as Record<string, { properties?: Record<string, unknown> }>)[f]?.properties ?? {};
-      expect('supported' in props, `${f} is listed as metadata but carries a \`supported\` flag — that is an extension family`).toBe(false);
-    }
-    // The honest number, asserted so it cannot silently shrink by deletion of the
-    // uncovered list rather than by adding records.
-    expect(cov.uncovered.length + cov.covered.length + cov.coreFields.length + metadata.length).toBe(families.length);
-  });
-
-  it('every record names the RFC — or, for a v1 base advertisement, the spec document — that owns it', () => {
-    // Vendor extensions may not use an `openwop-*` id without an accepted RFC
-    // (§F). The owning RFC is what makes that checkable. Six advertisements
-    // predate the RFC process (they shipped in the v1 base corpus: `secrets`,
-    // `webhooks`, `i18n`, `aiProviders`, `envelopeContracts`, `envelopeStrictness`);
-    // those carry `owningRfc: null` and an `owningDoc` under spec/v1/ that MUST
-    // exist — the steward's own corpus is the RFC-equivalent authority for them.
-    for (const e of (registry as NonNullable<typeof registry>).extensions) {
-      const rec = e as Extension & { owningDoc?: string; securityTier?: string };
-      if (rec.owningRfc === null) {
-        expect(typeof rec.owningDoc, `${e.id}: \`owningRfc: null\` requires an \`owningDoc\``).toBe('string');
-        expect(rec.owningDoc, `${e.id}: owningDoc MUST be a spec/v1 document`).toMatch(/^spec\/v1\/[a-z0-9-]+\.md$/);
-        if (V1_DIR !== null) {
-          const file = join(V1_DIR, (rec.owningDoc as string).replace(/^spec\/v1\//, ''));
-          expect(existsSync(file), `${e.id}: owningDoc ${rec.owningDoc} MUST exist`).toBe(true);
-        }
-      } else {
-        expect(e.owningRfc, `${e.id} MUST name an owning RFC`).toMatch(/^\d{4}$/);
-      }
-      expect(['high', 'medium', 'low'], `${e.id}: securityTier is a closed enum`).toContain(rec.securityTier);
-    }
-  });
-});