@openwop/openwop-conformance 1.153.0 → 1.155.0

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,102 @@
 {
-  "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.153.0",
-  "corpusCommit": "6c84ef16e2cae24b7e7b8d8bf09b9f46634bf9a5"
+  "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md §\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
+  "suiteVersion": "1.155.0",
+  "corpusCommit": "69a420b081aac0fc7f3a6b7576855d6d1ba33f48",
+  "files": {
+    "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
+    "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
+    "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
+    "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
+    "api/redocly.yaml": "9f2374405b9ca58994ae076ada9fbe4dfb8265b77e4bf65331d1493192c0bd3a",
+    "schemas/README.md": "3769a5bcdc2d8f02c819d20eecf34e0c50666b47ac922380a9b0e0ec13cfc9e2",
+    "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
+    "schemas/a2ui-surface-delta-frame.schema.json": "970d434e4fdcb925de64aaace91eb83bfbcfd8f76757a9ce9f339eda5fb3f4e8",
+    "schemas/agent-deployment-transition.schema.json": "1ac987fed0f380fa5b4e9a40e8e13316e5ae42d03a0ff42db4be6273e1bfe9f4",
+    "schemas/agent-deployment.schema.json": "0a71f0c7ab8cdf4fcac15e8652514f926cd84dfc7db32c47c9f3f3c9bd04f512",
+    "schemas/agent-eval-suite.schema.json": "d1aea50a48ddfe5ba8e25e9ddcc2c6e28eb1d953ef81b103518999a50e0967f7",
+    "schemas/agent-inventory-response.schema.json": "3a64dde3b95ece16ad73b95051ca99a1ca285f60255b5b506bed655676d82687",
+    "schemas/agent-manifest.schema.json": "b82738459792e24b14c4fe43622e8feb0df2250bda02054caa960c3556438b2c",
+    "schemas/agent-org-chart.schema.json": "2ca433503e76b29a70be35db22cce24bb698e6aa2f8b79c6fe6025f988f94fb0",
+    "schemas/agent-ref.schema.json": "b411bd51439e26d862393d546215d6b26d9349e6c9bdd92b353ca0fde2a51fb2",
+    "schemas/agent-roster-entry.schema.json": "3e0d8dfc0c66afb887bd05974a1ffbf79eece391255c09d2d0f7c5536aa219fd",
+    "schemas/agent-roster-response.schema.json": "1f6057bddd95d1cd31fdcef2fc87ae4560003c6e0c6d9e3fd1a148bac537c0b8",
+    "schemas/ai-envelope.schema.json": "78167a5767809286071bfcfcdfeceed0ed04c8b9f8c13079019d70eff4f351c1",
+    "schemas/annotation-create.schema.json": "567e8327777968e0ddab8e1547b4acd7beda734cf9d1fc6cde17037d8d9540d4",
+    "schemas/annotation.schema.json": "b26d22f9a97e1ae7c195e8799964aca804e78452a079ca3a0d61ea013907ce91",
+    "schemas/artifact-type-pack-manifest.schema.json": "13932ea58e819e01b3a0cc7a65590b70683dd5fe9208fc06c64c339943d3c4ce",
+    "schemas/audit-verify-result.schema.json": "e8fd013fb610ba5db27ab0113ec2eb18e7da5f9310dd3de2dd3dc87a259c21fe",
+    "schemas/budget-policy.schema.json": "3d4fe30ae129fe136ab9ece395f2a2a42a76360786b1b9a1d5f1cbc753eb5b39",
+    "schemas/capabilities.schema.json": "72811aa52360e9b84988e7989e4cad519acf0db096f4e3894574f7d022e37e7a",
+    "schemas/certification-bundle-v2.schema.json": "3540232676086869ae78d24f3b9c2154f9c4a8a5eeb976512d6a7409f8cf19bb",
+    "schemas/channel-presence-payload.schema.json": "f9d0ef4219814c2b765baf3e68cbe5eea2cb42379f516a93a0459dcd5f7db47e",
+    "schemas/channel-written-payload.schema.json": "54723a56bc5a35232f64544ca686ac1ac959a5fb05b32b2401facca6b3ef51a3",
+    "schemas/chat-card-pack-manifest.schema.json": "402f7e9081cc39857a52e772061f4e034a957dcbc17501fe6e8e0bcb3d337e42",
+    "schemas/compact-tool-descriptor.schema.json": "4856d52aed0438d366b4328e53e4d248126e46f57137ad25fb04c3cc22bba1be",
+    "schemas/compensation-policy.schema.json": "6038bf939a982be1105d92b8a0bb70fae936b49d5e8187e1215660d265e2c382",
+    "schemas/conformance-certification-bundle.schema.json": "30a1f7fc35ed06098b7abb6fcf3b6f46b5716f29fbae35e0de1247f1f8cbe54c",
+    "schemas/connection-pack-manifest.schema.json": "35aca9fc3b3c8322babebe77ef77a8033673254f948025fb2f37191f4cfd05b5",
+    "schemas/conversation-event.schema.json": "bfcb88ce8dfe4dd7a3a40e56519a2833c7d25487fd2ab4104f6a23195120c0d9",
+    "schemas/conversation-turn.schema.json": "7c025df336aef9456d07f3a1a6959fc6d1c6fa62859e884354d71efee705ca3c",
+    "schemas/core-conformance-mock-agent-config.schema.json": "2253e1fb0cd8823ef2bfbae9b957ac374a7b617f62c1eb15d819e3536296feb3",
+    "schemas/credential-provenance.schema.json": "7675889469a67c68f31b8d0b28fd0b0a3c837f21ef51ce3b3c676064d3f58597",
+    "schemas/credential-reference.schema.json": "14927f095c235367a0645cc4811f4cfcfa3bed152bf05b970881831c62178b56",
+    "schemas/debug-bundle.schema.json": "8bd626e4cfbdaa774231e7182f61f2b5a4a42c3afeb8672c8388ea41e3fb7f2e",
+    "schemas/dispatch-config.schema.json": "131767797315e980f182b2480a1e2ed562d3326a2db08628704273f5b38c9e26",
+    "schemas/envelopes/clarification.request.schema.json": "3b3520a9ca2e40b4fb54b3a8741b2d3f2d414a0dfc004ba7c71dcf3786c32603",
+    "schemas/envelopes/error.schema.json": "845261720e8398975042ddfe78012491e42f8a39ed195b524c389cc9bc25f5c0",
+    "schemas/envelopes/media.audio.schema.json": "6c23f7398558ed781a36295c980a7ca9c585cc51faac8dd0ea56973be9dc96df",
+    "schemas/envelopes/media.file.schema.json": "3eb9ba4d3727a86640d82d566dca4fbcc06f6f0f3f80cfd100be869e9739d0b4",
+    "schemas/envelopes/media.image.schema.json": "1517b2036450226a20a55c223583d3cb2b606d157698a0806e00ca9ea1ea413e",
+    "schemas/envelopes/schema.request.schema.json": "16f6523778bdae67c715c10b0eb61fb8c7abaed4673d888957d6cc46f604be8c",
+    "schemas/envelopes/schema.response.schema.json": "35323b628db30a2b51efb66192f8f1219e184afa130126395524165a98539c6b",
+    "schemas/envelopes/ui.a2ui-surface.schema.json": "68f977c11b9bb40435a9c5727b66d76275f8dcfa0b380086622a837c84b8c5e4",
+    "schemas/error-envelope.schema.json": "1f2addeabbaa3cd7957c77816a1609b0c5005e0730cff78162bbc2804ff7c4aa",
+    "schemas/eval-summary.schema.json": "cda7ea443069f5cfd088cd000dccb4ea8b6e8268cfcc3af740295241bf77fa10",
+    "schemas/export-bundle.schema.json": "1ed674786293fc33f3474fb93cd3e5a1d8f85d0cb09636a09856bd8671e62c90",
+    "schemas/form-content-pack-manifest.schema.json": "bd373116c8912e2cd8a0e4df1f7a56086c0fdae472320f695552dd46b1b48a45",
+    "schemas/frontend-plugin-manifest.schema.json": "33d4e4eea5753900669c7ed6416e314376395a0256a9d656bf03a18845c16e84",
+    "schemas/goal.schema.json": "66aab339cda217318dab40e40ea0b46ea949164e7f2482e865284d6b2e3383db",
+    "schemas/heartbeat-evaluated.schema.json": "d3caa3fae3d935cc782c2359afa2d6bf11feb1ce9d71b9345b8e5716a9348c61",
+    "schemas/heartbeat-state-changed.schema.json": "6b66086582436ac72bd929d2830d0539d932a41b8ddf90263e2b8ca903d60584",
+    "schemas/localized-content-language-settings.schema.json": "6ba0e2918e08756493648a64d6169829eed0ead91fb6c3f2a76dec5c451b2d77",
+    "schemas/localized-content-page-response.schema.json": "3fd47db2484c40417ab7a555ec42bf443d48deca0c38ecdbe008a3bdcd1a6809",
+    "schemas/localized-content-page.schema.json": "2ca2d591d197562c4bf668b338e47803256cfa0c9105abdf64bd79e8469f15a8",
+    "schemas/localized-content-section.schema.json": "3e183eb2e80b985dc9b3770e97865247059d32ffbab2957f4a5c0addfdfedc2e",
+    "schemas/memory-entry.schema.json": "f5d806c934e900a979e14ccd961224d55eede954ffd10c5369f4cb97654e142b",
+    "schemas/memory-list-options.schema.json": "fd3e61c0caf984c6cf14f8acf55c0e84b6b579d62a702be45e20dbedfc9fffce",
+    "schemas/node-pack-manifest.schema.json": "3c7812fc8aae840edd8afe6d51fcb58571a50008e0b7ade4b7c5d55e8da9fcb8",
+    "schemas/orchestrator-decision.schema.json": "9dbcc9e7595df1781db91b1e8764fec67feca7d232b07d151094400aa53750e7",
+    "schemas/org-chart-responsibility-view.schema.json": "9bf2cc7b2ac8b6d7c28d360e8263da5706f691c364c30d20f16fd46b21fdd278",
+    "schemas/pack-lockfile.schema.json": "e6c6fd6c042485a3a16c5aedf184a3304b3068c6dd0cf8a22cba1e2e58781556",
+    "schemas/prompt-kind.schema.json": "fcf4305b430dc9d2d34b6f2971f4185fd2ed7f617013720d975bfc3ab665e000",
+    "schemas/prompt-pack-manifest.schema.json": "d473d827797ce6c9fe4fe03e439840a9dbc78d899bfb9ff05ff3e6a747380977",
+    "schemas/prompt-ref.schema.json": "2fffd62cb27c36ddfa32363922b2cb5339091716112c54ded32c21a8c26398bb",
+    "schemas/prompt-template.schema.json": "54fc1f0d22b938d171dff214f3d446ae911ef0c3cdb2056929b93d01248e0969",
+    "schemas/proposal.schema.json": "472ac8c6bcbb4e34ae8fe7a0757567de4875e69aa5058dac4dc9226ddba6c731",
+    "schemas/registry-version-manifest.schema.json": "437890063087beab3cadbdb0dae354e9f92a3ebbecdd90a1d0487df71d34ed93",
+    "schemas/residency.schema.json": "b45fdc91ae88091251914dbd6787a1e2ce687580b91d31a759217b7a1f0010c0",
+    "schemas/run-ancestry-response.schema.json": "963a5763b03216aa72fc2854560c778e53994f8cb06ea9a4053e541273c87f5c",
+    "schemas/run-diff-response.schema.json": "d9d196730b5d5d8a04a591d21a8fc6b44be7fa134f11827ff7e4f1a86d47e83d",
+    "schemas/run-event-payloads.schema.json": "37cdbdb5038e148056c104a49b8d28a9668479e06d401309d354a8b0a70921a3",
+    "schemas/run-event.schema.json": "c70c06932b9831295042836213e617c8e946f20ddd49cf4e889b74d89d2175a8",
+    "schemas/run-options.schema.json": "f8241ece6ddc6527de9160d811d42c231b4f77b935f2e107b3c05608545c59ab",
+    "schemas/run-orchestrator-decided-event.schema.json": "17a43a3c44680a24d411141357a867b3caed6107d56de88fe2e062eaf93fa2c1",
+    "schemas/run-snapshot.schema.json": "8a45f997beec0a2fa596f4631129a869cfbc37c9ad38583530ed11655301d2ab",
+    "schemas/security-advisory.schema.json": "9c550f0bf10a3193dcca4a127081fb66fe5dc1b6f729c4c17bfaea3ba3ce05fc",
+    "schemas/self-hosted-runner-dispatch-frame.schema.json": "3f1d7edd572c6747657299525d8e85329b93b6fadf670e3a19c74d53e725adec",
+    "schemas/self-hosted-runner-registration.schema.json": "6c781adf1bb915a9e47796494f4a527353cbbf72b480e5a05be4aac65a6d0c6e",
+    "schemas/self-hosted-runner-result-frame.schema.json": "16f2f711b6071c797d8d4065f6f5ff39102ff03890fefce7a88a669831566296",
+    "schemas/subject.schema.json": "89679e35c7ec586adf6dd4adaff0bfa5453648d067fb2a43d7a2f7b2d016e10c",
+    "schemas/suspend-request.schema.json": "1aa39f2a947934bedc9f9696bf45fcb6119395c580d5ca282efb9443bd94a7bb",
+    "schemas/tool-descriptor.schema.json": "7f6adbae63003c1f1311f6a436f7f286542be62aa19a27b46730f2c2810857f7",
+    "schemas/trigger-event.schema.json": "59d63b79dca3593f45d281776cbfe43ae4d85ee25519b82ad59f162a9efb592c",
+    "schemas/trigger-subscription-registration.schema.json": "929d628bad08e1def696e47e9a148aba00fa801e28d49bbd0dc2360b08673435",
+    "schemas/trigger-subscription.schema.json": "4f7b067f20032073b140c4bb15dc9a9914c4f6421a252ff1ff261cbdd8edf270",
+    "schemas/ui-plugin-message.schema.json": "346638babf1f8ea7b161cde75c0038b518cd2cc5bf0631772e20a9b74c96b5dd",
+    "schemas/workflow-chain-pack-manifest.schema.json": "c027571913c44d8d9678750c72701a710a02fa0df55e86849da03e13e95c333a",
+    "schemas/workflow-definition.schema.json": "28b050ffe22121796c9d4a5a8c7e57c901bb283bd08d3fd3ff2ea25a898108c1",
+    "schemas/workload-identity.schema.json": "64ed93e12cc9f0657e56ff9b8f045e5d68d397df5276d103c07f42c7f34f0579",
+    "schemas/workspace-file-create.schema.json": "70a23b92c2958c0165d7d29aea9020a045dc7816af82c80c5f50d0aac19c4856",
+    "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4"
+  }
 }

package/schemas/README.md

@@ -71,6 +71,7 @@
 | `run-options.schema.json` | `run-options.md` | Per-run input overlay (configurable + tags + metadata) on `POST /v1/runs` |
 | `run-orchestrator-decided-event.schema.json` | orchestrator RFC + `observability.md` | Event payload for orchestrator decisions |
 | `run-snapshot.schema.json` | `rest-endpoints.md` §RunSnapshot | Projected run state from `GET /v1/runs/{runId}` |
+| `subject.schema.json` | `auth.md` §"The Subject record" + RFC 0165 | DRAFT — issuer-scoped, lane-typed identity record carried as `owner.subject` on `RunSnapshot` and the `run.started` echo; opaque `subjectId` (no `@`/whitespace), `keyClass` iff saml/scim, optional bounded `actor` chain. Optional in v1.x; the v2 major requires it. |
 | `residency.schema.json` | RFC 0129 + `capabilities.md` §dataResidency | OPTIONAL data-residency `{region}` constraint on `POST /v1/runs` (honor-or-reject admission) |
 | `credential-provenance.schema.json` | `host-capabilities.md` §"Credential provenance + egress policy" (RFC 0079) | Metadata about a host-issued credential at the tool/egress boundary — `credentialId`/`issuer`/`audiences`(+scopes/expiry/redaction/audit-correlation). Secret-free (SR-1); the §C audience-binding MUST is evaluated against `audiences`. |
 | `security-advisory.schema.json` | `registry-operations.md` + INCIDENT-RESPONSE runbook | Registry-owned CVE advisory record at `registry/security/advisories.json`. One entry per disclosed vulnerability — id, severity, affected pack-name + SemVer range, optional fixedIn/advisoryUrl/credits. Enforced by `check-advisories.mjs` in `.github/workflows/registry-publish.yml`. |

package/schemas/capabilities.schema.json

@@ -16,6 +16,13 @@
       "description": "RFC 0149 \u00a7C \u2014 openwop protocol version the server speaks, as ASCII `<major>.<minor>` with no leading zero except zero itself. `1.0` and `1.12` are valid; `1`, `1.0.0`, `v1.0`, and `01.0` are not. The integer major is the hard compatibility boundary and the integer minor is the additive contract level; PATCH belongs to suite and SDK versions, not the spec version. Previously constrained only by `minLength: 1`, which admitted `v1.0`, `1.0.0`, and `banana` \u2014 a negotiation the wire could not decide, since neither integer can be extracted from an unconstrained string. Independent of `engineVersion` (which gates persisted-doc compatibility per version-negotiation.md).",
       "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$"
     },
+    "protocolVersions": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$" },
+      "description": "RFC 0165 \u00a7A. Every protocol `<major>.<minor>` this host speaks, newest first by convention. OPTIONAL in v1.x; when present it MUST contain the value of `protocolVersion` and MUST NOT name a major the host does not serve. Same grammar as `protocolVersion` (RFC 0149 \u00a7C), not the looser A2A item pattern. Consumers that do not understand it ignore it; profile derivation reads `protocolVersion` only. Reserved for v2 major negotiation."
+    },
     "contractProvenance": {
       "type": "object",
       "description": "RFC 0146 (`Active`). Which corpus revision this host's contract handling corresponds to \u2014 the copy it validates and serves against. OPTIONAL; absent \u21d2 UNSPECIFIED provenance, neither current nor stale, and a consumer MUST NOT infer a version from its absence. ADVISORY: a consumer MUST NOT reject a request, refuse interop, or fail a run solely because this differs from its own \u2014 v1.x corpus revisions are additive, so a host on an older revision is conformant and this field detects drift rather than making drift an error. Nothing else on the wire answers this: `protocolVersion` is `1.0` across the entire v1 line (the drift happens inside that value) and `schemaVersions` is per-envelope-type. NOT an integrity check \u2014 `corpusCommit` says WHICH contract, never whether the copy was modified.",

package/schemas/run-event-payloads.schema.json

@@ -1019,6 +1019,15 @@
             "principal": {
               "type": "string",
               "minLength": 1
+            },
+            "principalKind": {
+              "type": "string",
+              "enum": ["user", "agent", "anonymous"],
+              "description": "RFC 0132 (declared here by RFC 0165): the echo carries the same optional kind as `RunSnapshot.owner.principalKind`, so a host that echoes its own snapshot owner emits a valid payload."
+            },
+            "subject": {
+              "$ref": "subject.schema.json",
+              "description": "RFC 0165 \u00a7B. The run's Subject record, echoed verbatim from `RunSnapshot.owner.subject` when present."
             }
           },
           "additionalProperties": false

package/schemas/run-snapshot.schema.json

@@ -46,6 +46,10 @@
         "tenant": { "type": "string", "minLength": 1, "description": "Top-level isolation boundary." },
         "workspace": { "type": "string", "minLength": 1, "description": "Optional sub-tenant within the tenant (RFC 0048 workspace)." },
         "principal": { "type": "string", "minLength": 1, "description": "Acting identity (user or agent) — opaque id, never PII." },
+        "subject": {
+          "$ref": "subject.schema.json",
+          "description": "RFC 0165 \u00a7B. OPTIONAL issuer-scoped Subject record for the acting identity. When present: `subject.tenant` MUST equal `tenant`, `subject.subjectId` MUST equal `principal` when both are present, `subject.kind` MUST equal `principalKind` when both are present. A host that emits it on new runs synthesizes `issuer: \"urn:openwop:legacy\"` for runs that predate emission (\u00a7B.3) and copies it verbatim onto forks (\u00a7B.4)."
+        },
         "principalKind": {
           "type": "string",
           "enum": ["user", "agent", "anonymous"],

package/schemas/subject.schema.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/subject.schema.json",
+  "title": "OpenWOP Subject",
+  "description": "RFC 0165 §B. An issuer-scoped, lane-typed identity record carried as `owner.subject` on RunSnapshot and on the run.started owner echo. With `issuer` in the key, two trust roots issuing the same identifier are distinct by construction. Optional in v1.x; the v2 major requires it and removes the bare `owner.principal` string.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["issuer", "subjectId", "tenant", "lane", "kind"],
+  "properties": {
+    "issuer": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 1024,
+      "pattern": "^\\S+$",
+      "description": "Trust root that asserted this subject: the SAML IdP entityID, the OIDC `iss`, the mTLS CA subject, the API-key realm, the SCIM connection id, or `urn:openwop:legacy` for a run that predates subject emission (RFC 0165 §B.3)."
+    },
+    "subjectId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "pattern": "^[^@\\s]+$",
+      "description": "Opaque, stable, issuer-scoped identifier. MUST NOT be an email address, a display name, or credential material (SECURITY invariant `subject-record-opaque`). Equals `owner.principal` when both are present (RFC 0165 §B.2)."
+    },
+    "tenant": {
+      "type": "string",
+      "minLength": 1,
+      "description": "MUST equal the enclosing `owner.tenant` (RFC 0165 §B.2)."
+    },
+    "lane": {
+      "type": "string",
+      "enum": ["api-key", "oauth2", "oidc", "mtls", "saml", "scim", "ldap", "workload"],
+      "description": "The authentication lane that minted the subject (auth-profiles.md). `workload` corresponds to RFC 0154's workload identity; the RFC 0154 `scheme` is carried in `issuer`."
+    },
+    "kind": {
+      "type": "string",
+      "enum": ["user", "agent", "anonymous", "workload"],
+      "description": "Superset of `owner.principalKind` (RFC 0132) plus `workload` (RFC 0154). Equals `principalKind` when both are present."
+    },
+    "keyClass": {
+      "type": "string",
+      "enum": ["opaque-idp", "configured-immutable"],
+      "description": "How `subjectId` was derived when the lane is linkable (RFC 0163 §A). Present iff `lane` is `saml` or `scim`; MUST equal `capabilities.auth.subjectLinkKey` when both identity profiles are advertised (RFC 0164 §A.3)."
+    },
+    "actor": {
+      "$ref": "#",
+      "description": "Who acted on this subject's behalf (delegation; RFC 0154 §B inverted to the run's point of view). Provenance, not authorization. Chain depth MUST NOT exceed 4; a host refuses rather than truncates (RFC 0165 §B.5)."
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "lane": { "enum": ["saml", "scim"] } } },
+      "then": { "required": ["keyClass"] },
+      "else": { "not": { "required": ["keyClass"] } }
+    }
+  ]
+}

package/src/cli.ts

@@ -195,7 +195,7 @@ Required (unless --offline):
   --api-key <key>       Bearer-style API key (or set OPENWOP_API_KEY env var)
 
 Filtering:
-  --offline             Run only the server-free subset (fixtures + spec corpus)
+  --offline             Run only the declared server-free subset (fixtures-valid; see README §"--offline")
   --filter <pattern>    Pass through to vitest --testNamePattern
 
 Implementation labels (cosmetic — surface in failure messages):
@@ -656,10 +656,12 @@ async function main(): Promise<never> {
   // the conformance package is used as a workspace member.
   const vitestArgs: string[] = ['run', '--config', resolvePath(conformanceRoot, 'vitest.config.ts')];
   if (args.offline) {
-    vitestArgs.push(
-      'src/scenarios/fixtures-valid.test.ts',
-      'src/scenarios/spec-corpus-validity.test.ts',
-    );
+    // Suite 1.154.0: the offline set is a DECLARED property of the package —
+    // exactly the server-free scenarios that ship in the tarball and run in
+    // the published layout. `spec-corpus-validity.test.ts` left the set: it is
+    // a corpus-coherence scenario (reads spec/v1, asserts nothing about a host)
+    // and is no longer packed. See conformance/README.md §"--offline".
+    vitestArgs.push('src/scenarios/fixtures-valid.test.ts');
   }
   if (args.filter) {
     vitestArgs.push('--testNamePattern', args.filter);

package/src/global-setup.ts

@@ -56,6 +56,8 @@ const MAX_ROWS = 40;
 // at runtime, so this costs nothing and makes the compiler the oracle: rename
 // a ledger field and this file stops building instead of silently degrading.
 import type { LedgerEntry } from './lib/requirement-ledger.js';
+import { LAYOUT, PKG_ROOT_PATH } from './lib/paths.js';
+import { describeVerdict, verifyCorpusStamp } from './lib/corpus-stamp.js';
 
 /** What a JSONL line parses to before validation — every field may be absent. */
 type LedgerLine = Partial<Record<keyof LedgerEntry, unknown>>;
@@ -64,6 +66,17 @@ let ownedDir: string | null = null;
 let ledgerPath: string | null = null;
 
 export function setup(): void {
+  // Suite 1.154.0 — the vendored contract must be the one this suite shipped.
+  // In the published layout every api/ + schemas/ file is checked against the
+  // SHA-256 map pack-vendor.sh wrote into schemas/CORPUS-STAMP.json; a mismatch
+  // aborts the run (a suite validating a host against a schema it did not ship
+  // is evidence about nothing). Repo layout: nothing vendored, nothing to check,
+  // and the log line says so rather than implying a pass.
+  const stamp = verifyCorpusStamp(PKG_ROOT_PATH, LAYOUT);
+  process.stderr.write(`${describeVerdict(stamp)}\n`);
+  if (stamp.kind === 'mismatch') {
+    throw new Error('openwop-conformance: refusing to run — schemas/CORPUS-STAMP.json digests do not match the vendored api/ + schemas/ files. Reinstall the package; do not hand-patch vendored contract files.');
+  }
   if (process.env['OPENWOP_DISPOSITION_SUMMARY'] === 'false') return;
   // `--certify` already routes the ledger to its own report dir and reads it
   // there. Never take it over — this exists only for the path that had no

package/src/lib/corpus-stamp.ts

@@ -0,0 +1,125 @@
+/**
+ * Corpus-stamp digest verification (v2 charter Phase 1, suite 1.154.0).
+ *
+ * The published suite vendors `api/` and `schemas/` at `prepack` and writes
+ * `schemas/CORPUS-STAMP.json` (RFC 0145 G2) — until 1.154.0 that stamp carried
+ * only `suiteVersion` + `corpusCommit`, so a tarball whose vendored files had
+ * been altered, partially copied, or hand-patched after install still read as
+ * "the 1.x contract". That is the generated-surface-drift class the charter's
+ * §A names (`@openwop/openwop-conformance@1.138.1` on npm was not the 1.138.1 in
+ * the tree), one layer down: the package identified its corpus by a commit
+ * hash it could not check.
+ *
+ * From 1.154.0 the stamp also carries `files`: a map of every vendored path
+ * (relative to the package root) to its SHA-256. In the PUBLISHED layout the
+ * suite verifies the map at global setup and refuses to run on a mismatch —
+ * a suite that validated a host against a schema it did not ship would be
+ * evidence about nothing. In the REPO layout (a spec checkout) there is no
+ * vendored copy and nothing to verify; the check is skipped and says so.
+ *
+ * Three outcomes, never folded (OK / FAIL / UNKNOWN): `verified` when every
+ * digest matches; `mismatch` (throws) when any file is missing or altered;
+ * `not-applicable` when the layout is not published or the stamp predates
+ * 1.154.0 (older tarballs cannot be verified and the run says so rather than
+ * pretending).
+ */
+
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+
+export interface CorpusStamp {
+  readonly suiteVersion?: string;
+  readonly corpusCommit?: string;
+  /** `<relative path>` → lowercase hex SHA-256. Present from suite 1.154.0. */
+  readonly files?: Readonly<Record<string, string>>;
+}
+
+export type StampVerdict =
+  | { readonly kind: 'verified'; readonly files: number }
+  | { readonly kind: 'not-applicable'; readonly reason: string }
+  | { readonly kind: 'mismatch'; readonly missing: readonly string[]; readonly altered: readonly string[]; readonly extra: readonly string[] };
+
+export const STAMP_RELATIVE_PATH = join('schemas', 'CORPUS-STAMP.json');
+
+/** SHA-256 of a file's bytes, lowercase hex. */
+export function sha256File(path: string): string {
+  return createHash('sha256').update(readFileSync(path)).digest('hex');
+}
+
+/** Every regular file under `dir`, as package-relative POSIX paths, sorted. */
+export function listVendoredFiles(root: string, dirs: readonly string[] = ['api', 'schemas']): string[] {
+  const out: string[] = [];
+  const walk = (d: string): void => {
+    if (!existsSync(d)) return;
+    for (const name of readdirSync(d).sort()) {
+      const p = join(d, name);
+      if (statSync(p).isDirectory()) walk(p);
+      else out.push(relative(root, p).split(sep).join('/'));
+    }
+  };
+  for (const d of dirs) walk(join(root, d));
+  return out.filter((p) => p !== STAMP_RELATIVE_PATH.split(sep).join('/')).sort();
+}
+
+/** Build the `files` map for a package root (used by pack-vendor at prepack). */
+export function digestVendoredFiles(root: string): Record<string, string> {
+  const map: Record<string, string> = {};
+  for (const rel of listVendoredFiles(root)) map[rel] = sha256File(join(root, ...rel.split('/')));
+  return map;
+}
+
+/**
+ * Compare the stamp's `files` map against the bytes on disk. Pure: reads,
+ * never writes, never throws on a mismatch — the caller decides how loud.
+ */
+export function verifyCorpusStamp(root: string, layout: string): StampVerdict {
+  if (layout !== 'published') {
+    return { kind: 'not-applicable', reason: `layout is '${layout}' — the vendored copy exists only in the published package` };
+  }
+  const stampPath = join(root, STAMP_RELATIVE_PATH);
+  if (!existsSync(stampPath)) {
+    return { kind: 'not-applicable', reason: 'schemas/CORPUS-STAMP.json is absent — not a packed suite' };
+  }
+  let stamp: CorpusStamp;
+  try {
+    stamp = JSON.parse(readFileSync(stampPath, 'utf8')) as CorpusStamp;
+  } catch (e) {
+    return { kind: 'mismatch', missing: [STAMP_RELATIVE_PATH], altered: [], extra: [] };
+  }
+  if (stamp.files === undefined) {
+    return { kind: 'not-applicable', reason: `stamp ${stamp.suiteVersion ?? '?'} predates per-file digests (suite < 1.154.0); the vendored contract cannot be verified` };
+  }
+  const expected = stamp.files;
+  const onDisk = new Set(listVendoredFiles(root));
+  const missing: string[] = [];
+  const altered: string[] = [];
+  for (const [rel, digest] of Object.entries(expected).sort()) {
+    const p = join(root, ...rel.split('/'));
+    if (!existsSync(p)) {
+      missing.push(rel);
+      continue;
+    }
+    if (sha256File(p) !== digest) altered.push(rel);
+    onDisk.delete(rel);
+  }
+  const extra = [...onDisk].sort();
+  if (missing.length > 0 || altered.length > 0 || extra.length > 0) return { kind: 'mismatch', missing, altered, extra };
+  return { kind: 'verified', files: Object.keys(expected).length };
+}
+
+/** One-line, greppable rendering for the run log. */
+export function describeVerdict(v: StampVerdict): string {
+  switch (v.kind) {
+    case 'verified':
+      return `[openwop-conformance] corpus stamp VERIFIED — ${v.files} vendored api/ + schemas/ files match their SHA-256 digests`;
+    case 'not-applicable':
+      return `[openwop-conformance] corpus stamp not checked — ${v.reason}`;
+    case 'mismatch':
+      return (
+        `[openwop-conformance] corpus stamp MISMATCH — the vendored contract is not the one this suite shipped ` +
+        `(missing ${v.missing.length}, altered ${v.altered.length}, extra ${v.extra.length}): ` +
+        [...v.missing.map((f) => `missing ${f}`), ...v.altered.map((f) => `altered ${f}`), ...v.extra.map((f) => `extra ${f}`)].slice(0, 12).join('; ')
+      );
+  }
+}

package/src/scenarios/anonymous-actor-shape.test.ts

@@ -112,9 +112,13 @@ describe('anonymous-actor-shape: capability advertisement (RFC 0132 §B, server-
 describe('anonymous-actor-shape: owner.principalKind (RFC 0132 §A, server-free)', () => {
   it('run-snapshot owner accepts principalKind "anonymous" and rejects "guest"', () => {
     const snap = loadSchema('run-snapshot.schema.json');
-    const owner = (snap.properties as Record<string, unknown>).owner as Record<string, unknown>;
+    // RFC 0165 added an optional `subject` member ($ref subject.schema.json);
+    // register it and give the extracted sub-schema its parent's `$id` as the
+    // base the relative $ref resolves against.
+    const owner = { $id: snap.$id as string, ...((snap.properties as Record<string, unknown>).owner as Record<string, unknown>) };
     const ajv = new Ajv2020({ strict: false, allErrors: true });
     addFormats(ajv);
+    ajv.addSchema(loadSchema('subject.schema.json'));
     const validate = ajv.compile(owner);
     expect(
       validate({ tenant: 'acme', principal: 'anon:sess-3f9c', principalKind: 'anonymous' }),
@@ -136,6 +140,7 @@ describe('anonymous-actor-shape: audit reuses authorization.decided (RFC 0132 §
   const payloads = loadSchema('run-event-payloads.schema.json');
   const ajv = new Ajv2020({ strict: false, allErrors: true });
   addFormats(ajv);
+  ajv.addSchema(loadSchema('subject.schema.json'));
   ajv.addSchema(payloads, 'payloads');
   const decided = ajv.getSchema('payloads#/$defs/authorizationDecided');
 

package/src/scenarios/auth-subject-link.test.ts

@@ -24,7 +24,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
@@ -190,3 +190,22 @@ describe('auth-subject-link: link-key hygiene (RFC 0159 §A.2 — opt-in)', () =
     ).toBe(false);
   });
 });
+
+describe('auth-subject-link: legacy subjects are never linked (RFC 0165 §B.3 — seam-gated)', () => {
+  // Invariant `subject-legacy-not-linkable` (witness class: negative-existence,
+  // seam-gated). A run that predates `owner.subject` emission carries a synthesized
+  // `issuer: "urn:openwop:legacy"`; a SCIM deactivation MUST NOT deny it. The only
+  // causable observation is a host seam that mints a legacy-issuer subject and a
+  // linked SCIM record; no such seam is specified yet, so this leg records
+  // `blocked` honestly rather than a pass (RFC 0148 §A).
+  it('a SCIM deactivation does not deny a SAML login whose run subject is legacy-issued', async () => {
+    const res = await driver.get('/.well-known/openwop', { authenticated: false });
+    const auth = ((res.json as Record<string, unknown>)['auth'] ?? (res.json as { capabilities?: { auth?: unknown } }).capabilities?.auth) as { profiles?: string[] } | undefined;
+    const both = Array.isArray(auth?.profiles) && auth.profiles.includes('openwop-auth-saml') && auth.profiles.includes('openwop-auth-scim');
+    if (!both) {
+      return softSkip('inapplicable', 'host does not advertise both identity profiles (RFC 0164) — the legacy-link rule has no linked pair to protect');
+    }
+    return seamAbsent('no seam mints a legacy-issuer subject bound to a SCIM record (RFC 0165 §B.3); the negative cannot be caused from outside the host');
+  });
+});
+

package/src/scenarios/discovery.test.ts

@@ -10,6 +10,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 describe('discovery: /.well-known/openwop', () => {
   it('returns 200 with required Capabilities fields per capabilities.md §2', async () => {
@@ -42,6 +43,17 @@ describe('discovery: /.well-known/openwop', () => {
     )).toBeTruthy();
   });
 
+  it('IF a standard ETag is present, a matching If-None-Match yields 304 (RFC 0165 §C.2 — presence-gated)', async () => {
+    const first = await driver.get('/.well-known/openwop', { authenticated: false });
+    const etag = first.headers.get('etag');
+    if (etag === null) {
+      return softSkip('inapplicable', 'host does not send a standard ETag on the discovery document (RFC 0165 §C.2 — SHOULD, presence-gated)');
+    }
+    expect(etag.trim().length, driver.describe('RFC 0165 §C.2', 'ETag, when present, MUST be a non-empty validator')).toBeGreaterThan(0);
+    const second = await driver.get('/.well-known/openwop', { authenticated: false, headers: { 'If-None-Match': etag } });
+    expect(second.status, driver.describe('capabilities-change-detection.md §"Cache validators"', 'a matching If-None-Match SHOULD yield 304 Not Modified')).toBe(304);
+  });
+
   it('IF Capabilities-Etag is present, it is non-empty and stable within the cache window', async () => {
     const first = await driver.get('/.well-known/openwop', { authenticated: false });
     const firstEtag = first.headers.get('capabilities-etag');

package/src/scenarios/identity-owner-shape.test.ts

@@ -9,8 +9,9 @@
  *   - Positive: `{ tenant }` and `{ tenant, workspace, principal }` validate.
  *   - Negative: missing `tenant` (required), or an unknown property, is rejected.
  *
- * The owner subschema is self-contained (no external $ref), so it compiles
- * standalone via ajv.
+ * The owner subschema referenced only itself until RFC 0165 added an optional
+ * `subject` member ($ref subject.schema.json); that schema is registered on the
+ * ajv instance so the owner subschema still compiles standalone.
  *
  * @see RFCS/0048-tenant-workspace-principal-identity-model.md
  * @see schemas/run-snapshot.schema.json properties.owner
@@ -24,6 +25,7 @@ import { SCHEMAS_DIR } from '../lib/paths.js';
 
 interface SnapshotSchema {
   $schema: string;
+  $id: string;
   properties: { owner?: Record<string, unknown> };
 }
 
@@ -40,7 +42,9 @@ describe('category: identity owner-triple shape (RFC 0048 §C)', () => {
   });
 
   const ajv = new Ajv2020({ allErrors: true, strict: false });
-  const ownerSchema = { $schema: snapshot.$schema, ...(snapshot.properties.owner as Record<string, unknown>) };
+  ajv.addSchema(JSON.parse(readFileSync(join(SCHEMAS_DIR, 'subject.schema.json'), 'utf8')) as Record<string, unknown>);
+  // `$id` is the base the relative `subject.schema.json` $ref (RFC 0165) resolves against.
+  const ownerSchema = { $schema: snapshot.$schema, $id: snapshot.$id, ...(snapshot.properties.owner as Record<string, unknown>) };
   const validate = ajv.compile(ownerSchema);
 
   it('positive: tenant-only owner validates', () => {