@openwop/openwop-conformance 1.153.0 → 1.155.0

package/src/scenarios/owner-subject-echo.test.ts

@@ -0,0 +1,127 @@
+/**
+ * owner-subject-echo — RFC 0165 §B.2, §B.4 verification (host-facing, gated).
+ *
+ * A host that emits `owner.subject` on a new run MUST: keep it consistent with
+ * the owner triple (§B.2), echo it verbatim on `run.started` (§B.2; RFC 0048
+ * §C), and copy it verbatim onto a fork (§B.4 — `replay.md` §"Fork
+ * ownership"). This file drives the `conformance-noop` fixture, reads the
+ * snapshot, and gates every leg on the snapshot actually carrying a subject:
+ * a host that does not emit one is conformant in v1.x (`inapplicable`), and a
+ * host that emits one is held to the rules.
+ *
+ * @see RFCS/0165-v2-preparation-wire-shapes.md §B
+ * @see spec/v1/auth.md §"The Subject record"
+ * @see spec/v1/replay.md §"Fork ownership"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { softSkip } from '../lib/soft-skip.js';
+
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);
+
+interface Subject {
+  issuer: string;
+  subjectId: string;
+  tenant: string;
+  lane: string;
+  kind: string;
+  keyClass?: string;
+  actor?: Subject;
+}
+interface Owner {
+  tenant?: string;
+  workspace?: string;
+  principal?: string;
+  principalKind?: string;
+  subject?: Subject;
+}
+interface Snapshot {
+  runId?: string;
+  status?: string;
+  owner?: Owner;
+}
+interface RawEvent {
+  type?: string;
+  sequence?: number;
+  payload?: { owner?: Owner };
+}
+
+async function createRun(): Promise<string> {
+  const create = await driver.post('/v1/runs', { workflowId: NOOP_WORKFLOW_ID });
+  if (create.status !== 201) throw new Error(`Failed to start ${NOOP_WORKFLOW_ID}: ${create.status}`);
+  return (create.json as { runId: string }).runId;
+}
+
+async function snapshot(runId: string): Promise<Snapshot> {
+  const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
+  if (res.status !== 200) throw new Error(`GET /v1/runs/${runId}: ${res.status}`);
+  return res.json as Snapshot;
+}
+
+async function events(runId: string): Promise<readonly RawEvent[]> {
+  const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events/poll?lastSequence=0&timeout=1`);
+  if (res.status !== 200) throw new Error(`events for ${runId}: ${res.status}`);
+  return (res.json as { events?: RawEvent[] })?.events ?? [];
+}
+
+function actorDepth(s: Subject | undefined): number {
+  let d = 0;
+  for (let cur = s?.actor; cur !== undefined; cur = cur.actor) d++;
+  return d;
+}
+
+describe.skipIf(SKIP_NO_NOOP)('owner-subject-echo: consistency, echo, fork (RFC 0165 §B — gated on a host that emits owner.subject)', () => {
+  it('subject is consistent with the owner triple (§B.2) and the actor chain is bounded (§B.5)', async () => {
+    const runId = await createRun();
+    const snap = await snapshot(runId);
+    const subject = snap.owner?.subject;
+    if (subject === undefined) {
+      return softSkip('inapplicable', 'host does not emit owner.subject on new runs (RFC 0165 §B — optional in v1.x)');
+    }
+    expect(subject.tenant, driver.describe('RFC 0165 §B.2', 'subject.tenant MUST equal owner.tenant')).toBe(snap.owner?.tenant);
+    if (snap.owner?.principal !== undefined) {
+      expect(subject.subjectId, driver.describe('RFC 0165 §B.2', 'subject.subjectId MUST equal owner.principal when both are present')).toBe(snap.owner.principal);
+    }
+    if (snap.owner?.principalKind !== undefined) {
+      expect(subject.kind, driver.describe('RFC 0165 §B.2', 'subject.kind MUST equal owner.principalKind when both are present')).toBe(snap.owner.principalKind);
+    }
+    if (subject.lane === 'saml' || subject.lane === 'scim') {
+      expect(subject.keyClass, driver.describe('RFC 0165 §B.2', 'keyClass MUST be present on a linkable lane')).toBeDefined();
+    } else {
+      expect(subject.keyClass, driver.describe('RFC 0165 §B.2', 'keyClass MUST be absent off the linkable lanes')).toBeUndefined();
+    }
+    expect(actorDepth(subject), driver.describe('RFC 0165 §B.5', 'actor chain depth MUST NOT exceed 4')).toBeLessThanOrEqual(4);
+  });
+
+  it('run.started echoes the snapshot subject verbatim (§B.2, RFC 0048 §C)', async () => {
+    const runId = await createRun();
+    const snap = await snapshot(runId);
+    if (snap.owner?.subject === undefined) {
+      return softSkip('inapplicable', 'host does not emit owner.subject on new runs (RFC 0165 §B — optional in v1.x)');
+    }
+    const started = (await events(runId)).find((e) => e.type === 'run.started');
+    expect(started, driver.describe('RFC 0048 §C', 'run.started MUST be present in the event log')).toBeDefined();
+    expect(started?.payload?.owner?.subject, driver.describe('RFC 0165 §B.2', 'run.started owner.subject MUST equal RunSnapshot.owner.subject')).toEqual(snap.owner.subject);
+  });
+
+  it('a fork copies owner.tenant and owner.subject verbatim onto the child (§B.4)', async () => {
+    const sourceRunId = await createRun();
+    const source = await snapshot(sourceRunId);
+    if (source.owner?.subject === undefined) {
+      return softSkip('inapplicable', 'host does not emit owner.subject on new runs (RFC 0165 §B — optional in v1.x)');
+    }
+    const fork = await driver.post(`/v1/runs/${encodeURIComponent(sourceRunId)}:fork`, { fromSeq: 0, mode: 'replay' });
+    if (fork.status === 404 || fork.status === 501 || fork.status === 403) {
+      return softSkip('inapplicable', `host does not offer :fork on this run (${fork.status}); the fork-copy rule has no fork to check`);
+    }
+    expect(fork.status, driver.describe('replay.md §"Fork ownership"', ':fork MUST return 201 for a completed noop run')).toBe(201);
+    const childId = (fork.json as { runId?: string }).runId;
+    expect(typeof childId, 'fork response MUST include the child runId').toBe('string');
+    const child = await snapshot(childId as string);
+    expect(child.owner?.tenant, driver.describe('RFC 0165 §B.4', 'the child owner.tenant MUST equal the source')).toBe(source.owner.tenant);
+    expect(child.owner?.subject, driver.describe('RFC 0165 §B.4', 'the child owner.subject MUST be copied verbatim from the source')).toEqual(source.owner.subject);
+  });
+});

package/src/scenarios/owner-subject-shape.test.ts

@@ -0,0 +1,96 @@
+/**
+ * owner-subject-shape — RFC 0165 §B.1–§B.2 verification (server-free).
+ *
+ * `schemas/subject.schema.json` is the OPTIONAL issuer-scoped identity record
+ * carried as `owner.subject` on `RunSnapshot` and on the `run.started` owner
+ * echo. This file proves the SCHEMA half of §B: the record compiles standalone,
+ * both owner sub-objects reference it as a declared optional member (they are
+ * `additionalProperties: false`, so an undeclared `subject` would be rejected —
+ * the live `principalKind` divergence RFC 0165 §Alternatives 3 names), and the
+ * opacity + key-class conditionals hold. Behaviour (echo, fork copy, legacy
+ * synthesis) is `owner-subject-echo.test.ts`, gated on a host that emits it.
+ *
+ * SECURITY invariant `subject-record-opaque` (witness class: claims-check —
+ * the schema pattern is what forbids an email-shaped or whitespace subjectId;
+ * no probe can prove a host never mints PII, only that the wire refuses it).
+ *
+ * @see RFCS/0165-v2-preparation-wire-shapes.md §B
+ * @see schemas/subject.schema.json
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+
+const read = (f: string): Record<string, unknown> => JSON.parse(readFileSync(join(SCHEMAS_DIR, f), 'utf8')) as Record<string, unknown>;
+const subject = read('subject.schema.json');
+const snapshot = read('run-snapshot.schema.json') as { $schema: string; $id: string; properties: { owner: Record<string, unknown> } };
+const payloads = read('run-event-payloads.schema.json') as { $schema: string; $id: string; $defs: { runStarted: { properties: { owner: Record<string, unknown> } } } };
+
+function ajvWithSubject(): Ajv2020 {
+  const ajv = new Ajv2020({ allErrors: true, strict: false });
+  ajv.addSchema(subject);
+  return ajv;
+}
+
+const VALID = { issuer: 'https://idp.example.com/entity', subjectId: 'idp-op-8f3a', tenant: 'acme', lane: 'saml', kind: 'user', keyClass: 'opaque-idp' };
+
+describe('owner-subject-shape: subject.schema.json (RFC 0165 §B.1)', () => {
+  const validate = ajvWithSubject().compile(subject);
+
+  it('compiles and accepts a full SAML subject', () => {
+    expect(validate(VALID), JSON.stringify(validate.errors)).toBe(true);
+  });
+
+  it('accepts the legacy issuer form (RFC 0165 §B.3) and a workload subject', () => {
+    expect(validate({ issuer: 'urn:openwop:legacy', subjectId: 'user_42', tenant: 'acme', lane: 'api-key', kind: 'user' }), JSON.stringify(validate.errors)).toBe(true);
+    expect(validate({ issuer: 'spiffe://trust.example', subjectId: 'spiffe://trust.example/ns/a/sa/b', tenant: 'acme', lane: 'workload', kind: 'workload' }), JSON.stringify(validate.errors)).toBe(true);
+  });
+
+  it('rejects an email-shaped or whitespace subjectId (invariant subject-record-opaque)', () => {
+    expect(validate({ ...VALID, subjectId: 'alice@example.com' }), 'RFC 0165 §B.2: subjectId MUST NOT be an email address').toBe(false);
+    expect(validate({ ...VALID, subjectId: 'Alice Example' }), 'RFC 0165 §B.2: subjectId MUST NOT contain whitespace (a display name)').toBe(false);
+  });
+
+  it('requires keyClass on the saml/scim lanes and forbids it elsewhere', () => {
+    const { keyClass: _k, ...noKey } = VALID;
+    expect(validate(noKey), 'RFC 0165 §B.2: keyClass MUST be present when lane is saml or scim').toBe(false);
+    expect(validate({ ...VALID, lane: 'oidc' }), 'RFC 0165 §B.2: keyClass MUST be absent when the lane is not linkable').toBe(false);
+    expect(validate({ ...noKey, lane: 'oidc' }), JSON.stringify(validate.errors)).toBe(true);
+  });
+
+  it('rejects an unknown member and a missing required member', () => {
+    expect(validate({ ...VALID, email: 'x' })).toBe(false);
+    const { tenant: _t, ...noTenant } = VALID;
+    expect(validate(noTenant)).toBe(false);
+  });
+
+  it('accepts a nested actor chain (depth is a host obligation, RFC 0165 §B.5)', () => {
+    const peer = { issuer: 'https://peer.example', subjectId: 'peer-1', tenant: 'acme', lane: 'workload', kind: 'workload' };
+    const { keyClass: _k, ...anon } = { ...VALID, kind: 'anonymous', lane: 'api-key', actor: peer };
+    expect(validate(anon), JSON.stringify(validate.errors)).toBe(true);
+  });
+});
+
+describe('owner-subject-shape: both owner sub-objects declare `subject` (RFC 0165 §B.1)', () => {
+  // The extracted sub-schema needs its parent's `$id` as the base for the relative `subject.schema.json` $ref.
+  const ownerSnap = { $schema: snapshot.$schema, $id: snapshot.$id, ...snapshot.properties.owner };
+  const ownerEcho = { $schema: payloads.$schema, $id: payloads.$id, ...payloads.$defs.runStarted.properties.owner };
+
+  it('RunSnapshot.owner accepts a subject and still rejects an undeclared member', () => {
+    const v = ajvWithSubject().compile(ownerSnap);
+    expect(v({ tenant: 'acme', principal: 'idp-op-8f3a', principalKind: 'user', subject: VALID }), JSON.stringify(v.errors)).toBe(true);
+    expect(v({ tenant: 'acme', role: 'admin' })).toBe(false);
+  });
+
+  it('run.started owner echo accepts the same subject AND principalKind (the echo matches the snapshot)', () => {
+    const v = ajvWithSubject().compile(ownerEcho);
+    expect(
+      v({ tenant: 'acme', principal: 'idp-op-8f3a', principalKind: 'user', subject: VALID }),
+      'RFC 0165 §B.1: run.started owner MUST declare subject and principalKind so a host can echo its snapshot owner verbatim',
+    ).toBe(true);
+    expect(v({ tenant: 'acme', subject: { ...VALID, subjectId: 'a@b' } })).toBe(false);
+  });
+});

package/src/scenarios/protocol-versions-array.test.ts

@@ -0,0 +1,103 @@
+/**
+ * protocol-versions-array — RFC 0165 §A verification.
+ *
+ * `protocolVersions: string[]` is the OPTIONAL root advertisement of every
+ * `<major>.<minor>` a host serves, reserved for v2 major negotiation
+ * (`version-negotiation.md` §"`protocolVersions[]`"). Three things are
+ * checkable today:
+ *
+ *   1. Server-free: the schema declares the array with the SAME strict grammar
+ *      as the scalar (RFC 0149 §C), not the looser A2A item pattern — one axis,
+ *      one grammar; and the Levenshtein-1 neighbour of `protocolVersion` is a
+ *      real property, so the root-layout typo lint cannot mistake it.
+ *   2. Host, presence-gated: when advertised, every item matches, items are
+ *      unique, and the array contains `protocolVersion`'s value.
+ *   3. Host, presence-gated: profile derivation is unchanged by the array —
+ *      `isCore` reads the scalar only (RFC 0165 §A.2, §Alternatives 6).
+ *
+ * A host that omits the array is conformant (`inapplicable`, not a pass).
+ *
+ * @see RFCS/0165-v2-preparation-wire-shapes.md §A
+ * @see spec/v1/version-negotiation.md §"Protocol version grammar"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import { driver } from '../lib/driver.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { isCore, type DiscoveryPayload } from '../lib/profiles.js';
+import { softSkip } from '../lib/soft-skip.js';
+
+interface CapsSchema {
+  $schema: string;
+  properties: {
+    protocolVersion?: { pattern?: string };
+    protocolVersions?: { type?: string; minItems?: number; uniqueItems?: boolean; items?: { pattern?: string } };
+  };
+}
+
+const caps = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'capabilities.schema.json'), 'utf8')) as CapsSchema;
+
+describe('protocol-versions-array: schema shape (RFC 0165 §A.1, server-free)', () => {
+  it('declares root `protocolVersions` as a unique, non-empty string array', () => {
+    const p = caps.properties.protocolVersions;
+    expect(p, 'RFC 0165 §A.1: capabilities.schema.json MUST declare root `protocolVersions`').toBeDefined();
+    expect(p?.type).toBe('array');
+    expect(p?.minItems).toBe(1);
+    expect(p?.uniqueItems).toBe(true);
+  });
+
+  it('item grammar equals the scalar grammar (one axis, one grammar)', () => {
+    expect(
+      caps.properties.protocolVersions?.items?.pattern,
+      'RFC 0165 §A.1: protocolVersions items MUST use the RFC 0149 §C grammar, not the A2A item pattern',
+    ).toBe(caps.properties.protocolVersion?.pattern);
+  });
+
+  it('accepts ["1.11", "2.0"], rejects "01.0", "1.0.0", duplicates, and empty', () => {
+    const ajv = new Ajv2020({ allErrors: true, strict: false });
+    const validate = ajv.compile({ $schema: caps.$schema, ...(caps.properties.protocolVersions as Record<string, unknown>) });
+    expect(validate(['1.11', '2.0'])).toBe(true);
+    expect(validate(['01.0'])).toBe(false);
+    expect(validate(['1.0.0'])).toBe(false);
+    expect(validate(['1.0', '1.0'])).toBe(false);
+    expect(validate([])).toBe(false);
+  });
+});
+
+describe('protocol-versions-array: advertisement (RFC 0165 §A.2 — presence-gated)', () => {
+  const GRAMMAR = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+
+  it('when advertised, every item matches the grammar, items are unique, and the array contains protocolVersion', async () => {
+    const res = await driver.get('/.well-known/openwop', { authenticated: false });
+    const doc = res.json as Record<string, unknown>;
+    const arr = doc['protocolVersions'];
+    if (arr === undefined) {
+      return softSkip('inapplicable', 'host does not advertise protocolVersions (RFC 0165 §A — optional in v1.x)');
+    }
+    expect(Array.isArray(arr), driver.describe('RFC 0165 §A.1', 'protocolVersions MUST be an array')).toBe(true);
+    const items = arr as unknown[];
+    expect(items.length, driver.describe('RFC 0165 §A.1', 'protocolVersions MUST be non-empty')).toBeGreaterThan(0);
+    for (const v of items) {
+      expect(typeof v === 'string' && GRAMMAR.test(v), driver.describe('RFC 0165 §A.1', `protocolVersions item ${JSON.stringify(v)} MUST match the RFC 0149 §C grammar`)).toBe(true);
+    }
+    expect(new Set(items).size, driver.describe('RFC 0165 §A.1', 'protocolVersions items MUST be unique')).toBe(items.length);
+    expect(items, driver.describe('RFC 0165 §A.2', 'protocolVersions MUST contain the value of protocolVersion')).toContain(doc['protocolVersion']);
+  });
+
+  it('profile derivation is unchanged by the array (isCore reads the scalar only)', async () => {
+    const res = await driver.get('/.well-known/openwop', { authenticated: false });
+    const doc = res.json as DiscoveryPayload & Record<string, unknown>;
+    if (doc['protocolVersions'] === undefined) {
+      return softSkip('inapplicable', 'host does not advertise protocolVersions (RFC 0165 §A — optional in v1.x)');
+    }
+    const without = { ...doc } as Record<string, unknown>;
+    delete without['protocolVersions'];
+    expect(
+      isCore(doc),
+      driver.describe('RFC 0165 §A.2', 'openwop-discovery-core derivation MUST NOT depend on protocolVersions in v1.x'),
+    ).toBe(isCore(without as DiscoveryPayload));
+  });
+});

package/src/scenarios/webhook-signed-delivery.test.ts

@@ -323,6 +323,28 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
       driver.describe('webhooks.md §"Delivery headers"', 'X-openwop-Signature MUST be sha256=HMAC-SHA256(secret, `${X-openwop-Timestamp}.${rawBody}`)'),
     ).toBe(expected);
 
+    // RFC 0165 §C.1 — dual emission of the `OpenWOP-*` family. SHOULD-level and
+    // presence-gated: when the new family is present, every value MUST equal its
+    // `X-openwop-*` counterpart and the signature verifies reading either.
+    const dual = first.headers['openwop-signature'];
+    if (dual === undefined) {
+      softSkip('inapplicable', 'host does not yet dual-emit the OpenWOP-* webhook header family (RFC 0165 §C.1 — SHOULD)');
+    } else {
+      for (const [neu, old] of [
+        ['openwop-webhook-id', 'x-openwop-webhook-id'],
+        ['openwop-event-type', 'x-openwop-event-type'],
+        ['openwop-timestamp', 'x-openwop-timestamp'],
+        ['openwop-signature', 'x-openwop-signature'],
+        ['openwop-signature-algorithm', 'x-openwop-signature-algorithm'],
+      ] as const) {
+        expect(first.headers[neu], driver.describe('RFC 0165 §C.1', `${neu} MUST equal ${old} when the OpenWOP-* family is emitted`)).toBe(first.headers[old]);
+      }
+      expect(
+        String(dual).replace('sha256=', ''),
+        driver.describe('RFC 0165 §C.1', 'OpenWOP-Signature MUST verify over the same bytes as X-openwop-Signature'),
+      ).toBe(expected);
+    }
+
     // Body should parse as JSON with a run event shape.
     const event = JSON.parse(first.body) as { type?: unknown; runId?: unknown };
     expect(typeof event.type).toBe('string');

package/src/lib/capabilities-auth-subject-link.test.ts

@@ -1,103 +0,0 @@
-/**
- * Server-free pin of the RFC 0163 §C schema conditional in
- * `schemas/capabilities.schema.json`:
- *
- *   auth.subjectLinking: true  ⇒  auth.subjectLinkKey required            (RFC 0163)
- *   auth.subjectLinkKey        ∈  { opaque-idp, configured-immutable }   (RFC 0163)
- *   profiles ⊇ {saml, scim}    ⇒  subjectLinking const true + key required (RFC 0164)
- *
- * This checks the SCHEMA ARTIFACT, not any host, which is why it lives under
- * `src/lib/` (no scenario ledger row — see `saml-idp.test.ts` for the G8
- * reasoning). The host-facing assertion is the advertisement leg of
- * `scenarios/auth-subject-link-key-class.test.ts`, gated on the flag.
- *
- * @see RFCS/0163-subject-linking-hardening.md §C
- * @see spec/v1/auth-profiles.md §"Subject linking (SAML ⟷ SCIM)"
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
-import Ajv2020 from 'ajv/dist/2020.js';
-import addFormats from 'ajv-formats';
-import { SCHEMAS_DIR } from './paths.js';
-
-function compileCapabilities() {
-  const ajv = new Ajv2020({ allErrors: true, strict: false });
-  addFormats(ajv);
-  for (const file of readdirSync(SCHEMAS_DIR).filter((f) => f.endsWith('.schema.json'))) {
-    const s = JSON.parse(readFileSync(join(SCHEMAS_DIR, file), 'utf8')) as { $id?: string };
-    ajv.addSchema(s, file);
-    ajv.addSchema(s, `./${file}`);
-  }
-  // Validate the `auth` block in isolation: the conditional lives on that
-  // object, and a full discovery document would drag in every root-level
-  // required family (supportedEnvelopes, schemaVersions, limits, …) that has
-  // nothing to do with what this file pins.
-  return ajv.compile({ $ref: 'capabilities.schema.json#/properties/auth' });
-}
-
-const PROFILES = ['openwop-auth-saml', 'openwop-auth-scim'];
-function doc(auth: Record<string, unknown>) {
-  return auth;
-}
-
-describe('capabilities.schema.json: auth.subjectLinkKey conditional (RFC 0163 §C)', () => {
-  const validate = compileCapabilities();
-
-  it('subjectLinking:true WITHOUT subjectLinkKey fails validation (§A.1 co-requirement is in the schema, not only prose)', () => {
-    const ok = validate(doc({ profiles: PROFILES, subjectLinking: true }));
-    expect(ok, JSON.stringify(validate.errors)).toBe(false);
-    expect(JSON.stringify(validate.errors)).toContain('subjectLinkKey');
-  });
-
-  it('subjectLinking:true with a class member validates', () => {
-    for (const k of ['opaque-idp', 'configured-immutable']) {
-      const ok = validate(doc({ profiles: PROFILES, subjectLinking: true, subjectLinkKey: k }));
-      expect(ok, `${k}: ${JSON.stringify(validate.errors)}`).toBe(true);
-    }
-  });
-
-  it('a mutable/PII key is INEXPRESSIBLE: "email" fails the enum', () => {
-    const ok = validate(doc({ profiles: PROFILES, subjectLinking: true, subjectLinkKey: 'email' }));
-    expect(ok).toBe(false);
-  });
-
-  it('the retired Draft-era attribute names are not members (the enum names classes)', () => {
-    for (const k of ['oid', 'immutable-id']) {
-      expect(validate(doc({ profiles: PROFILES, subjectLinking: true, subjectLinkKey: k })), k).toBe(false);
-    }
-  });
-
-  it('one profile alone does not require the flag or a key (SAML-only / SCIM-only hosts are unaffected)', () => {
-    expect(validate(doc({ profiles: ['openwop-auth-saml'] }))).toBe(true);
-    expect(validate(doc({ profiles: ['openwop-auth-scim'], subjectLinking: false }))).toBe(true);
-  });
-});
-
-describe('capabilities.schema.json: the profile pair implies the contract (RFC 0164 §B)', () => {
-  const validate = compileCapabilities();
-
-  it('BOTH profiles with subjectLinking absent fails validation (the vulnerable pre-0164 shape)', () => {
-    const ok = validate(doc({ profiles: PROFILES }));
-    expect(ok, JSON.stringify(validate.errors)).toBe(false);
-    expect(JSON.stringify(validate.errors)).toContain('subjectLinking');
-  });
-
-  it('BOTH profiles with subjectLinking:false fails validation (the flag is derived, not a choice)', () => {
-    expect(validate(doc({ profiles: PROFILES, subjectLinking: false, subjectLinkKey: 'opaque-idp' }))).toBe(false);
-  });
-
-  it('BOTH profiles with subjectLinking:true but no subjectLinkKey fails validation', () => {
-    expect(validate(doc({ profiles: PROFILES, subjectLinking: true }))).toBe(false);
-  });
-
-  it('BOTH profiles with subjectLinking:true + a class member validates (the derived advertisement)', () => {
-    expect(validate(doc({ profiles: PROFILES, subjectLinking: true, subjectLinkKey: 'opaque-idp' }))).toBe(true);
-  });
-
-  it('profile order does not matter', () => {
-    expect(validate(doc({ profiles: ['openwop-auth-scim', 'openwop-auth-api-key-rotation', 'openwop-auth-saml'], subjectLinking: true, subjectLinkKey: 'configured-immutable' }))).toBe(true);
-    expect(validate(doc({ profiles: ['openwop-auth-scim', 'openwop-auth-api-key-rotation', 'openwop-auth-saml'] }))).toBe(false);
-  });
-});

package/src/lib/fork-availability.test.ts

@@ -1,69 +0,0 @@
-/**
- * Pins `forkDeclined` (RFC 0148 §A).
- *
- * The risk in a helper like this is not that it misses a status — that shows up
- * as a red test somebody investigates. It is that it swallows one: every status
- * it accepts turns an assertion into a skip, silently, and a suite that skips
- * is indistinguishable from a suite that passes unless something records why.
- * So the load-bearing cases here are the NEGATIVE ones.
- */
-
-import { describe, expect, it, beforeEach } from 'vitest';
-import { forkDeclined } from './fork-availability.js';
-import { resetSoftSkips, softSkipDisposition } from './soft-skip.js';
-
-describe('forkDeclined', () => {
-  beforeEach(() => resetSoftSkips());
-
-  it('treats 404 and 403 the same as 501 — route absent is not weaker than route-declines', () => {
-    // The asymmetry this fixes: every replay scenario handled 501 and none
-    // handled 404. `501` means "I know this route and decline"; `404` means
-    // "there is no such route" — strictly less implemented. The suite treated
-    // the weaker signal as a skip and the stronger one as a defect, so a host
-    // had to implement the route in order to say it had not implemented it.
-    for (const status of [404, 403, 501]) {
-      expect(forkDeclined(status, 'leg'), `status ${status} means the fork did not happen`).toBe(true);
-    }
-  });
-
-  it('does NOT swallow any other status — a 500 is still a defect, not a skip', () => {
-    // If this ever goes green for one of these, a real failure has become a
-    // silent skip and no assertion downstream will ever run again.
-    for (const status of [200, 201, 202, 400, 409, 422, 500, 502, 503]) {
-      expect(forkDeclined(status, 'leg'), `status ${status} must reach the assertion`).toBe(false);
-    }
-  });
-
-  it('records WHY, so the ledger row is not an unclassified return', () => {
-    // Two of the eleven original call sites were a bare `return`. A bare return
-    // in a file whose OTHER tests assert is invisible: the file records
-    // `executed-pass` and the leg that never ran leaves no trace.
-    forkDeclined(404, 'fanout-suppression replay fork');
-    const noted = softSkipDisposition('fork-availability.test.ts');
-    expect(noted?.kind).toBe('blocked');
-    expect(noted?.reason).toContain('404');
-    expect(noted?.reason).toContain('fanout-suppression replay fork');
-    expect(noted?.reason).toContain('not mounted');
-  });
-
-  it('records nothing when the status is not a decline', () => {
-    forkDeclined(201, 'leg');
-    expect(softSkipDisposition('fork-availability.test.ts')).toBeNull();
-  });
-
-  it('names the leg, so one file with several forks stays attributable', () => {
-    forkDeclined(501, 'branch fork');
-    expect(softSkipDisposition('fork-availability.test.ts')?.reason).toContain('branch fork');
-  });
-
-  it('distinguishes the three declines in its reason text', () => {
-    forkDeclined(404, 'a');
-    const a = softSkipDisposition('fork-availability.test.ts')?.reason ?? '';
-    resetSoftSkips();
-    forkDeclined(501, 'a');
-    const b = softSkipDisposition('fork-availability.test.ts')?.reason ?? '';
-    // `blocked` alone does not tell a bundle reader whether the host lacks the
-    // route or declines the range; the reason must.
-    expect(a).not.toBe(b);
-  });
-});

package/src/lib/global-setup.test.ts

@@ -1,76 +0,0 @@
-/**
- * Pins the run-end disposition summary (`src/global-setup.ts`, RFC 0148 §A).
- *
- * The defect this guards is not "the summary is ugly" — it is that the suite
- * computed an honest disposition on every run and PUBLISHED it on one. Two
- * host implementers read vitest's `1 passed` as coverage for a requirement the
- * suite had internally classified `blocked`, because the classification had no
- * reader outside `--certify`.
- *
- * Server-free and pure: `summarise` takes the raw JSONL and returns the text.
- */
-
-import { describe, expect, it } from 'vitest';
-import { summarise } from '../global-setup.js';
-
-const line = (o: Record<string, unknown>): string => JSON.stringify(o);
-
-describe('global-setup: RFC 0148 §A disposition summary', () => {
-  it('reads the ledger key the ledger actually writes (`requirementId`, not `id`)', () => {
-    // Regression: the first draft of this reader keyed on `entry.id`, a field
-    // `recordRequirement` has never written, and fell back to `(unnamed)`.
-    // The fallback made a WRONG READER look like MISSING DATA — the same
-    // failure shape the summary exists to expose, reproduced in the exposer.
-    const out = summarise(
-      line({ requirementId: 'openwop.scenario.webhook-signed-delivery', disposition: 'blocked', detail: 'guard rejected loopback' }),
-    );
-    expect(out).toContain('openwop.scenario.webhook-signed-delivery');
-    expect(out).not.toContain('(unnamed)');
-  });
-
-  it('lists blocked / skipped / inapplicable as NOT witnessed, with the reason', () => {
-    const out = summarise(
-      [
-        line({ requirementId: 'a', disposition: 'blocked', detail: 'seam absent' }),
-        line({ requirementId: 'b', disposition: 'skipped', detail: 'operator opted out' }),
-        line({ requirementId: 'c', disposition: 'inapplicable', detail: 'profile not advertised' }),
-      ].join('\n'),
-    );
-    expect(out).toContain('did NOT witness');
-    for (const s of ['seam absent', 'operator opted out', 'profile not advertised']) {
-      expect(out).toContain(s);
-    }
-  });
-
-  it('flags an executed-pass that asserted nothing — the other RFC 0148 §A vacuity shape', () => {
-    const out = summarise(line({ requirementId: 'vacuous', disposition: 'executed-pass', assertionCount: 0 }));
-    expect(out).toContain('executed-pass (0 assertions)');
-    expect(out).toContain('vacuous');
-  });
-
-  it('does NOT flag a real executed-pass', () => {
-    const out = summarise(line({ requirementId: 'real', disposition: 'executed-pass', assertionCount: 12 }));
-    expect(out).toContain('executed-pass 1');
-    expect(out).not.toContain('did NOT witness');
-  });
-
-  it('announces truncation rather than capping silently', () => {
-    // A capped list that does not say it was capped reads as a complete one.
-    const many = Array.from({ length: 45 }, (_, i) =>
-      line({ requirementId: `r${i}`, disposition: 'blocked', detail: 'why' }),
-    ).join('\n');
-    const out = summarise(many);
-    expect(out).toContain('5 more not listed');
-  });
-
-  it('returns null on an empty ledger so teardown prints nothing', () => {
-    expect(summarise('')).toBeNull();
-    expect(summarise('\n\n')).toBeNull();
-  });
-
-  it('skips unparseable lines without discarding the rest of the run', () => {
-    const out = summarise(['{ not json', line({ requirementId: 'ok', disposition: 'blocked', detail: 'r' })].join('\n'));
-    expect(out).toContain('ok');
-    expect(out).toContain('blocked 1');
-  });
-});