@openwop/openwop-conformance 1.154.0 → 1.155.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [1.155.0] — 2026-09-02 — RFC 0165 `Draft → Active`: `protocolVersions[]`, the Subject record, header dual emission
+
+Three new scenario files (468 → 471) and four added legs, all additive:
+
+- `protocol-versions-array.test.ts` — server-free: the schema declares root `protocolVersions` with the scalar's strict grammar; presence-gated: items match, are unique, contain `protocolVersion`, and profile derivation is unchanged by the array.
+- `owner-subject-shape.test.ts` — server-free: `subject.schema.json` compiles; legacy and workload forms accepted; email/whitespace `subjectId` rejected (invariant `subject-record-opaque`); `keyClass` iff saml/scim; both `owner` sub-objects declare `subject` and the `run.started` echo declares `principalKind`.
+- `owner-subject-echo.test.ts` — gated on a snapshot carrying `owner.subject`: consistency with the owner triple, actor depth ≤ 4, `run.started` echo, fork copies tenant + subject verbatim.
+- Legs: `discovery.test.ts` (standard `ETag` + `If-None-Match` → 304, presence-gated); `webhook-signed-delivery.test.ts` (the `OpenWOP-*` family equals `X-openwop-*` and verifies, presence-gated); `auth-subject-link.test.ts` (legacy subjects never linked — seam-gated, records `blocked`); `identity-owner-shape.test.ts` registers `subject.schema.json`.
+
 ## [1.154.0] — 2026-09-02 — the tarball carries the suite and nothing else; the vendored contract is digest-checked (v2 charter Phase 1)
 
 No new scenario file. Three packed changes:

package/README.md

@@ -103,7 +103,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 468 scenario files under `src/scenarios/`.
+The current suite has 471 scenario files under `src/scenarios/`.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
 - 2026-08-18 (suite `1.136.7 → 1.136.8`, SP-04): NEW `spec-section-citations.test.ts` — server-free; a `<doc>.md §"<Section>"` citation of a checked doc MUST resolve to a heading that exists. `storage-adapters.md §"Claim acquisition"` was cited by four artifacts, including a normative MUST in `production-profile.md` §Durability, and the section did not exist for the life of RFC 0009. Scoped to the docs whose section citations carry the durability contract; a corpus-wide sweep finds ~260 unresolved citations that need triage before they can gate.
@@ -447,7 +447,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 468 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 471 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/api/openapi.yaml

@@ -109,6 +109,14 @@ paths:
       summary: Capability declaration handshake.
       operationId: getCapabilities
       security: []
+      parameters:
+        - name: If-None-Match
+          in: header
+          required: false
+          schema: { type: string }
+          description: >-
+            RFC 0165 §C.2. Standard conditional request against the discovery document's `ETag`;
+            a matching value SHOULD yield `304 Not Modified`.
       responses:
         '200':
           description: Capabilities object — see `capabilities.md`.
@@ -116,13 +124,21 @@ paths:
             Cache-Control:
               schema: { type: string }
               example: 'public, max-age=300'
+            ETag:
+              schema: { type: string }
+              description: >-
+                RFC 0165 §C.2. Standard strong validator for the response bytes (SHOULD be sent).
+                Distinct from `Capabilities-Etag`, which validates negotiation safety
+                (`capabilities-change-detection.md` §"Cache validators").
             Capabilities-Etag:
               schema: { type: string }
-              description: Optional probe handle for mid-session capability change detection.
+              description: Optional probe handle for mid-session capability change detection. Deprecated toward v2 (RFC 0165 §C.2).
           content:
             application/json:
               schema:
                 $ref: '#/components/schemas/Capabilities'
+        '304':
+          description: RFC 0165 §C.2 — `If-None-Match` matched the current `ETag`; the body is unchanged.
         '503':
           description: Server unable to compute capabilities (transient).
           content:

package/coverage.md

@@ -112,6 +112,9 @@ The scenario groups in the table below (one row per group; count the rows — th
 | `oauth-authorization-code-roundtrip.test.ts`                                                                                                                                                                                                            | `capabilities.oauth` (RFC 0047 §C) + `SECURITY/invariants.yaml` `credential-payload-redaction`                                                                                                                                                                                                                          | A (capability-gated on `oauth.supported` + `grants` ∋ `authorization_code`; behavioral roundtrip via optional `POST /v1/host/sample/oauth/authorize-code-roundtrip` seam against the one canonical synthetic provider in `fixtures/oauth-providers/synthetic.json` — returns a credential REFERENCE; the authorization code / state / PKCE verifier / acquired access+refresh tokens are absent from every observable surface; `connector.authorized` carries the ref not the token)                                                                                                                                                                                                                | `host-pending`                                                                                                                   | Capability+grant-gated; behavioral probe soft-skips on 404. Closes the RFC 0047 Tier-2 gap — exercises the actual authorization-code dance (shape + redaction scenarios existed; the grant itself was unexercised).                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `connector-manifest-validity.test.ts`                                                                                                                                                                                                                   | `node-pack-manifest.schema.json` §Connector (RFC 0045, `node-packs.md` §Connectors)                                                                                                                                                                                                                                     | Server-free (schema validity of the `connector` block incl. both ConnectorAuth variants + positive/negative round-trip; §B action/trigger typeId-resolution semantics — `connector_action_unresolved` on an unknown typeId)                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | host-pass (server-free)                                                                                                          | Always runs; no host needed. Behavioral idempotency-hint + rate-limit-honored scenarios deferred until a host advertises a connector.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `identity-owner-shape.test.ts`                                                                                                                                                                                                                          | `run-snapshot.schema.json` properties.owner (RFC 0048 §C, `auth.md` §Identity claims)                                                                                                                                                                                                                                   | Server-free (owner triple schema validity: positive `{tenant}` + full triple; negative missing-tenant + unknown-prop)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | host-pass (server-free)                                                                                                          | Always runs; no host needed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `protocol-versions-array.test.ts` | RFC 0165 §A (`version-negotiation.md` §"`protocolVersions[]`") | A (server-free: schema declares the array with the scalar's grammar) + B (presence-gated: items match, unique, contain `protocolVersion`; profile derivation unchanged) | host-pending (presence-gated) | A host that omits the array records `inapplicable`. |
+| `owner-subject-shape.test.ts` | RFC 0165 §B.1–§B.2 (`schemas/subject.schema.json`; both `owner` sub-objects) | Server-free: subject compiles; legacy + workload forms accepted; email/whitespace `subjectId` rejected (invariant `subject-record-opaque`); keyClass iff saml/scim; both owner sub-objects declare `subject` and the echo declares `principalKind` | host-pass (server-free) | Always runs; no host needed. |
+| `owner-subject-echo.test.ts` | RFC 0165 §B.2, §B.4, §B.5 (`auth.md` §"The Subject record", `replay.md` §"Fork ownership") | B (gated on a snapshot carrying `owner.subject`): tenant/subjectId/kind/keyClass consistency, actor depth ≤ 4, `run.started` echo equals the snapshot, fork copies tenant + subject verbatim | host-pending (gated) | A host that does not emit `owner.subject` records `inapplicable`. |
 | `cross-workspace-isolation.test.ts`                                                                                                                                                                                                                     | RFC 0048 §C/§D (`auth.md` §Identity claims, `rest-endpoints.md` `run_forbidden`)                                                                                                                                                                                                                                        | A (owner-echo shape if a sample run is readable; §D isolation MUST-NOT via optional `POST /v1/host/sample/identity/cross-workspace-read` seam — cross-workspace read fails closed with `run_forbidden`/`not_found`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `host-pending`                                                                                                                   | Behavioral probe soft-skips on 404; no host advertises run ownership yet (RFC 0048 `Draft`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | `authorization-roles-shape.test.ts`                                                                                                                                                                                                                     | `capabilities.authorization` (RFC 0049 §A, `auth.md` §"Role-based authorization")                                                                                                                                                                                                                                       | A (advertisement shape always — `supported` boolean; `failClosed` const true; every `roles[].role` non-empty + `scopes` array)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `host-pending`                                                                                                                   | Always runs; asserts the block is absent or well-formed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `authorization-fail-closed.test.ts`                                                                                                                                                                                                                     | `capabilities.authorization` (RFC 0049 §C) + `SECURITY/invariants.yaml` `authorization-fail-closed`                                                                                                                                                                                                                     | A (advertisement `failClosed===true` always; fail-closed MUST-NOT via optional `POST /v1/host/sample/authorization/decide` seam — an unseeded-role principal resolves `allowed:false`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `host-pending`                                                                                                                   | Capability-gated on `authorization.supported`; behavioral probe soft-skips on 404. Scope-match + denial-audited scenarios deferred to a host.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.154.0",
+  "version": "1.155.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/requirements.json

@@ -2,9 +2,9 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 468,
-    "tests": 1950,
-    "withStableId": 1927,
+    "files": 471,
+    "tests": 1968,
+    "withStableId": 1945,
     "interpolatedTitles": 23,
     "explicitIds": 0
   },
@@ -3479,7 +3479,7 @@
     {
       "id": "openwop.it.anonymous-actor-shape.a-content-free-anon-grant-deny-record-validates-against-the-existing-def",
       "file": "anonymous-actor-shape.test.ts",
-      "line": 142,
+      "line": 147,
       "title": "a content-free anon grant + deny record validates against the existing $def",
       "explicitId": null,
       "citations": []
@@ -3487,7 +3487,7 @@
     {
       "id": "openwop.it.anonymous-actor-shape.authorization-decided-is-in-the-runeventtype-enum-the-reused-audit-event",
       "file": "anonymous-actor-shape.test.ts",
-      "line": 168,
+      "line": 173,
       "title": "authorization.decided is in the RunEventType enum (the reused audit event)",
       "explicitId": null,
       "citations": []
@@ -4531,6 +4531,14 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.auth-subject-link.a-scim-deactivation-does-not-deny-a-saml-login-whose-run-subject-is-legacy-issue",
+      "file": "auth-subject-link.test.ts",
+      "line": 201,
+      "title": "a SCIM deactivation does not deny a SAML login whose run subject is legacy-issued",
+      "explicitId": null,
+      "citations": []
+    },
     {
       "id": "openwop.it.auth.returns-401-with-canonical-error-envelope-per-auth-md-3",
       "file": "auth.test.ts",
@@ -7998,7 +8006,7 @@
     {
       "id": "openwop.it.discovery.returns-200-with-required-capabilities-fields-per-capabilities-md-2",
       "file": "discovery.test.ts",
-      "line": 15,
+      "line": 16,
       "title": "returns 200 with required Capabilities fields per capabilities.md §2",
       "explicitId": null,
       "citations": [
@@ -8020,7 +8028,7 @@
     {
       "id": "openwop.it.discovery.serves-cache-control-per-capabilities-md-4-caching-guidance",
       "file": "discovery.test.ts",
-      "line": 35,
+      "line": 36,
       "title": "serves Cache-Control per capabilities.md §4 (caching guidance)",
       "explicitId": null,
       "citations": [
@@ -8030,10 +8038,27 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.discovery.if-a-standard-etag-is-present-a-matching-if-none-match-yields-304-rfc-0165-c-2-p",
+      "file": "discovery.test.ts",
+      "line": 46,
+      "title": "IF a standard ETag is present, a matching If-None-Match yields 304 (RFC 0165 §C.2 — presence-gated)",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "RFC 0165 §C.2",
+          "requirement": "ETag, when present, MUST be a non-empty validator"
+        },
+        {
+          "section": "capabilities-change-detection.md §\"Cache validators\"",
+          "requirement": "a matching If-None-Match SHOULD yield 304 Not Modified"
+        }
+      ]
+    },
     {
       "id": "openwop.it.discovery.if-capabilities-etag-is-present-it-is-non-empty-and-stable-within-the-cache-wind",
       "file": "discovery.test.ts",
-      "line": 45,
+      "line": 57,
       "title": "IF Capabilities-Etag is present, it is non-empty and stable within the cache window",
       "explicitId": null,
       "citations": [
@@ -8054,7 +8079,7 @@
     {
       "id": "openwop.it.discovery.declares-non-zero-limits-per-capabilities-md-3-capabilitylimiter-shape",
       "file": "discovery.test.ts",
-      "line": 71,
+      "line": 83,
       "title": "declares non-zero limits per capabilities.md §3 (CapabilityLimiter shape)",
       "explicitId": null,
       "citations": [
@@ -8077,7 +8102,7 @@
     {
       "id": "openwop.it.discovery.if-fixtures-is-present-it-must-be-a-string-of-unique-non-empty-entries",
       "file": "discovery.test.ts",
-      "line": 95,
+      "line": 107,
       "title": "IF fixtures is present, it MUST be a string[] of unique non-empty entries",
       "explicitId": null,
       "citations": [
@@ -8102,7 +8127,7 @@
     {
       "id": "openwop.it.discovery.returns-200-with-a-parseable-openapi-3-1-document",
       "file": "discovery.test.ts",
-      "line": 135,
+      "line": 147,
       "title": "returns 200 with a parseable OpenAPI 3.1 document",
       "explicitId": null,
       "citations": [
@@ -8119,7 +8144,7 @@
     {
       "id": "openwop.it.discovery.host-claiming-auth-scoped-discovery-advertises-required-fields",
       "file": "discovery.test.ts",
-      "line": 194,
+      "line": 206,
       "title": "host claiming auth-scoped discovery advertises required fields",
       "explicitId": null,
       "citations": [
@@ -8140,7 +8165,7 @@
     {
       "id": "openwop.it.discovery.authenticated-discovery-preserves-required-capabilities-fields",
       "file": "discovery.test.ts",
-      "line": 230,
+      "line": 242,
       "title": "authenticated discovery preserves required Capabilities fields",
       "explicitId": null,
       "citations": [
@@ -8158,7 +8183,7 @@
     {
       "id": "openwop.it.discovery.unauthorized-key-must-not-reveal-capabilities-outside-its-authorization",
       "file": "discovery.test.ts",
-      "line": 271,
+      "line": 283,
       "title": "unauthorized key MUST NOT reveal capabilities outside its authorization",
       "explicitId": null,
       "citations": [
@@ -11581,7 +11606,7 @@
     {
       "id": "openwop.it.identity-owner-shape.run-snapshot-schema-json-defines-an-optional-owner-triple",
       "file": "identity-owner-shape.test.ts",
-      "line": 35,
+      "line": 37,
       "title": "run-snapshot.schema.json defines an optional owner triple",
       "explicitId": null,
       "citations": []
@@ -11589,7 +11614,7 @@
     {
       "id": "openwop.it.identity-owner-shape.positive-tenant-only-owner-validates",
       "file": "identity-owner-shape.test.ts",
-      "line": 46,
+      "line": 50,
       "title": "positive: tenant-only owner validates",
       "explicitId": null,
       "citations": []
@@ -11597,7 +11622,7 @@
     {
       "id": "openwop.it.identity-owner-shape.positive-full-triple-validates",
       "file": "identity-owner-shape.test.ts",
-      "line": 50,
+      "line": 54,
       "title": "positive: full triple validates",
       "explicitId": null,
       "citations": []
@@ -11605,7 +11630,7 @@
     {
       "id": "openwop.it.identity-owner-shape.negative-owner-missing-tenant-is-rejected-tenant-is-required",
       "file": "identity-owner-shape.test.ts",
-      "line": 57,
+      "line": 61,
       "title": "negative: owner missing tenant is rejected (tenant is required)",
       "explicitId": null,
       "citations": []
@@ -11613,7 +11638,7 @@
     {
       "id": "openwop.it.identity-owner-shape.negative-unknown-owner-property-is-rejected-additionalproperties-false",
       "file": "identity-owner-shape.test.ts",
-      "line": 61,
+      "line": 65,
       "title": "negative: unknown owner property is rejected (additionalProperties:false)",
       "explicitId": null,
       "citations": []
@@ -14556,6 +14581,141 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.owner-subject-echo.subject-is-consistent-with-the-owner-triple-b-2-and-the-actor-chain-is-bounded-b",
+      "file": "owner-subject-echo.test.ts",
+      "line": 77,
+      "title": "subject is consistent with the owner triple (§B.2) and the actor chain is bounded (§B.5)",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "RFC 0165 §B.2",
+          "requirement": "subject.tenant MUST equal owner.tenant"
+        },
+        {
+          "section": "RFC 0165 §B.2",
+          "requirement": "subject.subjectId MUST equal owner.principal when both are present"
+        },
+        {
+          "section": "RFC 0165 §B.2",
+          "requirement": "subject.kind MUST equal owner.principalKind when both are present"
+        },
+        {
+          "section": "RFC 0165 §B.2",
+          "requirement": "keyClass MUST be present on a linkable lane"
+        },
+        {
+          "section": "RFC 0165 §B.2",
+          "requirement": "keyClass MUST be absent off the linkable lanes"
+        },
+        {
+          "section": "RFC 0165 §B.5",
+          "requirement": "actor chain depth MUST NOT exceed 4"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.owner-subject-echo.run-started-echoes-the-snapshot-subject-verbatim-b-2-rfc-0048-c",
+      "file": "owner-subject-echo.test.ts",
+      "line": 99,
+      "title": "run.started echoes the snapshot subject verbatim (§B.2, RFC 0048 §C)",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "RFC 0048 §C",
+          "requirement": "run.started MUST be present in the event log"
+        },
+        {
+          "section": "RFC 0165 §B.2",
+          "requirement": "run.started owner.subject MUST equal RunSnapshot.owner.subject"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.owner-subject-echo.a-fork-copies-owner-tenant-and-owner-subject-verbatim-onto-the-child-b-4",
+      "file": "owner-subject-echo.test.ts",
+      "line": 110,
+      "title": "a fork copies owner.tenant and owner.subject verbatim onto the child (§B.4)",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "replay.md §\"Fork ownership\"",
+          "requirement": ":fork MUST return 201 for a completed noop run"
+        },
+        {
+          "section": "RFC 0165 §B.4",
+          "requirement": "the child owner.tenant MUST equal the source"
+        },
+        {
+          "section": "RFC 0165 §B.4",
+          "requirement": "the child owner.subject MUST be copied verbatim from the source"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.owner-subject-shape.compiles-and-accepts-a-full-saml-subject",
+      "file": "owner-subject-shape.test.ts",
+      "line": 43,
+      "title": "compiles and accepts a full SAML subject",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.owner-subject-shape.accepts-the-legacy-issuer-form-rfc-0165-b-3-and-a-workload-subject",
+      "file": "owner-subject-shape.test.ts",
+      "line": 47,
+      "title": "accepts the legacy issuer form (RFC 0165 §B.3) and a workload subject",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.owner-subject-shape.rejects-an-email-shaped-or-whitespace-subjectid-invariant-subject-record-opaque",
+      "file": "owner-subject-shape.test.ts",
+      "line": 52,
+      "title": "rejects an email-shaped or whitespace subjectId (invariant subject-record-opaque)",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.owner-subject-shape.requires-keyclass-on-the-saml-scim-lanes-and-forbids-it-elsewhere",
+      "file": "owner-subject-shape.test.ts",
+      "line": 57,
+      "title": "requires keyClass on the saml/scim lanes and forbids it elsewhere",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.owner-subject-shape.rejects-an-unknown-member-and-a-missing-required-member",
+      "file": "owner-subject-shape.test.ts",
+      "line": 64,
+      "title": "rejects an unknown member and a missing required member",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.owner-subject-shape.accepts-a-nested-actor-chain-depth-is-a-host-obligation-rfc-0165-b-5",
+      "file": "owner-subject-shape.test.ts",
+      "line": 70,
+      "title": "accepts a nested actor chain (depth is a host obligation, RFC 0165 §B.5)",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.owner-subject-shape.runsnapshot-owner-accepts-a-subject-and-still-rejects-an-undeclared-member",
+      "file": "owner-subject-shape.test.ts",
+      "line": 82,
+      "title": "RunSnapshot.owner accepts a subject and still rejects an undeclared member",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.owner-subject-shape.run-started-owner-echo-accepts-the-same-subject-and-principalkind-the-echo-match",
+      "file": "owner-subject-shape.test.ts",
+      "line": 88,
+      "title": "run.started owner echo accepts the same subject AND principalKind (the echo matches the snapshot)",
+      "explicitId": null,
+      "citations": []
+    },
     {
       "id": "openwop.it.pack-manifest-extension-opacity.leg-1-an-extension-bearing-manifest-installs",
       "file": "pack-manifest-extension-opacity.test.ts",
@@ -16816,6 +16976,73 @@
       "explicitId": null,
       "citations": []
     },
+    {
+      "id": "openwop.it.protocol-versions-array.declares-root-protocolversions-as-a-unique-non-empty-string-array",
+      "file": "protocol-versions-array.test.ts",
+      "line": 44,
+      "title": "declares root `protocolVersions` as a unique, non-empty string array",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.protocol-versions-array.item-grammar-equals-the-scalar-grammar-one-axis-one-grammar",
+      "file": "protocol-versions-array.test.ts",
+      "line": 52,
+      "title": "item grammar equals the scalar grammar (one axis, one grammar)",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.protocol-versions-array.accepts-1-11-2-0-rejects-01-0-1-0-0-duplicates-and-empty",
+      "file": "protocol-versions-array.test.ts",
+      "line": 59,
+      "title": "accepts [\"1.11\", \"2.0\"], rejects \"01.0\", \"1.0.0\", duplicates, and empty",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.protocol-versions-array.when-advertised-every-item-matches-the-grammar-items-are-unique-and-the-array-co",
+      "file": "protocol-versions-array.test.ts",
+      "line": 73,
+      "title": "when advertised, every item matches the grammar, items are unique, and the array contains protocolVersion",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "RFC 0165 §A.1",
+          "requirement": "protocolVersions MUST be an array"
+        },
+        {
+          "section": "RFC 0165 §A.1",
+          "requirement": "protocolVersions MUST be non-empty"
+        },
+        {
+          "section": "RFC 0165 §A.1",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0165 §A.1",
+          "requirement": "protocolVersions items MUST be unique"
+        },
+        {
+          "section": "RFC 0165 §A.2",
+          "requirement": "protocolVersions MUST contain the value of protocolVersion"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.protocol-versions-array.profile-derivation-is-unchanged-by-the-array-iscore-reads-the-scalar-only",
+      "file": "protocol-versions-array.test.ts",
+      "line": 90,
+      "title": "profile derivation is unchanged by the array (isCore reads the scalar only)",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "RFC 0165 §A.2",
+          "requirement": "openwop-discovery-core derivation MUST NOT depend on protocolVersions in v1.x"
+        }
+      ]
+    },
     {
       "id": "openwop.it.provider-usage.capabilities-providerusage-is-either-absent-or-a-well-formed-object",
       "file": "provider-usage.test.ts",
@@ -22365,13 +22592,22 @@
         {
           "section": "webhooks.md §\"Delivery headers\"",
           "requirement": "X-openwop-Signature MUST be sha256=HMAC-SHA256(secret, `${X-openwop-Timestamp}.${rawBody}`)"
+        },
+        {
+          "section": "RFC 0165 §C.1",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0165 §C.1",
+          "requirement": "OpenWOP-Signature MUST verify over the same bytes as X-openwop-Signature"
         }
       ]
     },
     {
       "id": "openwop.it.webhook-signed-delivery.control-with-a-tunnel-wired-the-host-still-refuses-the-loopback-receiver",
       "file": "webhook-signed-delivery.test.ts",
-      "line": 356,
+      "line": 378,
       "title": "control: with a tunnel wired, the host still refuses the loopback receiver",
       "explicitId": null,
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,14 +1,14 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md §\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.154.0",
-  "corpusCommit": "07f4573cca4a742445d1078773f422d28f986ee5",
+  "suiteVersion": "1.155.0",
+  "corpusCommit": "69a420b081aac0fc7f3a6b7576855d6d1ba33f48",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
-    "api/openapi.yaml": "105e7bc27d216eb29fbb526b3548b5545711ec2a18c004bce20b08f5af38b750",
+    "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "9f2374405b9ca58994ae076ada9fbe4dfb8265b77e4bf65331d1493192c0bd3a",
-    "schemas/README.md": "d9624e98ba3534b27fe4823227e8c2ac8df3ffd4bc4f57b4a023c91f5addefd6",
+    "schemas/README.md": "3769a5bcdc2d8f02c819d20eecf34e0c50666b47ac922380a9b0e0ec13cfc9e2",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
     "schemas/a2ui-surface-delta-frame.schema.json": "970d434e4fdcb925de64aaace91eb83bfbcfd8f76757a9ce9f339eda5fb3f4e8",
     "schemas/agent-deployment-transition.schema.json": "1ac987fed0f380fa5b4e9a40e8e13316e5ae42d03a0ff42db4be6273e1bfe9f4",
@@ -26,7 +26,7 @@
     "schemas/artifact-type-pack-manifest.schema.json": "13932ea58e819e01b3a0cc7a65590b70683dd5fe9208fc06c64c339943d3c4ce",
     "schemas/audit-verify-result.schema.json": "e8fd013fb610ba5db27ab0113ec2eb18e7da5f9310dd3de2dd3dc87a259c21fe",
     "schemas/budget-policy.schema.json": "3d4fe30ae129fe136ab9ece395f2a2a42a76360786b1b9a1d5f1cbc753eb5b39",
-    "schemas/capabilities.schema.json": "594d92806866886f3aefa7855e1ef5f33fec6459b06ef1ce6c07220c396b5661",
+    "schemas/capabilities.schema.json": "72811aa52360e9b84988e7989e4cad519acf0db096f4e3894574f7d022e37e7a",
     "schemas/certification-bundle-v2.schema.json": "3540232676086869ae78d24f3b9c2154f9c4a8a5eeb976512d6a7409f8cf19bb",
     "schemas/channel-presence-payload.schema.json": "f9d0ef4219814c2b765baf3e68cbe5eea2cb42379f516a93a0459dcd5f7db47e",
     "schemas/channel-written-payload.schema.json": "54723a56bc5a35232f64544ca686ac1ac959a5fb05b32b2401facca6b3ef51a3",
@@ -77,15 +77,16 @@
     "schemas/residency.schema.json": "b45fdc91ae88091251914dbd6787a1e2ce687580b91d31a759217b7a1f0010c0",
     "schemas/run-ancestry-response.schema.json": "963a5763b03216aa72fc2854560c778e53994f8cb06ea9a4053e541273c87f5c",
     "schemas/run-diff-response.schema.json": "d9d196730b5d5d8a04a591d21a8fc6b44be7fa134f11827ff7e4f1a86d47e83d",
-    "schemas/run-event-payloads.schema.json": "6907c2a388d27169756781e1a5771e411238b465d9f0917698cde25dde6bccae",
+    "schemas/run-event-payloads.schema.json": "37cdbdb5038e148056c104a49b8d28a9668479e06d401309d354a8b0a70921a3",
     "schemas/run-event.schema.json": "c70c06932b9831295042836213e617c8e946f20ddd49cf4e889b74d89d2175a8",
     "schemas/run-options.schema.json": "f8241ece6ddc6527de9160d811d42c231b4f77b935f2e107b3c05608545c59ab",
     "schemas/run-orchestrator-decided-event.schema.json": "17a43a3c44680a24d411141357a867b3caed6107d56de88fe2e062eaf93fa2c1",
-    "schemas/run-snapshot.schema.json": "05c406120e1958984ac7e06deff369f2df9f4d7b72ced9b624c327c1c86999e8",
+    "schemas/run-snapshot.schema.json": "8a45f997beec0a2fa596f4631129a869cfbc37c9ad38583530ed11655301d2ab",
     "schemas/security-advisory.schema.json": "9c550f0bf10a3193dcca4a127081fb66fe5dc1b6f729c4c17bfaea3ba3ce05fc",
     "schemas/self-hosted-runner-dispatch-frame.schema.json": "3f1d7edd572c6747657299525d8e85329b93b6fadf670e3a19c74d53e725adec",
     "schemas/self-hosted-runner-registration.schema.json": "6c781adf1bb915a9e47796494f4a527353cbbf72b480e5a05be4aac65a6d0c6e",
     "schemas/self-hosted-runner-result-frame.schema.json": "16f2f711b6071c797d8d4065f6f5ff39102ff03890fefce7a88a669831566296",
+    "schemas/subject.schema.json": "89679e35c7ec586adf6dd4adaff0bfa5453648d067fb2a43d7a2f7b2d016e10c",
     "schemas/suspend-request.schema.json": "1aa39f2a947934bedc9f9696bf45fcb6119395c580d5ca282efb9443bd94a7bb",
     "schemas/tool-descriptor.schema.json": "7f6adbae63003c1f1311f6a436f7f286542be62aa19a27b46730f2c2810857f7",
     "schemas/trigger-event.schema.json": "59d63b79dca3593f45d281776cbfe43ae4d85ee25519b82ad59f162a9efb592c",

package/schemas/README.md

@@ -71,6 +71,7 @@
 | `run-options.schema.json` | `run-options.md` | Per-run input overlay (configurable + tags + metadata) on `POST /v1/runs` |
 | `run-orchestrator-decided-event.schema.json` | orchestrator RFC + `observability.md` | Event payload for orchestrator decisions |
 | `run-snapshot.schema.json` | `rest-endpoints.md` §RunSnapshot | Projected run state from `GET /v1/runs/{runId}` |
+| `subject.schema.json` | `auth.md` §"The Subject record" + RFC 0165 | DRAFT — issuer-scoped, lane-typed identity record carried as `owner.subject` on `RunSnapshot` and the `run.started` echo; opaque `subjectId` (no `@`/whitespace), `keyClass` iff saml/scim, optional bounded `actor` chain. Optional in v1.x; the v2 major requires it. |
 | `residency.schema.json` | RFC 0129 + `capabilities.md` §dataResidency | OPTIONAL data-residency `{region}` constraint on `POST /v1/runs` (honor-or-reject admission) |
 | `credential-provenance.schema.json` | `host-capabilities.md` §"Credential provenance + egress policy" (RFC 0079) | Metadata about a host-issued credential at the tool/egress boundary — `credentialId`/`issuer`/`audiences`(+scopes/expiry/redaction/audit-correlation). Secret-free (SR-1); the §C audience-binding MUST is evaluated against `audiences`. |
 | `security-advisory.schema.json` | `registry-operations.md` + INCIDENT-RESPONSE runbook | Registry-owned CVE advisory record at `registry/security/advisories.json`. One entry per disclosed vulnerability — id, severity, affected pack-name + SemVer range, optional fixedIn/advisoryUrl/credits. Enforced by `check-advisories.mjs` in `.github/workflows/registry-publish.yml`. |

package/schemas/capabilities.schema.json

@@ -16,6 +16,13 @@
       "description": "RFC 0149 \u00a7C \u2014 openwop protocol version the server speaks, as ASCII `<major>.<minor>` with no leading zero except zero itself. `1.0` and `1.12` are valid; `1`, `1.0.0`, `v1.0`, and `01.0` are not. The integer major is the hard compatibility boundary and the integer minor is the additive contract level; PATCH belongs to suite and SDK versions, not the spec version. Previously constrained only by `minLength: 1`, which admitted `v1.0`, `1.0.0`, and `banana` \u2014 a negotiation the wire could not decide, since neither integer can be extracted from an unconstrained string. Independent of `engineVersion` (which gates persisted-doc compatibility per version-negotiation.md).",
       "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$"
     },
+    "protocolVersions": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$" },
+      "description": "RFC 0165 \u00a7A. Every protocol `<major>.<minor>` this host speaks, newest first by convention. OPTIONAL in v1.x; when present it MUST contain the value of `protocolVersion` and MUST NOT name a major the host does not serve. Same grammar as `protocolVersion` (RFC 0149 \u00a7C), not the looser A2A item pattern. Consumers that do not understand it ignore it; profile derivation reads `protocolVersion` only. Reserved for v2 major negotiation."
+    },
     "contractProvenance": {
       "type": "object",
       "description": "RFC 0146 (`Active`). Which corpus revision this host's contract handling corresponds to \u2014 the copy it validates and serves against. OPTIONAL; absent \u21d2 UNSPECIFIED provenance, neither current nor stale, and a consumer MUST NOT infer a version from its absence. ADVISORY: a consumer MUST NOT reject a request, refuse interop, or fail a run solely because this differs from its own \u2014 v1.x corpus revisions are additive, so a host on an older revision is conformant and this field detects drift rather than making drift an error. Nothing else on the wire answers this: `protocolVersion` is `1.0` across the entire v1 line (the drift happens inside that value) and `schemaVersions` is per-envelope-type. NOT an integrity check \u2014 `corpusCommit` says WHICH contract, never whether the copy was modified.",

package/schemas/run-event-payloads.schema.json

@@ -1019,6 +1019,15 @@
             "principal": {
               "type": "string",
               "minLength": 1
+            },
+            "principalKind": {
+              "type": "string",
+              "enum": ["user", "agent", "anonymous"],
+              "description": "RFC 0132 (declared here by RFC 0165): the echo carries the same optional kind as `RunSnapshot.owner.principalKind`, so a host that echoes its own snapshot owner emits a valid payload."
+            },
+            "subject": {
+              "$ref": "subject.schema.json",
+              "description": "RFC 0165 \u00a7B. The run's Subject record, echoed verbatim from `RunSnapshot.owner.subject` when present."
             }
           },
           "additionalProperties": false

package/schemas/run-snapshot.schema.json

@@ -46,6 +46,10 @@
         "tenant": { "type": "string", "minLength": 1, "description": "Top-level isolation boundary." },
         "workspace": { "type": "string", "minLength": 1, "description": "Optional sub-tenant within the tenant (RFC 0048 workspace)." },
         "principal": { "type": "string", "minLength": 1, "description": "Acting identity (user or agent) — opaque id, never PII." },
+        "subject": {
+          "$ref": "subject.schema.json",
+          "description": "RFC 0165 \u00a7B. OPTIONAL issuer-scoped Subject record for the acting identity. When present: `subject.tenant` MUST equal `tenant`, `subject.subjectId` MUST equal `principal` when both are present, `subject.kind` MUST equal `principalKind` when both are present. A host that emits it on new runs synthesizes `issuer: \"urn:openwop:legacy\"` for runs that predate emission (\u00a7B.3) and copies it verbatim onto forks (\u00a7B.4)."
+        },
         "principalKind": {
           "type": "string",
           "enum": ["user", "agent", "anonymous"],

package/schemas/subject.schema.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/subject.schema.json",
+  "title": "OpenWOP Subject",
+  "description": "RFC 0165 §B. An issuer-scoped, lane-typed identity record carried as `owner.subject` on RunSnapshot and on the run.started owner echo. With `issuer` in the key, two trust roots issuing the same identifier are distinct by construction. Optional in v1.x; the v2 major requires it and removes the bare `owner.principal` string.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["issuer", "subjectId", "tenant", "lane", "kind"],
+  "properties": {
+    "issuer": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 1024,
+      "pattern": "^\\S+$",
+      "description": "Trust root that asserted this subject: the SAML IdP entityID, the OIDC `iss`, the mTLS CA subject, the API-key realm, the SCIM connection id, or `urn:openwop:legacy` for a run that predates subject emission (RFC 0165 §B.3)."
+    },
+    "subjectId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "pattern": "^[^@\\s]+$",
+      "description": "Opaque, stable, issuer-scoped identifier. MUST NOT be an email address, a display name, or credential material (SECURITY invariant `subject-record-opaque`). Equals `owner.principal` when both are present (RFC 0165 §B.2)."
+    },
+    "tenant": {
+      "type": "string",
+      "minLength": 1,
+      "description": "MUST equal the enclosing `owner.tenant` (RFC 0165 §B.2)."
+    },
+    "lane": {
+      "type": "string",
+      "enum": ["api-key", "oauth2", "oidc", "mtls", "saml", "scim", "ldap", "workload"],
+      "description": "The authentication lane that minted the subject (auth-profiles.md). `workload` corresponds to RFC 0154's workload identity; the RFC 0154 `scheme` is carried in `issuer`."
+    },
+    "kind": {
+      "type": "string",
+      "enum": ["user", "agent", "anonymous", "workload"],
+      "description": "Superset of `owner.principalKind` (RFC 0132) plus `workload` (RFC 0154). Equals `principalKind` when both are present."
+    },
+    "keyClass": {
+      "type": "string",
+      "enum": ["opaque-idp", "configured-immutable"],
+      "description": "How `subjectId` was derived when the lane is linkable (RFC 0163 §A). Present iff `lane` is `saml` or `scim`; MUST equal `capabilities.auth.subjectLinkKey` when both identity profiles are advertised (RFC 0164 §A.3)."
+    },
+    "actor": {
+      "$ref": "#",
+      "description": "Who acted on this subject's behalf (delegation; RFC 0154 §B inverted to the run's point of view). Provenance, not authorization. Chain depth MUST NOT exceed 4; a host refuses rather than truncates (RFC 0165 §B.5)."
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "lane": { "enum": ["saml", "scim"] } } },
+      "then": { "required": ["keyClass"] },
+      "else": { "not": { "required": ["keyClass"] } }
+    }
+  ]
+}

package/src/scenarios/anonymous-actor-shape.test.ts

@@ -112,9 +112,13 @@ describe('anonymous-actor-shape: capability advertisement (RFC 0132 §B, server-
 describe('anonymous-actor-shape: owner.principalKind (RFC 0132 §A, server-free)', () => {
   it('run-snapshot owner accepts principalKind "anonymous" and rejects "guest"', () => {
     const snap = loadSchema('run-snapshot.schema.json');
-    const owner = (snap.properties as Record<string, unknown>).owner as Record<string, unknown>;
+    // RFC 0165 added an optional `subject` member ($ref subject.schema.json);
+    // register it and give the extracted sub-schema its parent's `$id` as the
+    // base the relative $ref resolves against.
+    const owner = { $id: snap.$id as string, ...((snap.properties as Record<string, unknown>).owner as Record<string, unknown>) };
     const ajv = new Ajv2020({ strict: false, allErrors: true });
     addFormats(ajv);
+    ajv.addSchema(loadSchema('subject.schema.json'));
     const validate = ajv.compile(owner);
     expect(
       validate({ tenant: 'acme', principal: 'anon:sess-3f9c', principalKind: 'anonymous' }),
@@ -136,6 +140,7 @@ describe('anonymous-actor-shape: audit reuses authorization.decided (RFC 0132 §
   const payloads = loadSchema('run-event-payloads.schema.json');
   const ajv = new Ajv2020({ strict: false, allErrors: true });
   addFormats(ajv);
+  ajv.addSchema(loadSchema('subject.schema.json'));
   ajv.addSchema(payloads, 'payloads');
   const decided = ajv.getSchema('payloads#/$defs/authorizationDecided');
 

package/src/scenarios/auth-subject-link.test.ts

@@ -24,7 +24,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
@@ -190,3 +190,22 @@ describe('auth-subject-link: link-key hygiene (RFC 0159 §A.2 — opt-in)', () =
     ).toBe(false);
   });
 });
+
+describe('auth-subject-link: legacy subjects are never linked (RFC 0165 §B.3 — seam-gated)', () => {
+  // Invariant `subject-legacy-not-linkable` (witness class: negative-existence,
+  // seam-gated). A run that predates `owner.subject` emission carries a synthesized
+  // `issuer: "urn:openwop:legacy"`; a SCIM deactivation MUST NOT deny it. The only
+  // causable observation is a host seam that mints a legacy-issuer subject and a
+  // linked SCIM record; no such seam is specified yet, so this leg records
+  // `blocked` honestly rather than a pass (RFC 0148 §A).
+  it('a SCIM deactivation does not deny a SAML login whose run subject is legacy-issued', async () => {
+    const res = await driver.get('/.well-known/openwop', { authenticated: false });
+    const auth = ((res.json as Record<string, unknown>)['auth'] ?? (res.json as { capabilities?: { auth?: unknown } }).capabilities?.auth) as { profiles?: string[] } | undefined;
+    const both = Array.isArray(auth?.profiles) && auth.profiles.includes('openwop-auth-saml') && auth.profiles.includes('openwop-auth-scim');
+    if (!both) {
+      return softSkip('inapplicable', 'host does not advertise both identity profiles (RFC 0164) — the legacy-link rule has no linked pair to protect');
+    }
+    return seamAbsent('no seam mints a legacy-issuer subject bound to a SCIM record (RFC 0165 §B.3); the negative cannot be caused from outside the host');
+  });
+});
+

package/src/scenarios/discovery.test.ts

@@ -10,6 +10,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 describe('discovery: /.well-known/openwop', () => {
   it('returns 200 with required Capabilities fields per capabilities.md §2', async () => {
@@ -42,6 +43,17 @@ describe('discovery: /.well-known/openwop', () => {
     )).toBeTruthy();
   });
 
+  it('IF a standard ETag is present, a matching If-None-Match yields 304 (RFC 0165 §C.2 — presence-gated)', async () => {
+    const first = await driver.get('/.well-known/openwop', { authenticated: false });
+    const etag = first.headers.get('etag');
+    if (etag === null) {
+      return softSkip('inapplicable', 'host does not send a standard ETag on the discovery document (RFC 0165 §C.2 — SHOULD, presence-gated)');
+    }
+    expect(etag.trim().length, driver.describe('RFC 0165 §C.2', 'ETag, when present, MUST be a non-empty validator')).toBeGreaterThan(0);
+    const second = await driver.get('/.well-known/openwop', { authenticated: false, headers: { 'If-None-Match': etag } });
+    expect(second.status, driver.describe('capabilities-change-detection.md §"Cache validators"', 'a matching If-None-Match SHOULD yield 304 Not Modified')).toBe(304);
+  });
+
   it('IF Capabilities-Etag is present, it is non-empty and stable within the cache window', async () => {
     const first = await driver.get('/.well-known/openwop', { authenticated: false });
     const firstEtag = first.headers.get('capabilities-etag');

package/src/scenarios/identity-owner-shape.test.ts

@@ -9,8 +9,9 @@
  *   - Positive: `{ tenant }` and `{ tenant, workspace, principal }` validate.
  *   - Negative: missing `tenant` (required), or an unknown property, is rejected.
  *
- * The owner subschema is self-contained (no external $ref), so it compiles
- * standalone via ajv.
+ * The owner subschema referenced only itself until RFC 0165 added an optional
+ * `subject` member ($ref subject.schema.json); that schema is registered on the
+ * ajv instance so the owner subschema still compiles standalone.
  *
  * @see RFCS/0048-tenant-workspace-principal-identity-model.md
  * @see schemas/run-snapshot.schema.json properties.owner
@@ -24,6 +25,7 @@ import { SCHEMAS_DIR } from '../lib/paths.js';
 
 interface SnapshotSchema {
   $schema: string;
+  $id: string;
   properties: { owner?: Record<string, unknown> };
 }
 
@@ -40,7 +42,9 @@ describe('category: identity owner-triple shape (RFC 0048 §C)', () => {
   });
 
   const ajv = new Ajv2020({ allErrors: true, strict: false });
-  const ownerSchema = { $schema: snapshot.$schema, ...(snapshot.properties.owner as Record<string, unknown>) };
+  ajv.addSchema(JSON.parse(readFileSync(join(SCHEMAS_DIR, 'subject.schema.json'), 'utf8')) as Record<string, unknown>);
+  // `$id` is the base the relative `subject.schema.json` $ref (RFC 0165) resolves against.
+  const ownerSchema = { $schema: snapshot.$schema, $id: snapshot.$id, ...(snapshot.properties.owner as Record<string, unknown>) };
   const validate = ajv.compile(ownerSchema);
 
   it('positive: tenant-only owner validates', () => {

package/src/scenarios/owner-subject-echo.test.ts

@@ -0,0 +1,127 @@
+/**
+ * owner-subject-echo — RFC 0165 §B.2, §B.4 verification (host-facing, gated).
+ *
+ * A host that emits `owner.subject` on a new run MUST: keep it consistent with
+ * the owner triple (§B.2), echo it verbatim on `run.started` (§B.2; RFC 0048
+ * §C), and copy it verbatim onto a fork (§B.4 — `replay.md` §"Fork
+ * ownership"). This file drives the `conformance-noop` fixture, reads the
+ * snapshot, and gates every leg on the snapshot actually carrying a subject:
+ * a host that does not emit one is conformant in v1.x (`inapplicable`), and a
+ * host that emits one is held to the rules.
+ *
+ * @see RFCS/0165-v2-preparation-wire-shapes.md §B
+ * @see spec/v1/auth.md §"The Subject record"
+ * @see spec/v1/replay.md §"Fork ownership"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { softSkip } from '../lib/soft-skip.js';
+
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);
+
+interface Subject {
+  issuer: string;
+  subjectId: string;
+  tenant: string;
+  lane: string;
+  kind: string;
+  keyClass?: string;
+  actor?: Subject;
+}
+interface Owner {
+  tenant?: string;
+  workspace?: string;
+  principal?: string;
+  principalKind?: string;
+  subject?: Subject;
+}
+interface Snapshot {
+  runId?: string;
+  status?: string;
+  owner?: Owner;
+}
+interface RawEvent {
+  type?: string;
+  sequence?: number;
+  payload?: { owner?: Owner };
+}
+
+async function createRun(): Promise<string> {
+  const create = await driver.post('/v1/runs', { workflowId: NOOP_WORKFLOW_ID });
+  if (create.status !== 201) throw new Error(`Failed to start ${NOOP_WORKFLOW_ID}: ${create.status}`);
+  return (create.json as { runId: string }).runId;
+}
+
+async function snapshot(runId: string): Promise<Snapshot> {
+  const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
+  if (res.status !== 200) throw new Error(`GET /v1/runs/${runId}: ${res.status}`);
+  return res.json as Snapshot;
+}
+
+async function events(runId: string): Promise<readonly RawEvent[]> {
+  const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events/poll?lastSequence=0&timeout=1`);
+  if (res.status !== 200) throw new Error(`events for ${runId}: ${res.status}`);
+  return (res.json as { events?: RawEvent[] })?.events ?? [];
+}
+
+function actorDepth(s: Subject | undefined): number {
+  let d = 0;
+  for (let cur = s?.actor; cur !== undefined; cur = cur.actor) d++;
+  return d;
+}
+
+describe.skipIf(SKIP_NO_NOOP)('owner-subject-echo: consistency, echo, fork (RFC 0165 §B — gated on a host that emits owner.subject)', () => {
+  it('subject is consistent with the owner triple (§B.2) and the actor chain is bounded (§B.5)', async () => {
+    const runId = await createRun();
+    const snap = await snapshot(runId);
+    const subject = snap.owner?.subject;
+    if (subject === undefined) {
+      return softSkip('inapplicable', 'host does not emit owner.subject on new runs (RFC 0165 §B — optional in v1.x)');
+    }
+    expect(subject.tenant, driver.describe('RFC 0165 §B.2', 'subject.tenant MUST equal owner.tenant')).toBe(snap.owner?.tenant);
+    if (snap.owner?.principal !== undefined) {
+      expect(subject.subjectId, driver.describe('RFC 0165 §B.2', 'subject.subjectId MUST equal owner.principal when both are present')).toBe(snap.owner.principal);
+    }
+    if (snap.owner?.principalKind !== undefined) {
+      expect(subject.kind, driver.describe('RFC 0165 §B.2', 'subject.kind MUST equal owner.principalKind when both are present')).toBe(snap.owner.principalKind);
+    }
+    if (subject.lane === 'saml' || subject.lane === 'scim') {
+      expect(subject.keyClass, driver.describe('RFC 0165 §B.2', 'keyClass MUST be present on a linkable lane')).toBeDefined();
+    } else {
+      expect(subject.keyClass, driver.describe('RFC 0165 §B.2', 'keyClass MUST be absent off the linkable lanes')).toBeUndefined();
+    }
+    expect(actorDepth(subject), driver.describe('RFC 0165 §B.5', 'actor chain depth MUST NOT exceed 4')).toBeLessThanOrEqual(4);
+  });
+
+  it('run.started echoes the snapshot subject verbatim (§B.2, RFC 0048 §C)', async () => {
+    const runId = await createRun();
+    const snap = await snapshot(runId);
+    if (snap.owner?.subject === undefined) {
+      return softSkip('inapplicable', 'host does not emit owner.subject on new runs (RFC 0165 §B — optional in v1.x)');
+    }
+    const started = (await events(runId)).find((e) => e.type === 'run.started');
+    expect(started, driver.describe('RFC 0048 §C', 'run.started MUST be present in the event log')).toBeDefined();
+    expect(started?.payload?.owner?.subject, driver.describe('RFC 0165 §B.2', 'run.started owner.subject MUST equal RunSnapshot.owner.subject')).toEqual(snap.owner.subject);
+  });
+
+  it('a fork copies owner.tenant and owner.subject verbatim onto the child (§B.4)', async () => {
+    const sourceRunId = await createRun();
+    const source = await snapshot(sourceRunId);
+    if (source.owner?.subject === undefined) {
+      return softSkip('inapplicable', 'host does not emit owner.subject on new runs (RFC 0165 §B — optional in v1.x)');
+    }
+    const fork = await driver.post(`/v1/runs/${encodeURIComponent(sourceRunId)}:fork`, { fromSeq: 0, mode: 'replay' });
+    if (fork.status === 404 || fork.status === 501 || fork.status === 403) {
+      return softSkip('inapplicable', `host does not offer :fork on this run (${fork.status}); the fork-copy rule has no fork to check`);
+    }
+    expect(fork.status, driver.describe('replay.md §"Fork ownership"', ':fork MUST return 201 for a completed noop run')).toBe(201);
+    const childId = (fork.json as { runId?: string }).runId;
+    expect(typeof childId, 'fork response MUST include the child runId').toBe('string');
+    const child = await snapshot(childId as string);
+    expect(child.owner?.tenant, driver.describe('RFC 0165 §B.4', 'the child owner.tenant MUST equal the source')).toBe(source.owner.tenant);
+    expect(child.owner?.subject, driver.describe('RFC 0165 §B.4', 'the child owner.subject MUST be copied verbatim from the source')).toEqual(source.owner.subject);
+  });
+});

package/src/scenarios/owner-subject-shape.test.ts

@@ -0,0 +1,96 @@
+/**
+ * owner-subject-shape — RFC 0165 §B.1–§B.2 verification (server-free).
+ *
+ * `schemas/subject.schema.json` is the OPTIONAL issuer-scoped identity record
+ * carried as `owner.subject` on `RunSnapshot` and on the `run.started` owner
+ * echo. This file proves the SCHEMA half of §B: the record compiles standalone,
+ * both owner sub-objects reference it as a declared optional member (they are
+ * `additionalProperties: false`, so an undeclared `subject` would be rejected —
+ * the live `principalKind` divergence RFC 0165 §Alternatives 3 names), and the
+ * opacity + key-class conditionals hold. Behaviour (echo, fork copy, legacy
+ * synthesis) is `owner-subject-echo.test.ts`, gated on a host that emits it.
+ *
+ * SECURITY invariant `subject-record-opaque` (witness class: claims-check —
+ * the schema pattern is what forbids an email-shaped or whitespace subjectId;
+ * no probe can prove a host never mints PII, only that the wire refuses it).
+ *
+ * @see RFCS/0165-v2-preparation-wire-shapes.md §B
+ * @see schemas/subject.schema.json
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+
+const read = (f: string): Record<string, unknown> => JSON.parse(readFileSync(join(SCHEMAS_DIR, f), 'utf8')) as Record<string, unknown>;
+const subject = read('subject.schema.json');
+const snapshot = read('run-snapshot.schema.json') as { $schema: string; $id: string; properties: { owner: Record<string, unknown> } };
+const payloads = read('run-event-payloads.schema.json') as { $schema: string; $id: string; $defs: { runStarted: { properties: { owner: Record<string, unknown> } } } };
+
+function ajvWithSubject(): Ajv2020 {
+  const ajv = new Ajv2020({ allErrors: true, strict: false });
+  ajv.addSchema(subject);
+  return ajv;
+}
+
+const VALID = { issuer: 'https://idp.example.com/entity', subjectId: 'idp-op-8f3a', tenant: 'acme', lane: 'saml', kind: 'user', keyClass: 'opaque-idp' };
+
+describe('owner-subject-shape: subject.schema.json (RFC 0165 §B.1)', () => {
+  const validate = ajvWithSubject().compile(subject);
+
+  it('compiles and accepts a full SAML subject', () => {
+    expect(validate(VALID), JSON.stringify(validate.errors)).toBe(true);
+  });
+
+  it('accepts the legacy issuer form (RFC 0165 §B.3) and a workload subject', () => {
+    expect(validate({ issuer: 'urn:openwop:legacy', subjectId: 'user_42', tenant: 'acme', lane: 'api-key', kind: 'user' }), JSON.stringify(validate.errors)).toBe(true);
+    expect(validate({ issuer: 'spiffe://trust.example', subjectId: 'spiffe://trust.example/ns/a/sa/b', tenant: 'acme', lane: 'workload', kind: 'workload' }), JSON.stringify(validate.errors)).toBe(true);
+  });
+
+  it('rejects an email-shaped or whitespace subjectId (invariant subject-record-opaque)', () => {
+    expect(validate({ ...VALID, subjectId: 'alice@example.com' }), 'RFC 0165 §B.2: subjectId MUST NOT be an email address').toBe(false);
+    expect(validate({ ...VALID, subjectId: 'Alice Example' }), 'RFC 0165 §B.2: subjectId MUST NOT contain whitespace (a display name)').toBe(false);
+  });
+
+  it('requires keyClass on the saml/scim lanes and forbids it elsewhere', () => {
+    const { keyClass: _k, ...noKey } = VALID;
+    expect(validate(noKey), 'RFC 0165 §B.2: keyClass MUST be present when lane is saml or scim').toBe(false);
+    expect(validate({ ...VALID, lane: 'oidc' }), 'RFC 0165 §B.2: keyClass MUST be absent when the lane is not linkable').toBe(false);
+    expect(validate({ ...noKey, lane: 'oidc' }), JSON.stringify(validate.errors)).toBe(true);
+  });
+
+  it('rejects an unknown member and a missing required member', () => {
+    expect(validate({ ...VALID, email: 'x' })).toBe(false);
+    const { tenant: _t, ...noTenant } = VALID;
+    expect(validate(noTenant)).toBe(false);
+  });
+
+  it('accepts a nested actor chain (depth is a host obligation, RFC 0165 §B.5)', () => {
+    const peer = { issuer: 'https://peer.example', subjectId: 'peer-1', tenant: 'acme', lane: 'workload', kind: 'workload' };
+    const { keyClass: _k, ...anon } = { ...VALID, kind: 'anonymous', lane: 'api-key', actor: peer };
+    expect(validate(anon), JSON.stringify(validate.errors)).toBe(true);
+  });
+});
+
+describe('owner-subject-shape: both owner sub-objects declare `subject` (RFC 0165 §B.1)', () => {
+  // The extracted sub-schema needs its parent's `$id` as the base for the relative `subject.schema.json` $ref.
+  const ownerSnap = { $schema: snapshot.$schema, $id: snapshot.$id, ...snapshot.properties.owner };
+  const ownerEcho = { $schema: payloads.$schema, $id: payloads.$id, ...payloads.$defs.runStarted.properties.owner };
+
+  it('RunSnapshot.owner accepts a subject and still rejects an undeclared member', () => {
+    const v = ajvWithSubject().compile(ownerSnap);
+    expect(v({ tenant: 'acme', principal: 'idp-op-8f3a', principalKind: 'user', subject: VALID }), JSON.stringify(v.errors)).toBe(true);
+    expect(v({ tenant: 'acme', role: 'admin' })).toBe(false);
+  });
+
+  it('run.started owner echo accepts the same subject AND principalKind (the echo matches the snapshot)', () => {
+    const v = ajvWithSubject().compile(ownerEcho);
+    expect(
+      v({ tenant: 'acme', principal: 'idp-op-8f3a', principalKind: 'user', subject: VALID }),
+      'RFC 0165 §B.1: run.started owner MUST declare subject and principalKind so a host can echo its snapshot owner verbatim',
+    ).toBe(true);
+    expect(v({ tenant: 'acme', subject: { ...VALID, subjectId: 'a@b' } })).toBe(false);
+  });
+});

package/src/scenarios/protocol-versions-array.test.ts

@@ -0,0 +1,103 @@
+/**
+ * protocol-versions-array — RFC 0165 §A verification.
+ *
+ * `protocolVersions: string[]` is the OPTIONAL root advertisement of every
+ * `<major>.<minor>` a host serves, reserved for v2 major negotiation
+ * (`version-negotiation.md` §"`protocolVersions[]`"). Three things are
+ * checkable today:
+ *
+ *   1. Server-free: the schema declares the array with the SAME strict grammar
+ *      as the scalar (RFC 0149 §C), not the looser A2A item pattern — one axis,
+ *      one grammar; and the Levenshtein-1 neighbour of `protocolVersion` is a
+ *      real property, so the root-layout typo lint cannot mistake it.
+ *   2. Host, presence-gated: when advertised, every item matches, items are
+ *      unique, and the array contains `protocolVersion`'s value.
+ *   3. Host, presence-gated: profile derivation is unchanged by the array —
+ *      `isCore` reads the scalar only (RFC 0165 §A.2, §Alternatives 6).
+ *
+ * A host that omits the array is conformant (`inapplicable`, not a pass).
+ *
+ * @see RFCS/0165-v2-preparation-wire-shapes.md §A
+ * @see spec/v1/version-negotiation.md §"Protocol version grammar"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import { driver } from '../lib/driver.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { isCore, type DiscoveryPayload } from '../lib/profiles.js';
+import { softSkip } from '../lib/soft-skip.js';
+
+interface CapsSchema {
+  $schema: string;
+  properties: {
+    protocolVersion?: { pattern?: string };
+    protocolVersions?: { type?: string; minItems?: number; uniqueItems?: boolean; items?: { pattern?: string } };
+  };
+}
+
+const caps = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'capabilities.schema.json'), 'utf8')) as CapsSchema;
+
+describe('protocol-versions-array: schema shape (RFC 0165 §A.1, server-free)', () => {
+  it('declares root `protocolVersions` as a unique, non-empty string array', () => {
+    const p = caps.properties.protocolVersions;
+    expect(p, 'RFC 0165 §A.1: capabilities.schema.json MUST declare root `protocolVersions`').toBeDefined();
+    expect(p?.type).toBe('array');
+    expect(p?.minItems).toBe(1);
+    expect(p?.uniqueItems).toBe(true);
+  });
+
+  it('item grammar equals the scalar grammar (one axis, one grammar)', () => {
+    expect(
+      caps.properties.protocolVersions?.items?.pattern,
+      'RFC 0165 §A.1: protocolVersions items MUST use the RFC 0149 §C grammar, not the A2A item pattern',
+    ).toBe(caps.properties.protocolVersion?.pattern);
+  });
+
+  it('accepts ["1.11", "2.0"], rejects "01.0", "1.0.0", duplicates, and empty', () => {
+    const ajv = new Ajv2020({ allErrors: true, strict: false });
+    const validate = ajv.compile({ $schema: caps.$schema, ...(caps.properties.protocolVersions as Record<string, unknown>) });
+    expect(validate(['1.11', '2.0'])).toBe(true);
+    expect(validate(['01.0'])).toBe(false);
+    expect(validate(['1.0.0'])).toBe(false);
+    expect(validate(['1.0', '1.0'])).toBe(false);
+    expect(validate([])).toBe(false);
+  });
+});
+
+describe('protocol-versions-array: advertisement (RFC 0165 §A.2 — presence-gated)', () => {
+  const GRAMMAR = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+
+  it('when advertised, every item matches the grammar, items are unique, and the array contains protocolVersion', async () => {
+    const res = await driver.get('/.well-known/openwop', { authenticated: false });
+    const doc = res.json as Record<string, unknown>;
+    const arr = doc['protocolVersions'];
+    if (arr === undefined) {
+      return softSkip('inapplicable', 'host does not advertise protocolVersions (RFC 0165 §A — optional in v1.x)');
+    }
+    expect(Array.isArray(arr), driver.describe('RFC 0165 §A.1', 'protocolVersions MUST be an array')).toBe(true);
+    const items = arr as unknown[];
+    expect(items.length, driver.describe('RFC 0165 §A.1', 'protocolVersions MUST be non-empty')).toBeGreaterThan(0);
+    for (const v of items) {
+      expect(typeof v === 'string' && GRAMMAR.test(v), driver.describe('RFC 0165 §A.1', `protocolVersions item ${JSON.stringify(v)} MUST match the RFC 0149 §C grammar`)).toBe(true);
+    }
+    expect(new Set(items).size, driver.describe('RFC 0165 §A.1', 'protocolVersions items MUST be unique')).toBe(items.length);
+    expect(items, driver.describe('RFC 0165 §A.2', 'protocolVersions MUST contain the value of protocolVersion')).toContain(doc['protocolVersion']);
+  });
+
+  it('profile derivation is unchanged by the array (isCore reads the scalar only)', async () => {
+    const res = await driver.get('/.well-known/openwop', { authenticated: false });
+    const doc = res.json as DiscoveryPayload & Record<string, unknown>;
+    if (doc['protocolVersions'] === undefined) {
+      return softSkip('inapplicable', 'host does not advertise protocolVersions (RFC 0165 §A — optional in v1.x)');
+    }
+    const without = { ...doc } as Record<string, unknown>;
+    delete without['protocolVersions'];
+    expect(
+      isCore(doc),
+      driver.describe('RFC 0165 §A.2', 'openwop-discovery-core derivation MUST NOT depend on protocolVersions in v1.x'),
+    ).toBe(isCore(without as DiscoveryPayload));
+  });
+});

package/src/scenarios/webhook-signed-delivery.test.ts

@@ -323,6 +323,28 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
       driver.describe('webhooks.md §"Delivery headers"', 'X-openwop-Signature MUST be sha256=HMAC-SHA256(secret, `${X-openwop-Timestamp}.${rawBody}`)'),
     ).toBe(expected);
 
+    // RFC 0165 §C.1 — dual emission of the `OpenWOP-*` family. SHOULD-level and
+    // presence-gated: when the new family is present, every value MUST equal its
+    // `X-openwop-*` counterpart and the signature verifies reading either.
+    const dual = first.headers['openwop-signature'];
+    if (dual === undefined) {
+      softSkip('inapplicable', 'host does not yet dual-emit the OpenWOP-* webhook header family (RFC 0165 §C.1 — SHOULD)');
+    } else {
+      for (const [neu, old] of [
+        ['openwop-webhook-id', 'x-openwop-webhook-id'],
+        ['openwop-event-type', 'x-openwop-event-type'],
+        ['openwop-timestamp', 'x-openwop-timestamp'],
+        ['openwop-signature', 'x-openwop-signature'],
+        ['openwop-signature-algorithm', 'x-openwop-signature-algorithm'],
+      ] as const) {
+        expect(first.headers[neu], driver.describe('RFC 0165 §C.1', `${neu} MUST equal ${old} when the OpenWOP-* family is emitted`)).toBe(first.headers[old]);
+      }
+      expect(
+        String(dual).replace('sha256=', ''),
+        driver.describe('RFC 0165 §C.1', 'OpenWOP-Signature MUST verify over the same bytes as X-openwop-Signature'),
+      ).toBe(expected);
+    }
+
     // Body should parse as JSON with a run event shape.
     const event = JSON.parse(first.body) as { type?: unknown; runId?: unknown };
     expect(typeof event.type).toBe('string');