@openwop/openwop-conformance 1.162.0 → 2.0.0-rc.0

package/README.md

@@ -16,6 +16,15 @@ The suite is intentionally self-contained — it does NOT depend on the referenc
 
 ---
 
+
+## Suite 2.0.0 (v2 charter Phase 3; RFC 0168) — what changed for hosts
+
+- **The contract is a peer package.** `@openwop/openwop-conformance@2.x` no longer vendors `api/` and `schemas/`; it declares `@openwop/spec-artifacts` as an exact-pinned peer dependency (install both), resolves the installed peer through Node's resolver, and refuses to start when the peer's version or `CORPUS-STAMP.json` digest differs from `dist/spec-artifacts.lock.json` (RFC 0168 §D.2). `schemas/CORPUS-STAMP.json` in this package is a copy of the peer's stamp, kept at the path hosts already read for provenance.
+- **`--target-major 1|2`** (RFC 0168 §D.3): one package runs the scenarios for either protocol major; `scenario-majors.json` names each file's majors; the default comes from the host's root `preferredVersion` (RFC 0179), else `max(protocolVersions[])`, else 1.
+- **`req()` is the only assertion form** (RFC 0168 §A.1): every assertion carries a requirement id; `requirements.json` lists every id; `requirement-aliases.json` maps a reworded id to its successor. `scripts/check-req-only.mjs` is the gate.
+- **Corpus-coherence scenarios never run against a host.** They live in `src/coherence/`, run in the spec repo's CI (`scripts/check-spec-coherence.mjs`) and produce `evidence/corpus-ledger.json`; a host bundle never contains them. The `--offline` set is `fixtures-valid` only.
+- **1.x continues on `release/1.x`** (`openwop-conformance/v1.16x.y` tags); pre-release 2.x versions publish under the npm dist-tag `next`.
+
 ## Quickstart
 
 Two ways to run: the friendly `openwop-conformance` CLI (recommended for
@@ -103,7 +112,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 473 scenario files under `src/scenarios/`.
+The current suite has 444 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -448,7 +457,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 473 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 444 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -57,6 +57,7 @@ function parseArgs(argv) {
     // `--bundle-version 1` through the RFC 0148 migration window (ends
     // 2026-11-10) and is removed at v2.0 (spec/v1/deprecations.json).
     let bundleVersion = '2';
+    let targetMajor;
     let maxWorkers = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i] ?? '';
@@ -88,6 +89,15 @@ function parseArgs(argv) {
             case '--api-key':
                 apiKey = nextValue();
                 break;
+            case '--target-major': {
+                const v = argv[++i];
+                if (v !== '1' && v !== '2') {
+                    process.stderr.write(`openwop-conformance: --target-major must be 1 or 2 (got ${String(v)})\n`);
+                    process.exit(2);
+                }
+                targetMajor = v === '2' ? 2 : 1;
+                break;
+            }
             case '--filter':
                 filter = nextValue();
                 break;
@@ -133,6 +143,7 @@ function parseArgs(argv) {
         implVersion,
         certify,
         bundleVersion,
+        targetMajor,
         maxWorkers,
     };
 }
@@ -169,6 +180,9 @@ Implementation labels (cosmetic — surface in failure messages):
   --impl-version <version>  Implementation version     (env: OPENWOP_IMPLEMENTATION_VERSION)
 
 Certification (RFC 0089):
+  --target-major <1|2>    Suite 2.0.0 (RFC 0168 §D.3): run the scenarios for this protocol
+                          major. Default: the host's preferredVersion (RFC 0179), else
+                          max(protocolVersions[]), else 1. Selection is scenario-majors.json.
   --bundle-version <1|2>  Certification bundle format. Default 2 (corrected 2026-09-03, RFC 0168 §E.4; the text said 1 while the code set 2). Version 2 (RFC 0148
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
@@ -272,6 +286,34 @@ function scenarioStatesFromReport(report) {
     return states;
 }
 /** Generate + validate + write an RFC 0089 conformance certification bundle. */
+/**
+ * Suite 2.0.0 — resolve the target major (RFC 0168 §D.3 / RFC 0179): the flag,
+ * else the host's root `preferredVersion`, else max(protocolVersions[]), else 1.
+ * Returns the major and the scenario files that target it (scenario-majors.json).
+ */
+async function resolveTargetMajor(args, baseUrl, apiKey, conformanceRoot) {
+    let major = args.targetMajor;
+    let source = 'flag';
+    if (major === undefined && baseUrl) {
+        try {
+            const res = await fetch(`${baseUrl.replace(/\/$/, '')}/.well-known/openwop`, { headers: apiKey ? { authorization: `Bearer ${apiKey}` } : {} });
+            const doc = (await res.json());
+            const pv = doc.preferredVersion ?? (doc.protocolVersions ?? []).map((v) => v).sort((a, b) => Number(b.split('.')[0]) - Number(a.split('.')[0]))[0];
+            if (pv) {
+                major = Number(pv.split('.')[0]) >= 2 ? 2 : 1;
+                source = doc.preferredVersion ? 'preferredVersion' : 'max(protocolVersions[])';
+            }
+        }
+        catch { /* unreachable host: the default below; the run itself will report the failure */ }
+    }
+    if (major === undefined) {
+        major = 1;
+        source = 'default';
+    }
+    const manifest = JSON.parse(readFileSync(resolvePath(conformanceRoot, 'scenario-majors.json'), 'utf8'));
+    const files = Object.entries(manifest.majors).filter(([, m]) => m.includes(major)).map(([f]) => `src/scenarios/${f}`);
+    return { major, files, source };
+}
 async function runCertify(args, baseUrl, apiKey) {
     const outPath = args.certify;
     if (outPath === undefined)
@@ -312,6 +354,9 @@ async function runCertify(args, baseUrl, apiKey) {
         env.OPENWOP_IMPLEMENTATION_NAME = args.impl;
     if (args.implVersion)
         env.OPENWOP_IMPLEMENTATION_VERSION = args.implVersion;
+    const target = await resolveTargetMajor(args, baseUrl, apiKey, conformanceRoot);
+    env.OPENWOP_TARGET_MAJOR = String(target.major);
+    process.stderr.write(`openwop-conformance --certify: target major ${target.major} (${target.source}); ${target.files.length} scenario file(s)\n`);
     const vitestArgs = [
         'vitest',
         'run',
@@ -320,6 +365,8 @@ async function runCertify(args, baseUrl, apiKey) {
         '--reporter=json',
         `--outputFile=${reportFile}`,
         ...maxWorkersArgs(args.maxWorkers),
+        ...(args.filter ? ['--testNamePattern', args.filter] : []),
+        ...target.files,
     ];
     const runResult = spawnSync('npx', vitestArgs, { cwd: conformanceRoot, env, stdio: 'inherit' });
     if (runResult.error) {
@@ -420,7 +467,7 @@ async function runCertify(args, baseUrl, apiKey) {
         // the discovery it saw. Two runs against differently-configured hosts are
         // different evidence, and this is what says so.
         const configSha = createHash('sha256')
-            .update(`${args.baseUrl}\n${sha256}\n${process.env['OPENWOP_REQUIRE_BEHAVIOR'] ?? ''}`, 'utf8')
+            .update(`${baseUrl}\n${sha256}\n${process.env['OPENWOP_REQUIRE_BEHAVIOR'] ?? ''}`, 'utf8')
             .digest('hex');
         // Rows come from the ledger (S6). A file that recorded nothing is
         // `blocked` — unclassified — and, if it sits on a claimed floor, rejected above.
@@ -571,6 +618,12 @@ async function main() {
     // ancestor config (e.g., a parent monorepo's vite.config.ts) when
     // the conformance package is used as a workspace member.
     const vitestArgs = ['run', '--config', resolvePath(conformanceRoot, 'vitest.config.ts')];
+    const target = await resolveTargetMajor(args, env.OPENWOP_BASE_URL, env.OPENWOP_API_KEY, conformanceRoot);
+    env.OPENWOP_TARGET_MAJOR = String(target.major);
+    if (!args.offline) {
+        process.stderr.write(`openwop-conformance: target major ${target.major} (${target.source}); ${target.files.length} scenario file(s)\n`);
+        vitestArgs.push(...target.files);
+    }
     if (args.offline) {
         // Suite 1.154.0: the offline set is a DECLARED property of the package —
         // exactly the server-free scenarios that ship in the tarball and run in

package/dist/lib/paths.js

@@ -35,6 +35,7 @@
  */
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 import { dirname, join, resolve as pathResolve } from 'node:path';
 // `dirname(fileURLToPath(import.meta.url))` for an ESM module compiled or
 // run from `src/lib/paths.ts` returns `<pkg>/src/lib/`. The conformance
@@ -43,7 +44,22 @@ import { dirname, join, resolve as pathResolve } from 'node:path';
 // identical between the two; only the parent of `<pkg>` differs.
 const HERE = dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = pathResolve(HERE, '..', '..');
-function resolveFromRoot(root, layout) {
+/**
+ * Suite 2.0.0 (RFC 0168 §D.2): in the published layout the CONTRACT (api/ and
+ * schemas/) is the `@openwop/spec-artifacts` peer package, not files vendored
+ * into this tarball. Resolve its root through Node's resolver from this package
+ * so the host's installed peer is what the suite validates against.
+ */
+function resolvePeerRoot() {
+    try {
+        const req = createRequire(join(PKG_ROOT, 'package.json'));
+        return dirname(req.resolve('@openwop/spec-artifacts/package.json'));
+    }
+    catch {
+        return null;
+    }
+}
+function resolveFromRoot(root, layout, contractRoot = root) {
     // Two on-disk shapes for the layout root:
     //   - Repo: <root>/schemas, <root>/api, <root>/conformance/fixtures,
     //           <root>/conformance/{fixtures.md,coverage.md}, <root>/spec/v1/*.md
@@ -52,8 +68,8 @@ function resolveFromRoot(root, layout) {
     //           <root>/fixtures.md (when bundled), no spec/v1.
     // Probe by checking whether `schemas/` lives at the conformance pkg root
     // (vendored) vs one level up (repo).
-    const schemasDir = join(root, 'schemas');
-    const apiDir = join(root, 'api');
+    const schemasDir = join(contractRoot, 'schemas');
+    const apiDir = join(contractRoot, 'api');
     const repoFixturesDir = join(root, 'conformance', 'fixtures');
     const vendoredFixturesDir = join(root, 'fixtures');
     const fixturesDir = existsSync(repoFixturesDir) ? repoFixturesDir : vendoredFixturesDir;
@@ -131,7 +147,13 @@ function resolveLayout() {
     if (parentHasSchemas) {
         return resolveFromRoot(parent, 'repo');
     }
+    const peer = resolvePeerRoot();
+    if (peer) {
+        return resolveFromRoot(PKG_ROOT, 'published', peer);
+    }
     if (pkgHasSchemas) {
+        // A pre-2.0 tarball layout (schemas vendored in-package); kept so an old
+        // layout still resolves, but the 2.x stamp check refuses to run without the peer.
         return resolveFromRoot(PKG_ROOT, 'published');
     }
     // Neither — return the published-style resolution rooted at PKG_ROOT

package/dist/lib/requirement-ids.js

@@ -24,6 +24,20 @@
  * `~3`, … (vitest allows duplicate titles; the ledger does not allow duplicate
  * ids). A scenario MAY override the derived id for the current test with
  * `req()` when it wants a hand-authored, registry-listed id.
+ *
+ * requireExplicitIds (suite 2.0.0, RFC 0168 §A.1): from 2.0.0 `req(id, section,
+ * requirement)` is the ONLY assertion-message form in `src/scenarios` and
+ * `src/coherence` — `driver.describe(section, requirement)` is gone from every
+ * scenario, and `scripts/check-req-only.mjs` (root) fails the gate when a
+ * scenario reintroduces it, when an `expect` carries a bare string message,
+ * when an `it` body returns without `softSkip` / `seamAbsent`, or when two
+ * `it`s in one file share an explicit id. Every `it` therefore names the
+ * requirement it witnesses on the wire; the title-derived allocator below is
+ * the fallback for an `it` that makes no cited assertion at all. The ids the
+ * 2.0.0 sweep wrote are exactly the ids the allocator derived in 1.x (same
+ * stem + slug + `~n` order), so no bundle id changed at the cut-over; an `it`
+ * with an interpolated title carries a hand-minted id from the static parts of
+ * its title, unique within the file.
  */
 export const IT_ID_PREFIX = 'openwop.it.';
 export const IT_ID_GRAMMAR = /^openwop\.it\.[a-z0-9]+(?:-[a-z0-9]+)*\.[a-z0-9]+(?:-[a-z0-9]+)*(?:~[2-9][0-9]*)?$/;
@@ -64,7 +78,12 @@ export class ItIdAllocator {
     seen = new Map();
     allocate(scenarioFile, title) {
         const base = itRequirementId(scenarioFile, title);
-        const n = (this.seen.get(base) ?? 0) + 1;
+        let n = (this.seen.get(base) ?? 0) + 1;
+        // An id a sibling `it` already claimed through `req()` never reached this
+        // allocator, so a same-titled `it` that cites nothing must skip past it —
+        // otherwise the first explicit `exists` and the derived `exists` collide.
+        while (claimedExplicit.has(n === 1 ? base : `${base}~${n}`))
+            n++;
         this.seen.set(base, n);
         return n === 1 ? base : `${base}~${n}`;
     }
@@ -76,21 +95,32 @@ export class ItIdAllocator {
 // Explicit override for the current test.
 // ---------------------------------------------------------------------------
 let explicitId = null;
+/** Every id handed to `req()` in this worker — consulted by `ItIdAllocator`. */
+const claimedExplicit = new Set();
 /**
  * Attach a hand-authored requirement id to the CURRENT test. The per-`it`
  * ledger row for this test is recorded under `id` instead of the derived
- * title id. Returns the usual `driver.describe`-style message so the call
- * doubles as the assertion message:
+ * title id. Returns the SAME message shape `driver.describe` returns —
+ * `[<impl>@<version>] <section>: <requirement>` — so a failure still names
+ * the implementation under test:
  *
  *   expect(x, req('openwop.auth.subject-link.leaver-deny', 'auth-profiles.md §Subject linking', 'deactivation MUST deny')).toBe(true)
  *
+ * The implementation label is read straight from `OPENWOP_IMPLEMENTATION_NAME`
+ * / `OPENWOP_IMPLEMENTATION_VERSION` with the defaults `env.ts` uses (`unknown`)
+ * rather than through `loadEnv()`, so a suite self-test can call `req()`
+ * without `OPENWOP_BASE_URL` set.
+ *
  * The id MUST be listed in `conformance/requirements.json` (the generator
  * collects `req(` first-argument literals); an unlisted id fails the registry
  * check, so a hand id cannot drift from the registry silently.
  */
 export function req(id, specSection, requirement) {
     explicitId = id;
-    return `${specSection}: ${requirement}`;
+    claimedExplicit.add(id);
+    const impl = process.env['OPENWOP_IMPLEMENTATION_NAME']?.trim() ?? 'unknown';
+    const version = process.env['OPENWOP_IMPLEMENTATION_VERSION']?.trim() ?? 'unknown';
+    return `[${impl}@${version}] ${specSection}: ${requirement}`;
 }
 /** setup.ts reads and clears the override after each test. */
 export function takeExplicitRequirementId() {

package/dist/lib/scenario-disposition.js

@@ -110,6 +110,7 @@ export function resolveFileRecord(states, gateReason, assertionCount, noted, spe
     // CERTIFIABLE, so these rows stop counting against a host that cannot affect
     // them. See lib/spec-coherence.ts for why not a new disposition value.
     if (specCoherenceFile !== undefined
+        && process.env.OPENWOP_CORPUS_GATE !== '1' // suite 2.0.0: under the corpus gate the coherence scenario IS the subject
         && SPEC_COHERENCE_SCENARIOS.has(specCoherenceFile)
         && !states.includes('fail')
         && assertionCount === 0) {

package/dist/lib/spec-coherence.js

@@ -79,38 +79,19 @@
  * disjoint and jointly exhaustive over the `V1_DIR`-gated files, and a comment
  * is no longer the only place the exclusion reason lives.
  */
-/** Scenarios whose subject is the corpus. Kept honest by `spec-coherence-registry.test.ts`. */
-export const SPEC_COHERENCE_SCENARIOS = new Set([
-    'artifact-schema-compile-bounded.test.ts',
-    'artifact-type-legacy-ids.test.ts',
-    'capability-example-root-layout.test.ts',
-    'certification-floor-enforcement.test.ts',
-    'chain-subchain-unsupported-refused.test.ts',
-    'compensation-profile.test.ts',
-    'core-manifest-and-extension-registry.test.ts',
-    'discovery-canonical-family-no-shadow.test.ts',
-    'edge-condition-truthy-falsy.test.ts',
-    'effect-identity-composition.test.ts',
-    'effect-identity-cross-scope.test.ts',
-    'error-envelope-canonical-shape.test.ts',
-    'event-codemap-complete.test.ts',
-    'form-content-packs.test.ts',
-    'multi-region-effect-vocabulary.test.ts',
-    'normative-example-extraction.test.ts',
-    'openapi-asyncapi-sdk-parity.test.ts',
-    'pack-manifest-extensions.test.ts',
-    'protocol-version-grammar.test.ts',
-    'registry-declarative-kinds.test.ts',
-    'rfc-0147-self-audit.test.ts',
-    'rfc-lifecycle-coherence.test.ts',
-    'semantic-digest-v2.test.ts',
-    'spec-corpus-validity.test.ts',
-    'spec-section-citations.test.ts',
-    'tool-result-trust-monotone.test.ts',
-    'versioned-composition-profiles.test.ts',
-    'workflow-chain-internal-flag.test.ts',
-    'workload-identity-profile.test.ts',
-]);
+/**
+ * Scenarios whose subject is the corpus. Suite 2.0.0 (RFC 0168 §D.1): they
+ * live in `src/coherence/`, not `src/scenarios/`, and the set is the DIRECTORY
+ * LISTING — one source of truth instead of four (this list, the package.json
+ * negations, spec-coherence-scenarios.json and the registry self-test used to
+ * each carry a copy). They run in the spec repo's CI (scripts/check-spec-coherence.mjs)
+ * and never enter a host bundle; the published tarball excludes the directory.
+ */
+import { existsSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+const COHERENCE_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'coherence');
+export const SPEC_COHERENCE_SCENARIOS = new Set(existsSync(COHERENCE_DIR) ? readdirSync(COHERENCE_DIR).filter((f) => f.endsWith('.test.ts')).sort() : []);
 /**
  * Scenarios that gate on `V1_DIR` **and** drive the host, so their `blocked` is
  * honest: advertised behaviour a missing dependency prevented exercising.

package/dist/spec-artifacts.lock.json

@@ -0,0 +1,5 @@
+{
+  "package": "@openwop/spec-artifacts",
+  "version": "2.0.0-rc.0",
+  "stampSha256": "9596838d163c3c9bc51311776e20216fa6abcd9d315077af05f5301bab4fdcd9"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.162.0",
+  "version": "2.0.0-rc.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -20,7 +20,7 @@
     "coverage.md",
     "requirements.json",
     "requirement-aliases.json",
-    "api",
+    "scenario-majors.json",
     "schemas",
     "vectors",
     "vitest.config.ts",
@@ -28,35 +28,7 @@
     "CHANGELOG.md",
     "LICENSE",
     "!src/lib/*.test.ts",
-    "!src/scenarios/artifact-schema-compile-bounded.test.ts",
-    "!src/scenarios/artifact-type-legacy-ids.test.ts",
-    "!src/scenarios/capability-example-root-layout.test.ts",
-    "!src/scenarios/certification-floor-enforcement.test.ts",
-    "!src/scenarios/chain-subchain-unsupported-refused.test.ts",
-    "!src/scenarios/compensation-profile.test.ts",
-    "!src/scenarios/core-manifest-and-extension-registry.test.ts",
-    "!src/scenarios/discovery-canonical-family-no-shadow.test.ts",
-    "!src/scenarios/edge-condition-truthy-falsy.test.ts",
-    "!src/scenarios/effect-identity-composition.test.ts",
-    "!src/scenarios/effect-identity-cross-scope.test.ts",
-    "!src/scenarios/error-envelope-canonical-shape.test.ts",
-    "!src/scenarios/event-codemap-complete.test.ts",
-    "!src/scenarios/form-content-packs.test.ts",
-    "!src/scenarios/multi-region-effect-vocabulary.test.ts",
-    "!src/scenarios/normative-example-extraction.test.ts",
-    "!src/scenarios/openapi-asyncapi-sdk-parity.test.ts",
-    "!src/scenarios/pack-manifest-extensions.test.ts",
-    "!src/scenarios/protocol-version-grammar.test.ts",
-    "!src/scenarios/registry-declarative-kinds.test.ts",
-    "!src/scenarios/rfc-0147-self-audit.test.ts",
-    "!src/scenarios/rfc-lifecycle-coherence.test.ts",
-    "!src/scenarios/semantic-digest-v2.test.ts",
-    "!src/scenarios/spec-corpus-validity.test.ts",
-    "!src/scenarios/spec-section-citations.test.ts",
-    "!src/scenarios/tool-result-trust-monotone.test.ts",
-    "!src/scenarios/versioned-composition-profiles.test.ts",
-    "!src/scenarios/workflow-chain-internal-flag.test.ts",
-    "!src/scenarios/workload-identity-profile.test.ts"
+    "!src/coherence"
   ],
   "scripts": {
     "test": "vitest run",
@@ -66,7 +38,9 @@
     "build:cli": "tsc -p tsconfig.build.json && chmod +x dist/cli.js",
     "cli": "tsx src/cli.ts",
     "prepack": "bash scripts/pack-vendor.sh",
-    "postpack": "rm -rf api schemas"
+    "postpack": "rm -rf schemas",
+    "test:coherence": "vitest run --config vitest.coherence.config.ts",
+    "test:self": "vitest run --config vitest.selftest.config.ts"
   },
   "engines": {
     "node": ">=20"
@@ -78,6 +52,10 @@
   },
   "devDependencies": {
     "typescript": "^5.6.0",
-    "@types/node": "^22.0.0"
+    "@types/node": "^22.0.0",
+    "@openwop/spec-artifacts": "file:../spec-artifacts"
+  },
+  "peerDependencies": {
+    "@openwop/spec-artifacts": "2.0.0-rc.0"
   }
 }