@openwop/openwop-conformance 1.163.0 → 2.0.0-rc.1

package/schemas/CORPUS-STAMP.json

@@ -1,13 +1,18 @@
 {
-  "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md §\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.163.0",
-  "corpusCommit": "4ae34fdd2f3859a80b3dedb0ae1ad4e7dd7af5c1",
+  "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
+  "package": "@openwop/spec-artifacts",
+  "version": "2.0.0-rc.1",
+  "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
+    "api/seams-v2.yaml": "52fef8b9294f66a4b0bbf2fa53e6295808b643c8330418c478b4062e30952dd7",
+    "api/v2/asyncapi.yaml": "1362b62925d194848b269911ef7aedba46da07160dbc6f0a5c1438669d612855",
+    "api/v2/openapi.yaml": "834cdda6d57322f42061a60d8bb3b89cad8e51361506e59cb269251b8c30b86b",
+    "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
     "schemas/a2ui-surface-delta-frame.schema.json": "970d434e4fdcb925de64aaace91eb83bfbcfd8f76757a9ce9f339eda5fb3f4e8",
@@ -93,10 +98,137 @@
     "schemas/trigger-subscription-registration.schema.json": "929d628bad08e1def696e47e9a148aba00fa801e28d49bbd0dc2360b08673435",
     "schemas/trigger-subscription.schema.json": "4f7b067f20032073b140c4bb15dc9a9914c4f6421a252ff1ff261cbdd8edf270",
     "schemas/ui-plugin-message.schema.json": "346638babf1f8ea7b161cde75c0038b518cd2cc5bf0631772e20a9b74c96b5dd",
+    "schemas/v2/a2a-task-state.schema.json": "aa9bd0c15f653b7ecdb17427d61b1bccaf8156972c4b1a437dd3a8afb717b318",
+    "schemas/v2/a2ui-surface-delta-frame.schema.json": "43c10ebfd13c987520f0448df92fe74b52b846833763dfbbd5d35636bf75e8d9",
+    "schemas/v2/agent-deployment-transition.schema.json": "5871ec764f531b2d34a6bb8b2e16efd35aad642664ca6d41411ba8d699fd759e",
+    "schemas/v2/agent-deployment.schema.json": "61979201c850c69360a0840f3e23373284b5445b6c11212012ea53d33be9a6e7",
+    "schemas/v2/agent-eval-suite.schema.json": "77c4bb06f5e21584994d4b4aaafc2304904008a51f0c6d8892794d7074e4f6b5",
+    "schemas/v2/agent-inventory-response.schema.json": "bbf19724986a867a59ef51c115a43ece1cc4a003836b2f7f45dfefb3078db8f9",
+    "schemas/v2/agent-manifest.schema.json": "006ca6163ca8f9dc9fb91ca1ce01bd4c523f118680f6cbad971a4ac09e975381",
+    "schemas/v2/agent-org-chart.schema.json": "e64f1bcc6c0e9d3fc39c363e8e5e73b2b1fc49275b92f89b0cb941a7a80d67f2",
+    "schemas/v2/agent-ref.schema.json": "a86e98f7ffcbc4d7da145633e3010842e05e23e153d53c431d28dd72da0ec9de",
+    "schemas/v2/agent-roster-entry.schema.json": "801c7d7aca7bd497df56fdaa68b671eef5193d2b96eb836a8bf438790cb1f0e2",
+    "schemas/v2/agent-roster-response.schema.json": "682d1d1f4c184b14488a270de54c71a685e400e0184e88564cc01e2400367c5b",
+    "schemas/v2/ai-envelope.schema.json": "0dc7dfbf032a37239ffd81fc2d67f999a40782ff5074866a56e414164cdee809",
+    "schemas/v2/annotation-create.schema.json": "c2fc19d055be29bc499e53c4975a562eb76981e12c521a82f63f5827ac6ff6c7",
+    "schemas/v2/annotation.schema.json": "75c6785775d00e62bc1282626c2c27eafde0f93a01c7e80e4e5e985055907475",
+    "schemas/v2/artifact-type-pack-manifest.schema.json": "c911757562e521cb4f31a47c097f562573b64087efe60c8acb81fd352367d300",
+    "schemas/v2/audit-verify-result.schema.json": "cb54c4d89ba5dfb73f49aa8959a980be65c2dc2a87a12f71ba36d3e836fe85da",
+    "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
+    "schemas/v2/capabilities.schema.json": "b6191deddf6bee19470eee9a45bb520de0d17385c195de6e3b8c5cb6d9520238",
+    "schemas/v2/certification-bundle.schema.json": "02aa15f17644d902a9df06a99cfdaf51273b0a9cca0d0ef515d5da03be01fb09",
+    "schemas/v2/channel-presence-payload.schema.json": "9475d46f358d21c19126e78204987a5633979917a2293653354ef5c5e044d54e",
+    "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
+    "schemas/v2/chat-card-pack-manifest.schema.json": "566982ce509a96d1619d58a72e383eff0773fe43fc65e4bfc85a4fe158f4eaff",
+    "schemas/v2/compact-tool-descriptor.schema.json": "fc03f20c254c0ddc2cba7e7d5a6c46080ebd2cf9fae36f3c2510cbf88aadebdc",
+    "schemas/v2/compensation-policy.schema.json": "b3c1142637f5bf980f2b0bb67adb47e8cb7abb99a0405a4b6816ccf5d9c089d6",
+    "schemas/v2/compensation-projection.schema.json": "f46977c7076347b5473faa8c4bbe73d8321c33b33c98fff2f26ee7cbada4ed98",
+    "schemas/v2/configurable.schema.json": "33a6884047e2490f723733bf8b74d3b9164e00374cfea6dc3eac5a70dc368861",
+    "schemas/v2/connection-pack-manifest.schema.json": "7410a3011b28829b286e3ff764bdb283854dca69ea4b71a8441f8c1c4f1cc948",
+    "schemas/v2/conversation-event.schema.json": "80833d0bf72245118d23e5aebdf497aa5a4c79b0b53c262f38b6489753557f33",
+    "schemas/v2/conversation-turn.schema.json": "4c24aa85dd83f6ad00945b4a13ee8ff0a071893e884011e9289a07e97d22989d",
+    "schemas/v2/credential-provenance.schema.json": "f86b09e94b1c524dec7d1c6353965665ae8891e9517faef6e742d639c5578c99",
+    "schemas/v2/credential-reference.schema.json": "ea699ce30f58fb2c32d4279158b3f730f70be7b2dc8c3037693a76e66eb3e001",
+    "schemas/v2/debug-bundle.schema.json": "e792a588131290bccce3042a279e8e57677018df94b0861bee2b2b98a9ea2124",
+    "schemas/v2/dispatch-config.schema.json": "4a7db312e6b4a14cf5b1ad2b71367878c77b6321cc456f5b3644dd6434e94cbd",
+    "schemas/v2/effect-ledger-projection.schema.json": "9e690f8e5dbf9aa7c82eef4bf7cf96c024f0f8626ad5bbaca3ff25ac63c7cab2",
+    "schemas/v2/effect-seam-manifest.schema.json": "3402a2956c810b2bfa9ec1ad0cb79d607ecea122cbe7d1e05184af006b06ef15",
+    "schemas/v2/envelopes/clarification.request.schema.json": "9e39d7b09f0b3ce7902d6aa19ca0eb52867b634efc78a881469c4d44fb3333e7",
+    "schemas/v2/envelopes/error.schema.json": "6a11fa3b9d61736fcb5675e6ac9825919aa609dceba13ef5615993d54647802b",
+    "schemas/v2/envelopes/media.audio.schema.json": "a422352240a592c12840172e70835729f72b6b21915d14e926b6ffcd5d52a704",
+    "schemas/v2/envelopes/media.file.schema.json": "1a6ec46d5b987f5b4a95054f4c04c2dca712409ccaf4bc3ea3c92c0f6e0acd99",
+    "schemas/v2/envelopes/media.image.schema.json": "1373a145e4d25c1ea43fbe342a7a71ace370d6344459c2698d7904545ee40789",
+    "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
+    "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
+    "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "0a06fbbdc8ba797a6818c79336a98e211ac5ba5747945b4e4098072cd3974d79",
+    "schemas/v2/error-envelope.schema.json": "d550beeab958b528c8734fd32e74c438006b99172c5c586f9e0af20ef4b2bee7",
+    "schemas/v2/eval-summary.schema.json": "dfc995c8481ed212e6f3d83de982547898a7938be8c891ddb0d3efe84352908d",
+    "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
+    "schemas/v2/form-content-pack-manifest.schema.json": "307884e57946703b6f86ec283034bf56beb68bea4a000743ebbc9eebeed31b07",
+    "schemas/v2/frontend-plugin-manifest.schema.json": "fed6b8ddb3056c53b1bfc91525410a4445a3c37a8bf9eb9f6f9964ffea26d993",
+    "schemas/v2/goal.schema.json": "d202ef21ed3dbff87c25fd4b553fa978862a3200999878d25c5918f6794b3060",
+    "schemas/v2/heartbeat-evaluated.schema.json": "4086b1ba1d0547c08b038dfb263ac89416a3e406430db1250156fb2f9b74f8d6",
+    "schemas/v2/heartbeat-state-changed.schema.json": "eb68d0082aa996650e3a6b8ccf32457f959cebc7e6728cc7c331b9d171a4bef6",
+    "schemas/v2/ids.schema.json": "0ccf5eb3ec0744296b3379f7ced3b46ec51d908705a4f03dc4404d42236ebe19",
+    "schemas/v2/localized-content-language-settings.schema.json": "92240f19a2b4b2f05ab41a797f703485a28813848035478e72f395edd04c1d35",
+    "schemas/v2/localized-content-page-response.schema.json": "476b5f2775b42e35e679814a4ce846a7be1d5311d3a748c10df4275a78b0fb27",
+    "schemas/v2/localized-content-page.schema.json": "717bb51fbc64d0b34eb0a4b35c8b463d08d505267bf251b4cbc67e0a016a567a",
+    "schemas/v2/localized-content-section.schema.json": "29c7bad0ad9ebc6c45211282e8afb3fdb35a4ca075ce0404b6e2c29f35fa5313",
+    "schemas/v2/memory-entry.schema.json": "290576ae84f4fef4cdf975932b87963283b11c50ea3d2654b32cd96aa6537c3d",
+    "schemas/v2/memory-list-options.schema.json": "f66703bccb68efb28391c273abb66aa117ee5b5ce475c477846ed700c336afcd",
+    "schemas/v2/node-pack-manifest.schema.json": "771328fa73691e7f08fca3c628c4e8ba68fa4e43529faaf1a6358aecf26b13f2",
+    "schemas/v2/orchestrator-decision.schema.json": "2da17538e84cfbe70151eb118f1ccf670cff58b8697148e394074d32ac4af6b4",
+    "schemas/v2/org-chart-responsibility-view.schema.json": "ebac7d2889bfd659bcf30311efb0d6eb0c7e940b972b6b62da69c7351b5bb586",
+    "schemas/v2/pack-lockfile.schema.json": "2685417702c105146b780cd99154296a46578fbb10d81c8c713348ee26fea898",
+    "schemas/v2/prompt-kind.schema.json": "67251c937a5a91fb97c0422050e808dc0c162a9b8561366814cf87b0a7f62e00",
+    "schemas/v2/prompt-pack-manifest.schema.json": "a51667da3d601043d2c33fddaafa572e9dd7e47b8840393742b80eaf6238a1a5",
+    "schemas/v2/prompt-ref.schema.json": "11538fa36a7a652c93100cac4f1857eb4130137b546e3d94890618636d44b729",
+    "schemas/v2/prompt-template.schema.json": "494fc83028cb3af5dbb8a943d0e83b2348f7775e9fa02369162bcb58a6f81559",
+    "schemas/v2/proposal.schema.json": "72623553611f00e87b4c7972d69ebeba73c2222b01ead75a44a0c2114b679fea",
+    "schemas/v2/registry-version-manifest.schema.json": "270704ebc6bae63be949efbf9503578938b103733db9da3cb8fcbee1cd7684dd",
+    "schemas/v2/residency.schema.json": "af2658a7104cbcacd0e20a91226271c4a77f91ef46ae97612768fe743e6091d8",
+    "schemas/v2/run-ancestry-response.schema.json": "907e36341ba83a2147a5d76963950b6dcd47506b663ecbccae9dfa553f3724d3",
+    "schemas/v2/run-diff-response.schema.json": "6ab6cd265dc7e0a2086c6659c46aa0e7b43e6302949f0adac5d7deb1c7c0ecd3",
+    "schemas/v2/run-event-payloads.schema.json": "8eb0e05e1bd3399b0e2654a1ec5a13198ac4ec8459a1fcbfd800ab2d0a0ae8c6",
+    "schemas/v2/run-event.schema.json": "4ec8eb048a79ca1343e00aa018acbf86814b5eda6768add6b17e8d7b83638fdf",
+    "schemas/v2/run-options.schema.json": "6d6052596ab0f17acfb00fdfc89907da7724f952e5ffbe1f81d94ba23d4c77cd",
+    "schemas/v2/run-orchestrator-decided-event.schema.json": "bb76e15ff72e669f12938684033b55dc567470e1a378e19ffc3fa0e4034ab5a7",
+    "schemas/v2/run-snapshot.schema.json": "e77bf491d11c1414e62ed84cbf0c1d7149279b133a2101dc8f5eec89d3e45204",
+    "schemas/v2/security-advisory.schema.json": "6a382f737730a738d634266315e9d335e5760020a0cdd9f30727c2f987a01770",
+    "schemas/v2/self-hosted-runner-dispatch-frame.schema.json": "d8129f11d4e731d17ea951e66faaea2086081d13958b62ceaaa359fd6637dd7d",
+    "schemas/v2/self-hosted-runner-registration.schema.json": "93d60003a668cacb0eeac37699ca2884c6b79332d9494cb9e0a1752ac8f8a16c",
+    "schemas/v2/self-hosted-runner-result-frame.schema.json": "5a427362073720fb0e7b4a76143210083c017cac63e27eb3a91289bc7a443aaf",
+    "schemas/v2/subject-link.schema.json": "1fc941d6c14af886534009f2ffa6611e2035eb07e30b1df918c50d6bafff026c",
+    "schemas/v2/subject.schema.json": "094e981fb20052a911393e219ea5f2065d8b8417b65080a70c5ea99fd960a8fe",
+    "schemas/v2/suspend-request.schema.json": "28451d35f4f49a075d26b2be7e0d1cd2287a196b3d41819edf146fdc8c862756",
+    "schemas/v2/tool-descriptor.schema.json": "c7f96ddb5c5a1cda5a40078b9b70dd0026658c42c92394c369c54a0427458527",
+    "schemas/v2/trigger-event.schema.json": "7227fb9a130c33374fa8eab35e4448c4e8f22c962b8f271781cf4dbb5e4288b7",
+    "schemas/v2/trigger-subscription-registration.schema.json": "202f7ab9c29e78249e0ad04341ac53377b506d24a0cbfbb7bb54494e80165832",
+    "schemas/v2/trigger-subscription.schema.json": "074bec7f016aa9f4d60359c3a093296cc847045510f01e0a9dceaf4fa5084d12",
+    "schemas/v2/ui-plugin-message.schema.json": "879d65867c01656b3962d64283e66364dcb8f626ad26c5fcf2d2d55a79ae0ce9",
+    "schemas/v2/workflow-chain-pack-manifest.schema.json": "d1e43617ebacc9b32d1faf98dc7a2074d3e25054f383a1c264b87a19047f674d",
+    "schemas/v2/workflow-definition.schema.json": "91e422faacb886c8a17fc86b6576d38b7bfd99a37aaff69c710dec598e361192",
+    "schemas/v2/workload-identity.schema.json": "1f589debfac6d70e0908da511550ec69a27b4bcc8314551cd843b6d923605efc",
+    "schemas/v2/workspace-file-create.schema.json": "b6b5260857318c3b67de0231ed15e3a746f525880a763e7b36a7854178dd10d0",
+    "schemas/v2/workspace-file.schema.json": "d2ed39e8c229dde33b56905c8df6f8b2ff056c97e1c5f615e3124baa54a6254f",
     "schemas/workflow-chain-pack-manifest.schema.json": "c027571913c44d8d9678750c72701a710a02fa0df55e86849da03e13e95c333a",
     "schemas/workflow-definition.schema.json": "28b050ffe22121796c9d4a5a8c7e57c901bb283bd08d3fd3ff2ea25a898108c1",
     "schemas/workload-identity.schema.json": "64ed93e12cc9f0657e56ff9b8f045e5d68d397df5276d103c07f42c7f34f0579",
     "schemas/workspace-file-create.schema.json": "70a23b92c2958c0165d7d29aea9020a045dc7816af82c80c5f50d0aac19c4856",
-    "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4"
-  }
+    "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
+    "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
+    "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
+    "spec/v1/core-standard-manifest.json": "ba7d24beac18e8b0a95becf73e89c37e7720920a71bff6bdd2e98c291c70afb7",
+    "spec/v1/deprecations.json": "520d79927a8ed43ccf62c207a7cf6cf7b19b16e00bbbbdf0410667e939c19d85",
+    "spec/v1/deprecations.schema.json": "4cdbbb8eb9c0092913a5704c943880f0c8581bcf0f640a7df5a84105d53c8aee",
+    "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
+    "spec/v1/event-codemap.schema.json": "d52caf29071e3784d4c20259cdbd5a7b533986548a440bb632a80b82cadd7ea5",
+    "spec/v1/extensions.json": "4d7ba68bae7c7f50cc655b94646ad25945a5dd63b703d43c1d015470141cd668",
+    "spec/v1/gaps.json": "96ca051cb20f1a669b355d67a89421c56fef28aa5e6710c9519f592f26af33a3",
+    "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
+    "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
+    "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
+    "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
+    "spec/v1/spec-gaps.json": "6cc9962c6b969f632e07a78b52a4f61447ff579e2990cbae989866f584a86042",
+    "spec/v2/declaration.json": "892b6fae1e87f279ff75451f67ffab2a63ef883203f8066886bd60f165469348",
+    "spec/v2/declaration.schema.json": "b0881a76228dfbd1b85a2ec7b7259a60197f768344535cdb475db6ff719b0e54",
+    "spec/v2/errors.json": "ad1725dc7c11002450e8abc682858eb5c11952a0718ea8ef6bdb2fb5ae6e7e21",
+    "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
+    "spec/v2/event-codemap.schema.json": "ce2d0ca085d7668d7ef745d2560b385ec6881d24a6d4b47c49931986b2ba642d",
+    "spec/v2/ext/provider-idempotency/registry.json": "5b5fecad604fb4ab38da39f5abe697a4e57b05406c398f8afeb377331b2bd965",
+    "spec/v2/facets/a2a.schema.json": "6b0bceddec6d18d5115aa7d04720a0cc1ad7a9a0a78f53c208b34becaba5d16e",
+    "spec/v2/facets/aiProviders.schema.json": "0c76e48e5d487b5be3b3ab1f6512a4e206c840ee5087d1336c7d7e2853b58d03",
+    "spec/v2/facets/auth.schema.json": "73440c944ad12c41aab0618aeb799a90a0b59e97fc685527f248afb7d015381a",
+    "spec/v2/facets/heartbeat.schema.json": "81d7fa1895a8b0241bd07cf00a7e7905bef0fd14eb3427325261c62eee5746a6",
+    "spec/v2/facets/interrupt.schema.json": "c76c58c0abd99de619f8c8afad246568f5bc9cce3b7a0d097d16d87eba84be3a",
+    "spec/v2/facets/mcp.schema.json": "f56609fe24ba6160ad29ae31aa16043354ff005e5cb6a0f3871c4d226087cc08",
+    "spec/v2/facets/replay.schema.json": "0a5aefb0108c708c6794fadd533cf256709704c4f16dbf44cd63fa8980c78018",
+    "spec/v2/facets/sandbox.schema.json": "e75f54486d387b2d089791aa93b5093cd1450f1920753a0f97fc23acdfe978ed",
+    "spec/v2/facets/webhooks.schema.json": "0b766033ef4b4c6c2ac6f9979a19843ba024d3a1d1576972dcb55aaba52f1b9a",
+    "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
+    "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
+    "spec/v2/profiles.json": "1f0ee40491131cf561ef19a0394c47ba476b4567514fe16befb6cada4a10a5a4",
+    "spec/v2/release.json": "41b69aed1e0c366cb287b05133ad561a1d4975b7a9e6786edf355ce976f4f12e"
+  },
+  "corpusCommit": "56cd5d7bb1dd663a887f884a0a4504c878d71b52"
 }

package/src/cli.ts

@@ -35,8 +35,9 @@
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath, join } from 'node:path';
+import { createRequire } from 'node:module';
 import { createHash } from 'node:crypto';
-import { readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
@@ -44,12 +45,14 @@ import { SCHEMAS_DIR } from './lib/paths.js';
 import { readLedgerFile } from './lib/requirement-ledger.js';
 import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
+import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest, type BundleV3, type BundleV3Requirement } from './lib/certification-bundle-v3.js';
 import {
   deriveProfiles,
   isCoreStandard,
   agentPlatformStatus,
   DEPRECATED_PROFILE_ALIASES,
   type DiscoveryPayload,
+  PROFILE_FLOOR_SCENARIOS,
 } from './lib/profiles.js';
 
 interface ParsedArgs {
@@ -57,12 +60,21 @@ interface ParsedArgs {
   readonly apiKey: string | undefined;
   readonly offline: boolean;
   readonly filter: string | undefined;
+  /** Suite 2.0.0 (RFC 0168 §D.3): which protocol major's scenarios run. Default: the host's preferredVersion, else max(protocolVersions[]), else 1. */
+  readonly targetMajor: 1 | 2 | undefined;
   readonly help: boolean;
   readonly impl: string | undefined;
   readonly implVersion: string | undefined;
   /** RFC 0089 — emit a conformance certification bundle to this path. */
   readonly certify: string | undefined;
-  readonly bundleVersion: '1' | '2';
+  readonly bundleVersion: '2' | '3';
+  /** Suite 2.0.0 (RFC 0168 §E): v3 needs the build identity, the signing key, and the tier. */
+  readonly hostBuild: { kind: 'image-digest' | 'commit' | 'artifact-sha256'; id: string } | undefined;
+  readonly evidenceTier: 'self' | 'steward' | 'independent';
+  readonly signingKeyPath: string | undefined;
+  readonly signingKeyId: string | undefined;
+  readonly verifierKeyPath: string | undefined;
+  readonly verifierKeyId: string | undefined;
   /**
    * S43 (2026-08-18) — cap on concurrently running scenario FILES, forwarded to
    * vitest `--maxWorkers`. Unset = vitest's default (one worker per CPU), which
@@ -84,7 +96,11 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
   // Suite 1.152.0: bundle v2 (RFC 0148) is the default. v1 stays reachable via
   // `--bundle-version 1` through the RFC 0148 migration window (ends
   // 2026-11-10) and is removed at v2.0 (spec/v1/deprecations.json).
-  let bundleVersion: '1' | '2' = '2';
+  let bundleVersion: '2' | '3' = '3';
+  let hostBuild: ParsedArgs['hostBuild'];
+  let evidenceTier: ParsedArgs['evidenceTier'] = 'self';
+  let signingKeyPath: string | undefined, signingKeyId: string | undefined, verifierKeyPath: string | undefined, verifierKeyId: string | undefined;
+  let targetMajor: 1 | 2 | undefined;
   let maxWorkers: number | undefined = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
 
   for (let i = 0; i < argv.length; i++) {
@@ -117,6 +133,12 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
       case '--api-key':
         apiKey = nextValue();
         break;
+      case '--target-major': {
+        const v = argv[++i];
+        if (v !== '1' && v !== '2') { process.stderr.write(`openwop-conformance: --target-major must be 1 or 2 (got ${String(v)})\n`); process.exit(2); }
+        targetMajor = v === '2' ? 2 : 1;
+        break;
+      }
       case '--filter':
         filter = nextValue();
         break;
@@ -129,19 +151,29 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
         implVersion = nextValue();
         break;
       case '--bundle-version': {
-        const v = nextValue();
-        if (v !== '1' && v !== '2') {
-          process.stderr.write(`--bundle-version must be 1 or 2 (got '${v}')\n`);
-          process.exit(2);
-        }
+        const v = argv[++i];
+        if (v !== '2' && v !== '3') { process.stderr.write(`openwop-conformance: --bundle-version must be 2 or 3 (got ${String(v)}); v1 is gone in suite 2.0.0 (RFC 0168 §E.3)\n`); process.exit(2); }
+        if (v === '2') process.stderr.write('openwop-conformance: --bundle-version 2 is DEPRECATED — v2 bundles stop substantiating a certification at v1 end-of-support (RFC 0168 §E.3); the default is 3.\n');
         bundleVersion = v;
-        if (v === '1') {
-          process.stderr.write(
-            'openwop-conformance: --bundle-version 1 is DEPRECATED (RFC 0148). A v1 bundle ceases to substantiate a new certification after 2026-11-10 and the format is removed at v2.0; omit the flag to emit bundle v2.\n',
-          );
-        }
         break;
       }
+      case '--host-build': {
+        const v = argv[++i] ?? '';
+        const mm = /^(image-digest|commit|artifact-sha256):(.+)$/.exec(v);
+        if (!mm) { process.stderr.write(`openwop-conformance: --host-build must be <image-digest|commit|artifact-sha256>:<id> (got ${JSON.stringify(v)})\n`); process.exit(2); }
+        hostBuild = { kind: mm[1] as 'image-digest' | 'commit' | 'artifact-sha256', id: mm[2] };
+        break;
+      }
+      case '--evidence-tier': {
+        const v = argv[++i];
+        if (v !== 'self' && v !== 'steward' && v !== 'independent') { process.stderr.write('openwop-conformance: --evidence-tier must be self, steward or independent\n'); process.exit(2); }
+        evidenceTier = v;
+        break;
+      }
+      case '--signing-key': signingKeyPath = argv[++i]; break;
+      case '--signing-key-id': signingKeyId = argv[++i]; break;
+      case '--verifier-key': verifierKeyPath = argv[++i]; break;
+      case '--verifier-key-id': verifierKeyId = argv[++i]; break;
       case '--certify':
         certify = nextValue();
         break;
@@ -165,6 +197,13 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
     implVersion,
     certify,
     bundleVersion,
+    targetMajor,
+    hostBuild,
+    evidenceTier,
+    signingKeyPath,
+    signingKeyId,
+    verifierKeyPath,
+    verifierKeyId,
     maxWorkers,
   };
 }
@@ -203,7 +242,14 @@ Implementation labels (cosmetic — surface in failure messages):
   --impl-version <version>  Implementation version     (env: OPENWOP_IMPLEMENTATION_VERSION)
 
 Certification (RFC 0089):
-  --bundle-version <1|2>  Certification bundle format. Default 2 (corrected 2026-09-03, RFC 0168 §E.4; the text said 1 while the code set 2). Version 2 (RFC 0148
+  --target-major <1|2>    Suite 2.0.0 (RFC 0168 §D.3): run the scenarios for this protocol
+                          major. Default: the host's preferredVersion (RFC 0179), else
+                          max(protocolVersions[]), else 1. Selection is scenario-majors.json.
+  --host-build <k>:<id>   v3: the build identity (image-digest|commit|artifact-sha256), or OPENWOP_HOST_BUILD.
+  --signing-key <pem>     v3: Ed25519 private key (PKCS8 PEM) that signs the bundle, or OPENWOP_BUNDLE_SIGNING_KEY.
+  --signing-key-id <id>   v3: the keyId the host publishes for that key, or OPENWOP_BUNDLE_SIGNING_KEY_ID.
+  --evidence-tier <t>     v3: self | steward | independent (independent needs --verifier-key/--verifier-key-id).
+  --bundle-version <2|3>  Certification bundle format. Default 2 (corrected 2026-09-03, RFC 0168 §E.4; the text said 1 while the code set 2). Version 2 (RFC 0148
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.
@@ -265,6 +311,59 @@ function claimedProfilesFor(doc: DiscoveryPayload): string[] {
   return profiles;
 }
 
+/**
+ * The v2 profile registry is a set of predicates over the DECLARATION
+ * (RFC 0169 §C.1): every listed family present as a record, every listed
+ * metadata key present. The v1 derivation cannot stand in — `isCore` wants a
+ * root `protocolVersion` plus `supportedEnvelopes`/`schemaVersions`/`limits`,
+ * shapes a closed v2 root does not have — so a major-2 run claimed NOTHING and
+ * no v2 host could ever certify. Falls back to the empty set only when the
+ * registry is genuinely absent from the layout, and says so.
+ */
+function claimedProfilesForV2(doc: DiscoveryPayload, conformanceRoot: string): string[] {
+  // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
+  // this package — instead of guessing directory shapes. Hand-rolled candidates
+  // found the registry in a repo checkout and missed it in every published
+  // install, where npm hoists the peer to a SIBLING package dir: the probe that
+  // walked one level up landed on the `@openwop/` scope directory, not a
+  // package, so a real host run silently claimed nothing.
+  const candidates = [];
+  try {
+    const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
+    candidates.push(resolvePath(dirname(req.resolve('@openwop/spec-artifacts/package.json')), 'spec', 'v2', 'profiles.json'));
+  } catch { /* not installed as a package; the repo-layout candidates below */ }
+  candidates.push(
+    resolvePath(conformanceRoot, 'spec', 'v2', 'profiles.json'),
+    resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'),
+    resolvePath(conformanceRoot, '..', 'spec-artifacts', 'spec', 'v2', 'profiles.json'),
+  );
+  const found = candidates.find((c) => existsSync(c));
+  if (found === undefined) {
+    process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
+    return [];
+  }
+  let registry: { profiles?: Array<{ id?: unknown; predicate?: { families?: unknown; metadata?: unknown } }> };
+  try {
+    registry = JSON.parse(readFileSync(found, 'utf8'));
+  } catch {
+    process.stderr.write(`openwop-conformance --certify: ${found} is unreadable; claimedProfiles is empty.\n`);
+    return [];
+  }
+  const root = doc as unknown as Record<string, unknown>;
+  const isRecord = (k: string): boolean => {
+    const v = root[k];
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+  };
+  const out: string[] = [];
+  for (const p of registry.profiles ?? []) {
+    if (typeof p.id !== 'string') continue;
+    const families = Array.isArray(p.predicate?.families) ? (p.predicate.families as unknown[]).map(String) : [];
+    const metadata = Array.isArray(p.predicate?.metadata) ? (p.predicate.metadata as unknown[]).map(String) : [];
+    if (families.every(isRecord) && metadata.every((k) => root[k] !== undefined)) out.push(p.id);
+  }
+  return out;
+}
+
 /** A single scenario test file's terminal state, derived from the vitest JSON report. */
 type ScenarioState = 'passed' | 'failed' | 'skipped';
 
@@ -313,15 +412,52 @@ function scenarioStatesFromReport(report: VitestJsonReport): Map<string, Scenari
 }
 
 /** Generate + validate + write an RFC 0089 conformance certification bundle. */
+/**
+ * Suite 2.0.0 — resolve the target major (RFC 0168 §D.3 / RFC 0179): the flag,
+ * else the host's root `preferredVersion`, else max(protocolVersions[]), else 1.
+ * Returns the major and the scenario files that target it (scenario-majors.json).
+ */
+async function resolveTargetMajor(args: ParsedArgs, baseUrl: string | undefined, apiKey: string | undefined, conformanceRoot: string): Promise<{ major: 1 | 2; files: string[]; source: string }> {
+  let major: 1 | 2 | undefined = args.targetMajor;
+  let source = 'flag';
+  let dualStack = false;
+  if (major === undefined && baseUrl) {
+    try {
+      const res = await fetch(`${baseUrl.replace(/\/$/, '')}/.well-known/openwop`, { headers: apiKey ? { authorization: `Bearer ${apiKey}` } : {} });
+      const doc = (await res.json()) as { preferredVersion?: string; protocolVersions?: string[] };
+      const pv = doc.preferredVersion ?? (doc.protocolVersions ?? []).map((v) => v).sort((a, b) => Number(b.split('.')[0]) - Number(a.split('.')[0]))[0];
+      if ((doc.protocolVersions ?? []).some((v) => v.startsWith('2.'))) dualStack = true;
+      if (pv) { major = Number(pv.split('.')[0]) >= 2 ? 2 : 1; source = doc.preferredVersion ? 'preferredVersion' : 'max(protocolVersions[])'; }
+    } catch { /* unreachable host: the default below; the run itself will report the failure */ }
+  }
+  if (major === undefined) { major = 1; source = 'default'; }
+  // Through the overlap `preferredVersion` names the 1.x member (versioning.md
+  // §1.1), so auto-detection on a dual-stack host resolves to major 1 by design.
+  // Say so, or an operator reads a v1 run as the host's only option.
+  if (major === 1 && dualStack) source += ' (the host also serves 2.x — pass --target-major 2 to measure it)';
+  const manifest = JSON.parse(readFileSync(resolvePath(conformanceRoot, 'scenario-majors.json'), 'utf8')) as { majors: Record<string, number[]> };
+  const files = Object.entries(manifest.majors).filter(([, m]) => m.includes(major as number)).map(([f]) => `src/scenarios/${f}`);
+  return { major, files, source };
+}
+
 async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Promise<never> {
   const outPath = args.certify;
   if (outPath === undefined) process.exit(2);
 
   // (a) Fetch /.well-known/openwop verbatim + its canonical-JSON SHA-256.
+  // The target is resolved FIRST: `/.well-known/openwop` is one resource whose
+  // representation the `OpenWOP-Version` header selects, and through the overlap
+  // the header-less representation is the v1 document (spec/v2/core/versioning.md
+  // §1.1). Fetching it header-less on a major-2 run captured the v1 rendering, so
+  // `claimedProfiles` came out as the v1 set and the bundle described a contract
+  // the run never measured.
+  const here = dirname(fileURLToPath(import.meta.url));
+  const conformanceRoot = resolvePath(here, '..');
+  const target = await resolveTargetMajor(args, baseUrl, apiKey, conformanceRoot);
   const discoveryUrl = `${baseUrl.replace(/\/$/, '')}/.well-known/openwop`;
   let document: DiscoveryPayload;
   try {
-    const resp = await fetch(discoveryUrl, { headers: { Accept: 'application/json' } });
+    const resp = await fetch(discoveryUrl, { headers: { Accept: 'application/json', ...(target.major === 2 ? { 'OpenWOP-Version': '2.0' } : {}) } });
     if (!resp.ok) {
       process.stderr.write(
         `openwop-conformance --certify: GET ${discoveryUrl} returned HTTP ${resp.status}.\n`,
@@ -338,12 +474,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
   const sha256 = createHash('sha256').update(canonicalJSON(document)).digest('hex');
 
   // (b) Derive claimedProfiles from the captured document.
-  const claimedProfiles = claimedProfilesFor(document);
+  const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document, conformanceRoot) : claimedProfilesFor(document);
 
   // (c) Run the suite, capturing per-scenario terminal state via the vitest
   // JSON reporter. server-targeted scenarios live under src/scenarios/.
-  const here = dirname(fileURLToPath(import.meta.url));
-  const conformanceRoot = resolvePath(here, '..');
   const reportDir = mkdtempSync(join(tmpdir(), 'owp-certify-'));
   const reportFile = join(reportDir, 'vitest-report.json');
   // RFC 0148 §A ledger sink (S6): every scenario file records its disposition
@@ -357,6 +491,8 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
   if (args.impl) env.OPENWOP_IMPLEMENTATION_NAME = args.impl;
   if (args.implVersion) env.OPENWOP_IMPLEMENTATION_VERSION = args.implVersion;
 
+  env.OPENWOP_TARGET_MAJOR = String(target.major);
+  process.stderr.write(`openwop-conformance --certify: target major ${target.major} (${target.source}); ${target.files.length} scenario file(s)\n`);
   const vitestArgs: string[] = [
     'vitest',
     'run',
@@ -365,6 +501,8 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     '--reporter=json',
     `--outputFile=${reportFile}`,
     ...maxWorkersArgs(args.maxWorkers),
+    ...(args.filter ? ['--testNamePattern', args.filter] : []),
+    ...target.files,
   ];
   const runResult = spawnSync('npx', vitestArgs, { cwd: conformanceRoot, env, stdio: 'inherit' });
   if (runResult.error) {
@@ -466,6 +604,79 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     );
   }
 
+  if (args.bundleVersion === '3') {
+    // ── Bundle v3 (RFC 0168 §E) ─────────────────────────────────────────────
+    const build = args.hostBuild ?? (() => {
+      const mm = /^(image-digest|commit|artifact-sha256):(.+)$/.exec(process.env['OPENWOP_HOST_BUILD'] ?? '');
+      return mm ? { kind: mm[1] as BundleV3['host']['build']['kind'], id: mm[2] } : undefined;
+    })();
+    const signingKeyPem = args.signingKeyPath ? readFileSync(args.signingKeyPath, 'utf8') : process.env['OPENWOP_BUNDLE_SIGNING_KEY'];
+    const keyId = args.signingKeyId ?? process.env['OPENWOP_BUNDLE_SIGNING_KEY_ID'];
+    if (!build || !signingKeyPem || !keyId) {
+      process.stderr.write('openwop-conformance --certify: a v3 bundle needs --host-build <kind>:<id> (or OPENWOP_HOST_BUILD), --signing-key <pem> (or OPENWOP_BUNDLE_SIGNING_KEY) and --signing-key-id (or OPENWOP_BUNDLE_SIGNING_KEY_ID) — an unsigned bundle does not exist in v3 (RFC 0168 §E.2).\n');
+      process.exit(2);
+    }
+    const rows3: BundleV3Requirement[] = derived.requirements.map((r) => ({ id: r.requirementId, scenario: r.scenarioId, result: r.disposition as BundleV3Requirement['result'], ...(r.assertionCount === undefined ? {} : { assertions: r.assertionCount }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+    const totals3 = derived.totals;
+    const doc3 = document as Record<string, unknown>;
+    const protocolVersions = Array.isArray(doc3['protocolVersions']) ? (doc3['protocolVersions'] as string[]) : [String(doc3['protocolVersion'] ?? '')];
+    const preferredVersion = typeof doc3['preferredVersion'] === 'string' ? (doc3['preferredVersion'] as string) : (protocolVersions[0] ?? '');
+    // witnessCount: executed-pass rows on the profile's floor (PROFILE_FLOOR_SCENARIOS required + requiredAnyPrefix).
+    const witnessCountFor = (profile: string): number => {
+      const floor = PROFILE_FLOOR_SCENARIOS[profile];
+      if (!floor) return 0;
+      const onFloor = (scenario: string): boolean => floor.required.includes(scenario) || (floor.requiredAnyPrefix ?? []).some((pre) => scenario.startsWith(pre));
+      return derived.requirements.filter((r) => r.disposition === 'executed-pass' && onFloor(r.scenarioId)).length;
+    };
+    const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
+    let relaxations: BundleV3['host']['relaxations'];
+    if (process.env['OPENWOP_HOST_RELAXATIONS']) { try { relaxations = JSON.parse(process.env['OPENWOP_HOST_RELAXATIONS']) as BundleV3['host']['relaxations']; } catch { process.stderr.write('openwop-conformance --certify: OPENWOP_HOST_RELAXATIONS is not JSON\n'); process.exit(2); } }
+    const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
+    const lock = existsSync(lockPath) ? (JSON.parse(readFileSync(lockPath, 'utf8')) as { version: string; stampSha256: string }) : undefined;
+    const nonPass = rows3.filter((r) => r.result !== 'executed-pass');
+    const unsigned: Omit<BundleV3, 'signature'> = {
+      bundleVersion: '3',
+      generatedAt: new Date().toISOString(),
+      suite: { name: '@openwop/openwop-conformance', version, targetMajor: target.major, specArtifactsVersion: lock?.version ?? 'repo-layout', ...(lock ? { stampSha256: lock.stampSha256 } : {}) },
+      host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}) },
+      discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion },
+      claimedProfiles: claimed3,
+      results: { totals: totals3, requirements: rows3 },
+      witnessSha256: witnessDigest(rows3),
+      assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
+      ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
+    };
+    const signature = signBundleV3(unsigned, signingKeyPem, keyId);
+    const v3: BundleV3 = { ...unsigned, signature };
+    if (args.evidenceTier === 'independent') {
+      const vk = args.verifierKeyPath ? readFileSync(args.verifierKeyPath, 'utf8') : process.env['OPENWOP_BUNDLE_VERIFIER_KEY'];
+      const vkId = args.verifierKeyId ?? process.env['OPENWOP_BUNDLE_VERIFIER_KEY_ID'];
+      if (!vk || !vkId) { process.stderr.write('openwop-conformance --certify: --evidence-tier independent needs --verifier-key and --verifier-key-id (RFC 0168 §E.2)\n'); process.exit(2); }
+      v3.verifierSignature = verifierSign(unsigned, vk, vkId);
+    }
+    const secrets3 = evidenceSecretsFromEnv(process.env, [apiKey, signingKeyPem]);
+    const scrubbed3 = scrubEvidence(v3, secrets3);
+    const v3Out = scrubbed3.value as BundleV3;
+    const audit3 = verifyBundleV3(v3Out, { hostPublicKeyPem: publicKeyFromPrivate(signingKeyPem) });
+    const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'relaxed-profile-certified', 'independent-unverifiable'].includes(r.kind));
+    if (emitterDefects.length > 0) {
+      process.stderr.write('openwop-conformance --certify: assembled v3 bundle FAILED self-verification (emitter defect):\n' + emitterDefects.map((r) => `  - [${r.kind}] ${r.detail}`).join('\n') + '\n');
+      process.exit(2);
+    }
+    const v3Schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'certification-bundle.schema.json'), 'utf8')) as Record<string, unknown>;
+    const v3Ajv = new Ajv2020({ allErrors: true, strict: false });
+    addFormats(v3Ajv);
+    v3Ajv.addSchema(JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'ids.schema.json'), 'utf8')) as Record<string, unknown>);
+    const v3Validate = v3Ajv.compile(v3Schema);
+    if (!v3Validate(v3Out)) {
+      process.stderr.write('openwop-conformance --certify: assembled v3 bundle FAILED schema validation:\n' + `${JSON.stringify(v3Validate.errors, null, 2)}\n`);
+      process.exit(2);
+    }
+    writeFileSync(outPath, `${JSON.stringify(v3Out, null, 2)}\n`);
+    process.stdout.write(`openwop-conformance --certify: wrote bundle v3 → ${outPath} (${rows3.length} requirement rows, ${v3Out.assertionCount} assertions, witness ${v3Out.witnessSha256.slice(0, 12)}, signed by ${keyId}; certified: ${audit3.certifiedProfiles.join(', ') || 'none'})\n`);
+    process.exit(rejectedProfiles.length > 0 ? 3 : failed.length > 0 ? 1 : 0);
+  }
+
   if (args.bundleVersion === '2') {
     const scenarioIds = [...passed, ...failed, ...skipped].sort();
     const manifestSha = createHash('sha256').update(scenarioIds.join('\n'), 'utf8').digest('hex');
@@ -473,7 +684,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     // the discovery it saw. Two runs against differently-configured hosts are
     // different evidence, and this is what says so.
     const configSha = createHash('sha256')
-      .update(`${args.baseUrl}\n${sha256}\n${process.env['OPENWOP_REQUIRE_BEHAVIOR'] ?? ''}`, 'utf8')
+      .update(`${baseUrl}\n${sha256}\n${process.env['OPENWOP_REQUIRE_BEHAVIOR'] ?? ''}`, 'utf8')
       .digest('hex');
 
     // Rows come from the ledger (S6). A file that recorded nothing is
@@ -655,6 +866,12 @@ async function main(): Promise<never> {
   // ancestor config (e.g., a parent monorepo's vite.config.ts) when
   // the conformance package is used as a workspace member.
   const vitestArgs: string[] = ['run', '--config', resolvePath(conformanceRoot, 'vitest.config.ts')];
+  const target = await resolveTargetMajor(args, env.OPENWOP_BASE_URL, env.OPENWOP_API_KEY, conformanceRoot);
+  env.OPENWOP_TARGET_MAJOR = String(target.major);
+  if (!args.offline) {
+    process.stderr.write(`openwop-conformance: target major ${target.major} (${target.source}); ${target.files.length} scenario file(s)\n`);
+    vitestArgs.push(...target.files);
+  }
   if (args.offline) {
     // Suite 1.154.0: the offline set is a DECLARED property of the package —
     // exactly the server-free scenarios that ship in the tarball and run in

package/src/global-setup.ts

@@ -57,7 +57,7 @@ const MAX_ROWS = 40;
 // a ledger field and this file stops building instead of silently degrading.
 import type { LedgerEntry } from './lib/requirement-ledger.js';
 import { LAYOUT, PKG_ROOT_PATH } from './lib/paths.js';
-import { describeVerdict, verifyCorpusStamp } from './lib/corpus-stamp.js';
+import { describeVerdict, verifyCorpusStamp, verifyPeerContract } from './lib/corpus-stamp.js';
 
 /** What a JSONL line parses to before validation — every field may be absent. */
 type LedgerLine = Partial<Record<keyof LedgerEntry, unknown>>;
@@ -72,7 +72,8 @@ export function setup(): void {
   // aborts the run (a suite validating a host against a schema it did not ship
   // is evidence about nothing). Repo layout: nothing vendored, nothing to check,
   // and the log line says so rather than implying a pass.
-  const stamp = verifyCorpusStamp(PKG_ROOT_PATH, LAYOUT);
+  // Suite 2.0.0: in the published layout the contract is the spec-artifacts peer (RFC 0168 §D.2).
+  const stamp = LAYOUT === 'published' ? verifyPeerContract(PKG_ROOT_PATH) : verifyCorpusStamp(PKG_ROOT_PATH, LAYOUT);
   process.stderr.write(`${describeVerdict(stamp)}\n`);
   if (stamp.kind === 'mismatch') {
     throw new Error('openwop-conformance: refusing to run — schemas/CORPUS-STAMP.json digests do not match the vendored api/ + schemas/ files. Reinstall the package; do not hand-patch vendored contract files.');