@openwop/openwop-conformance 1.163.0 → 2.0.0-rc.1

package/src/scenarios/v2-capability-record-shape.test.ts

@@ -0,0 +1,104 @@
+/**
+ * v2 — `capability-record-shape` (suite 2.0.0; RFC 0169 §A.1–§A.3;
+ * `spec/v2/core/capabilities.md` §2 "The capability record").
+ *
+ * Witness class: witnessable — unaided. Every family record at the v2 root
+ * carries `status`, `since`, `witness`; `until` is present iff the record is
+ * not `stable`; an `until` already in the past makes the document
+ * non-conformant. Which root keys are family records is read from the
+ * generated `schemas/v2/capabilities.schema.json` (a property whose schema
+ * requires `status`, `since`, `witness`), so metadata keys (§3.1) are never
+ * mistaken for records.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { v2Discovery } from '../lib/v2.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/capabilities.md §2';
+const STATUS = new Set(['stable', 'experimental', 'deprecated']);
+const WITNESS = new Set(['witnessable-unaided', 'witnessable-gated', 'seam-gated', 'claims-check', 'negative-existence']);
+const VERSION = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+/** Root keys the generated schema declares as family records. */
+function familyKeys(): Set<string> {
+  const schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'capabilities.schema.json'), 'utf8')) as { properties?: Record<string, { required?: string[] }> };
+  const out = new Set<string>();
+  for (const [key, prop] of Object.entries(schema.properties ?? {})) {
+    const required = prop.required ?? [];
+    if (['status', 'since', 'witness'].every((r) => required.includes(r))) out.add(key);
+  }
+  return out;
+}
+
+/** The records the host actually advertises, keyed by family. */
+function records(doc: Record<string, unknown>): Array<[string, Record<string, unknown>]> {
+  const keys = familyKeys();
+  return Object.entries(doc)
+    .filter(([k, v]) => keys.has(k) && v !== null && typeof v === 'object' && !Array.isArray(v))
+    .map(([k, v]) => [k, v as Record<string, unknown>]);
+}
+
+/**
+ * `until` in the past: a date form is compared with today's UTC date; a
+ * `<major>.<minor>` form is "past" once the host already serves a version at or
+ * beyond it (the deprecation horizon has been reached on this very host).
+ */
+function untilInPast(until: string, served: string[]): boolean {
+  if (DATE.test(until)) return until < new Date().toISOString().slice(0, 10);
+  const [maj, min] = until.split('.').map(Number) as [number, number];
+  return served.some((v) => {
+    const [a, b] = v.split('.').map(Number) as [number, number];
+    return a > maj || (a === maj && b >= min);
+  });
+}
+
+describe('v2 capability-record-shape (RFC 0169 §A.1–§A.3)', () => {
+  it('every family record carries status, since and witness from the wire-legal sets', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const recs = records(doc);
+    if (recs.length === 0) return softSkip('inapplicable', 'the host advertises no family record at the v2 root (metadata only)');
+    for (const [key, rec] of recs) {
+      expect(STATUS.has(String(rec['status'])), req('openwop.requirement.0169.capability-record-shape.required-fields', DOC, `${key}.status MUST be one of stable | experimental | deprecated`)).toBe(true);
+      expect(typeof rec['since'] === 'string' && VERSION.test(rec['since']), req('openwop.requirement.0169.capability-record-shape.required-fields', DOC, `${key}.since MUST be present as <major>.<minor>`)).toBe(true);
+      expect(WITNESS.has(String(rec['witness'])), req('openwop.requirement.0169.capability-record-shape.required-fields', DOC, `${key}.witness MUST be one of the five wire-legal classes (unwitnessable MUST NOT appear on a wire record)`)).toBe(true);
+      expect('supported' in rec, req('openwop.requirement.0169.capability-record-shape.required-fields', DOC, `${key}: \`supported\` does not exist in v2 — presence of the record is the claim (§A.2)`)).toBe(false);
+    }
+  });
+
+  it('`until` is present iff the record is experimental or deprecated', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const recs = records(doc);
+    if (recs.length === 0) return softSkip('inapplicable', 'the host advertises no family record at the v2 root (metadata only)');
+    for (const [key, rec] of recs) {
+      const hasUntil = rec['until'] !== undefined;
+      const stable = rec['status'] === 'stable';
+      expect(hasUntil, req('openwop.requirement.0169.capability-record-shape.until-iff-not-stable', DOC, `${key}: \`until\` is REQUIRED when status is experimental or deprecated and MUST NOT be present when stable (status=${String(rec['status'])})`)).toBe(!stable);
+      if (hasUntil) {
+        expect(typeof rec['until'] === 'string' && (VERSION.test(rec['until']) || DATE.test(rec['until'])), req('openwop.requirement.0169.capability-record-shape.until-iff-not-stable', DOC, `${key}.until MUST be <major>.<minor> or YYYY-MM-DD`)).toBe(true);
+      }
+    }
+  });
+
+  it('no advertised record carries an `until` already in the past', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const served = Array.isArray(doc['protocolVersions']) ? (doc['protocolVersions'] as unknown[]).filter((v): v is string => typeof v === 'string') : [];
+    const dated = records(doc).filter(([, rec]) => typeof rec['until'] === 'string');
+    if (dated.length === 0) return softSkip('inapplicable', 'no advertised family record carries an `until` (every record is stable, or none is advertised)');
+    for (const [key, rec] of dated) {
+      expect(untilInPast(rec['until'] as string, served), req('openwop.requirement.0169.capability-record-shape.until-not-past', 'spec/v2/core/capabilities.md §2 (`until` in the past)', `${key}.until=${String(rec['until'])} is in the past — the document is non-conformant (a validator answers 400 until_in_past)`)).toBe(false);
+    }
+  });
+});

package/src/scenarios/v2-chain-pin-exact.test.ts

@@ -0,0 +1,118 @@
+/**
+ * v2-chain-pin-exact — RFC 0177 §E.1; `spec/v2/core/workflow-chain-packs.md`
+ * §"Exact pins".
+ *
+ * Suite 2.0.0, target major 2. Every reference a chain makes to a node type
+ * MUST pin an exact version per referenced `typeId` (`core.ai.callPrompt@1.0.0`);
+ * a host MUST refuse to register a chain whose reference carries a range or no
+ * version. Ranges are a v2.x additive follow-up.
+ *
+ *   1. a chain manifest referencing `core.ai.callPrompt@^1` is refused at
+ *      register (4xx with an error code).
+ *   2. the same chain referencing `core.ai.callPrompt@1.0.0` registers.
+ *
+ * Both go through the seams-profile publish seam
+ * (`/conformance/seams/packs-test/…`, RFC 0168 §C.2), gated on
+ * `workflowChainPacks` + the seams profile. The exact-pin manifest is first
+ * validated against `schemas/v2/workflow-chain-pack-manifest.schema.json`: the
+ * schema's `FragmentNode.typeId` pattern has no room for `@<version>` and no
+ * sibling pin field exists, so while that gap stands the legs record `blocked`
+ * naming it (RFC 0177 §E.1 schema follow-up) rather than a pass.
+ *
+ * @see RFCS/0177-v2-registry-packs-and-extension-tail.md §E.1
+ * @see spec/v2/core/workflow-chain-packs.md §"Exact pins"
+ * @see schemas/v2/workflow-chain-pack-manifest.schema.json
+ */
+
+import { describe, it, expect } from 'vitest';
+import { gzipSync } from 'node:zlib';
+import { driver } from '../lib/driver.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip, type SoftSkipKind } from '../lib/soft-skip.js';
+import { seamsProfileAdvertised, targetMajor } from '../lib/seams.js';
+import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
+
+const SECTION = 'workflow-chain-packs.md §"Exact pins" (RFC 0177 §E.1)';
+const SCHEMA_GAP = 'workflow-chain-pack-manifest.schema.json carries no per-typeId version pin (FragmentNode.typeId rejects `core.ai.callPrompt@1.0.0` and no pin field exists) — RFC 0177 §E.1 schema follow-up';
+
+function tarEntry(name: string, data: Buffer): Buffer {
+  const h = Buffer.alloc(512, 0);
+  h.write(name, 0, 100, 'utf8');
+  h.write('0000644\0', 100, 8, 'utf8');
+  h.write('0000000\0', 108, 8, 'utf8');
+  h.write('0000000\0', 116, 8, 'utf8');
+  h.write(`${data.length.toString(8).padStart(11, '0')}\0`, 124, 12, 'utf8');
+  h.write('00000000000\0', 136, 12, 'utf8');
+  h.write('        ', 148, 8, 'utf8');
+  h.write('0', 156, 1, 'utf8');
+  h.write('ustar\0', 257, 6, 'utf8');
+  h.write('00', 263, 2, 'utf8');
+  let sum = 0;
+  for (const b of h) sum += b;
+  h.write(`${sum.toString(8).padStart(6, '0')}\0 `, 148, 8, 'utf8');
+  const pad = (512 - (data.length % 512)) % 512;
+  return Buffer.concat([h, data, Buffer.alloc(pad, 0)]);
+}
+function packTarball(files: Record<string, string>): Buffer {
+  return gzipSync(Buffer.concat([...Object.entries(files).map(([n, c]) => tarEntry(n, Buffer.from(c, 'utf8'))), Buffer.alloc(1024, 0)]));
+}
+function freshName(slug: string): string {
+  return `core.openwop.v2-${slug}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function chainPack(name: string, reference: string): Record<string, unknown> {
+  return {
+    name,
+    version: '1.0.0',
+    kind: 'workflow-chain',
+    engines: { openwop: '>=2.0.0 <3.0.0' },
+    chains: [{
+      chainId: `${name}.chain`,
+      version: '1.0.0',
+      label: 'Pin fixture',
+      description: 'A one-node chain whose only reference is the pin under test.',
+      parameters: { type: 'object', properties: {} },
+      dag: { nodes: [{ id: 'n1', typeId: reference }], edges: [] },
+    }],
+  };
+}
+async function publish(manifest: Record<string, unknown>) {
+  const name = manifest['name'] as string;
+  const version = manifest['version'] as string;
+  return driver.put(`/v1/packs-test/${encodeURIComponent(name)}/-/${encodeURIComponent(version)}.tgz`, packTarball({ 'pack.json': JSON.stringify(manifest, null, 2) }), {
+    headers: { 'Content-Type': 'application/octet-stream' },
+  });
+}
+async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | null> {
+  if (targetMajor() !== 2) return { kind: 'inapplicable', reason: 'suite 2.0.0 v2 scenario: OPENWOP_TARGET_MAJOR is not 2' };
+  let doc: Record<string, unknown> | null;
+  try {
+    doc = await v2Discovery();
+  } catch {
+    doc = null;
+  }
+  if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
+  if (!(await gateFamily('workflowChainPacks'))) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise the workflowChainPacks family (RFC 0169 §A.2)' };
+  if (!seamsProfileAdvertised(doc)) return { kind: 'blocked', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only register path the suite can drive (RFC 0168 §C.1)' };
+  if (!v2Validator('workflow-chain-pack-manifest')(chainPack('core.openwop.pin-probe', 'core.ai.callPrompt@1.0.0')).ok) return { kind: 'blocked', reason: SCHEMA_GAP };
+  return null;
+}
+
+describe('v2-chain-pin-exact (RFC 0177 §E.1)', () => {
+  it('a chain reference carrying a range (core.ai.callPrompt@^1) is refused at register', async () => {
+    const skip = await preflight();
+    if (skip) return softSkip(skip.kind, skip.reason);
+    const res = await publish(chainPack(freshName('chain-range'), 'core.ai.callPrompt@^1'));
+    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    expect(res.status >= 400 && res.status < 500, req('openwop.requirement.0177.chain-pin-exact.range-refused', SECTION, `a ranged reference MUST be refused at register (got ${res.status})`)).toBe(true);
+    expect(typeof readErrorCode(res.json), req('openwop.requirement.0177.chain-pin-exact.range-refused', SECTION, 'the refusal MUST carry an error code in the canonical envelope')).toBe('string');
+  });
+
+  it('a chain reference pinning an exact version (core.ai.callPrompt@1.0.0) registers', async () => {
+    const skip = await preflight();
+    if (skip) return softSkip(skip.kind, skip.reason);
+    const res = await publish(chainPack(freshName('chain-exact'), 'core.ai.callPrompt@1.0.0'));
+    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    expect([200, 201].includes(res.status), req('openwop.requirement.0177.chain-pin-exact.exact-accepted', SECTION, `an exact pin MUST register (got ${res.status} ${readErrorCode(res.json) ?? ''})`)).toBe(true);
+  });
+});

package/src/scenarios/v2-coherence-not-in-bundle.test.ts

@@ -0,0 +1,98 @@
+/**
+ * v2-coherence-not-in-bundle — RFC 0168 §D.1; `spec/v2/core/conformance.md`
+ * §"Two products, two ledgers".
+ *
+ * Suite 2.0.0. Corpus-coherence checks run in the spec repo's CI and MUST NOT
+ * appear in a host bundle; the bundle schema forbids their ids. Unaided and
+ * fixture-based — no host is consulted:
+ *
+ *   1. disjoint by construction: every id in `evidence/corpus-ledger.json`
+ *      belongs to a scenario in `src/coherence/` and to none in
+ *      `src/scenarios/` (a derived `openwop.it.<stem>.…` id resolves to its
+ *      file; an explicit `req()` id is located by its literal in the sources),
+ *      so a bundle produced from the scenarios directory cannot carry one.
+ *   2. the bundle schema rejects a v3 fixture whose `results.requirements[]`
+ *      carries an id under `openwop.it.spec-corpus-validity.` and accepts the
+ *      same fixture under an `openwop.requirement.` id.
+ *
+ * @see RFCS/0168-v2-evidence-and-conformance.md §D.1
+ * @see spec/v2/core/conformance.md §"Two products, two ledgers"
+ * @see schemas/v2/certification-bundle.schema.json
+ */
+
+import { describe, it, expect } from 'vitest';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { generateKeyPairSync } from 'node:crypto';
+import { join } from 'node:path';
+import { SCHEMAS_DIR, SCENARIOS_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
+import { scenarioFileOfId } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { v2Validator } from '../lib/v2.js';
+import { signBundleV3, witnessDigest, type BundleV3, type BundleV3Requirement } from '../lib/certification-bundle-v3.js';
+
+const SECTION = 'conformance.md §"Two products, two ledgers" (RFC 0168 §D.1)';
+const LEDGER = join(SCHEMAS_DIR, '..', 'evidence', 'corpus-ledger.json');
+const COHERENCE_DIR = SCENARIOS_DIR === null ? null : join(SCENARIOS_DIR, '..', 'coherence');
+
+function sources(dir: string): Map<string, string> {
+  return new Map(readdirSync(dir).filter((f) => f.endsWith('.test.ts')).map((f) => [f, readFileSync(join(dir, f), 'utf8')]));
+}
+
+function bundleWith(rows: BundleV3Requirement[]): BundleV3 {
+  const { privateKey } = generateKeyPairSync('ed25519');
+  const pem = privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
+  const unsigned: Omit<BundleV3, 'signature'> = {
+    bundleVersion: '3',
+    generatedAt: new Date().toISOString(),
+    suite: { name: '@openwop/openwop-conformance', version: '2.0.0', targetMajor: 2, specArtifactsVersion: '2.0.0' },
+    host: { name: 'fixture-host', version: '0.0.0', build: { kind: 'commit', id: 'fixture' } },
+    discovery: { url: 'https://host.invalid/.well-known/openwop', sha256: 'a'.repeat(64), protocolVersions: ['2.0'], preferredVersion: '2.0' },
+    claimedProfiles: [{ id: 'openwop-core-v2', evidenceTier: 'self', witnessCount: rows.length, certified: true }],
+    results: { totals: { executedPass: rows.length, executedFail: 0, skipped: 0, inapplicable: 0, blocked: 0 }, requirements: rows },
+    witnessSha256: witnessDigest(rows),
+    assertionCount: rows.reduce((n, r) => n + (r.assertions ?? 0), 0),
+  };
+  return { ...unsigned, signature: signBundleV3(unsigned, pem, 'fixture-host-key') };
+}
+
+describe('v2-coherence-not-in-bundle (RFC 0168 §D.1)', () => {
+  it('every corpus-ledger id has a scenario in src/coherence and none in src/scenarios — the two id sets are disjoint by construction', () => {
+    if (!existsSync(LEDGER)) return softSkip('blocked', 'evidence/corpus-ledger.json is absent from this layout — the corpus id set cannot be read');
+    if (SCENARIOS_DIR === null || COHERENCE_DIR === null || !existsSync(COHERENCE_DIR)) return softSkip('blocked', 'src/scenarios or src/coherence is absent from this layout');
+    const ledger = JSON.parse(readFileSync(LEDGER, 'utf8')) as { requirements: Record<string, unknown> };
+    const ids = Object.keys(ledger.requirements);
+    expect(ids.length, req('openwop.requirement.0168.coherence-not-in-bundle.disjoint-by-construction', SECTION, 'the corpus ledger MUST carry at least one requirement id')).toBeGreaterThan(0);
+    const coherence = sources(COHERENCE_DIR);
+    const scenarios = sources(SCENARIOS_DIR);
+    const coherenceText = [...coherence.values()].join('\n');
+    const scenariosText = [...scenarios.values()].join('\n');
+    for (const id of ids) {
+      // `openwop.profile.*` / `openwop.family.*` are capability-GATE rows minted
+      // at run time by gateFamily(), not by a `req()` literal and not derived
+      // from a file. The same gate id is recorded by a corpus run and a host run
+      // alike, so it is shared by construction and carries no corpus content —
+      // the disjointness rule does not reach it.
+      if (id.startsWith('openwop.profile.') || id.startsWith('openwop.family.')) continue;
+      const file = scenarioFileOfId(id);
+      if (file !== null) {
+        expect(coherence.has(file), req('openwop.requirement.0168.coherence-not-in-bundle.disjoint-by-construction', SECTION, `${id} MUST belong to a src/coherence scenario (${file})`)).toBe(true);
+        expect(scenarios.has(file), req('openwop.requirement.0168.coherence-not-in-bundle.disjoint-by-construction', SECTION, `${id} MUST NOT belong to a src/scenarios file (${file}) — it would enter a host bundle`)).toBe(false);
+      } else {
+        const literal = `'${id}'`;
+        expect(coherenceText.includes(literal), req('openwop.requirement.0168.coherence-not-in-bundle.disjoint-by-construction', SECTION, `${id} MUST be cited by req() in a src/coherence scenario`)).toBe(true);
+        expect(scenariosText.includes(literal), req('openwop.requirement.0168.coherence-not-in-bundle.disjoint-by-construction', SECTION, `${id} MUST NOT be cited by req() in a src/scenarios file — it would enter a host bundle`)).toBe(false);
+      }
+    }
+  });
+
+  it('the bundle schema rejects a v3 bundle carrying a corpus-coherence id and accepts one under openwop.requirement.', () => {
+    const validate = v2Validator('certification-bundle');
+    const corpusRow: BundleV3Requirement = { id: 'openwop.it.spec-corpus-validity.every-fixture-validates', scenario: 'spec-corpus-validity.test.ts', result: 'executed-pass', assertions: 1 };
+    const hostRow: BundleV3Requirement = { id: 'openwop.requirement.0168.coherence-not-in-bundle.fixture', scenario: 'v2-coherence-not-in-bundle.test.ts', result: 'executed-pass', assertions: 1 };
+    const control = validate(bundleWith([hostRow]));
+    expect(control.ok, req('openwop.requirement.0168.coherence-not-in-bundle.schema-forbids-coherence-ids', SECTION, `a v3 bundle whose rows are openwop.requirement. ids MUST validate (${control.errors})`)).toBe(true);
+    const tainted = validate(bundleWith([hostRow, corpusRow]));
+    expect(tainted.ok, req('openwop.requirement.0168.coherence-not-in-bundle.schema-forbids-coherence-ids', SECTION, 'a v3 bundle carrying an openwop.it.spec-corpus-validity. id MUST be rejected by the bundle schema')).toBe(false);
+  });
+});

package/src/scenarios/v2-compensation-read-projection.test.ts

@@ -0,0 +1,85 @@
+/**
+ * RFC 0173 §B — `compensation-read-projection` (suite 2.0.0, target major 2; gated on `compensation`).
+ *
+ * Compensation is a core obligation with a declared witness: a host that
+ * advertises `compensation` MUST serve `GET /runs/{runId}/compensation`
+ * (`api/v2/openapi.yaml` `getRunCompensation`,
+ * `schemas/v2/compensation-projection.schema.json`) — `{ runId, status, plan[],
+ * attempts[] }` — so the obligation is deployed-wire evidence rather than
+ * seam-only (RFC 0151 G9; RFC 0173 §B row C6.6; `spec/v2/core/security-defaults.md`
+ * §Compensation).
+ *
+ * A fresh run of the noop fixture has nothing to compensate: the projection
+ * validates with `status: "none"`, an empty plan and no attempts. An unknown
+ * run is `404 not_found` through the canonical envelope.
+ *
+ * @see spec/v2/core/security-defaults.md §Compensation
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const FIXTURE = 'conformance-noop';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+async function waitTerminal(runId: string, timeoutMs: number): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const res = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+    if (res.status === 200 && TERMINAL.has(String((res.json as { status?: unknown } | null)?.status))) return;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+}
+
+describe('RFC 0173 §B — compensation-read-projection (gated on compensation)', () => {
+  it('GET /runs/{runId}/compensation on a fresh run validates with status none', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    if (!(await gateFamily('compensation'))) return softSkip('inapplicable', 'compensation family not advertised — no obligation (gate recorded under openwop.family.compensation)');
+    const fixtures = Array.isArray(doc['fixtures']) ? (doc['fixtures'] as unknown[]) : [];
+    if (!fixtures.includes(FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to project`);
+
+    const create = await driver.post('/runs', { workflowId: FIXTURE });
+    expect(create.status, req('openwop.requirement.0173.compensation-read-projection', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+    await waitTerminal(runId, 10_000);
+
+    const res = await driver.get(`/runs/${encodeURIComponent(runId)}/compensation`);
+    expect(
+      res.status,
+      req('openwop.requirement.0173.compensation-read-projection', 'security-defaults.md §Compensation', 'a host advertising `compensation` MUST serve GET /runs/{runId}/compensation with 200 (RFC 0173 §B — the read projection is the obligation\'s witness)'),
+    ).toBe(200);
+    const check = v2Validator('compensation-projection')(res.json);
+    expect(
+      check.ok,
+      req('openwop.requirement.0173.compensation-read-projection', 'compensation-projection.schema.json', `the projection MUST validate: ${check.errors}`),
+    ).toBe(true);
+    const body = res.json as { runId?: unknown; status?: unknown; plan?: unknown[]; attempts?: unknown[] };
+    expect(body.runId, req('openwop.requirement.0173.compensation-read-projection', 'compensation-projection.schema.json runId', 'runId MUST echo the run read')).toBe(runId);
+    expect(
+      body.status,
+      req('openwop.requirement.0173.compensation-read-projection', 'compensation-projection.schema.json status', 'a run with nothing to compensate MUST project status "none"'),
+    ).toBe('none');
+    expect(body.attempts, req('openwop.requirement.0173.compensation-read-projection', 'compensation-projection.schema.json attempts', 'no attempt exists before an unwind')).toEqual([]);
+  });
+
+  it('an unknown run projects 404 not_found through the canonical envelope', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    if (!(await gateFamily('compensation'))) return softSkip('inapplicable', 'compensation family not advertised — no obligation (gate recorded under openwop.family.compensation)');
+    const res = await driver.get('/runs/conformance-no-such-run-0173/compensation');
+    expect(res.status, req('openwop.requirement.0173.compensation-read-projection.not-found', 'openapi.yaml getRunCompensation 404', 'an unknown runId MUST answer 404')).toBe(404);
+    expect(
+      readErrorCode(res.json),
+      req('openwop.requirement.0173.compensation-read-projection.not-found', 'errors.md §Envelope', 'the 404 MUST carry the registered not_found code in the flat envelope'),
+    ).toBe('not_found');
+  });
+});

package/src/scenarios/v2-configurable-closed.test.ts

@@ -0,0 +1,67 @@
+/**
+ * v2 — `configurable-closed` (suite 2.0.0; RFC 0171 §D.1;
+ * `spec/v2/core/runs.md` §"RunOptions" / `configurable`;
+ * `schemas/v2/configurable.schema.json`).
+ *
+ * Witness class: witnessable — unaided. `configurable` is a closed, nested,
+ * versioned object. A dotted key (`ai.provider` as a string key inside a
+ * section) and an unknown root key MUST be rejected with
+ * `400 validation_error`. The schema leg is server-free (the closure is a
+ * property of the standalone artifact); the two wire legs post the bodies to
+ * `POST /runs` and record `blocked` when the host refuses the control body
+ * for a reason unrelated to `configurable`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/runs.md §configurable';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+const DOTTED = { version: 1, ai: { 'ai.provider': 'x' } };
+const UNKNOWN = { version: 1, unknownKey: 1 };
+const CONTROL = { version: 1 };
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+/** Post a body; when the CONTROL body is itself refused the wire leg is blocked. */
+async function probe(configurable: Record<string, unknown>): Promise<OpenWOPResponse | { reason: string }> {
+  if (!(await discovery())) return { reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
+  const control = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID, configurable: CONTROL }));
+  if (control === null) return { reason: 'POST /runs unreachable (fetch failed)' };
+  if (control.status !== 201) return { reason: `POST /runs with the control body { version: 1 } answered ${control.status} ${readErrorCode(control.json) ?? ''} — the create itself is refused, so the closure of configurable cannot be observed (fixture not seeded?)`.trim() };
+  const res = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID, configurable }));
+  return res ?? { reason: 'POST /runs unreachable (fetch failed)' };
+}
+
+describe('v2 configurable-closed (RFC 0171 §D.1)', () => {
+  it('the standalone schema rejects a dotted key and an unknown root key and accepts the versioned control', () => {
+    const validate = v2Validator('configurable');
+    expect(validate(CONTROL).ok, req('openwop.requirement.0171.configurable-closed.schema', DOC, '{ version: 1 } is the smallest valid configurable (version REQUIRED, const 1)')).toBe(true);
+    expect(validate(DOTTED).ok, req('openwop.requirement.0171.configurable-closed.schema', DOC, 'a dotted key (`ai.provider` as a string key) MUST fail the closed nested schema')).toBe(false);
+    expect(validate(UNKNOWN).ok, req('openwop.requirement.0171.configurable-closed.schema', DOC, 'an unknown root key MUST fail the closed schema (additionalProperties: false in the standalone artifact)')).toBe(false);
+    expect(validate({ ai: { provider: 'x' } }).ok, req('openwop.requirement.0171.configurable-closed.schema', DOC, 'a configurable without `version` MUST fail')).toBe(false);
+  });
+
+  it('POST /runs rejects a dotted key with 400 validation_error', async () => {
+    const res = await probe(DOTTED);
+    if ('reason' in res) return softSkip('blocked', res.reason);
+    expect(res.status, req('openwop.requirement.0171.configurable-closed.dotted-key', DOC, 'a dotted key inside a section MUST be rejected with 400')).toBe(400);
+    expect(readErrorCode(res.json), req('openwop.requirement.0171.configurable-closed.dotted-key', DOC, 'the refusal code MUST be validation_error')).toBe('validation_error');
+  });
+
+  it('POST /runs rejects an unknown root key with 400 validation_error', async () => {
+    const res = await probe(UNKNOWN);
+    if ('reason' in res) return softSkip('blocked', res.reason);
+    expect(res.status, req('openwop.requirement.0171.configurable-closed.unknown-key', DOC, 'an unknown root key MUST be rejected with 400')).toBe(400);
+    expect(readErrorCode(res.json), req('openwop.requirement.0171.configurable-closed.unknown-key', DOC, 'the refusal code MUST be validation_error')).toBe('validation_error');
+  });
+});

package/src/scenarios/v2-dual-stack-negotiation.test.ts

@@ -0,0 +1,118 @@
+/**
+ * v2 — `dual-stack-negotiation` (suite 2.0.0; RFC 0172 §A.3–§A.4;
+ * `spec/v2/core/versioning.md` §1.3 "The request header", §1.4 "The response
+ * header", §5 "The overlap").
+ *
+ * Witness class: witnessable — gated on two majors. Unless `protocolVersions[]`
+ * carries both a `1.x` and a `2.x` member the file records `inapplicable`. On a
+ * dual-advertising host: a run created through `/v1/runs` with NO
+ * `OpenWOP-Version` header is readable through `GET /runs/{runId}` under
+ * `OpenWOP-Version: 2.0`; an unlisted major (`9.0`) is `406
+ * protocol_version_unsupported` with `details.protocolVersions[]`;
+ * `OpenWOP-Version: 2.0` on a `/v1/…` path is `400 protocol_version_mismatch`;
+ * every response's `OpenWOP-Version` equals the contract that produced it. The
+ * header-less v1 call bypasses the driver (which stamps `OpenWOP-Version: 2.0`
+ * under target major 2) with a raw `fetch` against the same base URL.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { loadEnv } from '../lib/env.js';
+import { v2Discovery } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/versioning.md §1.3';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+/** Raw request with exactly the headers given — no OpenWOP-Version unless named. */
+async function raw(method: string, path: string, headers: Record<string, string>, body?: unknown): Promise<OpenWOPResponse | null> {
+  try {
+    const env = loadEnv();
+    const init: RequestInit = { method, headers: { Accept: 'application/json', Authorization: `Bearer ${env.apiKey}`, ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}), ...headers } };
+    if (body !== undefined) init.body = JSON.stringify(body);
+    const res = await fetch(`${env.baseUrl}${path}`, init);
+    const text = await res.text();
+    let json: unknown;
+    try { json = text.length > 0 ? JSON.parse(text) : undefined; } catch { json = undefined; }
+    return { status: res.status, headers: res.headers, text, json };
+  } catch {
+    return null;
+  }
+}
+
+function major(res: OpenWOPResponse | null): string | null {
+  const v = res?.headers.get('openwop-version')?.trim();
+  return v === undefined ? null : (v.split('.')[0] ?? null);
+}
+
+async function gate(): Promise<{ versions: string[] } | { kind: 'blocked' | 'inapplicable'; reason: string }> {
+  const doc = await discovery();
+  if (!doc) return { kind: 'blocked', reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
+  const versions = Array.isArray(doc['protocolVersions']) ? (doc['protocolVersions'] as unknown[]).filter((v): v is string => typeof v === 'string') : [];
+  const has1 = versions.some((v) => v.startsWith('1.'));
+  const has2 = versions.some((v) => v.startsWith('2.'));
+  if (!(has1 && has2)) return { kind: 'inapplicable', reason: `protocolVersions [${versions.join(', ')}] does not carry both a 1.x and a 2.x member — dual-stack negotiation is gated on two majors` };
+  return { versions };
+}
+
+describe('v2 dual-stack-negotiation (RFC 0172 §A.3–§A.4 — gated on two majors)', () => {
+  it('a run created through /v1/runs with no header is readable through /runs under OpenWOP-Version: 2.0', async () => {
+    const g = await gate();
+    if ('kind' in g) return softSkip(g.kind, g.reason);
+    const created = await raw('POST', '/v1/runs', {}, { workflowId: NOOP_WORKFLOW_ID });
+    if (created === null) return softSkip('blocked', 'POST /v1/runs unreachable (fetch failed)');
+    const runId = (created.json as { runId?: unknown } | undefined)?.runId;
+    if (created.status !== 201 || typeof runId !== 'string') return softSkip('blocked', `POST /v1/runs {workflowId: ${NOOP_WORKFLOW_ID}} with no header answered ${created.status} ${readErrorCode(created.json) ?? ''} — the v1 create was refused (fixture not seeded?)`);
+    expect(major(created), req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §1.4', 'a /v1/ response MUST report the 1.x contract that produced it')).toBe('1');
+    const read = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`, { headers: { 'OpenWOP-Version': '2.0' } }));
+    if (read === null) return softSkip('blocked', 'GET /runs/{runId} unreachable (fetch failed)');
+    expect(read.status, req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', 'the overlap: a run created through /v1/runs MUST be readable through GET /runs/{runId} with OpenWOP-Version: 2.0')).toBe(200);
+    expect((read.json as { runId?: unknown } | undefined)?.runId, req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', 'the v2 read MUST name the same run')).toBe(runId);
+    expect(major(read), req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §1.4', 'the v2 read MUST report the 2.x contract that produced it')).toBe('2');
+  });
+
+  it('an unlisted major is 406 protocol_version_unsupported with details.protocolVersions[]', async () => {
+    const g = await gate();
+    if ('kind' in g) return softSkip(g.kind, g.reason);
+    const res = await http(() => driver.get('/.well-known/openwop', { authenticated: false, headers: { 'OpenWOP-Version': '9.0' } }));
+    if (res === null) return softSkip('blocked', 'GET /.well-known/openwop unreachable (fetch failed)');
+    expect(res.status, req('openwop.requirement.0172.dual-stack-negotiation.unlisted-major', DOC, 'a header naming a major not in protocolVersions[] MUST be answered 406')).toBe(406);
+    expect(readErrorCode(res.json), req('openwop.requirement.0172.dual-stack-negotiation.unlisted-major', DOC, 'the refusal code MUST be protocol_version_unsupported')).toBe('protocol_version_unsupported');
+    const echoed = (res.json as { details?: { protocolVersions?: unknown } } | undefined)?.details?.protocolVersions;
+    expect(Array.isArray(echoed) ? [...echoed].sort() : echoed, req('openwop.requirement.0172.dual-stack-negotiation.unlisted-major', DOC, 'details.protocolVersions[] MUST echo the advertised list')).toEqual([...g.versions].sort());
+  });
+
+  it('OpenWOP-Version: 2.0 on a /v1/ path is 400 protocol_version_mismatch', async () => {
+    const g = await gate();
+    if ('kind' in g) return softSkip(g.kind, g.reason);
+    const res = await http(() => driver.get('/v1/openapi.json', { authenticated: false, headers: { 'OpenWOP-Version': '2.0' } }));
+    if (res === null) return softSkip('blocked', 'GET /v1/openapi.json unreachable (fetch failed)');
+    expect(res.status, req('openwop.requirement.0172.dual-stack-negotiation.v1-path-mismatch', DOC, 'a /v1/… path with OpenWOP-Version other than 1 MUST be answered 400')).toBe(400);
+    expect(readErrorCode(res.json), req('openwop.requirement.0172.dual-stack-negotiation.v1-path-mismatch', DOC, 'the refusal code MUST be protocol_version_mismatch')).toBe('protocol_version_mismatch');
+  });
+
+  it('every response reports the contract that produced it', async () => {
+    const g = await gate();
+    if ('kind' in g) return softSkip(g.kind, g.reason);
+    const v1 = await raw('GET', '/v1/openapi.json', {});
+    const v1Named = await raw('GET', '/v1/openapi.json', { 'OpenWOP-Version': '1.0' });
+    const v2 = await http(() => driver.get('/.well-known/openwop', { authenticated: false, headers: { 'OpenWOP-Version': '2.0' } }));
+    if (v1 === null || v1Named === null || v2 === null) return softSkip('blocked', 'a probe was unreachable (fetch failed)');
+    expect(major(v1), req('openwop.requirement.0172.dual-stack-negotiation.response-header', 'spec/v2/core/versioning.md §1.4', 'a header-less /v1/ response MUST carry OpenWOP-Version: 1.<minor> — the contract used, never another (silent downgrade)')).toBe('1');
+    expect(major(v1Named), req('openwop.requirement.0172.dual-stack-negotiation.response-header', 'spec/v2/core/versioning.md §1.4', 'a /v1/ response under OpenWOP-Version: 1.0 MUST carry OpenWOP-Version: 1.<minor>')).toBe('1');
+    expect(major(v2), req('openwop.requirement.0172.dual-stack-negotiation.response-header', 'spec/v2/core/versioning.md §1.4', 'a response under OpenWOP-Version: 2.0 MUST carry OpenWOP-Version: 2.<minor>')).toBe('2');
+    for (const res of [v1, v1Named, v2]) {
+      const v = res.headers.get('openwop-version')?.trim() ?? '';
+      expect(g.versions.includes(v), req('openwop.requirement.0172.dual-stack-negotiation.response-header', 'spec/v2/core/versioning.md §1.4', `the reported contract (${v}) MUST be a member of the advertised protocolVersions[]`)).toBe(true);
+    }
+  });
+});