@openwop/openwop-conformance 1.18.1 → 1.19.0

package/schemas/README.md

@@ -32,6 +32,7 @@
 | `capabilities.schema.json` | `capabilities.md` | `/.well-known/openwop` response — protocolVersion + supportedEnvelopes + schemaVersions + limits + optional v1 discovery surface |
 | `channel-written-payload.schema.json` | `channels-and-reducers.md` §Channel write event | Payload of the `channel.written` RunEvent — write input + reducer name |
 | `chat-card-pack-manifest.schema.json` | `chat-card-packs.md` + RFC 0071 | DRAFT — manifest for `kind: "card"` registry packs (RFC 0071 Phase 2). Peer to the node/workflow-chain/prompt/artifact-type pack manifests; disjoint via the `kind` discriminator. Distributes AI chat cards: a prompt template + typed input subset bound to a typed `outputArtifactType`. |
+| `conformance-certification-bundle.schema.json` | `conformance-certification.md` + RFC 0089 | DRAFT — machine-readable attestation binding a host's claimed profiles to the reproducible run that substantiates them (suite version + per-scenario pass list + host identity/commit + captured discovery document). Out-of-band; a consumer re-derives each claim via the §B binding rule. |
 | `conversation-event.schema.json` | `channels-and-reducers.md` + conversation RFC | Multi-turn conversation event shape for orchestrator-driven HITL flows |
 | `conversation-turn.schema.json` | `channels-and-reducers.md` + conversation RFC | Conversation turn shape for user/agent/system messages |
 | `core-conformance-mock-agent-config.schema.json` | `node-packs.md` + RFC 0023 | Config shape for the conformance-only `core.conformance.mock-agent` typeId — drives `agent.*` event emission on cue (`mockReasoning` / `mockToolCalls` / `mockHandoff` / `mockDecision` / `mockConfidence`). Hosts MUST refuse this typeId for production tenants unless `capabilities.conformance.mockAgent` is advertised. |

package/schemas/capabilities.schema.json

@@ -769,6 +769,11 @@
         "mockAgent": {
           "type": "boolean",
           "description": "RFC 0023 §B.2. When `true`, the host has registered the `core.conformance.mock-agent` typeId. The scenarios `agentReasoningEvents.test.ts` and `agentConfidenceEscalation.test.ts` rely on the typeId being reachable. Hosts that register the typeId only for workflow ids matching the conformance fixture prefix (`conformance-*`) and refuse it for other tenants MAY still advertise `true` — the advertisement says only that the typeId is reachable from the conformance suite, not that it is reachable from arbitrary workflows."
+        },
+        "certificationBundleUrl": {
+          "type": "string",
+          "format": "uri",
+          "description": "OPTIONAL (RFC 0089). URL of the host's most recent conformance certification bundle (`conformance-certification-bundle.schema.json`) — a machine-readable attestation binding this host's claimed profiles to the reproducible run that substantiates them. Omitting it is fully conformant; clients MUST tolerate its absence."
         }
       },
       "additionalProperties": false

package/schemas/conformance-certification-bundle.schema.json

@@ -0,0 +1,86 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/conformance-certification-bundle.schema.json",
+  "title": "OpenWOP Conformance Certification Bundle",
+  "description": "RFC 0089. A machine-readable attestation binding a host's claimed profiles to the reproducible run that substantiates them: suite version, per-scenario pass list, host identity + commit, and the captured discovery document. An out-of-band artifact emitted by the conformance harness (not a runtime wire message). A consumer MUST re-derive each claimed profile from the embedded `discovery.document` rather than trusting `claimedProfiles` verbatim (RFC 0089 §B).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["bundleVersion", "generatedAt", "generator", "suite", "host", "discovery", "claimedProfiles", "results"],
+  "properties": {
+    "bundleVersion": {
+      "const": "1",
+      "description": "Certification-bundle format version. `1` for RFC 0089."
+    },
+    "generatedAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "RFC 3339 timestamp when the bundle was generated. Marks the bundle as a point-in-time attestation."
+    },
+    "generator": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "version"],
+      "properties": {
+        "name": { "type": "string", "description": "Tool that produced the bundle, e.g. `@openwop/openwop-conformance --certify`." },
+        "version": { "type": "string" }
+      }
+    },
+    "suite": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["package", "version"],
+      "properties": {
+        "package": { "const": "@openwop/openwop-conformance" },
+        "version": { "type": "string", "description": "Exact conformance suite version the results were produced against." }
+      }
+    },
+    "host": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "version"],
+      "properties": {
+        "name": { "type": "string" },
+        "version": { "type": "string" },
+        "vendor": { "type": "string" },
+        "commit": { "type": "string", "description": "VCS commit / build id of the host under test, when known. Self-reported; authoritative only for independent-verifier-generated bundles (RFC 0089 §Security)." }
+      }
+    },
+    "discovery": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["url", "sha256", "document"],
+      "properties": {
+        "url": { "type": "string", "format": "uri", "description": "The `/.well-known/openwop` URL fetched for this run." },
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$", "description": "SHA-256 of the canonical-JSON serialization of `document`, so a verifier can confirm it matches a live fetch." },
+        "document": { "type": "object", "description": "The verbatim `/.well-known/openwop` discovery document captured for this run. Profile derivation re-runs against THIS document." }
+      }
+    },
+    "claimedProfiles": {
+      "type": "array",
+      "items": { "type": "string" },
+      "minItems": 0,
+      "description": "Profiles the host claims. A bundle MUST NOT list a profile its own `discovery.document` does not derive (RFC 0089 §B(1))."
+    },
+    "results": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["totals", "passed", "failed", "skipped"],
+      "properties": {
+        "totals": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["passed", "failed", "skipped", "total"],
+          "properties": {
+            "passed": { "type": "integer", "minimum": 0 },
+            "failed": { "type": "integer", "minimum": 0 },
+            "skipped": { "type": "integer", "minimum": 0 },
+            "total": { "type": "integer", "minimum": 0 }
+          }
+        },
+        "passed": { "type": "array", "items": { "type": "string" }, "description": "Stable scenario IDs that passed non-vacuously. The generator MUST NOT list a scenario here that did not run non-vacuously." },
+        "failed": { "type": "array", "items": { "type": "string" } },
+        "skipped": { "type": "array", "items": { "type": "string" } }
+      }
+    }
+  }
+}

package/src/cli.ts

@@ -11,6 +11,7 @@
  *   openwop-conformance --offline                       # server-free subset only
  *   openwop-conformance --filter discovery               # category filter
  *   openwop-conformance --base-url ... --api-key ... --filter "interrupt|cancellation"
+ *   openwop-conformance --base-url ... --api-key ... --certify out.json   # RFC 0089 bundle
  *
  * Environment variables override flags (per the conformance harness's
  * existing convention):
@@ -25,7 +26,19 @@
 
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { dirname, resolve as resolvePath } from 'node:path';
+import { dirname, resolve as resolvePath, join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR } from './lib/paths.js';
+import {
+  deriveProfiles,
+  isCoreStandard,
+  agentPlatformStatus,
+  type DiscoveryPayload,
+} from './lib/profiles.js';
 
 interface ParsedArgs {
   readonly baseUrl: string | undefined;
@@ -35,6 +48,8 @@ interface ParsedArgs {
   readonly help: boolean;
   readonly impl: string | undefined;
   readonly implVersion: string | undefined;
+  /** RFC 0089 — emit a conformance certification bundle to this path. */
+  readonly certify: string | undefined;
 }
 
 function parseArgs(argv: readonly string[]): ParsedArgs {
@@ -45,6 +60,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
   let help = false;
   let impl: string | undefined;
   let implVersion: string | undefined;
+  let certify: string | undefined;
 
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i] ?? '';
@@ -87,6 +103,9 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
       case '--implementation-version':
         implVersion = nextValue();
         break;
+      case '--certify':
+        certify = nextValue();
+        break;
       default:
         if (arg.startsWith('-')) {
           // Unknown flag — pass through to vitest by ignoring here.
@@ -94,7 +113,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
     }
   }
 
-  return { baseUrl, apiKey, offline, filter, help, impl, implVersion };
+  return { baseUrl, apiKey, offline, filter, help, impl, implVersion, certify };
 }
 
 const HELP_TEXT = `openwop-conformance — run the openwop conformance suite against a server
@@ -114,6 +133,14 @@ Implementation labels (cosmetic — surface in failure messages):
   --impl <name>             Implementation name        (env: OPENWOP_IMPLEMENTATION_NAME)
   --impl-version <version>  Implementation version     (env: OPENWOP_IMPLEMENTATION_VERSION)
 
+Certification (RFC 0089):
+  --certify <out.json>  Generate a machine-readable conformance certification
+                        bundle: fetch /.well-known/openwop (captured verbatim +
+                        SHA-256), derive claimedProfiles from it, run the suite
+                        recording each scenario's terminal state, validate the
+                        assembled bundle against the bundle schema, and write it
+                        to <out.json>. Requires --base-url (and --api-key as usual).
+
 Other:
   --help, -h            Show this message
 
@@ -121,9 +148,234 @@ Examples:
   openwop-conformance --offline
   openwop-conformance --base-url https://api.example.com --api-key hk_test_abc
   openwop-conformance --filter "discovery|errors"
+  openwop-conformance --base-url https://api.example.com --api-key hk_test_abc \\
+    --certify certification-bundle.json
 `;
 
-function main(): never {
+/** This CLI package's own version — surfaced as `generator.version` + `suite.version`. */
+function suiteVersion(): string {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const pkgPath = resolvePath(here, '..', 'package.json');
+  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as { version?: unknown };
+  return typeof pkg.version === 'string' ? pkg.version : '0.0.0';
+}
+
+/**
+ * Deterministic canonical-JSON serialization (RFC 8785 spirit): object keys
+ * sorted lexicographically at every level, arrays preserved in order. Used to
+ * compute `discovery.sha256` so a verifier can re-derive the same digest from
+ * a live `/.well-known/openwop` fetch regardless of incidental key order.
+ */
+function canonicalJSON(value: unknown): string {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalJSON).join(',')}]`;
+  const obj = value as Record<string, unknown>;
+  const keys = Object.keys(obj).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJSON(obj[k])}`).join(',')}}`;
+}
+
+/**
+ * The full set of profiles a discovery document derives — the closed
+ * `deriveProfiles` catalog plus the two operational annexes
+ * (`openwop-core-standard`, `openwop-agent-platform`) when their discovery
+ * predicate holds. This is `claimedProfiles`: a generated bundle MUST NOT
+ * claim a profile its own discovery document does not derive (RFC 0089 §B(1)).
+ */
+function claimedProfilesFor(doc: DiscoveryPayload): string[] {
+  const profiles: string[] = [...deriveProfiles(doc)];
+  if (isCoreStandard(doc)) profiles.push('openwop-core-standard');
+  if (agentPlatformStatus(doc) !== 'none') profiles.push('openwop-agent-platform');
+  return profiles;
+}
+
+/** A single scenario test file's terminal state, derived from the vitest JSON report. */
+type ScenarioState = 'passed' | 'failed' | 'skipped';
+
+/** The subset of vitest's JSON reporter output we read. */
+interface VitestJsonReport {
+  readonly testResults?: ReadonlyArray<{
+    readonly name?: string;
+    readonly assertionResults?: ReadonlyArray<{ readonly status?: string }>;
+  }>;
+}
+
+/**
+ * Reduce a vitest JSON report into a per-scenario-file terminal state, keyed by
+ * the test-file basename (e.g. `discovery.test.ts`) to align with the basenames
+ * in `PROFILE_FLOOR_SCENARIOS`. A file is `passed` only if it ran AND had ≥1
+ * passing assertion AND zero failures (non-vacuous, per §C); a fully-skipped
+ * file is `skipped`; any failed assertion makes the file `failed`.
+ */
+function scenarioStatesFromReport(report: VitestJsonReport): Map<string, ScenarioState> {
+  const states = new Map<string, ScenarioState>();
+  for (const file of report.testResults ?? []) {
+    const name = file.name;
+    if (typeof name !== 'string') continue;
+    const basename = name.split('/').pop() ?? name;
+    const assertions = file.assertionResults ?? [];
+    let passes = 0;
+    let failures = 0;
+    let nonSkipped = 0;
+    for (const a of assertions) {
+      if (a.status === 'passed') {
+        passes++;
+        nonSkipped++;
+      } else if (a.status === 'failed') {
+        failures++;
+        nonSkipped++;
+      }
+      // `skipped` / `todo` / `pending` count toward neither pass nor fail.
+    }
+    let state: ScenarioState;
+    if (failures > 0) state = 'failed';
+    else if (passes > 0 && nonSkipped > 0) state = 'passed';
+    else state = 'skipped';
+    states.set(basename, state);
+  }
+  return states;
+}
+
+/** Generate + validate + write an RFC 0089 conformance certification bundle. */
+async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Promise<never> {
+  const outPath = args.certify;
+  if (outPath === undefined) process.exit(2);
+
+  // (a) Fetch /.well-known/openwop verbatim + its canonical-JSON SHA-256.
+  const discoveryUrl = `${baseUrl.replace(/\/$/, '')}/.well-known/openwop`;
+  let document: DiscoveryPayload;
+  try {
+    const resp = await fetch(discoveryUrl, { headers: { Accept: 'application/json' } });
+    if (!resp.ok) {
+      process.stderr.write(
+        `openwop-conformance --certify: GET ${discoveryUrl} returned HTTP ${resp.status}.\n`,
+      );
+      process.exit(2);
+    }
+    document = (await resp.json()) as DiscoveryPayload;
+  } catch (err) {
+    process.stderr.write(
+      `openwop-conformance --certify: failed to fetch ${discoveryUrl}: ${String(err)}\n`,
+    );
+    process.exit(2);
+  }
+  const sha256 = createHash('sha256').update(canonicalJSON(document)).digest('hex');
+
+  // (b) Derive claimedProfiles from the captured document.
+  const claimedProfiles = claimedProfilesFor(document);
+
+  // (c) Run the suite, capturing per-scenario terminal state via the vitest
+  // JSON reporter. server-targeted scenarios live under src/scenarios/.
+  const here = dirname(fileURLToPath(import.meta.url));
+  const conformanceRoot = resolvePath(here, '..');
+  const reportDir = mkdtempSync(join(tmpdir(), 'owp-certify-'));
+  const reportFile = join(reportDir, 'vitest-report.json');
+  const env: NodeJS.ProcessEnv = { ...process.env };
+  env.OPENWOP_BASE_URL = baseUrl;
+  env.OPENWOP_API_KEY = apiKey;
+  if (args.impl) env.OPENWOP_IMPLEMENTATION_NAME = args.impl;
+  if (args.implVersion) env.OPENWOP_IMPLEMENTATION_VERSION = args.implVersion;
+
+  const vitestArgs: string[] = [
+    'vitest',
+    'run',
+    '--config',
+    resolvePath(conformanceRoot, 'vitest.config.ts'),
+    '--reporter=json',
+    `--outputFile=${reportFile}`,
+  ];
+  const runResult = spawnSync('npx', vitestArgs, { cwd: conformanceRoot, env, stdio: 'inherit' });
+  if (runResult.error) {
+    process.stderr.write(
+      `openwop-conformance --certify: failed to spawn vitest: ${String(runResult.error)}\n`,
+    );
+    process.exit(2);
+  }
+
+  let report: VitestJsonReport;
+  try {
+    report = JSON.parse(readFileSync(reportFile, 'utf8')) as VitestJsonReport;
+  } catch (err) {
+    process.stderr.write(
+      `openwop-conformance --certify: could not read vitest JSON report at ${reportFile}: ${String(err)}\n`,
+    );
+    process.exit(2);
+  } finally {
+    rmSync(reportDir, { recursive: true, force: true });
+  }
+
+  const states = scenarioStatesFromReport(report);
+  const passed: string[] = [];
+  const failed: string[] = [];
+  const skipped: string[] = [];
+  for (const [basename, state] of [...states.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    if (state === 'passed') passed.push(basename);
+    else if (state === 'failed') failed.push(basename);
+    else skipped.push(basename);
+  }
+
+  // (d) Assemble the bundle.
+  const version = suiteVersion();
+  const impl = (document as { implementation?: { name?: unknown; version?: unknown; vendor?: unknown } })
+    .implementation;
+  const hostName =
+    args.impl ?? (typeof impl?.name === 'string' ? impl.name : 'unknown-host');
+  const hostVersion =
+    args.implVersion ?? (typeof impl?.version === 'string' ? impl.version : '0.0.0');
+  const host: { name: string; version: string; vendor?: string } = {
+    name: hostName,
+    version: hostVersion,
+  };
+  if (typeof impl?.vendor === 'string') host.vendor = impl.vendor;
+
+  const bundle = {
+    bundleVersion: '1' as const,
+    generatedAt: new Date().toISOString(),
+    generator: { name: '@openwop/openwop-conformance --certify', version },
+    suite: { package: '@openwop/openwop-conformance' as const, version },
+    host,
+    discovery: { url: discoveryUrl, sha256, document },
+    claimedProfiles,
+    results: {
+      totals: {
+        passed: passed.length,
+        failed: failed.length,
+        skipped: skipped.length,
+        total: passed.length + failed.length + skipped.length,
+      },
+      passed,
+      failed,
+      skipped,
+    },
+  };
+
+  // (e) Validate against the bundle schema BEFORE writing.
+  const schema = JSON.parse(
+    readFileSync(join(SCHEMAS_DIR, 'conformance-certification-bundle.schema.json'), 'utf8'),
+  ) as Record<string, unknown>;
+  const ajv = new Ajv2020({ allErrors: true, strict: false });
+  addFormats(ajv);
+  const validate = ajv.compile(schema);
+  if (!validate(bundle)) {
+    process.stderr.write(
+      'openwop-conformance --certify: assembled bundle FAILED schema validation:\n' +
+        `${JSON.stringify(validate.errors, null, 2)}\n`,
+    );
+    process.exit(2);
+  }
+
+  writeFileSync(outPath, `${JSON.stringify(bundle, null, 2)}\n`);
+  process.stdout.write(
+    `openwop-conformance --certify: wrote certification bundle to ${outPath}\n` +
+      `  host: ${host.name}@${host.version}\n` +
+      `  claimedProfiles: ${claimedProfiles.length > 0 ? claimedProfiles.join(', ') : '(none)'}\n` +
+      `  results: ${passed.length} passed / ${failed.length} failed / ${skipped.length} skipped\n`,
+  );
+  // Exit code mirrors the suite outcome: a failing run still produces a bundle
+  // (the failures are recorded), but the process exit reflects pass/fail.
+  process.exit(failed.length > 0 ? 1 : 0);
+}
+
+async function main(): Promise<never> {
   const args = parseArgs(process.argv.slice(2));
 
   if (args.help) {
@@ -139,6 +391,18 @@ function main(): never {
   if (args.impl) env.OPENWOP_IMPLEMENTATION_NAME = args.impl;
   if (args.implVersion) env.OPENWOP_IMPLEMENTATION_VERSION = args.implVersion;
 
+  // RFC 0089 — certification-bundle generation requires a live host.
+  if (args.certify !== undefined) {
+    if (!env.OPENWOP_BASE_URL || !env.OPENWOP_API_KEY) {
+      process.stderr.write(
+        'openwop-conformance --certify: --base-url and --api-key are required.\n' +
+          'Run `openwop-conformance --help` for usage.\n',
+      );
+      process.exit(2);
+    }
+    return runCertify(args, env.OPENWOP_BASE_URL, env.OPENWOP_API_KEY);
+  }
+
   if (!args.offline && (!env.OPENWOP_BASE_URL || !env.OPENWOP_API_KEY)) {
     process.stderr.write(
       'openwop-conformance: --base-url and --api-key are required (or use --offline).\n' +
@@ -184,4 +448,4 @@ function main(): never {
   process.exit(result.status ?? 1);
 }
 
-main();
+void main();

package/src/lib/profiles.ts

@@ -428,3 +428,88 @@ export function hasProfile(c: DiscoveryPayload, profile: ProfileName): boolean {
       return isTriggerBridge(c);
   }
 }
+
+// ── RFC 0089: conformance certification bundle — floor-scenario sets + verifier ──
+//
+// G1 (RFC 0089): the §B binding rule needs each profile's REQUIRED floor
+// scenarios in a machine-readable form. Source of truth for
+// `openwop-core-standard` is `core-standard-profile.md` §C — the nine named
+// black-box floor scenarios plus the `interrupt-*` family. Keyed by profile
+// name (string) because annex profiles like `openwop-core-standard` sit outside
+// the closed `PROFILE_NAMES` catalog.
+
+export interface ProfileFloor {
+  /** Scenario files (basenames) that MUST each appear in `results.passed`. */
+  readonly required: readonly string[];
+  /** Prefix groups where ≥1 matching passed scenario satisfies the group. */
+  readonly requiredAnyPrefix?: readonly string[];
+}
+
+export const PROFILE_FLOOR_SCENARIOS: Readonly<Record<string, ProfileFloor>> = {
+  'openwop-core-standard': {
+    required: [
+      'runs-lifecycle.test.ts',
+      'discovery.test.ts',
+      'auth.test.ts',
+      'eventOrdering.test.ts',
+      'failure-path.test.ts',
+      'idempotency.test.ts',
+      'idempotency-key-determinism.test.ts',
+      'webhook-negative.test.ts',
+      'audit-log-verification.test.ts',
+    ],
+    requiredAnyPrefix: ['interrupt-'],
+  },
+};
+
+/** Is `profile` derivable from a discovery document? Maps a profile name to its predicate (RFC 0089 §B(1)). */
+export function profileDerivable(c: DiscoveryPayload, profile: string): boolean {
+  if (profile === 'openwop-core-standard') return isCoreStandard(c);
+  if (profile === 'openwop-agent-platform') return agentPlatformStatus(c) !== 'none';
+  if ((PROFILE_NAMES as readonly string[]).includes(profile)) {
+    return deriveProfiles(c).includes(profile as ProfileName);
+  }
+  return false;
+}
+
+/** Minimal shape of an RFC 0089 certification bundle the verifier reads. */
+export interface CertificationBundleLike {
+  readonly discovery: { readonly document: DiscoveryPayload };
+  readonly claimedProfiles: readonly string[];
+  readonly results: { readonly passed: readonly string[] };
+}
+
+export interface BundleProfileVerdict {
+  readonly profile: string;
+  /** §B(1): derivable from the captured discovery document. */
+  readonly derivable: boolean;
+  /** §B(2): every floor scenario for the profile is in `results.passed`. */
+  readonly floorProven: boolean;
+  readonly valid: boolean;
+  readonly missingFloor: readonly string[];
+}
+
+const scenarioBasename = (id: string): string => id.split('/').pop() ?? id;
+
+/**
+ * Verify a bundle's claim for one profile per RFC 0089 §B. A consumer MUST
+ * re-derive (this function) rather than trust `claimedProfiles` verbatim.
+ */
+export function verifyBundleProfile(bundle: CertificationBundleLike, profile: string): BundleProfileVerdict {
+  const derivable = profileDerivable(bundle.discovery.document, profile);
+  const floor = PROFILE_FLOOR_SCENARIOS[profile];
+  const passed = new Set(bundle.results.passed.map(scenarioBasename));
+  const missingFloor = floor ? floor.required.filter((r) => !passed.has(scenarioBasename(r))) : [];
+  const prefixOk = (floor?.requiredAnyPrefix ?? []).every((p) => [...passed].some((s) => s.startsWith(p)));
+  const floorProven = missingFloor.length === 0 && prefixOk;
+  return { profile, derivable, floorProven, valid: derivable && floorProven, missingFloor };
+}
+
+/** Verify every profile in `bundle.claimedProfiles`; the bundle is valid iff all claims are valid. */
+export function verifyBundle(bundle: CertificationBundleLike): {
+  readonly valid: boolean;
+  readonly verdicts: readonly BundleProfileVerdict[];
+} {
+  const verdicts = bundle.claimedProfiles.map((p) => verifyBundleProfile(bundle, p));
+  return { valid: verdicts.every((v) => v.valid), verdicts };
+}