@openwop/openwop-conformance 1.2.0 → 1.4.0

package/src/scenarios/cross-host-traceparent-propagation.test.ts

@@ -0,0 +1,60 @@
+/**
+ * cross-host-traceparent-propagation — RFC 0040 §B behavioral (capability-gated).
+ *
+ * Status: ACTIVE (capability-gated; behavioral assertion soft-skipped
+ * until a cross-host MCP/A2A composition test fixture ships). Gated on
+ * `capabilities.multiAgent.executionModel.version >= 3` AND
+ * `capabilities.multiAgent.executionModel.crossHostCausation.supported: true`.
+ *
+ * Asserts (when host advertises Phase 3 + a real MCP/A2A composition
+ * endpoint is reachable):
+ *
+ *   1. An outbound MCP tool call dispatched from a Phase 3 host MUST
+ *      carry the parent run's W3C `traceparent` header. The MCP server
+ *      receives the header AND uses it as the parent trace for any
+ *      spans it emits (closing the cross-host span linkage that
+ *      RFC 0023's same-host coverage left open).
+ *
+ *   2. An inbound MCP tool reply OR A2A message handler MUST adopt the
+ *      `traceparent` header from the inbound envelope as the trace
+ *      parent for any subsequent events the receiving agent emits.
+ *
+ *   3. (Symmetric) Outbound A2A messages MUST carry the parent run's
+ *      `traceparent`; inbound A2A handlers MUST adopt it.
+ *
+ * Behavioral wiring requires a cross-host test harness: either a real
+ * MCP server peer (`OPENWOP_MCP_REAL_SERVER_URL`) or an A2A peer
+ * (`OPENWOP_A2A_REAL_PEER_URL`) the host can call into. Without those,
+ * the assertion soft-skips and only the shape probe in
+ * cross-host-causation-shape.test.ts applies.
+ *
+ * @see RFCS/0040-multi-agent-cross-host-causation.md §B
+ * @see spec/v1/multi-agent-execution.md §"W3C tracecontext across MCP + A2A composition"
+ * @see RFCS/0023-conformance-agent-event-emitters.md (the same-host predecessor)
+ */
+
+import { describe, it } from 'vitest';
+
+// Behavioral assertions in this file are currently `it.todo` placeholders;
+// the cross-host MCP / A2A peer harness (gated on OPENWOP_MCP_REAL_SERVER_URL
+// / OPENWOP_A2A_REAL_PEER_URL) hasn't landed yet. When it does, the
+// `it.todo` calls flip back to runnable `it(...)` bodies that read discovery
+// (via `driver.get('/.well-known/openwop')`), gate on `Phase 3` advertisement,
+// and drive the workflow through the configured real peer.
+
+describe('cross-host-traceparent-propagation: behavioral (RFC 0040 §B)', () => {
+  // Behavioral assertion drives a workflow that calls an MCP tool via the
+  // host's `core.mcp.toolCall` node. The MCP peer (configured via
+  // OPENWOP_MCP_REAL_SERVER_URL) records inbound headers; the test reads
+  // the recorded headers and asserts `traceparent` is present + matches
+  // the format `00-{traceId}-{spanId}-{flags}` per W3C tracecontext.
+  // Until the peer harness lands, the assertion is surfaced as `todo` so
+  // test reporters track the gap rather than reporting a vacuous PASS.
+  it.todo('Phase 3 host MUST inject parent run\'s traceparent into outbound MCP requests');
+
+  // Behavioral assertion drives a workflow that dispatches an A2A message
+  // via the host's `core.a2a.send` (or equivalent) node. The A2A peer
+  // (configured via OPENWOP_A2A_REAL_PEER_URL) records inbound headers;
+  // the test asserts `traceparent` is present + well-formed.
+  it.todo('Phase 3 host MUST inject parent run\'s traceparent into outbound A2A messages');
+});

package/src/scenarios/dispatch-cross-worker-handoff.test.ts

@@ -92,7 +92,38 @@ describe.skipIf(SKIP)('dispatch-cross-worker-handoff: sequential child→parent
     )).toBe('hello');
   });
 
-  it.todo(
-    'HVMAP-1c-override: per-worker mapping overrides default mapping. dispatch.inputMapping={input:"defaultX"}; perWorkerInputMappings.child-b={input:"sharedVar"}; child-b MUST receive inputs.input from sharedVar, NOT defaultX. Requires a fixture variant carrying both default + per-worker mappings.',
-  );
+  it('HVMAP-1c-override: per-worker mapping overrides default mapping per §A effectiveInputMapping precedence', async () => {
+    const PARENT_OVERRIDE = 'conformance-dispatch-per-worker-override';
+    if (!isFixtureAdvertised(PARENT_OVERRIDE)) return; // fixture not seeded — soft-skip
+    const create = await driver.post('/v1/runs', { workflowId: PARENT_OVERRIDE });
+    expect(create.status).toBe(201);
+    const parentRunId = (create.json as { runId: string }).runId;
+    await pollUntilTerminal(parentRunId);
+
+    const eventsRes = await driver.get(`/v1/runs/${encodeURIComponent(parentRunId)}/events`);
+    const events = ((eventsRes.json as { events?: RunEvent[] } | undefined)?.events ?? []);
+    const dispatchedA = events.find((e) => e.type === 'node.dispatched' && e.payload?.childWorkflowId === CHILD_A);
+    const dispatchedB = events.find((e) => e.type === 'node.dispatched' && e.payload?.childWorkflowId === CHILD_B);
+    if (!dispatchedA || !dispatchedB) return;
+
+    const childARes = await driver.get(`/v1/runs/${encodeURIComponent(dispatchedA.payload!.childRunId!)}`);
+    const childBRes = await driver.get(`/v1/runs/${encodeURIComponent(dispatchedB.payload!.childRunId!)}`);
+    const childAInputs = (childARes.json as { inputs?: Record<string, unknown> }).inputs ?? {};
+    const childBInputs = (childBRes.json as { inputs?: Record<string, unknown> }).inputs ?? {};
+
+    expect(
+      childAInputs.input,
+      driver.describe(
+        'RFCS/0022-dispatch-input-output-mapping.md §A',
+        'child-a uses the DEFAULT inputMapping; input MUST come from parent.defaultX',
+      ),
+    ).toBe('default-x-value');
+    expect(
+      childBInputs.input,
+      driver.describe(
+        'RFCS/0022-dispatch-input-output-mapping.md §A',
+        'child-b uses the per-worker OVERRIDE; input MUST come from parent.sharedVar (NOT defaultX)',
+      ),
+    ).toBe('shared-value');
+  });
 });

package/src/scenarios/dispatch-input-mapping.test.ts

@@ -24,6 +24,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { setHostCapability, resetHostCapabilities, isToggleAvailable } from '../lib/host-toggle.js';
 
 const PARENT = 'conformance-dispatch-input-mapping';
 const CHILD = 'conformance-dispatch-input-mapping-child';
@@ -84,11 +85,79 @@ describe.skipIf(SKIP)('dispatch-input-mapping: parent → child variable project
     )).toBe('Alice');
   });
 
-  it.todo(
-    'HVMAP-1a-null: parent variable unset → child input surfaces as `undefined` (NOT omitted, NOT `null`) per §A normative bullet. Requires a fixture variant omitting parentName.defaultValue.',
-  );
+  it('HVMAP-1a-null: parent variable unset → child input surfaces as `undefined` per §A', async () => {
+    const PARENT_NO_DEFAULT = 'conformance-dispatch-input-mapping-no-default';
+    if (!isFixtureAdvertised(PARENT_NO_DEFAULT) || !isFixtureAdvertised(CHILD)) return; // fixture not seeded — soft-skip
+    const create = await driver.post('/v1/runs', { workflowId: PARENT_NO_DEFAULT });
+    expect(create.status).toBe(201);
+    const parentRunId = (create.json as { runId: string }).runId;
+    await pollUntilTerminal(parentRunId);
 
-  it.todo(
-    'HVMAP-1a-refusal: host advertises capabilities.agents.dispatch: true but NOT capabilities.agents.dispatchMapping: true; workflow with non-empty inputMapping MUST fail registration with validation_error + details.requiredCapability === "agents.dispatchMapping". Requires a host-capability-toggle hook in the conformance harness.',
-  );
+    const eventsRes = await driver.get(`/v1/runs/${encodeURIComponent(parentRunId)}/events`);
+    const events = ((eventsRes.json as { events?: RunEvent[] } | undefined)?.events ?? []);
+    const dispatched = events.find(
+      (e) => e.type === 'node.dispatched' && e.payload?.childWorkflowId === CHILD,
+    );
+    if (!dispatched) return; // host doesn't emit node.dispatched — soft-skip
+    const childRunId = dispatched.payload?.childRunId;
+
+    const childRes = await driver.get(`/v1/runs/${encodeURIComponent(childRunId!)}`);
+    const child = childRes.json as RunSnapshot;
+    // Per RFC 0022 §A: an unset parent variable MUST surface as `undefined`.
+    // On the wire, `undefined` becomes either omitted from the JSON object
+    // OR explicit `null`; the spec REJECTS the latter. We accept either
+    // "key absent" or "key === undefined" but FAIL on `null`.
+    const inputs = child.inputs ?? {};
+    const v = inputs.childGreeting;
+    expect(
+      v === undefined || !('childGreeting' in inputs),
+      driver.describe(
+        'RFCS/0022-dispatch-input-output-mapping.md §A',
+        'unset parent variable projection MUST surface as undefined (NOT null, NOT a default placeholder)',
+      ),
+    ).toBe(true);
+    expect(v).not.toBe(null);
+  });
+
+});
+
+describe('dispatch-input-mapping: registration refusal (RFC 0022 §C HVMAP-1a-refusal)', () => {
+  it('host with agents.dispatchMapping toggled OFF MUST refuse non-empty inputMapping at registration', async () => {
+    if (!(await isToggleAvailable())) return; // seam not exposed — soft-skip
+    await setHostCapability('agents.dispatchMapping', false);
+    try {
+      const workflow = {
+        workflowId: `hvmap-1a-refusal-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+        nodes: [
+          {
+            nodeId: 'dispatch-1',
+            typeId: 'core.dispatch',
+            config: {
+              nextWorkerIds: ['child-a'],
+              inputMapping: { childInput: 'parentVar' }, // non-empty — refusal trigger
+            },
+          },
+        ],
+      };
+      const res = await driver.post('/v1/host/sample/workflows', workflow);
+      expect(
+        res.status,
+        driver.describe(
+          'RFCS/0022-dispatch-input-output-mapping.md §C',
+          'workflow with non-empty inputMapping MUST be refused when capabilities.agents.dispatchMapping is not advertised',
+        ),
+      ).toBe(400);
+      const body = res.json as { error?: string; details?: { requiredCapability?: string } };
+      expect(body.error).toBe('validation_error');
+      expect(
+        body.details?.requiredCapability,
+        driver.describe(
+          'RFCS/0022-dispatch-input-output-mapping.md §C',
+          'refusal MUST surface requiredCapability: "agents.dispatchMapping"',
+        ),
+      ).toBe('agents.dispatchMapping');
+    } finally {
+      await resetHostCapabilities();
+    }
+  });
 });

package/src/scenarios/dispatch-output-mapping.test.ts

@@ -55,11 +55,101 @@ describe.skipIf(SKIP)('dispatch-output-mapping: child → parent variable harves
     )).toBe('done');
   });
 
-  it.todo(
-    'HVMAP-1b-failed: child terminates with `failed` status; outputMapping MUST be skipped; parent variables stay at pre-dispatch state for that child. Requires a child fixture that fails deterministically.',
-  );
+});
+
+interface RunEvent { readonly type: string; readonly nodeId?: string; readonly payload?: { childRunId?: string; childWorkflowId?: string } & Record<string, unknown>; }
+
+/** Register a parent workflow that dispatches to a specific child fixture
+ *  with outputMapping. Returns the registered parent's workflowId.
+ *  The parent declares `parentResult` with a sentinel default so the
+ *  test can verify it stayed at the sentinel (NOT overwritten by
+ *  outputMapping) when the child terminates non-completed. */
+async function registerParent(childFixtureId: string): Promise<string | null> {
+  const workflowId = `hvmap-1b-${childFixtureId.replace(/[^a-zA-Z0-9_.-]/g, '-')}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const def = {
+    workflowId,
+    nodes: [
+      {
+        nodeId: 'supervisor',
+        typeId: 'core.orchestrator.supervisor',
+        config: {
+          mockDispatchPlan: [
+            { kind: 'next-worker', nextWorkerIds: [childFixtureId] },
+            { kind: 'terminate', reason: 'goal-reached' },
+          ],
+        },
+      },
+      {
+        nodeId: 'dispatch',
+        typeId: 'core.dispatch',
+        config: {
+          askUserRouting: 'auto',
+          workerDispatchModel: 'child-run',
+          fanOutPolicy: 'sequential',
+          outputMapping: { parentResult: 'childOutcome' },
+        },
+      },
+    ],
+  };
+  const res = await driver.post('/v1/host/sample/workflows', def);
+  if (res.status !== 201) return null;
+  return workflowId;
+}
+
+describe.skipIf(!isFixtureAdvertised('conformance-dispatch-deterministic-fail-child'))('dispatch-output-mapping: HVMAP-1b-failed (RFC 0022 §B)', () => {
+  it('child terminates `failed` → outputMapping MUST be skipped; parent.parentResult stays at sentinel', async () => {
+    const parentId = await registerParent('conformance-dispatch-deterministic-fail-child');
+    if (!parentId) return; // workflow-register seam not exposed — soft-skip
+    const create = await driver.post('/v1/runs', { workflowId: parentId });
+    expect(create.status).toBe(201);
+    const parentRunId = (create.json as { runId: string }).runId;
+    const terminal = (await pollUntilTerminal(parentRunId)) as RunSnapshot & { variables?: Record<string, unknown> };
+    // Parent reaches some terminal state (completed if it tolerates failed children + supervisor terminates; failed if not).
+    // Either way, parentResult MUST NOT be overwritten with the child's "this-should-not-be-harvested" sentinel.
+    const parentVars = terminal.variables ?? {};
+    expect(
+      parentVars.parentResult,
+      driver.describe(
+        'RFCS/0022-dispatch-input-output-mapping.md §B',
+        'outputMapping MUST be SKIPPED when child terminates failed; parent variable MUST NOT be overwritten',
+      ),
+    ).not.toBe('this-should-not-be-harvested');
+  });
+});
 
-  it.todo(
-    'HVMAP-1b-cancelled: child terminates with `cancelled` status; outputMapping MUST be skipped; parent variables stay at pre-dispatch state for that child. Requires a child fixture that supports external cancellation.',
-  );
+describe.skipIf(!isFixtureAdvertised('conformance-dispatch-cancellable-child'))('dispatch-output-mapping: HVMAP-1b-cancelled (RFC 0022 §B)', () => {
+  it('child terminates `cancelled` → outputMapping MUST be skipped; parent.parentResult stays at sentinel', async () => {
+    const parentId = await registerParent('conformance-dispatch-cancellable-child');
+    if (!parentId) return; // soft-skip
+    const create = await driver.post('/v1/runs', { workflowId: parentId });
+    expect(create.status).toBe(201);
+    const parentRunId = (create.json as { runId: string }).runId;
+
+    // Poll for the node.dispatched event so we can cancel the child mid-flight.
+    const start = Date.now();
+    let childRunId: string | undefined;
+    while (Date.now() - start < 10_000) {
+      const eventsRes = await driver.get(`/v1/runs/${encodeURIComponent(parentRunId)}/events`);
+      const events = ((eventsRes.json as { events?: RunEvent[] } | undefined)?.events ?? []);
+      const dispatched = events.find((e) => e.type === 'node.dispatched' && e.payload?.childWorkflowId === 'conformance-dispatch-cancellable-child');
+      if (dispatched?.payload?.childRunId) {
+        childRunId = dispatched.payload.childRunId;
+        break;
+      }
+      await new Promise((r) => setTimeout(r, 250));
+    }
+    if (!childRunId) return; // dispatch didn't surface child run id — soft-skip
+    const cancelRes = await driver.post(`/v1/runs/${encodeURIComponent(childRunId)}/cancel`, { reason: 'hvmap-1b-cancelled test' });
+    expect(cancelRes.status === 200 || cancelRes.status === 202).toBe(true);
+
+    const terminal = (await pollUntilTerminal(parentRunId)) as RunSnapshot & { variables?: Record<string, unknown> };
+    const parentVars = terminal.variables ?? {};
+    expect(
+      parentVars.parentResult,
+      driver.describe(
+        'RFCS/0022-dispatch-input-output-mapping.md §B',
+        'outputMapping MUST be SKIPPED when child terminates cancelled; parent variable MUST NOT be overwritten',
+      ),
+    ).not.toBe('this-should-not-be-harvested');
+  });
 });

package/src/scenarios/envelope-completion-distinguishes-truncation.test.ts

@@ -0,0 +1,223 @@
+/**
+ * envelope-completion-distinguishes-truncation — RFC 0033 §A + §B + §C
+ * truncation-vs-schema-violation retry-routing distinction.
+ *
+ * Capability-gated on `capabilities.envelopes.reliability.supported: true`
+ * AND `capabilities.envelopes.reliability.completion.distinguishesTruncation: true`
+ * AND the host's test seam. Soft-skip cleanly on hosts that conflate the two
+ * paths (legacy v1.1 behavior).
+ *
+ * Asserts two scenarios:
+ *
+ * 1. **Truncation path** (RFC 0033 §B). Mock LLM stops at `max_tokens` mid-envelope.
+ *    - `envelope.truncated` event fires.
+ *    - `envelope.retry.attempted` fires with `reason: 'truncation'`.
+ *    - The retry's `maxTokens` budget is strictly greater than the initial.
+ *
+ * 2. **Schema-violation path** (RFC 0033 §C). Mock LLM emits malformed JSON.
+ *    - NO `envelope.truncated` event.
+ *    - `envelope.retry.attempted` fires with `reason` ∈ {`schema-violation`, `parse-error`}.
+ *    - The retry's `maxTokens` budget is UNCHANGED from the initial.
+ *
+ * Both scenarios share the existing per-path fixtures
+ * (`conformance-envelope-truncated` for the truncation case;
+ * `conformance-envelope-retry-attempted` for the schema-violation case).
+ *
+ * @see RFCS/0033-envelope-completion-contract.md §A + §B + §C
+ * @see spec/v1/ai-envelope.md §"Envelope-completion criteria"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { pollUntilTerminal } from '../lib/polling.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+const NODE_ID = 'structured-call';
+
+interface DiscoveryDoc {
+  capabilities?: {
+    envelopes?: {
+      reliability?: {
+        completion?: {
+          distinguishesTruncation?: unknown;
+          truncationBudgetMultiplier?: unknown;
+        };
+      };
+    };
+  };
+}
+
+interface RunEvent {
+  type: string;
+  payload?: Record<string, unknown>;
+  nodeId?: string;
+  sequence: number;
+}
+
+async function readDiscovery(): Promise<DiscoveryDoc | null> {
+  try {
+    const res = await driver.get('/.well-known/openwop');
+    if (res.status !== 200) return null;
+    return res.json as DiscoveryDoc;
+  } catch {
+    return null;
+  }
+}
+
+async function programMock(program: Array<Record<string, unknown>>): Promise<{ status: number }> {
+  const res = await driver.post('/v1/host/sample/test/mock-ai/program', { nodeId: NODE_ID, program });
+  return { status: res.status };
+}
+
+async function startRunAndRead(workflowId: string): Promise<{ events: RunEvent[]; terminal: unknown } | null> {
+  const create = await driver.post('/v1/runs', { workflowId });
+  if (create.status !== 201) return null;
+  const runId = (create.json as { runId: string }).runId;
+  const terminal = await pollUntilTerminal(runId, { timeoutMs: 10_000 });
+  const eventsRes = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
+  if (eventsRes.status !== 200) return null;
+  const events = ((eventsRes.json as { events?: RunEvent[] } | undefined)?.events ?? []) as RunEvent[];
+  return { events, terminal };
+}
+
+async function lastBudget(): Promise<number | null> {
+  const res = await driver.get(`/v1/host/sample/test/mock-ai/last-dispatch-budget?nodeId=${encodeURIComponent(NODE_ID)}`);
+  if (res.status !== 200) return null;
+  return (res.json as { maxTokens?: number | null }).maxTokens ?? null;
+}
+
+describe.skipIf(HTTP_SKIP)('envelope-completion-distinguishes-truncation: advertisement shape (RFC 0033 §E)', () => {
+  it('capabilities.envelopes.reliability.completion (when present) conforms to RFC 0033 §E', async () => {
+    const d = await readDiscovery();
+    if (d === null) return;
+    const completion = d.capabilities?.envelopes?.reliability?.completion;
+    if (completion === undefined) return;
+    expect(
+      typeof completion.distinguishesTruncation,
+      driver.describe('RFCS/0033-envelope-completion-contract.md §E', 'completion.distinguishesTruncation MUST be boolean when block is advertised'),
+    ).toBe('boolean');
+    if (completion.truncationBudgetMultiplier !== undefined) {
+      const n = completion.truncationBudgetMultiplier as number;
+      expect(
+        typeof n === 'number' && n >= 1 && n <= 8,
+        driver.describe('RFCS/0033-envelope-completion-contract.md §E', 'truncationBudgetMultiplier MUST be a number in [1, 8] (default 2)'),
+      ).toBe(true);
+    }
+  });
+});
+
+const TRUNCATED_FIXTURE = 'conformance-envelope-truncated';
+const SCHEMA_VIOLATION_FIXTURE = 'conformance-envelope-retry-attempted';
+
+describe.skipIf(HTTP_SKIP)('envelope-completion-distinguishes-truncation: truncation path (RFC 0033 §B)', () => {
+  it('truncation: emits envelope.truncated + envelope.retry.attempted with reason: "truncation"', async () => {
+    if (!isFixtureAdvertised(TRUNCATED_FIXTURE)) return;
+    const d = await readDiscovery();
+    if (d?.capabilities?.envelopes?.reliability?.completion?.distinguishesTruncation !== true) return;
+    const seed = await programMock([
+      { stopReason: 'max_tokens', content: '{"partial' },
+      { stopReason: 'end_turn', content: '{"valid":true}' },
+    ]);
+    if (seed.status === 404) return;
+
+    const result = await startRunAndRead(TRUNCATED_FIXTURE);
+    if (result === null) return;
+    const truncated = result.events.find((e) => e.type === 'envelope.truncated');
+    expect(truncated, 'envelope.truncated MUST fire on the truncation path').toBeDefined();
+    const retry = result.events.find((e) => e.type === 'envelope.retry.attempted');
+    expect(retry, 'envelope.retry.attempted MUST fire between attempts').toBeDefined();
+    expect(
+      retry!.payload?.reason,
+      driver.describe(
+        'RFCS/0033-envelope-completion-contract.md §B',
+        'truncation-routed retry MUST carry reason: "truncation" (distinct from schema-violation per RFC 0033 §A precedence rule)',
+      ),
+    ).toBe('truncation');
+  });
+
+  it('truncation: retry budget strictly greater than initial (RFC 0033 §B truncationBudgetMultiplier)', async () => {
+    if (!isFixtureAdvertised(TRUNCATED_FIXTURE)) return;
+    const d = await readDiscovery();
+    if (d?.capabilities?.envelopes?.reliability?.completion?.distinguishesTruncation !== true) return;
+    const seed = await programMock([
+      { stopReason: 'max_tokens', content: '{"partial' },
+      { stopReason: 'end_turn', content: '{"valid":true}' },
+    ]);
+    if (seed.status === 404) return;
+
+    await startRunAndRead(TRUNCATED_FIXTURE);
+    const budget = await lastBudget();
+    if (budget === null) return;
+    expect(
+      budget,
+      driver.describe(
+        'RFCS/0033-envelope-completion-contract.md §B',
+        'truncation retry MUST multiply maxTokens by truncationBudgetMultiplier — final budget > initial 50 fixture value',
+      ),
+    ).toBeGreaterThan(50);
+  });
+});
+
+describe.skipIf(HTTP_SKIP)('envelope-completion-distinguishes-truncation: schema-violation path (RFC 0033 §C)', () => {
+  it('schema-violation: NO envelope.truncated; envelope.retry.attempted reason ∈ {schema-violation, parse-error}', async () => {
+    if (!isFixtureAdvertised(SCHEMA_VIOLATION_FIXTURE)) return;
+    const seed = await programMock([
+      { content: 'not valid json' },
+      { content: '{"valid":true}' },
+    ]);
+    if (seed.status === 404) return;
+
+    const result = await startRunAndRead(SCHEMA_VIOLATION_FIXTURE);
+    if (result === null) return;
+    const truncated = result.events.find((e) => e.type === 'envelope.truncated');
+    expect(
+      truncated,
+      driver.describe(
+        'RFCS/0033-envelope-completion-contract.md §C',
+        'schema-violation path MUST NOT emit envelope.truncated (truncation and schema-violation are distinct paths per RFC 0033 §A)',
+      ),
+    ).toBeUndefined();
+    const retry = result.events.find((e) => e.type === 'envelope.retry.attempted');
+    expect(retry).toBeDefined();
+    const reason = retry!.payload?.reason as string | undefined;
+    expect(
+      reason === 'schema-violation' || reason === 'parse-error',
+      driver.describe(
+        'RFCS/0033-envelope-completion-contract.md §C',
+        'schema-violation-routed retry MUST carry reason ∈ {schema-violation, parse-error}; truncation reason is reserved for the budget-doubling path',
+      ),
+    ).toBe(true);
+  });
+
+  it('schema-violation: retry budget UNCHANGED from initial (no budget multiplication on this path)', async () => {
+    if (!isFixtureAdvertised(SCHEMA_VIOLATION_FIXTURE)) return;
+    const seed = await programMock([
+      { content: 'not valid json' },
+      { content: '{"valid":true}' },
+    ]);
+    if (seed.status === 404) return;
+
+    await startRunAndRead(SCHEMA_VIOLATION_FIXTURE);
+    const budget = await lastBudget();
+    if (budget === null) return;
+    // The schema-violation fixture doesn't set maxTokens explicitly →
+    // budget snapshots whatever the host's default is on each call.
+    // The KEY invariant: the retry call's budget MUST NOT be multiplied
+    // (the truncation path doubles; this path keeps the same). The
+    // budget on the last call equals the budget on the first call.
+    // Without a per-call history hook, we can't strictly compare; we
+    // assert the budget didn't grow into the truncation-path range
+    // (which would be ≥2× the default — typically 8000 for the
+    // sample's structuredOutput dispatch path).
+    if (budget !== null) {
+      expect(
+        budget,
+        driver.describe(
+          'RFCS/0033-envelope-completion-contract.md §C',
+          'schema-violation retry MUST NOT multiply maxTokens — budget stays at the original value (host default)',
+        ),
+      ).toBeLessThan(20_000);
+    }
+  });
+});