@openwop/openwop-conformance 1.2.0 → 1.4.0

package/fixtures/conformance-prompt-end-to-end.json

@@ -0,0 +1,33 @@
+{
+  "id": "conformance-prompt-end-to-end",
+  "name": "Conformance: Prompt-Library End-to-End",
+  "version": "1.0",
+  "description": "RFC 0027 + RFC 0029 end-to-end. Single mock-ai node configured with `config.systemPromptRef` pointing at a host-built-in template (`conformance.prompt.writer-system`); when the node executes, the host MUST resolve the ref via the four-layer chain (RFC 0029 §A), emit one `agent.promptResolved` event with the chain trace, compose the body (RFC 0027 §E), emit one `prompt.composed` event, and complete the run successfully. Capability-gated: host MUST advertise `capabilities.prompts.supported: true`. See conformance/src/scenarios/prompt-end-to-end-events.test.ts.",
+  "nodes": [
+    {
+      "id": "writer",
+      "typeId": "local.sample.demo.mock-ai",
+      "name": "Writer (mock AI)",
+      "position": { "x": 0, "y": 0 },
+      "config": {
+        "systemPromptRef": "prompt:conformance.prompt.writer-system@1.0.0"
+      },
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    {
+      "name": "prompt",
+      "type": "string",
+      "description": "Optional inline prompt content. The mock-ai node prefers the composed body from `config.systemPromptRef` when present; this variable is the fallback baseline if no ref resolves.",
+      "required": false,
+      "defaultValue": "conformance baseline prompt"
+    }
+  ],
+  "metadata": { "tags": ["conformance", "prompts", "end-to-end"] },
+  "settings": { "timeout": 10000 }
+}

package/fixtures/conformance-subworkflow-input-mapping-no-default.json

@@ -0,0 +1,33 @@
+{
+  "id": "conformance-subworkflow-input-mapping-no-default",
+  "name": "Conformance: subWorkflow Input Mapping — currentPrdId unset (RFC 0022 §B HVMAP-2-unset)",
+  "version": "1.0",
+  "description": "RFC 0022 §B / HVMAP-2-unset — parent variant of `conformance-subworkflow-input-mapping` that DECLARES `currentPrdId` in `variables[]` but OMITS its `defaultValue`. The `core.subWorkflow` node's `inputMapping: { receivedPrdId: 'currentPrdId' }` projects an unset parent variable. Per RFC 0022 §B normative bullet: child `receivedPrdId` MUST surface as `undefined` (NOT `null`, NOT omitted) — distinct from the child's own `defaultValue` fold. Same shape as the base fixture; only `currentPrdId.defaultValue` is removed. See subworkflow-input-mapping.test.ts § HVMAP-2-unset.",
+  "nodes": [
+    {
+      "id": "subwf-call",
+      "typeId": "core.subWorkflow",
+      "name": "Invoke child with inputMapping (parent var unset)",
+      "position": { "x": 0, "y": 0 },
+      "config": {
+        "workflowId": "conformance-subworkflow-input-mapping-child",
+        "waitForCompletion": true,
+        "onChildFailure": "fail-parent",
+        "inputMapping": { "receivedPrdId": "currentPrdId" }
+      },
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    { "name": "currentPrdId", "type": "string" }
+  ],
+  "metadata": {
+    "tags": ["conformance", "rfc-0022", "subworkflow", "input-mapping", "hvmap-2-unset"],
+    "requiresCapability": "capabilities.subWorkflow.inputMapping"
+  },
+  "settings": { "timeout": 10000 }
+}

package/fixtures/conformance-subworkflow-mid-run-mutation-child.json

@@ -0,0 +1,31 @@
+{
+  "id": "conformance-subworkflow-mid-run-mutation-child",
+  "name": "Conformance: subWorkflow one-shot fold — child (RFC 0022 §B HVMAP-2)",
+  "version": "1.0",
+  "description": "Child fixture for `conformance-subworkflow-mid-run-mutation`. The child declares `receivedPrdId.defaultValue='baked-in'` (overridden at dispatch-time by the parent's `inputMapping`), then suspends on an approval gate so the test can mutate the parent's `currentPrdId` while the child is paused. On resume the child terminates; the assertion reads the child's final `receivedPrdId` variable and confirms it remained at the dispatch-time projected value (NOT the parent's later-mutated value).",
+  "nodes": [
+    {
+      "id": "child-gate",
+      "typeId": "core.approvalGate",
+      "name": "Pause so parent can mutate currentPrdId",
+      "position": { "x": 0, "y": 0 },
+      "config": {
+        "title": "HVMAP-2 mid-run pause",
+        "description": "Held by the conformance harness so the parent can mutate its variable bag while the child is suspended; on resume the child completes and the test reads its final receivedPrdId.",
+        "actions": ["accept", "reject"]
+      },
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    { "name": "receivedPrdId", "type": "string", "defaultValue": "baked-in" }
+  ],
+  "metadata": {
+    "tags": ["conformance", "rfc-0022", "subworkflow", "input-mapping", "hvmap-2", "child"]
+  },
+  "settings": { "timeout": 30000 }
+}

package/fixtures/conformance-subworkflow-mid-run-mutation.json

@@ -0,0 +1,33 @@
+{
+  "id": "conformance-subworkflow-mid-run-mutation",
+  "name": "Conformance: subWorkflow inputMapping is a one-shot fold (RFC 0022 §B HVMAP-2)",
+  "version": "1.0",
+  "description": "RFC 0022 §B HVMAP-2 — `inputMapping` is a one-shot fold at child-dispatch time; mid-run mutations to the parent variable bag MUST NOT propagate into the already-seeded child. Parent declares `currentPrdId: 'seeded-id'`, dispatches the child (`conformance-subworkflow-mid-run-mutation-child`) with `inputMapping: { receivedPrdId: 'currentPrdId' }`. The child suspends on an approval gate, giving the test window to POST `/v1/host/sample/test/runs/:parentRunId/variables { variables: { currentPrdId: 'mutated-id' } }` against the parent. After the parent mutation, the test resolves the child's approval; the child terminates and its final `receivedPrdId` variable MUST still equal `seeded-id` (the dispatch-time fold). Pairs with `subworkflow-input-mapping.test.ts §HVMAP-2-no-midrun-propagation`.",
+  "nodes": [
+    {
+      "id": "subwf-call",
+      "typeId": "core.subWorkflow",
+      "name": "Invoke child with inputMapping (one-shot fold)",
+      "position": { "x": 0, "y": 0 },
+      "config": {
+        "workflowId": "conformance-subworkflow-mid-run-mutation-child",
+        "waitForCompletion": true,
+        "onChildFailure": "fail-parent",
+        "inputMapping": { "receivedPrdId": "currentPrdId" }
+      },
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    { "name": "currentPrdId", "type": "string", "defaultValue": "seeded-id" }
+  ],
+  "metadata": {
+    "tags": ["conformance", "rfc-0022", "subworkflow", "input-mapping", "hvmap-2"],
+    "requiresCapability": "capabilities.subWorkflow.inputMapping"
+  },
+  "settings": { "timeout": 30000 }
+}

package/fixtures/openwop-smoke-cost-emit.json

@@ -0,0 +1,37 @@
+{
+  "id": "openwop-smoke-cost-emit",
+  "name": "Conformance: cost-attribute allowlist + credential redaction (O4 / G6)",
+  "version": "1.0",
+  "description": "Drives the `conformance.cost.emit` typeId with a payload that mixes ALLOWLISTED `openwop.cost.*` attributes (per `spec/v1/observability.md §\"Cost attribution attributes\"`) with two intentional violations: (a) a non-allowlisted key (`openwop.cost.evil`) which MUST be dropped by `sanitizeCostForOtel`, and (b) a credential-shaped canary under a non-allowlisted name (`openwop.cost.leaked_token`) which MUST NOT appear in any OTel span attribute. Conformance scenario `cost-attribution.test.ts` reads the run's OTel spans (via the in-suite collector when `OPENWOP_OTEL_COLLECTOR=true`) and asserts the cost-namespace attrs are a strict subset of the allowlist AND that no canary plaintext leaked. Pairs with the `cost-attribution-allowlist-redaction` SECURITY invariant.",
+  "nodes": [
+    {
+      "id": "emit-cost",
+      "typeId": "conformance.cost.emit",
+      "name": "Emit cost attrs (mix of allowed + dropped)",
+      "position": { "x": 0, "y": 0 },
+      "config": {
+        "attrs": {
+          "openwop.cost.tokens.input": 100,
+          "openwop.cost.tokens.output": 50,
+          "openwop.cost.tokens.total": 150,
+          "openwop.cost.usd": 0.00123,
+          "openwop.cost.currency": "usd",
+          "openwop.cost.estimated": true,
+          "openwop.cost.provider": "anthropic",
+          "openwop.cost.evil": "must-be-dropped",
+          "openwop.cost.leaked_token": "sk-ant-CANARY-openwop-CONFORMANCE-NEVER-SECRET-cost-attr-leak"
+        }
+      },
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [],
+  "metadata": {
+    "tags": ["conformance", "observability", "cost-attribution", "g6", "o4", "security"]
+  },
+  "settings": { "timeout": 10000 }
+}

package/fixtures/prompt-templates/conformance-prompt-few-shot-2.json

@@ -0,0 +1,14 @@
+{
+  "templateId": "conformance.prompt.few-shot-2",
+  "version": "1.0.0",
+  "kind": "few-shot",
+  "text": "Example 3:\nQ: Summarize a paragraph about chocolate in two sentences.\nA: Chocolate is made from fermented and roasted cacao seeds. It is consumed worldwide as both confectionery and a flavoring for drinks and desserts.\n\nExample 4:\nQ: Summarize a paragraph about cheese in two sentences.\nA: Cheese is produced by curdling milk and aging the resulting solids. It exists in hundreds of regional varieties that differ in texture, flavor, and ripening method.",
+  "name": "Conformance: Few-shot exemplars (set 2)",
+  "description": "Second `kind: \"few-shot\"` template paired with `conformance.prompt.few-shot` to give the four-kinds conformance fixture a multi-entry `fewShotPromptRefs[]` array. Variable-free; renders verbatim. The multi-entry shape is the templateKinds-coverage regression pin for `fewShotPromptRefs[slotIndex]` resolution per RFC 0027 §A — a host that only handles entry [0] would silently drop this template.",
+  "tags": ["conformance", "few-shot"],
+  "meta": {
+    "author": "openwop-conformance-suite",
+    "createdAt": "2026-05-20T00:00:00Z",
+    "source": "host"
+  }
+}

package/fixtures/prompt-templates/conformance-prompt-few-shot.json

@@ -0,0 +1,14 @@
+{
+  "templateId": "conformance.prompt.few-shot",
+  "version": "1.0.0",
+  "kind": "few-shot",
+  "text": "Example 1:\nQ: Summarize a paragraph about coffee in two sentences.\nA: Coffee is brewed from roasted seeds of the Coffea plant. It is one of the world's most-traded commodities by value.\n\nExample 2:\nQ: Summarize a paragraph about tea in two sentences.\nA: Tea is brewed from cured leaves of the Camellia sinensis plant. It is consumed in more countries than coffee but produces less global trade value.",
+  "name": "Conformance: Few-shot exemplars (Q/A pairs)",
+  "description": "few-shot-kind PromptTemplate used by the prompt-end-to-end-events conformance scenario to assert all four kinds dispatch end-to-end. Variable-free; renders verbatim. Two Q/A exemplars in the conventional shape — real provider dispatchers route each exemplar to a separate assistant/user message pair; the mock LLM here just concatenates them into the composed body.",
+  "tags": ["conformance", "few-shot"],
+  "meta": {
+    "author": "openwop-conformance-suite",
+    "createdAt": "2026-05-20T00:00:00Z",
+    "source": "host"
+  }
+}

package/fixtures/prompt-templates/conformance-prompt-schema-hint.json

@@ -0,0 +1,14 @@
+{
+  "templateId": "conformance.prompt.schema-hint",
+  "version": "1.0.0",
+  "kind": "schema-hint",
+  "text": "Respond as a JSON object with exactly these keys: `topic` (string), `tone` (string), `outline` (array of three strings).",
+  "name": "Conformance: Schema hint (structured-output directive)",
+  "description": "schema-hint-kind PromptTemplate used by the prompt-end-to-end-events conformance scenario to assert all four kinds dispatch end-to-end. Variable-free; renders verbatim. Conventional dispatch slot per RFC 0027 §A is the structured-output directive a vendor SDK injects as `response_format` / `responseSchema` adjacent to the system message.",
+  "tags": ["conformance", "schema-hint"],
+  "meta": {
+    "author": "openwop-conformance-suite",
+    "createdAt": "2026-05-20T00:00:00Z",
+    "source": "host"
+  }
+}

package/fixtures/prompt-templates/conformance-prompt-secret-redaction.json

@@ -0,0 +1,23 @@
+{
+  "templateId": "conformance.prompt.secret-redaction",
+  "version": "1.0.0",
+  "kind": "user",
+  "text": "Authenticate with the following key: {{apiKey}}\nThen summarize the request.",
+  "name": "Conformance: Secret-Redaction Probe",
+  "description": "Prompt template used by prompt-composed-secret-redaction conformance. The `apiKey` variable's source: secret triggers the [REDACTED:<secretId>] marker in any `prompt.composed` payload emitted under observability: full.",
+  "tags": ["conformance", "security", "secret-redaction"],
+  "variables": [
+    {
+      "name": "apiKey",
+      "type": "string",
+      "required": true,
+      "source": "secret",
+      "description": "Secret-source variable used to assert SECURITY/threat-model-secret-leakage.md §SR-1 redaction in prompt.composed events."
+    }
+  ],
+  "meta": {
+    "author": "openwop-conformance-suite",
+    "createdAt": "2026-05-20T00:00:00Z",
+    "source": "host"
+  }
+}

package/fixtures/prompt-templates/conformance-prompt-trust-marker.json

@@ -0,0 +1,23 @@
+{
+  "templateId": "conformance.prompt.trust-marker",
+  "version": "1.0.0",
+  "kind": "user",
+  "text": "Process the following user payload: {{userPayload}}\nRespond carefully.",
+  "name": "Conformance: Trust-Marker Probe",
+  "description": "Prompt template used by prompt-composed-trust-marker conformance. The `userPayload` variable's source: input is tagged untrusted by the test seam to verify <UNTRUSTED>...</UNTRUSTED> wrapping + contentTrust propagation per RFC 0027 §E + RFC 0020 §D.",
+  "tags": ["conformance", "security", "trust-marker"],
+  "variables": [
+    {
+      "name": "userPayload",
+      "type": "string",
+      "required": true,
+      "source": "input",
+      "description": "User-supplied content; tagged untrusted by the conformance test seam to verify trust-boundary propagation."
+    }
+  ],
+  "meta": {
+    "author": "openwop-conformance-suite",
+    "createdAt": "2026-05-20T00:00:00Z",
+    "source": "host"
+  }
+}

package/fixtures/prompt-templates/conformance-prompt-writer-system.json

@@ -0,0 +1,15 @@
+{
+  "templateId": "conformance.prompt.writer-system",
+  "version": "1.0.0",
+  "kind": "system",
+  "text": "You are a careful editorial writer. Match the requested tone exactly. Keep paragraphs tight. Do not invent facts.",
+  "name": "Conformance: Writer (system)",
+  "description": "Minimal system-kind PromptTemplate used by prompt-template-shape conformance to assert positive-fixture round-trip. Variable-free; renders verbatim.",
+  "tags": ["conformance", "system"],
+  "modelHints": { "modelClass": "writing", "temperature": 0.7 },
+  "meta": {
+    "author": "openwop-conformance-suite",
+    "createdAt": "2026-05-20T00:00:00Z",
+    "source": "host"
+  }
+}

package/fixtures/prompt-templates/conformance-prompt-writer-user.json

@@ -0,0 +1,15 @@
+{
+  "templateId": "conformance.prompt.writer-user",
+  "version": "1.0.0",
+  "kind": "user",
+  "text": "Please write a 100-word piece on a topic chosen by the system prompt. Keep it tight.",
+  "name": "Conformance: Writer (user)",
+  "description": "Minimal `kind: \"user\"` template paired with `conformance.prompt.writer-system` to give the four-kinds conformance fixture a kind-accurate user slot (the system slot uses the writer-system template). Variable-free; renders verbatim.",
+  "tags": ["conformance", "user"],
+  "modelHints": { "modelClass": "writing", "temperature": 0.7 },
+  "meta": {
+    "author": "openwop-conformance-suite",
+    "createdAt": "2026-05-20T00:00:00Z",
+    "source": "host"
+  }
+}

package/fixtures.md

@@ -52,6 +52,8 @@ All fixtures MUST advertise:
 | Idempotent | `conformance-idempotent` | Verifies `Idempotency-Key` cache | `completed` | ≤ 5s |
 | Cancellable | `conformance-cancellable` | Verifies `:cancel` endpoint mid-run | `cancelled` after cancel | ≤ 60s (input-controlled) |
 | Capability Missing | `conformance-capability-missing` | Verifies dispatch refusal on unsatisfied `requires` | `failed` (`error.code='capability_not_provided'`) | ≤ 5s |
+| Prompt End-to-End | `conformance-prompt-end-to-end` | RFC 0027 + RFC 0029 end-to-end. Single `mock-ai` node with `config.systemPromptRef` set; host MUST emit `agent.promptResolved` + `prompt.composed` events during dispatch, then complete. Capability-gated on `capabilities.prompts.supported`. | `completed` | ≤ 10s |
+| Prompt All Four Kinds | `conformance-prompt-all-four-kinds` | RFC 0027 §A four-kind dispatch coverage with a MULTI-ENTRY `fewShotPromptRefs[]` array. Single `mock-ai` node with one ref per singular-kind slot (`systemPromptRef`, `userPromptRef`, `schemaHintPromptRef`) + two distinct templateIds in `fewShotPromptRefs[]`; host MUST emit 5 `agent.promptResolved` events (one per slot) AND 5 `prompt.composed` events. Multi-entry few-shot is the regression pin for `fewShotPromptRefs[slotIndex]` per-index resolution — a host that hard-codes `[0]` would emit the same template twice in the few-shot events and fail the per-templateId assertion. Capability-gated on `capabilities.prompts.supported`. | `completed` | ≤ 10s |
 | Dispatch Loop | `conformance-dispatch-loop` | Verifies `core.dispatch` loop mechanism | `completed` | ≤ 30s |
 | Interrupt — Quorum | `conformance-interrupt-quorum` | Verifies `openwop-interrupt-quorum` profile (multi-approver, majority rejection) | `completed` after 3 accepts, `failed` after quorum reject | unbounded (suspends) |
 | Interrupt — External Event | `conformance-interrupt-external-event` | Verifies `openwop-interrupt-external-event` profile (correlation-matched callback) | `completed` after matching POST, `failed` on timeout | ≤ 60s (timeoutMs configured) |
@@ -59,6 +61,7 @@ All fixtures MUST advertise:
 | Interrupt — Parent/Child Cancel | `conformance-interrupt-parent-child-cancel` + `conformance-interrupt-parent-child-cancel-child` | Verifies `openwop-interrupt-parent-child` cancel cascade | `cancelled` (both runs) | ≤ 30s |
 | Agent Identity | `conformance-agent-identity` | Phase 1 — `RunSnapshot.agent` / `runOrchestrator` AgentRef wire-shape | `completed` | ≤ 10s |
 | Agent Reasoning | `conformance-agent-reasoning` | Phase 1 / RFC 0023 — `agent.*` event family emission + `callId` pairing on `core.conformance.mock-agent` | `completed` | ≤ 15s |
+| Agent Reasoning Streaming | `conformance-agent-reasoning-streaming` | RFC 0024 — `core.conformance.mock-agent` with `mockReasoning.streamChunks` drives incremental `agent.reasoning.delta` events (sequence 0..N-1) followed by exactly one closing `agent.reasoned` whose `reasoning` equals the concatenation. Gated on `capabilities.agents.reasoning.streaming: true`. | `completed` | ≤ 15s |
 | Agent Low-Confidence | `conformance-agent-low-confidence` | Phase 1 / CP-1 / RFC 0023 — `core.conformance.mock-agent` emits `agent.decided` with confidence < threshold; host MUST follow with `node.suspended { reason: 'low-confidence' }` | `waiting-approval` (suspends) | unbounded (suspends) |
 | Message Reducer | `conformance-message-reducer` | Phase 1 — `message` reducer idempotency on duplicate `messageId` | `completed` | ≤ 10s |
 | Agent Pack Install | `conformance-agent-pack-install` | Phase 2 — pack `agents[]` surface as AgentManifest at `GET /v1/packs` | `completed` | ≤ 5s |
@@ -74,6 +77,16 @@ All fixtures MUST advertise:
 | Dispatch Output Mapping (child) | `conformance-dispatch-output-mapping-child` | RFC 0022 §A / HVMAP-1b — child workflow for the dispatch output-mapping scenario. Declares `childOutcome.defaultValue='done'`; on terminal, parent's `outputMapping` harvests `childOutcome → parentResult`. | `completed` | ≤ 5s |
 | Dispatch Cross-Worker Handoff (child-a) | `conformance-dispatch-cross-worker-handoff-child-a` | RFC 0022 §A / HVMAP-1c — first child of the cross-worker-handoff scenario. Declares `output.defaultValue='hello'`; on terminal, parent's `perWorkerOutputMappings.child-a` harvests `output → sharedVar`. | `completed` | ≤ 5s |
 | Dispatch Cross-Worker Handoff (child-b) | `conformance-dispatch-cross-worker-handoff-child-b` | RFC 0022 §A + §D / HVMAP-1c — second child of the cross-worker-handoff scenario. Sequential fan-out — runs after child-a; receives parent's `sharedVar` via `perWorkerInputMappings.child-b` onto its `input` input. Scenario reads child-b's `inputs_json` to assert `inputs.input === 'hello'`. | `completed` | ≤ 5s |
+| Dispatch Input Mapping — unset variant | `conformance-dispatch-input-mapping-no-default` | RFC 0022 §A / HVMAP-1a-null — parent variant that DECLARES `parentName` but OMITS its `defaultValue`. The dispatch's `inputMapping` projects an unset parent variable; per §A normative bullet, child `inputs.childGreeting` MUST surface as `undefined` (NOT `null`, NOT omitted). Reuses `conformance-dispatch-input-mapping-child`. | `completed` | ≤ 30s |
+| subWorkflow Input Mapping — unset variant | `conformance-subworkflow-input-mapping-no-default` | RFC 0022 §B / HVMAP-2-unset — parent variant that DECLARES `currentPrdId` but OMITS its `defaultValue`. Per §B, the unset projection MUST surface as `undefined` (NOT `null`) — distinct from the child's own `defaultValue` fold. Reuses `conformance-subworkflow-input-mapping-child`. | `completed` | ≤ 10s |
+| subWorkflow Mid-Run Mutation (parent) | `conformance-subworkflow-mid-run-mutation` | RFC 0022 §B / HVMAP-2-no-midrun-propagation — `inputMapping` is a one-shot fold at child-dispatch time. Parent declares `currentPrdId='seeded-id'`, dispatches child with `inputMapping`, then test mutates the parent variable via `POST /v1/host/sample/test/runs/:parentRunId/variables` WHILE the child is suspended. The child's `receivedPrdId` MUST remain at the dispatch-time fold (`seeded-id`), proving mid-run parent mutations do NOT propagate. | `completed` | ≤ 30s |
+| subWorkflow Mid-Run Mutation (child) | `conformance-subworkflow-mid-run-mutation-child` | RFC 0022 §B / HVMAP-2-no-midrun-propagation — child workflow with a `core.approvalGate` that suspends so the parent can mutate its variable bag mid-run. Declares `receivedPrdId.defaultValue='baked-in'` (overridden at dispatch by inputMapping). | `completed` | ≤ 30s |
+| Dispatch Per-Worker Mapping Override | `conformance-dispatch-per-worker-override` | RFC 0022 §A / HVMAP-1c-override — parent with BOTH a default `inputMapping` (`{ input: 'defaultX' }`) AND `perWorkerInputMappings.child-b: { input: 'sharedVar' }`. Verifies `effectiveInputMapping` precedence per §A: child-a receives the default, child-b receives the override. Reuses `conformance-dispatch-cross-worker-handoff-child-a` + `-child-b`. | `completed` | ≤ 30s |
+| Dispatch deterministic-fail child | `conformance-dispatch-deterministic-fail-child` | RFC 0022 §B / HVMAP-1b-failed — child workflow that ALWAYS terminates `failed` via `core.fail`. Used by `conformance-dispatch-output-mapping` to verify the parent's `outputMapping` is SKIPPED when the child fails terminally. | `failed` | ≤ 5s |
+| Dispatch cancellable child | `conformance-dispatch-cancellable-child` | RFC 0022 §B / HVMAP-1b-cancelled — child workflow with a long `core.delay` so the test cancels it externally via `POST /v1/runs/{childRunId}/cancel`. Verifies the parent's `outputMapping` is SKIPPED when the child terminates `cancelled`. | `cancelled` | ≤ 60s |
+| Multi-Agent Handoff (parent) | `conformance-multi-agent-handoff` | RFC 0037 Phase 1 — exercises the planner→worker handoff state machine. Supervisor decides one `next-worker`, dispatch spawns the child, harvests outputMapping. Conformance reads the event log for the 4 `core.workflowChain.event` transition records in causation-chained order (`dispatch.began → dispatch.succeeded → child.completed → output.harvested`). Capability-gated on `capabilities.multiAgent.executionModel.supported`. | `completed` | ≤ 30s |
+| Multi-Agent Handoff (child) | `conformance-multi-agent-handoff-child` | RFC 0037 Phase 1 — child for `conformance-multi-agent-handoff`. Declares `childOutcome.defaultValue='handoff-complete'`; the parent's outputMapping harvests it onto `parentResult`, triggering the `output.harvested` transition event. | `completed` | ≤ 5s |
+| Multi-Agent Confidence Escalation | `conformance-multi-agent-confidence-escalation` | RFC 0039 §A — exercises the Phase 2 confidence-floor escalation contract. Supervisor's `mockDispatchPlan` carries ONE decision with `confidence: 0.3` (below the 0.5 spec floor). The host MUST emit `core.workflowChain.confidence-escalated` AND suspend with a clarification interrupt BEFORE any dispatch.began fires; conformance asserts zero `core.workflowChain.event` records (no dispatch). Capability-gated on `capabilities.multiAgent.executionModel.version >= 2`. | `waiting-clarification` | ≤ 30s |
 | Agent Memory Round-Trip | `conformance-agent-memory-roundtrip` | Phase 3 — `MemoryAdapter.list/get` write → read | `completed` | ≤ 15s |
 | Agent Memory Cross-Tenant | `conformance-agent-memory-cross-tenant` | Phase 3 / CTI-1 — cross-tenant probe MUST return `[]` / `null` | `completed` | ≤ 10s |
 | Agent Memory Redaction | `conformance-agent-memory-redaction` | Phase 3 / SR-1 — BYOK plaintext surfaces as `[REDACTED:<id>]` on read | `completed` | ≤ 15s |
@@ -91,6 +104,15 @@ All fixtures MUST advertise:
 | WASM Pack Memory-Cap Breach | `conformance-wasm-pack-memory-cap-breach` | RFC 0008 §K — invokes the deliberately-misbehaving `vendor.openwop.misbehaving.memory-bomb` pack (allocates 1 GiB beyond the host's `memoryPagesMax`). Host MUST emit `cap.breached` with `kind: "wasm-memory"` and drive the run to terminal `failed`. Misbehaving pack lives at `examples/packs/rust-misbehaving-memory/` and is fixture-only (NOT signed for registry publication). | `failed` (with `cap.breached`) | ≤ 10s |
 | Configurable Schema | `conformance-configurable-schema` | Track 13 — workflow declares `configurableSchema` (`additionalProperties: false`, `recursionLimit: integer ≥ 1`). Suite verifies `GET /v1/workflows/{id}` surfaces the schema AND `POST /v1/runs` with a mismatched `configurable` returns `validation_error`. | `completed` (with accepted overlay) | ≤ 5s |
 | Smoke — BYOK Roundtrip | `openwop-smoke-byok-roundtrip` | End-to-end BYOK secret-resolution smoke. Single `conformance.secret.echo` node fetches the host-provisioned canary secret `openwop-conformance-canary-secret`, emits SHA-256 hex + byte length to variables — never the raw value. Spec: `run-options.md` §"Credential references" + `auth.md` §"Secret resolution" + `observability.md` §"Redaction". | `completed` | ≤ 10s |
+| Smoke — Cost Emit (G6 allowlist) | `openwop-smoke-cost-emit` | End-to-end cost-attribute allowlist smoke (G6 / O4). Single `conformance.cost.emit` node configured with a mix of allowlisted `openwop.cost.*` attributes + one non-allowlisted key + one credential-shaped canary under a non-allowlisted name. Scenario reads the live OTel span (when `OPENWOP_OTEL_COLLECTOR=true`) and asserts the cost-namespace attrs ⊆ `OPENWOP_COST_ATTRIBUTE_NAMES` AND that no canary plaintext leaks. Pairs with the `cost-attribution-allowlist-redaction` SECURITY invariant. Spec: `observability.md §"Cost attribution attributes"`. | `completed` | ≤ 10s |
+| Model Capability Insufficient | `conformance-model-capability-insufficient` | RFC 0031 §B step 4 + §D — single `conformance.modelCapability.insufficient` node whose NodeModule declares `requiredModelCapabilities: ['nonexistent-capability-9b3f']`. Executor's gate MUST refuse at dispatch with `error.code = "capability_not_provided"` and emit `model.capability.insufficient` BEFORE `node.failed`. Capability-gated on `capabilities.modelCapabilities.supported: true`. | `failed` (`error.code='capability_not_provided'`) | ≤ 5s |
+| Envelope Retry Attempted | `conformance-envelope-retry-attempted` | RFC 0032 §B.1 — single `core.ai.structuredOutput` node calls the conformance mock provider with a pre-seeded `MockProgram[]` (POSTed to `/v1/host/sample/test/mock-ai/program` by nodeId BEFORE run start). Attempt 1 returns invalid JSON; attempt 2 returns a valid envelope. Host's `dispatchStructured()` retry loop MUST emit exactly one `envelope.retry.attempted` event between the two attempts. Pairs with `envelope-retry-attempted.test.ts`. Capability-gated on `capabilities.envelopes.reliability.supported: true` AND `capabilities.testing.mockProviders` advertised. | `completed` | ≤ 10s |
+| Envelope Retry Exhausted | `conformance-envelope-retry-exhausted` | RFC 0032 §B.2 + RFC 0033 §C — single `core.ai.structuredOutput` node against the mock provider with a program returning invalid JSON on EVERY attempt. Host MUST exhaust its retry budget and emit exactly one `envelope.retry.exhausted` BEFORE `node.failed`. RunSnapshot.error.code MUST be `envelope_payload_invalid` (schema-violation-exhaustion per RFC 0033 §C). | `failed` (`error.code='envelope_payload_invalid'`) | ≤ 10s |
+| Envelope Truncated | `conformance-envelope-truncated` | RFC 0032 §B.4 + RFC 0033 §B — single `core.ai.structuredOutput` node against the mock provider with a 2-entry program: attempt 1 returns `stopReason: 'max_tokens'`; attempt 2 returns a valid envelope. Host MUST emit exactly one `envelope.truncated` event and retry with `maxTokens` strictly greater than the initial budget per `truncationBudgetMultiplier`. | `completed` (after truncation-retry succeeds) | ≤ 10s |
+| Envelope Truncation Cap Exhaustion | `conformance-envelope-truncation-cap-exhaustion` | RFC 0033 §B + §F DoS-bound assertion — mock provider returns `stopReason: 'max_tokens'` on EVERY attempt. Host MUST emit `envelope.retry.exhausted { finalReason: 'truncation' }`, fail with `error.code: 'envelope_truncation_unrecoverable'`, AND bound the total LLM call count to the advertised `maxRetryAttempts` (no infinite-budget-doubling loop). | `failed` (`error.code='envelope_truncation_unrecoverable'`) | ≤ 10s |
+| Envelope Refusal | `conformance-envelope-refusal` | RFC 0032 §B.3 + RFC 0033 §D + §F end-to-end refusal — mock provider returns `stopReason: 'safety'` with `refusalText`. Host MUST emit exactly one `envelope.refusal` event, NOT retry (RFC 0033 §D), fail with `error.code: 'envelope_refused_by_provider'`, AND keep refusalText off `RunSnapshot.error.message` (SECURITY invariant `envelope-refusal-no-prompt-leak`). | `failed` (`error.code='envelope_refused_by_provider'`) | ≤ 10s |
+| Envelope Recovery Applied | `conformance-envelope-recovery-applied` | RFC 0032 §B.6 lenient-parse — mock returns a markdown-fenced JSON envelope (```json\\n...\\n```). Host's `dispatchStructured()` lenient-parse fallback (`tryLenientParse()`) strips the fence, emits exactly one `envelope.recovery.applied` with `path: 'markdown-fence'`, and accepts the parsed value WITHOUT counting against the retry budget per RFC 0033 §D. | `completed` | ≤ 10s |
+| Envelope NL-to-Format Engaged | `conformance-envelope-nl-to-format-engaged` | RFC 0032 §B.5 NL-to-Format fallback — mock returns natural-language prose on the first 3 attempts (exhausting the retry budget); the host detects the NL shape after exhaustion, emits exactly one `envelope.nlToFormat.engaged { originalEnvelopeType, fallbackCalls: 1 }`, then fires ONE additional dispatch with a corrective coercion fragment. The 4th program entry returns valid JSON; the schema validates; the run terminates `completed`. | `completed` | ≤ 10s |
 
 The `messages`-mode stream fixture (AI token streaming) is covered by the deterministic mock-provider surface in `spec/v1/run-options.md`. Hosts that do not advertise `Capabilities.testing.mockProviders` skip-equivalent on those scenarios.
 
@@ -426,6 +448,29 @@ Pack-manifest fixtures are exercised by the server-free `fixtures-valid.test.ts`
 
 ---
 
+## Prompt-template fixtures
+
+The `fixtures/prompt-templates/` sub-directory holds canonical PromptTemplate documents (per RFC 0027 §A) used as schema-level proof points (validated server-free against `../schemas/prompt-template.schema.json`). They are NOT seeded into a workflow store. They exist so the `prompt-template-shape` scenario has stable positive fixtures, the secret-redaction + trust-marker conformance scenarios have known fixture templateIds to compose against (when a host advertises `capabilities.prompts.supported: true` + `observability: "full"`), and follow-up RFCs (RFC 0028 prompt packs, RFC 0029 resolution chain) can reference a stable shared fixture set.
+
+| Fixture | `templateId` | Purpose |
+|---|---|---|
+| `conformance-prompt-writer-system` | `conformance.prompt.writer-system` | Minimal `kind: "system"` template with no variables. Asserts positive round-trip against the canonical schema. |
+| `conformance-prompt-secret-redaction` | `conformance.prompt.secret-redaction` | `kind: "user"` template carrying a `source: "secret"` variable. Drives `prompt-composed-secret-redaction` scenario; the host's compose seam binds `apiKey` to a canary-marker secret and the scenario asserts the `[REDACTED:<secretId>]` marker appears in `prompt.composed` payload. |
+| `conformance-prompt-trust-marker` | `conformance.prompt.trust-marker` | `kind: "user"` template with a `source: "input"` variable. The conformance compose seam tags the binding `meta.contentTrust: "untrusted"` so the `prompt-composed-trust-marker` scenario asserts `<UNTRUSTED>...</UNTRUSTED>` wrapping + `contentTrust: "untrusted"` propagation. |
+| `conformance-prompt-schema-hint` | `conformance.prompt.schema-hint` | `kind: "schema-hint"` template — structured-output directive instructing the model to emit a specific JSON shape. Variable-free. Used by the `prompt-all-four-kinds-events` scenario to exercise the schema-hint dispatch slot on the reference workflow-engine's `local.sample.demo.mock-ai` node. |
+| `conformance-prompt-few-shot` | `conformance.prompt.few-shot` | `kind: "few-shot"` template carrying two Q/A exemplar pairs (coffee + tea). Variable-free. Used by the `prompt-all-four-kinds-events` scenario as the FIRST entry of the multi-entry `fewShotPromptRefs[]` array — exercises `slotIndex: 0` of the resolver's per-index lookup. |
+| `conformance-prompt-few-shot-2` | `conformance.prompt.few-shot-2` | Second `kind: "few-shot"` template carrying two Q/A exemplar pairs (chocolate + cheese). Variable-free. Used by the `prompt-all-four-kinds-events` scenario as the SECOND entry of the multi-entry `fewShotPromptRefs[]` array — exercises `slotIndex: 1`. The regression pin for `fewShotPromptRefs[slotIndex]` per-index resolution; a host that hard-codes `[0]` silently drops this template. |
+| `conformance-prompt-writer-user` | `conformance.prompt.writer-user` | Minimal `kind: "user"` template paired with `conformance.prompt.writer-system` to give the four-kinds fixture a kind-accurate user slot. Variable-free; renders verbatim. |
+
+Fixture invariants enforced by `fixtures-valid.test.ts`:
+1. Every file under `prompt-templates/` validates against `prompt-template.schema.json`.
+2. Every file declares a non-empty `templateId`.
+3. Any fixture declaring a `source: "secret"` variable MUST carry the `secret-redaction` tag — the prompt-composed-secret-redaction scenario discovers fixtures by tag, so an untagged fixture would silently bypass redaction assertions.
+
+Prompt-template fixtures are exercised by the server-free `fixtures-valid.test.ts` scenarios — adding one runs the schema validator against it automatically. Capability-gated behavioral scenarios (`prompt-composed-secret-redaction`, `prompt-composed-trust-marker`) skip cleanly when the host doesn't advertise `capabilities.prompts.supported: true` + `observability: "full"`.
+
+---
+
 ## References
 
 - `README.md` — conformance suite operator docs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/README.md

@@ -24,8 +24,13 @@
 | `memory-list-options.schema.json` | memory-layer RFC | Query options for listing agent memory entries |
 | `node-pack-manifest.schema.json` | `node-packs.md` | Pack manifest (`pack.json`) — name, version, engines, nodes[], runtime, signing |
 | `pack-lockfile.schema.json` | `node-packs.md` §"Dependency resolution + lockfile" | Reproducible-build lockfile pinning resolved pack versions + SHA-256 integrity + Ed25519 signature for the entire workspace dependency graph |
+| `prompt-kind.schema.json` | `prompts.md` + RFC 0027 | Shared `string` enum (`system` / `user` / `few-shot` / `schema-hint`) `$ref`-ed by every schema that names a prompt kind. Single edit point when introducing a new kind. |
+| `prompt-pack-manifest.schema.json` | `prompts.md` §"Discovery & distribution" + RFC 0028 | Manifest for `kind: "prompt"` registry packs. Peer to `node-pack-manifest.schema.json` (RFC 0003) and `workflow-chain-pack-manifest.schema.json` (RFC 0013); disjoint via the `kind` discriminator. Distributes curated PromptTemplate collections via the same signed-tarball + Ed25519 + SRI pipeline. |
+| `prompt-ref.schema.json` | `prompts.md` + RFC 0027 | Reference to a PromptTemplate. `oneOf` accepts the stringy form (`prompt:templateId@version`) or a structured object with `libraryId` / `templateId` / `version` / `variableOverrides`. |
+| `prompt-template.schema.json` | `prompts.md` + RFC 0027 | Named, versioned, variable-bound prompt body. Carries `templateId` + SemVer `version` + `kind` (via `prompt-kind.schema.json`) + Mustache `text` + typed `variables[]` + optional `modelHints` + `meta` provenance (incl. RFC 0028 `packName` + `packVersion` when pack-sourced). |
 | `registry-version-manifest.schema.json` | `registry-operations.md` | Registry-augmented version manifest served at `GET /v1/packs/{name}/-/{version}.json`. Extends the bare pack-manifest contract with registry-side metadata (integrity hash, signing-block polymorphism, lifecycle flags). Enforced by the `Validate version manifests against registry-version-manifest schema` step in `.github/workflows/registry-publish.yml`. |
 | `orchestrator-decision.schema.json` | `node-packs.md` + orchestrator RFC | Decision output shape for orchestrator routing nodes |
+| `run-ancestry-response.schema.json` | `multi-agent-execution.md` + RFC 0040 | Response body for `GET /v1/runs/{runId}/ancestry` — names the run's immediate parent in the cross-host composition chain (or `parent: null` for top-level runs). Capability-gated on `capabilities.multiAgent.executionModel.crossHostCausation.ancestryEndpointSupported`. |
 | `run-event-payloads.schema.json` | `run-event.schema.json` §RunEventType | Per-RunEventType payload contracts, indexed by `$defs.<typeId>` for opt-in strict validation |
 | `run-event.schema.json` | `version-negotiation.md` + `RunEventDoc` | Event log envelope + event type enum |
 | `run-options.schema.json` | `run-options.md` | Per-run input overlay (configurable + tags + metadata) on `POST /v1/runs` |

package/schemas/agent-manifest.schema.json

@@ -97,6 +97,22 @@
       "type": "string",
       "description": "Optional one-line summary for UI / catalog surfaces.",
       "maxLength": 500
+    },
+    "promptLibraryRef": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9._-]{0,127}$",
+      "description": "RFC 0029 §B. Optional library identifier (per RFC 0028 §C) the agent draws fallback prompts from. When set AND `promptOverrides[kind]` is unset for a given kind, the host MAY look up a same-kind default template from this library at resolution time (layer-2 `agent-library-default` per the resolution chain in `spec/v1/prompts.md` §\"Resolution chain (normative)\"). NOT a replacement for `systemPrompt | systemPromptRef` — those remain the agent's intrinsic system-prompt declaration."
+    },
+    "promptOverrides": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "RFC 0029 §B. Per-kind preferred PromptRefs that apply at resolution chain layer 2 (`agent-overrides`) per `spec/v1/prompts.md` §\"Resolution chain (normative)\". For `system` kind, applies ONLY when the manifest has no intrinsic `systemPrompt | systemPromptRef` (the intrinsic surface wins). For other kinds, applies whenever the node doesn't carry a layer-1 explicit override.",
+      "properties": {
+        "system": { "$ref": "./prompt-ref.schema.json" },
+        "user": { "$ref": "./prompt-ref.schema.json" },
+        "few-shot": { "$ref": "./prompt-ref.schema.json" },
+        "schema-hint": { "$ref": "./prompt-ref.schema.json" }
+      }
     }
   },
   "additionalProperties": false,