@openwop/openwop-conformance 1.26.0 → 1.28.0

package/schemas/capabilities.schema.json

@@ -2052,6 +2052,32 @@
       },
       "additionalProperties": false
     },
+    "content": {
+      "type": "object",
+      "description": "RFC 0103 (spec/v1/localized-content.md). Localized authored content (pages → sections) advertisement. Reuses the i18n annex's Accept-Language/Content-Language negotiation; it does NOT redeclare negotiation. Requires `i18n.supported: true`. `baseLocale` MUST equal `capabilities.i18n.defaultLocale`; `({baseLocale} ∪ supportedLocales)` MUST be a subset of `capabilities.i18n.supportedLocales`; `baseLocale` MUST NOT appear in `supportedLocales`. Hosts that omit this block serve no content surface; the conformance scenarios skip cleanly.",
+      "additionalProperties": false,
+      "required": ["supported", "baseLocale", "supportedLocales"],
+      "properties": {
+        "supported": {
+          "type": "boolean",
+          "description": "Host serves the localized-content surface (`GET /v1/content/pages/{slug}` + tenant-scoped admin CRUD). Requires `i18n.supported: true`."
+        },
+        "baseLocale": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8}){0,3}$",
+          "description": "The locale section `data` is authored in. MUST equal `capabilities.i18n.defaultLocale`."
+        },
+        "supportedLocales": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8}){0,3}$"
+          },
+          "description": "BCP 47 tags the host has authored content translations for. MUST NOT contain `baseLocale`; `({baseLocale} ∪ supportedLocales)` MUST be a subset of `i18n.supportedLocales`."
+        }
+      }
+    },
     "portability": {
       "type": "object",
       "description": "RFC 0098 (`Active`). Export/import of a tenant's reusable estate (agents 0070, packs 0003/0013, prompt templates 0027, connection *refs* 0045/0095, schedules 0052, roster/org-chart 0086/0087). An export bundle carries NO credential values — only refs to be re-bound at the destination (RFC 0046/0079). Import maps the estate onto the destination's RFC 0048 identity, MUST offer a no-write dry-run plan, MUST be idempotent, and is gated by an RFC 0049 scope. A host advertising this serves `/v1/host/sample/{export,import}` (promotable to `/v1/{export,import}`) and emits the content-free `import.applied` event. Hosts that omit this block neither export nor import; the conformance scenarios skip cleanly.",
@@ -2081,6 +2107,29 @@
       },
       "if": { "properties": { "import": { "const": true } }, "required": ["import"] },
       "then": { "properties": { "dryRun": { "const": true } }, "required": ["dryRun"] }
+    },
+    "interrupt": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "RFC 0104 (`Active`). Interrupt-surface capabilities. Currently advertises portable HITL approver routing on the `kind: \"approval\"` InterruptPayload.",
+      "properties": {
+        "approverRouting": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["supported"],
+          "description": "RFC 0104. When `supported: true`, the host surfaces the OPTIONAL, ADVISORY `approverGroupRefs` / `approverRoleRefs` / `audience` fields on the approval InterruptPayload unchanged, resolves the ref kinds it advertises against its own identity/RBAC, ENFORCES eligibility at resolve time (the refs stay advisory metadata for clients; enforcement is host-side), and SHOULD route notifications to the resolved union. Refs are opaque to the engine and snapshotted at decision time for deterministic replay. Hosts that omit this block (or set `supported: false`) ignore the fields and remain conformant. Advertise only what the host actually resolves (`refKinds`) and honors (`audience`).",
+          "properties": {
+            "supported": { "type": "boolean", "description": "Host honors the RFC 0104 approver-routing fields." },
+            "refKinds": {
+              "type": "array",
+              "items": { "type": "string", "enum": ["group", "role"] },
+              "uniqueItems": true,
+              "description": "Which approver ref kinds the host actually resolves. `group` ⇒ honors `approverGroupRefs`; `role` ⇒ honors `approverRoleRefs`. Absent ⇒ the host resolves neither (advisory-only passthrough). Capability honesty: advertise only the kinds the host's resolver supports."
+            },
+            "audience": { "type": "boolean", "default": false, "description": "Host honors the `audience` notification-targeting override. Absent/`false` ⇒ the host notifies the resolved eligible union and ignores `audience`." }
+          }
+        }
+      }
     }
   },
   "additionalProperties": true

package/schemas/localized-content-language-settings.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/localized-content-language-settings.schema.json",
+  "title": "LocalizedContentLanguageSettings",
+  "description": "RFC 0103 (spec/v1/localized-content.md §B). Per-tenant authoring configuration for the content surface. Invariant: `baseLocale` MUST NOT appear in `supportedLocales` (the base locale is carried by section `data`, supported locales by `localizations`). This object is the source of truth for the host's advertised `content` capability block; the advertisement MUST reflect it (`baseLocale` equal, advertised `supportedLocales` equal or a subset).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["baseLocale", "supportedLocales", "autoTranslateOnPublish"],
+  "properties": {
+    "baseLocale": {
+      "type": "string",
+      "pattern": "^[a-z]{2}(-[A-Z]{2})?$",
+      "description": "The locale section `data` is authored in. MUST equal `capabilities.i18n.defaultLocale`."
+    },
+    "supportedLocales": {
+      "type": "array",
+      "description": "BCP-47 tags the tenant authors content translations for. MUST NOT contain `baseLocale`.",
+      "items": { "type": "string", "pattern": "^[a-z]{2}(-[A-Z]{2})?$" },
+      "uniqueItems": true
+    },
+    "autoTranslateOnPublish": {
+      "type": "boolean",
+      "description": "Whether the host auto-translates missing locale fields on publish (host-extension behavior; informational at the protocol layer)."
+    }
+  }
+}

package/schemas/localized-content-page-response.schema.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/localized-content-page-response.schema.json",
+  "title": "LocalizedContentPageResponse",
+  "description": "RFC 0103 (spec/v1/localized-content.md §D). The resolved delivery response for `GET /v1/content/pages/{slug}`. `locale` is the negotiated locale (equals the `Content-Language` response header). `sections[]` carry the ALREADY-MERGED section bodies — resolution (the per-section field merge §C) happened server-side, so no `localizations` map appears in the response. Only `published`, `enabled` sections are present, in render order.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "generatedAt", "locale", "slug", "page", "sections"],
+  "properties": {
+    "version": {
+      "type": "string",
+      "description": "Response schema version marker (e.g. `\"1\"`)."
+    },
+    "generatedAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "When the resolved response was generated."
+    },
+    "locale": {
+      "type": "string",
+      "pattern": "^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8}){0,3}$",
+      "description": "The negotiated locale actually used (BCP-47). Equals the `Content-Language` response header."
+    },
+    "slug": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]*$",
+      "description": "The requested page slug."
+    },
+    "page": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["pageId", "slug", "name"],
+      "description": "Resolved page metadata (status omitted — only published pages are delivered).",
+      "properties": {
+        "pageId": { "type": "string", "minLength": 1 },
+        "slug": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" },
+        "name": { "type": "string", "minLength": 1 },
+        "seo": { "type": "object", "additionalProperties": true }
+      }
+    },
+    "sections": {
+      "type": "array",
+      "description": "Resolved sections in render order; each body is the merged result, not the raw record.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["sectionId", "sectionType", "data"],
+        "properties": {
+          "sectionId": { "type": "string", "minLength": 1 },
+          "sectionType": { "type": "string", "minLength": 1 },
+          "data": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "The merged section body for the negotiated locale (exact → family → base shallow overlay)."
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/localized-content-page.schema.json

@@ -0,0 +1,62 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/localized-content-page.schema.json",
+  "title": "LocalizedContentPage",
+  "description": "RFC 0103 (spec/v1/localized-content.md §B). An authored content page: an ordered composition of sections addressed by a URL `slug`. Publication status is atomic across locales for v1. SEO carries hreflang + og:locale alternates so a renderer can emit per-locale link relations.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["pageId", "slug", "name", "status", "sectionOrder"],
+  "properties": {
+    "pageId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Stable identifier of the page within its tenant."
+    },
+    "slug": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]*$",
+      "description": "URL slug for public delivery (`GET /v1/content/pages/{slug}`). Lowercase, hyphen-separated."
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Human-facing page name (admin/authoring label)."
+    },
+    "status": {
+      "type": "string",
+      "enum": ["draft", "published"],
+      "description": "Publication status, atomic across locales for v1. A `draft` page MUST NOT be served on the public delivery path."
+    },
+    "sectionOrder": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 },
+      "description": "Ordered list of `sectionId`s defining the page's render order."
+    },
+    "seo": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Optional SEO metadata for per-locale link relations.",
+      "properties": {
+        "hreflang": {
+          "type": "array",
+          "description": "hreflang alternates: per-locale canonical URLs.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["locale", "href"],
+            "properties": {
+              "locale": { "type": "string", "pattern": "^[a-z]{2}(-[A-Z]{2})?$" },
+              "href": { "type": "string", "format": "uri" }
+            }
+          }
+        },
+        "ogLocaleAlternates": {
+          "type": "array",
+          "description": "og:locale:alternate values.",
+          "items": { "type": "string", "pattern": "^[a-z]{2}(-[A-Z]{2})?$" },
+          "uniqueItems": true
+        }
+      }
+    }
+  }
+}

package/schemas/localized-content-section.schema.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/localized-content-section.schema.json",
+  "title": "LocalizedContentSection",
+  "description": "RFC 0103 (spec/v1/localized-content.md §B). One section record of an authored content page. A section is ONE record carrying a base `data` payload (authored in the host's `content.baseLocale`) plus a sparse `localizations` map of partial per-locale field overrides — never one record per locale. The negotiated locale's resolved body is computed by the normative per-section field merge (exact-locale → language-family → base `data`, shallow overlay; §C). Body field shapes inside `data`/`localizations` are open and host/section-type-defined; this schema closes the envelope, not the body.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["sectionId", "sectionType", "data", "localizations", "status", "enabled", "order"],
+  "properties": {
+    "sectionId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Stable identifier of the section within its page."
+    },
+    "sectionType": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The section-type discriminator (e.g. `hero`, `features`). The host/section-type defines the body field shape; the protocol does not."
+    },
+    "data": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "The base/default-locale fields, authored in `content.baseLocale`. Open object — body shapes are the host/section-type's concern."
+    },
+    "localizations": {
+      "type": "object",
+      "description": "Sparse map of per-locale partial field overrides. MAY be empty (`{}`). Each key is a BCP-47 tag matching `^[a-z]{2}(-[A-Z]{2})?$` and MUST NOT equal `content.baseLocale` (the base locale is carried by `data`). Each value is a partial overlay of `data` fields; missing fields fall through to `data` (per-section merge §C).",
+      "propertyNames": {
+        "pattern": "^[a-z]{2}(-[A-Z]{2})?$"
+      },
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": true,
+        "description": "Partial field overrides for one locale; shallow-overlaid onto `data`."
+      }
+    },
+    "status": {
+      "type": "string",
+      "enum": ["draft", "published"],
+      "description": "Publication status. Atomic across all locales for v1 (no per-locale publish). The public delivery path serves `published` only."
+    },
+    "enabled": {
+      "type": "boolean",
+      "description": "Whether the section participates in delivery when its page is rendered."
+    },
+    "order": {
+      "type": "integer",
+      "description": "Render order of the section within its page (lower first). `sectionOrder` on the page is authoritative; `order` is the per-section tiebreak/sort hint."
+    }
+  }
+}

package/schemas/suspend-request.schema.json

@@ -81,6 +81,26 @@
           "type": "boolean",
           "default": false,
           "description": "RFC 0093 §D2 (pins RFC 0051 UQ 2). When `true`, a configured override principal (per `interrupt-profiles.md` §approval-gate `override.requiredRole`) MAY bypass the quorum (`requiredApprovals`) and release the gate alone. Default `false`: an override principal's approval counts as ONE quorum vote; quorum still applies. Optional, additive."
+        },
+        "approverGroupRefs": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "RFC 0104 — OPTIONAL, ADVISORY. Opaque group refs whose resolved members are eligible to approve. Like `approversList`, advisory: the host resolves refs against its own identity/RBAC and ENFORCES eligibility at resolve time; the engine treats refs as opaque (no membership resolution in the engine). Capability-gated via `interrupt.approverRouting` (`refKinds` MUST include `group`). Hosts that don't advertise it ignore this field. Membership is resolved at decision time and snapshotted for deterministic replay."
+        },
+        "approverRoleRefs": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "RFC 0104 — OPTIONAL, ADVISORY. Opaque role refs whose holders are eligible to approve. Same advisory + host-resolved + opaque-to-engine + decision-time-snapshot semantics as `approverGroupRefs`. Capability-gated via `interrupt.approverRouting` (`refKinds` MUST include `role`)."
+        },
+        "audience": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "RFC 0104 — OPTIONAL, ADVISORY notification-targeting hint: who should be TOLD about this gate, distinct from who MAY approve (the eligibility refs). When OMITTED, the host SHOULD notify the resolved union of the eligibility refs (`approversList` ∪ `approverGroupRefs` ∪ `approverRoleRefs`). When PRESENT, it OVERRIDES that default. Advisory; the host remains the routing authority. Capability-gated via `interrupt.approverRouting.audience`.",
+          "properties": {
+            "subjects": { "type": "array", "items": { "type": "string" }, "description": "Opaque subject refs to notify." },
+            "groups": { "type": "array", "items": { "type": "string" }, "description": "Opaque group refs to notify." },
+            "roles": { "type": "array", "items": { "type": "string" }, "description": "Opaque role refs to notify." }
+          }
         }
       }
     },

package/src/scenarios/i18n-negotiation.test.ts

@@ -166,16 +166,43 @@ describe.skipIf(HTTP_SKIP)('i18n-negotiation: behavioral (i18n.md §Accept-Langu
     // Prefer a non-default supported locale so localization actually engages.
     const negotiated = supported.find((t) => t !== defaultLocale) ?? defaultLocale;
 
+    // Baseline: the same probe under the host's DEFAULT locale. The i18n MUST is
+    // locale-INVARIANCE of the machine-readable code, not a specific vocabulary
+    // value. i18n.md §"`locale` field on `ErrorEnvelope.details`" requires the
+    // `error` code to "remain English / lowercase / underscore-cased regardless
+    // of locale" — it is an identifier, not human text. The spec does NOT pin a
+    // missing run to the literal `not_found`: error-envelope.schema.json says
+    // codes are SHOULD-snake_case, rest-endpoints.md §"Common error codes" is
+    // non-exhaustive, and `run_forbidden` (RFC 0048) sets precedent that hosts
+    // MAY use run-specific codes. Asserting a literal here would also pressure a
+    // conformant host into a COMPATIBILITY.md §2.2 breaking error-code change.
+    const baseRes = await driver.get(PROBE_PATH, {
+      headers: { 'Accept-Language': defaultLocale },
+    });
+    const baseCode = errCode(baseRes.json);
+
     const res = await driver.get(PROBE_PATH, {
       headers: { 'Accept-Language': negotiated },
     });
     expect(res.status).toBe(404);
+    const negotiatedCode = errCode(res.json);
+
+    // (a) the code is an English snake_case identifier (not localized prose)
+    expect(
+      typeof negotiatedCode === 'string' && /^[a-z][a-z0-9_]*$/.test(negotiatedCode),
+      driver.describe(
+        'i18n.md §"`locale` field on `ErrorEnvelope.details`"',
+        `the machine-readable error code MUST be an English lowercase snake_case identifier, not localized text (got ${String(negotiatedCode)} under ${negotiated})`,
+      ),
+    ).toBe(true);
+
+    // (b) it is byte-identical to the default-locale code — the actual invariance MUST
     expect(
-      errCode(res.json),
+      negotiatedCode,
       driver.describe(
         'i18n.md §"`locale` field on `ErrorEnvelope.details`"',
-        `the machine-readable error code MUST remain the canonical English token regardless of the negotiated locale (${negotiated})`,
+        `the machine-readable error code MUST remain identical regardless of the negotiated locale (default ${defaultLocale} → ${String(baseCode)}; negotiated ${negotiated})`,
       ),
-    ).toBe('not_found');
+    ).toBe(baseCode);
   });
 });

package/src/scenarios/interrupt-approver-routing.test.ts

@@ -0,0 +1,166 @@
+/**
+ * Portable HITL approver routing (RFC 0104; `spec/v1/interrupt.md` §`kind: "approval"`).
+ *
+ * Adds three OPTIONAL, ADVISORY fields to the approval `InterruptPayload` so
+ * group/role approver routing is portable + capability-gated across hosts:
+ * `approverGroupRefs`, `approverRoleRefs`, and an `audience` notification hint.
+ * `approversList` advisory semantics are unchanged; enforcement stays host-side;
+ * refs are opaque to the engine and decision-time-snapshotted for replay.
+ *
+ * Two layers:
+ *
+ *   A. Always-on, server-free legs — the `interrupt.approverRouting` capability
+ *      block shape, the additive optionality of the three fields on the
+ *      `ApprovalData` schema, and the §"Portable approver routing" reference
+ *      rule that `audience` DEFAULTS to the resolved eligibility union when
+ *      omitted and OVERRIDES it when present (`notifyTargets`).
+ *
+ *   B. Capability-gated advertisement-coherence leg — on a host advertising
+ *      `capabilities.interrupt.approverRouting.supported`, the advertised shape
+ *      MUST be honest: `refKinds` ⊆ {group, role}; `audience` boolean. Hosts
+ *      that do not advertise the capability soft-skip via the gate (the fields
+ *      are ignored and the host stays conformant).
+ *
+ * @see spec/v1/interrupt.md §"Portable approver routing (RFC 0104)"
+ * @see spec/v1/capabilities.md — interrupt.approverRouting.*
+ * @see schemas/suspend-request.schema.json — ApprovalData
+ * @see RFCS/0104-hitl-approver-routing.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+
+const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
+function loadSchema(name: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as Record<string, unknown>;
+}
+
+interface ApproverRoutingCap {
+  supported?: boolean;
+  refKinds?: string[];
+  audience?: boolean;
+}
+interface InterruptCap {
+  approverRouting?: ApproverRoutingCap;
+}
+
+// ── §"Portable approver routing" reference rule — audience default/override ──
+type ApprovalPayload = {
+  approversList?: string[];
+  approverGroupRefs?: string[];
+  approverRoleRefs?: string[];
+  audience?: { subjects?: string[]; groups?: string[]; roles?: string[] };
+};
+/**
+ * The advisory routing union a notifying host SHOULD target. Mirrors the
+ * normative rule: omitted `audience` ⇒ the eligibility union
+ * (`approversList` ∪ `approverGroupRefs` ∪ `approverRoleRefs`); present
+ * `audience` ⇒ its own union, overriding the default. Refs stay opaque —
+ * this composes refs, it does NOT resolve membership.
+ */
+function notifyTargets(p: ApprovalPayload): string[] {
+  const uniq = (xs: string[]): string[] => [...new Set(xs)];
+  if (p.audience) {
+    return uniq([...(p.audience.subjects ?? []), ...(p.audience.groups ?? []), ...(p.audience.roles ?? [])]);
+  }
+  return uniq([...(p.approversList ?? []), ...(p.approverGroupRefs ?? []), ...(p.approverRoleRefs ?? [])]);
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+// A. Server-free legs
+// ════════════════════════════════════════════════════════════════════════════
+
+describe('interrupt-approver-routing: capability advertisement shape (capabilities.md, server-free)', () => {
+  const caps = loadSchema('capabilities.schema.json');
+  const interrupt = (caps.properties as Record<string, { properties?: Record<string, { required?: string[]; properties?: Record<string, unknown> }> }>).interrupt;
+
+  it('capabilities schema declares interrupt.approverRouting', () => {
+    expect(interrupt, why('capabilities.schema.json §interrupt', 'the interrupt block MUST be declared')).toBeDefined();
+    const ar = interrupt?.properties?.approverRouting;
+    expect(ar, why('RFC 0104', 'interrupt.approverRouting MUST be declared')).toBeDefined();
+    expect(ar?.required, why('RFC 0104', 'approverRouting.supported MUST be required')).toEqual(expect.arrayContaining(['supported']));
+    for (const f of ['supported', 'refKinds', 'audience']) {
+      expect(ar?.properties?.[f], why('RFC 0104', `approverRouting.${f} MUST be declared`)).toBeDefined();
+    }
+  });
+});
+
+describe('interrupt-approver-routing: ApprovalData additive optionality (interrupt.md §approval, server-free)', () => {
+  const ajv = new Ajv2020({ strict: false, allErrors: true });
+  addFormats(ajv);
+  const suspend = loadSchema('suspend-request.schema.json');
+  const validate = ajv.compile(suspend);
+
+  const baseApproval = {
+    kind: 'approval',
+    key: 'run:node:0',
+    data: { artifactId: 'a1', artifactType: 'prd', title: 'Approve budget', actions: ['accept', 'reject'] },
+  };
+
+  it('an approval payload WITHOUT the routing fields still validates (additive, optional)', () => {
+    expect(validate(baseApproval), why('RFC 0104 Compatibility', `the fields are optional — Errors: ${JSON.stringify(validate.errors)}`)).toBe(true);
+  });
+  it('an approval payload WITH group/role refs + audience validates', () => {
+    const withRouting = {
+      ...baseApproval,
+      data: {
+        ...baseApproval.data,
+        approverGroupRefs: ['grp:finance-approvers'],
+        approverRoleRefs: ['role:controller'],
+        audience: { groups: ['grp:finance-approvers'], roles: ['role:controller'], subjects: ['user:cfo'] },
+      },
+    };
+    expect(validate(withRouting), why('RFC 0104 §Proposal', `routing fields MUST validate — Errors: ${JSON.stringify(validate.errors)}`)).toBe(true);
+  });
+  it('an audience with an unknown key is rejected (audience object is closed)', () => {
+    const badAudience = { ...baseApproval, data: { ...baseApproval.data, audience: { teams: ['grp:x'] } } };
+    expect(validate(badAudience), why('RFC 0104', 'audience MUST be additionalProperties:false')).toBe(false);
+  });
+});
+
+describe('interrupt-approver-routing: audience default/override rule (interrupt.md §"Portable approver routing", server-free)', () => {
+  it('omitted audience ⇒ notify the resolved eligibility union', () => {
+    expect(
+      notifyTargets({ approversList: ['user:a'], approverGroupRefs: ['grp:fin'], approverRoleRefs: ['role:ctrl'] }),
+      why('RFC 0104', 'omitted audience MUST default to the eligibility union'),
+    ).toEqual(['user:a', 'grp:fin', 'role:ctrl']);
+  });
+  it('present audience ⇒ overrides the eligibility union', () => {
+    expect(
+      notifyTargets({ approverGroupRefs: ['grp:fin'], audience: { subjects: ['user:cfo'], groups: ['grp:audit'] } }),
+      why('RFC 0104', 'present audience MUST override the default'),
+    ).toEqual(['user:cfo', 'grp:audit']);
+  });
+  it('no eligibility refs and no audience ⇒ empty target set', () => {
+    expect(notifyTargets({}), why('RFC 0104', 'nothing to route when no refs')).toEqual([]);
+  });
+});
+
+// ════════════════════════════════════════════════════════════════════════════
+// B. Capability-gated advertisement-coherence leg
+// ════════════════════════════════════════════════════════════════════════════
+
+describe('interrupt-approver-routing: advertised shape is honest (capability-gated)', () => {
+  it('an advertising host advertises a coherent approverRouting block', async () => {
+    if (!process.env.OPENWOP_BASE_URL) return; // no live host → nothing to read
+    const interrupt = await readCapabilityFamily<InterruptCap>('interrupt');
+    const ar = interrupt?.approverRouting;
+    // Soft-skip: host does not advertise the capability (fields ignored; still conformant).
+    if (!behaviorGate('interrupt.approverRouting', ar?.supported === true)) return;
+
+    // Opt-in established (supported === true): the advertised shape MUST be honest.
+    const allowed = new Set(['group', 'role']);
+    for (const k of ar?.refKinds ?? []) {
+      expect(allowed.has(k), why('RFC 0104 capabilities.md', `refKinds MUST be a subset of {group, role} — saw ${k}`)).toBe(true);
+    }
+    if (ar?.audience !== undefined) {
+      expect(typeof ar.audience, why('RFC 0104 capabilities.md', 'approverRouting.audience MUST be boolean')).toBe('boolean');
+    }
+  });
+});