@openwop/openwop-conformance 1.29.0 → 1.34.0

package/src/scenarios/multi-party-conversation-shape.test.ts

@@ -0,0 +1,206 @@
+/**
+ * Multi-party group conversation — shared transcript + speaker attribution (RFC 0101).
+ *
+ * Always-on, server-free schema-shape probe. Verifies the three additive,
+ * normative RFC 0101 wire facts on the published schemas:
+ *
+ *   1. `conversation-event.schema.json` `ConversationOpenedPayload` carries an
+ *      OPTIONAL `participants: AgentRef[]` roster — a conforming 3-agent council
+ *      transcript validates, and a malformed participant item is rejected.
+ *   2. `conversation-turn.schema.json` REQUIRES `speakerId` when `role: 'agent'`
+ *      (the `allOf`/`if` conditional) — an agent turn WITH a roster-instance
+ *      `speakerId` validates; an agent turn that OMITS `speakerId` MUST FAIL
+ *      schema validation (the RFC 0101 attribution MUST); a `user`/`system` turn
+ *      without `speakerId` is unaffected (additive — pre-RFC-0101 producers).
+ *   3. `capabilities.schema.json` declares the `multiPartyConversation` block with
+ *      its `supported` flag (+ optional `maxParticipants`), and it is closed
+ *      (`additionalProperties: false`).
+ *
+ * The non-participant-rejection MUST (a turn whose `speakerId` is NOT in the
+ * declared `participants` roster MUST be rejected) is a HOST-enforced runtime
+ * contract — it is not expressible by JSON Schema alone (roster membership is
+ * cross-field state). This probe asserts the wire SHAPE that makes the check
+ * possible (roster present + every agent turn attributed) and verifies the
+ * membership predicate directly; the behavioral leg (a live host rejecting a
+ * non-participant turn with `validation_error`) is gated on
+ * `multiPartyConversation.supported` and lands at the reference-host
+ * implementation (RFC 0101 §Conformance — same staging as RFC 0086's roster
+ * `roster.run.initiated` behavioral leg). This scenario asserts the wire
+ * contract, not host behavior.
+ *
+ * Normative references:
+ *   - RFCS/0101-multi-party-group-conversation.md (§Spec / §Schema / §Conformance)
+ *   - RFCS/0005-conversation.md (the single-agent conversation primitive this extends)
+ *   - schemas/conversation-event.schema.json (ConversationOpenedPayload.participants)
+ *   - schemas/conversation-turn.schema.json (speakerId + the role==='agent' conditional)
+ *   - schemas/capabilities.schema.json (multiPartyConversation)
+ *
+ * @see RFCS/0101-multi-party-group-conversation.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+
+/** Server-free assertion-message helper. */
+const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
+
+function loadSchema(name: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as Record<string, unknown>;
+}
+
+describe('multi-party-conversation-shape: participant roster on conversation.opened (RFC 0101 §Schema, server-free)', () => {
+  const ajv = new Ajv2020({ strict: false, allErrors: true });
+  addFormats(ajv);
+  ajv.addSchema(loadSchema('conversation-event.schema.json'), 'conversation-event');
+  const opened = ajv.getSchema('conversation-event#/$defs/ConversationOpenedPayload');
+
+  it('the ConversationOpenedPayload $def exists and declares participants: AgentRef[]', () => {
+    expect(opened, 'the ConversationOpenedPayload $def MUST exist').toBeTruthy();
+  });
+
+  it('a conforming 3-agent council transcript (participant roster + user opening turn) validates', () => {
+    const good = {
+      conversationId: 'run-abc:n1:0',
+      agentId: 'host:advisor-cfo',
+      participants: [
+        { agentId: 'host:advisor-cfo', name: 'CFO' },
+        { agentId: 'host:advisor-cmo', name: 'CMO' },
+        { agentId: 'host:advisor-cto', name: 'CTO' },
+      ],
+      initialTurn: {
+        messageId: 'run-abc:n1:0:user',
+        from: 'user',
+        content: 'Should we launch in Q3 or Q4?',
+        ts: 1718900000000,
+        role: 'user',
+        turnIndex: 0,
+      },
+    };
+    expect(opened!(good), why('RFC 0101 §Schema', 'a conversation.opened with a participant roster MUST validate')).toBe(true);
+  });
+
+  it('a participant entry that is not a valid AgentRef (no agentId) is rejected', () => {
+    const bad = {
+      conversationId: 'run-abc:n1:0',
+      participants: [{ name: 'CFO' }],
+      initialTurn: {
+        messageId: 'run-abc:n1:0:user',
+        from: 'user',
+        content: 'x',
+        ts: 1,
+        role: 'user',
+        turnIndex: 0,
+      },
+    };
+    expect(opened!(bad), why('RFC 0101 §Schema', 'a participants[] item without agentId MUST be rejected')).toBe(false);
+  });
+
+  it('participants is OPTIONAL — a single-agent conversation.opened (no roster) still validates (back-compat)', () => {
+    const noRoster = {
+      conversationId: 'run-abc:n1:0',
+      agentId: 'host:advisor-cfo',
+      initialTurn: {
+        messageId: 'run-abc:n1:0:user',
+        from: 'user',
+        content: 'x',
+        ts: 1,
+        role: 'user',
+        turnIndex: 0,
+      },
+    };
+    expect(opened!(noRoster), why('RFC 0101 §Compatibility', 'participants is additive — a roster-less conversation MUST still validate')).toBe(true);
+  });
+});
+
+describe('multi-party-conversation-shape: per-turn speaker attribution (RFC 0101 §Schema, server-free)', () => {
+  const ajv = new Ajv2020({ strict: false, allErrors: true });
+  addFormats(ajv);
+  const turn = ajv.compile(loadSchema('conversation-turn.schema.json'));
+
+  const agentBase = {
+    messageId: 'council-q1:1:agent',
+    from: 'host:advisor-cfo',
+    content: "From a cash-runway view I'd push the launch one quarter.",
+    ts: 1718900000000,
+    role: 'agent' as const,
+    turnIndex: 1,
+  };
+
+  it('an agent turn WITH a roster-instance speakerId validates', () => {
+    expect(
+      turn({ ...agentBase, speakerId: 'host:advisor-cfo' }),
+      why('RFC 0101 §Schema', "a role:'agent' turn carrying speakerId MUST validate"),
+    ).toBe(true);
+  });
+
+  it("a role:'agent' turn MISSING speakerId MUST fail schema validation (the attribution MUST)", () => {
+    expect(
+      turn(agentBase),
+      why('RFC 0101 §Schema', "a role:'agent' turn that omits speakerId MUST be rejected (the conditional required)"),
+    ).toBe(false);
+  });
+
+  it("speakerId is OPTIONAL for role:'user' / role:'system' turns (additive — pre-RFC-0101 producers)", () => {
+    expect(
+      turn({ messageId: 'council-q1:0:user', from: 'user', content: 'Q3 or Q4?', ts: 1, role: 'user', turnIndex: 0 }),
+      why('RFC 0101 §Compatibility', "a role:'user' turn without speakerId MUST still validate"),
+    ).toBe(true);
+    expect(
+      turn({ messageId: 'council-q1:9:system', from: 'system', content: 'conversation timed out', ts: 1, role: 'system', turnIndex: 9 }),
+      why('RFC 0101 §Compatibility', "a role:'system' turn without speakerId MUST still validate"),
+    ).toBe(true);
+  });
+});
+
+describe('multi-party-conversation-shape: non-participant turn detection (RFC 0101 §Spec, server-free)', () => {
+  // The roster-membership MUST ("a turn whose speakerId is not a participant MUST
+  // be rejected") is host-enforced cross-field state, not JSON-Schema-expressible.
+  // This probe asserts the membership predicate the host applies, over the same
+  // shapes the schema validates — so the wire contract that makes the check
+  // possible is verified server-free; the live-host rejection is the gated
+  // behavioral leg (below).
+  const roster = new Set(['host:advisor-cfo', 'host:advisor-cmo', 'host:advisor-cto']);
+
+  it('a turn whose speakerId IS a participant is admissible', () => {
+    expect(roster.has('host:advisor-cmo'), why('RFC 0101 §Spec', 'an agent in the roster MAY speak')).toBe(true);
+  });
+
+  it('a turn whose speakerId is NOT a participant MUST be rejected by the host (roster membership)', () => {
+    expect(
+      roster.has('host:advisor-intruder'),
+      why('RFC 0101 §Spec', 'a turn from a non-participant agent MUST be rejected'),
+    ).toBe(false);
+  });
+});
+
+describe('multi-party-conversation-shape: capability advertisement (RFC 0101 §Schema, server-free)', () => {
+  it('capabilities.schema.json declares multiPartyConversation with supported + optional maxParticipants, closed', () => {
+    const caps = loadSchema('capabilities.schema.json');
+    const props = caps.properties as Record<string, Record<string, unknown>>;
+    const mpc = props.multiPartyConversation as
+      | { properties?: Record<string, unknown>; required?: string[]; additionalProperties?: boolean }
+      | undefined;
+    expect(mpc, why('RFC 0101 §Schema', 'capabilities.multiPartyConversation MUST be declared')).toBeDefined();
+    expect(mpc?.properties?.supported, why('RFC 0101 §Schema', 'multiPartyConversation.supported MUST be declared')).toBeDefined();
+    expect(mpc?.properties?.maxParticipants, why('RFC 0101 §Schema', 'multiPartyConversation.maxParticipants MUST be declared (optional)')).toBeDefined();
+    expect(mpc?.required, why('RFC 0101 §Schema', 'supported MUST be required on the block')).toContain('supported');
+    expect(mpc?.additionalProperties, why('RFC 0101 §Schema', 'the multiPartyConversation block MUST be closed')).toBe(false);
+  });
+
+  it('the multiPartyConversation block validates a conforming advertisement and rejects extras', () => {
+    const caps = loadSchema('capabilities.schema.json');
+    const mpc = (caps.properties as Record<string, Record<string, unknown>>).multiPartyConversation;
+    const ajv = new Ajv2020({ strict: false, allErrors: true });
+    addFormats(ajv);
+    const validate = ajv.compile(mpc);
+    expect(validate({ supported: true, maxParticipants: 8 }), why('RFC 0101 §Schema', 'a conforming advertisement MUST validate')).toBe(true);
+    expect(validate({ supported: true }), why('RFC 0101 §Schema', 'maxParticipants is optional')).toBe(true);
+    expect(validate({ maxParticipants: 8 }), why('RFC 0101 §Schema', 'supported is required')).toBe(false);
+    expect(validate({ supported: true, unexpected: 1 }), why('RFC 0101 §Schema', 'an extra key MUST be rejected (closed block)')).toBe(false);
+    expect(validate({ supported: true, maxParticipants: 1 }), why('RFC 0101 §Schema', 'maxParticipants minimum is 2 (a council has ≥2)')).toBe(false);
+  });
+});

package/src/scenarios/registry-declarative-kinds.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Publishable declarative pack kinds (RFC 0107, `Active`).
+ *
+ * OpenWOP defines declarative pack kinds at the SOURCE level — artifact-type
+ * (RFC 0075, `kind: "artifact-type"`) and connection (RFC 0095,
+ * `kind: "connection"`). RFC 0107 extends the PUBLISHED contract,
+ * `registry-version-manifest.schema.json`, so those kinds can be published to a
+ * registry: it adds a `kind` discriminator (absent ≡ `node`), the per-kind
+ * declarative payload (`artifactTypes[]` / `provider` / `chains[]` / …), and
+ * makes `runtime` required only for executable kinds.
+ *
+ * Always-on + server-free. Two parts (mirrors the project's other
+ * schema-contract scenarios):
+ *
+ *   PART 1 — contract present. `registry-operations.md` §"Validation flow"
+ *   carries the kind-aware manifest-schema selection (#3) and the
+ *   skip-runtime-check-for-declarative-kinds rule (#7); the version-manifest
+ *   schema carries the `kind` enum + declarative payload + conditional runtime.
+ *   Guards against the requirement being silently dropped.
+ *
+ *   PART 2 — schema admits declarative kinds and still rejects malformed ones.
+ *   A published artifact-type and a published connection version manifest
+ *   validate; a node manifest is unchanged; a declarative manifest carrying
+ *   `runtime` (forbidden) and a node manifest missing `runtime` are rejected.
+ *
+ * @see spec/v1/registry-operations.md §"Validation flow"
+ * @see schemas/registry-version-manifest.schema.json
+ * @see RFCS/0107-publishable-declarative-pack-kinds.md
+ * @see RFCS/0075-artifact-type-packs-realworld-amendment.md, RFCS/0095-connection-packs-portable-provider-definitions.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
+
+const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
+
+describe('registry-declarative-kinds: contract present in the corpus (RFC 0107, server-free)', () => {
+  const registryDoc = V1_DIR ? readFileSync(join(V1_DIR, 'registry-operations.md'), 'utf8') : '';
+  const versionManifestSchema = JSON.parse(
+    readFileSync(join(SCHEMAS_DIR, 'registry-version-manifest.schema.json'), 'utf8'),
+  );
+
+  it.skipIf(V1_DIR === null)('registry-operations.md §Validation flow selects the manifest schema by `kind`', () => {
+    expect(
+      /kind[\s\S]{0,120}artifact-type-pack-manifest\.schema\.json/.test(registryDoc),
+      why('registry-operations.md §Validation flow #3', 'pack.json validates against the per-`kind` source schema (RFC 0107)'),
+    ).toBe(true);
+  });
+
+  it.skipIf(V1_DIR === null)('registry-operations.md §Validation flow skips the runtime check for declarative kinds', () => {
+    expect(
+      /declarative[\s\S]{0,160}(skipped|MUST NOT)/i.test(registryDoc) && /runtime/i.test(registryDoc),
+      why('registry-operations.md §Validation flow #7', 'runtime-support check is skipped for declarative kinds (RFC 0107)'),
+    ).toBe(true);
+  });
+
+  it('registry-version-manifest.schema.json carries the `kind` discriminator + declarative payload + conditional runtime', () => {
+    const props = versionManifestSchema.properties ?? {};
+    expect(props.kind?.enum, why('registry-version-manifest.schema.json', '`kind` enum present')).toEqual(
+      expect.arrayContaining(['node', 'artifact-type', 'connection']),
+    );
+    expect(!!props.artifactTypes && !!props.provider, why('registry-version-manifest.schema.json', 'declarative payload props present')).toBe(true);
+    expect(
+      (versionManifestSchema.required ?? []).includes('runtime'),
+      why('registry-version-manifest.schema.json', '`runtime` is NOT top-level required (conditional on kind)'),
+    ).toBe(false);
+    expect(
+      JSON.stringify(versionManifestSchema.allOf ?? []).includes('runtime'),
+      why('registry-version-manifest.schema.json', '`allOf` if/then/else makes runtime conditional on kind'),
+    ).toBe(true);
+  });
+});
+
+describe('registry-declarative-kinds: version-manifest schema admits declarative kinds (RFC 0107, server-free)', () => {
+  const ajv = new Ajv2020({ allErrors: true, strict: false });
+  addFormats(ajv);
+  const validate = ajv.compile(
+    JSON.parse(readFileSync(join(SCHEMAS_DIR, 'registry-version-manifest.schema.json'), 'utf8')),
+  );
+
+  const base = { name: 'core.openwop.x', version: '1.0.0', engines: { openwop: '>=1.0.0' }, integrity: 'sha256-abc=' };
+
+  it('a published artifact-type version manifest validates (kind + artifactTypes, no runtime)', () => {
+    const ok = validate({ ...base, kind: 'artifact-type', artifactTypes: [{ artifactTypeId: 'doc.one-pager', title: 'One-Pager', schema: { type: 'object' } }] });
+    expect(ok, why('registry-operations.md §Validation flow', 'artifact-type manifest publishes (RFC 0107)')).toBe(true);
+  });
+
+  it('a published connection version manifest validates (kind + provider, no runtime)', () => {
+    const ok = validate({ ...base, kind: 'connection', provider: { id: 'github', category: 'dev' } });
+    expect(ok, why('registry-operations.md §Validation flow', 'connection manifest publishes (RFC 0107)')).toBe(true);
+  });
+
+  it('an unchanged node version manifest still validates (no kind, runtime + nodes)', () => {
+    const ok = validate({ ...base, runtime: { language: 'javascript' }, nodes: [{ typeId: 'core.openwop.x.n', version: '1.0.0', category: 'data', role: 'pure' }] });
+    expect(ok, why('COMPATIBILITY.md §2.1', 'RFC 0107 is additive — node manifests validate unchanged')).toBe(true);
+  });
+
+  it('a declarative manifest carrying `runtime` is REJECTED (declarative kinds carry no runtime)', () => {
+    const ok = validate({ ...base, kind: 'artifact-type', artifactTypes: [{ artifactTypeId: 'doc.x' }], runtime: { language: 'javascript' } });
+    expect(ok, why('registry-version-manifest.schema.json', 'declarative kind MUST NOT carry runtime')).toBe(false);
+  });
+
+  it('a node manifest MISSING `runtime` is still REJECTED (executable kinds require runtime)', () => {
+    const ok = validate({ ...base, nodes: [{ typeId: 'core.openwop.x.n', version: '1.0.0', category: 'data', role: 'pure' }] });
+    expect(ok, why('registry-version-manifest.schema.json', 'executable kind (node/absent) still requires runtime')).toBe(false);
+  });
+});

package/src/scenarios/voice-bargein-no-partial-leak.test.ts

@@ -0,0 +1,61 @@
+/**
+ * Barge-in: no partial-output leak (RFC 0106 §F INV-3) — behavioral.
+ *
+ * Backs the protocol-tier SECURITY invariant `voice-bargein-no-partial-leak`.
+ * Gated on `capabilities.aiProviders.realtimeVoice.bargeIn === 'supported'`.
+ * Soft-skips when unadvertised (default) / hard-fails under
+ * `OPENWOP_REQUIRE_BEHAVIOR=true`. Drives `POST /v1/host/sample/voice/barge-in`
+ * (soft-skips on 404):
+ *
+ *   - the host MUST emit `voice.barge_in` then `voice.cancelled` (distinct events);
+ *   - NO `voice.synthesis_chunk` (nor any partial tool/model output) may appear
+ *     AFTER the `voice.cancelled` — a cancellation is all-or-nothing and MUST NOT
+ *     leak the un-guardrailed partial the end-of-turn pass would otherwise scrub.
+ *
+ * Spec references:
+ *   - https://github.com/openwop/openwop/blob/main/RFCS/0106-realtime-voice-session-profile.md (§F INV-3)
+ *   - https://github.com/openwop/openwop/blob/main/SECURITY/invariants.yaml (voice-bargein-no-partial-leak)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+
+const SEAM = '/v1/host/sample/voice/barge-in';
+
+function realtimeVoiceOf(ai: Record<string, unknown> | undefined): Record<string, unknown> | undefined {
+  const rv = (ai as { realtimeVoice?: unknown })?.realtimeVoice;
+  return rv && typeof rv === 'object' ? (rv as Record<string, unknown>) : undefined;
+}
+function eventsOf(json: unknown): Array<{ type?: string }> {
+  const e = (json as { events?: unknown })?.events;
+  return Array.isArray(e) ? (e as Array<{ type?: string }>) : [];
+}
+
+describe('voice-bargein-no-partial-leak (RFC 0106 §F INV-3)', () => {
+  it('barge-in cancels with no synthesis chunk emitted after voice.cancelled', async () => {
+    const ai = await readCapabilityFamily<Record<string, unknown>>('aiProviders');
+    const advertised = realtimeVoiceOf(ai)?.bargeIn === 'supported';
+    if (!behaviorGate('openwop-voice-bargein', advertised)) return;
+
+    const res = await driver.post(SEAM, {});
+    if (res.status === 404) return; // seam unwired — soft-skip
+
+    expect(res.status === 200, driver.describe('RFC 0106 §F', 'the barge-in seam MUST return 200')).toBe(true);
+
+    const types = eventsOf(res.json).map((e) => e.type);
+    const bargeIdx = types.indexOf('voice.barge_in');
+    const cancelIdx = types.indexOf('voice.cancelled');
+    expect(bargeIdx >= 0, driver.describe('RFC 0106 §D', 'a barge-in MUST emit voice.barge_in')).toBe(true);
+    expect(cancelIdx >= 0, driver.describe('RFC 0106 §D', 'a barge-in that cancels work MUST emit voice.cancelled')).toBe(true);
+    expect(cancelIdx > bargeIdx, driver.describe('RFC 0106 §D', 'voice.cancelled MUST follow voice.barge_in')).toBe(true);
+
+    // The load-bearing INV-3 assertion: nothing partial after the cancel.
+    const afterCancel = types.slice(cancelIdx + 1);
+    expect(
+      !afterCancel.includes('voice.synthesis_chunk'),
+      driver.describe('RFC 0106 §F INV-3', 'NO voice.synthesis_chunk (partial output) may be emitted AFTER voice.cancelled'),
+    ).toBe(true);
+  });
+});

package/src/scenarios/voice-event-payloads-shape.test.ts

@@ -0,0 +1,127 @@
+/**
+ * Voice run-event payload shapes (RFC 0106 §B/§C/§D) — server-free.
+ *
+ * Always-on schema-shape probe for the `voice.*` run-event taxonomy — the single
+ * canonical record of a live voice turn (the `ctx.callTranscriber` Promise resolves
+ * at `turn_commit`; the events ARE the streaming representation). Verifies that:
+ *   - all seven `voice.*` types are members of `run-event.schema.json#$defs.RunEventType`;
+ *   - each has a payload `$def` in `run-event-payloads.schema.json` reachable via the
+ *     `typeIndex` lookup map;
+ *   - `voice.transcript` REQUIRES `contentTrust: "untrusted"` — the schema-enforced wire
+ *     half of SECURITY invariant `voice-transcript-untrusted` (live transcript is
+ *     untrusted ingress and MUST NOT be promoted to system/developer authority);
+ *   - `voice.synthesis_chunk` is metadata-shaped (seq + mimeType required; bytes by
+ *     `url`/`streamRef`, inline `base64` optional-only) — backing the G8 metadata-only
+ *     event-log rule (`voice-streamref-tenant-bound` keeps the log bounded);
+ *   - the content-free events (`speech_start`/`endpoint_candidate`/`turn_commit`/
+ *     `barge_in`/`cancelled`) reject an unknown property (`additionalProperties:false`).
+ *
+ * The behavioral legs (interim-not-durable, barge-in no-partial-leak, streamRef
+ * tenant-binding, the live `callTranscriber` Promise + emission) are the gated
+ * reference-host scenarios that land at `Active → Accepted` — those invariants are
+ * reference-impl tier until a host proves them non-vacuously.
+ *
+ * Spec references:
+ *   - https://github.com/openwop/openwop/blob/main/RFCS/0106-realtime-voice-session-profile.md (§B, §C, §D, §F)
+ *   - https://github.com/openwop/openwop/blob/main/schemas/run-event-payloads.schema.json
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+
+const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
+
+function loadSchema(name: string): Record<string, any> {
+  return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as Record<string, any>;
+}
+
+const VOICE_TYPES = [
+  'voice.speech_start',
+  'voice.transcript',
+  'voice.endpoint_candidate',
+  'voice.turn_commit',
+  'voice.synthesis_chunk',
+  'voice.barge_in',
+  'voice.cancelled',
+] as const;
+
+const DEF_KEY: Record<string, string> = {
+  'voice.speech_start': 'voiceSpeechStart',
+  'voice.transcript': 'voiceTranscript',
+  'voice.endpoint_candidate': 'voiceEndpointCandidate',
+  'voice.turn_commit': 'voiceTurnCommit',
+  'voice.synthesis_chunk': 'voiceSynthesisChunk',
+  'voice.barge_in': 'voiceBargeIn',
+  'voice.cancelled': 'voiceCancelled',
+};
+
+describe('voice-event-payloads-shape: the voice.* run-event taxonomy (RFC 0106 §B/§C/§D, server-free)', () => {
+  it('all seven voice.* types are in the RunEventType enum', () => {
+    const enumVals: string[] = loadSchema('run-event.schema.json').$defs.RunEventType.enum;
+    for (const t of VOICE_TYPES) {
+      expect(enumVals.includes(t), why('run-event.schema.json §RunEventType', `${t} MUST be a RunEventType`)).toBe(true);
+    }
+  });
+
+  it('each voice.* type has a payload $def reachable via typeIndex', () => {
+    const payloads = loadSchema('run-event-payloads.schema.json');
+    const typeIndex = payloads.$defs._typeIndex.properties as Record<string, { $ref: string }>;
+    for (const t of VOICE_TYPES) {
+      expect(typeIndex[t], why('run-event-payloads.schema.json §typeIndex', `${t} MUST map to a $def`)).toBeDefined();
+      expect(payloads.$defs[DEF_KEY[t]], why('run-event-payloads.schema.json', `$defs.${DEF_KEY[t]} MUST exist`)).toBeDefined();
+    }
+  });
+
+  it('voice.transcript REQUIRES contentTrust:"untrusted" (SECURITY: voice-transcript-untrusted)', () => {
+    const def = loadSchema('run-event-payloads.schema.json').$defs.voiceTranscript;
+    const ajv = new Ajv2020({ strict: false, allErrors: true });
+    addFormats(ajv);
+    const validate = ajv.compile(def);
+
+    expect(
+      validate({ text: 'book a table', isFinal: true, atMs: 1200, contentTrust: 'untrusted' }),
+      why('RFC 0106 §F INV-2', 'a transcript marked untrusted MUST validate'),
+    ).toBe(true);
+    expect(
+      validate({ text: 'book a table', isFinal: true, atMs: 1200 }),
+      why('RFC 0106 §F INV-2 (voice-transcript-untrusted)', 'a transcript WITHOUT contentTrust MUST be rejected'),
+    ).toBe(false);
+    expect(
+      validate({ text: 'book a table', isFinal: true, atMs: 1200, contentTrust: 'trusted' }),
+      why('RFC 0106 §F INV-2 (voice-transcript-untrusted)', 'contentTrust MUST be the const "untrusted" — never promoted'),
+    ).toBe(false);
+  });
+
+  it('voice.synthesis_chunk is metadata-shaped (seq+mimeType required; bytes by reference, inline base64 optional)', () => {
+    const def = loadSchema('run-event-payloads.schema.json').$defs.voiceSynthesisChunk;
+    const ajv = new Ajv2020({ strict: false, allErrors: true });
+    addFormats(ajv);
+    const validate = ajv.compile(def);
+
+    expect(
+      validate({ seq: 0, mimeType: 'audio/mpeg', durationMs: 240, url: 'https://host/seg/0', final: false }),
+      why('RFC 0106 §C', 'a metadata chunk referencing bytes by url MUST validate'),
+    ).toBe(true);
+    expect(
+      validate({ mimeType: 'audio/mpeg' }),
+      why('RFC 0106 §C', 'a chunk without seq MUST be rejected'),
+    ).toBe(false);
+  });
+
+  it('content-free voice events reject unknown properties (additionalProperties:false)', () => {
+    const payloads = loadSchema('run-event-payloads.schema.json');
+    const ajv = new Ajv2020({ strict: false, allErrors: true });
+    addFormats(ajv);
+    for (const key of ['voiceSpeechStart', 'voiceTurnCommit', 'voiceBargeIn', 'voiceCancelled', 'voiceEndpointCandidate']) {
+      const validate = ajv.compile(payloads.$defs[key]);
+      expect(
+        validate({ atMs: 100, transcriptBody: 'should not be here' }),
+        why('RFC 0106 §D', `${key} MUST reject an unknown (content-bearing) property`),
+      ).toBe(false);
+    }
+  });
+});

package/src/scenarios/voice-interim-not-durable.test.ts

@@ -0,0 +1,59 @@
+/**
+ * Interim transcript is not durable (RFC 0106 §F INV-1) — behavioral.
+ *
+ * Backs the SECURITY invariant `voice-interim-not-durable` (reference-impl tier
+ * until a host proves it non-vacuously — graduates to protocol at the dual-witness
+ * step). Gated on `realtimeVoice.transcription === 'streaming'`. Soft-skips when
+ * unadvertised / when the host honestly rejects a live `streamRef` (§E) / on 404.
+ * Drives `POST /v1/host/sample/ai/call-transcriber`:
+ *
+ *   - a provisional `voice.transcript` (`isFinal: false`) MUST NOT appear AFTER the
+ *     terminal `voice.turn_commit`, and MUST NOT be the authoritative committed text;
+ *   - the committed `finalText` is the settled turn (acting on an interim that the
+ *     ASR later revised is the interim→final poisoning threat §F defends against).
+ *
+ * Spec references:
+ *   - https://github.com/openwop/openwop/blob/main/RFCS/0106-realtime-voice-session-profile.md (§F INV-1)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+
+const SEAM = '/v1/host/sample/ai/call-transcriber';
+
+function realtimeVoiceOf(ai: Record<string, unknown> | undefined): Record<string, unknown> | undefined {
+  const rv = (ai as { realtimeVoice?: unknown })?.realtimeVoice;
+  return rv && typeof rv === 'object' ? (rv as Record<string, unknown>) : undefined;
+}
+function errCode(json: unknown): string | undefined {
+  return (json as { error?: { code?: string } })?.error?.code;
+}
+function eventsOf(json: unknown): Array<{ type?: string; payload?: Record<string, unknown> }> {
+  const e = (json as { events?: unknown })?.events;
+  return Array.isArray(e) ? (e as Array<{ type?: string; payload?: Record<string, unknown> }>) : [];
+}
+
+describe('voice-interim-not-durable (RFC 0106 §F INV-1)', () => {
+  it('no provisional (isFinal:false) transcript is durable past voice.turn_commit', async () => {
+    const ai = await readCapabilityFamily<Record<string, unknown>>('aiProviders');
+    const advertised = realtimeVoiceOf(ai)?.transcription === 'streaming';
+    if (!behaviorGate('openwop-voice-interim-not-durable', advertised)) return;
+
+    const res = await driver.post(SEAM, { audio: { streamRef: 'stream:conformance/mic' }, interimResults: true });
+    if (res.status === 404) return; // seam unwired — soft-skip
+    if (errCode(res.json) === 'transcription_unsupported') return; // §E live transport / no test-seam arm — soft-skip
+
+    const events = eventsOf(res.json);
+    if (events.length === 0) return; // host returned only the result envelope — nothing observable to assert
+
+    const commitIdx = events.findIndex((e) => e.type === 'voice.turn_commit');
+    if (commitIdx < 0) return; // no commit observed — soft-skip
+    const afterCommit = events.slice(commitIdx + 1);
+    expect(
+      !afterCommit.some((e) => e.type === 'voice.transcript' && (e.payload ?? {}).isFinal === false),
+      driver.describe('RFC 0106 §F INV-1', 'a provisional (isFinal:false) transcript MUST NOT appear after voice.turn_commit'),
+    ).toBe(true);
+  });
+});

package/src/scenarios/voice-streamref-tenant-bound.test.ts

@@ -0,0 +1,59 @@
+/**
+ * streamRef is tenant + session bound (RFC 0106 §F INV-4) — behavioral.
+ *
+ * Backs the SECURITY invariant `voice-streamref-tenant-bound` (reference-impl tier
+ * until a host with LIVE `streamRef` transport proves it non-vacuously — graduates
+ * to protocol then). Gated on `realtimeVoice.transcription === 'streaming'`.
+ * Soft-skips when unadvertised / on 404 / when the host's live-stream transport is
+ * host-internal per §E (honest `transcription_unsupported` for a `streamRef`) —
+ * a stateless host without live transport cannot exhibit the cross-handle read, so
+ * there is nothing to bind. Drives `POST /v1/host/sample/ai/call-transcriber`:
+ *
+ *   - a `streamRef` is bound to exactly one tenant + session for its lifetime; no
+ *     buffered audio / interim transcript may be read via another handle, and a
+ *     never-finalizing stream is bounded by a max-uncommitted-audio budget (TDoS).
+ *
+ * Spec references:
+ *   - https://github.com/openwop/openwop/blob/main/RFCS/0106-realtime-voice-session-profile.md (§B.1, §F INV-4)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+
+const SEAM = '/v1/host/sample/ai/call-transcriber';
+
+function realtimeVoiceOf(ai: Record<string, unknown> | undefined): Record<string, unknown> | undefined {
+  const rv = (ai as { realtimeVoice?: unknown })?.realtimeVoice;
+  return rv && typeof rv === 'object' ? (rv as Record<string, unknown>) : undefined;
+}
+function errCode(json: unknown): string | undefined {
+  return (json as { error?: { code?: string } })?.error?.code;
+}
+
+describe('voice-streamref-tenant-bound (RFC 0106 §F INV-4)', () => {
+  it('a live streamRef is tenant+session bound (host-internal transport per §E soft-skips)', async () => {
+    const ai = await readCapabilityFamily<Record<string, unknown>>('aiProviders');
+    const advertised = realtimeVoiceOf(ai)?.transcription === 'streaming';
+    if (!behaviorGate('openwop-voice-streamref-tenant', advertised)) return;
+
+    // Probe whether the host honors a LIVE streamRef at all. If it rejects with
+    // transcription_unsupported (§E: live transport host-internal), there is no live
+    // conduit to bind cross-tenant — soft-skip (the invariant stays reference-impl
+    // until a host with live streamRef transport proves it).
+    const res = await driver.post(SEAM, { audio: { streamRef: 'stream:tenant-a/mic' } });
+    if (res.status === 404) return;
+    if (errCode(res.json) === 'transcription_unsupported') return; // §E — no live transport on this host
+
+    // A host that DOES accept a live streamRef must bind it: a second tenant presenting
+    // tenant-A's streamRef MUST be rejected (cross-handle read forbidden). Exercising the
+    // two-credential path requires a second principal the suite does not synthesize here;
+    // assert the minimum a single-credential probe can: the host did not silently echo
+    // another tenant's buffered audio for an unknown streamRef.
+    expect(
+      res.status !== 200 || (res.json as { finalText?: unknown })?.finalText !== undefined,
+      driver.describe('RFC 0106 §F INV-4', 'a host honoring a live streamRef MUST bind it to its tenant+session'),
+    ).toBe(true);
+  });
+});