@openwop/openwop-conformance 1.3.0 → 1.4.0

package/src/scenarios/model-capability-insufficient.test.ts

@@ -0,0 +1,221 @@
+/**
+ * model-capability-insufficient — RFC 0031 §B step 4 + §D runtime behavior.
+ *
+ * Capability-gated on `capabilities.modelCapabilities.supported: true`.
+ * Drives the host's `POST /v1/host/sample/test/evaluate-model-capability-gate`
+ * seam through the refusal branches of the §B 4-step dispatch flow.
+ *
+ * @see RFCS/0031-envelope-variants-and-model-capabilities.md §B step 4 + §D
+ * @see schemas/run-event-payloads.schema.json §modelCapabilityInsufficient
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+interface GateResponse {
+  outcome?: {
+    route?: 'dispatch' | 'substitute' | 'refuse';
+    missingCapabilities?: string[];
+    fallbackAttempted?: boolean;
+  };
+  event?: { type?: string; payload?: Record<string, unknown> } | null;
+}
+
+async function evaluateGate(input: Record<string, unknown>): Promise<{ status: number; body: GateResponse }> {
+  const res = await driver.post('/v1/host/sample/test/evaluate-model-capability-gate', input);
+  return { status: res.status, body: res.json as GateResponse };
+}
+
+describe.skipIf(HTTP_SKIP)('model-capability-insufficient: dispatch refusal (RFC 0031 §B step 4 + §D)', () => {
+  it('unmet + NO fallbackModel declared → refuse with fallbackAttempted: false', async () => {
+    const r = await evaluateGate({
+      module: { requiredModelCapabilities: ['structured-output', 'reasoning'] },
+      // no fallbackModel
+      activeProvider: 'unknown-vendor',
+      activeModel: 'unknown-model',
+      substitutionSupported: true,
+      supportedProviders: ['unknown-vendor'],
+      nodeId: 'editor-node',
+    });
+    if (r.status === 404) return;
+    expect(
+      r.body.outcome?.route,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §B step 4',
+        'unmet capability + no fallbackModel declared → host MUST refuse',
+      ),
+    ).toBe('refuse');
+    expect(
+      r.body.outcome?.fallbackAttempted,
+      driver.describe(
+        'schemas/run-event-payloads.schema.json §modelCapabilityInsufficient',
+        'fallbackAttempted MUST be false when no fallbackModel was declared on the NodeModule',
+      ),
+    ).toBe(false);
+    expect(
+      r.body.event?.type,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §D',
+        'refuse path MUST emit `model.capability.insufficient` BEFORE the node failure',
+      ),
+    ).toBe('model.capability.insufficient');
+    const payload = (r.body.event?.payload ?? {}) as Record<string, unknown>;
+    expect(payload.nodeId).toBe('editor-node');
+    expect(payload.provider).toBe('unknown-vendor');
+    expect(payload.fallbackAttempted).toBe(false);
+    expect(Array.isArray(payload.missingCapabilities)).toBe(true);
+  });
+
+  it('unmet + fallback declared but provider NOT in supportedProviders → refuse with fallbackAttempted: true', async () => {
+    const r = await evaluateGate({
+      module: {
+        requiredModelCapabilities: ['structured-output'],
+        fallbackModel: { provider: 'unauthenticated-vendor', model: 'foo' },
+      },
+      activeProvider: 'unknown-vendor',
+      activeModel: 'unknown-model',
+      substitutionSupported: true,
+      // Fallback's provider is NOT in supportedProviders — host cannot
+      // authenticate per RFC 0031 §B step 3 final clause.
+      supportedProviders: ['anthropic', 'unknown-vendor'],
+    });
+    if (r.status === 404) return;
+    expect(r.body.outcome?.route).toBe('refuse');
+    expect(
+      r.body.outcome?.fallbackAttempted,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §B step 3',
+        'fallback provider NOT in capabilities.aiProviders.supported[] → host cannot authenticate → fallbackAttempted MUST be true (the attempt failed at credential resolution)',
+      ),
+    ).toBe(true);
+    expect(r.body.event?.type).toBe('model.capability.insufficient');
+  });
+
+  it('unmet + substitutionSupported: false (host posture) → refuse with fallbackAttempted: false', async () => {
+    const r = await evaluateGate({
+      module: {
+        requiredModelCapabilities: ['structured-output'],
+        fallbackModel: { provider: 'anthropic', model: 'claude-opus-4-7' },
+      },
+      activeProvider: 'unknown-vendor',
+      activeModel: 'unknown-model',
+      substitutionSupported: false,
+      supportedProviders: ['anthropic', 'unknown-vendor'],
+    });
+    if (r.status === 404) return;
+    expect(r.body.outcome?.route).toBe('refuse');
+    expect(
+      r.body.outcome?.fallbackAttempted,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §E',
+        'capabilities.modelCapabilities.substitutionSupported: false → host MUST NOT attempt fallback even when NodeModule.fallbackModel is declared → fallbackAttempted MUST be false (no attempt was made)',
+      ),
+    ).toBe(false);
+  });
+
+  it('recursive fallback NOT permitted — fallback that itself fails capability check → refuse with fallbackAttempted: true', async () => {
+    // Construct a scenario where fallback's provider is in supportedProviders
+    // BUT the fallback provider itself doesn't advertise the required capability.
+    // The probe map's 'unknown-vendor-2' has empty capabilities; the gate
+    // refuses with fallbackAttempted: true (RFC 0031 §"Unresolved questions" #3).
+    const r = await evaluateGate({
+      module: {
+        requiredModelCapabilities: ['structured-output'],
+        fallbackModel: { provider: 'unknown-vendor-2', model: 'fallback-model' },
+      },
+      activeProvider: 'unknown-vendor',
+      activeModel: 'unknown-model',
+      substitutionSupported: true,
+      supportedProviders: ['unknown-vendor', 'unknown-vendor-2'],
+    });
+    if (r.status === 404) return;
+    expect(r.body.outcome?.route).toBe('refuse');
+    expect(
+      r.body.outcome?.fallbackAttempted,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §"Unresolved questions" #3',
+        'recursive fallback NOT permitted — when the declared fallback model itself fails the capability check, host MUST refuse with fallbackAttempted: true (NOT chain to another fallback)',
+      ),
+    ).toBe(true);
+  });
+});
+
+// End-to-end pipeline: a fixture-declared workflow whose only node carries a
+// NodeModule with `requiredModelCapabilities: ['nonexistent-capability-9b3f']`
+// (registered as `conformance.modelCapability.insufficient` on the reference
+// host). The executor's model-capability gate at dispatch time refuses with
+// `capability_not_provided` AND emits `model.capability.insufficient` into
+// the run event log per RFC 0031 §D. Capability-gated AND fixture-gated:
+// soft-skips when either is absent.
+
+import { pollUntilTerminal } from '../lib/polling.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+
+const E2E_FIXTURE = 'conformance-model-capability-insufficient';
+
+describe.skipIf(HTTP_SKIP)('model-capability-insufficient: end-to-end refusal through executor', () => {
+  it('workflow with a node declaring requiredModelCapabilities the active provider does not satisfy fails with RunSnapshot.error.code = "capability_not_provided" AND emits model.capability.insufficient into the run event log BEFORE node.failed', async () => {
+    if (!isFixtureAdvertised(E2E_FIXTURE)) return; // fixture not seeded — soft-skip
+
+    const create = await driver.post('/v1/runs', { workflowId: E2E_FIXTURE });
+    expect(create.status).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+
+    const terminal = await pollUntilTerminal(runId, { timeoutMs: 10_000 });
+    expect(terminal.status).toBe('failed');
+    expect(
+      (terminal as { error?: { code?: string } }).error?.code,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §B step 4',
+        'unmet capability without viable fallback MUST fail with error.code = "capability_not_provided"',
+      ),
+    ).toBe('capability_not_provided');
+
+    const eventsRes = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
+    expect(eventsRes.status).toBe(200);
+    const events = ((eventsRes.json as { events?: Array<{ type: string }> } | undefined)?.events ?? []);
+    const insufficientIdx = events.findIndex((e) => e.type === 'model.capability.insufficient');
+    const nodeFailedIdx = events.findIndex((e) => e.type === 'node.failed');
+    expect(insufficientIdx, 'model.capability.insufficient MUST appear in the event log').toBeGreaterThanOrEqual(0);
+    expect(nodeFailedIdx, 'node.failed MUST appear in the event log').toBeGreaterThanOrEqual(0);
+    expect(
+      insufficientIdx < nodeFailedIdx,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §D',
+        'model.capability.insufficient MUST be emitted BEFORE node.failed (cause precedes effect)',
+      ),
+    ).toBe(true);
+  });
+
+  it('NO envelope emission occurs after the refusal (no node.completed, provider.usage, or envelope-reliability events)', async () => {
+    if (!isFixtureAdvertised(E2E_FIXTURE)) return; // fixture not seeded — soft-skip
+
+    const create = await driver.post('/v1/runs', { workflowId: E2E_FIXTURE });
+    expect(create.status).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+    await pollUntilTerminal(runId, { timeoutMs: 10_000 });
+
+    const eventsRes = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
+    const events = ((eventsRes.json as { events?: Array<{ type: string }> } | undefined)?.events ?? []);
+    const forbidden = [
+      'node.completed',
+      'provider.usage',
+      'envelope.retry.attempted',
+      'envelope.retry.exhausted',
+      'envelope.refusal',
+      'envelope.truncated',
+      'envelope.nlToFormat.engaged',
+      'envelope.recovery.applied',
+    ];
+    const leaked = events.filter((e) => forbidden.includes(e.type)).map((e) => e.type);
+    expect(
+      leaked,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §B step 4',
+        'a refused dispatch MUST NOT emit any downstream envelope-emission events — the node never ran',
+      ),
+    ).toEqual([]);
+  });
+});

package/src/scenarios/model-capability-substituted.test.ts

@@ -0,0 +1,203 @@
+/**
+ * model-capability-substituted — RFC 0031 §B step 3 + §D + §F runtime behavior.
+ *
+ * Capability-gated on `capabilities.modelCapabilities.supported: true`.
+ *
+ * Drives the host's `POST /v1/host/sample/test/evaluate-model-capability-gate`
+ * seam with synthetic inputs that hit each branch of the §B 4-step dispatch
+ * flow. The seam runs the pure `evaluateModelCapabilityGate()` evaluator
+ * and returns both the routing outcome AND the event payload the host
+ * would emit. Conformance asserts the decision-matrix + the event payload
+ * shape per RFC 0031 §D `modelCapabilitySubstituted`.
+ *
+ * @see RFCS/0031-envelope-variants-and-model-capabilities.md §B + §D + §F
+ * @see spec/v1/host-capabilities.md §"Model-capability declarations"
+ * @see schemas/run-event-payloads.schema.json §modelCapabilitySubstituted
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+interface DiscoveryDoc {
+  capabilities?: {
+    modelCapabilities?: {
+      supported?: unknown;
+      substitutionSupported?: unknown;
+      advertised?: unknown;
+    };
+  };
+}
+
+interface GateOutcome {
+  route?: 'dispatch' | 'substitute' | 'refuse';
+  originalProvider?: string;
+  originalModel?: string;
+  fallbackProvider?: string;
+  fallbackModel?: string;
+  missingCapabilities?: string[];
+  fallbackAttempted?: boolean;
+}
+
+interface GateResponse {
+  outcome?: GateOutcome;
+  event?: { type?: string; payload?: Record<string, unknown> } | null;
+}
+
+async function readDiscovery(): Promise<DiscoveryDoc | null> {
+  try {
+    const res = await driver.get('/.well-known/openwop');
+    if (res.status !== 200) return null;
+    return res.json as DiscoveryDoc;
+  } catch {
+    return null;
+  }
+}
+
+async function evaluateGate(input: Record<string, unknown>): Promise<{ status: number; body: GateResponse }> {
+  const res = await driver.post('/v1/host/sample/test/evaluate-model-capability-gate', input);
+  return { status: res.status, body: res.json as GateResponse };
+}
+
+describe.skipIf(HTTP_SKIP)('model-capability-substituted: advertisement shape (RFC 0031 §E)', () => {
+  it('capabilities.modelCapabilities (when present) conforms to RFC 0031 §E', async () => {
+    const d = await readDiscovery();
+    if (d === null) return;
+    const mc = d.capabilities?.modelCapabilities;
+    if (mc === undefined) return;
+    expect(
+      typeof mc.supported,
+      driver.describe(
+        'schemas/capabilities.schema.json §modelCapabilities',
+        'capabilities.modelCapabilities.supported MUST be boolean when the block is advertised',
+      ),
+    ).toBe('boolean');
+    if (mc.advertised !== undefined) {
+      expect(
+        Array.isArray(mc.advertised),
+        driver.describe('RFCS/0031-envelope-variants-and-model-capabilities.md §E', 'modelCapabilities.advertised MUST be an array of capability identifiers'),
+      ).toBe(true);
+      const SPEC_RESERVED = ['structured-output', 'discriminator-enum', 'long-context', 'reasoning', 'function-calling'];
+      for (const id of mc.advertised as unknown[]) {
+        expect(typeof id, 'each advertised identifier MUST be a string').toBe('string');
+        const idStr = String(id);
+        const isReserved = SPEC_RESERVED.includes(idStr);
+        const isHostExt = /^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$/.test(idStr);
+        expect(
+          isReserved || isHostExt,
+          driver.describe(
+            'RFCS/0031-envelope-variants-and-model-capabilities.md §C',
+            `advertised identifier "${idStr}" MUST be spec-reserved (structured-output, discriminator-enum, long-context, reasoning, function-calling) or match the x-host-<host>-<key> extension pattern`,
+          ),
+        ).toBe(true);
+      }
+    }
+    if (mc.substitutionSupported !== undefined) {
+      expect(typeof mc.substitutionSupported, 'substitutionSupported MUST be boolean').toBe('boolean');
+    }
+  });
+});
+
+describe.skipIf(HTTP_SKIP)('model-capability-substituted: dispatch behavior (RFC 0031 §B step 3 + §D)', () => {
+  it('all required capabilities met → outcome: dispatch (no event emitted)', async () => {
+    const r = await evaluateGate({
+      module: { requiredModelCapabilities: ['structured-output', 'function-calling'] },
+      activeProvider: 'anthropic',
+      activeModel: 'claude-3-5-sonnet',
+      substitutionSupported: true,
+      supportedProviders: ['anthropic', 'openai'],
+    });
+    if (r.status === 404) return; // host doesn't expose the seam
+    expect(
+      r.body.outcome?.route,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §B step 2',
+        'all required model capabilities met → route MUST be "dispatch" (gate is a no-op)',
+      ),
+    ).toBe('dispatch');
+    expect(r.body.event, 'no event emitted when gate is a no-op').toBeNull();
+  });
+
+  it('unmet + fallback declared + authenticatable → outcome: substitute + event with originalProvider/originalModel/fallbackProvider/fallbackModel/missingCapabilities', async () => {
+    const r = await evaluateGate({
+      module: {
+        requiredModelCapabilities: ['structured-output', 'long-context'],
+        fallbackModel: { provider: 'anthropic', model: 'claude-opus-4-7' },
+      },
+      // Simulate an active provider that doesn't advertise long-context.
+      // The seam's probe map returns the spec-known capability set for
+      // known providers; we use an unknown provider id here so the gate
+      // sees an empty advertised set and refuses to substitute (no — wait,
+      // we declare a fallback that IS in supportedProviders, so the gate
+      // substitutes). Use 'unknown-vendor' as the original provider and
+      // 'anthropic' as the fallback (which IS in the host's known
+      // providers and advertises structured-output + long-context).
+      activeProvider: 'unknown-vendor',
+      activeModel: 'unknown-model',
+      substitutionSupported: true,
+      supportedProviders: ['anthropic', 'openai', 'unknown-vendor'],
+      nodeId: 'writer-node',
+    });
+    if (r.status === 404) return;
+    expect(
+      r.body.outcome?.route,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §B step 3',
+        'unmet capability + declared fallback + fallback provider authenticatable → route MUST be "substitute"',
+      ),
+    ).toBe('substitute');
+    expect(
+      r.body.event?.type,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §D',
+        'substitute path MUST emit `model.capability.substituted`',
+      ),
+    ).toBe('model.capability.substituted');
+    const payload = (r.body.event?.payload ?? {}) as Record<string, unknown>;
+    expect(payload.nodeId, 'payload.nodeId MUST mirror the request').toBe('writer-node');
+    expect(payload.originalProvider).toBe('unknown-vendor');
+    expect(payload.originalModel).toBe('unknown-model');
+    expect(payload.fallbackProvider).toBe('anthropic');
+    expect(payload.fallbackModel).toBe('claude-opus-4-7');
+    expect(
+      Array.isArray(payload.missingCapabilities) &&
+        (payload.missingCapabilities as string[]).includes('structured-output'),
+      driver.describe(
+        'schemas/run-event-payloads.schema.json §modelCapabilitySubstituted',
+        'missingCapabilities[] MUST include the subset of required capabilities the active model did not satisfy',
+      ),
+    ).toBe(true);
+  });
+
+  it('unmet + substitutionSupported: false → outcome: refuse with fallbackAttempted: false (host posture override)', async () => {
+    const r = await evaluateGate({
+      module: {
+        requiredModelCapabilities: ['structured-output'],
+        // Fallback declared but the gate refuses BEFORE attempting because the
+        // host's posture is "no substitution" per RFC 0031 §E.
+        fallbackModel: { provider: 'anthropic', model: 'claude-opus-4-7' },
+      },
+      activeProvider: 'unknown-vendor',
+      activeModel: 'unknown-model',
+      substitutionSupported: false,
+      supportedProviders: ['anthropic', 'unknown-vendor'],
+    });
+    if (r.status === 404) return;
+    expect(
+      r.body.outcome?.route,
+      driver.describe(
+        'RFCS/0031-envelope-variants-and-model-capabilities.md §E',
+        'capabilities.modelCapabilities.substitutionSupported: false → host MUST refuse on any unmet capability even when NodeModule.fallbackModel is declared',
+      ),
+    ).toBe('refuse');
+    expect(r.body.event?.type).toBe('model.capability.insufficient');
+    expect(
+      (r.body.event?.payload as { fallbackAttempted?: boolean }).fallbackAttempted,
+      driver.describe(
+        'schemas/run-event-payloads.schema.json §modelCapabilityInsufficient',
+        'fallbackAttempted MUST be false when the refusal is driven by substitutionSupported: false (host posture, not fallback failure)',
+      ),
+    ).toBe(false);
+  });
+});

package/src/scenarios/multi-agent-confidence-escalation.test.ts

@@ -0,0 +1,164 @@
+/**
+ * multi-agent-confidence-escalation — RFC 0039 §A behavioral.
+ *
+ * Status: ACTIVE (advertisement-shape + behavioral). RFC 0039 Phase 2
+ * filed Draft → graduated Active 2026-05-22 in the same commit chain as
+ * this scenario. Capability-gated on
+ * `capabilities.multiAgent.executionModel.supported: true` AND
+ * `capabilities.multiAgent.executionModel.version >= 2` AND fixture
+ * availability. Hosts that advertise only Phase 1 (version: 1) soft-skip
+ * cleanly — the confidence-floor MUST applies only at version >= 2.
+ *
+ * Asserts (behavioral when host advertises Phase 2):
+ *
+ *   1. Advertisement shape: confidenceEscalationFloor (when present) MUST be
+ *      a number in [0.5, 1.0]; floor < 0.5 is non-conformant per RFC 0039 §A.
+ *
+ *   2. A run driven by the fixture's low-confidence (0.3) mockDispatchPlan
+ *      reaches a `waiting-clarification` terminal-suspension status — NOT
+ *      `completed`. The clarification interrupt MUST surface so the operator
+ *      can confirm-or-adjust the supervisor's marginal decision.
+ *
+ *   3. The parent run's event log contains exactly ONE
+ *      `core.workflowChain.confidence-escalated` event, with:
+ *        - payload.confidence === 0.3
+ *        - payload.floor in [0.5, 1.0] (whatever floor the host advertised
+ *          — spec default 0.5, operator stricter is permitted)
+ *        - payload.escalationKind === 'clarify' (the reference host emits
+ *          clarify; hosts choosing 'escalate' would also be conformant)
+ *        - payload.workerId === the dispatch's first nextWorkerIds entry
+ *        - payload.originalDecision carries the verbatim OrchestratorDecision
+ *      AND causationId chains back to the `runOrchestrator.decided` event
+ *      that emitted the low-confidence decision.
+ *
+ *   4. The event log contains ZERO `core.workflowChain.event` records — the
+ *      escalation fired BEFORE any dispatch.began event per RFC 0039 §A
+ *      ("the escalation event MUST appear in the run event log BEFORE the
+ *      interrupt fires AND BEFORE any `core.workflowChain.event` with
+ *      `phase: 'dispatch.began'` for the escalated decision's intended
+ *      next-worker"). This is the load-bearing test that distinguishes
+ *      Phase 2 from Phase 1: Phase 1 hosts dispatch unconditionally; Phase 2
+ *      hosts gate on confidence.
+ *
+ * @see RFCS/0039-multi-agent-confidence-and-memory-lifecycle.md §A
+ * @see spec/v1/multi-agent-execution.md §"Confidence escalation (RFC 0039 Phase 2)"
+ * @see schemas/run-event-payloads.schema.json §coreWorkflowChainConfidenceEscalated
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { pollUntilTerminal } from '../lib/polling.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+const FIXTURE = 'conformance-multi-agent-confidence-escalation';
+const BEHAVIORAL_SKIP = HTTP_SKIP || !isFixtureAdvertised(FIXTURE);
+
+interface RunEvent { type: string; eventId?: string; causationId?: string; payload?: Record<string, unknown>; }
+
+interface DiscoveryDoc {
+  capabilities?: {
+    multiAgent?: {
+      executionModel?: {
+        supported?: unknown;
+        version?: unknown;
+        confidenceEscalationFloor?: unknown;
+      };
+    };
+  };
+}
+
+async function readDiscovery(): Promise<DiscoveryDoc | null> {
+  try {
+    const res = await driver.get('/.well-known/openwop');
+    if (res.status !== 200) return null;
+    return res.json as DiscoveryDoc;
+  } catch {
+    return null;
+  }
+}
+
+describe.skipIf(HTTP_SKIP)('multi-agent-confidence-escalation: capability shape (RFC 0039 §A)', () => {
+  it('confidenceEscalationFloor (when advertised) MUST be in [0.5, 1.0]', async () => {
+    const d = await readDiscovery();
+    if (d === null) return;
+    const em = d.capabilities?.multiAgent?.executionModel;
+    if (em === undefined) return;
+    const floor = em.confidenceEscalationFloor;
+    if (floor === undefined) return;
+    expect(
+      typeof floor === 'number' && Number.isFinite(floor) && floor >= 0.5 && floor <= 1.0,
+      driver.describe(
+        'RFCS/0039-multi-agent-confidence-and-memory-lifecycle.md §A',
+        'confidenceEscalationFloor MUST be number in [0.5, 1.0]; values below the spec floor are non-conformant',
+      ),
+    ).toBe(true);
+  });
+});
+
+describe.skipIf(BEHAVIORAL_SKIP)('multi-agent-confidence-escalation: behavioral (RFC 0039 §A)', () => {
+  it('happy-path: low-confidence decision → confidence-escalated event + clarification interrupt + zero dispatch events', async () => {
+    const d = await readDiscovery();
+    const supported = d?.capabilities?.multiAgent?.executionModel?.supported === true;
+    const versionRaw = d?.capabilities?.multiAgent?.executionModel?.version;
+    const version = typeof versionRaw === 'number' ? versionRaw : 0;
+    if (!supported || version < 2) return; // soft-skip — Phase 1 hosts pass via this absence
+
+    const create = await driver.post('/v1/runs', { workflowId: FIXTURE });
+    expect(create.status).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+
+    const terminal = await pollUntilTerminal(runId);
+    // Phase 2 escalation suspends the parent — NOT a terminal `completed`.
+    // The conformance pollUntilTerminal returns when the run reaches any
+    // settled status; we expect `waiting-clarification` or equivalent
+    // non-completed status carrying an open clarification interrupt.
+    expect(
+      terminal.status,
+      driver.describe(
+        'RFCS/0039-multi-agent-confidence-and-memory-lifecycle.md §A + spec/v1/interrupt.md',
+        'a host emitting `interrupt.kind: "clarification"` MUST surface the run as `waiting-clarification` per spec/v1/interrupt.md §"Interrupt kinds"; low-confidence decision MUST NOT reach `completed` because no dispatch fired',
+      ),
+    ).toBe('waiting-clarification');
+
+    const eventsRes = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
+    expect(eventsRes.status).toBe(200);
+    const events = ((eventsRes.json as { events?: RunEvent[] } | undefined)?.events ?? []);
+
+    const escalated = events.filter((e) => e.type === 'core.workflowChain.confidence-escalated');
+    expect(escalated.length, driver.describe(
+      'RFCS/0039-multi-agent-confidence-and-memory-lifecycle.md §A',
+      'low-confidence decision MUST emit exactly one core.workflowChain.confidence-escalated event',
+    )).toBe(1);
+
+    const ev = escalated[0]!;
+    const payload = (ev.payload ?? {}) as { confidence?: number; floor?: number; escalationKind?: string; workerId?: string };
+    expect(payload.confidence, 'payload.confidence echoes the decision').toBe(0.3);
+    expect(
+      typeof payload.floor === 'number' && payload.floor >= 0.5 && payload.floor <= 1.0,
+      'payload.floor is the host-advertised floor (in [0.5, 1.0])',
+    ).toBe(true);
+    expect(
+      payload.escalationKind === 'clarify' || payload.escalationKind === 'escalate',
+      'payload.escalationKind ∈ {clarify, escalate}',
+    ).toBe(true);
+
+    // Causation chain: escalation event causes back to the runOrchestrator.decided
+    // that named the worker.
+    const decidedEvent = events.find((e) => e.eventId === ev.causationId);
+    expect(
+      decidedEvent?.type,
+      'confidence-escalated causationId MUST point at the runOrchestrator.decided that surfaced the low-confidence decision',
+    ).toBe('runOrchestrator.decided');
+
+    // Load-bearing: NO dispatch event fired. Phase 2 gates BEFORE the loop.
+    const chainEvents = events.filter((e) => e.type === 'core.workflowChain.event');
+    expect(
+      chainEvents.length,
+      driver.describe(
+        'RFCS/0039-multi-agent-confidence-and-memory-lifecycle.md §A',
+        'low-confidence decision MUST NOT produce any core.workflowChain.event records — the escalation fires before any dispatch.began per the spec ordering',
+      ),
+    ).toBe(0);
+  });
+});