@openwop/openwop-conformance 1.3.0 → 1.4.0

package/src/scenarios/prompt-end-to-end-events.test.ts

@@ -0,0 +1,202 @@
+/**
+ * prompt-end-to-end-events — RFC 0027 + RFC 0029 end-to-end emission.
+ *
+ * Asserts: when a workflow node carries `config.systemPromptRef` and
+ * the host advertises `capabilities.prompts.supported: true`,
+ * dispatching the run MUST cause the host to emit (in this order)
+ * one `agent.promptResolved` event (per RFC 0029 §A — the resolution
+ * chain trace with `applied: true` on the winning layer) followed by
+ * one `prompt.composed` event (per RFC 0027 §E — the composed body
+ * + sha256 hash + per-variable hashes), and the run MUST reach
+ * terminal `completed` carrying the composed body's mock-AI
+ * completion.
+ *
+ * This is the integration regression pin: prior conformance scenarios
+ * exercised composition + resolution via the host-extension test
+ * seams (`/v1/host/sample/prompt/{compose,resolve}`); this scenario
+ * exercises the SAME pipeline through real workflow-engine dispatch.
+ * If the executor stops wiring the prompt-library helpers into node
+ * execution, this scenario fails first.
+ *
+ * Capability-gated: skips when the host doesn't advertise
+ * `capabilities.prompts.supported: true`. Under
+ * `OPENWOP_REQUIRE_BEHAVIOR=true`, the gate hardens from SKIP to
+ * FAIL via `behaviorGate('prompts-supported', ...)`.
+ *
+ * @see spec/v1/prompts.md §"Composition + observability"
+ * @see spec/v1/prompts.md §"Resolution chain (normative)"
+ * @see RFCS/0027-prompt-templates.md §E
+ * @see RFCS/0029-prompt-override-hierarchy.md §A
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { pollUntilTerminal } from '../lib/polling.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+
+const WORKFLOW_ID = 'conformance-prompt-end-to-end';
+const SKIP_NO_FIXTURE = !isFixtureAdvertised(WORKFLOW_ID);
+
+interface DiscoveryDoc {
+  capabilities?: {
+    prompts?: { supported?: unknown };
+  };
+}
+
+interface RunEventDoc {
+  eventId: string;
+  runId: string;
+  type: string;
+  payload: unknown;
+  sequence: number;
+}
+
+interface PollEventsResponse {
+  events: RunEventDoc[];
+  isComplete?: boolean;
+}
+
+async function readDiscovery(): Promise<DiscoveryDoc | null> {
+  const res = await driver.get('/.well-known/openwop');
+  if (res.status !== 200) return null;
+  return res.json as DiscoveryDoc;
+}
+
+function promptsSupported(d: DiscoveryDoc | null): boolean {
+  return d?.capabilities?.prompts?.supported === true;
+}
+
+/** Drain the run's event log via polling. The fixture is tiny so all
+ *  events fit in one page; conformance hosts may paginate via the
+ *  optional `nextSequence` but our local sample doesn't. */
+async function readAllEvents(runId: string): Promise<RunEventDoc[]> {
+  const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events/poll?lastSequence=0`);
+  if (res.status !== 200) return [];
+  const body = res.json as PollEventsResponse;
+  return body.events ?? [];
+}
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+describe.skipIf(SKIP_NO_FIXTURE || HTTP_SKIP)('prompt-end-to-end-events: real dispatch emits agent.promptResolved + prompt.composed (RFC 0027/0029)', () => {
+  it('emits agent.promptResolved with chain[].applied: true for layer "node" when systemPromptRef is set on node.config', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-supported', promptsSupported(d))) return;
+
+    const create = await driver.post('/v1/runs', { workflowId: WORKFLOW_ID });
+    expect(
+      create.status,
+      driver.describe(
+        'spec/v1/rest-endpoints.md',
+        'POST /v1/runs MUST return 201 on accepted creation',
+      ),
+    ).toBe(201);
+    const { runId } = create.json as { runId: string };
+
+    const terminal = await pollUntilTerminal(runId);
+    expect(
+      terminal.status,
+      driver.describe(
+        'fixtures.md conformance-prompt-end-to-end §Terminal status',
+        'fixture MUST reach terminal `completed`',
+      ),
+    ).toBe('completed');
+
+    const events = await readAllEvents(runId);
+    const resolved = events.find((e) => e.type === 'agent.promptResolved');
+    expect(
+      resolved,
+      driver.describe(
+        'spec/v1/prompts.md §"Resolution chain (normative)"',
+        'host MUST emit `agent.promptResolved` when a node carries a `*PromptRef` and prompts.supported is advertised',
+      ),
+    ).toBeDefined();
+
+    const payload = resolved!.payload as {
+      nodeId?: string;
+      kind?: string;
+      chain?: Array<{ layer?: string; applied?: boolean; source?: string }>;
+      resolved?: string | null;
+    };
+    expect(payload.nodeId, 'agent.promptResolved.nodeId MUST be set').toBe('writer');
+    expect(payload.kind, 'agent.promptResolved.kind MUST match the resolved kind').toBe('system');
+    const applied = (payload.chain ?? []).find((c) => c.applied === true);
+    expect(
+      applied?.layer,
+      driver.describe(
+        'spec/v1/prompts.md §"Resolution chain (normative)" — Layer 1',
+        'node-config ref MUST win when no higher-precedence run-configurable layer is configured',
+      ),
+    ).toBe('node');
+    expect(payload.resolved).toBe('prompt:conformance.prompt.writer-system@1.0.0');
+  });
+
+  it('emits prompt.composed with sha256:<hex64> hash + non-empty composed body for system-kind template', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-supported', promptsSupported(d))) return;
+
+    const create = await driver.post('/v1/runs', { workflowId: WORKFLOW_ID });
+    if (create.status !== 201) return;
+    const { runId } = create.json as { runId: string };
+    await pollUntilTerminal(runId);
+    const events = await readAllEvents(runId);
+
+    const composed = events.find((e) => e.type === 'prompt.composed');
+    expect(
+      composed,
+      driver.describe(
+        'spec/v1/prompts.md §"Composition + observability"',
+        'host MUST emit `prompt.composed` after `agent.promptResolved` when a ref resolves and observability !== off',
+      ),
+    ).toBeDefined();
+
+    const payload = composed!.payload as {
+      nodeId?: string;
+      kind?: string;
+      hash?: string;
+      composed?: string;
+      systemPrompt?: string;
+      contentTrust?: string;
+    };
+    expect(
+      payload.hash && /^sha256:[0-9a-f]{64}$/.test(payload.hash),
+      driver.describe(
+        'schemas/run-event-payloads.schema.json §promptComposed.hash',
+        'hash MUST match `^sha256:[0-9a-f]{64}$`',
+      ),
+    ).toBe(true);
+    expect(payload.kind, 'system-only kind composition').toBe('system-only');
+    expect(
+      typeof payload.composed === 'string' && payload.composed.length > 0,
+      driver.describe(
+        'spec/v1/prompts.md §"Composition + observability"',
+        'composed body MUST be non-empty for system-kind under observability: full',
+      ),
+    ).toBe(true);
+    // systemPrompt should mirror composed for system-kind templates.
+    expect(payload.systemPrompt).toBe(payload.composed);
+  });
+
+  it('emits agent.promptResolved before prompt.composed (causal ordering)', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-supported', promptsSupported(d))) return;
+    const create = await driver.post('/v1/runs', { workflowId: WORKFLOW_ID });
+    if (create.status !== 201) return;
+    const { runId } = create.json as { runId: string };
+    await pollUntilTerminal(runId);
+    const events = await readAllEvents(runId);
+
+    const resolvedIdx = events.findIndex((e) => e.type === 'agent.promptResolved');
+    const composedIdx = events.findIndex((e) => e.type === 'prompt.composed');
+    expect(resolvedIdx, 'agent.promptResolved MUST appear in the event log').toBeGreaterThanOrEqual(0);
+    expect(composedIdx, 'prompt.composed MUST appear in the event log').toBeGreaterThanOrEqual(0);
+    expect(
+      resolvedIdx,
+      driver.describe(
+        'spec/v1/prompts.md §"Resolution chain (normative)"',
+        'agent.promptResolved MUST emit BEFORE the corresponding prompt.composed (resolution precedes composition)',
+      ),
+    ).toBeLessThan(composedIdx);
+  });
+});

package/src/scenarios/prompt-list-and-fetch.test.ts

@@ -0,0 +1,207 @@
+/**
+ * prompt-list-and-fetch — RFC 0028 §A `listPromptTemplates` +
+ * `getPromptTemplate` shape contract.
+ *
+ * Asserts:
+ *   1. `GET /v1/prompts` returns `{ items: PromptTemplate[],
+ *      nextCursor?: string }`.
+ *   2. Each item validates against `prompt-template.schema.json`.
+ *   3. Filters (`?kind`, `?source`) narrow the result set without
+ *      breaking the envelope.
+ *   4. `GET /v1/prompts/{templateId}` returns a single template,
+ *      sets an `ETag` header, and honors `If-None-Match` with 304.
+ *   5. Unknown templateId returns 404 with the canonical
+ *      ErrorEnvelope shape.
+ *
+ * Capability-gated: skips when the host doesn't advertise
+ * `capabilities.prompts.endpointsSupported: true`.
+ *
+ * Under `OPENWOP_REQUIRE_BEHAVIOR=true`, the capability gate hardens
+ * from SKIP to FAIL when the host advertises `endpointsSupported`
+ * but doesn't serve the routes.
+ *
+ * HTTP-driven: skips when no `OPENWOP_BASE_URL` is configured.
+ *
+ * @see spec/v1/prompts.md §"Discovery & distribution"
+ * @see RFCS/0028-prompt-library-endpoints.md §A
+ */
+
+import { describe, it, expect } from 'vitest';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { driver } from '../lib/driver.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+
+interface DiscoveryDoc {
+  capabilities?: {
+    prompts?: {
+      supported?: unknown;
+      endpointsSupported?: unknown;
+    };
+  };
+}
+
+interface PromptTemplate {
+  templateId: string;
+  version: string;
+  kind: 'system' | 'user' | 'few-shot' | 'schema-hint';
+  text: string;
+  name?: string;
+  meta?: { source?: 'host' | 'pack' | 'user' };
+}
+
+interface ListResponse {
+  items: PromptTemplate[];
+  nextCursor?: string;
+}
+
+async function readDiscovery(): Promise<DiscoveryDoc | null> {
+  const res = await driver.get('/.well-known/openwop');
+  if (res.status !== 200) return null;
+  return res.json as DiscoveryDoc;
+}
+
+function endpointsSupported(d: DiscoveryDoc | null): boolean {
+  return d?.capabilities?.prompts?.endpointsSupported === true;
+}
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+describe.skipIf(HTTP_SKIP)('prompt-list-and-fetch: REST surface shape (RFC 0028 §A)', () => {
+  // Pre-load schemas so cross-ref validation works against responses.
+  const ajv = new Ajv2020({ allErrors: true, strict: false });
+  addFormats(ajv);
+  const promptKindSchema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'prompt-kind.schema.json'), 'utf8'));
+  ajv.addSchema(promptKindSchema, 'prompt-kind.schema.json');
+  ajv.addSchema(promptKindSchema, './prompt-kind.schema.json');
+  const promptTemplateSchema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'prompt-template.schema.json'), 'utf8'));
+  const validate = ajv.compile(promptTemplateSchema);
+
+  it('GET /v1/prompts returns { items: PromptTemplate[], nextCursor? } when endpointsSupported is true', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-endpoints', endpointsSupported(d))) return;
+
+    const res = await driver.get('/v1/prompts');
+    expect(res.status, driver.describe('spec/v1/prompts.md §Discovery & distribution', 'GET /v1/prompts MUST return 200 when endpointsSupported: true')).toBe(200);
+    const body = res.json as ListResponse;
+    expect(
+      Array.isArray(body.items),
+      driver.describe('spec/v1/prompts.md §Discovery & distribution', 'response MUST contain an `items` array'),
+    ).toBe(true);
+    for (const item of body.items) {
+      const ok = validate(item);
+      expect(
+        ok,
+        driver.describe(
+          'spec/v1/prompts.md §PromptTemplate',
+          `every list item MUST validate against prompt-template.schema.json; errors: ${JSON.stringify(validate.errors)}`,
+        ),
+      ).toBe(true);
+    }
+  });
+
+  it('GET /v1/prompts?source=host narrows to host-built-in templates', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-endpoints', endpointsSupported(d))) return;
+    const res = await driver.get('/v1/prompts?source=host');
+    expect(res.status).toBe(200);
+    const body = res.json as ListResponse;
+    for (const item of body.items) {
+      expect(
+        item.meta?.source,
+        driver.describe(
+          'spec/v1/prompts.md §Discovery & distribution',
+          'source filter MUST narrow to templates whose meta.source matches',
+        ),
+      ).toBe('host');
+    }
+  });
+
+  it('GET /v1/prompts?kind=system narrows to system-kind templates', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-endpoints', endpointsSupported(d))) return;
+    const res = await driver.get('/v1/prompts?kind=system');
+    expect(res.status).toBe(200);
+    const body = res.json as ListResponse;
+    for (const item of body.items) {
+      expect(item.kind).toBe('system');
+    }
+  });
+
+  it('GET /v1/prompts/{templateId} returns the template + ETag header for a known fixture', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-endpoints', endpointsSupported(d))) return;
+
+    // List first to discover a known templateId we can fetch.
+    const list = await driver.get('/v1/prompts?source=host&limit=1');
+    if (list.status !== 200) return;
+    const body = list.json as ListResponse;
+    if (body.items.length === 0) return; // host advertises endpoints but ships no fixtures — tolerable
+    const known = body.items[0]!;
+
+    const fetched = await driver.get(`/v1/prompts/${encodeURIComponent(known.templateId)}`);
+    expect(fetched.status).toBe(200);
+    const tpl = fetched.json as PromptTemplate;
+    expect(tpl.templateId).toBe(known.templateId);
+
+    // Headers.get() is case-insensitive per the Fetch spec, so one call
+     // covers both "etag" and "ETag" wire spellings.
+    const etag = fetched.headers?.get('etag');
+    expect(
+      typeof etag === 'string' && etag.length > 0,
+      driver.describe(
+        'spec/v1/prompts.md §Discovery & distribution',
+        'GET /v1/prompts/{templateId} SHOULD set an ETag header (RFC 0028 §A cache semantics)',
+      ),
+    ).toBe(true);
+  });
+
+  it('GET /v1/prompts/{templateId} with If-None-Match returns 304 when ETag matches', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-endpoints', endpointsSupported(d))) return;
+    const list = await driver.get('/v1/prompts?source=host&limit=1');
+    if (list.status !== 200) return;
+    const body = list.json as ListResponse;
+    if (body.items.length === 0) return;
+    const known = body.items[0]!;
+
+    const first = await driver.get(`/v1/prompts/${encodeURIComponent(known.templateId)}`);
+    if (first.status !== 200) return;
+    const etag = first.headers?.get('etag') ?? undefined;
+    if (!etag) return; // ETag is SHOULD, not MUST — soft-skip when absent
+
+    const second = await driver.get(`/v1/prompts/${encodeURIComponent(known.templateId)}`, {
+      headers: { 'If-None-Match': etag },
+    });
+    expect(
+      second.status,
+      driver.describe(
+        'spec/v1/prompts.md §Discovery & distribution',
+        'conditional revalidation MUST return 304 when ETag matches',
+      ),
+    ).toBe(304);
+  });
+
+  it('GET /v1/prompts/unknown-template returns 404 with ErrorEnvelope', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-endpoints', endpointsSupported(d))) return;
+    const res = await driver.get('/v1/prompts/conformance-unknown-template-deadbeef');
+    expect(res.status).toBe(404);
+    // Canonical ErrorEnvelope per `schemas/error-envelope.schema.json`:
+    // FLAT `{ error: <code-string>, message: <human> }`. NOT the nested
+    // `{ error: { code, message } }` shape — the schema's
+    // `additionalProperties: false` rules that out.
+    const body = res.json as { error?: unknown; message?: unknown };
+    expect(
+      typeof body.error,
+      driver.describe(
+        'schemas/error-envelope.schema.json',
+        '404 response MUST carry canonical ErrorEnvelope: `error` is a machine-readable code STRING (flat shape per the schema, not nested)',
+      ),
+    ).toBe('string');
+    expect(typeof body.message).toBe('string');
+  });
+});

package/src/scenarios/prompt-mutable-lifecycle.test.ts

@@ -0,0 +1,216 @@
+/**
+ * prompt-mutable-lifecycle — RFC 0028 §A `create` / `update` /
+ * `delete` round-trip for user-source templates.
+ *
+ * Asserts the full mutating lifecycle:
+ *   1. POST /v1/prompts creates a user-source template; returns 201
+ *      with a Location header.
+ *   2. GET /v1/prompts/{templateId} returns the newly-created
+ *      template with `meta.source: "user"`.
+ *   3. POST /v1/prompts with the same (templateId, version) returns
+ *      409 (duplicate).
+ *   4. PUT /v1/prompts/{templateId} with a strictly-greater SemVer
+ *      replaces the template; the stored version reflects the bump.
+ *   5. PUT /v1/prompts/{templateId} with a non-monotonic SemVer
+ *      returns 409.
+ *   6. DELETE /v1/prompts/{templateId} returns 204; subsequent GET
+ *      returns 404.
+ *   7. DELETE on a host-built-in (meta.source: "host") template
+ *      returns 403.
+ *
+ * Capability-gated: skips when the host doesn't advertise BOTH
+ * `capabilities.prompts.endpointsSupported: true` AND
+ * `capabilities.prompts.mutableLibrary: true`.
+ *
+ * HTTP-driven: skips when no `OPENWOP_BASE_URL` is configured.
+ *
+ * Under `OPENWOP_REQUIRE_BEHAVIOR=true`, the capability gate hardens
+ * from SKIP to FAIL when the host advertises mutableLibrary but
+ * fails to round-trip the lifecycle.
+ *
+ * @see spec/v1/prompts.md §"Discovery & distribution"
+ * @see RFCS/0028-prompt-library-endpoints.md §A
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+
+interface DiscoveryDoc {
+  capabilities?: {
+    prompts?: {
+      endpointsSupported?: unknown;
+      mutableLibrary?: unknown;
+    };
+  };
+}
+
+interface PromptTemplate {
+  templateId: string;
+  version: string;
+  kind: 'system' | 'user' | 'few-shot' | 'schema-hint';
+  text: string;
+  meta?: { source?: 'host' | 'pack' | 'user' };
+}
+
+async function readDiscovery(): Promise<DiscoveryDoc | null> {
+  const res = await driver.get('/.well-known/openwop');
+  if (res.status !== 200) return null;
+  return res.json as DiscoveryDoc;
+}
+
+function mutableSupport(d: DiscoveryDoc | null): boolean {
+  const p = d?.capabilities?.prompts;
+  return p?.endpointsSupported === true && p?.mutableLibrary === true;
+}
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+// Stable per-suite-run templateId so retries don't accumulate state.
+const TEMPLATE_ID = `conformance.user.lifecycle-${Math.random().toString(36).slice(2, 10)}`;
+
+describe.skipIf(HTTP_SKIP)('prompt-mutable-lifecycle: user-source create/update/delete round-trip (RFC 0028 §A)', () => {
+  it('POST /v1/prompts creates a user-source template (201 + Location)', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-mutable', mutableSupport(d))) return;
+    const body: PromptTemplate = {
+      templateId: TEMPLATE_ID,
+      version: '1.0.0',
+      kind: 'system',
+      text: 'You are a conformance probe. {{tone}}',
+    };
+    const res = await driver.post('/v1/prompts', body);
+    expect(
+      res.status,
+      driver.describe(
+        'spec/v1/prompts.md §Discovery & distribution',
+        'POST /v1/prompts MUST return 201 on successful user-source create',
+      ),
+    ).toBe(201);
+    const location = res.headers?.get?.('location');
+    expect(
+      typeof location === 'string' && location.includes(TEMPLATE_ID),
+      driver.describe(
+        'spec/v1/prompts.md §Discovery & distribution',
+        '201 response MUST set a Location header referencing the new templateId',
+      ),
+    ).toBe(true);
+  });
+
+  it('GET /v1/prompts/{templateId} returns the new template with meta.source: "user"', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-mutable', mutableSupport(d))) return;
+    const res = await driver.get(`/v1/prompts/${encodeURIComponent(TEMPLATE_ID)}`);
+    expect(res.status).toBe(200);
+    const tpl = res.json as PromptTemplate;
+    expect(tpl.templateId).toBe(TEMPLATE_ID);
+    expect(
+      tpl.meta?.source,
+      driver.describe(
+        'spec/v1/prompts.md §PromptTemplate',
+        'host MUST stamp meta.source: "user" on POST-created templates',
+      ),
+    ).toBe('user');
+  });
+
+  it('POST /v1/prompts with same (templateId, version) returns 409', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-mutable', mutableSupport(d))) return;
+    const body: PromptTemplate = {
+      templateId: TEMPLATE_ID,
+      version: '1.0.0',
+      kind: 'system',
+      text: 'duplicate',
+    };
+    const res = await driver.post('/v1/prompts', body);
+    expect(
+      res.status,
+      driver.describe(
+        'spec/v1/prompts.md §Discovery & distribution',
+        'POST /v1/prompts MUST return 409 on (templateId, version) duplicate',
+      ),
+    ).toBe(409);
+  });
+
+  it('PUT /v1/prompts/{templateId} with strictly-greater SemVer replaces the template', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-mutable', mutableSupport(d))) return;
+    const body: PromptTemplate = {
+      templateId: TEMPLATE_ID,
+      version: '1.1.0',
+      kind: 'system',
+      text: 'You are a conformance probe v1.1. {{tone}}',
+    };
+    const res = await driver.put(`/v1/prompts/${encodeURIComponent(TEMPLATE_ID)}`, body);
+    expect(
+      res.status,
+      driver.describe(
+        'spec/v1/prompts.md §Discovery & distribution',
+        'PUT /v1/prompts/{templateId} MUST return 200 on monotonic-SemVer update',
+      ),
+    ).toBe(200);
+    // Latest fetch reflects the bumped version.
+    const fetched = await driver.get(`/v1/prompts/${encodeURIComponent(TEMPLATE_ID)}`);
+    expect((fetched.json as PromptTemplate).version).toBe('1.1.0');
+  });
+
+  it('PUT /v1/prompts/{templateId} with non-monotonic SemVer returns 409', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-mutable', mutableSupport(d))) return;
+    const body: PromptTemplate = {
+      templateId: TEMPLATE_ID,
+      version: '0.9.0',
+      kind: 'system',
+      text: 'cannot replay',
+    };
+    const res = await driver.put(`/v1/prompts/${encodeURIComponent(TEMPLATE_ID)}`, body);
+    expect(
+      res.status,
+      driver.describe(
+        'spec/v1/prompts.md §Discovery & distribution',
+        'PUT MUST return 409 when submitted version does not exceed stored',
+      ),
+    ).toBe(409);
+  });
+
+  it('DELETE /v1/prompts/{templateId} returns 204 and subsequent GET returns 404', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-mutable', mutableSupport(d))) return;
+    const del = await driver.delete(`/v1/prompts/${encodeURIComponent(TEMPLATE_ID)}`);
+    expect(
+      del.status,
+      driver.describe(
+        'spec/v1/prompts.md §Discovery & distribution',
+        'DELETE /v1/prompts/{templateId} MUST return 204 on successful delete',
+      ),
+    ).toBe(204);
+    const after = await driver.get(`/v1/prompts/${encodeURIComponent(TEMPLATE_ID)}`);
+    expect(
+      after.status,
+      driver.describe(
+        'spec/v1/prompts.md §Discovery & distribution',
+        'GET after DELETE MUST return 404',
+      ),
+    ).toBe(404);
+  });
+
+  it('DELETE on a host-built-in template returns 403', async () => {
+    const d = await readDiscovery();
+    if (!behaviorGate('prompts-mutable', mutableSupport(d))) return;
+    // Find a host-built-in to probe; the conformance-fixture set
+    // is the standard source for this test.
+    const list = await driver.get('/v1/prompts?source=host&limit=1');
+    if (list.status !== 200) return;
+    const body = list.json as { items: PromptTemplate[] };
+    if (body.items.length === 0) return;
+    const hostTemplate = body.items[0]!;
+    const res = await driver.delete(`/v1/prompts/${encodeURIComponent(hostTemplate.templateId)}`);
+    expect(
+      res.status,
+      driver.describe(
+        'spec/v1/prompts.md §Discovery & distribution',
+        'DELETE on a host-built-in template MUST return 403 (read-only)',
+      ),
+    ).toBe(403);
+  });
+});