@openwop/openwop-conformance 1.3.0 → 1.5.0

package/src/scenarios/multi-agent-handoff-state-machine.test.ts

@@ -0,0 +1,167 @@
+/**
+ * multi-agent-handoff-state-machine — RFC 0037 Phase 1 advertisement-shape + behavioral.
+ *
+ * Status: ACTIVE (advertisement-shape + behavioral). RFC 0037 filed
+ * 2026-05-21 as Draft; this scenario lands the matching conformance gate.
+ * Capability-gated on `capabilities.multiAgent.executionModel.supported: true`
+ * AND fixture-gated on the `conformance-multi-agent-handoff` parent + child
+ * fixtures (when those land; current scenario is shape + soft-skip until then).
+ *
+ * Asserts (Phase 1 — execution-loop + handoff state machine per spec/v1/multi-agent-execution.md):
+ *
+ *   1. Advertisement shape: when capabilities.multiAgent.executionModel.supported
+ *      is present, version MUST be integer in [1, 4]; supported MUST be boolean.
+ *
+ *   2. Behavioral (gated on supported: true + fixture availability): a
+ *      supervisor → next-worker → child-completed run emits the 4 expected
+ *      `core.workflowChain.event` records in causation order:
+ *        - dispatch.began (causationId → runOrchestrator.decided eventId)
+ *        - dispatch.succeeded (causationId → dispatch.began eventId)
+ *        - child.completed (causationId → dispatch.succeeded eventId)
+ *        - output.harvested (causationId → child.completed eventId; harvestedKeys present
+ *          when the dispatch config carried outputMapping)
+ *
+ *   3. Behavioral negative: failed-child path emits dispatch.began → dispatch.succeeded
+ *      → child.failed (NO output.harvested — per spec/v1/multi-agent-execution.md
+ *      §"Handoff state machine" + RFC 0022 §B).
+ *
+ * @see RFCS/0037-multi-agent-execution-model.md
+ * @see spec/v1/multi-agent-execution.md §"Execution loop" + §"Handoff state machine"
+ * @see schemas/run-event-payloads.schema.json §coreWorkflowChainEvent
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { pollUntilTerminal } from '../lib/polling.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+interface DiscoveryDoc {
+  capabilities?: {
+    multiAgent?: {
+      executionModel?: {
+        supported?: unknown;
+        version?: unknown;
+      };
+    };
+  };
+}
+
+async function readDiscovery(): Promise<DiscoveryDoc | null> {
+  try {
+    const res = await driver.get('/.well-known/openwop');
+    if (res.status !== 200) return null;
+    return res.json as DiscoveryDoc;
+  } catch {
+    return null;
+  }
+}
+
+describe.skipIf(HTTP_SKIP)('multi-agent-handoff-state-machine: advertisement shape (RFC 0037 §C)', () => {
+  it('capabilities.multiAgent.executionModel (when present) conforms to RFC 0037 §C', async () => {
+    const d = await readDiscovery();
+    if (d === null) return; // discovery unavailable — skip
+    const executionModel = d.capabilities?.multiAgent?.executionModel;
+    if (executionModel === undefined) return; // host doesn't advertise — soft-skip
+    expect(
+      typeof executionModel.supported,
+      driver.describe(
+        'RFCS/0037-multi-agent-execution-model.md §C',
+        'capabilities.multiAgent.executionModel.supported MUST be boolean when present',
+      ),
+    ).toBe('boolean');
+    expect(
+      typeof executionModel.version,
+      driver.describe(
+        'RFCS/0037-multi-agent-execution-model.md §C',
+        'capabilities.multiAgent.executionModel.version MUST be integer when present',
+      ),
+    ).toBe('number');
+    const v = executionModel.version as number;
+    expect(
+      Number.isInteger(v) && v >= 1 && v <= 4,
+      driver.describe(
+        'RFCS/0037-multi-agent-execution-model.md §C',
+        'version MUST be an integer in [1, 4] (1 = Phase 1 only; Phases 2-4 lift the ceiling additively)',
+      ),
+    ).toBe(true);
+  });
+});
+
+// Behavioral assertion: when a host advertises capabilities.multiAgent.executionModel.supported,
+// it MUST emit the 7-state handoff state machine's transition events as `core.workflowChain.event`
+// records with causationId chained per the spec §"Transition events" table. The happy-path
+// fixture (supervisor → next-worker → child completed with outputMapping non-empty) drives 4
+// of the 7 transitions: dispatch.began → dispatch.succeeded → child.completed → output.harvested.
+
+interface RunEvent { type: string; eventId?: string; causationId?: string; payload?: Record<string, unknown>; }
+
+const PARENT_FIXTURE = 'conformance-multi-agent-handoff';
+const CHILD_FIXTURE = 'conformance-multi-agent-handoff-child';
+const BEHAVIORAL_SKIP = HTTP_SKIP || !isFixtureAdvertised(PARENT_FIXTURE) || !isFixtureAdvertised(CHILD_FIXTURE);
+
+describe.skipIf(BEHAVIORAL_SKIP)('multi-agent-handoff-state-machine: behavioral 4-event causation chain (RFC 0037 §"Handoff state machine")', () => {
+  it('happy-path: dispatch.began → dispatch.succeeded → child.completed → output.harvested fire in causation order', async () => {
+    const d = await readDiscovery();
+    const advertised = d?.capabilities?.multiAgent?.executionModel?.supported === true;
+    if (!advertised) return; // soft-skip — host honest about not implementing
+
+    const create = await driver.post('/v1/runs', { workflowId: PARENT_FIXTURE });
+    expect(create.status).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+
+    const terminal = await pollUntilTerminal(runId);
+    expect(terminal.status, driver.describe(
+      'spec/v1/multi-agent-execution.md §"Execution loop"',
+      'parent run with supervisor → next-worker → terminate MUST reach terminal `completed`',
+    )).toBe('completed');
+
+    const eventsRes = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
+    expect(eventsRes.status).toBe(200);
+    const events = ((eventsRes.json as { events?: RunEvent[] } | undefined)?.events ?? []);
+    const chainEvents = events.filter((e) => e.type === 'core.workflowChain.event');
+
+    expect(chainEvents.length, driver.describe(
+      'RFCS/0037-multi-agent-execution-model.md §"Conformance"',
+      'happy-path fixture MUST produce 4 core.workflowChain.event records (dispatch.began, dispatch.succeeded, child.completed, output.harvested)',
+    )).toBe(4);
+
+    const phases = chainEvents.map((e) => (e.payload as { phase?: string } | undefined)?.phase);
+    expect(phases, driver.describe(
+      'spec/v1/multi-agent-execution.md §"Transition events"',
+      'phase order MUST be dispatch.began → dispatch.succeeded → child.completed → output.harvested',
+    )).toEqual(['dispatch.began', 'dispatch.succeeded', 'child.completed', 'output.harvested']);
+
+    // Causation chain: each transition's causationId MUST equal the prior transition's eventId.
+    // dispatch.began causes back to a runOrchestrator.decided; the inner 3 chain through each other.
+    for (let i = 1; i < chainEvents.length; i++) {
+      const prior = chainEvents[i - 1];
+      const cur = chainEvents[i];
+      expect(cur?.causationId, driver.describe(
+        'spec/v1/multi-agent-execution.md §"Transition events"',
+        `core.workflowChain.event #${i} (${phases[i]}) MUST have causationId === prior event's eventId`,
+      )).toBe(prior?.eventId);
+    }
+
+    // dispatch.began causationId MUST chain back to a runOrchestrator.decided event.
+    const dispatchBegan = chainEvents[0];
+    expect(dispatchBegan?.causationId).toBeDefined();
+    const decidedEvent = events.find((e) => e.eventId === dispatchBegan?.causationId);
+    expect(decidedEvent?.type, driver.describe(
+      'spec/v1/multi-agent-execution.md §"Transition events"',
+      'dispatch.began causationId MUST point at the runOrchestrator.decided event that named this worker',
+    )).toBe('runOrchestrator.decided');
+
+    // output.harvested.harvestedKeys MUST list the outputMapping keys harvested.
+    const harvested = chainEvents[3]?.payload as { harvestedKeys?: string[] } | undefined;
+    expect(harvested?.harvestedKeys, driver.describe(
+      'spec/v1/multi-agent-execution.md §"Transition events"',
+      'output.harvested payload MUST list harvested parent-variable keys (the fixture\'s outputMapping is { parentResult: \'childOutcome\' })',
+    )).toEqual(['parentResult']);
+  });
+});
+
+// Cross-host promotion path per RFCs/0001 §"Promotion to Accepted": once a non-steward host
+// advertises capabilities.multiAgent.executionModel.supported + the behavioral assertion above
+// passes against it, RFC 0037 Phase 1 graduates Active → Accepted.

package/src/scenarios/multi-agent-memory-lifecycle.test.ts

@@ -0,0 +1,124 @@
+/**
+ * multi-agent-memory-lifecycle — RFC 0039 §B advertisement-shape + behavioral stubs.
+ *
+ * Status: ACTIVE (advertisement-shape; behavioral stubs deferred to a
+ * host that advertises both `capabilities.memory.supported: true` AND
+ * `capabilities.multiAgent.executionModel.version >= 2`). Phase 1 hosts
+ * + Phase 2 hosts without memory + Phase 2 hosts with memory but no
+ * MAE-3 snapshot implementation all soft-skip cleanly.
+ *
+ * Closes the conformance gate for RFC 0039 §B (MAE-2 cross-run TTL +
+ * MAE-3 replay snapshot). Behavioral assertions require a host that
+ * actually advertises the MemoryAdapter surface; the reference
+ * workflow-engine sample advertises `capabilities.memory.supported:
+ * false` so this scenario soft-skips there. The Postgres reference
+ * host advertises memory.supported: true; once it adopts RFC 0039
+ * Phase 2 the behavioral assertions below light up.
+ *
+ * Asserts (advertisement-shape — always-on when discovery is reachable):
+ *
+ *   1. capabilities.multiAgent.executionModel.crossChildMemoryConcurrency
+ *      (when advertised) MUST be one of {"strict", "advisory"} per
+ *      RFC 0039 §B + schemas/capabilities.schema.json.
+ *
+ *   2. When a host advertises BOTH multiAgent.executionModel.version >= 2
+ *      AND memory.supported: true, the host MUST honor the MAE-2 +
+ *      MAE-3 contracts (behavioral assertions below).
+ *
+ * Behavioral assertions (capability-gated; soft-skip when no host
+ * advertises the conjunction):
+ *
+ *   3. MAE-2 cross-run TTL: a child writing MemoryEntry { ttl: 5 } at
+ *      parent-clock T+10s has `expiresAt` reflecting T+15s (child
+ *      write time + 5s), NOT parent-start + 5s. Implementation requires
+ *      a host-side test seam to drive the cross-run write + read; once
+ *      a memory-advertising host wires the seam the assertion runs.
+ *
+ *   4. MAE-3 replay snapshot refusal: a host that advertises Phase 2 +
+ *      memory MUST either (a) serve the fork from a past event-log
+ *      index returning memory state as-of that index, OR (b) refuse
+ *      with error.code: "replay_memory_snapshot_unavailable" per
+ *      spec/v1/rest-endpoints.md §"Common error codes". Silent
+ *      substitution of current memory is non-conformant.
+ *
+ * @see RFCS/0039-multi-agent-confidence-and-memory-lifecycle.md §B
+ * @see spec/v1/multi-agent-execution.md §"Agent memory lifecycle across sub-runs"
+ * @see spec/v1/agent-memory.md §"TTL semantics" (which the child-write-time MAE-2 anchoring extends to the cross-run case)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+interface DiscoveryDoc {
+  capabilities?: {
+    memory?: { supported?: unknown };
+    multiAgent?: {
+      executionModel?: {
+        supported?: unknown;
+        version?: unknown;
+        crossChildMemoryConcurrency?: unknown;
+      };
+    };
+  };
+}
+
+async function readDiscovery(): Promise<DiscoveryDoc | null> {
+  try {
+    const res = await driver.get('/.well-known/openwop');
+    if (res.status !== 200) return null;
+    return res.json as DiscoveryDoc;
+  } catch {
+    return null;
+  }
+}
+
+describe.skipIf(HTTP_SKIP)('multi-agent-memory-lifecycle: advertisement shape (RFC 0039 §B)', () => {
+  it('crossChildMemoryConcurrency (when advertised) MUST be one of {strict, advisory}', async (ctx) => {
+    const d = await readDiscovery();
+    if (d === null) {
+      ctx.skip();
+      return;
+    }
+    const ccmc = d.capabilities?.multiAgent?.executionModel?.crossChildMemoryConcurrency;
+    if (ccmc === undefined) {
+      ctx.skip(); // optional advertisement — host hasn't opted in
+      return;
+    }
+    expect(
+      ccmc === 'strict' || ccmc === 'advisory',
+      driver.describe(
+        'RFCS/0039-multi-agent-confidence-and-memory-lifecycle.md §B',
+        'crossChildMemoryConcurrency MUST be one of {strict, advisory} when present; values outside the closed enum are non-conformant',
+      ),
+    ).toBe(true);
+  });
+});
+
+describe.skipIf(HTTP_SKIP)('multi-agent-memory-lifecycle: behavioral (RFC 0039 §B MAE-2 + MAE-3)', () => {
+  // Behavioral assertion lands when a memory-advertising Phase 2 host
+  // exposes a host-side test seam for cross-run memory writes (e.g.,
+  // POST /v1/host/sample/test/memory/cross-run-ttl-roundtrip). The
+  // assertion drives:
+  //   1. Parent starts at parent-clock T+0
+  //   2. Child dispatched at T+10s, writes MemoryEntry { key: 'k', value: 'v', ttl: 5 }
+  //   3. Parent reads MemoryEntry { key: 'k' } at T+12s; expiresAt MUST be
+  //      approximately T+15s (child write at T+10 + ttl 5), not T+5s.
+  // Until a memory-advertising Phase 2 host wires the seam, the contract
+  // is documentation-only — surfaced as `todo` so test reporters track
+  // the gap rather than reporting a vacuous PASS.
+  it.todo('MAE-2 cross-run TTL: child write expiresAt MUST be anchored at child write time, not parent start');
+
+  // Behavioral assertion lands when the host implements the snapshot
+  // mechanism per RFC 0039 §B. The assertion drives:
+  //   1. Run a workflow that writes MemoryEntry { key: 'k', value: 'v1' } at index 10.
+  //   2. Write MemoryEntry { key: 'k', value: 'v2' } at index 20.
+  //   3. POST /v1/runs/{runId}:fork { fromSeq: 15 }.
+  //   4. Forked run reads MemoryEntry { key: 'k' }; MUST return 'v1' (not 'v2').
+  //   5. Alternative compliance: fork refused with
+  //      error.code: 'replay_memory_snapshot_unavailable' AND
+  //      details.fromSeq === 15.
+  // Silent substitution of v2 (current state) is non-conformant.
+  it.todo('MAE-3 replay snapshot: fork from past index MUST return memory-as-of-index OR refuse with replay_memory_snapshot_unavailable');
+});

package/src/scenarios/multi-region-idempotency.test.ts

@@ -85,3 +85,61 @@ describe('multi-region-idempotency: capability shape', () => {
     }
   });
 });
+
+// RFC 0036 — granular `multiRegion` sub-block advertisement shape. Hosts that
+// opt into the granular advertisement (separate from the categorical `crossRegion`
+// claim) MUST conform to the shape below: supported is boolean (required); when
+// supported is true, replicationLagBoundMs is integer [0, 60000] and
+// partitionRecoveryStrategy is either the categorical enum or an x-host-<host>-<key>
+// extension namespace string. Hosts that don't advertise multiRegion stay on the
+// categorical crossRegion claim (above); both forms are compatible.
+
+interface MultiRegionCaps {
+  supported?: unknown;
+  replicationLagBoundMs?: unknown;
+  partitionRecoveryStrategy?: unknown;
+}
+
+describe('multi-region-idempotency: granular multiRegion advertisement shape (RFC 0036 §A)', () => {
+  it('capabilities.idempotency.multiRegion (when present) conforms to RFC 0036 §A', async () => {
+    const disco = await driver.get('/.well-known/openwop');
+    const idem =
+      (disco.json as { capabilities?: { idempotency?: IdempotencyCaps & { multiRegion?: MultiRegionCaps } } })
+        .capabilities?.idempotency;
+    const mr = idem?.multiRegion;
+    if (mr === undefined) return; // host doesn't advertise the granular block — soft-skip
+
+    expect(
+      typeof mr.supported,
+      driver.describe(
+        'RFCS/0036-multi-region-and-cross-engine-guarantees.md §A',
+        'capabilities.idempotency.multiRegion.supported MUST be boolean when present',
+      ),
+    ).toBe('boolean');
+
+    if (mr.supported === true) {
+      if (mr.replicationLagBoundMs !== undefined) {
+        const n = mr.replicationLagBoundMs as number;
+        expect(
+          Number.isInteger(n) && n >= 0 && n <= 60000,
+          driver.describe(
+            'RFCS/0036-multi-region-and-cross-engine-guarantees.md §A',
+            'replicationLagBoundMs MUST be integer in [0, 60000] when supported is true',
+          ),
+        ).toBe(true);
+      }
+      if (mr.partitionRecoveryStrategy !== undefined) {
+        const s = mr.partitionRecoveryStrategy as string;
+        const isCategorical = s === 'last-writer-wins' || s === 'first-writer-wins';
+        const isExtension = /^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$/.test(s);
+        expect(
+          isCategorical || isExtension,
+          driver.describe(
+            'RFCS/0036-multi-region-and-cross-engine-guarantees.md §A',
+            'partitionRecoveryStrategy MUST be one of {last-writer-wins, first-writer-wins} OR match ^x-host-<host>-<key>$',
+          ),
+        ).toBe(true);
+      }
+    }
+  });
+});

package/src/scenarios/node-module-required-capabilities-shape.test.ts

@@ -0,0 +1,185 @@
+/**
+ * node-module-required-capabilities-shape — RFC 0031 §B authoring conformance.
+ *
+ * Capability-gated on `capabilities.modelCapabilities.supported: true`.
+ *
+ * SHOULD-tier scenario — verifies that every NodeModule in the host's pack
+ * registry whose `typeId` is in the `core.ai.*` namespace declares
+ * `requiredModelCapabilities`. Treated as a soft-fail; failures are
+ * surfaced as findings rather than blocking the suite.
+ *
+ * Reads the host's node catalog (via `GET /v1/host/sample/node-catalog`
+ * — vendor-prefixed per `spec/v1/host-extensions.md`). Hosts that don't
+ * expose the catalog endpoint soft-skip cleanly; the conformance check
+ * cannot enumerate NodeModules without a catalog surface.
+ *
+ * @see RFCS/0031-envelope-variants-and-model-capabilities.md §B + §C
+ * @see spec/v1/node-packs.md §"Model-capability declarations on NodeModules"
+ * @see schemas/node-pack-manifest.schema.json §NodeModule
+ */
+
+import { describe, it, expect, beforeAll } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+/** RFC 0031 §C — spec-reserved capability identifiers. */
+const RESERVED_IDENTIFIERS: ReadonlySet<string> = new Set([
+  'structured-output',
+  'discriminator-enum',
+  'long-context',
+  'reasoning',
+  'function-calling',
+]);
+
+/** Host-private extension prefix per `host-extensions.md §"Canonical-
+ *  prefix table"` + RFC 0031 §C "Reservation policy". */
+const HOST_EXTENSION_RE = /^x-host-[a-z0-9][a-z0-9-]*-[a-z0-9][a-z0-9-]*$/;
+
+interface CatalogNode {
+  typeId: string;
+  source?: 'local' | 'pack';
+  requiredModelCapabilities?: unknown;
+  fallbackModel?: unknown;
+}
+
+interface DiscoveryDoc {
+  capabilities?: {
+    modelCapabilities?: { supported?: unknown };
+    aiProviders?: { supported?: unknown };
+  };
+}
+
+let SKIP_REASON: string | null = null;
+let CATALOG: CatalogNode[] = [];
+let SUPPORTED_PROVIDERS: ReadonlySet<string> = new Set();
+
+beforeAll(async () => {
+  const disco = await driver.get('/.well-known/openwop');
+  if (disco.status !== 200) {
+    SKIP_REASON = 'discovery doc unreachable';
+    return;
+  }
+  const caps = (disco.json as DiscoveryDoc).capabilities ?? {};
+  if (caps.modelCapabilities?.supported !== true) {
+    SKIP_REASON = 'host does not advertise capabilities.modelCapabilities.supported: true';
+    return;
+  }
+  if (Array.isArray(caps.aiProviders?.supported)) {
+    SUPPORTED_PROVIDERS = new Set(caps.aiProviders.supported as string[]);
+  }
+  const cat = await driver.get('/v1/host/sample/node-catalog');
+  if (cat.status === 404) {
+    SKIP_REASON = 'host does not expose /v1/host/sample/node-catalog';
+    return;
+  }
+  if (cat.status !== 200) {
+    SKIP_REASON = `node-catalog returned ${cat.status}`;
+    return;
+  }
+  CATALOG = (cat.json as { nodes?: CatalogNode[] }).nodes ?? [];
+});
+
+describe('node-module-required-capabilities-shape: authoring convention (RFC 0031 §B)', () => {
+  it('every NodeModule with typeId matching `core.ai.*` declares non-empty `requiredModelCapabilities` (SHOULD-tier)', () => {
+    if (SKIP_REASON) {
+      // eslint-disable-next-line no-console
+      console.warn(`[node-module-required-capabilities-shape] skip: ${SKIP_REASON}`);
+      return;
+    }
+    const aiNodes = CATALOG.filter((n) => /^core\.ai\./.test(n.typeId));
+    const missing: string[] = [];
+    for (const n of aiNodes) {
+      const rmc = n.requiredModelCapabilities;
+      if (!Array.isArray(rmc) || rmc.length === 0) missing.push(n.typeId);
+    }
+    // SHOULD-tier: surface as a finding (warning), don't fail the suite.
+    if (missing.length > 0) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `[node-module-required-capabilities-shape] RFC 0031 §B SHOULD: ${missing.length} core.ai.* NodeModule(s) omit requiredModelCapabilities: ${missing.join(', ')}`,
+      );
+    }
+    // The describe-itself assertion: catalog reached + AT LEAST one
+    // node was inspected (otherwise the test is vacuous). MUST hold.
+    expect(
+      aiNodes.length,
+      driver.describe(
+        'RFC 0031 §B',
+        'host MUST advertise at least one core.ai.* NodeModule in the node catalog (otherwise the SHOULD has no surface to bind to)',
+      ),
+    ).toBeGreaterThan(0);
+  });
+
+  it('every declared identifier MUST match the spec-reserved set OR the `x-host-<host>-<key>` extension pattern', () => {
+    if (SKIP_REASON) return;
+    const violations: Array<{ typeId: string; identifier: string }> = [];
+    for (const n of CATALOG) {
+      if (!Array.isArray(n.requiredModelCapabilities)) continue;
+      for (const id of n.requiredModelCapabilities) {
+        if (typeof id !== 'string') {
+          violations.push({ typeId: n.typeId, identifier: String(id) });
+          continue;
+        }
+        if (RESERVED_IDENTIFIERS.has(id)) continue;
+        if (HOST_EXTENSION_RE.test(id)) continue;
+        violations.push({ typeId: n.typeId, identifier: id });
+      }
+    }
+    expect(
+      violations,
+      driver.describe(
+        'RFC 0031 §C "Reservation policy"',
+        'every requiredModelCapabilities identifier MUST be spec-reserved OR match x-host-<host>-<key>',
+      ),
+    ).toEqual([]);
+  });
+
+  it('NodeModule.fallbackModel.provider (when declared) MUST be in `capabilities.aiProviders.supported[]`', () => {
+    if (SKIP_REASON) return;
+    const violations: Array<{ typeId: string; provider: string }> = [];
+    for (const n of CATALOG) {
+      const fm = n.fallbackModel;
+      if (!fm || typeof fm !== 'object') continue;
+      const provider = (fm as { provider?: unknown }).provider;
+      if (typeof provider !== 'string') continue;
+      if (SUPPORTED_PROVIDERS.size > 0 && !SUPPORTED_PROVIDERS.has(provider)) {
+        violations.push({ typeId: n.typeId, provider });
+      }
+    }
+    expect(
+      violations,
+      driver.describe(
+        'RFC 0031 §B',
+        'every fallbackModel.provider MUST appear in capabilities.aiProviders.supported[]',
+      ),
+    ).toEqual([]);
+  });
+
+  it('a NodeModule declaring `requiredModelCapabilities` without `fallbackModel` is conformant — refusal-only (no substitution) is the default posture', () => {
+    if (SKIP_REASON) return;
+    // The check is structural: catalog entries are not malformed when
+    // they carry requiredModelCapabilities AND lack fallbackModel. This
+    // asserts the host doesn't synthesize a default fallbackModel for
+    // nodes that didn't declare one — refusal-only is RFC 0031's
+    // default posture per §B.
+    const refusalOnly = CATALOG.filter(
+      (n) => Array.isArray(n.requiredModelCapabilities)
+        && n.requiredModelCapabilities.length > 0
+        && (n.fallbackModel === undefined || n.fallbackModel === null),
+    );
+    // Pass condition: the host SHOULD have at least one such node OR
+    // SHOULD have none — both are valid postures. The MUST-tier check
+    // is that when refusalOnly is non-empty, each entry's
+    // `fallbackModel` is genuinely absent (not coerced to `{}` or
+    // similar by an over-zealous projection). Trivially true given
+    // the filter; the assertion documents the spec contract.
+    for (const n of refusalOnly) {
+      expect(
+        n.fallbackModel,
+        driver.describe(
+          'RFC 0031 §B',
+          `${n.typeId}: refusal-only posture MUST surface as absent fallbackModel (not as {} or null wrapper)`,
+        ),
+      ).toBeUndefined();
+    }
+  });
+});