@openwop/openwop-conformance 1.3.0 → 1.5.0

package/src/scenarios/queue-publish-consume-roundtrip.test.ts

@@ -1,12 +1,12 @@
 /**
- * queue-publish-consume-roundtrip — RFC 0017 advertisement-shape verification + behavioral placeholders.
+ * queue-publish-consume-roundtrip — RFC 0017 advertisement-shape verification + behavioral roundtrip.
  *
- * Status: ACTIVE (advertisement-shape). RFC 0017 promoted to `Active`
- * 2026-05-17. The matching `capabilities.queueBus` block has landed in
- * `schemas/capabilities.schema.json`. This scenario asserts the advertisement
- * shape against any host that boots the conformance suite, and keeps the
- * deeper behavioral assertions as `it.todo()` until a reference host wires
- * a test seam.
+ * Status: ACTIVE (advertisement-shape + behavioral). RFC 0017 promoted to
+ * `Active` 2026-05-17. The matching `capabilities.queueBus` block has
+ * landed in `schemas/capabilities.schema.json`. This scenario asserts the
+ * advertisement shape against any host that boots the conformance suite, and
+ * exercises the behavioral surface through the `/v1/host/sample/test/surface`
+ * seam (soft-skip with HTTP 404 on hosts that don't expose it).
  *
  * Summary: publish + consume + ack roundtrip.
  *

package/src/scenarios/replay-divergence-at-refusal.test.ts

@@ -0,0 +1,134 @@
+/**
+ * replay-divergence-at-refusal — RFC 0041 §B behavioral assertion.
+ *
+ * Status: ACTIVE (capability-gated behavioral; soft-skips when no Phase 4
+ * host advertises the contract). Gated on
+ * `capabilities.multiAgent.executionModel.version >= 4` AND
+ * `capabilities.multiAgent.executionModel.replayDeterminism.refusalDivergenceEmission: true`.
+ *
+ * Asserts (behavioral, when a Phase 4 host advertises both gates):
+ *
+ *   1. When the original run obtained a valid LLM envelope but the replay
+ *      gets a refusal, the host MUST emit a `replay.divergedAtRefusal`
+ *      event AND fail the replay with `error.code:
+ *      "replay_diverged_at_refusal"`. Silent substitution is non-conformant.
+ *
+ *   2. The emitted `replay.divergedAtRefusal` payload MUST carry
+ *      `originalEnvelopeKind: "valid"` + `replayEnvelopeKind: "refusal"`
+ *      (or the inverse for the original-refused case). The two MUST
+ *      differ — otherwise there is no divergence to report.
+ *
+ *   3. The error envelope MAY carry `details.atSequence`, `details.nodeId`,
+ *      `details.originalEnvelopeKind`, `details.replayEnvelopeKind` per
+ *      `spec/v1/rest-endpoints.md` §"Common error codes" — when present,
+ *      the values MUST be consistent with the emitted event.
+ *
+ * Driving the assertion requires a host-side test seam that can stage a
+ * mock provider returning a valid envelope on the original run and a
+ * refusal on the replay (or vice-versa). Reference workflow-engine ships
+ * a mock-AI provider (`OPENWOP_MULTI_AGENT_EXECUTION_MODEL=true`); the
+ * Phase 4 wiring extends it to honor a "refusal on replay" mode. Until
+ * that wiring lands, the assertion is surfaced as `it.todo` so test
+ * reporters track the gap rather than reporting a vacuous PASS.
+ *
+ * @see RFCS/0041-multi-agent-replay-under-nondeterminism.md §B
+ * @see spec/v1/replay.md §"Envelope-refusal recovery in replay (MAE-8 closure)"
+ * @see spec/v1/multi-agent-execution.md §"Phase 4 replay determinism"
+ * @see spec/v1/rest-endpoints.md §"Common error codes" — replay_diverged_at_refusal
+ * @see schemas/run-event-payloads.schema.json §replayDivergedAtRefusal
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+interface DiscoveryDoc {
+  capabilities?: {
+    multiAgent?: {
+      executionModel?: {
+        supported?: unknown;
+        version?: unknown;
+        replayDeterminism?: {
+          supported?: unknown;
+          refusalDivergenceEmission?: unknown;
+        };
+      };
+    };
+  };
+}
+
+async function readDiscovery(): Promise<DiscoveryDoc | null> {
+  try {
+    const res = await driver.get('/.well-known/openwop');
+    if (res.status !== 200) return null;
+    return res.json as DiscoveryDoc;
+  } catch { return null; }
+}
+
+describe.skipIf(HTTP_SKIP)('replay-divergence-at-refusal: advertisement shape (RFC 0041 §D)', () => {
+  it('replayDeterminism (when present) conforms to RFC 0041 §D', async (ctx) => {
+    const d = await readDiscovery();
+    if (d === null) {
+      ctx.skip();
+      return;
+    }
+    const rd = d.capabilities?.multiAgent?.executionModel?.replayDeterminism;
+    if (rd === undefined) {
+      ctx.skip(); // optional advertisement — host hasn't opted in
+      return;
+    }
+
+    expect(
+      typeof rd.supported,
+      driver.describe(
+        'RFCS/0041-multi-agent-replay-under-nondeterminism.md §D',
+        'replayDeterminism.supported MUST be boolean when present',
+      ),
+    ).toBe('boolean');
+
+    if (rd.supported === true) {
+      const version = d.capabilities?.multiAgent?.executionModel?.version as number | undefined;
+      expect(
+        typeof version === 'number' && version >= 4,
+        driver.describe(
+          'RFCS/0041-multi-agent-replay-under-nondeterminism.md §D',
+          'when replayDeterminism.supported: true, multiAgent.executionModel.version MUST be >= 4',
+        ),
+      ).toBe(true);
+
+      // Phase 4 hosts MUST commit to refusal-divergence emission per the
+      // schema description on capabilities.schema.json §replayDeterminism
+      // .refusalDivergenceEmission. The MUST is normative prose on the
+      // schema; JSON Schema can't express the conditional, so this
+      // assertion closes the conformance-enforcement gap.
+      expect(
+        rd.refusalDivergenceEmission,
+        driver.describe(
+          'schemas/capabilities.schema.json §replayDeterminism.refusalDivergenceEmission',
+          'hosts advertising version: 4 MUST set replayDeterminism.refusalDivergenceEmission to true',
+        ),
+      ).toBe(true);
+    }
+  });
+});
+
+describe.skipIf(HTTP_SKIP)('replay-divergence-at-refusal: behavioral (RFC 0041 §B MAE-8)', () => {
+  // Behavioral assertion drives a workflow whose mock-AI provider returns a
+  // valid envelope on the original run + a refusal on the replay (or
+  // vice-versa via a second variant). The assertion sequence:
+  //   1. Stage mock provider: original returns valid envelope.
+  //   2. Run workflow `conformance-phase4-replay-divergence` end-to-end.
+  //   3. Re-stage mock provider: replay-of-this-runId returns refusal.
+  //   4. POST /v1/runs/{runId}:fork { mode: 'replay' }.
+  //   5. Assert the resulting run terminates with
+  //        error.code === 'replay_diverged_at_refusal'.
+  //   6. Assert event log contains a `replay.divergedAtRefusal` event with
+  //        originalEnvelopeKind === 'valid' AND replayEnvelopeKind === 'refusal'.
+  //   7. Assert NO silent substitution: the replay's continuation past the
+  //      diverging node MUST NOT execute (run terminates at the divergence).
+  // Until the reference host wires the staged-refusal seam, surfaced as
+  // `todo` so test reporters track the gap.
+  it.todo('Phase 4 host MUST emit replay.divergedAtRefusal + fail with replay_diverged_at_refusal when original=valid + replay=refusal');
+  it.todo('Phase 4 host MUST emit replay.divergedAtRefusal + fail with replay_diverged_at_refusal when original=refusal + replay=valid (symmetric case)');
+});

package/src/scenarios/replay-llm-cache-key-portable.test.ts

@@ -0,0 +1,197 @@
+/**
+ * replay-llm-cache-key-portable — RFC 0041 §E SECURITY-invariant probe.
+ *
+ * Status: ACTIVE (capability-gated behavioral). Gated on
+ * `capabilities.multiAgent.executionModel.version >= 4` AND
+ * `capabilities.multiAgent.executionModel.replayDeterminism.llmCacheKeyRecipe: "spec-rfc-0041"`.
+ *
+ * The CROSS-host parity assertion in `replay-llm-cache-key.test.ts §D`
+ * (gated on `OPENWOP_BASE_URL_B`) is the cross-instance probe. This file
+ * is the SECURITY-tier complement: it asserts that the SINGLE-host
+ * recipe is portable in the strict sense — given the recipe input, the
+ * host's emitted key is reproducible offline from the recipe alone
+ * (no host-internal secrets, sequence numbers, or trace context
+ * influence the key).
+ *
+ * Asserts:
+ *
+ *   1. Two probes with byte-identical recipe input MUST yield the same
+ *      cache key (intra-host determinism; subsumes the SECURITY
+ *      portability requirement at the single-host boundary).
+ *
+ *   2. The emitted key is reproducible offline: locally recomputed
+ *      SHA-256-over-RFC-8785-JCS over the canonical recipe MUST equal
+ *      the host's emission. This is the load-bearing claim — without
+ *      it, the recipe is private host state masquerading as a content-
+ *      addressable hash.
+ *
+ *   3. (Negative) Permuting any non-recipe field (`max_tokens`, `stop`,
+ *      `stream`, `seed`, `metadata`, `user`, request IDs, trace context)
+ *      MUST NOT shift the key. This is the security boundary: hosts
+ *      that mix non-recipe state into the key leak that state across
+ *      the cache boundary, defeating the portability claim and (via
+ *      the SR-1 sibling invariant) potentially leaking BYOK plaintexts
+ *      through the cache.
+ *
+ *   4. (Gated on Phase 4 advertisement.) The host's discovery doc MUST
+ *      advertise `replayDeterminism.llmCacheKeyRecipe` matching the
+ *      recipe it honors — `spec-rfc-0041` for the canonical recipe,
+ *      `x-host-<host>-<recipe-name>` for vendor variants per
+ *      `host-extensions.md` §"Canonical prefixes".
+ *
+ * The behavioral assertions reuse the existing test seam at
+ * `POST /v1/host/sample/test/llm-cache-key` (the same seam the sibling
+ * `replay-llm-cache-key.test.ts` drives). Hosts that don't expose the
+ * seam return 404 and the scenario soft-skips.
+ *
+ * @see RFCS/0041-multi-agent-replay-under-nondeterminism.md §E
+ * @see SECURITY/invariants.yaml §replay-llm-cache-key-portable
+ * @see spec/v1/replay.md §"LLM cache-key recipe" §A + §B + §D
+ * @see conformance/src/scenarios/replay-llm-cache-key.test.ts (the sibling behavioral suite)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { expectedCacheKey, callCacheKeySeam as callSeam } from '../lib/llm-cache-key-recipe.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+interface DiscoveryDoc {
+  capabilities?: {
+    multiAgent?: {
+      executionModel?: {
+        version?: unknown;
+        replayDeterminism?: {
+          supported?: unknown;
+          llmCacheKeyRecipe?: unknown;
+        };
+      };
+    };
+  };
+}
+
+async function readDiscovery(): Promise<DiscoveryDoc | null> {
+  try {
+    const res = await driver.get('/.well-known/openwop');
+    if (res.status !== 200) return null;
+    return res.json as DiscoveryDoc;
+  } catch { return null; }
+}
+
+describe.skipIf(HTTP_SKIP)('replay-llm-cache-key-portable: intra-host reproducibility (RFC 0041 §E)', () => {
+  it('host cache key MUST equal locally-recomputed SHA-256 over canonical JSON (reproducible offline)', async (ctx) => {
+    const input = {
+      provider: 'anthropic',
+      model: 'claude-3-5-sonnet-20240620',
+      messages: [
+        { role: 'system' as const, content: 'portability probe' },
+        { role: 'user' as const, content: 'reproduce offline' },
+      ],
+      temperature: 0.3,
+    };
+    const result = await callSeam(input);
+    if (result.status === 404) {
+      ctx.skip(); // host doesn't expose the test seam
+      return;
+    }
+    expect(result.status).toBe(200);
+    expect(
+      result.cacheKey,
+      driver.describe(
+        'SECURITY/invariants.yaml §replay-llm-cache-key-portable + replay.md §B',
+        'host cache key MUST be reproducible offline from the recipe alone — no host-internal state',
+      ),
+    ).toBe(expectedCacheKey(input));
+  });
+
+  it('two identical probes MUST yield byte-identical keys (intra-host determinism)', async (ctx) => {
+    const input = {
+      provider: 'openai',
+      model: 'gpt-4',
+      messages: [{ role: 'user' as const, content: 'idempotence probe' }],
+      temperature: 0.0,
+    };
+    const a = await callSeam(input);
+    if (a.status === 404) {
+      ctx.skip(); // host doesn't expose the test seam
+      return;
+    }
+    const b = await callSeam(input);
+    expect(
+      a.cacheKey,
+      driver.describe(
+        'SECURITY/invariants.yaml §replay-llm-cache-key-portable',
+        'two byte-identical recipe inputs MUST yield byte-identical keys (no per-request entropy)',
+      ),
+    ).toBe(b.cacheKey);
+  });
+});
+
+describe.skipIf(HTTP_SKIP)('replay-llm-cache-key-portable: non-recipe-field invariance (RFC 0041 §E security boundary)', () => {
+  it('non-recipe fields (request ID, trace context, tenant ID) MUST NOT influence the cache key', async (ctx) => {
+    const base = {
+      provider: 'openai',
+      model: 'gpt-4',
+      messages: [{ role: 'user' as const, content: 'security-boundary probe' }],
+      temperature: 0.5,
+    };
+    const baseResult = await callSeam(base);
+    if (baseResult.status === 404) {
+      ctx.skip(); // host doesn't expose the test seam
+      return;
+    }
+
+    // The security boundary: ANY of these fields leaking into the key
+    // would expose tenant/request state through cache-collision behavior.
+    const polluted = {
+      ...base,
+      max_tokens: 1000,
+      stop: ['STOP'],
+      stream: true,
+      seed: 42,
+      metadata: { tenantId: 'tenant-A', traceparent: '00-deadbeef-cafe-01' },
+      user: 'user-42',
+      'x-request-id': 'req-abc-123',
+    };
+    const pollutedResult = await callSeam(polluted);
+    expect(
+      pollutedResult.cacheKey,
+      driver.describe(
+        'SECURITY/invariants.yaml §replay-llm-cache-key-portable + replay.md §A',
+        'non-recipe fields (request id, trace context, tenant id) MUST NOT influence the cache key — leaking them defeats the portability invariant',
+      ),
+    ).toBe(baseResult.cacheKey);
+  });
+});
+
+describe.skipIf(HTTP_SKIP)('replay-llm-cache-key-portable: Phase 4 advertisement alignment (RFC 0041 §D)', () => {
+  it('hosts advertising version: 4 MUST advertise replayDeterminism.llmCacheKeyRecipe', async (ctx) => {
+    const d = await readDiscovery();
+    const em = d?.capabilities?.multiAgent?.executionModel;
+    const version = em?.version;
+    if (typeof version !== 'number' || version < 4) {
+      ctx.skip(); // pre-Phase-4 or no multiAgent advertisement
+      return;
+    }
+
+    const recipe = em?.replayDeterminism?.llmCacheKeyRecipe;
+    expect(
+      typeof recipe === 'string',
+      driver.describe(
+        'RFCS/0041-multi-agent-replay-under-nondeterminism.md §D',
+        'Phase 4 host MUST advertise replayDeterminism.llmCacheKeyRecipe (`spec-rfc-0041` or `x-host-<host>-<recipe>`)',
+      ),
+    ).toBe(true);
+
+    const r = recipe as string;
+    const canonical = r === 'spec-rfc-0041';
+    const vendor = /^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$/.test(r);
+    expect(
+      canonical || vendor,
+      driver.describe(
+        'schemas/capabilities.schema.json §replayDeterminism.llmCacheKeyRecipe',
+        'llmCacheKeyRecipe MUST be `spec-rfc-0041` OR match `^x-host-<host>-<recipe>$` per host-extensions.md',
+      ),
+    ).toBe(true);
+  });
+});

package/src/scenarios/replay-llm-cache-key.test.ts

@@ -20,47 +20,8 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { createHash } from 'node:crypto';
 import { driver } from '../lib/driver.js';
-
-/** Mirror of the reference impl's `canonicalize` so the conformance
- *  scenario can recompute the expected cache key locally and assert
- *  equality with what the host returns. RFC 8785 JCS-style:
- *  sorted-keys, no whitespace, preserve array order. */
-function canonicalize(value: unknown): string {
-  if (value === null) return 'null';
-  if (typeof value === 'boolean' || typeof value === 'number') return JSON.stringify(value);
-  if (typeof value === 'string') return JSON.stringify(value);
-  if (Array.isArray(value)) return '[' + value.map((v) => canonicalize(v)).join(',') + ']';
-  if (typeof value === 'object') {
-    const obj = value as Record<string, unknown>;
-    const keys = Object.keys(obj).sort();
-    return '{' + keys.map((k) => `${JSON.stringify(k)}:${canonicalize(obj[k])}`).join(',') + '}';
-  }
-  return JSON.stringify(value);
-}
-
-function projectRecipe(raw: Record<string, unknown>): Record<string, unknown> {
-  const out: Record<string, unknown> = { provider: raw.provider, model: raw.model, messages: raw.messages };
-  if (Array.isArray(raw.tools) && raw.tools.length > 0) {
-    out.tools = [...(raw.tools as Array<{ name: string }>)].sort((a, b) => a.name.localeCompare(b.name));
-  }
-  if (typeof raw.temperature === 'number') out.temperature = raw.temperature;
-  if (typeof raw.topP === 'number') out.topP = raw.topP;
-  if (typeof raw.topK === 'number') out.topK = raw.topK;
-  if (raw.responseFormat && typeof raw.responseFormat === 'object') out.responseFormat = raw.responseFormat;
-  return out;
-}
-
-function expectedCacheKey(input: Record<string, unknown>): string {
-  return createHash('sha256').update(canonicalize(projectRecipe(input)), 'utf8').digest('hex');
-}
-
-async function callSeam(input: Record<string, unknown>): Promise<{ status: number; cacheKey?: string }> {
-  const res = await driver.post('/v1/host/sample/test/llm-cache-key', input);
-  const cacheKey = (res.json as { cacheKey?: string }).cacheKey;
-  return cacheKey !== undefined ? { status: res.status, cacheKey } : { status: res.status };
-}
+import { expectedCacheKey, callCacheKeySeam as callSeam } from '../lib/llm-cache-key-recipe.js';
 
 describe('replay-llm-cache-key: SHA-256-over-JCS recipe (replay.md §B)', () => {
   it('host cache key MUST equal locally-recomputed SHA-256 over canonical JSON', async () => {

package/src/scenarios/replay-observable-sequence-determinism.test.ts

@@ -0,0 +1,80 @@
+/**
+ * replay-observable-sequence-determinism — RFC 0041 §C behavioral.
+ *
+ * Status: ACTIVE (capability-gated behavioral). Gated on
+ * `capabilities.multiAgent.executionModel.version >= 4` AND
+ * `capabilities.multiAgent.executionModel.replayDeterminism.supported: true`.
+ *
+ * Asserts (behavioral, when a Phase 4 host advertises the contract):
+ *
+ *   1. A `mode: replay` fork from event-log index `fromSeq` produces an
+ *      event-log prefix `[0, fromSeq]` that is byte-equivalent to the
+ *      original run's prefix (modulo per-region clock fields per RFC 0036
+ *      §E and ULID component-T entropy when ULIDs are minted fresh).
+ *
+ *   2. The replay's `RunSnapshot.variables`, `RunSnapshot.channels`, and
+ *      `RunSnapshot.status` at the boundary index are byte-equivalent to
+ *      the original.
+ *
+ *   3. (Crucially per §C.) The replay reproduces observable output EVEN
+ *      WHEN the underlying tool call would have produced different bytes.
+ *      The reference test uses a mock tool that returns a fresh random
+ *      string on each call; the host MUST cache the original observable
+ *      result so replay returns the SAME string the original got — not
+ *      the bytes a fresh call would return now.
+ *
+ * Driving the assertion requires a workflow fixture whose tool call is
+ * pure-nondeterministic (different bytes on each call) but whose
+ * observable result is what gets cached. Reference workflow-engine ships
+ * `core.noop` + deterministic fixtures; Phase 4 wiring needs a
+ * nondeterministic-tool fixture (e.g., `conformance-phase4-nondet-tool`).
+ * Until that lands, the cross-boundary assertion is surfaced as `it.todo`
+ * so test reporters track the gap.
+ *
+ * @see RFCS/0041-multi-agent-replay-under-nondeterminism.md §C
+ * @see spec/v1/replay.md §"Observable-output-sequence determinism vs bit-equivalent execution (MAE-9 closure)"
+ * @see spec/v1/multi-agent-execution.md §"Phase 4 replay determinism"
+ */
+
+import { describe, it } from 'vitest';
+
+// Behavioral assertions in this file are currently `it.todo` placeholders;
+// the `conformance-phase4-nondet-tool` fixture hasn't shipped yet. When
+// it does, the `it.todo` calls flip back to runnable `it(...)` bodies
+// that read discovery (via `driver.get('/.well-known/openwop')`), gate
+// on `multiAgent.executionModel.version >= 4` AND
+// `replayDeterminism.supported: true`, and drive the workflow through
+// the fixture.
+
+describe('replay-observable-sequence-determinism: prefix byte-equivalence (RFC 0041 §C)', () => {
+  // Behavioral assertion drives a workflow with at least one node whose
+  // underlying tool call is nondeterministic (different bytes on each
+  // call). The assertion sequence:
+  //   1. POST /v1/runs { workflowId: 'conformance-phase4-nondet-tool' }
+  //      → runs to completion, capturing the original event log.
+  //   2. Capture original event-log prefix [0, N] where N is the index
+  //      after the nondeterministic-tool node fires.
+  //   3. POST /v1/runs/{runId}:fork { mode: 'replay', fromSeq: N }
+  //   4. Read replay event-log prefix [0, N].
+  //   5. Assert byte-equivalence modulo the carve-outs:
+  //      - per-region observedAt timestamps (RFC 0036 §E)
+  //      - ULID component-T entropy on newly-minted eventIds
+  //   6. Read original + replay RunSnapshot at index N; assert
+  //      variables + channels + status byte-equivalent.
+  // Surfaced as `todo` until the `conformance-phase4-nondet-tool`
+  // fixture ships in the suite — consistent with the sibling Phase 4
+  // scenarios (`replay-divergence-at-refusal.test.ts`,
+  // `replay-llm-cache-key-portable.test.ts`).
+  it.todo('original and replay event-log prefixes [0, fromSeq] MUST be byte-equivalent (modulo per-region clock + ULID-T entropy)');
+});
+
+describe('replay-observable-sequence-determinism: observable-result caching (RFC 0041 §C)', () => {
+  // The load-bearing assertion: a nondeterministic tool call's OBSERVABLE
+  // RESULT (return value + side-effects on workflow state + emitted events)
+  // is what gets cached, not the bytes-on-the-wire of the underlying call.
+  // The replay's reproduction of the observable sequence is what makes
+  // this a valid determinism contract — bit-equivalent execution would
+  // require unbounded caching (rejected per RFC 0041 §"Alternatives
+  // considered" #2).
+  it.todo('replay of a workflow containing a nondeterministic tool call reproduces the original observable result, NOT a fresh call');
+});

package/src/scenarios/sandbox-capability-gate-respected.test.ts

@@ -0,0 +1,27 @@
+/**
+ * sandbox-capability-gate-respected — RFC 0035 §B invariant
+ * `node-pack-sandbox-capability-gate-respected`.
+ *
+ * Capability-gated on `capabilities.sandbox.supported: true`.
+ *
+ * Asserts (behavioral when host advertises): a pack invocation that calls
+ * a host capability NOT in `capabilities.sandbox.allowedHostCalls` fails
+ * closed with `error.code: "sandbox_capability_denied"` AND
+ * `details.requestedCapability` identifying the disallowed capability.
+ *
+ * @see RFCS/0035-sandbox-execution-contract.md §B + §C
+ * @see SECURITY/invariants.yaml node-pack-sandbox-capability-gate-respected
+ */
+
+import { describe, it } from 'vitest';
+
+// Behavioral assertion lands when the misbehaving-capability-gate typeId
+// ships + a host advertises `capabilities.sandbox.supported: true`.
+// Expected: error.code === 'sandbox_capability_denied';
+// details.requestedCapability is set to the disallowed identifier.
+// Surfaced as `todo` so test reporters track the gap rather than
+// reporting a vacuous PASS.
+
+describe('sandbox-capability-gate-respected: behavioral (RFC 0035 §B)', () => {
+  it.todo('a misbehaving pack calling an undeclared host capability fails closed with sandbox_capability_denied');
+});

package/src/scenarios/sandbox-memory-cap.test.ts

@@ -0,0 +1,58 @@
+/**
+ * sandbox-memory-cap — RFC 0035 §B invariant `node-pack-sandbox-memory-cap`.
+ *
+ * Capability-gated on `capabilities.sandbox.supported: true` AND
+ * `capabilities.sandbox.memoryLimitBytes` advertised.
+ *
+ * Asserts (behavioral when host advertises): a pack invocation that
+ * allocates beyond `capabilities.sandbox.memoryLimitBytes` fails closed
+ * with `error.code: "sandbox_memory_exceeded"` per RFC 0035 §C. The host
+ * MUST advertise an integer ≥ 1 MiB per the schema.
+ *
+ * @see RFCS/0035-sandbox-execution-contract.md §B + §C
+ * @see SECURITY/invariants.yaml node-pack-sandbox-memory-cap
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+interface D {
+  capabilities?: { sandbox?: { supported?: unknown; memoryLimitBytes?: unknown } };
+}
+
+async function readSandbox(): Promise<{ supported: boolean; memoryLimitBytes?: number } | null> {
+  try {
+    const r = await driver.get('/.well-known/openwop');
+    if (r.status !== 200) return null;
+    const sb = (r.json as D).capabilities?.sandbox;
+    if (!sb || sb.supported !== true) return null;
+    return {
+      supported: true,
+      ...(typeof sb.memoryLimitBytes === 'number' ? { memoryLimitBytes: sb.memoryLimitBytes } : {}),
+    };
+  } catch { return null; }
+}
+
+describe.skipIf(HTTP_SKIP)('sandbox-memory-cap: capability shape + behavioral (RFC 0035 §B)', () => {
+  it('memoryLimitBytes MUST be integer ≥ 1 MiB when present (per schema)', async () => {
+    const sb = await readSandbox();
+    if (!sb) return; // soft-skip
+    if (sb.memoryLimitBytes === undefined) return; // optional field
+
+    expect(
+      Number.isInteger(sb.memoryLimitBytes) && sb.memoryLimitBytes >= 1048576,
+      driver.describe(
+        'RFCS/0035-sandbox-execution-contract.md §A',
+        'memoryLimitBytes MUST be integer ≥ 1 MiB (1048576)',
+      ),
+    ).toBe(true);
+  });
+
+  // Behavioral assertion lands when the misbehaving-memory-cap typeId is
+  // available. Expected: error.code === 'sandbox_memory_exceeded';
+  // details.requestedBytes > memoryLimitBytes. Surfaced as `todo` so
+  // test reporters track the gap rather than reporting a vacuous PASS.
+  it.todo('a misbehaving pack allocating beyond memoryLimitBytes fails with sandbox_memory_exceeded');
+});

package/src/scenarios/sandbox-no-cross-pack-mutation.test.ts

@@ -0,0 +1,30 @@
+/**
+ * sandbox-no-cross-pack-mutation — RFC 0035 §B invariant
+ * `node-pack-sandbox-no-cross-pack-mutation`.
+ *
+ * Capability-gated on `capabilities.sandbox.supported: true`.
+ *
+ * Asserts (behavioral when host advertises): pack A's sandbox invocation
+ * cannot mutate state visible to pack B running in the same host process.
+ * Exercised via two synthetic packs from `vendor.openwop.misbehaving-sandbox`:
+ *   - pack-a writes a sentinel to a shared address (e.g., a global object,
+ *     a known process-singleton, an ambient module);
+ *   - pack-b reads the same address;
+ * the test asserts pack-b does NOT see pack-a's write (sandbox isolation
+ * holds at the pack boundary, not just at the syscall boundary).
+ *
+ * @see RFCS/0035-sandbox-execution-contract.md §B
+ * @see SECURITY/invariants.yaml node-pack-sandbox-no-cross-pack-mutation
+ */
+
+import { describe, it } from 'vitest';
+
+// Behavioral assertion lands when the misbehaving-cross-pack-mutation
+// typeIds ship + a host advertises `capabilities.sandbox.supported: true`.
+// Expected: pack-b read returns the absent sentinel value; pack-a's
+// mutation did not cross the isolation boundary. Surfaced as `todo` so
+// test reporters track the gap rather than reporting a vacuous PASS.
+
+describe('sandbox-no-cross-pack-mutation: behavioral (RFC 0035 §B)', () => {
+  it.todo('pack A writing a sentinel is NOT visible to pack B in the same host process');
+});

package/src/scenarios/sandbox-no-host-env-leak.test.ts

@@ -0,0 +1,27 @@
+/**
+ * sandbox-no-host-env-leak — RFC 0035 §B invariant `node-pack-sandbox-no-host-env-leak`.
+ *
+ * Capability-gated on `capabilities.sandbox.supported: true`.
+ *
+ * Asserts (behavioral when host advertises): a pack invocation that reads
+ * `process.env` (or the platform equivalent) does NOT see host-level env
+ * vars unless the host has forwarded them via an `allowedHostCalls` entry
+ * exposing env resolution.
+ *
+ * @see RFCS/0035-sandbox-execution-contract.md §B
+ * @see SECURITY/invariants.yaml node-pack-sandbox-no-host-env-leak
+ */
+
+import { describe, it } from 'vitest';
+
+// Behavioral assertion lands when a sandbox-executing host advertises
+// `capabilities.sandbox.supported: true` AND ships a misbehaving-env-leak
+// typeId. The assertion sets a canary env var on the host process, runs
+// the misbehaving pack that reads `process.env`, and asserts the pack's
+// view of env does NOT contain the canary (unless the host has forwarded
+// it via an `allowedHostCalls` entry). Surfaced as `todo` so test
+// reporters track the gap rather than reporting a vacuous PASS.
+
+describe('sandbox-no-host-env-leak: behavioral (RFC 0035 §B)', () => {
+  it.todo('a misbehaving pack reading process.env does NOT see host env vars unless explicitly allowed');
+});