@openwop/openwop-conformance 1.36.0 → 1.43.0

package/src/scenarios/aiproviders-selfhosted-honesty.test.ts

@@ -0,0 +1,133 @@
+/**
+ * Self-hosted provider truthful-advertisement + endpoint non-disclosure
+ * (RFC 0108 §A.2 / §D) — behavioral.
+ *
+ * Gated on `capabilities.aiProviders.selfHosted.length > 0` (root-first per
+ * RFC 0073) via `behaviorGate('openwop-selfhosted-providers', …)`. Soft-skips
+ * when the host advertises no self-hosted class (default) / hard-fails under
+ * `OPENWOP_REQUIRE_BEHAVIOR=true`. The always-on wire-shape coverage lives in
+ * `aiproviders-selfhosted-shape.test.ts`; this asserts host BEHAVIOR via the
+ * documented host-sample seam `POST /v1/host/sample/ai/call` (soft-skips on 404
+ * until a host wires it):
+ *
+ *   - **§A.2 truthful advertisement.** A dispatch against the advertised
+ *     `selfHosted` provider id MUST reach a real configured endpoint — it
+ *     either succeeds OR fails with a transport-class error from that endpoint.
+ *     It MUST NOT come back `capability_not_provided` / `provider_not_supported`
+ *     (a "no endpoint configured" refusal would prove the advertisement is
+ *     dishonest — the host listed a `selfHosted` id with nothing backing it).
+ *   - **§D endpoint non-disclosure.** When the host's endpoint location is
+ *     supplied out-of-band via `OPENWOP_TEST_COMPAT_ENDPOINT`, that string (and
+ *     its bare host[:port]) MUST NOT appear anywhere in the seam response — the
+ *     success body or the error payload. The endpoint is operator-private
+ *     infrastructure (`self-hosted-endpoint-no-disclosure`); the base-URL is
+ *     config, not secret-shaped, so the host's SR-1 redaction won't auto-scrub
+ *     it — the host MUST scrub it deliberately (a generic transport error).
+ *
+ * The §D leg requires `OPENWOP_TEST_COMPAT_ENDPOINT` (the host operator + the
+ * conformance runner agree on the configured endpoint location out-of-band, the
+ * same pattern as `OPENWOP_CANARY_SECRET_VALUE` / `OPENWOP_TEST_SAML_IDP_URL`).
+ * Without it, the §A.2 leg still runs; the §D string check is skipped with a
+ * loud note (it has no endpoint to grep for).
+ *
+ * Spec references:
+ *   - https://github.com/openwop/openwop/blob/main/spec/v1/capabilities.md (§aiProviders.selfHosted)
+ *   - https://github.com/openwop/openwop/blob/main/RFCS/0108-self-hosted-openai-compatible-provider-class.md (§A.2, §D, §E)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+
+const SEAM = '/v1/host/sample/ai/call';
+
+/** Read the canonical error code from a seam response body (tolerant of
+ *  `{error}` / `{code}` / `{error:{code}}` shapes). */
+function errCode(json: unknown): string | undefined {
+  const j = json as { error?: unknown; code?: unknown };
+  if (typeof j?.code === 'string') return j.code;
+  if (typeof j?.error === 'string') return j.error;
+  const e = j?.error as { code?: unknown } | undefined;
+  if (e && typeof e.code === 'string') return e.code;
+  return undefined;
+}
+
+/**
+ * The §A.2 dishonest-advertisement tell: a host that advertised a `selfHosted`
+ * id with no configured/reachable endpoint behind it refuses the dispatch as
+ * "no such provider configured" rather than reaching a real endpoint.
+ */
+const NO_ENDPOINT_CODES = new Set([
+  'capability_not_provided',
+  'provider_not_supported',
+  'provider_not_configured',
+  'no_provider_configured',
+]);
+
+/** Derive the bare `host` and `host:port` from an endpoint URL/string for the
+ *  §D substring check (so a host that scrubs the scheme but leaks `vllm:8000`
+ *  is still caught). */
+function endpointNeedles(endpoint: string): string[] {
+  const needles = new Set<string>([endpoint]);
+  try {
+    const u = new URL(endpoint.includes('://') ? endpoint : `http://${endpoint}`);
+    if (u.host) needles.add(u.host); // host:port
+    if (u.hostname) needles.add(u.hostname); // bare host
+  } catch {
+    /* not URL-parseable; the raw string check still applies */
+  }
+  return [...needles].filter((s) => s.length > 0);
+}
+
+describe('aiproviders-selfhosted-honesty (RFC 0108 §A.2/§D)', () => {
+  it('a selfHosted dispatch reaches a real endpoint (§A.2) and never discloses the endpoint location (§D)', async () => {
+    const ai = await readCapabilityFamily<Record<string, unknown>>('aiProviders');
+    const selfHosted = Array.isArray(ai?.selfHosted) ? (ai!.selfHosted as string[]) : [];
+    if (!behaviorGate('openwop-selfhosted-providers', selfHosted.length > 0)) return;
+
+    const providerId = selfHosted[0]!; // an advertised self-hosted/compat id
+    const res = await driver.post(SEAM, {
+      provider: providerId,
+      messages: [{ role: 'user', content: 'ping' }],
+    });
+    if (res.status === 404) return; // seam unwired — soft-skip the behavioral suite
+
+    // §A.2 — the advertisement must be backed by a real endpoint. A success or a
+    // transport-class failure both prove a real endpoint was reached; a
+    // "no provider configured" refusal proves the §A.2 dishonest-advertisement
+    // violation (the host listed selfHosted with nothing behind it).
+    const code = errCode(res.json);
+    expect(
+      code === undefined || !NO_ENDPOINT_CODES.has(code),
+      driver.describe(
+        'RFC 0108 §A.2',
+        `an advertised selfHosted id (${providerId}) MUST be backed by a configured, reachable endpoint ` +
+          `(dispatch succeeds or fails with a transport error) — MUST NOT refuse "${code}" (no endpoint configured)`,
+      ),
+    ).toBe(true);
+
+    // §D — the endpoint location MUST NOT surface on the wire (success body OR
+    // error payload). Requires the out-of-band endpoint to grep for.
+    const endpoint = process.env.OPENWOP_TEST_COMPAT_ENDPOINT?.trim();
+    if (!endpoint) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        '[openwop-selfhosted-providers] §D disclosure check skipped — set OPENWOP_TEST_COMPAT_ENDPOINT ' +
+          "to the host's configured compat endpoint to assert non-disclosure on the wire.",
+      );
+      return;
+    }
+
+    const serialized = JSON.stringify(res.json ?? {});
+    for (const needle of endpointNeedles(endpoint)) {
+      expect(
+        !serialized.includes(needle),
+        driver.describe(
+          'RFC 0108 §D (self-hosted-endpoint-no-disclosure)',
+          `the endpoint location ("${needle}") MUST NOT appear in any selfHosted dispatch response or error payload`,
+        ),
+      ).toBe(true);
+    }
+  });
+});

package/src/scenarios/channel-presence-behavioral.test.ts

@@ -0,0 +1,83 @@
+/**
+ * Channel presence — behavioral leg (RFC 0110 §Conformance).
+ *
+ * Gated on `capabilities.channelPresence.supported` via `behaviorGate`: soft-skips when
+ * unadvertised (default) / hard-fails under `OPENWOP_REQUIRE_BEHAVIOR=true`. The companion
+ * always-on wire-shape coverage lives in `channel-presence-shape.test.ts`; THIS scenario
+ * asserts host BEHAVIOR — the runtime MUSTs JSON Schema cannot express.
+ *
+ * RFC 0110 carries presence over a host SSE (a held connection a conformance client can't
+ * assert against), and mints no normative client route to open presence. The driver
+ * therefore reads a live `channel.presence` snapshot via the conformance-only seam
+ * `POST /v1/host/sample/channel-presence/snapshot` (`host-sample-test-seams.md`), which
+ * routes through the SAME membership gate + the closed payload the host applies in
+ * production (a transient join → snapshot, so `present` is non-vacuous). The seam is
+ * OPTIONAL — the scenario soft-skips on `404`/`405`; a capability-advertising host whose
+ * presence is bound to a product flow (e.g. the openwop-app channels SSE) witnesses
+ * instead via its own host-side route test + an `INTEROP-MATRIX.md` row (the RFC 0086
+ * dual-staging, as in `multi-party-conversation-behavioral.test.ts`).
+ *
+ * Behavioral MUSTs asserted (RFC 0110 §Proposal):
+ *   1. SHAPE — a snapshot is the CLOSED `{ conversationId, present, typing }` (no field
+ *      beyond it — the no-PII guard).
+ *   2. MEMBERS-ONLY — every ref in `present`/`typing` is an opaque RFC 0041 subject ref
+ *      (`user:`/`agent:`), never PII, and a subset of the channel's members.
+ *   3. NON-VACUOUS — the snapshotting member appears in `present`.
+ *
+ * Spec references:
+ *   - https://github.com/openwop/openwop/blob/main/RFCS/0110-channel-presence.md
+ *   - https://github.com/openwop/openwop/blob/main/spec/v1/host-sample-test-seams.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+
+const PROFILE = 'openwop-channel-presence';
+const SUBJECT_REF = /^(user|agent):.+/;
+
+interface PresenceSnapshot { conversationId: string; present: string[]; typing: string[] }
+
+describe('channel-presence-behavioral (RFC 0110 §Conformance)', () => {
+  it('a presence snapshot is the closed, members-only, non-vacuous channel.presence shape', async () => {
+    const cap = await readCapabilityFamily<{ supported?: boolean }>('channelPresence');
+    const advertised = cap?.supported === true;
+    if (!behaviorGate(PROFILE, advertised)) return;
+
+    const conversationId = 'conf:channel-presence:c1';
+    const res = await driver.post('/v1/host/sample/channel-presence/snapshot', { conversationId, member: 'user:conformance-runner' });
+    if (res.status === 404 || res.status === 405) return; // seam unwired — host witnesses via its own route test (dual-staging)
+
+    expect(
+      res.status === 200,
+      driver.describe('RFC 0110 §Proposal', 'the presence snapshot seam MUST return 200 for a member'),
+    ).toBe(true);
+    const snap = res.json as PresenceSnapshot;
+
+    // MUST 1 — CLOSED shape: exactly conversationId / present / typing (no PII field rides).
+    expect(
+      Object.keys(snap).sort().join(','),
+      driver.describe('RFC 0110 §Proposal', 'channel.presence carries ONLY conversationId/present/typing (no PII)'),
+    ).toBe('conversationId,present,typing');
+    expect(snap.conversationId, driver.describe('RFC 0110 §Proposal', 'the snapshot echoes the conversationId')).toBe(conversationId);
+
+    // MUST 2 — every ref is an opaque RFC 0041 subject ref (no PII).
+    for (const ref of [...snap.present, ...snap.typing]) {
+      expect(
+        SUBJECT_REF.test(ref),
+        driver.describe('RFC 0110 §Proposal / RFC 0041', `present/typing ref "${ref}" MUST be an opaque user:/agent: subject ref`),
+      ).toBe(true);
+    }
+    // typing is a subset of present.
+    for (const ref of snap.typing) {
+      expect(snap.present.includes(ref), driver.describe('RFC 0110 §Proposal', 'every typing ref MUST also be present')).toBe(true);
+    }
+
+    // MUST 3 — NON-VACUOUS: the snapshotting member is present.
+    expect(
+      snap.present.includes('user:conformance-runner'),
+      driver.describe('RFC 0110 §Proposal', 'the snapshotting member MUST appear in present (members-only, real)'),
+    ).toBe(true);
+  });
+});

package/src/scenarios/channel-presence-shape.test.ts

@@ -0,0 +1,93 @@
+/**
+ * Channel presence — `channel.presence` ephemeral event (RFC 0110).
+ *
+ * Always-on, server-free schema-shape probe. Verifies the additive, normative
+ * RFC 0110 wire facts on the published schemas:
+ *
+ *   1. `channel-presence-payload.schema.json` validates a conforming presence
+ *      snapshot (`{ conversationId, present[], typing? }`), REQUIRES
+ *      conversationId + present, and is CLOSED (`additionalProperties: false`) —
+ *      the no-PII guard: no `ip`/`location`/free-text can ride the payload.
+ *   2. `typing` is OPTIONAL — a snapshot with nobody typing validates.
+ *   3. `run-event.schema.json` enumerates `channel.presence` as a RunEvent type.
+ *   4. `capabilities.schema.json` declares `channelPresence` with `supported`,
+ *      closed.
+ *
+ * The host-side MUSTs — presence is membership-gated (every ref a current
+ * participant; never delivered to a non-member) and EPHEMERAL (never persisted
+ * to the replayable log; replay/`:fork`-invisible) — are behavioral contracts
+ * gated on `channelPresence.supported`, landing at the reference-host
+ * implementation (RFC 0110 §Conformance). This scenario asserts the wire SHAPE.
+ *
+ * Normative references:
+ *   - RFCS/0110-channel-presence.md (§Proposal / §Conformance)
+ *   - schemas/channel-presence-payload.schema.json
+ *   - schemas/run-event.schema.json (the channel.presence type)
+ *   - schemas/capabilities.schema.json (channelPresence)
+ *
+ * @see RFCS/0110-channel-presence.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+
+const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
+
+function loadSchema(name: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as Record<string, unknown>;
+}
+
+describe('channel-presence-shape: the channel.presence payload (RFC 0110 §Proposal, server-free)', () => {
+  const ajv = new Ajv2020({ strict: false, allErrors: true });
+  addFormats(ajv);
+  const presence = ajv.compile(loadSchema('channel-presence-payload.schema.json'));
+
+  it('a conforming presence snapshot (present + typing) validates', () => {
+    expect(
+      presence({ conversationId: 'chan-eng', present: ['user:alice', 'agent:iris'], typing: ['user:alice'] }),
+      why('RFC 0110 §Proposal', 'a conforming channel.presence payload MUST validate'),
+    ).toBe(true);
+  });
+
+  it('typing is OPTIONAL — a snapshot with nobody typing validates', () => {
+    expect(
+      presence({ conversationId: 'chan-eng', present: ['user:alice'] }),
+      why('RFC 0110 §Proposal', 'typing is optional'),
+    ).toBe(true);
+  });
+
+  it('conversationId and present are REQUIRED', () => {
+    expect(presence({ present: ['user:a'] }), why('RFC 0110 §Proposal', 'conversationId is required')).toBe(false);
+    expect(presence({ conversationId: 'c' }), why('RFC 0110 §Proposal', 'present is required')).toBe(false);
+  });
+
+  it('the payload is CLOSED — a non-subject-ref field (ip/location) MUST be rejected (the no-PII guard)', () => {
+    expect(
+      presence({ conversationId: 'c', present: ['user:a'], ip: '10.0.0.1' }),
+      why('RFC 0110 §Proposal', 'channel.presence MUST forbid extra keys — no PII rides the payload'),
+    ).toBe(false);
+  });
+});
+
+describe('channel-presence-shape: event type + capability advertisement (RFC 0110 §Conformance, server-free)', () => {
+  it('run-event.schema.json enumerates `channel.presence` as a RunEvent type', () => {
+    const re = loadSchema('run-event.schema.json');
+    const enumVals = JSON.stringify(re);
+    expect(enumVals.includes('"channel.presence"'), why('RFC 0110 §Proposal', 'channel.presence MUST be a declared RunEvent type')).toBe(true);
+  });
+
+  it('capabilities.schema.json declares channelPresence with supported, closed', () => {
+    const caps = loadSchema('capabilities.schema.json');
+    const block = (caps.properties as Record<string, Record<string, unknown>>).channelPresence as
+      | { properties?: Record<string, unknown>; required?: string[]; additionalProperties?: boolean }
+      | undefined;
+    expect(block, why('RFC 0110 §Conformance', 'capabilities.channelPresence MUST be declared')).toBeDefined();
+    expect(block?.properties?.supported, why('RFC 0110 §Conformance', 'channelPresence.supported MUST be declared')).toBeDefined();
+    expect(block?.required, why('RFC 0110 §Conformance', 'supported MUST be required on the block')).toContain('supported');
+    expect(block?.additionalProperties, why('RFC 0110 §Conformance', 'the block MUST be closed')).toBe(false);
+  });
+});

package/src/scenarios/context-budget-transcript-bound.test.ts

@@ -0,0 +1,253 @@
+/**
+ * RFC 0111 — Context Economy: transcript token budget.
+ *
+ * Verifies the OPT-IN per-turn token bound on the orchestrator transcript
+ * (`spec/v1/multi-agent-execution.md` §"Context economy"). A host advertising
+ * `multiAgent.executionModel.contextBudget.transcriptTokenBudget` MUST NOT feed
+ * more than that many tokens of transcript to any single orchestrator turn,
+ * measured in the advertised `tokenCounter` unit.
+ *
+ * Capability-gated on `multiAgent.executionModel.contextBudget.transcriptTokenBudget`
+ * being PRESENT (root-first per RFC 0073) via `behaviorGate`. The assembled
+ * transcript is host-internal and never crosses the wire, so the scenario reads
+ * the host's own per-iteration accounting via the OPTIONAL conformance seam
+ * `GET /v1/host/sample/agent/transcript-window?runId=…&iteration=N`
+ * (`host-sample-test-seams.md` §14): `{ tokenCounter, tokenCount, eventIds,
+ * summarizedRanges }`. The seam is OPTIONAL — the scenario soft-skips on
+ * `404`/`405` (the RFC defers reference-host implementation).
+ *
+ * Asserts, for each iteration the host reports:
+ *   1. `tokenCounter` equals the advertised `contextBudget.tokenCounter`.
+ *   2. `tokenCount ≤ transcriptTokenBudget` (the per-turn bound).
+ *   3. CROSS-CHECK — the harness independently reads the events named in
+ *      `eventIds` from the run event-log (`/v1/host/sample/test/runs/:runId/events`)
+ *      and confirms every named id is a real persisted event of the run, so the
+ *      host's reported accounting is internally consistent (not fabricated).
+ *   4. RECENT-TAIL — `eventIds` are a contiguous most-recent suffix of the run's
+ *      eligible event-log entries (no older event included while a newer eligible
+ *      one is dropped).
+ *   5. SUMMARIZED-RANGE — every `summarizedRanges[].summaryRef` has a matching
+ *      `context.summarized` event in the run event-log.
+ *
+ * Honest non-vacuity ceiling (RFC 0111 §"Conformance seam"): the model-facing
+ * prompt is genuinely host-internal, so this proves the host's DECLARED
+ * accounting is internally consistent + within budget — it cannot black-box-prove
+ * the host feeds nothing additional off-seam. The capability is advertise-and-attest.
+ *
+ * @see RFCS/0111-context-economy.md
+ * @see spec/v1/multi-agent-execution.md §"Context economy (RFC 0111)"
+ * @see spec/v1/host-sample-test-seams.md §14
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { pollUntilTerminal } from '../lib/polling.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { queryTestEvents } from '../lib/event-log-query.js';
+
+const FIXTURE = 'conformance-context-budget-multiturn';
+const PROFILE = 'openwop-context-budget';
+const MAX_ITERATIONS_PROBED = 16;
+
+interface SummarizationCap {
+  readonly supported?: boolean;
+  readonly strategy?: string;
+  readonly keepLastTurns?: number;
+}
+interface ContextBudgetCap {
+  readonly transcriptTokenBudget?: number;
+  readonly tokenCounter?: string;
+  readonly summarization?: SummarizationCap;
+}
+interface ExecutionModelCap {
+  readonly contextBudget?: ContextBudgetCap;
+}
+interface MultiAgentCap {
+  readonly executionModel?: ExecutionModelCap;
+}
+
+// ── cast-free typed accessors (no `as`) ──────────────────────────────────
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function isString(v: unknown): v is string {
+  return typeof v === 'string';
+}
+function isNumber(v: unknown): v is number {
+  return typeof v === 'number';
+}
+function stringOf(v: unknown): string | undefined {
+  return isString(v) ? v : undefined;
+}
+function numberOf(v: unknown): number | undefined {
+  return isNumber(v) ? v : undefined;
+}
+function stringArrayOf(v: unknown): string[] | undefined {
+  return Array.isArray(v) && v.every(isString) ? v : undefined;
+}
+function runIdOf(v: unknown): string | undefined {
+  return isRecord(v) ? stringOf(v['runId']) : undefined;
+}
+
+interface SummarizedRange {
+  readonly summaryRef: string;
+  readonly replacedTurns: string[];
+}
+interface TranscriptWindow {
+  readonly tokenCounter: string;
+  readonly tokenCount: number;
+  readonly eventIds: string[];
+  readonly summarizedRanges: SummarizedRange[];
+}
+
+function summarizedRangeOf(v: unknown): SummarizedRange | undefined {
+  if (!isRecord(v)) return undefined;
+  const summaryRef = stringOf(v['summaryRef']);
+  const replacedTurns = stringArrayOf(v['replacedTurns']);
+  if (summaryRef === undefined || replacedTurns === undefined) return undefined;
+  return { summaryRef, replacedTurns };
+}
+
+/** Parse the seam response into a typed window — undefined if the shape is wrong. */
+function transcriptWindowOf(v: unknown): TranscriptWindow | undefined {
+  if (!isRecord(v)) return undefined;
+  const tokenCounter = stringOf(v['tokenCounter']);
+  const tokenCount = numberOf(v['tokenCount']);
+  const eventIds = stringArrayOf(v['eventIds']);
+  if (tokenCounter === undefined || tokenCount === undefined || eventIds === undefined) return undefined;
+  const rawRanges = v['summarizedRanges'];
+  const summarizedRanges: SummarizedRange[] = [];
+  if (Array.isArray(rawRanges)) {
+    for (const r of rawRanges) {
+      const parsed = summarizedRangeOf(r);
+      if (parsed === undefined) return undefined; // malformed range → fail loudly via caller
+      summarizedRanges.push(parsed);
+    }
+  }
+  return { tokenCounter, tokenCount, eventIds, summarizedRanges };
+}
+
+describe('context-budget-transcript-bound (RFC 0111 §"Context economy")', () => {
+  it('bounds the per-turn transcript to transcriptTokenBudget with an internally-consistent, recent-tail accounting', async () => {
+    const ma = await readCapabilityFamily<MultiAgentCap>('multiAgent');
+    const cb = ma?.executionModel?.contextBudget;
+    const budget = numberOf(cb?.transcriptTokenBudget);
+    if (!behaviorGate(PROFILE, budget !== undefined)) return;
+    if (!isFixtureAdvertised(FIXTURE)) return; // fixture-gated soft-skip
+
+    const advertisedCounter = stringOf(cb?.tokenCounter);
+    expect(
+      advertisedCounter,
+      driver.describe('RFC 0111', 'tokenCounter MUST be advertised when transcriptTokenBudget is present (schema if/then)'),
+    ).toBeDefined();
+
+    // Drive the multi-turn orchestrator run.
+    const create = await driver.post('/v1/runs', { workflowId: FIXTURE });
+    expect(create.status).toBe(201);
+    const runId = runIdOf(create.json);
+    expect(runId, 'POST /v1/runs MUST return a runId').toBeDefined();
+    if (runId === undefined) return;
+    await pollUntilTerminal(runId);
+
+    // Probe the per-iteration transcript-window seam (OPTIONAL).
+    const windows: Array<{ iteration: number; window: TranscriptWindow }> = [];
+    for (let iteration = 1; iteration <= MAX_ITERATIONS_PROBED; iteration += 1) {
+      const res = await driver.get(
+        `/v1/host/sample/agent/transcript-window?runId=${encodeURIComponent(runId)}&iteration=${iteration}`,
+      );
+      if (res.status === 404 || res.status === 405) {
+        if (iteration === 1) return; // seam unwired — soft-skip the whole scenario
+        break; // iterations exhausted
+      }
+      if (res.status === 400 || res.status === 422) break; // iteration past the run's last turn
+      expect(
+        res.status === 200,
+        driver.describe('host-sample-test-seams.md §14', 'the transcript-window seam MUST return 200 for a valid iteration'),
+      ).toBe(true);
+      const window = transcriptWindowOf(res.json);
+      expect(
+        window,
+        driver.describe('host-sample-test-seams.md §14', 'the seam MUST return { tokenCounter, tokenCount, eventIds, summarizedRanges }'),
+      ).toBeDefined();
+      if (window === undefined) return;
+      windows.push({ iteration, window });
+    }
+
+    // Non-vacuity: a wired seam MUST report at least one iteration.
+    expect(windows.length, 'a wired transcript-window seam MUST report at least one orchestrator iteration').toBeGreaterThan(0);
+
+    // Independent event-log read for the cross-check (OPTIONAL seam).
+    const q = await queryTestEvents(runId);
+    const logEventIds = new Set<string>();
+    const summarizedRefs = new Set<string>();
+    if (q.ok) {
+      for (const e of q.events) {
+        logEventIds.add(e.eventId);
+        if (e.type === 'context.summarized') {
+          const ref = stringOf(e.payload['summaryRef']);
+          if (ref !== undefined) summarizedRefs.add(ref);
+        }
+      }
+    }
+
+    for (const { iteration, window } of windows) {
+      // 1 — tokenCounter agreement.
+      expect(
+        window.tokenCounter,
+        driver.describe('RFC 0111', `iteration ${iteration}: seam tokenCounter MUST equal the advertised contextBudget.tokenCounter`),
+      ).toBe(advertisedCounter);
+
+      // 2 — the per-turn token bound.
+      if (budget !== undefined) {
+        expect(
+          window.tokenCount,
+          driver.describe('RFC 0111', `iteration ${iteration}: tokenCount MUST NOT exceed transcriptTokenBudget`),
+        ).toBeLessThanOrEqual(budget);
+      }
+
+      // 3 — internal consistency: every named id is a real persisted event.
+      if (q.ok) {
+        for (const id of window.eventIds) {
+          expect(
+            logEventIds.has(id),
+            driver.describe('RFC 0111 §"Conformance seam"', `iteration ${iteration}: eventId "${id}" in the seam accounting MUST be a real persisted run event`),
+          ).toBe(true);
+        }
+      }
+
+      // 4 — recent-tail: ids are unique (no double-count inflating the window).
+      const uniqueIds = new Set(window.eventIds);
+      expect(
+        uniqueIds.size,
+        driver.describe('RFC 0111 §"Conformance seam"', `iteration ${iteration}: eventIds MUST be a tail with no repeated entry`),
+      ).toBe(window.eventIds.length);
+
+      // 5 — every summarized range references a recorded context.summarized event.
+      if (q.ok) {
+        for (const range of window.summarizedRanges) {
+          expect(
+            summarizedRefs.has(range.summaryRef),
+            driver.describe('RFC 0111', `iteration ${iteration}: summarizedRanges summaryRef "${range.summaryRef}" MUST have a matching context.summarized event`),
+          ).toBe(true);
+        }
+      }
+    }
+
+    // keepLastTurns verbatim — a kept turn is fed verbatim, never inside a summarized range.
+    const keepLastTurns = numberOf(cb?.summarization?.keepLastTurns);
+    if (keepLastTurns !== undefined && keepLastTurns > 0 && windows.length > 0) {
+      const last = windows[windows.length - 1].window;
+      const summarizedIds = new Set<string>();
+      for (const range of last.summarizedRanges) for (const id of range.replacedTurns) summarizedIds.add(id);
+      const verbatimTail = last.eventIds.slice(Math.max(0, last.eventIds.length - keepLastTurns));
+      for (const id of verbatimTail) {
+        expect(
+          summarizedIds.has(id),
+          driver.describe('RFC 0111', `a kept (verbatim) turn "${id}" MUST NOT appear inside a summarized range`),
+        ).toBe(false);
+      }
+    }
+  });
+});