@openwop/openwop-conformance 1.52.0 → 1.53.0

package/schemas/capabilities.schema.json

@@ -470,6 +470,22 @@
         }
       }
     },
+    "purposePropagation": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "RFC 0128 (`Active`). Purpose-propagation — the host reads and RE-EMITS `permittedPurposes` labels (opaque purpose strings riding the A2A `metadata.openwop.permittedPurposes` extension and the `TriggerEvent.permittedPurposes` field) on onward OpenWOP-envelope hops of the same data, narrowing at most and never widening; a `[]` label is honored as no-onward-use. This family advertises label PROPAGATION only — it does NOT claim the host enforces purpose limits on its own internal use (that is declared intent under the receiver's local governance, RFC 0128 §4, deliberately not conformance-gated). A host MUST NOT advertise `supported: true` until RFC 0128 reaches `Accepted` and propagation is honored (truthful-advertisement, `OPENWOP_REQUIRE_BEHAVIOR=true`). Absent block ⇒ labels pass through unread as unknown metadata (pre-RFC behavior).",
+      "required": ["supported"],
+      "properties": {
+        "supported": {
+          "type": "boolean",
+          "description": "RFC 0128. When `true`, the host preserves and re-emits received `permittedPurposes` labels per RFC 0128 §3 (re-emit on OpenWOP-envelope onward hops; MAY narrow; MUST NOT widen; derived outputs never carry a purpose absent from any contributing labelled input; `[]` ⇒ no onward hop)."
+        },
+        "propagatesOnward": {
+          "type": "boolean",
+          "description": "RFC 0128. When `true`, the host's onward OpenWOP-envelope hops (A2A forwards, trigger/sync events to OpenWOP peers) re-emit the label. Distinct from `supported` only for hosts that read labels but have no onward-hop surface at all; a host WITH onward hops advertising `supported: true` MUST also propagate."
+        }
+      }
+    },
     "credentials": {
       "type": "object",
       "description": "RFC 0046 (`Draft`). Portable credential resolution + lifecycle contract — sibling to `secrets`, first-class store-at-rest + workspace sharing + two-key-overlap rotation. A pack references a credential by `{ ref, scope }` (see `credential-reference.schema.json`); the host resolves it into the node sandbox ONLY — never into inputs, persisted variables, channels, any run.* event payload, the debug bundle, or replay state (SECURITY invariant `credential-payload-redaction`). Supersedes the informal BYOK annex; the `secrets` advertisement stays valid.",
@@ -1699,13 +1715,13 @@
             "backoff": { "type": "string", "enum": ["none", "fixed", "exponential"], "description": "Backoff strategy between attempts." }
           }
         },
-        "sources": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form"] }, "description": "Which trigger sources bridge uniformly. A source listed here MUST have a registerable `TriggerSubscription` driven through the four-state machine AND emit the two `trigger.*` events for that source — the list MUST NOT over-claim a source the host has as a feature but does not wire as a durable trigger subscription. A consumer MUST tolerate any subset." },
+        "sources": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form", "stream", "change"] }, "description": "Which trigger sources bridge uniformly. A source listed here MUST have a registerable `TriggerSubscription` driven through the four-state machine AND emit the two `trigger.*` events for that source — the list MUST NOT over-claim a source the host has as a feature but does not wire as a durable trigger subscription. A consumer MUST tolerate any subset." },
         "ingestion": {
           "type": "object",
           "additionalProperties": false,
-          "description": "RFC 0099 §F.3 (additive). External-event ingestion advertisement — which of `sources[]` the host actually ingests from EXTERNALLY-originated events (`webhook`/`email`/`form`), normalizing each to a `TriggerEvent` (`trigger-event.schema.json`) and starting a run. Absent ⇒ the host does NOT externally-ingest (today's behavior — schedule/queue only). A source in `externalSources[]` MUST actually accept an external event, normalize it, and start a run — over-claiming is a dishonest advertisement. A consumer MUST tolerate any subset.",
+          "description": "RFC 0099 §F.3 (additive). External-event ingestion advertisement — which of `sources[]` the host actually ingests from EXTERNALLY-originated events (`webhook`/`email`/`form`/`stream`/`change`), normalizing each to a `TriggerEvent` (`trigger-event.schema.json`) and starting a run. Absent ⇒ the host does NOT externally-ingest (today's behavior — schedule/queue only). A source in `externalSources[]` MUST actually accept an external event, normalize it, and start a run — over-claiming is a dishonest advertisement. A consumer MUST tolerate any subset.",
           "properties": {
-            "externalSources": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook", "email", "form"] }, "description": "Which of `sources[]` are EXTERNALLY ingested per RFC 0099. The honesty gate — each MUST normalize to a `TriggerEvent` and start a run." },
+            "externalSources": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook", "email", "form", "stream", "change"] }, "description": "Which of `sources[]` are EXTERNALLY ingested per RFC 0099 (`stream`/`change` per RFC 0127). The honesty gate — each MUST normalize to a `TriggerEvent` and start a run." },
             "maxBodyBytes": { "type": "integer", "minimum": 1, "description": "Inbound body cap (webhook body / email / form), reusing the RFC 0076 §B response-cap discipline." },
             "verification": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook-signature", "email-dmarc", "form-origin"] }, "description": "Which source-authenticity checks the host performs. An advertised check MUST actually be performed (RFC 0099 §F.3 / UQ1)." },
             "registrationEndpoint": { "type": "boolean", "description": "`true` ⇒ the host serves `POST /v1/trigger-subscriptions` (RFC 0099 §F.2) for portable external-event subscription creation." }

package/schemas/run-event-payloads.schema.json

@@ -1739,7 +1739,7 @@
       "required": ["subscriptionId", "source", "fromState", "toState"],
       "properties": {
         "subscriptionId": { "type": "string", "minLength": 1, "description": "The TriggerSubscription this state change is for." },
-        "source":         { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form"], "description": "The subscription source." },
+        "source":         { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form", "stream", "change"], "description": "The subscription source." },
         "fromState":      { "type": "string", "enum": ["active", "paused", "failed", "dead-lettered"], "description": "Prior state." },
         "toState":        { "type": "string", "enum": ["active", "paused", "failed", "dead-lettered"], "description": "New state." },
         "reason":         { "type": "string", "enum": ["retry-exhausted", "operator-paused", "signature-invalid", "backpressure", "source-removed", "provenance-unevaluable"], "description": "MAY — a machine-stable reason code (a CLOSED enum — a free-form reason is a leak vector that would let a host spill an inbound URL/host/header into it). The load-bearing field is `toState`." }

package/schemas/trigger-event.schema.json

@@ -2,15 +2,15 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v1/trigger-event.schema.json",
   "title": "TriggerEvent",
-  "description": "RFC 0099 §F.1. The normalized external-event envelope a host hands a started run as `ctx.triggerData` when an externally-originated event (`webhook`/`email`/`form`) is delivered to an `active` TriggerSubscription (RFC 0083). This is an IN-RUN payload only — it never appears on the durable event log; the `trigger.delivery.attempted` event stays content-free (RFC 0083 §C / SECURITY `trigger-ingestion-content-redaction`). A TriggerEvent carries exactly the per-source sub-object matching its `source`. All content is `untrusted` (SECURITY `threat-model-prompt-injection.md`).",
+  "description": "RFC 0099 §F.1. The normalized external-event envelope a host hands a started run as `ctx.triggerData` when an externally-originated event (`webhook`/`email`/`form`/`stream`/`change`) is delivered to an `active` TriggerSubscription (RFC 0083). This is an IN-RUN payload only — it never appears on the durable event log; the `trigger.delivery.attempted` event stays content-free (RFC 0083 §C / SECURITY `trigger-ingestion-content-redaction`). A TriggerEvent carries exactly the per-source sub-object matching its `source`. All content is `untrusted` (SECURITY `threat-model-prompt-injection.md`).",
   "type": "object",
   "additionalProperties": false,
   "required": ["source", "subscriptionId", "deliveryId", "receivedAt"],
   "properties": {
     "source": {
       "type": "string",
-      "enum": ["webhook", "email", "form"],
-      "description": "Which external source originated the event. A TriggerEvent MUST carry exactly the per-source sub-object matching this value and MUST NOT carry the others (RFC 0099 §F.1)."
+      "enum": ["webhook", "email", "form", "stream", "change"],
+      "description": "Which external source originated the event. A TriggerEvent MUST carry exactly the per-source sub-object matching this value and MUST NOT carry the others (RFC 0099 §F.1; `stream`/`change` per RFC 0127)."
     },
     "subscriptionId": {
       "type": "string",
@@ -40,23 +40,38 @@
       "enum": ["untrusted"],
       "description": "Always `untrusted`. Inbound external content reaching an LLM node MUST be wrapped per `threat-model-prompt-injection.md` §UNTRUSTED; a TriggerEvent MUST NOT directly advance a HITL approval gate (the `prompt-injection-mcp-no-approval` invariant generalizes)."
     },
+    "permittedPurposes": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "RFC 0128 — OPTIONAL declared uses the receiver is permitted to make of the accompanying data. Opaque purpose strings mapped to the host's local vocabulary; carries purpose categories only, never subject identifiers or consent records. Absent ⇒ unlabelled (no constraint asserted); `[]` ⇒ no onward use permitted (NOT the same as absent). A host advertising `purposePropagation` MUST honor the RFC 0128 §3 propagation rules for this label."
+    },
     "webhook": { "$ref": "#/$defs/WebhookEvent" },
     "email": { "$ref": "#/$defs/EmailEvent" },
-    "form": { "$ref": "#/$defs/FormEvent" }
+    "form": { "$ref": "#/$defs/FormEvent" },
+    "stream": { "$ref": "#/$defs/StreamEvent" },
+    "change": { "$ref": "#/$defs/ChangeEvent" }
   },
   "allOf": [
     {
       "description": "RFC 0099 §F.1 — a TriggerEvent MUST carry exactly the per-source sub-object matching its `source` and MUST NOT carry the others.",
       "if": { "properties": { "source": { "const": "webhook" } } },
-      "then": { "not": { "anyOf": [{ "required": ["email"] }, { "required": ["form"] }] } }
+      "then": { "not": { "anyOf": [{ "required": ["email"] }, { "required": ["form"] }, { "required": ["stream"] }, { "required": ["change"] }] } }
     },
     {
       "if": { "properties": { "source": { "const": "email" } } },
-      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["form"] }] } }
+      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["form"] }, { "required": ["stream"] }, { "required": ["change"] }] } }
     },
     {
       "if": { "properties": { "source": { "const": "form" } } },
-      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["email"] }] } }
+      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["email"] }, { "required": ["stream"] }, { "required": ["change"] }] } }
+    },
+    {
+      "if": { "properties": { "source": { "const": "stream" } } },
+      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["email"] }, { "required": ["form"] }, { "required": ["change"] }] } }
+    },
+    {
+      "if": { "properties": { "source": { "const": "change" } } },
+      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["email"] }, { "required": ["form"] }, { "required": ["stream"] }] } }
     }
   ],
   "$defs": {
@@ -98,6 +113,31 @@
         "files": { "type": "array", "items": { "$ref": "#/$defs/AttachmentRef" } }
       }
     },
+    "StreamEvent": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Present iff `source == \"stream\"` (RFC 0127). One message consumed from a streaming broker (Kafka / Kinesis / Pub-Sub); the host is the consumer and each delivered message normalizes to one TriggerEvent. The broker connection is a credential-brokered egress (RFC 0095), never a wire field.",
+      "properties": {
+        "topic": { "type": "string", "description": "The broker topic/stream/subscription name the message was consumed from." },
+        "partition": { "type": "integer", "minimum": 0, "description": "Broker partition/shard, where the broker has one. With `offset`, feeds the RFC 0127 §4 dedup-key guidance `(topic, partition, offset)`." },
+        "offset": { "type": "string", "description": "Broker offset / sequence number as an opaque string (brokers disagree on integer width)." },
+        "key": { "type": "string", "description": "The message key, where the broker has one." },
+        "message": { "description": "The consumed message payload — parsed JSON, or a string for non-JSON. Bounded by `triggerBridge.ingestion.maxBodyBytes`." }
+      }
+    },
+    "ChangeEvent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["op"],
+      "description": "Present iff `source == \"change\"` (RFC 0127). One change-data-capture record from a warehouse/database changelog. `op` is REQUIRED. The warehouse connection is a credential-brokered egress (RFC 0095), never a wire field.",
+      "properties": {
+        "op": { "type": "string", "enum": ["insert", "update", "delete"], "description": "The change operation. REQUIRED (RFC 0127 §2 / resolved Q1 — one `change` source with an `op` discriminator, not per-verb sources)." },
+        "table": { "type": "string", "description": "The source table/collection/entity name. With `changelogId`, feeds the RFC 0127 §4 dedup-key guidance `(table, changelog-id)`." },
+        "changelogId": { "type": "string", "description": "The changelog position/LSN/row-version as an opaque string." },
+        "before": { "description": "The pre-image row where the feed provides one (typically `update`/`delete`). Parsed JSON. Bounded by `triggerBridge.ingestion.maxBodyBytes`." },
+        "after": { "description": "The post-image row where the feed provides one (typically `insert`/`update`). Parsed JSON. Bounded by `triggerBridge.ingestion.maxBodyBytes`." }
+      }
+    },
     "AttachmentRef": {
       "type": "object",
       "additionalProperties": false,
@@ -144,6 +184,39 @@
         "headers": { "X-Event-Type": "issue.created" },
         "body": { "issue": { "id": 42, "title": "Bug" } }
       }
+    },
+    {
+      "source": "stream",
+      "subscriptionId": "sub_12",
+      "deliveryId": "dlv_e5f6",
+      "dedupKey": "events:3:88412",
+      "receivedAt": "2026-07-06T12:00:00Z",
+      "verified": true,
+      "contentTrust": "untrusted",
+      "stream": {
+        "topic": "events",
+        "partition": 3,
+        "offset": "88412",
+        "key": "user_77",
+        "message": { "type": "page_view", "path": "/pricing" }
+      }
+    },
+    {
+      "source": "change",
+      "subscriptionId": "sub_13",
+      "deliveryId": "dlv_a7b8",
+      "dedupKey": "contacts:lsn:0/1C4F9D0",
+      "receivedAt": "2026-07-06T12:01:00Z",
+      "verified": true,
+      "contentTrust": "untrusted",
+      "permittedPurposes": ["analytics"],
+      "change": {
+        "op": "update",
+        "table": "contacts",
+        "changelogId": "0/1C4F9D0",
+        "before": { "id": 77, "tier": "free" },
+        "after": { "id": 77, "tier": "pro" }
+      }
     }
   ]
 }

package/schemas/trigger-subscription-registration.schema.json

@@ -9,7 +9,7 @@
   "properties": {
     "source": {
       "type": "string",
-      "enum": ["webhook", "email", "form"],
+      "enum": ["webhook", "email", "form", "stream", "change"],
       "description": "The external source this subscription ingests. MUST appear in the host's `capabilities.triggerBridge.ingestion.externalSources[]`."
     },
     "workflowId": {

package/schemas/trigger-subscription.schema.json

@@ -8,7 +8,7 @@
   "required": ["subscriptionId", "source", "state"],
   "properties": {
     "subscriptionId": { "type": "string", "minLength": 1, "description": "Stable host-unique id for the subscription. Correlates the §C delivery events + the management surface." },
-    "source": { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form"], "description": "Which trigger source backs the subscription. Channels beyond these (Slack/Discord/SMS) bridge as a vendor extension by registering a subscription of the closest source kind (§E)." },
+    "source": { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form", "stream", "change"], "description": "Which trigger source backs the subscription. Channels beyond these (Slack/Discord/SMS) bridge as a vendor extension by registering a subscription of the closest source kind (§E)." },
     "state": { "type": "string", "enum": ["active", "paused", "failed", "dead-lettered"], "description": "The §B state. `active`: accepting + delivering; `paused`: retained, not delivering (operator-held); `failed`: delivery failing past policy (the webhooks.md circuit-breaker generalized); `dead-lettered`: terminal, deliveries routed to the RFC 0053 sink." },
     "dedupEnabled": { "type": "boolean", "description": "When true, the host de-duplicates inbound events by `dedupKey` within the retention window (§C-1; the idempotency.md Layer-1 model applied to inbound triggers)." },
     "retryPolicy": {

package/schemas/workflow-definition.schema.json

@@ -111,7 +111,7 @@
       "type": "object",
       "required": ["id", "typeId", "name", "position", "config", "inputs"],
       "properties": {
-        "id": { "type": "string", "minLength": 1 },
+        "id": { "type": "string", "minLength": 1, "description": "Node identifier, unique within the workflow. Intentionally has NO `maxLength` — RFC 0013 chain expansion mints ids of the form `${chainIdSlug}_${expansionId}_${fragmentId}` where `chainIdSlug` is an unbounded reverse-DNS string, so an expanded node id can exceed any short cap. A host MUST NOT reject or truncate a node id by length (no host-imposed `maxLength` stricter than this schema)." },
         "typeId": {
           "type": "string",
           "description": "Canonical node type ID (e.g., 'core.ai.callPrompt', 'core.chat.approvalGate'). Reserved prefixes: 'core.*' for spec-canonical, 'vendor.<org>.*' for third-party.",

package/src/lib/workflow-chain-expansion.ts

@@ -126,17 +126,33 @@ export class ChainUnresolvableTypeIdError extends Error {
 
 const PARAM_PATTERN = /\{\{params\.([a-zA-Z_][a-zA-Z0-9_]*)\}\}/g;
 /** A value that is EXACTLY a single `{{params.<name>}}` token (whole-value),
- *  distinct from a token embedded in a larger string. Whole-value tokens are
- *  the only non-prompt position deferrable to a variable-sourced PortValue
- *  (WCP2 raw-typed rule); an embedded non-prompt token has no runtime `{{}}`
- *  construct and MUST resolve at expansion time. */
+ *  distinct from a token embedded in a larger string. Under expansion-time
+ *  substitution a whole-value token resolves to the RAW TYPED parameter value
+ *  rather than a string coercion (WCP2 raw-typed rule); under deferred mode it
+ *  is the only non-prompt position deferrable to a variable-sourced PortValue.
+ *  An embedded non-prompt token has no runtime `{{}}` construct and MUST resolve
+ *  at expansion time. */
 const WHOLE_VALUE_PATTERN = /^\{\{params\.([a-zA-Z_][a-zA-Z0-9_]*)\}\}$/;
 
-/** Recursive literal substitution of `{{params.<name>}}` placeholders in
- *  any string field. Non-string values pass through unchanged; nested
- *  arrays/objects are walked. */
+/** Recursive substitution of `{{params.<name>}}` placeholders in any string
+ *  field. Two cases per `workflow-chain-packs.md` §"Parameter substitution":
+ *    - WHOLE-VALUE: a string that is exactly one `{{params.x}}` token resolves
+ *      to the RAW typed parameter value (object / array / number / boolean
+ *      survive as their JSON type instead of being stringified).
+ *    - EMBEDDED: one or more tokens inside surrounding text do literal string
+ *      substitution.
+ *  Non-string values pass through unchanged; nested arrays/objects are walked. */
 function substitute(value: unknown, params: Record<string, unknown>): unknown {
   if (typeof value === 'string') {
+    const whole = WHOLE_VALUE_PATTERN.exec(value);
+    if (whole) {
+      // Whole-value token — return the raw typed value so a param typed
+      // `object` / `array` / `number` / `boolean` reaches the node config
+      // intact. `undefined` (undeclared param) collapses to the empty string,
+      // matching the embedded-token convention below.
+      const v = params[whole[1] as string];
+      return v === undefined ? '' : v;
+    }
     return value.replace(PARAM_PATTERN, (_match, name: string) => {
       const v = params[name];
       // Per the spec, parameter values are validated against the chain's

package/src/scenarios/purpose-propagation.test.ts

@@ -0,0 +1,200 @@
+/**
+ * Purpose-propagation — permitted-use labels (RFC 0128) —
+ * `capabilities.md` §purposePropagation + `a2a-integration.md`
+ * §"Purpose-propagation labels".
+ *
+ * The conformance-testable core of RFC 0128 §3: a host advertising
+ * `capabilities.purposePropagation` MUST re-emit a received
+ * `permittedPurposes` label on onward OpenWOP-envelope hops (MAY narrow,
+ * MUST NOT widen), a derived output MUST NOT carry a purpose absent from any
+ * contributing labelled input, and `[]`-labelled data MUST NOT be forwarded
+ * onward at all. The internal-use restriction (§4) is deliberately NOT tested
+ * — it is not observable over the wire.
+ *
+ * Two layers:
+ *
+ *   A. Always-on, server-free schema probes:
+ *      - a labelled TriggerEvent validates; a non-array label fails;
+ *      - absent vs `[]` are distinct wire states (both validate — the
+ *        semantic difference is behavioral, asserted in layer B);
+ *      - the `capabilities.purposePropagation` family shape: `supported`
+ *        REQUIRED, `additionalProperties:false`.
+ *
+ *   B. Capability-gated behavioral legs via the two-hop seam
+ *      `POST /v1/host/sample/purpose-propagation/forward` (the suite plays
+ *      hop A — the labelled sender — and hop C — the onward receiver — around
+ *      the host at B). Soft-skips when the seam is unwired (404/405);
+ *      REQUIRED once `purposePropagation.supported` is advertised
+ *      (advertise-only-what-you-honor):
+ *      1. survive/narrow — a forwarded label arrives ⊆ what B received;
+ *      2. never-widen — strictly no purpose beyond the input set;
+ *      3. derived output — a merge of two labelled inputs arrives ⊆ their
+ *         intersection (multi-input never-widen — transformation does not
+ *         launder a grant);
+ *      4. unlabelled inputs add no constraint to a merge;
+ *      5. `[]` fail-closed — a `[]`-labelled record is dropped from onward
+ *         emission, with an unlabelled twin as the positive control
+ *         (non-arrival is evidence, not a timeout artifact).
+ *
+ * @see RFCS/0128-purpose-propagation-permitted-use-labels.md §3
+ * @see spec/v1/capabilities.md §purposePropagation
+ * @see spec/v1/a2a-integration.md §"Purpose-propagation labels"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR, FIXTURES_DIR } from '../lib/paths.js';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+const SEAM = '/v1/host/sample/purpose-propagation/forward';
+
+interface OnwardEmission {
+  recordId?: string;
+  surface?: string;
+  permittedPurposes?: string[];
+}
+interface ForwardResponse {
+  onward?: OnwardEmission[];
+  dropped?: string[];
+}
+
+function subsetOf(actual: string[] | undefined, allowed: string[]): boolean {
+  return (actual ?? []).every((p) => allowed.includes(p));
+}
+
+describe('purpose-propagation: label schema (always-on, server-free)', () => {
+  const ajv = new Ajv2020({ allErrors: true, strict: false });
+  addFormats(ajv);
+  const validate = ajv.compile(JSON.parse(readFileSync(join(SCHEMAS_DIR, 'trigger-event.schema.json'), 'utf8')));
+  const FIXTURE = join(FIXTURES_DIR, 'trigger-events', 'trigger-event-change.json');
+
+  it('a labelled TriggerEvent validates; a non-array label fails', () => {
+    const ev = JSON.parse(readFileSync(FIXTURE, 'utf8'));
+    expect(validate(ev), `a labelled TriggerEvent MUST validate (RFC 0128 §1). Errors: ${JSON.stringify(validate.errors)}`).toBe(true);
+
+    ev.permittedPurposes = 'analytics';
+    expect(validate(ev), 'RFC 0128 §1 — permittedPurposes MUST be string[]').toBe(false);
+  });
+
+  it('absent and [] are BOTH wire-valid — distinct states (unlabelled vs no-onward-use)', () => {
+    const ev = JSON.parse(readFileSync(FIXTURE, 'utf8'));
+    delete ev.permittedPurposes;
+    expect(validate(ev), 'RFC 0128 §1 — an unlabelled event (absent label) MUST validate').toBe(true);
+    ev.permittedPurposes = [];
+    expect(validate(ev), 'RFC 0128 §1 — a []-labelled event MUST validate (behavioral meaning: no onward use)').toBe(true);
+  });
+
+  it('the capabilities.purposePropagation family requires `supported` and closes its shape', () => {
+    const caps = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'capabilities.schema.json'), 'utf8'));
+    const fam = caps.properties?.purposePropagation;
+    expect(fam, 'capabilities.schema.json MUST define the purposePropagation family (RFC 0128 §2)').toBeDefined();
+    expect(fam.required, 'purposePropagation MUST require `supported`').toContain('supported');
+    expect(fam.additionalProperties, 'purposePropagation MUST close its shape').toBe(false);
+    const ajvFam = new Ajv2020({ allErrors: true, strict: false });
+    const vf = ajvFam.compile(fam);
+    expect(vf({ supported: true, propagatesOnward: true }), 'the canonical advert MUST validate').toBe(true);
+    expect(vf({ propagatesOnward: true }), 'an advert without `supported` MUST fail').toBe(false);
+  });
+});
+
+describe.skipIf(HTTP_SKIP)('purpose-propagation: two-hop onward behavior (capability-gated)', () => {
+  async function seamPost(body: Record<string, unknown>): Promise<ForwardResponse | null> {
+    const res = await driver.post(SEAM, body);
+    if (res.status === 404 || res.status === 405) return null; // seam unwired — soft-skip
+    return (res.json as ForwardResponse | undefined) ?? {};
+  }
+
+  async function gate(): Promise<boolean> {
+    const fam = await readCapabilityFamily<{ supported?: boolean }>('purposePropagation');
+    return behaviorGate('purposePropagation', fam?.supported === true);
+  }
+
+  it('a forwarded label survives ⊆ the received set (re-emit; MAY narrow, MUST NOT widen)', async () => {
+    if (!(await gate())) return;
+    const input = ['analytics', 'marketing-email'];
+    const res = await seamPost({ mode: 'forward', records: [{ id: 'r1', permittedPurposes: input, data: { k: 1 } }] });
+    if (res === null) return;
+
+    const onward = res.onward ?? [];
+    expect(
+      onward.length > 0,
+      driver.describe('RFC 0128 §3', 'an advertising host MUST re-emit a received label on the onward hop — silent loss fails (the promise is propagation)'),
+    ).toBe(true);
+    for (const o of onward) {
+      expect(
+        Array.isArray(o.permittedPurposes) && subsetOf(o.permittedPurposes, input),
+        driver.describe('RFC 0128 §3', `the onward label MUST be a subset of what the host received — got ${JSON.stringify(o.permittedPurposes)} vs input ${JSON.stringify(input)} (widening is the testable violation)`),
+      ).toBe(true);
+    }
+  });
+
+  it('a derived (merged) output arrives ⊆ the intersection of contributing labelled inputs', async () => {
+    if (!(await gate())) return;
+    const res = await seamPost({
+      mode: 'merge',
+      records: [
+        { id: 'a', permittedPurposes: ['analytics', 'marketing-email'], data: { k: 1 } },
+        { id: 'b', permittedPurposes: ['analytics'], data: { k: 2 } },
+      ],
+    });
+    if (res === null) return;
+    const onward = res.onward ?? [];
+    expect(onward.length > 0, driver.describe('RFC 0128 §3', 'a merge of forwardable labelled inputs MUST produce an onward emission')).toBe(true);
+    for (const o of onward) {
+      expect(
+        subsetOf(o.permittedPurposes, ['analytics']),
+        driver.describe('RFC 0128 §3', `a derived output MUST NOT carry a purpose absent from any contributing labelled input — transformation does not launder a grant; got ${JSON.stringify(o.permittedPurposes)}, allowed ⊆ ["analytics"]`),
+      ).toBe(true);
+    }
+  });
+
+  it('an unlabelled input adds no constraint to a merge', async () => {
+    if (!(await gate())) return;
+    const res = await seamPost({
+      mode: 'merge',
+      records: [
+        { id: 'a', permittedPurposes: ['analytics'], data: { k: 1 } },
+        { id: 'b', data: { k: 2 } },
+      ],
+    });
+    if (res === null) return;
+    for (const o of res.onward ?? []) {
+      expect(
+        subsetOf(o.permittedPurposes, ['analytics']),
+        driver.describe('RFC 0128 §3', 'an unlabelled input asserts no constraint — the derived label is still bounded by the labelled input(s)'),
+      ).toBe(true);
+    }
+  });
+
+  it('[]-labelled data is fail-closed dropped from onward emission (positive control: unlabelled twin forwards)', async () => {
+    if (!(await gate())) return;
+    const res = await seamPost({
+      mode: 'forward',
+      records: [
+        { id: 'blocked', permittedPurposes: [], data: { k: 1 } },
+        { id: 'control', data: { k: 1 } },
+      ],
+    });
+    if (res === null) return;
+
+    const onwardIds = (res.onward ?? []).map((o) => o.recordId);
+    expect(
+      !onwardIds.includes('blocked'),
+      driver.describe('RFC 0128 §3', 'permittedPurposes: [] means no onward use — a conformant host MUST NOT forward []-labelled data to a further sink at all'),
+    ).toBe(true);
+    expect(
+      (res.dropped ?? []).includes('blocked'),
+      driver.describe('RFC 0128 §3', 'the []-labelled record MUST be reported dropped (fail-closed, observable)'),
+    ).toBe(true);
+    expect(
+      onwardIds.includes('control'),
+      driver.describe('RFC 0128 §3', 'the unlabelled twin (positive control) MUST forward — proving the non-arrival of the []-labelled record is the rule firing, not a dead seam'),
+    ).toBe(true);
+  });
+});