@openwop/openwop-conformance 1.53.0 → 1.54.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [1.54.0] — 2026-07-06 — RFC 0129 data-residency admission control
+
+Adds `data-residency-admission.test.ts` (suite 386 → 387) for **RFC 0129 — Data-residency**. Always-on server-free layer: `capabilities.dataResidency` family shape (`supported` const-true + `regions` non-empty array, closed); `residency.schema.json` (`region` REQUIRED, closed); `residency_unavailable` registered in `rest-endpoints.md`. Capability-gated behavioral legs drive the NORMATIVE `POST /v1/runs` endpoint (no host-sample seam): an ADVERTISED region MUST NOT be rejected `residency_unavailable` (accept iff advertised); an UNADVERTISED region MUST be rejected with `{error:{code:"residency_unavailable"}}` at HTTP one-of 400/404/422 and create NO run (fail-closed; advertise-only-what-you-honor — a hollow advert that accepts an unadvertised region fails). The physical-confinement §4 SHOULD is deliberately NOT tested (unobservable over the wire). Gate: `dataResidency` advertised (soft-skip absent; hard-fail under `OPENWOP_REQUIRE_BEHAVIOR=true`). This is the RFC 0129 → Accepted bar (single-witness: openwop-app tier-1).
+
+## [1.53.1] — 2026-07-06 — fix: purpose-propagation behavioral legs are seam-gated, not advertisement-gated
+
+`purpose-propagation.test.ts`'s four two-hop behavioral legs gated on `capabilities.purposePropagation.supported` being advertised. That made a non-vacuous graduation witness impossible: RFC 0128 is `Active`, and `capabilities.md` §purposePropagation prohibits advertising `purposePropagation.supported:true` until it reaches `Accepted` — so under `OPENWOP_REQUIRE_BEHAVIOR=true` an honest-off host could only soft-skip (vacuous), yet an advertising host would breach the pre-Accepted prohibition. Re-gated the legs onto **seam availability** (the `POST /v1/host/sample/purpose-propagation/forward` seam returning non-404) instead of the advert — matching how RFC 0122's `self-hosted-runner.test.ts` behavioral legs are seam-gated and witnessed non-vacuously with `selfHostedRunner.supported:false`. The host now witnesses honest-OFF: the seam runs behind its feature flag, the assertions execute against real onward/dropped output, and non-vacuity is proven by the live seam + the steward's independent curl. No scenario-count change (386); schema-probe layer + RFC 0127 scenario unchanged.
+
 ## [1.53.0] — 2026-07-06 — RFC 0127 streaming/CDC trigger sources + RFC 0128 purpose-propagation labels (CDP Track-2)
 
 Adds `trigger-stream-cdc-sources.test.ts` + `purpose-propagation.test.ts` (suite 384 → 386) for the two `Active` CDP Track-2 RFCs.

package/README.md

@@ -92,7 +92,7 @@ Exit code is non-zero on any failed assertion.
 
 ## What's Covered
 
-The current suite has 386 scenario files under `src/scenarios/`. 2026-07-06 (RFC 0127 + RFC 0128 — CDP Track-2, suite `1.52.0 → 1.53.0`) added `trigger-stream-cdc-sources.test.ts` (always-on schema probes for the `stream`/`change` TriggerEvent sub-objects — `op` REQUIRED negative, exactly-one rule, registration + capabilities vocabulary pins — plus capability-gated behavioral legs driving the existing `/v1/host/sample/trigger-bridge/ingest` + `/deliver` seams: schema-valid delivered envelopes, SR-1 content-free durable events with a body canary, `(topic,partition,offset)` dedup effectively-once) and `purpose-propagation.test.ts` (always-on `permittedPurposes` + `capabilities.purposePropagation` family shape probes, plus the capability-gated two-hop legs via the new `POST /v1/host/sample/purpose-propagation/forward` seam: onward label ⊆ received, derived-output ⊆ intersection of labelled inputs, unlabelled adds no constraint, `[]` fail-closed dropped with an unlabelled positive control). Both behavioral suites soft-skip pre-implementation and become REQUIRED once the host advertises the surface (advertise-only-what-you-honor). 2026-07-05 (RFC 0013 erratum A-lite — bundle + load the sample-pack fixture, suite `1.51.0 → 1.52.0`) bundled the `vendor.openwop.workflow-chain-sample` pack into the conformance package at `fixtures/pack-manifests/workflow-chain-sample.pack.json` (host-syncable, ships in `files`) and refactored `workflow-chain-host-expansion.test.ts` to **load** it + derive the expected expansion from the `expandChain()` reference library instead of hardcoding — so a live host serving `POST /v1/host/sample/workflow-chain:expand` is checked against the spec algorithm for the identical published pack (closes the RFC 0013 host-expansion witness's fixture gap; the seam still soft-skips until a host advertises `workflowChainPacks.hostExpansionSeam`). `fixtures-valid.test.ts` now schema-selects pack-manifest fixtures by `kind` (node-pack vs workflow-chain-pack). No scenario-file count change. 2026-07-05 (RFC 0013 erratum — host-expansion test seam decouple, suite `1.50.0 → 1.51.0`) re-gated `workflow-chain-host-expansion.test.ts` from the semantic `workflowChainPacks.supported` claim onto a new OPTIONAL `workflowChainPacks.hostExpansionSeam` test-harness sub-flag (no scenario-file count change), so a host advertising `workflowChainPacks.supported` / RFC 0124 `deferredParameters.supported` is no longer conscripted into the never-bundled `vendor.openwop.workflow-chain-sample` seam under `OPENWOP_REQUIRE_BEHAVIOR` — the semantic claim rides the server-free `workflow-chain-expansion.test.ts` legs, RFC 0124's deferred path its own `/chain/deferred-expand` seam. 2026-07-04 (RFC 0124 — portable per-run parameter deferral, suite `1.49.0 → 1.50.0`) added `workflow-chain-deferred-parameters.test.ts` (always-on, server-free legs against the reference `expandChainDeferred` in `conformance/src/lib/workflow-chain-expansion.ts`: non-sensitive deferral materializes `variables[]` with `defaultValue`+`type` and leaves ZERO `{{params.*}}` tokens (R3), a whole-value input token → variable-sourced PortValue, the bare param name is the auto-generated `configurableSchema` override key (R6); §Security legs: a `x-openwop-sensitive` prompt-body param materializes `source:"secret"` with the plaintext appearing NOWHERE — not bagged — a sensitive whole-value `node.input` fails closed `sensitive_param_not_deferrable` (422), a sensitive param on a host without `secrets` support fails closed, and a host without a `prompts.variable` source falls back to expansion-time (G5); plus schema-surface legs pinning the amended `source:"secret"` wording in the manifest schema + the `credentialRef` per-run supply shape; capability-gated host legs over `POST /v1/host/sample/chain/deferred-expand` for the bare-param override / `:fork` replay / `contentTrust:"untrusted"` fence / `[REDACTED]` sensitive compose, soft-skip 404/403). 2026-07-04 (RFC 0126 — data-parallel dispatch per-item input, suite `1.48.0 → 1.49.0`) added `dispatch-per-item-input.test.ts` (always-on, server-free schema legs on `orchestrator-decision.schema.json` §NextWorkerDecision: a well-formed index-aligned `nextWorkerInputs` validates, a decision omitting it stays valid (additive/back-compat), a non-object item and a non-array are rejected, a mis-named `perItemInputs` is rejected by `additionalProperties:false` (the fail-closed rail for pre-RFC-0126 strict validators), and a length-mismatch is ADMITTED at the wire because `nextWorkerInputs.length == nextWorkerIds.length` is not JSON-Schema-expressible — a host runtime MUST; capability-gated behavioral legs over `POST /v1/host/sample/dispatch/per-item` asserting a host advertising `capabilities.dispatch.perItemInput` projects `nextWorkerInputs[i]` into child `i` (per-item value wins over `inputMapping`), a length-mismatch fails with a `validation_error` dispatching no child, and a host NOT advertising the capability fails closed on a non-empty `nextWorkerInputs` rather than silently dropping it and dispatching N identical children; soft-skips on 404/403). 2026-07-02 (RFC 0122 — self-hosted runner, suite `1.47.0 → 1.48.0`) added `self-hosted-runner.test.ts` (always-on schema legs for the `selfHostedRunner` capability block + the dispatch/result/registration frame shapes; an advertisement-gated block-shape leg; capability-gated behavioral legs over `POST /v1/host/sample/runner/{register,dispatch}` asserting subject-first isolation, retriable `runner_unavailable`, and at-most-once dedup — the public test for the protocol-tier `runner-credential-non-transit` + `runner-output-untrusted-transport` invariants; soft-skips on 404). 2026-07-01 (RFC 0121 — subscription-reuse provider auth mode, suite `1.46.0 → 1.47.0`) added `aiproviders-subscription-scope.test.ts` (always-on schema leg: the `aiProviders.authModes` closed enum includes `subscription`; §B.7 advertisement-gated leg: a `subscription` provider MUST appear in `byok`; §B.8 bind-seam-gated leg over `POST /v1/host/sample/credentials/bind` asserting a tenant-scope binding is rejected with `credential_scope_forbidden` — the public test for the protocol-tier `subscription-credential-user-scope-only` invariant. §B.8 is gated on the seam rather than on advertisement, so a host that cannot lawfully advertise `subscription` can still witness the user-scope safety rail; soft-skips when the seam is unwired). 2026-06-29 (RFC 0120 — connection-pack `apiHosts` credential-egress allow-list, suite `1.45.0 → 1.46.0`) added `connection-pack-apihosts.test.ts` (always-on schema legs: the `connection-pack-apihosts-valid` fixture validates, an `openapi`-reach provider omitting `apiHosts` is rejected by the conditional-MUST `allOf`, and IP/wildcard/port/single-label/uppercase entries are each rejected; always-on matching-rule legs: the item-10 dot-anchored eTLD+1 suffix-containment rule permits subdomains + a tighter exact host and fails closed with no substring/suffix/prefix escape — the public tests for the protocol-tier `connection-pack-api-host-shape` + `connection-pack-egress-host-bound` invariants; plus a capability-gated behavioral egress allow-list leg over the new `POST /v1/host/sample/connection-packs/egress-check` seam, soft-skipping when unadvertised/unwired). 2026-06-28 (RFC 0118 — parallel sub-workflow fan-out and join, suite `1.44.0 → 1.45.0`) added `dispatch-fanout-parallel.test.ts` (always-on schema legs for `dispatch-config.schema.json` — accepts a valid `parallel` config + each `joinPolicy.mode` + `maxConcurrency`, rejects unknown enum values / `additionalProperties` on `joinPolicy` / non-positive `maxConcurrency`, keeps a pre-RFC-0118 config valid — and the `dispatchFanOut`/`dispatchJoin` event `$defs` of `run-event-payloads.schema.json` — `fanOutPolicy` const `parallel`, `childCount ≥ 2`, the required replay-deterministic `mergeOrder`; capability-gated behavioral legs over `POST /v1/host/sample/dispatch/fanout` (wait-all/collect → `joinOutcome: satisfied` + full `children[]` + `mergeOrder`) plus the un-gated registration-rejection leg (`fanOutSupported:false` host MUST reject `parallel` with a 4xx); soft-skips on absent `dispatch.fanOutSupported` / `parallel` ∉ `fanOutPolicies`). 2026-06-27 (RFC 0117 — front-end plugin packs, suite `1.43.0 → 1.44.0`) added `frontend-plugin-packs.test.ts` (always-on schema legs for `frontend-plugin-manifest.schema.json` + the `ui-plugin/1` envelope `ui-plugin-message.schema.json`: manifest validity, `runtime`-forbidden, path-traversal-guarded `entry`, the closed `hostApi` allowlist, the version-token `artifact_conflict` + `currentVersion` concurrency shape, and no credential-bearing envelope field (`additionalProperties:false`); the capability-shape leg asserts `isolation` pins to the `cross-origin-iframe` const; capability-gated behavioral legs over `POST /v1/host/sample/ui-plugin/rpc` assert an undeclared method → `method_not_allowed` and a stale `artifact.write` → `artifact_conflict` with no persist; soft-skips on absent `capabilities.uiPlugins.supported` or `404`/`403` on the seam (RFC 0117 stays Active pending host witnesses); the public test for the protocol-tier `frontend-plugin-{isolation,egress,rpc-allowlist,no-byok}` invariants). 2026-06-26 (RFC 0116 — portable prompt-prefix cache, suite `1.42.0 → 1.43.0`) added `prompt-prefix-cache.test.ts` (advertisement-shape on `aiProviders.promptPrefixCache` + behavioral legs over the OPTIONAL `POST /v1/host/sample/ai/generate` seam (`host-sample-test-seams.md` §16): (a) outcome-invariance — a generate with `cachePrefixId` and a control without produce the same accepted envelope + identical `provider.usage.inputTokens`/`outputTokens` (cost-hint-only, replay-invariant); (b) cache-hit observable — a repeat generate shows `cacheReadTokens > 0`; (c) cross-tenant isolation — tenant B’s first use of tenant A’s `cachePrefixId` shows `cacheReadTokens == 0`, the public test for the protocol-tier `prompt-prefix-cache-cross-tenant-isolation` invariant (the host MUST key its provider cache by `(tenant, cachePrefixId)`, never global); (d) secret-free — the cost-only cache-token fields carry no prompt substrings (SR-1); soft-skips on absent `aiProviders.promptPrefixCache.supported` or `404`/`405` on the seam, since RFC 0116 defers reference-host impl as provider-gated). 2026-06-26 (RFC 0114 — A2UI surface deltas, suite `1.41.0 → 1.42.0`) added `a2ui-surface-delta-transport.test.ts` (always-on legs use a cast-free, dependency-free client-side RFC 6902 applier + Ajv2020 to assert: the new `a2ui-surface-delta-frame.schema.json` compiles, the op enum excludes `test`, a full surface + delta frames reconstruct the expected tree AND equal the full a non-negotiating subscriber materializes and re-validate against the closed catalog, an out-of-catalog/script-bearing delta fails closed-catalog validation post-patch — the `a2ui-surface-no-code-exec` boundary holds — and the recorded envelope is always the full surface; the HTTP leg is capability-gated on `a2uiSurface.deltaTransport` and soft-skips on absent host/capability or `404`/`405` on the OPTIONAL `GET /v1/host/sample/a2ui/surface/materialized` seam). 2026-06-26 (RFC 0111 — context economy, suite `1.40.0 → 1.41.0`) added `context-budget-transcript-bound.test.ts` (capability-gated on `multiAgent.executionModel.contextBudget.transcriptTokenBudget` being present via `behaviorGate(openwop-context-budget, …)` — drives the `conformance-context-budget-multiturn` orchestrator fixture, reads the host’s per-iteration accounting via the OPTIONAL seam `GET /v1/host/sample/agent/transcript-window?runId=…&iteration=N` (`host-sample-test-seams.md` §14), and asserts `tokenCount ≤ transcriptTokenBudget` in the advertised `tokenCounter` unit, that every `eventId` in the seam accounting is a real persisted run event (internal-consistency cross-check against `/v1/host/sample/test/runs/:runId/events`), recent-tail + no-double-count, every `summarizedRanges.summaryRef` has a matching `context.summarized` event, and `keepLastTurns` recent turns are fed verbatim — never inside a summarized range; soft-skips on `404`/`405` since the RFC defers reference-host impl) + `context-summarization-replay.test.ts` (capability-gated on `multiAgent.executionModel.contextBudget.summarization.supported` via `behaviorGate(openwop-context-summarization, …)` — replays the run via `:fork mode:replay` and asserts the recorded `context.summarized` → `summaryRef` records are REUSED, never re-summarized, the direct analogue of RFC 0041 envelope-refusal recovery; soft-skips when the event-log seam is unwired, no `replay` mode is advertised, or the run produced no summarization). 2026-06-26 (RFC 0113 — memory injection budget, suite `1.39.0 → 1.40.0`) added `memory-injection-budget.test.ts` (capability-gated on `memory.injectionBudget.supported === true` via `behaviorGate(openwop-memory-injection-budget, …)` — drives the `conformance-agent-memory-injection-budget` fixture through the host-sample memory seam and asserts the budgeted injection read's cumulative tokens ≤ the requested `tokenBudget` in the advertised `tokenCounter` unit (`o200k_base`/`cl100k_base`/`chars`/`host-defined`), an over-budget single entry is omitted not truncated, and re-asserts SR-1 (`[REDACTED:<secretId>]` content) + CTI-1 (cross-tenant probe returns empty) on the budgeted path; the `rank:'relevance'` leg DELEGATES to `memory.search` semantic (RFC 0080) and asserts relevance ordering differs from recency ONLY when the host ALSO advertises `memory.search` semantic, else it soft-skips — there is NO ranking primitive in `injectionBudget`; soft-skips on hosts that do not advertise `memory.injectionBudget`). 2026-06-26 (RFC 0112 — compact tool projection, suite `1.38.0 → 1.39.0`) added `tool-catalog-compact-projection.test.ts` (capability-gated on `toolCatalog.compactView === true` via `behaviorGate(openwop-tool-catalog-compact, …)` — drives `GET /v1/tools?view=compact` and asserts the host returns the `{ tools: CompactToolDescriptor[] }` envelope where every descriptor validates against `compact-tool-descriptor.schema.json` with the heavy `ToolDescriptor` fields dropped, every present `inputSchema` satisfies the self-contained compact structural subset (top-level `type:"object"`+`properties`; no `$ref`/`oneOf`/`allOf`/`anyOf`/`not`/`patternProperties`/`dependentSchemas`), and the compact `tools[]` `toolId` set EQUALS the standard view set for the same principal (projection completeness); soft-skips on hosts that do not advertise `toolCatalog.compactView`). 2026-06-26 (RFC 0115 — run transport economy, suite `1.37.0 → 1.38.0`) added `run-transport-economy.test.ts` (capability-gated on `restTransport.conditionalRunGet === true` and a non-empty `restTransport.contentEncodings` — drives `GET /v1/runs/{runId}` and asserts a sequence-derived strong `ETag` on the `200`, `If-None-Match` → `304` with an empty body while the run is unchanged, the `ETag` ROTATES after the `conformance-approval` fixture advances `waiting-approval → completed` (proving it derives from the latest persisted event-log sequence, not a coarser signal that would leave a `304` stale), and each advertised `Content-Encoding` (`gzip` baseline; `br`/`zstd` optional) round-trips byte-identically to the identity body; soft-skips on hosts that do not advertise `restTransport`). 2026-06-24 (RFC 0110 — channel presence, behavioral leg) added `channel-presence-behavioral.test.ts` (capability-gated on `channelPresence.supported` via `behaviorGate('openwop-channel-presence', …)` — drives the `POST /v1/host/sample/channel-presence/snapshot` seam and asserts a live `channel.presence` snapshot is the CLOSED `{conversationId,present,typing}` shape (no PII), every ref is an opaque RFC 0041 `user:`/`agent:` subject, `typing ⊆ present`, and the snapshotting member is non-vacuously present; soft-skips on 404/405 — a host whose presence is bound to a product flow witnesses via its own route test + an INTEROP-MATRIX row, the RFC 0086 dual-staging). 2026-06-24 (RFC 0110 — channel presence, Accept cycle) added `channel-presence-shape.test.ts` (always-on server-free — the OPTIONAL `channel.presence` ephemeral payload validates a conforming snapshot, REQUIRES `conversationId`+`present`, is CLOSED `additionalProperties:false` (the no-PII guard), `typing` optional; `channel.presence` is in the `RunEventType` enum; the `channelPresence` capability block is declared + closed). 2026-06-24 (RFC 0109 — conversation-turn model provenance, Accept cycle) added `conversation-turn-model-provenance-shape.test.ts` (always-on server-free — `agent.model` `{provider, model}` validates conforming / both-required / closed-SR-1 / optional-back-compat, + the `conversationTurnModelProvenance` capability declared + closed). 2026-06-24 (RFC 0108 — self-hosted / OpenAI-compatible provider class, Accept cycle, suite `1.36.0 → 1.37.0`) added the gated behavioral honesty leg `aiproviders-selfhosted-honesty.test.ts` (gated on `aiProviders.selfHosted.length > 0` via `behaviorGate('openwop-selfhosted-providers', …)` — drives `POST /v1/host/sample/ai/call` against an advertised `selfHosted` id and asserts **§A.2** the dispatch reaches a real configured endpoint (success or transport error — never `capability_not_provided` / `provider_not_supported`, which would prove a dishonest advertisement with no endpoint behind it) and **§D** the endpoint location — supplied out-of-band via `OPENWOP_TEST_COMPAT_ENDPOINT`, checked as the raw string + bare `host`/`host:port` — never appears in the seam response or error payload; soft-skips on 404 / when the env var is unset for the §D leg). 2026-06-24 (RFC 0108, suite `1.35.0 → 1.36.0`) added the always-on server-free shape leg `aiproviders-selfhosted-shape.test.ts` (the additive `aiProviders.selfHosted` advertisement: a `string[]` with `uniqueItems`/`minLength:1` items, absent from `aiProviders.required`, validates a conforming array via Ajv2020 while rejecting non-array / duplicate / empty-string forms, and enforces the two §A rules JSON Schema cannot express — §A.1 every `selfHosted` entry is a subset of `supported`, and §A.3 / `self-hosted-endpoint-no-disclosure` no entry is URL-shaped (`://`, bare `host:port`, or leading `/` path) — exercised against good/bad example docs). 2026-06-23 (RFC 0106 — real-time voice session profile, Accept cycle) added six gated behavioral scenarios driving the openwop-app live host (rev `00293-89w`): `voice-transcription-streaming` + `voice-transcription-unadvertised` (the `call-transcriber` seam; the latter gated-by-absence), `voice-synthesis-streaming` (the `stream:true` synthesis arm → metadata-only `voice.synthesis_chunk` events), `voice-bargein-no-partial-leak` (the `/voice/barge-in` seam — `voice.barge_in`→`voice.cancelled` with no chunk after; **graduated `voice-bargein-no-partial-leak` reference-impl→protocol** on the live proof), and `voice-interim-not-durable` + `voice-streamref-tenant-bound` (§F INV-1/INV-4; soft-skip on the §E `transcription_unsupported` / no-live-streamRef path — stay reference-impl until a host with a scripted-interim / live-streamRef arm proves them). 2026-06-23 (RFC 0107 — publishable declarative pack kinds) added one: `registry-declarative-kinds.test.ts` (always-on server-free — the registry version-manifest carries the `kind` discriminator + per-kind declarative payload, `runtime` is conditional on `kind` via `allOf if/then/else`, published artifact-type and connection manifests validate, and a declarative-with-`runtime` or node-without-`runtime` manifest is rejected). 2026-06-23 (RFC 0107 correction, suite `1.34.0 → 1.35.0`) extended that scenario with two cases — a published **chat-card** pack manifest (`kind: "card"`, RFC 0071) validates, and the never-canonical `kind: "chat-card"` is **rejected** — fixing a kind-string mismatch where RFC 0107's published schema enumerated `chat-card` while RFC 0071 (authoritative) defines `card` (no scenario-file count change; cases added to the existing file). 2026-06-23 (RFC 0106 — real-time voice session profile, Phase 2) added one: `voice-event-payloads-shape.test.ts` (always-on server-free — all seven `voice.*` types are in the `RunEventType` enum, each has a payload `$def` via `typeIndex`, `voice.transcript` REQUIRES `contentTrust:"untrusted"` (the schema-enforced half of `voice-transcript-untrusted`), `voice.synthesis_chunk` is metadata-shaped (seq+mimeType required; bytes by `url`/`streamRef`), and the content-free events reject unknown properties). Phase 2 also lands the `voice.*` payload `$defs` in `run-event-payloads.schema.json` + the `asyncapi.yaml` messages + the four §F `SECURITY/invariants.yaml` rows (1 protocol-tier `voice-transcript-untrusted` + 3 reference-impl behavioral, graduating at `Active → Accepted`). The gated behavioral legs (`voice-transcription-streaming`/`-unadvertised`, `voice-synthesis-streaming` + the three behavioral invariant scenarios) land with the reference host at `Active → Accepted`. 2026-06-23 (RFC 0106 — real-time voice session profile, Phase 1) added one: `aiproviders-realtimevoice-shape.test.ts` (always-on server-free — the `aiProviders.realtimeVoice` object advertisement: the four sub-flags `transcription`/`synthesis`/`turnDetection`/`bargeIn` are declared, `realtimeVoice` is absent from `aiProviders.required`, the `turnDetection`/`bargeIn ⇒ transcription` `dependentRequired` closure and the `synthesis ⇒ speechSynthesis` if/then closure hold via Ajv2020, and out-of-enum / boolean sub-flag values are rejected). The gated behavioral legs (`voice-transcription-streaming` / `-unadvertised`, `voice-synthesis-streaming`) and the four §F live-ingress invariant scenarios land in Phase 2 at the `Active → Accepted` cycle. 2026-06-22 (RFC 0101 — multi-party group conversation) added two — `multi-party-conversation-shape.test.ts` (always-on server-free — asserts the three additive RFC 0101 wire facts: a 3-agent council `conversation.opened` participant roster (instance ids) + a user opening turn validates, every `role: 'agent'` turn carrying a roster-instance `speakerId` validates while one OMITTING `speakerId` MUST FAIL schema validation (the `allOf`/`if role==='agent' then required:['speakerId']` conditional), a non-AgentRef participant item is rejected, the `capabilities.multiPartyConversation { supported, maxParticipants? }` block is declared + closed and rejects extras / `maxParticipants:1` / a missing `supported`, and the non-participant membership predicate is asserted server-free) and `multi-party-conversation-behavioral.test.ts` (capability-gated on `multiPartyConversation.supported` via `behaviorGate('openwop-multi-party-conversation', …)` — drives the conformance-only seam `POST /v1/host/sample/conversation/multi-party/{open,exchange}` (`host-sample-test-seams.md`, since RFC 0101 mints no normative client trigger to open a council): a 3-agent council opens and a roster-valid attributed agent turn is accepted, while a `role:'agent'` turn missing `speakerId`, a non-participant `speakerId`, and an over-`maxParticipants` open are each rejected with `error.code:'validation_error'` (status-tolerant 400/422 per RFC 0005 §E); soft-skips on 404/405 — reference impl: the postgres example host). 2026-06-20 (RFC 0105 — speech synthesis adapter) added three: `aiproviders-speechsynth-shape.test.ts` (always-on server-free — the `aiProviders.speechSynthesis` `const "supported"` flag is declared, absent from `aiProviders.required`, and a string-const advertisement validates while the object form `{supported:true}` is rejected), `speech-synthesis-roundtrip.test.ts` (gated on `aiProviders.speechSynthesis === "supported"` via `behaviorGate('openwop-speech-synthesis', …)` — an advertising host's `callSpeechSynthesizer` round-trip via the `POST /v1/host/sample/ai/call-speech-synthesizer` seam returns `audio` with EXACTLY ONE of `url`/`base64`, a non-empty `mimeType`, and the echoed `voiceId`; soft-skips on 404), and `speech-synthesis-unadvertised.test.ts` (gated-by-absence via `behaviorGate('openwop-speech-synthesis-unadvertised', …)` — a host NOT advertising `speechSynthesis` MUST reject the call with `speech_synthesis_unsupported`, never a silent no-op). 2026-06-19 (RFC 0104 — portable HITL approver routing) added one: `interrupt-approver-routing.test.ts` (server-free Ajv2020 — the `interrupt.approverRouting` capability block shape, the additive optionality of `approverGroupRefs` / `approverRoleRefs` / `audience` on the `ApprovalData` schema, the closed `audience` object, and the §"Portable approver routing" `notifyTargets` reference rule that `audience` DEFAULTS to the resolved eligibility union when omitted and OVERRIDES it when present; the capability-gated leg asserts an advertising host's `interrupt.approverRouting` is honest — `refKinds` ⊆ {group, role}, `audience` boolean — and soft-skips when the host does not advertise the capability). 2026-06-17 (RFC 0103 — localized content surface) added one: `localized-content-delivery.test.ts` (server-free Ajv2020 — the four content schemas + the §C `resolveSection` merge + §A capability coherence; the public test for `content-published-cache-no-draft` / `content-response-tenant-scoped` / `content-no-cross-tenant-enumeration`; the live legs gate on `capabilities.content.supported` and soft-skip without a `GET /v1/content/pages/{slug}` target). 2026-06-15 (RFC 0102 — A2UI agent-authored interface surfaces) added five: `a2ui-surface-shape.test.ts` (server-free Ajv2020 — the closed core `ui.a2ui-surface` payload validates, while an out-of-catalog component / extra script-bearing property / unenumerated `catalogVersion` / `action.target` outside `enum["resume","exchange"]` each fail; the structural half of `a2ui-action-confinement` and the enabling precondition for the render-side `a2ui-surface-no-code-exec` / `a2ui-surface-no-network-egress` reference-app probes), `a2ui-surface-degrades.test.ts` (the kind is optional/advertised, not a MUST-recognize universal kind, and an unadvertised kind is gated — N6 — never crashing the run), `a2ui-surface-version-refusal.test.ts` (the enumerated `catalogVersion` rejects an unadvertised version → `unknown_schema_version`, and the surface schema carries no external `$ref`), `a2ui-surface-replay.test.ts` (all `$ref`s internal so a stored surface `:fork`/replays deterministically; same-`correlationId` + divergent `type` → `envelope_correlation_conflict`), and `a2ui-untrusted-blocks-approval.test.ts` (a `meta.contentTrust:'untrusted'` surface is trust-gated and MUST NOT advance an approval interrupt — composition of `untrusted_content_blocks_approval`). The four behavioral legs soft-skip on 404 (host-pending; the `openwop-app` reference renderer is the render-side probe). 2026-06-14 (RFCs 0099/0100 — external-event trigger ingestion + async/durable A2A tasks) added one new scenario (`trigger-ingestion.test.ts`) and extended `a2a-task-roundtrip.test.ts` with the RFC 0100 async subtests: `trigger-ingestion.test.ts` (RFC 0099 — always-on `TriggerEvent` / `TriggerSubscriptionRegistration` schema legs incl. the §F.1 per-source one-of, the `AttachmentRef.ref`-only rule + raw-URL rejection backing `trigger-ingestion-ssrf`, and the content-free `trigger.delivery.attempted` shape backing `trigger-ingestion-content-redaction`; plus a capability-gated behavioral leg on `triggerBridge.ingestion` driving the `POST /v1/host/sample/trigger-bridge/ingest` seam for SSRF refusal + header-redaction), and the `a2a-task-roundtrip.test.ts` additions (RFC 0100 — always-on `A2ATaskState` + `capabilities.a2a` shape legs incl. the lowercase-hyphen state enum, the `PushConfig` `url`-required + truncated-`tokenFingerprint` rule backing `a2a-push-egress-ssrf`, the no-inline-inputs `additionalProperties:false` SR-1 check; plus capability-gated durable-`tasks/get`-after-disconnect and push-SSRF behavioral legs on `a2a.durableTasks` / `a2a.pushNotifications` via the `/v1/host/sample/a2a/tasks/*` seam). 2026-06-13 (RFCs 0096/0097/0098 — reviewable learning, standing goals, agent-platform portability) added three always-on-plus-gated scenarios: `proposal-reviewable-learning.test.ts` (RFC 0096 — the `agents.proposals` shape + the `Proposal` round-trip incl. the dropped `rule` kind + the content-free `proposal.{created,activated}` events, plus a gated apply-without-scope→403 leg; backs `proposal-inert-until-applied` + `proposal-no-resynthesis`), `goal-standing-continuation.test.ts` (RFC 0097 — the `agents.goals` shape + the `Goal` round-trip + the content-free `goal.{evaluated,closed}` events, plus gated bounded-termination→422 + judge-only-completion legs; backs `goal-continuation-bounded` + `goal-completion-judge-only`), and `export-bundle-portability.test.ts` (RFC 0098 — the `portability` shape incl. the `import⇒dryRun` if/then + the `ExportBundle` round-trip rejecting every credential-named field + the content-free `import.applied` event, plus a gated literal-credential-import→422 leg; backs `export-bundle-no-credential-material`). 2026-06-11 (RFCs 0093/0094 — protocol hardening + wire-shape reconciliation) added five: `version-fold.test.ts` (the `version-negotiation.md` §`X-Force-Engine-Version` cross-version matrix through the previously-orphaned `conformance-version-fold` fixture — closes catalog gap F5; soft-skips when `Capabilities.testing.forceEngineVersionRange` is unadvertised), `stream-text-fixture.test.ts` (the `stream-modes.md` §`messages` fold through the deterministic `stream-text` mock provider + the previously-orphaned `conformance-stream-text` fixture — closes catalog gap F1), `i18n-negotiation.test.ts` (gated on `capabilities.i18n` via `behaviorGate('openwop-i18n', …)` — an unsupported or malformed `Accept-Language` never 400s, `Content-Language` reflects the locale actually used, and error `code` strings stay the canonical English tokens), `grpc-transport.test.ts` (gated on `capabilities.grpc` via `behaviorGate('openwop-grpc-transport', …)` — advertisement-shape only per `grpc-transport.md` §Field semantics: `service` MUST be `openwop.v1.Engine`, the `tls` enum, `grpcs?://` endpoint URIs, `supportedTransports` includes `grpc` when exposed, production claimants require `tls: "required"`; no gRPC dialing), and `webhook-tenant-isolation.test.ts` (RFC 0093 §A.3 — backs the new protocol-tier `webhook-cross-tenant-isolation` invariant; a two-tenant proof through the `/v1/host/sample/test/surface` seam plus black-box registration-surface scoping). `spec-corpus-validity.test.ts` also gained the RFC 0094 §A satisfiability probe: canonical `createRun` bodies MUST pass the composed request schema (closed via `unevaluatedProperties: false` at the composition site, never inside an `allOf` branch) and an undeclared property MUST fail. 2026-06-07 (RFCs 0090/0091/0092 — verifier turn + convergence, multimodal perception input, agent capability requirements) added six: the always-on, server-free shape probes `agent-verifier-shape.test.ts`, `aiproviders-input-shape.test.ts`, `agent-requires-capabilities-shape.test.ts`, plus the capability-gated **behavioral** legs `agent-capability-degraded-projection.test.ts` (RFC 0092 §B — the `degraded[]` projection on `GET /v1/agents`, black-box, non-vacuous via `OPENWOP_DEGRADED_CAPABILITY_AGENT_ID`), `callai-multimodal.test.ts` (RFC 0091 §A/§B — advertised modality accepted / unadvertised → `unsupported_modality`, via the `POST /v1/host/sample/ai/call` seam), and `verifier-gating.test.ts` (RFC 0090 §B — a `fail` verdict blocks commit, via the `POST /v1/host/sample/agents/verify-run` seam). The three behavioral legs soft-skip by default and hard-fail under `OPENWOP_REQUIRE_BEHAVIOR=true` — the Active→Accepted reference-host proof for each RFC. 2026-06-02 (RFC 0082 §B — deployment channel resolve-and-pin, production-path coverage) added `agent-channel-dispatch.test.ts` (capability-gated on `agents.deployment.supported` + the seeded `conformance-agent-channel-dispatch` fixture + advertised `replay` mode via `behaviorGate('openwop-deployment-channel-dispatch', …)` — proves the §B pin from a REAL run graph, complementing `agent-deployment-lifecycle.test.ts` Leg 4's host-sample seam: a canonical `POST /v1/runs` of a node binding `agent.channel:"stable"` MUST record `resolvedChannel` + `resolvedAgentVersion` on `agent.invocation.started` (RFC 0077), a `:fork{mode:"replay"}` MUST re-read that recorded version, and the seam-guarded Leg 3 MOVES the channel then asserts a replay STILL carries the original pin — never re-resolving a moved channel; soft-skips by default, hard-fails under `OPENWOP_REQUIRE_BEHAVIOR=true` — the production-path proof of the §B contract). 2026-06-01 (RFC 0085 — `openwop-agent-platform` meta-profile, the Active→Accepted behavioral gate) added `agent-platform-aggregate-evidence.test.ts` (capability-gated on a host CLAIMING `openwop-agent-platform` in its live discovery `profiles[]` via `behaviorGate('openwop-agent-platform', …)` — the §C/§D honest-advertisement rule on the live `/.well-known/openwop`: the claim MUST satisfy the §B floor predicate (`isAgentPlatformPartial` → `partial`/`full`, never `none`), backed by the per-capability evidence not the profile string; `OPENWOP_AGENT_PLATFORM_TIER=full` forces the non-vacuous full bar — all governance terms + tenant installScope + all 16 §D terms; server-requiring, the always-on §B/§D derivation legs stay in `agent-platform-profile.test.ts` — the RFC 0085 → Accepted bar). 2026-06-01 (RFC 0084 — budget, quota + cost policy, the Active→Accepted behavioral gate) added `budget-enforcement.test.ts` (capability-gated on `budget.supported` via `behaviorGate('openwop-budget-enforcement', …)` — the §C/§D enforcement via the new `POST /v1/host/sample/budget/run` seam + the test event-log seam: a `hard-cost-exhaust` run emits the strict-ordered `budget.reserved → budget.consumed → budget.threshold.crossed{percent} → budget.exhausted → cap.breached{kind:"budget-cost"} → run.failed{error:"budget_exhausted"}` chain; a `model-denied` run is refused `budget_model_denied` BEFORE the provider call (fail-closed); an `advisory` host emits the `budget.*` events without stopping; every `budget.*` payload content-free backing `budget-no-pricing-leak`; new lib helper `src/lib/budgetPolicy.ts`; soft-skips on 404 — the RFC 0084 → Accepted bar). 2026-06-01 (RFC 0080 — agent memory capability reconciliation, the Active→Accepted behavioral gate) added `memory-degraded-projection.test.ts` (capability-gated on `agents.manifestRuntime.supported` + `memory.supported` via `behaviorGate('openwop-memory-degraded', …)` — the §C degraded-projection iff-contract on the NORMATIVE `GET /v1/agents`: a degraded inventory entry MUST carry `memoryDegraded:true` + a non-empty, unique `degradedMemoryDimensions[]` from the closed §A-name enum, a non-degraded entry MUST NOT, the inventory is non-empty, and the degraded branch runs non-vacuously when `OPENWOP_DEGRADED_AGENT_ID` names a known-degraded agent; black-box, no POST seam — the RFC 0080 → Accepted bar). This batch also documents the two RFC 0068 conformance seams (`POST /v1/host/sample/memory/consolidate` + `.../commitment/fire`) in `host-sample-test-seams.md` (the 0068 gated scenarios shipped in 1.14.0). 2026-06-01 (RFC 0034 — collector-side BYOK-canary inspection) added `otel-collector-canary-inspection.test.ts` (always-on server-free: stands up a real `OtelCollector`, POSTs synthetic OTLP/HTTP-JSON traces + metrics through its actual ingest path, and proves the new `findCanaryLeakage()` inspector catches a canary embedded in a span attribute / resource attribute / span name / metric data-point attribute while reporting ZERO hits on a redacted payload and never matching an empty canary — the non-vacuous proof that the conformance collector now inspects what the host's OTLP exporter ACTUALLY shipped over the wire, closing the `secret-leakage-otel-attribute` / `-debug-bundle-otel` collector-seam gap; the live capability-gated complement is the new collector-export describe block in `secret-leakage-otel-attribute.test.ts`). 2026-06-01 (RFC 0035 — sandbox wall-clock timeout, the 7th-of-8 graduation) added `sandbox-wasm-timeout.test.ts` (worker-driven server-free: `probeTimeout` in `wasm-sandbox-probe.ts` spawns a worker thread running the committed `misbehaving-timeout.wasm` + a main-thread kill-timer — the thread preemption a same-thread probe can't do — asserting `sandbox_timeout` with a well-behaved positive control; graduates `node-pack-sandbox-timeout` reference-impl→protocol, so 7 of 8 `node-pack-sandbox-*` invariants are now protocol-tier, only the JS-specific `no-eval` permanently exempt). 2026-05-31 (audit-response black-box / graduation batch) added three more: `sandbox-wasm-isolation.test.ts` (RFC 0035 — drives the committed `fixtures/wasm-sandbox/*.wasm` through `wasm-sandbox-probe.ts`: escape/capability-gate via static `WebAssembly.Module.imports()`, an OOB-store memory trap, double-instantiate isolation; 10/10; graduates 6 `node-pack-sandbox-*` invariants reference-impl→protocol), `workspace-cross-tenant-isolation-blackbox.test.ts` (RFC 0059 — two-credential black-box on the normative §C `/v1/host/workspace/files` endpoints: owner A writes, a second-tenant credential fails closed; no seam), and `prompt-resolution-chain-event.test.ts` (RFC 0029 — reads the durable `agent.promptResolved.chain[]` precedence record via the normative `GET /v1/runs/{runId}/events/poll`; no seam) — each the production-path proof that graduates its surface into the `openwop-core-standard` floor. 2026-05-31 (RFC 0088 — the `openwop-core-standard` Core Standard Profile, the audit-response Core Candidate target) added `core-standard-profile.test.ts` (always-on server-free derivation probe: `isCoreStandard` derives the §B floor — `openwop-core` ∧ `openwop-interrupts` ∧ (`openwop-stream-sse` ∨ `openwop-stream-poll`) — a bare `openwop-core` host without interrupts is excluded, a host with no event transport fails, and the annex is absent from `deriveProfiles` because it composes rather than redefines). 2026-05-31 (RFC 0082 — agent deployment lifecycle, the Active→Accepted behavioral gate) added `agent-deployment-lifecycle.test.ts` (capability-gated on `agents.deployment.supported` via `behaviorGate('openwop-deployment-lifecycle', …)` — the §E promotion contract via the new `POST /v1/host/sample/agents/deployment-transition` seam + the test event-log seam across four legs: `promote` (authorize RFC 0049 → approvalGate RFC 0051 → eval-verify RFC 0081 → content-free `deployment.promoted` with a seven-state `toState` + `toVersion`, the record validating `agent-deployment.schema.json`), `unauthorized` (fail-closed — `allowed:false`, no `deployment.promoted`, the behavioral leg of `deployment-promotion-fail-closed`), `eval-gate-unmet` (`eval_gate_unmet` denial, §E-3), and `channel-pin` (the §B `resolvedAgentVersion` recorded-fact on `agent.invocation.started`); new lib helper `src/lib/agentDeployment.ts`; soft-skips on 404 — the RFC 0082 → Accepted bar). 2026-05-31 (RFC 0081 — agent evaluation, the Active→Accepted behavioral gate) added `agent-eval-run.test.ts` (capability-gated on `agents.evalSuite.supported` via `behaviorGate('openwop-eval-run', …)` — the §B `mode:"eval"` projection via the new `POST /v1/host/sample/agents/eval-run` seam + the test event-log seam: `eval.started`-first → one `eval.scored` per task → `eval.completed`-once ordering (count == `eval.completed.taskCount`), the content-free `eval.scored` legs (`score` ∈ 0..1) backing `eval-summary-no-content-leak`, and the NORMATIVE `GET /v1/runs/{runId}/eval-summary` schema-valid `EvalSummary` round-trip with `passedCount <= taskCount`; new lib helper `src/lib/agentEval.ts`; soft-skips on 404 — the RFC 0081 → Accepted bar). 2026-05-31 (RFC 0083 — durable trigger bridge, the Active→Accepted behavioral gate) added `trigger-bridge-delivery.test.ts` (profile-gated on `openwop-trigger-bridge` derived from the live discovery doc — the §C delivery model via the `POST /v1/host/sample/trigger-bridge/deliver` seam + the test event-log seam: dedup→effectively-once `trigger.delivery.attempted{delivered}` (§C-1), retry-exhaustion→`{dead-lettered}` + `trigger.subscription.state.changed{toState:dead-lettered}` (§C-2 + RFC 0053), and the delivered run's `run.started.causationId` == the delivery id (§C / RFC 0040); both `trigger.*` events content-free; the always-on shape stays in `trigger-bridge-shape.test.ts`; new lib helper `src/lib/triggerBridge.ts`). 2026-05-31 (RFC 0087 — agent org-chart, the Active→Accepted behavioral gate) added two capability-gated behavioral scenarios (both gated on `agents.orgChart.supported`, black-box on the normative `/v1/agents/org-chart` surface — no new POST seam): `agent-org-chart-scoping.test.ts` (the `GET /v1/agents/org-chart` tree-shape — departments form an acyclic `parentDepartmentId` tree, members reference `host:<id>` roster entries — + the §D responsibility roll-up via `GET /v1/agents/org-chart/{departmentId}` with a deduped `responsibilities[]` union + the RFC 0074 cross-tenant 404 via `OPENWOP_CROSS_TENANT_ORG_CHART_DEPARTMENT_ID`) and `org-position-no-authority-escalation.test.ts` (the behavioral leg of the protocol-tier invariant — the live org-chart wire carries NO authority-bearing field on any member/department/responsibility-view object; the structural leg stays always-on in `agent-org-chart-shape.test.ts`, and the deeper RFC 0049/0051 authority-invariance legs stay reference-impl tier per the `agent-manifest-runtime` no-host-hook precedent). 2026-05-31 (RFCs 0086 + 0077 — the Active→Accepted behavioral gate) added four capability-gated behavioral scenarios so a non-steward host can be mechanically certified non-vacuously under `OPENWOP_REQUIRE_BEHAVIOR=true`: `agent-roster-attribution.test.ts` (RFC 0086 §B/§C; gated on `agents.roster.supported` — the normative `GET /v1/agents/roster` read shape + `total==roster.length`, the §C `roster.run.initiated`-before-`agent.invocation.started` ordering, the content-free payload backing `roster-attribution-no-content`, the durable work-item `triggerSubscriptionId`, and the RFC 0074 cross-tenant 404 via `OPENWOP_CROSS_TENANT_ROSTER_ID`), `agent-live-invocation-bracket.test.ts` (RFC 0077 §E; gated on `agents.liveRuntime.supported` — `agent.invocation.started`-first / `agent.invocation.completed`-last bracket, matching `invocationId`, `source`/`outcome` closed enums, content-free), `agent-live-structured-output.test.ts` (RFC 0077 §B step 6; gated on `agents.liveRuntime.structuredOutput` — a result violating `handoff.returnSchemaRef` fails the invocation `outcome:"failed"` rather than shipping as completed), and `agent-live-allowlist-enforced.test.ts` (RFC 0077 §F-1 / RFC 0002 §A14; gated on `agents.liveRuntime.supported` — a tool outside `toolAllowlist` is not callable); all four drive the documented `POST /v1/host/sample/roster/fire` + `POST /v1/host/sample/agents/live-invoke` seams plus the test event-log seam and soft-skip on 404 (these are the RFC 0086 / 0077 Active→Accepted bars). 2026-05-30 (RFC 0087 — agent org-chart, Draft -> Active) added `agent-org-chart-shape.test.ts` (always-on server-free: the `capabilities.agents.orgChart` shape + the `AgentOrgChart` round-trip + the non-`host:` member negative + the **§B structural non-authority guarantee** — the schema rejects a `scopes`/`canDispatch`/`permissions`/`authority` field on a member (`additionalProperties:false`), and a member's key set is exactly `{rosterId, departmentId, roleId, reportsTo}` — backing the protocol-tier `org-position-no-authority-escalation` invariant; no new RunEventType). 2026-05-30 (RFC 0086 — standing agent roster, Draft -> Active) added `agent-roster-shape.test.ts` (always-on server-free: the `capabilities.agents.roster` shape + the `AgentRosterEntry` round-trip + the `host:` `rosterId` + `agentRef` version-XOR-channel negatives + the content-free `roster.run.initiated` negatives backing the protocol-tier `roster-attribution-no-content` invariant + the additive `roster` inventory projection + RunEventType-enum membership). 2026-05-30 (RFC 0082 — agent deployment lifecycle, Draft -> Active) added `agent-deployment-shape.test.ts` (always-on server-free: the `capabilities.agents.deployment` shape + the `AgentDeployment` record round-trip + the `AgentRef` `channel` XOR `version` `not`-clause + the four `deployment.*` payloads + the content-free negatives backing the protocol-tier `deployment-event-no-content-leak` invariant). 2026-05-30 (RFC 0085 — `openwop-agent-platform` meta-profile, Draft -> Active) added `agent-platform-profile.test.ts` (always-on server-free derivation of the operational-annex `none`/`partial`/`full` status: all-floor ⇒ partial, missing-flag ⇒ none, the replay-OR-`nondeterminismPolicy.declared` term, floor+governance ⇒ full, missing-tenant-scope ⇒ partial-not-full per the honest-advertisement rule, eval/deploy/budget-are-advisory-not-hard-terms, + the `capabilities.nondeterminismPolicy.declared` shape). 2026-05-30 (RFC 0084 — budget, quota + cost policy, Draft -> Active) added `budget-policy-shape.test.ts` (always-on server-free: `budget-policy.schema.json` round-trip + the §A orthogonality guard — a wall-time field is rejected (it's RFC 0058's `runTimeoutMs`) — + threshold/onExhaustion negatives + the four content-free `budget.{reserved,consumed,threshold.crossed,exhausted}` payloads + the four `cap.breached{budget-*}` kinds + RunEventType-enum membership + the no-pricing-property structural check backing the protocol-tier `budget-no-pricing-leak` invariant + the `capabilities.budget`/`limits.maxBudget*` shape). 2026-05-30 (RFC 0083 — durable trigger + channel bridge, Draft -> Active) added `trigger-bridge-shape.test.ts` (always-on server-free: `trigger-subscription.schema.json` round-trip + missing-`state`/out-of-enum-`source`/unknown-property negatives + the four-state vocab + the two content-free `trigger.{subscription.state.changed,delivery.attempted}` payloads incl. closed `state`/`outcome` enums + RunEventType-enum membership + the `triggerBridge`/`webhooks.durable` capability shape + the `openwop-trigger-bridge` profile derivation incl. the no-dead-letter-sink negative). 2026-05-30 (RFC 0079 — credential provenance + egress policy, Draft -> Active) added `egress-provenance-shape.test.ts` (always-on server-free: `credential-provenance.schema.json` round-trip + `audiences:[]`/missing-`credentialId`/unknown-property negatives + the no-secret-property structural check backing the protocol-tier `egress-decision-no-secret-leak` invariant + the content-free `egress.decided` record incl. the `decision` enum + RunEventType-enum membership + the `httpClient.egressPolicy` shape; the behavioral `egress-credential-audience-bound` confused-deputy MUST is reference-impl tier, deferred to a host). 2026-05-30 (RFC 0078 — portable tool catalog, Draft -> Active) added `tool-descriptor-shape.test.ts` (always-on server-free: `tool-descriptor.schema.json` round-trip + the §C-1 `exec` ⇒ `host-extension` cross-field MUST (RFC 0069) + the `safetyTier`-required negative + `additionalProperties:false`, the `capabilities.toolCatalog` `supported`/`sources`/`sessionLifecycle` shape, and the two content-free `tool.session.{opened,closed}` payload $defs incl. the closed `outcome` enum + RunEventType-enum membership). 2026-05-30 (RFC 0080 — agent memory capability reconciliation, Draft -> Active) added `memory-capability-model-shape.test.ts` (always-on server-free: the additive `capabilities.memory.{writable,search,retention}` dimension shapes + malformed-instance negatives — `retention.ttl` non-boolean, out-of-enum `search.modes`, unknown property under `additionalProperties:false` — the `agent-inventory-response` `memoryDegraded`/`degradedMemoryDimensions` closed-enum fields, and the `openwop-memory` derivation surfacing for read/write + long-term hosts while withholding from `writable:false`). 2026-05-30 (RFC 0081 — agent evaluation, Draft -> Active) added `agent-eval-suite-shape.test.ts` (always-on server-free: the `capabilities.agents.evalSuite` shape + the `AgentEvalSuite`/`EvalSummary` schema round-trips + the three `eval.{started,scored,completed}` payloads + the content-free negatives — a task entry with a `taskOutput` body, a `safetyFinding` with an `excerpt` — backing the new `eval-summary-no-content-leak` SECURITY invariant). 2026-05-29 (RFC 0076 §B — `ctx.http.safeFetch` live-run audit) added `safefetch-live-audit.test.ts` (`behaviorGate('openwop-safefetch-live-audit', …)`, gated on `httpClient.safeFetch` + `toolHooks.prePostEvents`) — asserts the audit-when-both MUST against the **durable run event log** via the new `POST /v1/host/sample/http/safe-fetch-run` open seam + the test event-log seam, closing the seam-vs-production gap (a production `createSafeFetch()` with no audit hooks passes the inline `safefetch-behavior.test.ts` but FAILS this under `OPENWOP_REQUIRE_BEHAVIOR=true`); this is the RFC 0076 §B → Accepted bar; run seam soft-skips on 404 (host-pending). 2026-05-29 (RFC 0066 — `x-openwop-form` picker UX hints, Draft → Active) added `x-openwop-form-pack-manifest.test.ts` (always-on server-free: an annotated `configSchema` stays a valid 2020-12 schema + the advisory hints don't change what it accepts, each §A annotation matches the shape, an unknown `kind` validates for forward-compat, 3 negatives — missing/non-string `kind`, non-string `dependsOn`). 2026-05-29 (RFC 0076 §B — `ctx.http.safeFetch`) added `safefetch-behavior.test.ts` (seam-gated: SSRF block / DNS-rebinding / `Connection: upgrade` refusal / tool-hooks audit-when-both, via `POST /v1/host/sample/http/safe-fetch`; advertisement contract stays in `http-client-ssrf.test.ts`). 2026-05-29 (RFC 0076 §A — pack `runtime.requires[]` install gate) added two: `runtime-requires-shape.test.ts` (server-free closed-vocabulary validation — the 8 tokens validate, a raw builtin name is rejected, empty-array≡omission, `uniqueItems`) + `runtime-requires-install-gate.test.ts` (seam-gated install-grant / install-refuse → `pack_runtime_requirement_unmet` / non-sandbox SHOULD-projection, soft-skip on 404 via `POST /v1/host/sample/packs/install-gate`). 2026-05-29 (RFC 0047 — `host.oauth` authorization-code roundtrip) added `oauth-authorization-code-roundtrip.test.ts` — capability-gated on `capabilities.oauth.supported` + `grants` including `authorization_code`; drives the `POST /v1/host/sample/oauth/authorize-code-roundtrip` seam against the one canonical synthetic provider in `fixtures/oauth-providers/synthetic.json` (soft-skip on 404, Tier-2 host-pending), asserting a successful grant returns a credential REFERENCE (token persisted as a `host.credentials` entry) and that the authorization code / state / PKCE verifier / acquired access+refresh tokens never appear on any run-visible surface (RFC 0047 §C + §C.2 / `credential-payload-redaction`). Closes the RFC 0047 Tier-2 gap (capability-shape + redaction scenarios existed; the actual authorization-code dance was unexercised). 2026-05-26 (RFC 0070 — agent-manifest runtime) added `agent-manifest-runtime.test.ts`; 2026-05-26 (RFC 0071 — artifact-type + chat card packs) added six: `artifact-type-pack-manifest-validation.test.ts` + `artifact-schema-compile-bounded.test.ts` (server-free) + `artifact-type-pack-install.test.ts` + `artifact-type-store-without-render.test.ts` + `chat-card-pack-manifest-validation.test.ts` (server-free) + `chat-card-pack-execution.test.ts` (capability-gated, host-pending). 2026-05-26 (RFCs 0067 / 0068 / 0069 — spec-gap Draft cohort) added five scenarios: `byok-auth-modes.test.ts` (RFC 0067; always-on schema-shape of `aiProviders.authModes` + a discovery-gated §B auth-mode-contract cross-field check), `memory-consolidation-shape.test.ts` (RFC 0068; always-on shape of `agents.memoryConsolidation`/`agents.commitments` + the `agent.memory.consolidated`/`commitment.fired` payload $defs), `memory-consolidation-idempotent.test.ts` + `commitment-fired.test.ts` (RFC 0068; capability-gated behavioral, soft-skip on the documented `/v1/host/sample/memory/consolidate` + `/commitment/fire` seams), and `exec-not-protocol-tier.test.ts` (RFC 0069; always-on server-free structural assertion that the protocol corpus defines no `core.*`/`openwop.*` exec-class primitive — backs the `exec-must-not-be-protocol-tier` SECURITY invariant). 2026-05-25 (RFC 0061 — stateful agent-loop lifecycle, executionModel.version 5) added four `agent-loop-*.test.ts` scenarios: `-version5-shape` (always-on; validates `executionModel.statefulResume`/`transcriptWindow` + the 1–5 version ceiling) plus `-iteration-monotonic` (gated on `version >= 5`; `runOrchestrator.decided.iteration` increments 1,2,3… exactly once per turn), `-workspace-snapshot` (gated additionally on `host.workspace.supported`; a turn-i workspace write is invisible to turn i, visible to turn i+1), and `-stateful-resume` (gated on `statefulResume`; a mid-loop suspend resumes at the same iteration without resetting the counter) — the three behavioral scenarios drive the documented agent-loop seam (`POST /v1/host/sample/agentloop/run`) and soft-skip until a host wires it. 2026-05-25 (RFC 0059 — host.workspace M2, reference-host enforcement) added two `workspace-*.test.ts` scenarios: `-behavior` (capability-gated CRUD round-trip / `If-Match` 409 `workspace_conflict` / `workspace_too_large` / §D run-start snapshot, all via the real `/v1/host/workspace/files` §C endpoints) and `-cross-tenant-isolation` (WCT-1 — drives the documented `POST /v1/host/sample/workspace/op` seam to assert a file owned by one `{tenant, workspace}` is unreadable, on both `get` and `list`, under a different owner; backs the new `workspace-cross-tenant-isolation` SECURITY invariant). The in-memory reference host now advertises `capabilities.workspace.supported` and honors §C/§D/§E end-to-end. 2026-05-25 (RFC 0062 — memory.distillation "dreams") added five `distillation-*.test.ts` scenarios: `-shape` (always-on; validates the `capabilities.memory.distillation` block + the additive `distillation` sub-object on `memory.compacted`) plus `-token-budget` (within budget `tokensUsed ≤ tokenBudget`; an un-meetable budget → `token_budget_exceeded` with no partial archive), `-stable-archive` (same sources + budget ⇒ byte-stable archive checksum), `-index-roundtrip` (gated additionally on `indexEmitted`; the `MEMORY-INDEX.json` workspace file is retrievable + `workspace.updated` fired), and `-secret-carryforward` (SR-1: a redacted source secret never appears in the archive) — the four behavioral scenarios drive the documented memory-distillation seam (`POST /v1/host/sample/memory/distill`) and soft-skip until a host wires it. 2026-05-25 (RFC 0063 — core.subWorkflow.outputAttestation) added four `subrun-*.test.ts` scenarios: `-attestation-shape` (always-on; validates the `capabilities.agents.subRunAttestation` flag) plus `-checksum-stable` (the child output checksum is the byte-stable, key-order-invariant RFC 8785 JCS + SHA-256 digest), `-approval-gate` (`requireApproval` → `accept` merges, `reject` does not), and `-approval-fail-closed` (no `accept`/`edit-accept` → no merge; backs the deferred `subrun-merge-approval-fail-closed` invariant) — the three behavioral scenarios drive the documented sub-run attestation seam (`POST /v1/host/sample/subrun/attest`) and soft-skip until a host wires it. 2026-05-25 (RFC 0064 — host.toolHooks) added five `tool-hooks-*.test.ts` scenarios: `-shape` (always-on; validates the `capabilities.toolHooks` block + the optional content-free fields on `agentToolCalled` / `agentToolReturned`) plus `-content-free` (gated on `prePostEvents`), `-authorization-fail-closed` (gated on `perToolAuthorization`), `-rate-limit` (gated on `perToolRateLimit`), and `-secret-redaction` (gated on `prePostEvents` + the SR-1 `argsHash` redaction rule) — the four behavioral scenarios drive the documented tool-hooks invoke seam (`POST /v1/host/sample/toolhooks/invoke`) and soft-skip until a host wires it. 2026-05-25 (RFC 0060 — host.heartbeat) added four `heartbeat-*.test.ts` scenarios: `-capability-shape` (always-on; validates the `capabilities.heartbeat` block) plus `-fires-once-per-tick`, `-idempotent-no-spam`, and `-runtime-bound` (gated on `capabilities.heartbeat.supported` + the host heartbeat tick seam; soft-skip until a host wires it). 2026-05-25 (RFC 0057 — memory write-attribution) added five `memory-attribution-*.test.ts` scenarios: `-shape` (always-on advertisement check on `capabilities.memory.attribution`), plus `-no-content`, `-tenant-scoped`, `-emits-on-write`, and `-replay-stable` (gated on `capabilities.memory.attribution.emitsWriteEvents`) verifying the content-free `memory.written` RunEvent, its two SECURITY invariants (`memory-attribution-no-content` + `memory-attribution-tenant-scoped`), and the §D replay rule that a `replay`-mode fork MUST NOT regenerate `memoryId`. 2026-05-25 (RFC 0025 §C point 1 — test-catalog isolation invariant; pairs with the 25 publish-error scenarios in `pack-registry-publish.test.ts`) added `pack-registry-isolation.test.ts` — capability-gated on `capabilities.packs.testMode.{supported, isolated}: true`; PUTs a disposable pack into `/v1/packs-test/{name}` and asserts the same `(name, version)` does NOT appear via `GET /v1/packs/{name}` — anchors the test-catalog isolation MUST in RFC 0025 §C. 2026-05-25 (RFC 0028 Tier-2 post-promotion T2 — read-side sister scenario for workspace-membership enforcement) added `prompt-read-workspace-membership-enforced.test.ts` — gates on `capabilities.prompts.supported: true` (broader than `mutableLibrary` so read-only hosts that expose `?workspaceId=` are also probed); drives `GET /v1/prompts?workspaceId=<random-non-member>` and interprets the response: 4xx PASS (canonical envelope check on 403); 200 with empty `templates[]` PASS (correct null result for a nonexistent workspace); 200 with non-empty `templates[]` FAIL (cross-tenant leak); 200 without `templates[]` field SKIP (host doesn't expose workspace-scoped reads). Verifies SECURITY invariant `prompt-read-workspace-membership-enforced`. Same-day T1 strengthened `prompt-mutation-workspace-membership-enforced.test.ts` to pin `error === "workspace_membership_required"` when the host's refusal status is 403 (other refusal codes unconstrained). 2026-05-25 (RFC 0028 Tier-2 follow-up — workspace-membership enforcement on mutating prompt endpoints, filed in response to a self-disclosed adopter vulnerability) added `prompt-mutation-workspace-membership-enforced.test.ts` — capability-gated on `capabilities.prompts.mutableLibrary: true`; drives `POST /v1/prompts` with a cryptographically-random non-member `workspaceId` and asserts the host refuses (NOT a 2xx; any 4xx/5xx is acceptable — silent success is the failure mode). Verifies SECURITY invariant `prompt-mutation-workspace-membership-enforced`. 2026-05-22 (RFC 0034 §B follow-up — secret-leakage harness against the OTel + debug-bundle seams) added `secret-leakage-otel-attribute.test.ts` — gates on `capabilities.secrets.supported` + `capabilities.observability.testSeams.{otelScrape,debugBundleExport}` AND the `OPENWOP_CANARY_SECRET_VALUE` env (host operator + conformance runner agree on the canary). Drives the existing `openwop-smoke-byok-roundtrip` fixture end-to-end; scrapes both seams after run completion; hard-fails if the canary plaintext appears in any OTel span attribute or debug-bundle field. Verifies SECURITY invariants `secret-leakage-otel-attribute` + `secret-leakage-debug-bundle-otel`. 2026-05-22 (RFC 0041 Phase 4 — replay determinism under nondeterministic models) added three scenarios: `replay-divergence-at-refusal.test.ts` (advertisement-shape probe on `replayDeterminism.refusalDivergenceEmission` + 2 `it.todo` for the dual-direction refusal-divergence case), `replay-observable-sequence-determinism.test.ts` (capability-gated; behavioral assertion soft-skipped until a `conformance-phase4-nondet-tool` fixture ships), `replay-llm-cache-key-portable.test.ts` (intra-host reproducibility + non-recipe-field invariance + Phase 4 advertisement alignment — reuses the existing `POST /v1/host/sample/test/llm-cache-key` seam from the sibling `replay-llm-cache-key.test.ts`). 2026-05-20 (RFC 0027 §A templateKinds-coverage follow-up — paired with `prompt-end-to-end-events.test.ts`) added `prompt-all-four-kinds-events.test.ts` exercising all four `PromptKind` values (`system`, `user`, `schema-hint`, `few-shot`) end-to-end through the reference workflow-engine sample's `local.sample.demo.mock-ai` dispatch path; capability-gated via `behaviorGate('prompts-supported', ...)`. Closes the credibility gap where the host advertised `templateKinds: ["system", "user", "few-shot", "schema-hint"]` but only the system+user pair was actually wired into dispatch. 2026-05-20 (RFCs 0030–0033 — envelope LLM-contract-hardening track) added 15 scenarios across four `Active` RFCs: `envelope-reasoning-shape.test.ts` (RFC 0030, always-on; asserts the OPTIONAL `reasoning` property on the three universal-kind schemas + the `schema.response` deliberate omission), `envelope-reasoning-secret-redaction.test.ts` (RFC 0030, capability-gated on `capabilities.envelopes.reasoning.supported` + `secrets.supported`; 5 `it.todo()` placeholders for SECURITY invariant `envelope-reasoning-secret-redaction`), `envelope-tier-one-subset-static.test.ts` (RFC 0030, always-on for load-bearing rules — no `oneOf` / `allOf` / `not` / `prefixItems` / `propertyNames` anywhere; gated on `tierOneSubsetCompliance: "strict"` for OpenAI-strict-only constraints), `envelope-variant-discriminator-static.test.ts` (RFC 0031, always-on; asserts no `oneOf` + every `anyOf` branch declares a single-string-enum discriminator in `required` on every `schemas/envelopes/*.schema.json`), `model-capability-substituted.test.ts` (RFC 0031, advertisement-shape probe on `capabilities.modelCapabilities.advertised[]` identifier pattern + 5 `it.todo()` placeholders for SECURITY invariant `model-capability-substituted-no-credential-disclosure`), `model-capability-insufficient.test.ts` (RFC 0031, 6 `it.todo()` placeholders for refusal + no-recursive-fallback), `node-module-required-capabilities-shape.test.ts` (RFC 0031 SHOULD-tier authoring-convention; 4 `it.todo()` placeholders), and the six envelope-reliability events from RFC 0032 (`envelope-retry-attempted` carrying the shared advertisement-shape probe enforcing both MUST-tier events in `events[]` per RFC 0032 §C, plus `envelope-retry-exhausted`, `envelope-refusal-shape`, `envelope-truncated`, `envelope-nl-to-format-engaged`, `envelope-recovery-applied` — collectively 39 `it.todo()` placeholders covering retry/refusal/truncation/recovery + SECURITY invariants `envelope-refusal-no-prompt-leak` and `envelope-recovery-no-content-leak`), plus RFC 0033's two scenarios (`envelope-completion-distinguishes-truncation.test.ts` + `envelope-truncation-cap-exhaustion.test.ts` — 12 `it.todo()` placeholders covering the truncation-vs-schema-violation retry-routing distinction + the DoS-bound assertion). Reference workflow-engine sample advertises `capabilities.envelopes.reasoning: { supported: true, promptDirective: "off" }` + `tierOneSubsetCompliance: "warn"` honestly (schemas accept the field; host doesn't yet inject the directive); the other three RFCs' capability blocks defer to reference-host emission code per the staged RFC 0027 §G precedent. 2026-05-20 (RFC 0028 §B Phase B — prompt-pack boot-time install) added `prompt-pack-install.test.ts` (capability-gated on `capabilities.prompts.endpointsSupported: true`; asserts a host that ran the boot-time pack loader surfaces ≥ 1 pack-source template under `GET /v1/prompts?source=pack` carrying the canonical `meta.source: "pack"` + `meta.packName` + `meta.packVersion` stamps; positively identifies the in-tree `vendor.openwop.prompt-sample` reference pack's `writer-system` template when present). Pairs with the new `host/promptPackLoader.ts` boot-time entry on the reference workflow-engine sample, which scans `examples/packs/*` plus `OPENWOP_PROMPT_PACKS_DIR` and calls `installPackTemplates()` for each `kind: "prompt"` pack found. 2026-05-20 (RFC 0029 Phase C — prompt resolution chain wire shape) added three more scenarios: `prompt-resolution-chain-node-wins.test.ts` (capability-gated on `capabilities.prompts.supported: true`; asserts layer-1 node-config supersedes lower layers per `spec/v1/prompts.md` §"Resolution chain (normative)"), `prompt-resolution-chain-agent-intrinsic.test.ts` (additionally gated on `capabilities.prompts.agentBindings: true`; asserts agent intrinsic `systemPromptRef` wins over `promptOverrides` AND lower layers when the node has no layer-1 ref), `prompt-resolution-chain-fallback-cascade.test.ts` (asserts layer 3 workflow-defaults wins over layer 4 host-defaults; layer 4 host-defaults wins when 1-3 yield null; resolved is null when all four yield null but chain[] still lists every attempted layer). The scenarios drive the host's `POST /v1/host/sample/prompt/resolve` test seam (reference-host implementation deferred to follow-up slice per RFC 0021 staging precedent). 2026-05-20 (RFC 0027 Phase A — prompt templates wire shape) added three scenarios: `prompt-template-shape.test.ts` (always-on; Ajv compileability + positive/negative round-trip for PromptTemplate + PromptRef + PromptKind), `prompt-composed-secret-redaction.test.ts` (capability-gated on `capabilities.prompts.supported: true` + `observability: "full"`; asserts `[REDACTED:<secretId>]` markers in `prompt.composed` payloads for `source: "secret"` variable bindings per SECURITY/threat-model-secret-leakage.md §SR-1), `prompt-composed-trust-marker.test.ts` (same capability gates; asserts `<UNTRUSTED>...</UNTRUSTED>` wrapping + `contentTrust: "untrusted"` propagation per RFC 0020 §D). Paired with new `fixtures/prompt-templates/` sub-directory + per-fixture schema-validity describe block + future SECURITY invariants `prompt-composed-secret-redaction` and `prompt-composed-trust-marker` (lands alongside reference-host emission per RFC 0021 staging precedent). 2026-05-18 (RFC 0022 `Draft` — runtime variable mapping) added four `it.todo()` placeholder scenarios covering the new mapping surfaces on `core.dispatch` (§A — `dispatch-input-mapping.test.ts`, `dispatch-output-mapping.test.ts`, `dispatch-cross-worker-handoff.test.ts`) and `core.subWorkflow` (§B — `subworkflow-input-mapping.test.ts`). Gated on `capabilities.agents.dispatchMapping` (dispatch trio) and `capabilities.subWorkflow.inputMapping` (subWorkflow). Promote to live assertions when RFC 0022 reaches `Active` + a reference host advertises the matching flags. 2026-05-17 (RFC 0003 §D handoff-schema enforcement, HV-1) added `agentPackHandoffSchemaValidation.test.ts` — verifies the host validates dispatch payloads against `handoff.taskSchemaRef` AND return payloads against `handoff.returnSchemaRef` per RFC 0003 §D. Paired with the new `agent-pack-handoff-schema-enforcement` row in `SECURITY/invariants.yaml`. 2026-05-17 (AI Envelope gap-closure, DRAFT v1.x — `spec/v1/ai-envelope.md`) added 7 advertisement-shape scenarios with `it.todo()` behavioral placeholders gated on `capabilities.envelopeContracts.advertised: true`: `aiEnvelope.universalKinds.test.ts`, `aiEnvelope.schemaDrift.test.ts`, `aiEnvelope.correlationReplay.test.ts`, `aiEnvelope.contractRefusal.test.ts`, `aiEnvelope.trustBoundaryPropagation.test.ts`, `aiEnvelope.redaction.test.ts`, `aiEnvelope.capBreached.test.ts`. Paired with the new `envelope-redaction-sr-1-carry-forward` row in `SECURITY/invariants.yaml`. 2026-05-17 (post-publish hardening, deep audit of `core.openwop.agents`) added `agents-run-tool-allowlist.test.ts` — server-free scenario locking in the `core.openwop.agents@1.0.1` safety-fix that closes `OPENWOP-AUDIT-2026-003` (function-typed `tool.handler` properties rejected at `validateTools()` with `INVALID_TOOL_DECLARATION`; tool-driven runs require `ctx.agentRuntime`; tool-less safe fallback preserved). Paired with the new `agents-run-no-raw-handler` row in `SECURITY/invariants.yaml`. Same-day post-publish hardening added `idempotency-key-determinism.test.ts` — server-free scenario locking in the `core.openwop.http@1.1.2` determinism safety-fix (default `composite` mode produces deterministic keys in `(runId, nodeId, payload)`; removed `uuid` mode rejects with `CONFIG_INVALID`; cross-impl vector test lets third-party reimplementations verify wire agreement). Paired with the new `idempotency-key-deterministic` row in `SECURITY/invariants.yaml`. 2026-05-17 (Phase 3 of RFC 0013) added three server-free scenarios exercising the reference workflow-chain expansion library (`conformance/src/lib/workflow-chain-expansion.ts`): `workflow-chain-expansion.test.ts` (parameter substitution + node id collision avoidance + edge rewriting + capability propagation + runtime-invariance contract), `workflow-chain-unresolvable-typeid.test.ts` (rejection with `chain_unresolvable_typeid` when a chain references an unknown typeId), and `workflow-chain-pack-signature-verification.test.ts` (Ed25519 verification recipe reuse from `node-packs.md §Signing`). Earlier that day (Phase 1) added `workflow-chain-pack-manifest-validation.test.ts` — server-free schema-validation scenario covering the new `workflow-chain-pack-manifest.schema.json` (positive sample + two negatives: kind/contents mismatch and invalid `chainId`). Closes RFC 0013 (`Workflow-chain packs`, `Draft`) Phases 1 + 3 alongside the new `spec/v1/workflow-chain-packs.md`, the `Capabilities.workflowChainPacks` block, and the registry build-index/conformance-check `kind` routing from Phase 2. Earlier that day, the suite added 27 `it.todo()` placeholder scenarios paired with RFCs 0014-0020 (host capability surfaces — fs, kvStorage, tableStorage, queueBus, sql/vector/search, blob/cache, mcp.serverMount). These promote to live assertions when each RFC reaches `Active` + the matching capability block lands in `schemas/capabilities.schema.json` + a reference host advertises the capability. Earlier additions include 18 Multi-Agent Shift scenarios (Phases 1-5) added 2026-05-10, the `registry-public.test.ts` public-registry healthcheck added 2026-05-11 (opt-in via `OPENWOP_TEST_PUBLIC_REGISTRY=true`), the `replay-llm-cache-key.test.ts` placeholder added 2026-05-11 (three `it.todo()` cases for the cross-host LLM cache-key recipe per `replay.md` §"LLM cache-key recipe"), the two `production-*.test.ts` scenarios added 2026-05-11 for the `openwop-production` profile per RFC 0009 (`production-backpressure.test.ts`, `production-retention-expiry.test.ts`), the four `auth-*.test.ts` scenarios added 2026-05-11/12 for the production-auth profiles per RFC 0010 (`auth-api-key-rotation.test.ts`, `auth-oauth2-client-credentials.test.ts`, `auth-oidc-user-bearer.test.ts`, `auth-mtls.test.ts` (opt-in via `OPENWOP_TEST_MTLS=1`)), `replay-retention-expiry.test.ts` added 2026-05-12 (capability shape + 410/422 envelope per `replay.md` §"Retention and garbage collection"), `bulk-cancel.test.ts` added 2026-05-12 (Phase B close-out of R1 — `POST /v1/runs:bulk-cancel`), the two Phase H launch-blocker advertisement-contract scenarios added 2026-05-12 (`mcp-toolcall-redaction.test.ts` for the MCP-1 invariant per `host-capabilities.md §host.mcp` + `threat-model-prompt-injection.md §UNTRUSTED`, and `http-client-ssrf.test.ts` for the SSRF + body-size cap advertisement contract on `capabilities.httpClient`), the `wasm-pack-abi-version-rejection.test.ts` Track 7 scenario added 2026-05-12 for the ABI-mismatch positive path via the `vendor.openwop.misbehaving-abi` pack per RFC 0008 §H, the `otel-trace-propagation-subworkflow.test.ts` Track 11 close-out added 2026-05-13 (parent + child run spans share the inbound traceparent's traceId across the `core.subWorkflow` dispatch boundary), and the three RFC 0012 (Memory Compaction Profile, `Active`) scenarios added 2026-05-13/14: `memory-compaction-sr1-carry-forward.test.ts` (load-bearing SR-1 §D), `memory-compaction-event-emitted.test.ts` (canonical §B payload shape), and `memory-compaction-provenance-tag.test.ts` (soft assertion on §C `compacted-from:<id>` convention). All three gate on `capabilities.memory.compaction.supported` + the host's test seam at `/v1/test/memory/{seed,compact}` (Postgres reference host enables both via `OPENWOP_MEMORY_COMPACTION=true OPENWOP_TEST_TRIGGER_COMPACTION=true`). 2026-05-15 (gap-closure CF-3) added `interrupt-token-matrix.test.ts` (malformed / unknown / replay / cross-run-id paths on `GET|POST /v1/interrupts/{token}`). 2026-05-31 (RFC 0078 portable tool catalog + RFC 0079 credential provenance / egress policy — the Active→Accepted behavioral gate) added four: `tool-catalog-projection.test.ts` (capability-gated on `toolCatalog.supported` via `behaviorGate('openwop-tool-catalog', …)` — the NORMATIVE `GET /v1/tools` list with each `ToolDescriptor` schema-valid + `source`/`safetyTier` in the closed vocab + content-free, `GET /v1/tools/{toolId}` round-trip + unknown-id 404, 401-unauthenticated, and the §F-2 cross-principal non-disclosure; black-box, no POST seam), `tool-session-lifecycle.test.ts` (gated on `toolCatalog.sessionLifecycle` — the §D `tool.session.opened`-before / `tool.session.closed`-after bracket over the RFC 0064 call events via the `POST /v1/host/sample/tools/session-run` seam, one shared `sessionId`, content-free), `egress-audience-binding.test.ts` (KEYSTONE — gated on `httpClient.egressPolicy.supported`; the §C confused-deputy MUST via `POST /v1/host/sample/egress/decide`: an out-of-audience egress is denied/downgraded with the credential NOT attached, a provenance-unevaluable egress fails closed — the behavioral leg of `egress-credential-audience-bound`), and `egress-decision-content-free.test.ts` (the SR-1 canary — the credential value never surfaces in `egress.decided` and `reason` stays in the CLOSED vocabulary). The maintained scenario-to-spec map lives in [`coverage.md`](./coverage.md); this README keeps the operator quickstart and the historical scenario notes below.
+The current suite has 387 scenario files under `src/scenarios/`. 2026-07-06 (RFC 0129 — data-residency, suite `1.53.1 → 1.54.0`) added `data-residency-admission.test.ts` (always-on `capabilities.dataResidency` + `residency.schema.json` shape probes + `residency_unavailable` error-registration check; plus capability-gated behavioral legs driving the NORMATIVE `POST /v1/runs` endpoint — an advertised region MUST NOT be rejected `residency_unavailable`, an unadvertised region MUST be rejected with that code at HTTP one-of 400/404/422 and create no run — advertise-only-what-you-honor, soft-skip until a host advertises `dataResidency`). 2026-07-06 (RFC 0127 + RFC 0128 — CDP Track-2, suite `1.52.0 → 1.53.0`) added `trigger-stream-cdc-sources.test.ts` (always-on schema probes for the `stream`/`change` TriggerEvent sub-objects — `op` REQUIRED negative, exactly-one rule, registration + capabilities vocabulary pins — plus capability-gated behavioral legs driving the existing `/v1/host/sample/trigger-bridge/ingest` + `/deliver` seams: schema-valid delivered envelopes, SR-1 content-free durable events with a body canary, `(topic,partition,offset)` dedup effectively-once) and `purpose-propagation.test.ts` (always-on `permittedPurposes` + `capabilities.purposePropagation` family shape probes, plus the capability-gated two-hop legs via the new `POST /v1/host/sample/purpose-propagation/forward` seam: onward label ⊆ received, derived-output ⊆ intersection of labelled inputs, unlabelled adds no constraint, `[]` fail-closed dropped with an unlabelled positive control). Both behavioral suites soft-skip pre-implementation and become REQUIRED once the host advertises the surface (advertise-only-what-you-honor). 2026-07-05 (RFC 0013 erratum A-lite — bundle + load the sample-pack fixture, suite `1.51.0 → 1.52.0`) bundled the `vendor.openwop.workflow-chain-sample` pack into the conformance package at `fixtures/pack-manifests/workflow-chain-sample.pack.json` (host-syncable, ships in `files`) and refactored `workflow-chain-host-expansion.test.ts` to **load** it + derive the expected expansion from the `expandChain()` reference library instead of hardcoding — so a live host serving `POST /v1/host/sample/workflow-chain:expand` is checked against the spec algorithm for the identical published pack (closes the RFC 0013 host-expansion witness's fixture gap; the seam still soft-skips until a host advertises `workflowChainPacks.hostExpansionSeam`). `fixtures-valid.test.ts` now schema-selects pack-manifest fixtures by `kind` (node-pack vs workflow-chain-pack). No scenario-file count change. 2026-07-05 (RFC 0013 erratum — host-expansion test seam decouple, suite `1.50.0 → 1.51.0`) re-gated `workflow-chain-host-expansion.test.ts` from the semantic `workflowChainPacks.supported` claim onto a new OPTIONAL `workflowChainPacks.hostExpansionSeam` test-harness sub-flag (no scenario-file count change), so a host advertising `workflowChainPacks.supported` / RFC 0124 `deferredParameters.supported` is no longer conscripted into the never-bundled `vendor.openwop.workflow-chain-sample` seam under `OPENWOP_REQUIRE_BEHAVIOR` — the semantic claim rides the server-free `workflow-chain-expansion.test.ts` legs, RFC 0124's deferred path its own `/chain/deferred-expand` seam. 2026-07-04 (RFC 0124 — portable per-run parameter deferral, suite `1.49.0 → 1.50.0`) added `workflow-chain-deferred-parameters.test.ts` (always-on, server-free legs against the reference `expandChainDeferred` in `conformance/src/lib/workflow-chain-expansion.ts`: non-sensitive deferral materializes `variables[]` with `defaultValue`+`type` and leaves ZERO `{{params.*}}` tokens (R3), a whole-value input token → variable-sourced PortValue, the bare param name is the auto-generated `configurableSchema` override key (R6); §Security legs: a `x-openwop-sensitive` prompt-body param materializes `source:"secret"` with the plaintext appearing NOWHERE — not bagged — a sensitive whole-value `node.input` fails closed `sensitive_param_not_deferrable` (422), a sensitive param on a host without `secrets` support fails closed, and a host without a `prompts.variable` source falls back to expansion-time (G5); plus schema-surface legs pinning the amended `source:"secret"` wording in the manifest schema + the `credentialRef` per-run supply shape; capability-gated host legs over `POST /v1/host/sample/chain/deferred-expand` for the bare-param override / `:fork` replay / `contentTrust:"untrusted"` fence / `[REDACTED]` sensitive compose, soft-skip 404/403). 2026-07-04 (RFC 0126 — data-parallel dispatch per-item input, suite `1.48.0 → 1.49.0`) added `dispatch-per-item-input.test.ts` (always-on, server-free schema legs on `orchestrator-decision.schema.json` §NextWorkerDecision: a well-formed index-aligned `nextWorkerInputs` validates, a decision omitting it stays valid (additive/back-compat), a non-object item and a non-array are rejected, a mis-named `perItemInputs` is rejected by `additionalProperties:false` (the fail-closed rail for pre-RFC-0126 strict validators), and a length-mismatch is ADMITTED at the wire because `nextWorkerInputs.length == nextWorkerIds.length` is not JSON-Schema-expressible — a host runtime MUST; capability-gated behavioral legs over `POST /v1/host/sample/dispatch/per-item` asserting a host advertising `capabilities.dispatch.perItemInput` projects `nextWorkerInputs[i]` into child `i` (per-item value wins over `inputMapping`), a length-mismatch fails with a `validation_error` dispatching no child, and a host NOT advertising the capability fails closed on a non-empty `nextWorkerInputs` rather than silently dropping it and dispatching N identical children; soft-skips on 404/403). 2026-07-02 (RFC 0122 — self-hosted runner, suite `1.47.0 → 1.48.0`) added `self-hosted-runner.test.ts` (always-on schema legs for the `selfHostedRunner` capability block + the dispatch/result/registration frame shapes; an advertisement-gated block-shape leg; capability-gated behavioral legs over `POST /v1/host/sample/runner/{register,dispatch}` asserting subject-first isolation, retriable `runner_unavailable`, and at-most-once dedup — the public test for the protocol-tier `runner-credential-non-transit` + `runner-output-untrusted-transport` invariants; soft-skips on 404). 2026-07-01 (RFC 0121 — subscription-reuse provider auth mode, suite `1.46.0 → 1.47.0`) added `aiproviders-subscription-scope.test.ts` (always-on schema leg: the `aiProviders.authModes` closed enum includes `subscription`; §B.7 advertisement-gated leg: a `subscription` provider MUST appear in `byok`; §B.8 bind-seam-gated leg over `POST /v1/host/sample/credentials/bind` asserting a tenant-scope binding is rejected with `credential_scope_forbidden` — the public test for the protocol-tier `subscription-credential-user-scope-only` invariant. §B.8 is gated on the seam rather than on advertisement, so a host that cannot lawfully advertise `subscription` can still witness the user-scope safety rail; soft-skips when the seam is unwired). 2026-06-29 (RFC 0120 — connection-pack `apiHosts` credential-egress allow-list, suite `1.45.0 → 1.46.0`) added `connection-pack-apihosts.test.ts` (always-on schema legs: the `connection-pack-apihosts-valid` fixture validates, an `openapi`-reach provider omitting `apiHosts` is rejected by the conditional-MUST `allOf`, and IP/wildcard/port/single-label/uppercase entries are each rejected; always-on matching-rule legs: the item-10 dot-anchored eTLD+1 suffix-containment rule permits subdomains + a tighter exact host and fails closed with no substring/suffix/prefix escape — the public tests for the protocol-tier `connection-pack-api-host-shape` + `connection-pack-egress-host-bound` invariants; plus a capability-gated behavioral egress allow-list leg over the new `POST /v1/host/sample/connection-packs/egress-check` seam, soft-skipping when unadvertised/unwired). 2026-06-28 (RFC 0118 — parallel sub-workflow fan-out and join, suite `1.44.0 → 1.45.0`) added `dispatch-fanout-parallel.test.ts` (always-on schema legs for `dispatch-config.schema.json` — accepts a valid `parallel` config + each `joinPolicy.mode` + `maxConcurrency`, rejects unknown enum values / `additionalProperties` on `joinPolicy` / non-positive `maxConcurrency`, keeps a pre-RFC-0118 config valid — and the `dispatchFanOut`/`dispatchJoin` event `$defs` of `run-event-payloads.schema.json` — `fanOutPolicy` const `parallel`, `childCount ≥ 2`, the required replay-deterministic `mergeOrder`; capability-gated behavioral legs over `POST /v1/host/sample/dispatch/fanout` (wait-all/collect → `joinOutcome: satisfied` + full `children[]` + `mergeOrder`) plus the un-gated registration-rejection leg (`fanOutSupported:false` host MUST reject `parallel` with a 4xx); soft-skips on absent `dispatch.fanOutSupported` / `parallel` ∉ `fanOutPolicies`). 2026-06-27 (RFC 0117 — front-end plugin packs, suite `1.43.0 → 1.44.0`) added `frontend-plugin-packs.test.ts` (always-on schema legs for `frontend-plugin-manifest.schema.json` + the `ui-plugin/1` envelope `ui-plugin-message.schema.json`: manifest validity, `runtime`-forbidden, path-traversal-guarded `entry`, the closed `hostApi` allowlist, the version-token `artifact_conflict` + `currentVersion` concurrency shape, and no credential-bearing envelope field (`additionalProperties:false`); the capability-shape leg asserts `isolation` pins to the `cross-origin-iframe` const; capability-gated behavioral legs over `POST /v1/host/sample/ui-plugin/rpc` assert an undeclared method → `method_not_allowed` and a stale `artifact.write` → `artifact_conflict` with no persist; soft-skips on absent `capabilities.uiPlugins.supported` or `404`/`403` on the seam (RFC 0117 stays Active pending host witnesses); the public test for the protocol-tier `frontend-plugin-{isolation,egress,rpc-allowlist,no-byok}` invariants). 2026-06-26 (RFC 0116 — portable prompt-prefix cache, suite `1.42.0 → 1.43.0`) added `prompt-prefix-cache.test.ts` (advertisement-shape on `aiProviders.promptPrefixCache` + behavioral legs over the OPTIONAL `POST /v1/host/sample/ai/generate` seam (`host-sample-test-seams.md` §16): (a) outcome-invariance — a generate with `cachePrefixId` and a control without produce the same accepted envelope + identical `provider.usage.inputTokens`/`outputTokens` (cost-hint-only, replay-invariant); (b) cache-hit observable — a repeat generate shows `cacheReadTokens > 0`; (c) cross-tenant isolation — tenant B’s first use of tenant A’s `cachePrefixId` shows `cacheReadTokens == 0`, the public test for the protocol-tier `prompt-prefix-cache-cross-tenant-isolation` invariant (the host MUST key its provider cache by `(tenant, cachePrefixId)`, never global); (d) secret-free — the cost-only cache-token fields carry no prompt substrings (SR-1); soft-skips on absent `aiProviders.promptPrefixCache.supported` or `404`/`405` on the seam, since RFC 0116 defers reference-host impl as provider-gated). 2026-06-26 (RFC 0114 — A2UI surface deltas, suite `1.41.0 → 1.42.0`) added `a2ui-surface-delta-transport.test.ts` (always-on legs use a cast-free, dependency-free client-side RFC 6902 applier + Ajv2020 to assert: the new `a2ui-surface-delta-frame.schema.json` compiles, the op enum excludes `test`, a full surface + delta frames reconstruct the expected tree AND equal the full a non-negotiating subscriber materializes and re-validate against the closed catalog, an out-of-catalog/script-bearing delta fails closed-catalog validation post-patch — the `a2ui-surface-no-code-exec` boundary holds — and the recorded envelope is always the full surface; the HTTP leg is capability-gated on `a2uiSurface.deltaTransport` and soft-skips on absent host/capability or `404`/`405` on the OPTIONAL `GET /v1/host/sample/a2ui/surface/materialized` seam). 2026-06-26 (RFC 0111 — context economy, suite `1.40.0 → 1.41.0`) added `context-budget-transcript-bound.test.ts` (capability-gated on `multiAgent.executionModel.contextBudget.transcriptTokenBudget` being present via `behaviorGate(openwop-context-budget, …)` — drives the `conformance-context-budget-multiturn` orchestrator fixture, reads the host’s per-iteration accounting via the OPTIONAL seam `GET /v1/host/sample/agent/transcript-window?runId=…&iteration=N` (`host-sample-test-seams.md` §14), and asserts `tokenCount ≤ transcriptTokenBudget` in the advertised `tokenCounter` unit, that every `eventId` in the seam accounting is a real persisted run event (internal-consistency cross-check against `/v1/host/sample/test/runs/:runId/events`), recent-tail + no-double-count, every `summarizedRanges.summaryRef` has a matching `context.summarized` event, and `keepLastTurns` recent turns are fed verbatim — never inside a summarized range; soft-skips on `404`/`405` since the RFC defers reference-host impl) + `context-summarization-replay.test.ts` (capability-gated on `multiAgent.executionModel.contextBudget.summarization.supported` via `behaviorGate(openwop-context-summarization, …)` — replays the run via `:fork mode:replay` and asserts the recorded `context.summarized` → `summaryRef` records are REUSED, never re-summarized, the direct analogue of RFC 0041 envelope-refusal recovery; soft-skips when the event-log seam is unwired, no `replay` mode is advertised, or the run produced no summarization). 2026-06-26 (RFC 0113 — memory injection budget, suite `1.39.0 → 1.40.0`) added `memory-injection-budget.test.ts` (capability-gated on `memory.injectionBudget.supported === true` via `behaviorGate(openwop-memory-injection-budget, …)` — drives the `conformance-agent-memory-injection-budget` fixture through the host-sample memory seam and asserts the budgeted injection read's cumulative tokens ≤ the requested `tokenBudget` in the advertised `tokenCounter` unit (`o200k_base`/`cl100k_base`/`chars`/`host-defined`), an over-budget single entry is omitted not truncated, and re-asserts SR-1 (`[REDACTED:<secretId>]` content) + CTI-1 (cross-tenant probe returns empty) on the budgeted path; the `rank:'relevance'` leg DELEGATES to `memory.search` semantic (RFC 0080) and asserts relevance ordering differs from recency ONLY when the host ALSO advertises `memory.search` semantic, else it soft-skips — there is NO ranking primitive in `injectionBudget`; soft-skips on hosts that do not advertise `memory.injectionBudget`). 2026-06-26 (RFC 0112 — compact tool projection, suite `1.38.0 → 1.39.0`) added `tool-catalog-compact-projection.test.ts` (capability-gated on `toolCatalog.compactView === true` via `behaviorGate(openwop-tool-catalog-compact, …)` — drives `GET /v1/tools?view=compact` and asserts the host returns the `{ tools: CompactToolDescriptor[] }` envelope where every descriptor validates against `compact-tool-descriptor.schema.json` with the heavy `ToolDescriptor` fields dropped, every present `inputSchema` satisfies the self-contained compact structural subset (top-level `type:"object"`+`properties`; no `$ref`/`oneOf`/`allOf`/`anyOf`/`not`/`patternProperties`/`dependentSchemas`), and the compact `tools[]` `toolId` set EQUALS the standard view set for the same principal (projection completeness); soft-skips on hosts that do not advertise `toolCatalog.compactView`). 2026-06-26 (RFC 0115 — run transport economy, suite `1.37.0 → 1.38.0`) added `run-transport-economy.test.ts` (capability-gated on `restTransport.conditionalRunGet === true` and a non-empty `restTransport.contentEncodings` — drives `GET /v1/runs/{runId}` and asserts a sequence-derived strong `ETag` on the `200`, `If-None-Match` → `304` with an empty body while the run is unchanged, the `ETag` ROTATES after the `conformance-approval` fixture advances `waiting-approval → completed` (proving it derives from the latest persisted event-log sequence, not a coarser signal that would leave a `304` stale), and each advertised `Content-Encoding` (`gzip` baseline; `br`/`zstd` optional) round-trips byte-identically to the identity body; soft-skips on hosts that do not advertise `restTransport`). 2026-06-24 (RFC 0110 — channel presence, behavioral leg) added `channel-presence-behavioral.test.ts` (capability-gated on `channelPresence.supported` via `behaviorGate('openwop-channel-presence', …)` — drives the `POST /v1/host/sample/channel-presence/snapshot` seam and asserts a live `channel.presence` snapshot is the CLOSED `{conversationId,present,typing}` shape (no PII), every ref is an opaque RFC 0041 `user:`/`agent:` subject, `typing ⊆ present`, and the snapshotting member is non-vacuously present; soft-skips on 404/405 — a host whose presence is bound to a product flow witnesses via its own route test + an INTEROP-MATRIX row, the RFC 0086 dual-staging). 2026-06-24 (RFC 0110 — channel presence, Accept cycle) added `channel-presence-shape.test.ts` (always-on server-free — the OPTIONAL `channel.presence` ephemeral payload validates a conforming snapshot, REQUIRES `conversationId`+`present`, is CLOSED `additionalProperties:false` (the no-PII guard), `typing` optional; `channel.presence` is in the `RunEventType` enum; the `channelPresence` capability block is declared + closed). 2026-06-24 (RFC 0109 — conversation-turn model provenance, Accept cycle) added `conversation-turn-model-provenance-shape.test.ts` (always-on server-free — `agent.model` `{provider, model}` validates conforming / both-required / closed-SR-1 / optional-back-compat, + the `conversationTurnModelProvenance` capability declared + closed). 2026-06-24 (RFC 0108 — self-hosted / OpenAI-compatible provider class, Accept cycle, suite `1.36.0 → 1.37.0`) added the gated behavioral honesty leg `aiproviders-selfhosted-honesty.test.ts` (gated on `aiProviders.selfHosted.length > 0` via `behaviorGate('openwop-selfhosted-providers', …)` — drives `POST /v1/host/sample/ai/call` against an advertised `selfHosted` id and asserts **§A.2** the dispatch reaches a real configured endpoint (success or transport error — never `capability_not_provided` / `provider_not_supported`, which would prove a dishonest advertisement with no endpoint behind it) and **§D** the endpoint location — supplied out-of-band via `OPENWOP_TEST_COMPAT_ENDPOINT`, checked as the raw string + bare `host`/`host:port` — never appears in the seam response or error payload; soft-skips on 404 / when the env var is unset for the §D leg). 2026-06-24 (RFC 0108, suite `1.35.0 → 1.36.0`) added the always-on server-free shape leg `aiproviders-selfhosted-shape.test.ts` (the additive `aiProviders.selfHosted` advertisement: a `string[]` with `uniqueItems`/`minLength:1` items, absent from `aiProviders.required`, validates a conforming array via Ajv2020 while rejecting non-array / duplicate / empty-string forms, and enforces the two §A rules JSON Schema cannot express — §A.1 every `selfHosted` entry is a subset of `supported`, and §A.3 / `self-hosted-endpoint-no-disclosure` no entry is URL-shaped (`://`, bare `host:port`, or leading `/` path) — exercised against good/bad example docs). 2026-06-23 (RFC 0106 — real-time voice session profile, Accept cycle) added six gated behavioral scenarios driving the openwop-app live host (rev `00293-89w`): `voice-transcription-streaming` + `voice-transcription-unadvertised` (the `call-transcriber` seam; the latter gated-by-absence), `voice-synthesis-streaming` (the `stream:true` synthesis arm → metadata-only `voice.synthesis_chunk` events), `voice-bargein-no-partial-leak` (the `/voice/barge-in` seam — `voice.barge_in`→`voice.cancelled` with no chunk after; **graduated `voice-bargein-no-partial-leak` reference-impl→protocol** on the live proof), and `voice-interim-not-durable` + `voice-streamref-tenant-bound` (§F INV-1/INV-4; soft-skip on the §E `transcription_unsupported` / no-live-streamRef path — stay reference-impl until a host with a scripted-interim / live-streamRef arm proves them). 2026-06-23 (RFC 0107 — publishable declarative pack kinds) added one: `registry-declarative-kinds.test.ts` (always-on server-free — the registry version-manifest carries the `kind` discriminator + per-kind declarative payload, `runtime` is conditional on `kind` via `allOf if/then/else`, published artifact-type and connection manifests validate, and a declarative-with-`runtime` or node-without-`runtime` manifest is rejected). 2026-06-23 (RFC 0107 correction, suite `1.34.0 → 1.35.0`) extended that scenario with two cases — a published **chat-card** pack manifest (`kind: "card"`, RFC 0071) validates, and the never-canonical `kind: "chat-card"` is **rejected** — fixing a kind-string mismatch where RFC 0107's published schema enumerated `chat-card` while RFC 0071 (authoritative) defines `card` (no scenario-file count change; cases added to the existing file). 2026-06-23 (RFC 0106 — real-time voice session profile, Phase 2) added one: `voice-event-payloads-shape.test.ts` (always-on server-free — all seven `voice.*` types are in the `RunEventType` enum, each has a payload `$def` via `typeIndex`, `voice.transcript` REQUIRES `contentTrust:"untrusted"` (the schema-enforced half of `voice-transcript-untrusted`), `voice.synthesis_chunk` is metadata-shaped (seq+mimeType required; bytes by `url`/`streamRef`), and the content-free events reject unknown properties). Phase 2 also lands the `voice.*` payload `$defs` in `run-event-payloads.schema.json` + the `asyncapi.yaml` messages + the four §F `SECURITY/invariants.yaml` rows (1 protocol-tier `voice-transcript-untrusted` + 3 reference-impl behavioral, graduating at `Active → Accepted`). The gated behavioral legs (`voice-transcription-streaming`/`-unadvertised`, `voice-synthesis-streaming` + the three behavioral invariant scenarios) land with the reference host at `Active → Accepted`. 2026-06-23 (RFC 0106 — real-time voice session profile, Phase 1) added one: `aiproviders-realtimevoice-shape.test.ts` (always-on server-free — the `aiProviders.realtimeVoice` object advertisement: the four sub-flags `transcription`/`synthesis`/`turnDetection`/`bargeIn` are declared, `realtimeVoice` is absent from `aiProviders.required`, the `turnDetection`/`bargeIn ⇒ transcription` `dependentRequired` closure and the `synthesis ⇒ speechSynthesis` if/then closure hold via Ajv2020, and out-of-enum / boolean sub-flag values are rejected). The gated behavioral legs (`voice-transcription-streaming` / `-unadvertised`, `voice-synthesis-streaming`) and the four §F live-ingress invariant scenarios land in Phase 2 at the `Active → Accepted` cycle. 2026-06-22 (RFC 0101 — multi-party group conversation) added two — `multi-party-conversation-shape.test.ts` (always-on server-free — asserts the three additive RFC 0101 wire facts: a 3-agent council `conversation.opened` participant roster (instance ids) + a user opening turn validates, every `role: 'agent'` turn carrying a roster-instance `speakerId` validates while one OMITTING `speakerId` MUST FAIL schema validation (the `allOf`/`if role==='agent' then required:['speakerId']` conditional), a non-AgentRef participant item is rejected, the `capabilities.multiPartyConversation { supported, maxParticipants? }` block is declared + closed and rejects extras / `maxParticipants:1` / a missing `supported`, and the non-participant membership predicate is asserted server-free) and `multi-party-conversation-behavioral.test.ts` (capability-gated on `multiPartyConversation.supported` via `behaviorGate('openwop-multi-party-conversation', …)` — drives the conformance-only seam `POST /v1/host/sample/conversation/multi-party/{open,exchange}` (`host-sample-test-seams.md`, since RFC 0101 mints no normative client trigger to open a council): a 3-agent council opens and a roster-valid attributed agent turn is accepted, while a `role:'agent'` turn missing `speakerId`, a non-participant `speakerId`, and an over-`maxParticipants` open are each rejected with `error.code:'validation_error'` (status-tolerant 400/422 per RFC 0005 §E); soft-skips on 404/405 — reference impl: the postgres example host). 2026-06-20 (RFC 0105 — speech synthesis adapter) added three: `aiproviders-speechsynth-shape.test.ts` (always-on server-free — the `aiProviders.speechSynthesis` `const "supported"` flag is declared, absent from `aiProviders.required`, and a string-const advertisement validates while the object form `{supported:true}` is rejected), `speech-synthesis-roundtrip.test.ts` (gated on `aiProviders.speechSynthesis === "supported"` via `behaviorGate('openwop-speech-synthesis', …)` — an advertising host's `callSpeechSynthesizer` round-trip via the `POST /v1/host/sample/ai/call-speech-synthesizer` seam returns `audio` with EXACTLY ONE of `url`/`base64`, a non-empty `mimeType`, and the echoed `voiceId`; soft-skips on 404), and `speech-synthesis-unadvertised.test.ts` (gated-by-absence via `behaviorGate('openwop-speech-synthesis-unadvertised', …)` — a host NOT advertising `speechSynthesis` MUST reject the call with `speech_synthesis_unsupported`, never a silent no-op). 2026-06-19 (RFC 0104 — portable HITL approver routing) added one: `interrupt-approver-routing.test.ts` (server-free Ajv2020 — the `interrupt.approverRouting` capability block shape, the additive optionality of `approverGroupRefs` / `approverRoleRefs` / `audience` on the `ApprovalData` schema, the closed `audience` object, and the §"Portable approver routing" `notifyTargets` reference rule that `audience` DEFAULTS to the resolved eligibility union when omitted and OVERRIDES it when present; the capability-gated leg asserts an advertising host's `interrupt.approverRouting` is honest — `refKinds` ⊆ {group, role}, `audience` boolean — and soft-skips when the host does not advertise the capability). 2026-06-17 (RFC 0103 — localized content surface) added one: `localized-content-delivery.test.ts` (server-free Ajv2020 — the four content schemas + the §C `resolveSection` merge + §A capability coherence; the public test for `content-published-cache-no-draft` / `content-response-tenant-scoped` / `content-no-cross-tenant-enumeration`; the live legs gate on `capabilities.content.supported` and soft-skip without a `GET /v1/content/pages/{slug}` target). 2026-06-15 (RFC 0102 — A2UI agent-authored interface surfaces) added five: `a2ui-surface-shape.test.ts` (server-free Ajv2020 — the closed core `ui.a2ui-surface` payload validates, while an out-of-catalog component / extra script-bearing property / unenumerated `catalogVersion` / `action.target` outside `enum["resume","exchange"]` each fail; the structural half of `a2ui-action-confinement` and the enabling precondition for the render-side `a2ui-surface-no-code-exec` / `a2ui-surface-no-network-egress` reference-app probes), `a2ui-surface-degrades.test.ts` (the kind is optional/advertised, not a MUST-recognize universal kind, and an unadvertised kind is gated — N6 — never crashing the run), `a2ui-surface-version-refusal.test.ts` (the enumerated `catalogVersion` rejects an unadvertised version → `unknown_schema_version`, and the surface schema carries no external `$ref`), `a2ui-surface-replay.test.ts` (all `$ref`s internal so a stored surface `:fork`/replays deterministically; same-`correlationId` + divergent `type` → `envelope_correlation_conflict`), and `a2ui-untrusted-blocks-approval.test.ts` (a `meta.contentTrust:'untrusted'` surface is trust-gated and MUST NOT advance an approval interrupt — composition of `untrusted_content_blocks_approval`). The four behavioral legs soft-skip on 404 (host-pending; the `openwop-app` reference renderer is the render-side probe). 2026-06-14 (RFCs 0099/0100 — external-event trigger ingestion + async/durable A2A tasks) added one new scenario (`trigger-ingestion.test.ts`) and extended `a2a-task-roundtrip.test.ts` with the RFC 0100 async subtests: `trigger-ingestion.test.ts` (RFC 0099 — always-on `TriggerEvent` / `TriggerSubscriptionRegistration` schema legs incl. the §F.1 per-source one-of, the `AttachmentRef.ref`-only rule + raw-URL rejection backing `trigger-ingestion-ssrf`, and the content-free `trigger.delivery.attempted` shape backing `trigger-ingestion-content-redaction`; plus a capability-gated behavioral leg on `triggerBridge.ingestion` driving the `POST /v1/host/sample/trigger-bridge/ingest` seam for SSRF refusal + header-redaction), and the `a2a-task-roundtrip.test.ts` additions (RFC 0100 — always-on `A2ATaskState` + `capabilities.a2a` shape legs incl. the lowercase-hyphen state enum, the `PushConfig` `url`-required + truncated-`tokenFingerprint` rule backing `a2a-push-egress-ssrf`, the no-inline-inputs `additionalProperties:false` SR-1 check; plus capability-gated durable-`tasks/get`-after-disconnect and push-SSRF behavioral legs on `a2a.durableTasks` / `a2a.pushNotifications` via the `/v1/host/sample/a2a/tasks/*` seam). 2026-06-13 (RFCs 0096/0097/0098 — reviewable learning, standing goals, agent-platform portability) added three always-on-plus-gated scenarios: `proposal-reviewable-learning.test.ts` (RFC 0096 — the `agents.proposals` shape + the `Proposal` round-trip incl. the dropped `rule` kind + the content-free `proposal.{created,activated}` events, plus a gated apply-without-scope→403 leg; backs `proposal-inert-until-applied` + `proposal-no-resynthesis`), `goal-standing-continuation.test.ts` (RFC 0097 — the `agents.goals` shape + the `Goal` round-trip + the content-free `goal.{evaluated,closed}` events, plus gated bounded-termination→422 + judge-only-completion legs; backs `goal-continuation-bounded` + `goal-completion-judge-only`), and `export-bundle-portability.test.ts` (RFC 0098 — the `portability` shape incl. the `import⇒dryRun` if/then + the `ExportBundle` round-trip rejecting every credential-named field + the content-free `import.applied` event, plus a gated literal-credential-import→422 leg; backs `export-bundle-no-credential-material`). 2026-06-11 (RFCs 0093/0094 — protocol hardening + wire-shape reconciliation) added five: `version-fold.test.ts` (the `version-negotiation.md` §`X-Force-Engine-Version` cross-version matrix through the previously-orphaned `conformance-version-fold` fixture — closes catalog gap F5; soft-skips when `Capabilities.testing.forceEngineVersionRange` is unadvertised), `stream-text-fixture.test.ts` (the `stream-modes.md` §`messages` fold through the deterministic `stream-text` mock provider + the previously-orphaned `conformance-stream-text` fixture — closes catalog gap F1), `i18n-negotiation.test.ts` (gated on `capabilities.i18n` via `behaviorGate('openwop-i18n', …)` — an unsupported or malformed `Accept-Language` never 400s, `Content-Language` reflects the locale actually used, and error `code` strings stay the canonical English tokens), `grpc-transport.test.ts` (gated on `capabilities.grpc` via `behaviorGate('openwop-grpc-transport', …)` — advertisement-shape only per `grpc-transport.md` §Field semantics: `service` MUST be `openwop.v1.Engine`, the `tls` enum, `grpcs?://` endpoint URIs, `supportedTransports` includes `grpc` when exposed, production claimants require `tls: "required"`; no gRPC dialing), and `webhook-tenant-isolation.test.ts` (RFC 0093 §A.3 — backs the new protocol-tier `webhook-cross-tenant-isolation` invariant; a two-tenant proof through the `/v1/host/sample/test/surface` seam plus black-box registration-surface scoping). `spec-corpus-validity.test.ts` also gained the RFC 0094 §A satisfiability probe: canonical `createRun` bodies MUST pass the composed request schema (closed via `unevaluatedProperties: false` at the composition site, never inside an `allOf` branch) and an undeclared property MUST fail. 2026-06-07 (RFCs 0090/0091/0092 — verifier turn + convergence, multimodal perception input, agent capability requirements) added six: the always-on, server-free shape probes `agent-verifier-shape.test.ts`, `aiproviders-input-shape.test.ts`, `agent-requires-capabilities-shape.test.ts`, plus the capability-gated **behavioral** legs `agent-capability-degraded-projection.test.ts` (RFC 0092 §B — the `degraded[]` projection on `GET /v1/agents`, black-box, non-vacuous via `OPENWOP_DEGRADED_CAPABILITY_AGENT_ID`), `callai-multimodal.test.ts` (RFC 0091 §A/§B — advertised modality accepted / unadvertised → `unsupported_modality`, via the `POST /v1/host/sample/ai/call` seam), and `verifier-gating.test.ts` (RFC 0090 §B — a `fail` verdict blocks commit, via the `POST /v1/host/sample/agents/verify-run` seam). The three behavioral legs soft-skip by default and hard-fail under `OPENWOP_REQUIRE_BEHAVIOR=true` — the Active→Accepted reference-host proof for each RFC. 2026-06-02 (RFC 0082 §B — deployment channel resolve-and-pin, production-path coverage) added `agent-channel-dispatch.test.ts` (capability-gated on `agents.deployment.supported` + the seeded `conformance-agent-channel-dispatch` fixture + advertised `replay` mode via `behaviorGate('openwop-deployment-channel-dispatch', …)` — proves the §B pin from a REAL run graph, complementing `agent-deployment-lifecycle.test.ts` Leg 4's host-sample seam: a canonical `POST /v1/runs` of a node binding `agent.channel:"stable"` MUST record `resolvedChannel` + `resolvedAgentVersion` on `agent.invocation.started` (RFC 0077), a `:fork{mode:"replay"}` MUST re-read that recorded version, and the seam-guarded Leg 3 MOVES the channel then asserts a replay STILL carries the original pin — never re-resolving a moved channel; soft-skips by default, hard-fails under `OPENWOP_REQUIRE_BEHAVIOR=true` — the production-path proof of the §B contract). 2026-06-01 (RFC 0085 — `openwop-agent-platform` meta-profile, the Active→Accepted behavioral gate) added `agent-platform-aggregate-evidence.test.ts` (capability-gated on a host CLAIMING `openwop-agent-platform` in its live discovery `profiles[]` via `behaviorGate('openwop-agent-platform', …)` — the §C/§D honest-advertisement rule on the live `/.well-known/openwop`: the claim MUST satisfy the §B floor predicate (`isAgentPlatformPartial` → `partial`/`full`, never `none`), backed by the per-capability evidence not the profile string; `OPENWOP_AGENT_PLATFORM_TIER=full` forces the non-vacuous full bar — all governance terms + tenant installScope + all 16 §D terms; server-requiring, the always-on §B/§D derivation legs stay in `agent-platform-profile.test.ts` — the RFC 0085 → Accepted bar). 2026-06-01 (RFC 0084 — budget, quota + cost policy, the Active→Accepted behavioral gate) added `budget-enforcement.test.ts` (capability-gated on `budget.supported` via `behaviorGate('openwop-budget-enforcement', …)` — the §C/§D enforcement via the new `POST /v1/host/sample/budget/run` seam + the test event-log seam: a `hard-cost-exhaust` run emits the strict-ordered `budget.reserved → budget.consumed → budget.threshold.crossed{percent} → budget.exhausted → cap.breached{kind:"budget-cost"} → run.failed{error:"budget_exhausted"}` chain; a `model-denied` run is refused `budget_model_denied` BEFORE the provider call (fail-closed); an `advisory` host emits the `budget.*` events without stopping; every `budget.*` payload content-free backing `budget-no-pricing-leak`; new lib helper `src/lib/budgetPolicy.ts`; soft-skips on 404 — the RFC 0084 → Accepted bar). 2026-06-01 (RFC 0080 — agent memory capability reconciliation, the Active→Accepted behavioral gate) added `memory-degraded-projection.test.ts` (capability-gated on `agents.manifestRuntime.supported` + `memory.supported` via `behaviorGate('openwop-memory-degraded', …)` — the §C degraded-projection iff-contract on the NORMATIVE `GET /v1/agents`: a degraded inventory entry MUST carry `memoryDegraded:true` + a non-empty, unique `degradedMemoryDimensions[]` from the closed §A-name enum, a non-degraded entry MUST NOT, the inventory is non-empty, and the degraded branch runs non-vacuously when `OPENWOP_DEGRADED_AGENT_ID` names a known-degraded agent; black-box, no POST seam — the RFC 0080 → Accepted bar). This batch also documents the two RFC 0068 conformance seams (`POST /v1/host/sample/memory/consolidate` + `.../commitment/fire`) in `host-sample-test-seams.md` (the 0068 gated scenarios shipped in 1.14.0). 2026-06-01 (RFC 0034 — collector-side BYOK-canary inspection) added `otel-collector-canary-inspection.test.ts` (always-on server-free: stands up a real `OtelCollector`, POSTs synthetic OTLP/HTTP-JSON traces + metrics through its actual ingest path, and proves the new `findCanaryLeakage()` inspector catches a canary embedded in a span attribute / resource attribute / span name / metric data-point attribute while reporting ZERO hits on a redacted payload and never matching an empty canary — the non-vacuous proof that the conformance collector now inspects what the host's OTLP exporter ACTUALLY shipped over the wire, closing the `secret-leakage-otel-attribute` / `-debug-bundle-otel` collector-seam gap; the live capability-gated complement is the new collector-export describe block in `secret-leakage-otel-attribute.test.ts`). 2026-06-01 (RFC 0035 — sandbox wall-clock timeout, the 7th-of-8 graduation) added `sandbox-wasm-timeout.test.ts` (worker-driven server-free: `probeTimeout` in `wasm-sandbox-probe.ts` spawns a worker thread running the committed `misbehaving-timeout.wasm` + a main-thread kill-timer — the thread preemption a same-thread probe can't do — asserting `sandbox_timeout` with a well-behaved positive control; graduates `node-pack-sandbox-timeout` reference-impl→protocol, so 7 of 8 `node-pack-sandbox-*` invariants are now protocol-tier, only the JS-specific `no-eval` permanently exempt). 2026-05-31 (audit-response black-box / graduation batch) added three more: `sandbox-wasm-isolation.test.ts` (RFC 0035 — drives the committed `fixtures/wasm-sandbox/*.wasm` through `wasm-sandbox-probe.ts`: escape/capability-gate via static `WebAssembly.Module.imports()`, an OOB-store memory trap, double-instantiate isolation; 10/10; graduates 6 `node-pack-sandbox-*` invariants reference-impl→protocol), `workspace-cross-tenant-isolation-blackbox.test.ts` (RFC 0059 — two-credential black-box on the normative §C `/v1/host/workspace/files` endpoints: owner A writes, a second-tenant credential fails closed; no seam), and `prompt-resolution-chain-event.test.ts` (RFC 0029 — reads the durable `agent.promptResolved.chain[]` precedence record via the normative `GET /v1/runs/{runId}/events/poll`; no seam) — each the production-path proof that graduates its surface into the `openwop-core-standard` floor. 2026-05-31 (RFC 0088 — the `openwop-core-standard` Core Standard Profile, the audit-response Core Candidate target) added `core-standard-profile.test.ts` (always-on server-free derivation probe: `isCoreStandard` derives the §B floor — `openwop-core` ∧ `openwop-interrupts` ∧ (`openwop-stream-sse` ∨ `openwop-stream-poll`) — a bare `openwop-core` host without interrupts is excluded, a host with no event transport fails, and the annex is absent from `deriveProfiles` because it composes rather than redefines). 2026-05-31 (RFC 0082 — agent deployment lifecycle, the Active→Accepted behavioral gate) added `agent-deployment-lifecycle.test.ts` (capability-gated on `agents.deployment.supported` via `behaviorGate('openwop-deployment-lifecycle', …)` — the §E promotion contract via the new `POST /v1/host/sample/agents/deployment-transition` seam + the test event-log seam across four legs: `promote` (authorize RFC 0049 → approvalGate RFC 0051 → eval-verify RFC 0081 → content-free `deployment.promoted` with a seven-state `toState` + `toVersion`, the record validating `agent-deployment.schema.json`), `unauthorized` (fail-closed — `allowed:false`, no `deployment.promoted`, the behavioral leg of `deployment-promotion-fail-closed`), `eval-gate-unmet` (`eval_gate_unmet` denial, §E-3), and `channel-pin` (the §B `resolvedAgentVersion` recorded-fact on `agent.invocation.started`); new lib helper `src/lib/agentDeployment.ts`; soft-skips on 404 — the RFC 0082 → Accepted bar). 2026-05-31 (RFC 0081 — agent evaluation, the Active→Accepted behavioral gate) added `agent-eval-run.test.ts` (capability-gated on `agents.evalSuite.supported` via `behaviorGate('openwop-eval-run', …)` — the §B `mode:"eval"` projection via the new `POST /v1/host/sample/agents/eval-run` seam + the test event-log seam: `eval.started`-first → one `eval.scored` per task → `eval.completed`-once ordering (count == `eval.completed.taskCount`), the content-free `eval.scored` legs (`score` ∈ 0..1) backing `eval-summary-no-content-leak`, and the NORMATIVE `GET /v1/runs/{runId}/eval-summary` schema-valid `EvalSummary` round-trip with `passedCount <= taskCount`; new lib helper `src/lib/agentEval.ts`; soft-skips on 404 — the RFC 0081 → Accepted bar). 2026-05-31 (RFC 0083 — durable trigger bridge, the Active→Accepted behavioral gate) added `trigger-bridge-delivery.test.ts` (profile-gated on `openwop-trigger-bridge` derived from the live discovery doc — the §C delivery model via the `POST /v1/host/sample/trigger-bridge/deliver` seam + the test event-log seam: dedup→effectively-once `trigger.delivery.attempted{delivered}` (§C-1), retry-exhaustion→`{dead-lettered}` + `trigger.subscription.state.changed{toState:dead-lettered}` (§C-2 + RFC 0053), and the delivered run's `run.started.causationId` == the delivery id (§C / RFC 0040); both `trigger.*` events content-free; the always-on shape stays in `trigger-bridge-shape.test.ts`; new lib helper `src/lib/triggerBridge.ts`). 2026-05-31 (RFC 0087 — agent org-chart, the Active→Accepted behavioral gate) added two capability-gated behavioral scenarios (both gated on `agents.orgChart.supported`, black-box on the normative `/v1/agents/org-chart` surface — no new POST seam): `agent-org-chart-scoping.test.ts` (the `GET /v1/agents/org-chart` tree-shape — departments form an acyclic `parentDepartmentId` tree, members reference `host:<id>` roster entries — + the §D responsibility roll-up via `GET /v1/agents/org-chart/{departmentId}` with a deduped `responsibilities[]` union + the RFC 0074 cross-tenant 404 via `OPENWOP_CROSS_TENANT_ORG_CHART_DEPARTMENT_ID`) and `org-position-no-authority-escalation.test.ts` (the behavioral leg of the protocol-tier invariant — the live org-chart wire carries NO authority-bearing field on any member/department/responsibility-view object; the structural leg stays always-on in `agent-org-chart-shape.test.ts`, and the deeper RFC 0049/0051 authority-invariance legs stay reference-impl tier per the `agent-manifest-runtime` no-host-hook precedent). 2026-05-31 (RFCs 0086 + 0077 — the Active→Accepted behavioral gate) added four capability-gated behavioral scenarios so a non-steward host can be mechanically certified non-vacuously under `OPENWOP_REQUIRE_BEHAVIOR=true`: `agent-roster-attribution.test.ts` (RFC 0086 §B/§C; gated on `agents.roster.supported` — the normative `GET /v1/agents/roster` read shape + `total==roster.length`, the §C `roster.run.initiated`-before-`agent.invocation.started` ordering, the content-free payload backing `roster-attribution-no-content`, the durable work-item `triggerSubscriptionId`, and the RFC 0074 cross-tenant 404 via `OPENWOP_CROSS_TENANT_ROSTER_ID`), `agent-live-invocation-bracket.test.ts` (RFC 0077 §E; gated on `agents.liveRuntime.supported` — `agent.invocation.started`-first / `agent.invocation.completed`-last bracket, matching `invocationId`, `source`/`outcome` closed enums, content-free), `agent-live-structured-output.test.ts` (RFC 0077 §B step 6; gated on `agents.liveRuntime.structuredOutput` — a result violating `handoff.returnSchemaRef` fails the invocation `outcome:"failed"` rather than shipping as completed), and `agent-live-allowlist-enforced.test.ts` (RFC 0077 §F-1 / RFC 0002 §A14; gated on `agents.liveRuntime.supported` — a tool outside `toolAllowlist` is not callable); all four drive the documented `POST /v1/host/sample/roster/fire` + `POST /v1/host/sample/agents/live-invoke` seams plus the test event-log seam and soft-skip on 404 (these are the RFC 0086 / 0077 Active→Accepted bars). 2026-05-30 (RFC 0087 — agent org-chart, Draft -> Active) added `agent-org-chart-shape.test.ts` (always-on server-free: the `capabilities.agents.orgChart` shape + the `AgentOrgChart` round-trip + the non-`host:` member negative + the **§B structural non-authority guarantee** — the schema rejects a `scopes`/`canDispatch`/`permissions`/`authority` field on a member (`additionalProperties:false`), and a member's key set is exactly `{rosterId, departmentId, roleId, reportsTo}` — backing the protocol-tier `org-position-no-authority-escalation` invariant; no new RunEventType). 2026-05-30 (RFC 0086 — standing agent roster, Draft -> Active) added `agent-roster-shape.test.ts` (always-on server-free: the `capabilities.agents.roster` shape + the `AgentRosterEntry` round-trip + the `host:` `rosterId` + `agentRef` version-XOR-channel negatives + the content-free `roster.run.initiated` negatives backing the protocol-tier `roster-attribution-no-content` invariant + the additive `roster` inventory projection + RunEventType-enum membership). 2026-05-30 (RFC 0082 — agent deployment lifecycle, Draft -> Active) added `agent-deployment-shape.test.ts` (always-on server-free: the `capabilities.agents.deployment` shape + the `AgentDeployment` record round-trip + the `AgentRef` `channel` XOR `version` `not`-clause + the four `deployment.*` payloads + the content-free negatives backing the protocol-tier `deployment-event-no-content-leak` invariant). 2026-05-30 (RFC 0085 — `openwop-agent-platform` meta-profile, Draft -> Active) added `agent-platform-profile.test.ts` (always-on server-free derivation of the operational-annex `none`/`partial`/`full` status: all-floor ⇒ partial, missing-flag ⇒ none, the replay-OR-`nondeterminismPolicy.declared` term, floor+governance ⇒ full, missing-tenant-scope ⇒ partial-not-full per the honest-advertisement rule, eval/deploy/budget-are-advisory-not-hard-terms, + the `capabilities.nondeterminismPolicy.declared` shape). 2026-05-30 (RFC 0084 — budget, quota + cost policy, Draft -> Active) added `budget-policy-shape.test.ts` (always-on server-free: `budget-policy.schema.json` round-trip + the §A orthogonality guard — a wall-time field is rejected (it's RFC 0058's `runTimeoutMs`) — + threshold/onExhaustion negatives + the four content-free `budget.{reserved,consumed,threshold.crossed,exhausted}` payloads + the four `cap.breached{budget-*}` kinds + RunEventType-enum membership + the no-pricing-property structural check backing the protocol-tier `budget-no-pricing-leak` invariant + the `capabilities.budget`/`limits.maxBudget*` shape). 2026-05-30 (RFC 0083 — durable trigger + channel bridge, Draft -> Active) added `trigger-bridge-shape.test.ts` (always-on server-free: `trigger-subscription.schema.json` round-trip + missing-`state`/out-of-enum-`source`/unknown-property negatives + the four-state vocab + the two content-free `trigger.{subscription.state.changed,delivery.attempted}` payloads incl. closed `state`/`outcome` enums + RunEventType-enum membership + the `triggerBridge`/`webhooks.durable` capability shape + the `openwop-trigger-bridge` profile derivation incl. the no-dead-letter-sink negative). 2026-05-30 (RFC 0079 — credential provenance + egress policy, Draft -> Active) added `egress-provenance-shape.test.ts` (always-on server-free: `credential-provenance.schema.json` round-trip + `audiences:[]`/missing-`credentialId`/unknown-property negatives + the no-secret-property structural check backing the protocol-tier `egress-decision-no-secret-leak` invariant + the content-free `egress.decided` record incl. the `decision` enum + RunEventType-enum membership + the `httpClient.egressPolicy` shape; the behavioral `egress-credential-audience-bound` confused-deputy MUST is reference-impl tier, deferred to a host). 2026-05-30 (RFC 0078 — portable tool catalog, Draft -> Active) added `tool-descriptor-shape.test.ts` (always-on server-free: `tool-descriptor.schema.json` round-trip + the §C-1 `exec` ⇒ `host-extension` cross-field MUST (RFC 0069) + the `safetyTier`-required negative + `additionalProperties:false`, the `capabilities.toolCatalog` `supported`/`sources`/`sessionLifecycle` shape, and the two content-free `tool.session.{opened,closed}` payload $defs incl. the closed `outcome` enum + RunEventType-enum membership). 2026-05-30 (RFC 0080 — agent memory capability reconciliation, Draft -> Active) added `memory-capability-model-shape.test.ts` (always-on server-free: the additive `capabilities.memory.{writable,search,retention}` dimension shapes + malformed-instance negatives — `retention.ttl` non-boolean, out-of-enum `search.modes`, unknown property under `additionalProperties:false` — the `agent-inventory-response` `memoryDegraded`/`degradedMemoryDimensions` closed-enum fields, and the `openwop-memory` derivation surfacing for read/write + long-term hosts while withholding from `writable:false`). 2026-05-30 (RFC 0081 — agent evaluation, Draft -> Active) added `agent-eval-suite-shape.test.ts` (always-on server-free: the `capabilities.agents.evalSuite` shape + the `AgentEvalSuite`/`EvalSummary` schema round-trips + the three `eval.{started,scored,completed}` payloads + the content-free negatives — a task entry with a `taskOutput` body, a `safetyFinding` with an `excerpt` — backing the new `eval-summary-no-content-leak` SECURITY invariant). 2026-05-29 (RFC 0076 §B — `ctx.http.safeFetch` live-run audit) added `safefetch-live-audit.test.ts` (`behaviorGate('openwop-safefetch-live-audit', …)`, gated on `httpClient.safeFetch` + `toolHooks.prePostEvents`) — asserts the audit-when-both MUST against the **durable run event log** via the new `POST /v1/host/sample/http/safe-fetch-run` open seam + the test event-log seam, closing the seam-vs-production gap (a production `createSafeFetch()` with no audit hooks passes the inline `safefetch-behavior.test.ts` but FAILS this under `OPENWOP_REQUIRE_BEHAVIOR=true`); this is the RFC 0076 §B → Accepted bar; run seam soft-skips on 404 (host-pending). 2026-05-29 (RFC 0066 — `x-openwop-form` picker UX hints, Draft → Active) added `x-openwop-form-pack-manifest.test.ts` (always-on server-free: an annotated `configSchema` stays a valid 2020-12 schema + the advisory hints don't change what it accepts, each §A annotation matches the shape, an unknown `kind` validates for forward-compat, 3 negatives — missing/non-string `kind`, non-string `dependsOn`). 2026-05-29 (RFC 0076 §B — `ctx.http.safeFetch`) added `safefetch-behavior.test.ts` (seam-gated: SSRF block / DNS-rebinding / `Connection: upgrade` refusal / tool-hooks audit-when-both, via `POST /v1/host/sample/http/safe-fetch`; advertisement contract stays in `http-client-ssrf.test.ts`). 2026-05-29 (RFC 0076 §A — pack `runtime.requires[]` install gate) added two: `runtime-requires-shape.test.ts` (server-free closed-vocabulary validation — the 8 tokens validate, a raw builtin name is rejected, empty-array≡omission, `uniqueItems`) + `runtime-requires-install-gate.test.ts` (seam-gated install-grant / install-refuse → `pack_runtime_requirement_unmet` / non-sandbox SHOULD-projection, soft-skip on 404 via `POST /v1/host/sample/packs/install-gate`). 2026-05-29 (RFC 0047 — `host.oauth` authorization-code roundtrip) added `oauth-authorization-code-roundtrip.test.ts` — capability-gated on `capabilities.oauth.supported` + `grants` including `authorization_code`; drives the `POST /v1/host/sample/oauth/authorize-code-roundtrip` seam against the one canonical synthetic provider in `fixtures/oauth-providers/synthetic.json` (soft-skip on 404, Tier-2 host-pending), asserting a successful grant returns a credential REFERENCE (token persisted as a `host.credentials` entry) and that the authorization code / state / PKCE verifier / acquired access+refresh tokens never appear on any run-visible surface (RFC 0047 §C + §C.2 / `credential-payload-redaction`). Closes the RFC 0047 Tier-2 gap (capability-shape + redaction scenarios existed; the actual authorization-code dance was unexercised). 2026-05-26 (RFC 0070 — agent-manifest runtime) added `agent-manifest-runtime.test.ts`; 2026-05-26 (RFC 0071 — artifact-type + chat card packs) added six: `artifact-type-pack-manifest-validation.test.ts` + `artifact-schema-compile-bounded.test.ts` (server-free) + `artifact-type-pack-install.test.ts` + `artifact-type-store-without-render.test.ts` + `chat-card-pack-manifest-validation.test.ts` (server-free) + `chat-card-pack-execution.test.ts` (capability-gated, host-pending). 2026-05-26 (RFCs 0067 / 0068 / 0069 — spec-gap Draft cohort) added five scenarios: `byok-auth-modes.test.ts` (RFC 0067; always-on schema-shape of `aiProviders.authModes` + a discovery-gated §B auth-mode-contract cross-field check), `memory-consolidation-shape.test.ts` (RFC 0068; always-on shape of `agents.memoryConsolidation`/`agents.commitments` + the `agent.memory.consolidated`/`commitment.fired` payload $defs), `memory-consolidation-idempotent.test.ts` + `commitment-fired.test.ts` (RFC 0068; capability-gated behavioral, soft-skip on the documented `/v1/host/sample/memory/consolidate` + `/commitment/fire` seams), and `exec-not-protocol-tier.test.ts` (RFC 0069; always-on server-free structural assertion that the protocol corpus defines no `core.*`/`openwop.*` exec-class primitive — backs the `exec-must-not-be-protocol-tier` SECURITY invariant). 2026-05-25 (RFC 0061 — stateful agent-loop lifecycle, executionModel.version 5) added four `agent-loop-*.test.ts` scenarios: `-version5-shape` (always-on; validates `executionModel.statefulResume`/`transcriptWindow` + the 1–5 version ceiling) plus `-iteration-monotonic` (gated on `version >= 5`; `runOrchestrator.decided.iteration` increments 1,2,3… exactly once per turn), `-workspace-snapshot` (gated additionally on `host.workspace.supported`; a turn-i workspace write is invisible to turn i, visible to turn i+1), and `-stateful-resume` (gated on `statefulResume`; a mid-loop suspend resumes at the same iteration without resetting the counter) — the three behavioral scenarios drive the documented agent-loop seam (`POST /v1/host/sample/agentloop/run`) and soft-skip until a host wires it. 2026-05-25 (RFC 0059 — host.workspace M2, reference-host enforcement) added two `workspace-*.test.ts` scenarios: `-behavior` (capability-gated CRUD round-trip / `If-Match` 409 `workspace_conflict` / `workspace_too_large` / §D run-start snapshot, all via the real `/v1/host/workspace/files` §C endpoints) and `-cross-tenant-isolation` (WCT-1 — drives the documented `POST /v1/host/sample/workspace/op` seam to assert a file owned by one `{tenant, workspace}` is unreadable, on both `get` and `list`, under a different owner; backs the new `workspace-cross-tenant-isolation` SECURITY invariant). The in-memory reference host now advertises `capabilities.workspace.supported` and honors §C/§D/§E end-to-end. 2026-05-25 (RFC 0062 — memory.distillation "dreams") added five `distillation-*.test.ts` scenarios: `-shape` (always-on; validates the `capabilities.memory.distillation` block + the additive `distillation` sub-object on `memory.compacted`) plus `-token-budget` (within budget `tokensUsed ≤ tokenBudget`; an un-meetable budget → `token_budget_exceeded` with no partial archive), `-stable-archive` (same sources + budget ⇒ byte-stable archive checksum), `-index-roundtrip` (gated additionally on `indexEmitted`; the `MEMORY-INDEX.json` workspace file is retrievable + `workspace.updated` fired), and `-secret-carryforward` (SR-1: a redacted source secret never appears in the archive) — the four behavioral scenarios drive the documented memory-distillation seam (`POST /v1/host/sample/memory/distill`) and soft-skip until a host wires it. 2026-05-25 (RFC 0063 — core.subWorkflow.outputAttestation) added four `subrun-*.test.ts` scenarios: `-attestation-shape` (always-on; validates the `capabilities.agents.subRunAttestation` flag) plus `-checksum-stable` (the child output checksum is the byte-stable, key-order-invariant RFC 8785 JCS + SHA-256 digest), `-approval-gate` (`requireApproval` → `accept` merges, `reject` does not), and `-approval-fail-closed` (no `accept`/`edit-accept` → no merge; backs the deferred `subrun-merge-approval-fail-closed` invariant) — the three behavioral scenarios drive the documented sub-run attestation seam (`POST /v1/host/sample/subrun/attest`) and soft-skip until a host wires it. 2026-05-25 (RFC 0064 — host.toolHooks) added five `tool-hooks-*.test.ts` scenarios: `-shape` (always-on; validates the `capabilities.toolHooks` block + the optional content-free fields on `agentToolCalled` / `agentToolReturned`) plus `-content-free` (gated on `prePostEvents`), `-authorization-fail-closed` (gated on `perToolAuthorization`), `-rate-limit` (gated on `perToolRateLimit`), and `-secret-redaction` (gated on `prePostEvents` + the SR-1 `argsHash` redaction rule) — the four behavioral scenarios drive the documented tool-hooks invoke seam (`POST /v1/host/sample/toolhooks/invoke`) and soft-skip until a host wires it. 2026-05-25 (RFC 0060 — host.heartbeat) added four `heartbeat-*.test.ts` scenarios: `-capability-shape` (always-on; validates the `capabilities.heartbeat` block) plus `-fires-once-per-tick`, `-idempotent-no-spam`, and `-runtime-bound` (gated on `capabilities.heartbeat.supported` + the host heartbeat tick seam; soft-skip until a host wires it). 2026-05-25 (RFC 0057 — memory write-attribution) added five `memory-attribution-*.test.ts` scenarios: `-shape` (always-on advertisement check on `capabilities.memory.attribution`), plus `-no-content`, `-tenant-scoped`, `-emits-on-write`, and `-replay-stable` (gated on `capabilities.memory.attribution.emitsWriteEvents`) verifying the content-free `memory.written` RunEvent, its two SECURITY invariants (`memory-attribution-no-content` + `memory-attribution-tenant-scoped`), and the §D replay rule that a `replay`-mode fork MUST NOT regenerate `memoryId`. 2026-05-25 (RFC 0025 §C point 1 — test-catalog isolation invariant; pairs with the 25 publish-error scenarios in `pack-registry-publish.test.ts`) added `pack-registry-isolation.test.ts` — capability-gated on `capabilities.packs.testMode.{supported, isolated}: true`; PUTs a disposable pack into `/v1/packs-test/{name}` and asserts the same `(name, version)` does NOT appear via `GET /v1/packs/{name}` — anchors the test-catalog isolation MUST in RFC 0025 §C. 2026-05-25 (RFC 0028 Tier-2 post-promotion T2 — read-side sister scenario for workspace-membership enforcement) added `prompt-read-workspace-membership-enforced.test.ts` — gates on `capabilities.prompts.supported: true` (broader than `mutableLibrary` so read-only hosts that expose `?workspaceId=` are also probed); drives `GET /v1/prompts?workspaceId=<random-non-member>` and interprets the response: 4xx PASS (canonical envelope check on 403); 200 with empty `templates[]` PASS (correct null result for a nonexistent workspace); 200 with non-empty `templates[]` FAIL (cross-tenant leak); 200 without `templates[]` field SKIP (host doesn't expose workspace-scoped reads). Verifies SECURITY invariant `prompt-read-workspace-membership-enforced`. Same-day T1 strengthened `prompt-mutation-workspace-membership-enforced.test.ts` to pin `error === "workspace_membership_required"` when the host's refusal status is 403 (other refusal codes unconstrained). 2026-05-25 (RFC 0028 Tier-2 follow-up — workspace-membership enforcement on mutating prompt endpoints, filed in response to a self-disclosed adopter vulnerability) added `prompt-mutation-workspace-membership-enforced.test.ts` — capability-gated on `capabilities.prompts.mutableLibrary: true`; drives `POST /v1/prompts` with a cryptographically-random non-member `workspaceId` and asserts the host refuses (NOT a 2xx; any 4xx/5xx is acceptable — silent success is the failure mode). Verifies SECURITY invariant `prompt-mutation-workspace-membership-enforced`. 2026-05-22 (RFC 0034 §B follow-up — secret-leakage harness against the OTel + debug-bundle seams) added `secret-leakage-otel-attribute.test.ts` — gates on `capabilities.secrets.supported` + `capabilities.observability.testSeams.{otelScrape,debugBundleExport}` AND the `OPENWOP_CANARY_SECRET_VALUE` env (host operator + conformance runner agree on the canary). Drives the existing `openwop-smoke-byok-roundtrip` fixture end-to-end; scrapes both seams after run completion; hard-fails if the canary plaintext appears in any OTel span attribute or debug-bundle field. Verifies SECURITY invariants `secret-leakage-otel-attribute` + `secret-leakage-debug-bundle-otel`. 2026-05-22 (RFC 0041 Phase 4 — replay determinism under nondeterministic models) added three scenarios: `replay-divergence-at-refusal.test.ts` (advertisement-shape probe on `replayDeterminism.refusalDivergenceEmission` + 2 `it.todo` for the dual-direction refusal-divergence case), `replay-observable-sequence-determinism.test.ts` (capability-gated; behavioral assertion soft-skipped until a `conformance-phase4-nondet-tool` fixture ships), `replay-llm-cache-key-portable.test.ts` (intra-host reproducibility + non-recipe-field invariance + Phase 4 advertisement alignment — reuses the existing `POST /v1/host/sample/test/llm-cache-key` seam from the sibling `replay-llm-cache-key.test.ts`). 2026-05-20 (RFC 0027 §A templateKinds-coverage follow-up — paired with `prompt-end-to-end-events.test.ts`) added `prompt-all-four-kinds-events.test.ts` exercising all four `PromptKind` values (`system`, `user`, `schema-hint`, `few-shot`) end-to-end through the reference workflow-engine sample's `local.sample.demo.mock-ai` dispatch path; capability-gated via `behaviorGate('prompts-supported', ...)`. Closes the credibility gap where the host advertised `templateKinds: ["system", "user", "few-shot", "schema-hint"]` but only the system+user pair was actually wired into dispatch. 2026-05-20 (RFCs 0030–0033 — envelope LLM-contract-hardening track) added 15 scenarios across four `Active` RFCs: `envelope-reasoning-shape.test.ts` (RFC 0030, always-on; asserts the OPTIONAL `reasoning` property on the three universal-kind schemas + the `schema.response` deliberate omission), `envelope-reasoning-secret-redaction.test.ts` (RFC 0030, capability-gated on `capabilities.envelopes.reasoning.supported` + `secrets.supported`; 5 `it.todo()` placeholders for SECURITY invariant `envelope-reasoning-secret-redaction`), `envelope-tier-one-subset-static.test.ts` (RFC 0030, always-on for load-bearing rules — no `oneOf` / `allOf` / `not` / `prefixItems` / `propertyNames` anywhere; gated on `tierOneSubsetCompliance: "strict"` for OpenAI-strict-only constraints), `envelope-variant-discriminator-static.test.ts` (RFC 0031, always-on; asserts no `oneOf` + every `anyOf` branch declares a single-string-enum discriminator in `required` on every `schemas/envelopes/*.schema.json`), `model-capability-substituted.test.ts` (RFC 0031, advertisement-shape probe on `capabilities.modelCapabilities.advertised[]` identifier pattern + 5 `it.todo()` placeholders for SECURITY invariant `model-capability-substituted-no-credential-disclosure`), `model-capability-insufficient.test.ts` (RFC 0031, 6 `it.todo()` placeholders for refusal + no-recursive-fallback), `node-module-required-capabilities-shape.test.ts` (RFC 0031 SHOULD-tier authoring-convention; 4 `it.todo()` placeholders), and the six envelope-reliability events from RFC 0032 (`envelope-retry-attempted` carrying the shared advertisement-shape probe enforcing both MUST-tier events in `events[]` per RFC 0032 §C, plus `envelope-retry-exhausted`, `envelope-refusal-shape`, `envelope-truncated`, `envelope-nl-to-format-engaged`, `envelope-recovery-applied` — collectively 39 `it.todo()` placeholders covering retry/refusal/truncation/recovery + SECURITY invariants `envelope-refusal-no-prompt-leak` and `envelope-recovery-no-content-leak`), plus RFC 0033's two scenarios (`envelope-completion-distinguishes-truncation.test.ts` + `envelope-truncation-cap-exhaustion.test.ts` — 12 `it.todo()` placeholders covering the truncation-vs-schema-violation retry-routing distinction + the DoS-bound assertion). Reference workflow-engine sample advertises `capabilities.envelopes.reasoning: { supported: true, promptDirective: "off" }` + `tierOneSubsetCompliance: "warn"` honestly (schemas accept the field; host doesn't yet inject the directive); the other three RFCs' capability blocks defer to reference-host emission code per the staged RFC 0027 §G precedent. 2026-05-20 (RFC 0028 §B Phase B — prompt-pack boot-time install) added `prompt-pack-install.test.ts` (capability-gated on `capabilities.prompts.endpointsSupported: true`; asserts a host that ran the boot-time pack loader surfaces ≥ 1 pack-source template under `GET /v1/prompts?source=pack` carrying the canonical `meta.source: "pack"` + `meta.packName` + `meta.packVersion` stamps; positively identifies the in-tree `vendor.openwop.prompt-sample` reference pack's `writer-system` template when present). Pairs with the new `host/promptPackLoader.ts` boot-time entry on the reference workflow-engine sample, which scans `examples/packs/*` plus `OPENWOP_PROMPT_PACKS_DIR` and calls `installPackTemplates()` for each `kind: "prompt"` pack found. 2026-05-20 (RFC 0029 Phase C — prompt resolution chain wire shape) added three more scenarios: `prompt-resolution-chain-node-wins.test.ts` (capability-gated on `capabilities.prompts.supported: true`; asserts layer-1 node-config supersedes lower layers per `spec/v1/prompts.md` §"Resolution chain (normative)"), `prompt-resolution-chain-agent-intrinsic.test.ts` (additionally gated on `capabilities.prompts.agentBindings: true`; asserts agent intrinsic `systemPromptRef` wins over `promptOverrides` AND lower layers when the node has no layer-1 ref), `prompt-resolution-chain-fallback-cascade.test.ts` (asserts layer 3 workflow-defaults wins over layer 4 host-defaults; layer 4 host-defaults wins when 1-3 yield null; resolved is null when all four yield null but chain[] still lists every attempted layer). The scenarios drive the host's `POST /v1/host/sample/prompt/resolve` test seam (reference-host implementation deferred to follow-up slice per RFC 0021 staging precedent). 2026-05-20 (RFC 0027 Phase A — prompt templates wire shape) added three scenarios: `prompt-template-shape.test.ts` (always-on; Ajv compileability + positive/negative round-trip for PromptTemplate + PromptRef + PromptKind), `prompt-composed-secret-redaction.test.ts` (capability-gated on `capabilities.prompts.supported: true` + `observability: "full"`; asserts `[REDACTED:<secretId>]` markers in `prompt.composed` payloads for `source: "secret"` variable bindings per SECURITY/threat-model-secret-leakage.md §SR-1), `prompt-composed-trust-marker.test.ts` (same capability gates; asserts `<UNTRUSTED>...</UNTRUSTED>` wrapping + `contentTrust: "untrusted"` propagation per RFC 0020 §D). Paired with new `fixtures/prompt-templates/` sub-directory + per-fixture schema-validity describe block + future SECURITY invariants `prompt-composed-secret-redaction` and `prompt-composed-trust-marker` (lands alongside reference-host emission per RFC 0021 staging precedent). 2026-05-18 (RFC 0022 `Draft` — runtime variable mapping) added four `it.todo()` placeholder scenarios covering the new mapping surfaces on `core.dispatch` (§A — `dispatch-input-mapping.test.ts`, `dispatch-output-mapping.test.ts`, `dispatch-cross-worker-handoff.test.ts`) and `core.subWorkflow` (§B — `subworkflow-input-mapping.test.ts`). Gated on `capabilities.agents.dispatchMapping` (dispatch trio) and `capabilities.subWorkflow.inputMapping` (subWorkflow). Promote to live assertions when RFC 0022 reaches `Active` + a reference host advertises the matching flags. 2026-05-17 (RFC 0003 §D handoff-schema enforcement, HV-1) added `agentPackHandoffSchemaValidation.test.ts` — verifies the host validates dispatch payloads against `handoff.taskSchemaRef` AND return payloads against `handoff.returnSchemaRef` per RFC 0003 §D. Paired with the new `agent-pack-handoff-schema-enforcement` row in `SECURITY/invariants.yaml`. 2026-05-17 (AI Envelope gap-closure, DRAFT v1.x — `spec/v1/ai-envelope.md`) added 7 advertisement-shape scenarios with `it.todo()` behavioral placeholders gated on `capabilities.envelopeContracts.advertised: true`: `aiEnvelope.universalKinds.test.ts`, `aiEnvelope.schemaDrift.test.ts`, `aiEnvelope.correlationReplay.test.ts`, `aiEnvelope.contractRefusal.test.ts`, `aiEnvelope.trustBoundaryPropagation.test.ts`, `aiEnvelope.redaction.test.ts`, `aiEnvelope.capBreached.test.ts`. Paired with the new `envelope-redaction-sr-1-carry-forward` row in `SECURITY/invariants.yaml`. 2026-05-17 (post-publish hardening, deep audit of `core.openwop.agents`) added `agents-run-tool-allowlist.test.ts` — server-free scenario locking in the `core.openwop.agents@1.0.1` safety-fix that closes `OPENWOP-AUDIT-2026-003` (function-typed `tool.handler` properties rejected at `validateTools()` with `INVALID_TOOL_DECLARATION`; tool-driven runs require `ctx.agentRuntime`; tool-less safe fallback preserved). Paired with the new `agents-run-no-raw-handler` row in `SECURITY/invariants.yaml`. Same-day post-publish hardening added `idempotency-key-determinism.test.ts` — server-free scenario locking in the `core.openwop.http@1.1.2` determinism safety-fix (default `composite` mode produces deterministic keys in `(runId, nodeId, payload)`; removed `uuid` mode rejects with `CONFIG_INVALID`; cross-impl vector test lets third-party reimplementations verify wire agreement). Paired with the new `idempotency-key-deterministic` row in `SECURITY/invariants.yaml`. 2026-05-17 (Phase 3 of RFC 0013) added three server-free scenarios exercising the reference workflow-chain expansion library (`conformance/src/lib/workflow-chain-expansion.ts`): `workflow-chain-expansion.test.ts` (parameter substitution + node id collision avoidance + edge rewriting + capability propagation + runtime-invariance contract), `workflow-chain-unresolvable-typeid.test.ts` (rejection with `chain_unresolvable_typeid` when a chain references an unknown typeId), and `workflow-chain-pack-signature-verification.test.ts` (Ed25519 verification recipe reuse from `node-packs.md §Signing`). Earlier that day (Phase 1) added `workflow-chain-pack-manifest-validation.test.ts` — server-free schema-validation scenario covering the new `workflow-chain-pack-manifest.schema.json` (positive sample + two negatives: kind/contents mismatch and invalid `chainId`). Closes RFC 0013 (`Workflow-chain packs`, `Draft`) Phases 1 + 3 alongside the new `spec/v1/workflow-chain-packs.md`, the `Capabilities.workflowChainPacks` block, and the registry build-index/conformance-check `kind` routing from Phase 2. Earlier that day, the suite added 27 `it.todo()` placeholder scenarios paired with RFCs 0014-0020 (host capability surfaces — fs, kvStorage, tableStorage, queueBus, sql/vector/search, blob/cache, mcp.serverMount). These promote to live assertions when each RFC reaches `Active` + the matching capability block lands in `schemas/capabilities.schema.json` + a reference host advertises the capability. Earlier additions include 18 Multi-Agent Shift scenarios (Phases 1-5) added 2026-05-10, the `registry-public.test.ts` public-registry healthcheck added 2026-05-11 (opt-in via `OPENWOP_TEST_PUBLIC_REGISTRY=true`), the `replay-llm-cache-key.test.ts` placeholder added 2026-05-11 (three `it.todo()` cases for the cross-host LLM cache-key recipe per `replay.md` §"LLM cache-key recipe"), the two `production-*.test.ts` scenarios added 2026-05-11 for the `openwop-production` profile per RFC 0009 (`production-backpressure.test.ts`, `production-retention-expiry.test.ts`), the four `auth-*.test.ts` scenarios added 2026-05-11/12 for the production-auth profiles per RFC 0010 (`auth-api-key-rotation.test.ts`, `auth-oauth2-client-credentials.test.ts`, `auth-oidc-user-bearer.test.ts`, `auth-mtls.test.ts` (opt-in via `OPENWOP_TEST_MTLS=1`)), `replay-retention-expiry.test.ts` added 2026-05-12 (capability shape + 410/422 envelope per `replay.md` §"Retention and garbage collection"), `bulk-cancel.test.ts` added 2026-05-12 (Phase B close-out of R1 — `POST /v1/runs:bulk-cancel`), the two Phase H launch-blocker advertisement-contract scenarios added 2026-05-12 (`mcp-toolcall-redaction.test.ts` for the MCP-1 invariant per `host-capabilities.md §host.mcp` + `threat-model-prompt-injection.md §UNTRUSTED`, and `http-client-ssrf.test.ts` for the SSRF + body-size cap advertisement contract on `capabilities.httpClient`), the `wasm-pack-abi-version-rejection.test.ts` Track 7 scenario added 2026-05-12 for the ABI-mismatch positive path via the `vendor.openwop.misbehaving-abi` pack per RFC 0008 §H, the `otel-trace-propagation-subworkflow.test.ts` Track 11 close-out added 2026-05-13 (parent + child run spans share the inbound traceparent's traceId across the `core.subWorkflow` dispatch boundary), and the three RFC 0012 (Memory Compaction Profile, `Active`) scenarios added 2026-05-13/14: `memory-compaction-sr1-carry-forward.test.ts` (load-bearing SR-1 §D), `memory-compaction-event-emitted.test.ts` (canonical §B payload shape), and `memory-compaction-provenance-tag.test.ts` (soft assertion on §C `compacted-from:<id>` convention). All three gate on `capabilities.memory.compaction.supported` + the host's test seam at `/v1/test/memory/{seed,compact}` (Postgres reference host enables both via `OPENWOP_MEMORY_COMPACTION=true OPENWOP_TEST_TRIGGER_COMPACTION=true`). 2026-05-15 (gap-closure CF-3) added `interrupt-token-matrix.test.ts` (malformed / unknown / replay / cross-run-id paths on `GET|POST /v1/interrupts/{token}`). 2026-05-31 (RFC 0078 portable tool catalog + RFC 0079 credential provenance / egress policy — the Active→Accepted behavioral gate) added four: `tool-catalog-projection.test.ts` (capability-gated on `toolCatalog.supported` via `behaviorGate('openwop-tool-catalog', …)` — the NORMATIVE `GET /v1/tools` list with each `ToolDescriptor` schema-valid + `source`/`safetyTier` in the closed vocab + content-free, `GET /v1/tools/{toolId}` round-trip + unknown-id 404, 401-unauthenticated, and the §F-2 cross-principal non-disclosure; black-box, no POST seam), `tool-session-lifecycle.test.ts` (gated on `toolCatalog.sessionLifecycle` — the §D `tool.session.opened`-before / `tool.session.closed`-after bracket over the RFC 0064 call events via the `POST /v1/host/sample/tools/session-run` seam, one shared `sessionId`, content-free), `egress-audience-binding.test.ts` (KEYSTONE — gated on `httpClient.egressPolicy.supported`; the §C confused-deputy MUST via `POST /v1/host/sample/egress/decide`: an out-of-audience egress is denied/downgraded with the credential NOT attached, a provenance-unevaluable egress fails closed — the behavioral leg of `egress-credential-audience-bound`), and `egress-decision-content-free.test.ts` (the SR-1 canary — the credential value never surfaces in `egress.decided` and `reason` stays in the CLOSED vocabulary). The maintained scenario-to-spec map lives in [`coverage.md`](./coverage.md); this README keeps the operator quickstart and the historical scenario notes below.
 
 High-level coverage includes:
 
@@ -171,7 +171,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 386 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 387 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/api/openapi.yaml

@@ -211,6 +211,15 @@ paths:
                     inputs:
                       type: object
                       description: Workflow inputs (consumed by triggers/nodes).
+                    residency:
+                      # RFC 0129 — OPTIONAL data-residency constraint. Closed shape
+                      # lives in the referenced schema (RFC 0094 §A forbids a closed
+                      # `additionalProperties:false` branch inside this allOf; the
+                      # $ref keeps the constraint out of the composition). A host
+                      # advertising `capabilities.dataResidency` MUST honor-or-reject
+                      # (accept iff region in advertised regions[], else
+                      # `residency_unavailable`, create no run). Absent ⇒ no constraint.
+                      $ref: '../schemas/residency.schema.json'
                     tenantId:
                       type: string
                       description: Tenant scoping. Server typically defaults from API key.

package/coverage.md

@@ -122,6 +122,7 @@ The scenario groups in the table below (one row per group; count the rows — th
 | `trigger-bridge-delivery.test.ts`                                                                                                                                                                                                                       | `openwop-trigger-bridge` profile (RFC 0083 §C/§D, `trigger-bridge.md`; derived from discovery — bridge + dead-letter sink + durable source)                                                                                                                                                                             | A (the §C delivery model via `POST /v1/host/sample/trigger-bridge/deliver` + the test event-log seam: dedup→effectively-once `trigger.delivery.attempted{delivered}` (§C-1), retry-exhaustion→`{dead-lettered}` + `trigger.subscription.state.changed{toState:dead-lettered}` (§C-2 + RFC 0053), and the delivered run's `run.started.causationId` == the delivery id (§C / RFC 0040); both `trigger.*` events content-free)                                                                                                                                                                                                                                                                        | `host-pending`                                                                                                                   | `behaviorGate('openwop-trigger-bridge', …)`. Profile-gated; seam-gated; soft-skips on 404. Normative `GET /v1/trigger-subscriptions` read runs black-box. **This is the RFC 0083 → Accepted bar.** First adopter: MyndHyve `triggerBridge`.                                                                                                                                                                                                                                                                                                                                                                                             |
 | `trigger-stream-cdc-sources.test.ts` | `triggerBridge.ingestion` (RFC 0127, `trigger-bridge.md` §F.5) | A (always-on: stream/change envelope shape, `op` REQUIRED negative, §F.1 exactly-one extension, registration + capabilities vocabulary pins; gated: schema-valid delivered envelopes + SR-1 body-canary content-freeness via `POST /v1/host/sample/trigger-bridge/ingest`, `(topic,partition,offset)` dedup effectively-once via `/deliver`) | `host-pending` | `behaviorGate('triggerBridge.ingestion', …)`; new-source calls soft-skip on a pre-0127 host, REQUIRED once `externalSources[]` advertises stream/change (advertise-only-what-you-honor). **This is the RFC 0127 → Accepted bar** (single-witness: openwop-app, 2026-07-06 architect ruling). |
 | `purpose-propagation.test.ts` | `purposePropagation` (RFC 0128, `capabilities.md` §purposePropagation) | A (always-on: label shape, absent-vs-`[]` wire validity, family shape closed + `supported` REQUIRED; gated two-hop via `POST /v1/host/sample/purpose-propagation/forward`: onward ⊆ received, derived merge ⊆ intersection of labelled inputs, unlabelled adds no constraint, `[]` fail-closed dropped with unlabelled positive control) | `host-pending` | `behaviorGate('purposePropagation', supported)`; seam soft-skips on 404/405. Internal use (§4) deliberately untested — not wire-observable. **This is the RFC 0128 → Accepted bar** (tier-2 MyndHyve attempt first). |
+| `data-residency-admission.test.ts` | `dataResidency` (RFC 0129, `capabilities.md` §dataResidency) | A (always-on: dataResidency family shape closed + `supported` const-true + `regions` required, residency.schema.json `{region}` closed, `residency_unavailable` error registered; gated behavioral on the NORMATIVE `POST /v1/runs`: advertised region not rejected residency_unavailable, unadvertised region rejected `residency_unavailable` at HTTP one-of 400/404/422 with no run created — fail-closed) | `host-pending` | `behaviorGate('dataResidency', supported && regions)`; drives the normative createRun endpoint (no host-sample seam); soft-skips when unadvertised. Physical §4 confinement deliberately untested (not wire-observable). **This is the RFC 0129 → Accepted bar** (single-witness: openwop-app tier-1). |
 | `agent-eval-run.test.ts`                                                                                                                                                                                                                                | `capabilities.agents.evalSuite.supported` (RFC 0081 §B/§C, `agent-evaluation.md`)                                                                                                                                                                                                                                       | A (the §C `mode:"eval"` projection via `POST /v1/host/sample/agents/eval-run` + the test event-log seam: `eval.started`-first → one `eval.scored` per task → `eval.completed`-once ordering (`count == eval.completed.taskCount`), every `eval.scored` content-free + `score` ∈ 0..1 backing `eval-summary-no-content-leak`; plus the NORMATIVE `GET /v1/runs/{runId}/eval-summary` returning a schema-valid `EvalSummary` with `passedCount <= taskCount` and no per-task output body)                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-eval-run', …)`. Seam-gated; soft-skips on 404. The normative eval-summary read runs black-box on any `evalSuite` host. **This is the RFC 0081 → Accepted bar.** First adopter: MyndHyve `agents.evalSuite`.                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `agent-deployment-lifecycle.test.ts`                                                                                                                                                                                                                    | `capabilities.agents.deployment.supported` (RFC 0082 §B/§E, `agent-deployment.md`) + `SECURITY/invariants.yaml` `deployment-promotion-fail-closed`                                                                                                                                                                      | A (the §E promotion contract via `POST /v1/host/sample/agents/deployment-transition` + the test event-log seam: a `promote` runs authorize (RFC 0049) → approvalGate (RFC 0051) → eval-verify (RFC 0081) → content-free `deployment.promoted` with a seven-state `toState` + `toVersion`, the returned record validating `agent-deployment.schema.json`; an `unauthorized` principal fails closed — `allowed:false`, NO `deployment.promoted` (the behavioral leg of `deployment-promotion-fail-closed`); an `eval-gate-unmet` promote is denied `eval_gate_unmet` with NO `deployment.promoted` (§E-3); and a `channel-pin` run records `resolvedAgentVersion` on `agent.invocation.started` (§B)) | `host-pending`                                                                                                                   | `behaviorGate('openwop-deployment-lifecycle', …)`. Seam-gated; soft-skips on 404. The normative `GET /v1/agents/{agentId}/deployments` read runs black-box on any `deployment` host. **This is the RFC 0082 → Accepted bar** (the `deployment-promotion-fail-closed` invariant graduates reference-impl → protocol tier when this passes against a host). First adopter: MyndHyve `agents.deployment`.                                                                                                                                                                                                                                  |
 | `agent-channel-dispatch.test.ts`                                                                                                                                                                                                                        | `capabilities.agents.deployment.supported` (RFC 0082 §B, `agent-deployment.md` + `version-negotiation.md`) + the seeded `conformance-agent-channel-dispatch` fixture + advertised `replay` mode                                                                                                                         | A (the §B pin from a PRODUCTION run graph, complementing `agent-deployment-lifecycle.test.ts` Leg 4's host-sample seam: a canonical `POST /v1/runs` of a node binding `agent.channel:"stable"` records `resolvedChannel` + a concrete `resolvedAgentVersion` on `agent.invocation.started` (RFC 0077); a `:fork{mode:"replay"}` re-reads that recorded version; the seam-guarded Leg 3 MOVES the channel then asserts a replay STILL carries the original pin — never re-resolving a moved channel)                                                                                                                                                                                                 | `host-pending`                                                                                                                   | `behaviorGate('openwop-deployment-channel-dispatch', …)`. Fixture+cap+replay-mode-gated; soft-skips by default, hard-fails under `OPENWOP_REQUIRE_BEHAVIOR=true`. **The production-path proof of the §B contract** (Leg 4 proves it through the seam; this proves it through a real run graph). First adopter: MyndHyve `agents.deployment`.                                                                                                                                                                                                                                                                                            |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.53.0",
+  "version": "1.54.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/README.md

@@ -70,6 +70,7 @@
 | `run-options.schema.json` | `run-options.md` | Per-run input overlay (configurable + tags + metadata) on `POST /v1/runs` |
 | `run-orchestrator-decided-event.schema.json` | orchestrator RFC + `observability.md` | Event payload for orchestrator decisions |
 | `run-snapshot.schema.json` | `rest-endpoints.md` §RunSnapshot | Projected run state from `GET /v1/runs/{runId}` |
+| `residency.schema.json` | RFC 0129 + `capabilities.md` §dataResidency | OPTIONAL data-residency `{region}` constraint on `POST /v1/runs` (honor-or-reject admission) |
 | `credential-provenance.schema.json` | `host-capabilities.md` §"Credential provenance + egress policy" (RFC 0079) | Metadata about a host-issued credential at the tool/egress boundary — `credentialId`/`issuer`/`audiences`(+scopes/expiry/redaction/audit-correlation). Secret-free (SR-1); the §C audience-binding MUST is evaluated against `audiences`. |
 | `security-advisory.schema.json` | `registry-operations.md` + INCIDENT-RESPONSE runbook | Registry-owned CVE advisory record at `registry/security/advisories.json`. One entry per disclosed vulnerability — id, severity, affected pack-name + SemVer range, optional fixedIn/advisoryUrl/credits. Enforced by `check-advisories.mjs` in `.github/workflows/registry-publish.yml`. |
 | `trigger-subscription.schema.json` | `trigger-bridge.md` (RFC 0083) | Durable inbound-trigger subscription record — `subscriptionId`/`source`/`state` (active/paused/failed/dead-lettered) + `dedupEnabled`/`retryPolicy` + the webhooks.md register keys. Backs the `openwop-trigger-bridge` profile; content-free of inbound payloads (SR-1). |

package/schemas/capabilities.schema.json

@@ -486,6 +486,24 @@
         }
       }
     },
+    "dataResidency": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "RFC 0129 (`Active`). Data-residency — the host advertises the operator region codes it can pin a run to, and honors-or-rejects an OPTIONAL `residency.region` on run-creation (`POST /v1/runs`): accept iff the requested region is in `regions[]`, else reject `residency_unavailable` (never silently accept-and-ignore). This family advertises the ADMISSION decision only (falsifiable over the wire) — it does NOT assert that the run's data physically remains in-region (unobservable; declared operator intent under RFC 0129 §4, not conformance-gated). A host MUST advertise a region in `regions[]` only if it can actually process a run entirely within it. Absent block ⇒ the host makes no residency promise and MAY ignore or reject a `residency` constraint (but MUST NOT claim to honor it).",
+      "required": ["supported", "regions"],
+      "properties": {
+        "supported": {
+          "const": true,
+          "description": "RFC 0129. Present-and-true when the host performs region admission control per §3. The block is omitted entirely when the host offers no residency pinning."
+        },
+        "regions": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "uniqueItems": true,
+          "description": "RFC 0129. Opaque operator region codes the host can pin a run to (e.g. `\"eu\"`, `\"us\"`, `\"eu-west-1\"`). No closed registry — codes are the host's own vocabulary (a global region enum would be unfalsifiable). A host MUST advertise a code here only if it can process a run entirely within it; a run-create `residency.region` not in this list MUST be rejected `residency_unavailable`."
+        }
+      }
+    },
     "credentials": {
       "type": "object",
       "description": "RFC 0046 (`Draft`). Portable credential resolution + lifecycle contract — sibling to `secrets`, first-class store-at-rest + workspace sharing + two-key-overlap rotation. A pack references a credential by `{ ref, scope }` (see `credential-reference.schema.json`); the host resolves it into the node sandbox ONLY — never into inputs, persisted variables, channels, any run.* event payload, the debug bundle, or replay state (SECURITY invariant `credential-payload-redaction`). Supersedes the informal BYOK annex; the `secrets` advertisement stays valid.",

package/schemas/residency.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/residency.schema.json",
+  "title": "Residency",
+  "description": "RFC 0129 — an OPTIONAL data-residency constraint on a run-creation request (`POST /v1/runs`). A host advertising `capabilities.dataResidency` MUST honor-or-reject: accept iff `region` is in the advertised `dataResidency.regions[]`, else reject `residency_unavailable` (HTTP one-of 400/404/422) and create no run — it MUST NOT silently accept-and-ignore. Absent ⇒ no constraint (host default region). Physical byte-confinement of the accepted run is a declared operator SHOULD (RFC 0129 §4), not a wire guarantee.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["region"],
+  "properties": {
+    "region": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Requested processing region — an opaque operator code from the host's own vocabulary (e.g. `\"eu\"`, `\"us\"`, `\"eu-west-1\"`). Honored only if present in the host's advertised `capabilities.dataResidency.regions[]`; otherwise the run is rejected `residency_unavailable`."
+    }
+  }
+}

package/src/scenarios/data-residency-admission.test.ts

@@ -0,0 +1,138 @@
+/**
+ * Data-residency — regional admission control (RFC 0129) —
+ * `capabilities.md` §dataResidency + `rest-endpoints.md` §`residency_unavailable`.
+ *
+ * The conformance-testable core of RFC 0129 §3: a host advertising
+ * `capabilities.dataResidency` performs ADMISSION CONTROL on an OPTIONAL
+ * `residency.region` attached to a `POST /v1/runs` request — it accepts iff
+ * the region is in the advertised `regions[]`, else rejects
+ * `residency_unavailable` and creates NO run. It MUST NOT silently
+ * accept-and-ignore. The physical-confinement guarantee (§4) is a declared
+ * operator SHOULD and is deliberately NOT tested (unobservable over the wire).
+ *
+ * Two layers:
+ *
+ *   A. Always-on, server-free schema probes:
+ *      - `capabilities.dataResidency` family shape: `supported` (const true) +
+ *        `regions` (non-empty string array) REQUIRED, `additionalProperties:false`;
+ *      - `residency.schema.json` shape: `region` REQUIRED, closed;
+ *      - `residency_unavailable` is registered in the rest-endpoints error prose.
+ *
+ *   B. Capability-gated behavioral legs (driving the NORMATIVE `POST /v1/runs`
+ *      endpoint — no host-sample seam), gated on `capabilities.dataResidency`
+ *      being advertised (soft-skip when absent, hard-fail under
+ *      `OPENWOP_REQUIRE_BEHAVIOR=true`):
+ *      1. advertised-region accept — `POST /v1/runs` with a `residency.region`
+ *         from the advertised `regions[]` is accepted (2xx, a run is created);
+ *      2. unadvertised-region reject — `POST /v1/runs` with a region NOT in
+ *         `regions[]` is rejected with `{ error: { code: "residency_unavailable" } }`
+ *         at HTTP one-of 400/404/422, and NO run is created (fail-closed;
+ *         advertise-only-what-you-honor — a hollow advert that accepts an
+ *         unadvertised region fails here).
+ *
+ * @see RFCS/0129-data-residency-region-advertisement-and-honor-or-reject.md §3
+ * @see spec/v1/capabilities.md §dataResidency
+ * @see spec/v1/rest-endpoints.md §"Common error codes" (`residency_unavailable`)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+
+const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
+
+describe('data-residency: schema + error registration (always-on, server-free)', () => {
+  it('capabilities.dataResidency requires `supported` (const true) + `regions`, closed', () => {
+    const caps = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'capabilities.schema.json'), 'utf8'));
+    const fam = caps.properties?.dataResidency;
+    expect(fam, 'capabilities.schema.json MUST define the dataResidency family (RFC 0129 §1)').toBeDefined();
+    expect(fam.additionalProperties, 'dataResidency MUST close its shape').toBe(false);
+    expect(fam.required?.sort()).toEqual(['regions', 'supported']);
+    const ajv = new Ajv2020({ allErrors: true, strict: false });
+    const vf = ajv.compile(fam);
+    expect(vf({ supported: true, regions: ['eu', 'us'] }), 'the canonical advert MUST validate').toBe(true);
+    expect(vf({ supported: true }), 'an advert without `regions` MUST fail').toBe(false);
+    expect(vf({ regions: ['eu'] }), 'an advert without `supported` MUST fail').toBe(false);
+    expect(vf({ supported: false, regions: ['eu'] }), 'dataResidency.supported is const true — false MUST fail').toBe(false);
+  });
+
+  it('residency.schema.json requires `region` and closes its shape', () => {
+    const ajv = new Ajv2020({ allErrors: true, strict: false });
+    addFormats(ajv);
+    const validate = ajv.compile(JSON.parse(readFileSync(join(SCHEMAS_DIR, 'residency.schema.json'), 'utf8')));
+    expect(validate({ region: 'eu' }), 'RFC 0129 §2 — a `{region}` residency constraint MUST validate').toBe(true);
+    expect(validate({}), 'RFC 0129 §2 — `region` is REQUIRED').toBe(false);
+    expect(validate({ region: 'eu', extra: 1 }), 'residency MUST be closed (additionalProperties:false)').toBe(false);
+  });
+
+  it.skipIf(V1_DIR === null)('residency_unavailable is registered in the rest-endpoints error prose', () => {
+    const rest = readFileSync(join(V1_DIR as string, 'rest-endpoints.md'), 'utf8');
+    expect(
+      rest.includes('`residency_unavailable`'),
+      'rest-endpoints.md §"Common error codes" MUST register `residency_unavailable` (RFC 0129 §3)',
+    ).toBe(true);
+  });
+});
+
+describe.skipIf(HTTP_SKIP)('data-residency: admission control (capability-gated, normative POST /v1/runs)', () => {
+  it('accepts an advertised region and rejects an unadvertised one with residency_unavailable (no run created)', async () => {
+    const fam = await readCapabilityFamily<{ supported?: boolean; regions?: string[] }>('dataResidency');
+    const regions = fam?.regions ?? [];
+    if (!behaviorGate('dataResidency', fam?.supported === true && regions.length > 0)) return;
+
+    // ---- Leg 1: advertised-region accept -----------------------------------
+    const advertised = regions[0];
+    const ok = await driver.post('/v1/runs', {
+      workflowId: 'conformance-residency-probe',
+      inputs: {},
+      residency: { region: advertised },
+    });
+    // A host may legitimately reject the probe workflow for reasons unrelated to
+    // residency (e.g. unknown workflowId) — but it MUST NOT reject an ADVERTISED
+    // region with residency_unavailable. That specific pairing is the violation.
+    const okBody = ok.json as { error?: { code?: string } } | undefined;
+    expect(
+      okBody?.error?.code !== 'residency_unavailable',
+      driver.describe(
+        'capabilities.md §dataResidency / RFC 0129 §3',
+        `an ADVERTISED region ("${advertised}") MUST NOT be rejected with residency_unavailable (accept iff advertised) — got ${ok.status} ${JSON.stringify(okBody?.error)}`,
+      ),
+    ).toBe(true);
+
+    // ---- Leg 2: unadvertised-region reject (fail-closed) -------------------
+    // Synthesize a region guaranteed not to be advertised.
+    let bogus = 'zz-nowhere';
+    while (regions.includes(bogus)) bogus += 'x';
+    const rej = await driver.post('/v1/runs', {
+      workflowId: 'conformance-residency-probe',
+      inputs: {},
+      residency: { region: bogus },
+    });
+    const rejBody = rej.json as { error?: { code?: string }; runId?: string } | undefined;
+
+    expect(
+      rej.status === 400 || rej.status === 404 || rej.status === 422,
+      driver.describe(
+        'rest-endpoints.md §residency_unavailable',
+        `an unadvertised region MUST be rejected at HTTP one-of 400/404/422 (envelope-not-status, #815) — got ${rej.status}`,
+      ),
+    ).toBe(true);
+    expect(
+      rejBody?.error?.code === 'residency_unavailable',
+      driver.describe(
+        'RFC 0129 §3',
+        `an unadvertised region MUST be rejected with error code "residency_unavailable" (MUST NOT silently accept-and-ignore) — got ${JSON.stringify(rejBody?.error)}`,
+      ),
+    ).toBe(true);
+    expect(
+      rejBody?.runId === undefined,
+      driver.describe('RFC 0129 §3', 'a rejected residency request MUST create NO run (no runId in the response)'),
+    ).toBe(true);
+  });
+});

package/src/scenarios/purpose-propagation.test.ts

@@ -20,12 +20,17 @@
  *      - the `capabilities.purposePropagation` family shape: `supported`
  *        REQUIRED, `additionalProperties:false`.
  *
- *   B. Capability-gated behavioral legs via the two-hop seam
+ *   B. SEAM-gated behavioral legs via the two-hop seam
  *      `POST /v1/host/sample/purpose-propagation/forward` (the suite plays
  *      hop A — the labelled sender — and hop C — the onward receiver — around
- *      the host at B). Soft-skips when the seam is unwired (404/405);
- *      REQUIRED once `purposePropagation.supported` is advertised
- *      (advertise-only-what-you-honor):
+ *      the host at B). Soft-skips ONLY when the seam is unwired (404/405) —
+ *      deliberately NOT gated on `capabilities.purposePropagation.supported`,
+ *      so the graduation witness runs on a host that is honest-OFF (advert
+ *      prohibited until RFC 0128 is `Accepted`) yet serves the seam behind its
+ *      feature flag. This mirrors RFC 0122's `self-hosted-runner` seam-gated
+ *      legs (witnessed non-vacuously with `selfHostedRunner.supported:false`).
+ *      Non-vacuity is proven by the seam being live + assertions running, and
+ *      by the steward's independent curl — not by the advert:
  *      1. survive/narrow — a forwarded label arrives ⊆ what B received;
  *      2. never-widen — strictly no purpose beyond the input set;
  *      3. derived output — a merge of two labelled inputs arrives ⊆ their
@@ -48,8 +53,6 @@ import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { SCHEMAS_DIR, FIXTURES_DIR } from '../lib/paths.js';
 import { driver } from '../lib/driver.js';
-import { behaviorGate } from '../lib/behavior-gate.js';
-import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 const SEAM = '/v1/host/sample/purpose-propagation/forward';
@@ -103,20 +106,25 @@ describe('purpose-propagation: label schema (always-on, server-free)', () => {
   });
 });
 
-describe.skipIf(HTTP_SKIP)('purpose-propagation: two-hop onward behavior (capability-gated)', () => {
+describe.skipIf(HTTP_SKIP)('purpose-propagation: two-hop onward behavior (seam-gated)', () => {
   async function seamPost(body: Record<string, unknown>): Promise<ForwardResponse | null> {
     const res = await driver.post(SEAM, body);
     if (res.status === 404 || res.status === 405) return null; // seam unwired — soft-skip
     return (res.json as ForwardResponse | undefined) ?? {};
   }
 
-  async function gate(): Promise<boolean> {
-    const fam = await readCapabilityFamily<{ supported?: boolean }>('purposePropagation');
-    return behaviorGate('purposePropagation', fam?.supported === true);
-  }
+  // SEAM-gated, NOT advertisement-gated (matches self-hosted-runner.test.ts). The
+  // behavioral legs drive the `purpose-propagation/forward` seam and soft-skip on a
+  // 404 (seam unwired). They deliberately do NOT gate on
+  // `capabilities.purposePropagation.supported`, because the graduation witness runs
+  // on a host that is honest-OFF (the advert is prohibited until RFC 0128 is
+  // `Accepted`, `capabilities.md` §purposePropagation) yet serves the seam behind its
+  // feature flag — exactly how RFC 0122's `self-hosted-runner` scenario witnessed
+  // non-vacuously with `selfHostedRunner.supported:false`. Non-vacuity is proven by
+  // the seam being live (assertions run against real onward/dropped output), verified
+  // by the steward's independent curl, NOT by an advertised capability.
 
   it('a forwarded label survives ⊆ the received set (re-emit; MAY narrow, MUST NOT widen)', async () => {
-    if (!(await gate())) return;
     const input = ['analytics', 'marketing-email'];
     const res = await seamPost({ mode: 'forward', records: [{ id: 'r1', permittedPurposes: input, data: { k: 1 } }] });
     if (res === null) return;
@@ -135,7 +143,6 @@ describe.skipIf(HTTP_SKIP)('purpose-propagation: two-hop onward behavior (capabi
   });
 
   it('a derived (merged) output arrives ⊆ the intersection of contributing labelled inputs', async () => {
-    if (!(await gate())) return;
     const res = await seamPost({
       mode: 'merge',
       records: [
@@ -155,7 +162,6 @@ describe.skipIf(HTTP_SKIP)('purpose-propagation: two-hop onward behavior (capabi
   });
 
   it('an unlabelled input adds no constraint to a merge', async () => {
-    if (!(await gate())) return;
     const res = await seamPost({
       mode: 'merge',
       records: [
@@ -173,7 +179,6 @@ describe.skipIf(HTTP_SKIP)('purpose-propagation: two-hop onward behavior (capabi
   });
 
   it('[]-labelled data is fail-closed dropped from onward emission (positive control: unlabelled twin forwards)', async () => {
-    if (!(await gate())) return;
     const res = await seamPost({
       mode: 'forward',
       records: [