@openwop/openwop-conformance 1.53.1 → 1.57.0

package/src/lib/workflow-chain-expansion.ts

@@ -43,6 +43,33 @@ export interface WorkflowChain {
   dag: { nodes: ReadonlyArray<FragmentNode>; edges?: ReadonlyArray<FragmentEdge> };
   outputs?: Record<string, { type: string; description: string }>;
   capabilities?: ReadonlyArray<'streamable' | 'cacheable' | 'side-effectful' | 'mcp-exportable'>;
+  /** RFC 0133 §1. Child chains this chain composes at run time. A node
+   *  references one via `config.subChainRef`; the host co-registers it as
+   *  its own workflow and dispatches it as a child run. Optional — a chain
+   *  with none behaves exactly as under RFC 0013. */
+  subChains?: ReadonlyArray<SubChainRef>;
+  /** RFC 0133 §2. Run-scoped values a node writes to the executor's variable
+   *  bag and downstream nodes read via a `{ type:"variable" }` input binding.
+   *  Distinct from author-time `parameters`; carry NO author-time value. */
+  producedVariables?: ReadonlyArray<ProducedVariable>;
+}
+
+/** RFC 0133 §1.1. A reference to a child chain the parent composes. `ref` is
+ *  EITHER a sibling `chainId` string (a chain in the SAME pack) OR an object
+ *  naming an externally published chain (resolved + signature-verified like any
+ *  pack dependency). */
+export interface SubChainRef {
+  ref: string | { packName: string; chainId: string; version: string };
+}
+
+/** RFC 0133 §2.2. A run-scoped variable a chain declares: written by one node
+ *  (`producedBy`) and read by others by `name`. `type` is a JSON-Schema type
+ *  token for validation/inspection. Run-scoped — no author-time value. */
+export interface ProducedVariable {
+  name: string;
+  producedBy: string;
+  type: string;
+  description?: string;
 }
 
 export interface FragmentNode {
@@ -512,3 +539,318 @@ export function expandChainDeferred(
     configurableSchema,
   };
 }
+
+// ---------------------------------------------------------------------------
+// RFC 0133 — Workflow-chain composition: sub-chains + produced variables.
+//
+// Two additive extensions to the RFC 0013 model, each usable alone:
+//
+//   §1 SUB-CHAINS — a chain declares child chains it composes (`subChains[]`)
+//      and references them from a runtime dispatch node via `config.subChainRef`.
+//      Unlike RFC 0013's author-time inline splice, a referenced sub-chain is
+//      CO-INSTANTIATED as its own registered workflow and dispatched by the
+//      parent at run time (the parent genuinely holds the child). Expansion
+//      mints a DETERMINISTIC, TENANT-SCOPED child id from (tenantId, childChainId, version) so
+//      a repeat instantiation converges and a shared child registers once, then
+//      rewrites the referencing node's `config.subChainRef` → `config.workflowId`
+//      (the field the runtime already reads). Recursion is bounded by a cycle
+//      check + `maxSubChainDepth` (DoS guard — SECURITY `sub-chain-expansion-bounded`).
+//
+//   §2 PRODUCED VARIABLES — a chain declares run-scoped values a node writes to
+//      the executor's variable bag (`producedVariables[]`), emitted on expansion
+//      into `WorkflowDefinition.variables[]`. Any `{ type:"variable" }` input
+//      read is validated closed-world against the declared set (+ materialized
+//      params); an undeclared read is a `variable_undeclared` manifest error.
+//
+// @see spec/v1/workflow-chain-packs.md §"Sub-chain composition (RFC 0133)"
+//   + §"Produced (run-scoped) variables (RFC 0133)"
+// @see RFCS/0133-workflow-chain-composition.md
+// ---------------------------------------------------------------------------
+
+/** RECOMMENDED default recursion bound for sub-chain co-expansion (RFC 0133
+ *  §1.3 — confirms UQ3). A host MAY advertise a different `maxDepth` via
+ *  `capabilities.workflowChainPacks.subChains.maxDepth`. */
+export const DEFAULT_MAX_SUB_CHAIN_DEPTH = 8;
+
+/** Thrown when a `config.subChainRef` (or a `subChains[].ref`) names a sibling
+ *  chainId that is not present in the same pack, or an external ref that fails
+ *  resolution/verification. Wire code `sub_chain_unresolved` (HTTP 400) per
+ *  `workflow-chain-packs.md` §"Error codes" (RFC 0133). */
+export class SubChainUnresolvedError extends Error {
+  readonly code = 'sub_chain_unresolved';
+  readonly httpStatus = 400;
+  constructor(readonly ref: string, readonly chainId: string) {
+    super(`sub_chain_unresolved: '${ref}' referenced from chain '${chainId}'`);
+    this.name = 'SubChainUnresolvedError';
+  }
+}
+
+/** Thrown when a chain transitively composes itself (a cycle in the compose
+ *  graph). Wire code `sub_chain_cycle` (HTTP 400) per `workflow-chain-packs.md`
+ *  §"Error codes" (RFC 0133). Together with `SubChainDepthExceededError` it is a
+ *  public test for SECURITY invariant `sub-chain-expansion-bounded`. */
+export class SubChainCycleError extends Error {
+  readonly code = 'sub_chain_cycle';
+  readonly httpStatus = 400;
+  constructor(readonly chainId: string, readonly detail: string) {
+    super(`sub_chain_cycle: chain '${chainId}' — ${detail}`);
+    this.name = 'SubChainCycleError';
+  }
+}
+
+/** Thrown when co-expansion nesting exceeds `maxSubChainDepth` — the DoS depth
+ *  backstop, DISTINCT from an actual cycle so an operator sees WHICH bound fired.
+ *  Wire code `sub_chain_max_depth_exceeded` (HTTP 400) per `workflow-chain-packs.md`
+ *  §"Error codes" (RFC 0133). A public test for `sub-chain-expansion-bounded`. */
+export class SubChainDepthExceededError extends Error {
+  readonly code = 'sub_chain_max_depth_exceeded';
+  readonly httpStatus = 400;
+  constructor(readonly chainId: string, readonly maxDepth: number) {
+    super(`sub_chain_max_depth_exceeded: chain '${chainId}' exceeds maxSubChainDepth ${maxDepth}`);
+    this.name = 'SubChainDepthExceededError';
+  }
+}
+
+/** Thrown when a node input binding `{ type:"variable", variableName }` reads a
+ *  name that is neither a declared `producedVariables[].name` nor a materialized
+ *  parameter — the closed-world guard that closes the "reads a value nothing
+ *  produces" hole. Wire code `variable_undeclared` (HTTP 400) per
+ *  `workflow-chain-packs.md` §"Error codes" (RFC 0133). */
+export class VariableUndeclaredError extends Error {
+  readonly code = 'variable_undeclared';
+  readonly httpStatus = 400;
+  constructor(readonly variableName: string, readonly chainId: string) {
+    super(`variable_undeclared: '${variableName}' read in chain '${chainId}'`);
+    this.name = 'VariableUndeclaredError';
+  }
+}
+
+/** Thrown when a `producedVariables[].producedBy` names a node id that does not
+ *  exist in the same fragment — a malformed producer declaration (the value would
+ *  be produced by nothing). Distinct from `variable_undeclared` (a bad READER) so
+ *  an operator sees which side is malformed. Wire code `produced_var_producer_unknown`
+ *  (HTTP 400) per `workflow-chain-packs.md` §"Error codes" (RFC 0133). */
+export class ProducedVarProducerUnknownError extends Error {
+  readonly code = 'produced_var_producer_unknown';
+  readonly httpStatus = 400;
+  constructor(readonly variableName: string, readonly producedBy: string, readonly chainId: string) {
+    super(`produced_var_producer_unknown: '${variableName}' producedBy unknown node '${producedBy}' in chain '${chainId}'`);
+    this.name = 'ProducedVarProducerUnknownError';
+  }
+}
+
+/** The canonical `subChains[].ref` chainId — a string ref is the sibling
+ *  chainId; an object ref's `chainId` is the external chain's id. */
+function refChainId(ref: SubChainRef['ref']): string {
+  return typeof ref === 'string' ? ref : ref.chainId;
+}
+
+/** Deterministic child workflow id minted from **(tenantId, childChainId, version)**
+ *  per RFC 0133 §1.3 step 2. TENANT-SCOPED by construction: the `registerWorkflow`
+ *  registry is global by-id, so a tenant-less id would let two tenants instantiating
+ *  the same parent→child COLLIDE on one global workflow (a cross-tenant isolation
+ *  break — SECURITY `sub-chain-child-tenant-scoped`). Keying on `tenantId` also makes
+ *  the dedup correct ACROSS PARENTS within a tenant: a child chain composed by two
+ *  different parents in the same tenant registers exactly once (a repeat instantiation
+ *  converges). `version` distinguishes `lesson-batch@1` from `lesson-batch@2`. Dots +
+ *  unsafe chars are slugged (storage-key safety). */
+export function mintChildWorkflowId(tenantId: string, childChainId: string, version: string): string {
+  const slug = (s: string): string => s.replace(/[^0-9A-Za-z._-]/g, '_').replace(/\./g, '_');
+  return `wfc_${slug(tenantId)}__${slug(childChainId)}__${slug(version)}`;
+}
+
+/** A child chain co-registered as its own workflow during parent expansion. */
+export interface CoRegisteredChild {
+  /** Deterministic minted id (see `mintChildWorkflowId`). */
+  childWorkflowId: string;
+  /** The composed chain's `chainId`. */
+  chainId: string;
+  /** The child's own expanded fragment (registered as a standalone workflow). */
+  fragment: ExpandedFragment;
+}
+
+export interface ChainTreeExpansion {
+  /** The parent fragment — every `config.subChainRef` rewritten to the minted
+   *  child `config.workflowId`. */
+  parent: ExpandedFragment;
+  /** Every co-registered child, deduplicated by `childWorkflowId` (a child
+   *  referenced twice registers once). */
+  children: ReadonlyArray<CoRegisteredChild>;
+}
+
+export interface CoExpansionContext {
+  /** Unique tag for this parent instantiation — seeds the parent node-id prefix
+   *  (per-drop node-id uniqueness). Does NOT seed the child workflow id (that is
+   *  tenant-scoped — see `tenantId`). */
+  parentExpansionId: string;
+  /** The instantiating tenant. The deterministic CHILD workflow id is scoped to
+   *  this tenant so two tenants never collide on the global by-id registry
+   *  (SECURITY `sub-chain-child-tenant-scoped`) and a child shared across parents
+   *  within the tenant dedups to one registration. */
+  tenantId: string;
+  params: Record<string, unknown>;
+  isTypeIdResolvable: (typeId: string) => boolean;
+  /** Sibling chains available in the SAME pack, keyed by `chainId`. External
+   *  refs (object form) are resolved host-side and supplied here too when the
+   *  host wants them co-expanded in-process; a ref absent from this map is
+   *  `sub_chain_unresolved`. */
+  siblingChains: ReadonlyMap<string, WorkflowChain>;
+  /** Recursion bound (default `DEFAULT_MAX_SUB_CHAIN_DEPTH`). */
+  maxDepth?: number;
+}
+
+/** Collect every distinct `config.subChainRef` reachable from a chain's nodes. */
+function subChainRefsInNodes(chain: WorkflowChain): string[] {
+  const refs: string[] = [];
+  for (const n of chain.dag.nodes) {
+    const r = n.config?.['subChainRef'];
+    if (typeof r === 'string' && !refs.includes(r)) refs.push(r);
+  }
+  return refs;
+}
+
+/**
+ * Co-expand a parent chain and every sub-chain it composes (RFC 0133 §1.3).
+ * Resolves each `config.subChainRef` to a sibling chain, recursively co-expands
+ * it, mints a deterministic child workflow id, and rewrites the referencing
+ * node's `config.subChainRef` → `config.workflowId`. Bounded by a cycle check
+ * and `maxDepth`.
+ *
+ * @throws SubChainUnresolvedError when a ref names no sibling chain.
+ * @throws SubChainCycleError on a compose cycle or a depth-bound breach.
+ * @throws ChainUnresolvableTypeIdError when any node typeId fails resolution.
+ */
+export function expandChainTree(
+  root: WorkflowChain,
+  ctx: CoExpansionContext,
+): ChainTreeExpansion {
+  const maxDepth = ctx.maxDepth ?? DEFAULT_MAX_SUB_CHAIN_DEPTH;
+  const children = new Map<string, CoRegisteredChild>();
+
+  // DFS over the compose graph with an on-stack set for cycle detection.
+  const onStack = new Set<string>();
+
+  const expandOne = (chain: WorkflowChain, depth: number): ExpandedFragment => {
+    if (depth > maxDepth) {
+      throw new SubChainDepthExceededError(chain.chainId, maxDepth);
+    }
+    if (onStack.has(chain.chainId)) {
+      throw new SubChainCycleError(chain.chainId, 'chain transitively composes itself');
+    }
+    onStack.add(chain.chainId);
+
+    // Validate declared subChains[] resolve, and recurse into each referenced
+    // sibling BEFORE rewriting the parent so child ids exist to splice in.
+    const declared = new Set((chain.subChains ?? []).map((s) => refChainId(s.ref)));
+    for (const ref of subChainRefsInNodes(chain)) {
+      // A node ref MUST be a declared subChains[] entry (RFC 0133 §1.2).
+      if (!declared.has(ref)) throw new SubChainUnresolvedError(ref, chain.chainId);
+      const sibling = ctx.siblingChains.get(ref);
+      if (!sibling) throw new SubChainUnresolvedError(ref, chain.chainId);
+      // Tenant-scoped, version-pinned deterministic child id (§1.3 step 2).
+      const childId = mintChildWorkflowId(ctx.tenantId, ref, sibling.version);
+      if (!children.has(childId)) {
+        // Recurse first; the child fragment is registered under the minted id.
+        const childFragment = expandOne(sibling, depth + 1);
+        children.set(childId, { childWorkflowId: childId, chainId: ref, fragment: childFragment });
+      }
+    }
+
+    // Expand this chain's own fragment (reuses the RFC 0013 algorithm), then
+    // rewrite each subChainRef node: `config.subChainRef` → `config.workflowId`
+    // (the minted child id the runtime dispatches).
+    const expansionId = chain.chainId === root.chainId
+      ? ctx.parentExpansionId
+      : `${ctx.parentExpansionId}_${chain.chainId.replace(/\./g, '_')}`;
+    const fragment = expandChain(chain, {
+      expansionId,
+      params: ctx.params,
+      isTypeIdResolvable: ctx.isTypeIdResolvable,
+    });
+    const rewrittenNodes = fragment.nodes.map((n) => {
+      const ref = (n.config as Record<string, unknown> | undefined)?.['subChainRef'];
+      if (typeof ref !== 'string') return n;
+      const refVersion = ctx.siblingChains.get(ref)?.version ?? '0.0.0';
+      const { subChainRef: _drop, ...restConfig } = n.config as Record<string, unknown>;
+      return { ...n, config: { ...restConfig, workflowId: mintChildWorkflowId(ctx.tenantId, ref, refVersion) } };
+    });
+
+    onStack.delete(chain.chainId);
+    return { nodes: rewrittenNodes, edges: fragment.edges, idMap: fragment.idMap };
+  };
+
+  const parent = expandOne(root, 0);
+  return { parent, children: [...children.values()] };
+}
+
+/** Emit a chain's declared `producedVariables[]` as run-scoped `variables[]`
+ *  entries (name + type, NO value) for the expanded `WorkflowDefinition`
+ *  (RFC 0133 §2.3). The executor's existing variable bag carries them exactly
+ *  as in a hand-authored workflow — no new runtime surface. */
+export function emitProducedVariables(
+  chain: WorkflowChain,
+): ReadonlyArray<{ name: string; type: string }> {
+  return (chain.producedVariables ?? []).map((p) => ({ name: p.name, type: p.type }));
+}
+
+/** Walk a value for `{ type:"variable", variableName }` input bindings, collecting
+ *  every referenced variable name. */
+function collectVariableReads(value: unknown, out: Set<string>): void {
+  if (Array.isArray(value)) {
+    for (const v of value) collectVariableReads(v, out);
+    return;
+  }
+  if (value !== null && typeof value === 'object') {
+    const obj = value as Record<string, unknown>;
+    if (obj['type'] === 'variable' && typeof obj['variableName'] === 'string') {
+      out.add(obj['variableName']);
+    }
+    for (const v of Object.values(obj)) collectVariableReads(v, out);
+  }
+}
+
+/**
+ * Closed-world validation of a chain's run-variable reads (RFC 0133 §2.2). Every
+ * `{ type:"variable", variableName }` binding in any node's `inputs` MUST reference
+ * a declared `producedVariables[].name` OR a materialized parameter name. An
+ * undeclared read throws `VariableUndeclaredError` — closing the "reads a value
+ * nothing produces" hole.
+ *
+ * @param materializedParams parameter names the host materialized as variables
+ *   (deferred mode, RFC 0124); empty for expansion-time substitution.
+ * @throws VariableUndeclaredError on the first undeclared variable read.
+ */
+export function validateVariableReads(
+  chain: WorkflowChain,
+  materializedParams: ReadonlySet<string> = new Set(),
+): void {
+  // Producer-existence (RFC 0133 §2.2): every producedVariables[].producedBy MUST
+  // name a real node id in the fragment — a producedBy naming a non-existent node
+  // is a malformed producer (the value would be written by nothing).
+  const nodeIds = new Set(chain.dag.nodes.map((n) => n.id));
+  for (const p of chain.producedVariables ?? []) {
+    if (!nodeIds.has(p.producedBy)) {
+      throw new ProducedVarProducerUnknownError(p.name, p.producedBy, chain.chainId);
+    }
+  }
+
+  // Disjointness (RFC 0133 §2.2): a producedVariables name MUST NOT collide with a
+  // `parameters` property name — the author-time and run-scoped channels are disjoint.
+  const paramNames = new Set<string>(materializedParams);
+  const paramProps = (chain.parameters as { properties?: Record<string, unknown> } | undefined)?.properties;
+  if (paramProps) for (const k of Object.keys(paramProps)) paramNames.add(k);
+  for (const p of chain.producedVariables ?? []) {
+    if (paramNames.has(p.name)) throw new VariableUndeclaredError(p.name, chain.chainId);
+  }
+
+  const declared = new Set<string>(materializedParams);
+  for (const p of chain.producedVariables ?? []) declared.add(p.name);
+  const reads = new Set<string>();
+  for (const n of chain.dag.nodes) {
+    if (n.inputs !== undefined) collectVariableReads(n.inputs, reads);
+    if (n.config !== undefined) collectVariableReads(n.config, reads);
+  }
+  for (const name of reads) {
+    if (!declared.has(name)) throw new VariableUndeclaredError(name, chain.chainId);
+  }
+}

package/src/scenarios/agent-manifest-role-profile.test.ts

@@ -0,0 +1,116 @@
+/**
+ * Agent-manifest `role` + the Skill profile (RFC 0131).
+ *
+ * Always-on, server-free schema-shape probe of the additive optional
+ * `AgentManifest.role` and the schema-encoded Skill profile (§B). The profile is
+ * a JSON-Schema `if role==="skill" then {required:["handoff"], memoryShape.
+ * {conversation,longTerm} !== true}` conditional, so a violating skill manifest
+ * FAILS validation at publish/install — a malformed manifest (RFC 0003 §C author
+ * error), NOT an RFC 0072 §C `degraded[]` runtime tier. This is the public
+ * witness for the SECURITY invariant `agent-skill-profile-stateless`.
+ *
+ * Verifies:
+ *   - `role` is EXPLICIT, never inferred: a manifest with NO `role` and any
+ *     `memoryShape` (incl. conversation+longTerm) validates — unconstrained,
+ *     exactly today's meaning. `handoff` presence does NOT reclassify it.
+ *   - a `role:"skill"` manifest WITH `handoff` + scratchpad-only memory validates.
+ *   - a `role:"skill"` manifest with `memoryShape.longTerm:true` FAILS validation.
+ *   - a `role:"skill"` manifest with `memoryShape.conversation:true` FAILS.
+ *   - a `role:"skill"` manifest MISSING `handoff` FAILS validation.
+ *   - a `role:"assistant"` manifest with conversation+longTerm (+ optional
+ *     handoff) validates — no profile binds it.
+ *   - `role` outside the `["skill","assistant"]` enum FAILS.
+ *
+ * Spec references:
+ *   - https://github.com/openwop/openwop/blob/main/RFCS/0131-agent-manifest-role-and-skill-profile.md
+ *   - https://github.com/openwop/openwop/blob/main/spec/v1/agent-memory.md (§B — reject vs §C degrade)
+ *   - https://github.com/openwop/openwop/blob/main/RFCS/0072-agent-inventory-and-dispatch.md (the degraded[] marker this RFC does NOT overload)
+ *   - https://github.com/openwop/openwop/blob/main/SECURITY/invariants.yaml (agent-skill-profile-stateless)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+
+const BASE = 'https://openwop.dev/spec/v1/';
+const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
+function loadSchema(name: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as Record<string, unknown>;
+}
+
+describe('agent-manifest-role-profile: AgentManifest.role + Skill profile (RFC 0131, server-free)', () => {
+  const ajv = new Ajv2020({ strict: false, allErrors: true });
+  addFormats(ajv);
+  for (const f of readdirSync(SCHEMAS_DIR)) {
+    if (f.endsWith('.schema.json')) {
+      try {
+        ajv.addSchema(loadSchema(f));
+      } catch {
+        /* duplicate/ignore */
+      }
+    }
+  }
+  const manifest = ajv.getSchema(`${BASE}agent-manifest.schema.json`)!;
+
+  const base = { agentId: 'core.openwop.agents.demo', persona: 'Demo', modelClass: 'general', systemPrompt: 'do it' };
+  const handoff = { taskSchemaRef: 'schemas/task.json', returnSchemaRef: 'schemas/return.json' };
+
+  it('NO role + any memoryShape (conversation+longTerm) validates — explicit, never inferred', () => {
+    expect(
+      manifest({ ...base, memoryShape: { scratchpad: true, conversation: true, longTerm: true } }),
+      why('RFC 0131 §A', 'absent role ⇒ unconstrained; nothing reclassifies (today’s meaning, unchanged)'),
+    ).toBe(true);
+  });
+
+  it('NO role + handoff + rich memory validates — handoff presence does NOT imply skill', () => {
+    expect(
+      manifest({ ...base, handoff, memoryShape: { conversation: true, longTerm: true } }),
+      why('RFC 0131 §A / Motivation 2', 'handoff is an interop contract, orthogonal to role — no inference'),
+    ).toBe(true);
+  });
+
+  it('role:"skill" WITH handoff + scratchpad-only memory validates', () => {
+    expect(
+      manifest({ ...base, role: 'skill', handoff, memoryShape: { scratchpad: true, conversation: false, longTerm: false } }),
+      why('RFC 0131 §B', 'a well-formed skill (handoff + scratchpad-only) MUST validate'),
+    ).toBe(true);
+  });
+
+  it('role:"skill" with memoryShape.longTerm:true FAILS validation (malformed, not degraded)', () => {
+    expect(
+      manifest({ ...base, role: 'skill', handoff, memoryShape: { scratchpad: true, longTerm: true } }),
+      why('RFC 0131 §B', 'a skill declaring longTerm memory is malformed — reject at publish/install'),
+    ).toBe(false);
+  });
+
+  it('role:"skill" with memoryShape.conversation:true FAILS validation', () => {
+    expect(
+      manifest({ ...base, role: 'skill', handoff, memoryShape: { conversation: true } }),
+      why('RFC 0131 §B', 'a skill declaring conversation memory is malformed — reject'),
+    ).toBe(false);
+  });
+
+  it('role:"skill" MISSING handoff FAILS validation', () => {
+    expect(
+      manifest({ ...base, role: 'skill', memoryShape: { scratchpad: true } }),
+      why('RFC 0131 §B', 'a skill MUST declare handoff (task→return capability)'),
+    ).toBe(false);
+  });
+
+  it('role:"assistant" with conversation+longTerm (and handoff) validates — no profile binds it', () => {
+    expect(
+      manifest({ ...base, role: 'assistant', handoff, memoryShape: { scratchpad: true, conversation: true, longTerm: true } }),
+      why('RFC 0131 §A', 'an assistant’s conversation + long-term memory are legitimate; it MAY ship handoff'),
+    ).toBe(true);
+  });
+
+  it('role outside the ["skill","assistant"] enum FAILS', () => {
+    expect(
+      manifest({ ...base, role: 'agent' }),
+      why('RFC 0131 §A', '"agent" is not an enum value (it is the overloaded word the RFC removes)'),
+    ).toBe(false);
+  });
+});

package/src/scenarios/anonymous-actor-audit-opaque.test.ts

@@ -0,0 +1,71 @@
+/**
+ * Anonymous-actor audit is opaque + non-PII (RFC 0132 §D) — backs the
+ * `anon-actor-audit-opaque` SECURITY invariant (RFC 0048 identifier-opacity + SR-1).
+ *
+ * Every anonymous-actor tool call emits an `authorization.decided` record (RFC
+ * 0049 — no new event minted) attributable to the opaque anon-session
+ * `principal`. The `principal` MUST be opaque, non-cross-linkable, and non-PII
+ * (no IP, email, device fingerprint), and the record MUST carry no credential
+ * material. The run snapshot echoes `owner.principalKind: "anonymous"`.
+ *
+ * Capability-gated on `capabilities.anonymousActor.supported`; soft-skips when
+ * unadvertised or when the seam is unwired (404). Hard-fails under
+ * `OPENWOP_REQUIRE_BEHAVIOR=true`. Passing non-vacuously graduates
+ * `anon-actor-audit-opaque` reference-impl → protocol tier.
+ *
+ * @see RFCS/0132-anonymous-actor-authorization.md §A, §D
+ */
+
+import { describe, it, expect } from 'vitest';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { driver } from '../lib/driver.js';
+import { isAnonymousActorAdvertised, anonDispatch } from '../lib/anonymousActor.js';
+
+const PROFILE = 'openwop-anonymous-actor';
+
+/** Reject anything that looks like PII the anon id MUST NOT embed. */
+const PII_PATTERNS: Array<[RegExp, string]> = [
+  [/\b\d{1,3}(?:\.\d{1,3}){3}\b/, 'an IPv4 address'],
+  [/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/, 'an email address'],
+];
+
+describe('anonymous-actor-audit-opaque (RFC 0132 §D)', () => {
+  it('the authorization.decided principal is opaque, non-PII, and the record carries no credential', async () => {
+    if (!behaviorGate(PROFILE, await isAnonymousActorAdvertised())) return;
+    const res = await anonDispatch({ tool: 'catalog.read' });
+    if (res.status === 404 || res.status === 405) return; // seam unwired — soft-skip
+
+    const decided = res.json?.authorizationDecided?.payload;
+    expect(
+      decided?.principal,
+      driver.describe('RFC 0132 §D', 'an anon tool call MUST emit authorization.decided with a principal'),
+    ).toBeTruthy();
+
+    const principal = decided?.principal ?? '';
+    for (const [pattern, label] of PII_PATTERNS) {
+      expect(
+        pattern.test(principal),
+        driver.describe('SECURITY anon-actor-audit-opaque', `the anon principal MUST NOT embed ${label}`),
+      ).toBe(false);
+    }
+    // The record MUST NOT carry credential material (reason is redaction-safe).
+    const serialized = JSON.stringify(decided ?? {});
+    for (const [pattern, label] of PII_PATTERNS) {
+      expect(
+        pattern.test(serialized),
+        driver.describe('SECURITY anon-actor-audit-opaque', `the audit record MUST NOT carry ${label}`),
+      ).toBe(false);
+    }
+  });
+
+  it('the run snapshot echoes owner.principalKind "anonymous"', async () => {
+    if (!behaviorGate(PROFILE, await isAnonymousActorAdvertised())) return;
+    const res = await anonDispatch({ tool: 'catalog.read' });
+    if (res.status === 404 || res.status === 405) return; // seam unwired — soft-skip
+    if (!res.json?.owner) return; // seam does not echo an owner triple — nothing to assert
+    expect(
+      res.json.owner.principalKind,
+      driver.describe('RFC 0132 §A', 'an anon-authorized run MUST set owner.principalKind "anonymous"'),
+    ).toBe('anonymous');
+  });
+});

package/src/scenarios/anonymous-actor-default-deny.test.ts

@@ -0,0 +1,87 @@
+/**
+ * Anonymous-actor default-deny grant (RFC 0132 §C.1) — backs the
+ * `anon-actor-no-default-baseline` SECURITY invariant.
+ *
+ * An anonymous actor is granted ONLY the tools explicitly listed in the
+ * resolved surface allowlist — never a default-on tool baseline, never a tool
+ * granted to authenticated agents by default. The effective granted set is
+ * discoverable through the RFC 0078 tool-catalog read scoped to the anon
+ * principal, which fails EMPTY when the surface grants nothing (never a
+ * baseline). A call to a non-granted tool MUST resolve to
+ * `authorization.decided { allowed:false, reason:"anon-not-granted" }` with NO
+ * dispatch.
+ *
+ * Capability-gated on `capabilities.anonymousActor.supported` +
+ * `behaviorGate('openwop-anonymous-actor', …)`; soft-skips when unadvertised or
+ * when the reference public-surface seam is unwired (404). Hard-fails under
+ * `OPENWOP_REQUIRE_BEHAVIOR=true`. When it passes non-vacuously the
+ * `anon-actor-no-default-baseline` invariant graduates reference-impl → protocol
+ * tier (RFC 0079 precedent).
+ *
+ * @see RFCS/0132-anonymous-actor-authorization.md §C.1
+ * @see conformance/coverage.md §"Capability-gated scenarios"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { driver } from '../lib/driver.js';
+import {
+  isAnonymousActorAdvertised,
+  anonDispatch,
+  anonToolCatalog,
+  readAnonymousActorCap,
+} from '../lib/anonymousActor.js';
+
+const PROFILE = 'openwop-anonymous-actor';
+
+/** A tool no public surface would ever grant — an authenticated default-on baseline action. */
+const UNGRANTED_TOOL = 'crm.contact.delete';
+
+describe('anonymous-actor-default-deny (RFC 0132 §C.1)', () => {
+  it('the anon tool catalog returns only the explicit surface grant — never a default baseline', async () => {
+    if (!behaviorGate(PROFILE, await isAnonymousActorAdvertised())) return;
+    const cat = await anonToolCatalog();
+    if (cat.status === 404 || cat.status === 405) return; // seam unwired — soft-skip
+    expect(
+      cat.status,
+      driver.describe('RFC 0132 §C.1', 'the anon tool-catalog read MUST resolve (scoped to the anon principal)'),
+    ).toBe(200);
+    // Default-deny: the ungranted baseline tool MUST NOT appear in the anon catalog.
+    const names = cat.tools.map((t) => t.name);
+    expect(
+      names,
+      driver.describe('RFC 0132 §C.1', 'a default-on baseline tool MUST NOT appear in the anon grant'),
+    ).not.toContain(UNGRANTED_TOOL);
+  });
+
+  it('calling a non-granted tool denies with reason "anon-not-granted" and does not dispatch', async () => {
+    if (!behaviorGate(PROFILE, await isAnonymousActorAdvertised())) return;
+    const res = await anonDispatch({ tool: UNGRANTED_TOOL });
+    if (res.status === 404 || res.status === 405) return; // seam unwired — soft-skip
+    const decided = res.json?.authorizationDecided?.payload;
+    expect(
+      decided?.allowed,
+      driver.describe('RFC 0132 §C.1', 'a non-granted anon tool MUST be denied (allowed:false), never default-allowed'),
+    ).toBe(false);
+    expect(
+      decided?.reason,
+      driver.describe('RFC 0132 §C.1', 'a default-deny denial carries the machine reason "anon-not-granted"'),
+    ).toBe('anon-not-granted');
+    // No dispatch — the seam MUST NOT return a tool result for a denied call.
+    expect(
+      res.json?.result,
+      driver.describe('RFC 0132 §C.1', 'a denied anon tool MUST NOT dispatch (no result)'),
+    ).toBeUndefined();
+  });
+
+  it('a host that advertises bounded-write-egress also advertises a mandatory control (truthful-advertisement)', async () => {
+    const cap = await readAnonymousActorCap();
+    if (!behaviorGate(PROFILE, cap?.supported === true)) return;
+    if ((cap?.tiers ?? []).includes('bounded-write-egress')) {
+      expect(
+        (cap?.writeEgressControls ?? []).length,
+        driver.describe('RFC 0132 §B.2', 'bounded-write-egress MUST advertise ≥1 writeEgressControl'),
+      ).toBeGreaterThan(0);
+    }
+  });
+});