@openwop/openwop-conformance 1.6.1 → 1.10.0

package/src/scenarios/chat-card-pack-manifest-validation.test.ts

@@ -0,0 +1,128 @@
+/**
+ * Chat card pack manifest validation — `chat-card-packs.md` §"Manifest format"
+ * + `schemas/chat-card-pack-manifest.schema.json` (RFC 0071 Phase 2).
+ *
+ * Server-free schema-validation scenario for `kind: "card"` packs:
+ *   1. Positive: a valid card manifest validates.
+ *   2. Negative — kind/contents mismatch: cards[] + a foreign artifactTypes[]
+ *      is rejected (additionalProperties -> pack_kind_invalid at the registry).
+ *   3. Negative — empty cards[] (minItems).
+ *   4. Negative — invalid cardTypeId (uppercase scope -> pattern).
+ *   5. Negative — a card missing prompt (required).
+ *   6. Negative — a non-portable inputs[].type that is neither in the closed
+ *      enum nor a vendor-prefixed extension (`canvas-reference` -> pattern).
+ *   7. Positive — a vendor.*-prefixed inputs[].type extension is tolerated.
+ *
+ * Behavioral execution (`chat-card-pack-execution.test.ts` — prompt routed
+ * through ctx.aiEnvelope.generate, output validated against the linked
+ * outputArtifactType, untrusted-input trust-tag propagation) is the Phase-2
+ * `Active` gate (R2) and lands with a host advertising `host.chat.cardPacks`.
+ *
+ * @see spec/v1/chat-card-packs.md
+ * @see schemas/chat-card-pack-manifest.schema.json
+ * @see RFCS/0071-artifact-type-and-chat-card-packs.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import type { ErrorObject } from 'ajv';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+
+const SCHEMA_PATH = join(SCHEMAS_DIR, 'chat-card-pack-manifest.schema.json');
+
+function validManifest() {
+  return {
+    kind: 'card',
+    name: 'vendor.acme.cad-cards',
+    version: '1.0.0',
+    engines: { openwop: '>=1.1' },
+    cards: [
+      {
+        cardTypeId: 'vendor.acme.cad.model.create',
+        prompt: {
+          template: 'Design a model for: {{spec}}',
+          placeholderMapping: { spec: 'inputs.spec' },
+          temperature: 0.2,
+        },
+        inputs: [{ id: 'spec', type: 'text', label: 'Part spec', required: true }],
+        outputArtifactType: 'vendor.acme.cad.model',
+        outputSchemaRef: 'schemas/cad-model.schema.json',
+      },
+    ],
+  };
+}
+
+describe('category: chat-card-pack manifest validation', () => {
+  const ajv = new Ajv2020({ allErrors: true, strict: false });
+  addFormats(ajv);
+  const validate = ajv.compile(JSON.parse(readFileSync(SCHEMA_PATH, 'utf8')));
+
+  const failsWith = (manifest: unknown, keyword: string): ErrorObject[] => {
+    expect(validate(manifest)).toBe(false);
+    return (validate.errors ?? []).filter((e) => e.keyword === keyword);
+  };
+
+  it('positive: a valid chat card pack manifest validates cleanly', () => {
+    expect(
+      validate(validManifest()),
+      `chat-card-packs.md §"Manifest format": a well-formed kind:"card" manifest MUST validate. Errors: ${JSON.stringify(validate.errors)}`,
+    ).toBe(true);
+  });
+
+  it('negative: a manifest mixing cards[] and artifactTypes[] is rejected', () => {
+    const manifest = { ...validManifest(), artifactTypes: [{ artifactTypeId: 'vendor.acme.x', schemaRef: 'x.json' }] };
+    const errs = failsWith(manifest, 'additionalProperties');
+    expect(
+      errs.some((e) => (e.params as { additionalProperty?: string }).additionalProperty === 'artifactTypes'),
+      'chat-card-packs.md §"Pack kind": one kind per pack (additionalProperties:false)',
+    ).toBe(true);
+  });
+
+  it('negative: an empty cards[] is rejected', () => {
+    expect(failsWith({ ...validManifest(), cards: [] }, 'minItems').length).toBeGreaterThan(0);
+  });
+
+  it('negative: an uppercase-scope cardTypeId is rejected', () => {
+    const m = validManifest();
+    m.cards[0]!.cardTypeId = 'Vendor.Acme.Card';
+    expect(failsWith(m, 'pattern').length).toBeGreaterThan(0);
+  });
+
+  it('negative: a card missing prompt is rejected', () => {
+    const m = validManifest();
+    delete (m.cards[0] as { prompt?: unknown }).prompt;
+    expect(failsWith(m, 'required').length).toBeGreaterThan(0);
+  });
+
+  it('negative: a non-portable inputs[].type (canvas-reference) is rejected', () => {
+    const m = validManifest();
+    m.cards[0]!.inputs[0]!.type = 'canvas-reference';
+    expect(
+      failsWith(m, 'pattern').length,
+      'chat-card-packs.md §"Input fields": type is the closed portable enum OR a vendor.*/x- extension',
+    ).toBeGreaterThan(0);
+  });
+
+  it('positive: a vendor.*-prefixed inputs[].type extension is tolerated', () => {
+    const m = validManifest();
+    m.cards[0]!.inputs[0]!.type = 'vendor.myndhyve.canvas-ref';
+    expect(
+      validate(m),
+      'chat-card-packs.md §"Input fields": a vendor.<org>.<kind> input type extension MUST validate (other hosts ignore it)',
+    ).toBe(true);
+  });
+
+  it('positive: the full portable inputs[].type subset validates (G9, incl. multiselect + file)', () => {
+    for (const t of ['text', 'longtext', 'number', 'boolean', 'select', 'multiselect', 'file', 'artifact-ref']) {
+      const m = validManifest();
+      m.cards[0]!.inputs[0]!.type = t;
+      expect(
+        validate(m),
+        `chat-card-packs.md §"Input fields": portable inputs[].type "${t}" MUST validate (G9 resolved 2026-05-27)`,
+      ).toBe(true);
+    }
+  });
+});

package/src/scenarios/commitment-fired.test.ts

@@ -0,0 +1,83 @@
+/**
+ * Inferred standing commitment — fire-once + content-free (RFC 0068, `Draft`).
+ *
+ * Gated on `capabilities.agents.commitments.supported`. Drives the
+ * documented host seam `POST /v1/host/sample/commitment/fire` (staged per
+ * the RFC 0027 §G precedent — soft-skips on 404/501 until a reference host
+ * wires it). Asserts:
+ *   - a fired commitment emits a content-free `commitment.fired` carrying
+ *     `commitmentId` + `memoryRef` provenance + `condition` (RFC 0068 §C);
+ *   - the event MUST NOT carry the inferred intention text (no-content);
+ *   - the commitment fires at most once per satisfied condition.
+ *
+ * Hosts that omit the capability skip cleanly.
+ *
+ * Spec references:
+ *   - https://github.com/openwop/openwop/blob/main/spec/v1/agent-memory.md §"Inferred commitments"
+ *   - https://github.com/openwop/openwop/blob/main/RFCS/0068-memory-consolidation-and-standing-commitments.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+
+interface CommitmentCaps {
+  agents?: { commitments?: { supported?: boolean } };
+}
+
+interface FireResult {
+  event?: {
+    commitmentId?: string;
+    memoryRef?: string;
+    condition?: string;
+    [k: string]: unknown;
+  };
+  fireCount?: number;
+  /** The plaintext intention the host inferred — used only to assert it does NOT appear on the event. */
+  intentionCanary?: string;
+}
+
+async function commitmentsSupported(): Promise<boolean> {
+  const res = await driver.get('/.well-known/openwop', { authenticated: false });
+  if (res.status !== 200) return false;
+  return Boolean((res.json as CommitmentCaps).agents?.commitments?.supported);
+}
+
+describe('commitment-fired: fire contract (RFC 0068 §C, capability-gated)', () => {
+  it('a fired commitment emits a content-free event with memory provenance, exactly once', async () => {
+    if (!(await commitmentsSupported())) return; // capability absent — gated skip
+
+    const res = await driver.post('/v1/host/sample/commitment/fire', {
+      memoryRef: 'mem://conformance/commitments',
+      condition: 'predicate',
+      includeIntentionCanary: true,
+    });
+    if (res.status === 404 || res.status === 501) return; // seam not wired — soft-skip
+
+    expect(res.status, driver.describe('RFC 0068 §C', 'an advertised commitment seam MUST succeed')).toBe(200);
+    const r = res.json as FireResult;
+
+    // §C — required identifiers.
+    expect(r.event?.commitmentId, driver.describe('RFC 0068 §C', 'commitment.fired MUST carry commitmentId')).toBeTruthy();
+    expect(
+      r.event?.memoryRef,
+      driver.describe('RFC 0068 §C.1', 'commitment.fired MUST carry the source memoryRef (CTI-1 provenance)'),
+    ).toBeTruthy();
+
+    // §C.3 — content-free: the inferred intention text MUST NOT appear on the event.
+    if (typeof r.intentionCanary === 'string' && r.intentionCanary.length > 0) {
+      const serialized = JSON.stringify(r.event ?? {});
+      expect(
+        serialized.includes(r.intentionCanary),
+        driver.describe('RFC 0068 §C.3', 'the inferred intention text MUST NOT appear on the commitment.fired payload'),
+      ).toBe(false);
+    }
+
+    // §C.2 — fire-once-per-condition (when the seam reports a count).
+    if (typeof r.fireCount === 'number') {
+      expect(
+        r.fireCount,
+        driver.describe('RFC 0068 §C.2', 'a commitment MUST fire at most once per satisfied condition'),
+      ).toBeLessThanOrEqual(1);
+    }
+  });
+});

package/src/scenarios/credential-payload-redaction.test.ts

@@ -26,6 +26,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 interface DiscoveryCredentials {
   supported?: boolean;
@@ -43,7 +44,7 @@ const CANARY = 'OPENWOP_CRED_CANARY_4f1c8a2e9b';
 async function readCredentials(): Promise<DiscoveryCredentials | null> {
   const res = await driver.get('/.well-known/openwop');
   const body = res.json as DiscoveryDoc | undefined;
-  return body?.capabilities?.credentials ?? null;
+  return capabilityFamily(body, 'credentials') ?? null;
 }
 
 describe('credential-payload-redaction: advertisement shape (RFC 0046 §A)', () => {

package/src/scenarios/credentials-capability-shape.test.ts

@@ -21,6 +21,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 interface DiscoveryCredentials {
   supported?: boolean;
@@ -42,7 +43,7 @@ const VALID_ROTATION: ReadonlySet<string> = new Set(['none', 'two-key-overlap'])
 async function readCredentials(): Promise<DiscoveryCredentials | null> {
   const res = await driver.get('/.well-known/openwop');
   const body = res.json as DiscoveryDoc | undefined;
-  return body?.capabilities?.credentials ?? null;
+  return capabilityFamily(body, 'credentials') ?? null;
 }
 
 describe('credentials-capability-shape: advertisement shape (RFC 0046 §A)', () => {

package/src/scenarios/cross-engine-append-ordering.test.ts

@@ -26,6 +26,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 const ORDERING_MODELS = new Set(['lamport', 'vector-clock', 'global-sequencer']);
@@ -55,7 +56,7 @@ describe.skipIf(HTTP_SKIP)('cross-engine-append-ordering: advertisement shape (R
   it('capabilities.eventLog.crossEngineOrdering (when present) conforms to RFC 0036 §B', async () => {
     const d = await readDiscovery();
     if (d === null) return;
-    const ceo = d.capabilities?.eventLog?.crossEngineOrdering;
+    const ceo = capabilityFamily<{ crossEngineOrdering?: { supported?: unknown; orderingModel?: unknown } }>(d, 'eventLog')?.crossEngineOrdering;
     if (ceo === undefined) return; // host doesn't advertise — soft-skip
 
     expect(

package/src/scenarios/cross-host-ancestry-endpoint.test.ts

@@ -35,6 +35,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 
@@ -65,7 +66,7 @@ async function readDiscovery(): Promise<DiscoveryDoc | null> {
 describe.skipIf(HTTP_SKIP)('cross-host-ancestry-endpoint: behavioral (RFC 0040 §C)', () => {
   it('hosts advertising ancestryEndpointSupported MUST serve GET /v1/runs/{runId}/ancestry with the documented shape on a top-level run', async (ctx) => {
     const d = await readDiscovery();
-    const chc = d?.capabilities?.multiAgent?.executionModel?.crossHostCausation;
+    const chc = capabilityFamily<{ executionModel?: { [k: string]: unknown; crossHostCausation?: Record<string, unknown>; replayDeterminism?: Record<string, unknown> } }>(d, 'multiAgent')?.executionModel?.crossHostCausation;
     if (chc?.ancestryEndpointSupported !== true) {
       ctx.skip();
       return;
@@ -112,7 +113,7 @@ describe.skipIf(HTTP_SKIP)('cross-host-ancestry-endpoint: behavioral (RFC 0040
 
   it('hosts advertising crossHostCausation.supported but NOT ancestryEndpointSupported MUST return 404 from the ancestry endpoint', async (ctx) => {
     const d = await readDiscovery();
-    const chc = d?.capabilities?.multiAgent?.executionModel?.crossHostCausation;
+    const chc = capabilityFamily<{ executionModel?: { [k: string]: unknown; crossHostCausation?: Record<string, unknown>; replayDeterminism?: Record<string, unknown> } }>(d, 'multiAgent')?.executionModel?.crossHostCausation;
     if (chc?.supported !== true) {
       ctx.skip();
       return;

package/src/scenarios/cross-host-causation-shape.test.ts

@@ -27,6 +27,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 
@@ -63,7 +64,7 @@ describe.skipIf(HTTP_SKIP)('cross-host-causation-shape: advertisement shape (RFC
       ctx.skip();
       return;
     }
-    const chc = d.capabilities?.multiAgent?.executionModel?.crossHostCausation;
+    const chc = capabilityFamily<{ executionModel?: { [k: string]: unknown; crossHostCausation?: Record<string, unknown>; replayDeterminism?: Record<string, unknown> } }>(d, 'multiAgent')?.executionModel?.crossHostCausation;
     if (chc === undefined) {
       ctx.skip(); // host doesn't advertise — soft-skip
       return;
@@ -78,7 +79,7 @@ describe.skipIf(HTTP_SKIP)('cross-host-causation-shape: advertisement shape (RFC
     ).toBe('boolean');
 
     if (chc.supported === true) {
-      const version = d.capabilities?.multiAgent?.executionModel?.version as number | undefined;
+      const version = capabilityFamily<{ executionModel?: { [k: string]: unknown; crossHostCausation?: Record<string, unknown>; replayDeterminism?: Record<string, unknown> } }>(d, 'multiAgent')?.executionModel?.version as number | undefined;
       expect(
         typeof version === 'number' && version >= 3,
         driver.describe(

package/src/scenarios/deadletter-capability-shape.test.ts

@@ -19,6 +19,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 interface DiscoveryDeadLetter {
   supported?: boolean;
@@ -32,7 +33,7 @@ interface DiscoveryDoc {
 async function readDeadLetter(): Promise<DiscoveryDeadLetter | null> {
   const res = await driver.get('/.well-known/openwop');
   const body = res.json as DiscoveryDoc | undefined;
-  return body?.capabilities?.deadLetter ?? null;
+  return capabilityFamily(body, 'deadLetter') ?? null;
 }
 
 describe('deadletter-capability-shape: advertisement shape (RFC 0053 §A)', () => {

package/src/scenarios/deadletter-retry-exhaustion.test.ts

@@ -23,6 +23,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 interface DiscoveryDoc {
   capabilities?: { deadLetter?: { supported?: boolean } };
@@ -30,7 +31,7 @@ interface DiscoveryDoc {
 
 async function deadLetterSupported(): Promise<boolean> {
   const res = await driver.get('/.well-known/openwop');
-  return (res.json as DiscoveryDoc | undefined)?.capabilities?.deadLetter?.supported === true;
+  return capabilityFamily((res.json as DiscoveryDoc | undefined), 'deadLetter')?.supported === true;
 }
 
 describe('deadletter-retry-exhaustion: retry exhaustion → dead-lettered + fork-eligible (RFC 0053 §C)', () => {

package/src/scenarios/distillation-index-roundtrip.test.ts

@@ -0,0 +1,35 @@
+/**
+ * distillation-index-roundtrip — RFC 0062 §B(5). After distillation the
+ * memory-index workspace file (`MEMORY-INDEX.json`, RFC 0059) is retrievable and
+ * the run reported updating the index (rides `workspace.updated`, not a bespoke
+ * index event).
+ *
+ * Gated on `capabilities.memory.distillation.supported` + `indexEmitted` + the
+ * host memory-distillation seam; soft-skips when any is absent. (The seam echoes
+ * the index file, so this scenario does not separately require the workspace
+ * read endpoint to be wired.)
+ *
+ * @see RFCS/0062-scheduled-memory-distillation.md §B
+ * @see RFCS/0059-agent-workspace.md — the durable layer the index rides
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { readDistillationCap, invokeDistill } from '../lib/distillation.js';
+
+describe('distillation-index-roundtrip (RFC 0062 §B)', () => {
+  it('an indexEmitted run updates a retrievable memory-index manifest', async () => {
+    const cap = await readDistillationCap();
+    if (cap?.supported !== true || cap?.indexEmitted !== true) return;
+    const res = await invokeDistill({ memoryRef: 'conformance-distill', tokenBudget: 8000, indexEmitted: true });
+    if (res === null) return; // seam absent — soft-skip
+    expect(
+      res.body.indexUpdated === true || res.body.event?.distillation?.indexUpdated === true,
+      driver.describe('RFC 0062 §B', 'an indexEmitted distillation MUST report updating the memory index'),
+    ).toBe(true);
+    expect(
+      res.body.indexFile !== undefined && res.body.indexFile !== null,
+      driver.describe('RFC 0062 §B', 'the MEMORY-INDEX.json manifest MUST be retrievable after distillation'),
+    ).toBe(true);
+  });
+});

package/src/scenarios/distillation-secret-carryforward.test.ts

@@ -0,0 +1,35 @@
+/**
+ * distillation-secret-carryforward — RFC 0062 §B(3). A redacted secret in
+ * source memory stays redacted in the distilled archive — the SR-1 carry-forward
+ * invariant (RFC 0012 §D) holds through distillation; the raw value never appears
+ * in the archive or the emitted `memory.compacted` event.
+ *
+ * Gated on `capabilities.memory.distillation.supported` + the host memory-
+ * distillation seam; soft-skips when either is absent.
+ *
+ * @see RFCS/0062-scheduled-memory-distillation.md §B
+ * @see spec/v1/agent-memory.md §SR-1 — Secret-Redaction Invariant
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { readDistillationCap, invokeDistill } from '../lib/distillation.js';
+
+const CANARY = 'sk-canary-rfc0062-do-not-leak-qrs456';
+
+describe('distillation-secret-carryforward (RFC 0062 §B)', () => {
+  it('a redacted secret in source memory never appears in the distilled output', async () => {
+    if ((await readDistillationCap())?.supported !== true) return;
+    const res = await invokeDistill({
+      memoryRef: 'conformance-distill',
+      tokenBudget: 8000,
+      includeSecretCanary: true,
+      sources: [{ content: `notes with embedded secret ${CANARY}` }],
+    });
+    if (res === null) return; // seam absent — soft-skip
+    expect(
+      JSON.stringify(res.body).includes(CANARY),
+      driver.describe('RFC 0062 §B', 'SR-1 carry-forward: a redacted secret MUST NOT re-appear in the archive or memory.compacted event'),
+    ).toBe(false);
+  });
+});

package/src/scenarios/distillation-shape.test.ts

@@ -0,0 +1,41 @@
+/**
+ * distillation-shape — RFC 0062 §A. The `capabilities.memory.distillation`
+ * advertisement block is either absent or a well-formed object (with a positive
+ * `maxTokenBudget` when present).
+ *
+ * Status: ACTIVE (advertisement-shape; always runs). Behavioral coverage lives
+ * in the sibling distillation-*.test.ts scenarios, gated on `supported` + the
+ * host memory-distillation seam.
+ *
+ * @see RFCS/0062-scheduled-memory-distillation.md §A
+ * @see spec/v1/agent-memory.md §"Scheduled distillation"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { readDistillationCap } from '../lib/distillation.js';
+
+describe('distillation-shape: advertisement (RFC 0062 §A)', () => {
+  it('capabilities.memory.distillation is absent or a well-formed object', async () => {
+    const cap = await readDistillationCap();
+    if (cap === null) return; // not advertised — valid
+    expect(
+      typeof cap.supported,
+      driver.describe('capabilities.schema.json §memory.distillation', 'distillation.supported MUST be a boolean when the block is present'),
+    ).toBe('boolean');
+    if (cap.maxTokenBudget !== undefined) {
+      expect(
+        typeof cap.maxTokenBudget === 'number' && (cap.maxTokenBudget as number) >= 1,
+        driver.describe('capabilities.schema.json §memory.distillation', 'maxTokenBudget MUST be a positive integer when present'),
+      ).toBe(true);
+    }
+    for (const k of ['scheduled', 'indexEmitted'] as const) {
+      if (cap[k] !== undefined) {
+        expect(
+          typeof cap[k],
+          driver.describe('capabilities.schema.json §memory.distillation', `distillation.${k} MUST be a boolean when present`),
+        ).toBe('boolean');
+      }
+    }
+  });
+});

package/src/scenarios/distillation-stable-archive.test.ts

@@ -0,0 +1,37 @@
+/**
+ * distillation-stable-archive — RFC 0062 §B(4). The distilled archive is an
+ * immutable, addressable artifact: the same source set + budget MUST yield a
+ * byte-stable archive checksum (reproducible + auditable).
+ *
+ * Gated on `capabilities.memory.distillation.supported` + the host memory-
+ * distillation seam; soft-skips when either is absent.
+ *
+ * @see RFCS/0062-scheduled-memory-distillation.md §B
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { readDistillationCap, invokeDistill } from '../lib/distillation.js';
+
+describe('distillation-stable-archive (RFC 0062 §B)', () => {
+  it('identical sources + budget produce an identical archive checksum', async () => {
+    if ((await readDistillationCap())?.supported !== true) return;
+    const req = {
+      memoryRef: 'conformance-distill',
+      tokenBudget: 8000,
+      sources: ['s1', 's2', 's3'],
+    };
+    const a = await invokeDistill(req);
+    if (a === null) return; // seam absent — soft-skip
+    const b = await invokeDistill(req);
+    if (b === null) return;
+    expect(
+      typeof a.body.archiveChecksum === 'string' && (a.body.archiveChecksum as string).length > 0,
+      driver.describe('RFC 0062 §B', 'a distillation run MUST produce a non-empty archive checksum'),
+    ).toBe(true);
+    expect(
+      b.body.archiveChecksum,
+      driver.describe('RFC 0062 §B', 'the same source set + budget MUST yield a byte-stable archive'),
+    ).toBe(a.body.archiveChecksum);
+  });
+});

package/src/scenarios/distillation-token-budget.test.ts

@@ -0,0 +1,45 @@
+/**
+ * distillation-token-budget — RFC 0062 §B. A distillation run stays within its
+ * token budget (`memory.compacted.distillation.tokensUsed ≤ tokenBudget`); an
+ * un-meetable budget fails with `token_budget_exceeded` and writes no partial
+ * archive (atomic).
+ *
+ * Gated on `capabilities.memory.distillation.supported` + the host memory-
+ * distillation seam; soft-skips when either is absent.
+ *
+ * @see RFCS/0062-scheduled-memory-distillation.md §B
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { readDistillationCap, invokeDistill } from '../lib/distillation.js';
+
+describe('distillation-token-budget (RFC 0062 §B)', () => {
+  it('within budget tokensUsed ≤ tokenBudget; an un-meetable budget fails atomically', async () => {
+    if ((await readDistillationCap())?.supported !== true) return;
+
+    const ok = await invokeDistill({ memoryRef: 'conformance-distill', tokenBudget: 8000 });
+    if (ok === null) return; // seam absent — soft-skip
+    const dist = ok.body.event?.distillation ?? {};
+    expect(
+      typeof dist.tokenBudget === 'number' && typeof dist.tokensUsed === 'number',
+      driver.describe('RFC 0062 §B', 'memory.compacted MUST carry distillation.tokenBudget + tokensUsed on a budgeted run'),
+    ).toBe(true);
+    expect(
+      (dist.tokensUsed as number) <= (dist.tokenBudget as number),
+      driver.describe('RFC 0062 §B', 'a successful distillation MUST consume ≤ its tokenBudget'),
+    ).toBe(true);
+
+    // A budget too small to distill the corpus MUST fail closed, no partial archive.
+    const tooSmall = await invokeDistill({ memoryRef: 'conformance-distill', tokenBudget: 1 });
+    if (tooSmall === null) return;
+    expect(
+      tooSmall.status >= 400 && tooSmall.body.error === 'token_budget_exceeded',
+      driver.describe('RFC 0062 §B', 'an un-meetable budget MUST fail with token_budget_exceeded'),
+    ).toBe(true);
+    expect(
+      tooSmall.body.archiveChecksum,
+      driver.describe('RFC 0062 §B', 'a token_budget_exceeded run MUST write no partial archive (atomic)'),
+    ).toBeUndefined();
+  });
+});

package/src/scenarios/envelope-completion-distinguishes-truncation.test.ts

@@ -31,6 +31,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 const NODE_ID = 'structured-call';
@@ -91,7 +92,7 @@ describe.skipIf(HTTP_SKIP)('envelope-completion-distinguishes-truncation: advert
   it('capabilities.envelopes.reliability.completion (when present) conforms to RFC 0033 §E', async () => {
     const d = await readDiscovery();
     if (d === null) return;
-    const completion = d.capabilities?.envelopes?.reliability?.completion;
+    const completion = capabilityFamily<{ reasoning?: Record<string, unknown>; tierOneSubsetCompliance?: unknown; reliability?: { completion?: Record<string, unknown> } & Record<string, unknown> }>(d, 'envelopes')?.reliability?.completion;
     if (completion === undefined) return;
     expect(
       typeof completion.distinguishesTruncation,
@@ -114,7 +115,7 @@ describe.skipIf(HTTP_SKIP)('envelope-completion-distinguishes-truncation: trunca
   it('truncation: emits envelope.truncated + envelope.retry.attempted with reason: "truncation"', async () => {
     if (!isFixtureAdvertised(TRUNCATED_FIXTURE)) return;
     const d = await readDiscovery();
-    if (d?.capabilities?.envelopes?.reliability?.completion?.distinguishesTruncation !== true) return;
+    if (capabilityFamily<{ reasoning?: Record<string, unknown>; tierOneSubsetCompliance?: unknown; reliability?: { completion?: Record<string, unknown> } & Record<string, unknown> }>(d, 'envelopes')?.reliability?.completion?.distinguishesTruncation !== true) return;
     const seed = await programMock([
       { stopReason: 'max_tokens', content: '{"partial' },
       { stopReason: 'end_turn', content: '{"valid":true}' },
@@ -139,7 +140,7 @@ describe.skipIf(HTTP_SKIP)('envelope-completion-distinguishes-truncation: trunca
   it('truncation: retry budget strictly greater than initial (RFC 0033 §B truncationBudgetMultiplier)', async () => {
     if (!isFixtureAdvertised(TRUNCATED_FIXTURE)) return;
     const d = await readDiscovery();
-    if (d?.capabilities?.envelopes?.reliability?.completion?.distinguishesTruncation !== true) return;
+    if (capabilityFamily<{ reasoning?: Record<string, unknown>; tierOneSubsetCompliance?: unknown; reliability?: { completion?: Record<string, unknown> } & Record<string, unknown> }>(d, 'envelopes')?.reliability?.completion?.distinguishesTruncation !== true) return;
     const seed = await programMock([
       { stopReason: 'max_tokens', content: '{"partial' },
       { stopReason: 'end_turn', content: '{"valid":true}' },

package/src/scenarios/envelope-reasoning-secret-redaction.test.ts

@@ -35,6 +35,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 
@@ -97,8 +98,8 @@ describe.skipIf(HTTP_SKIP)('envelope-reasoning-secret-redaction: advertisement s
   it('hosts advertising envelope reasoning + BYOK honor SR-1 carry-forward for the reasoning field', async () => {
     const d = await readDiscovery();
     if (d === null) return;
-    const reasoning = d.capabilities?.envelopes?.reasoning?.supported;
-    const secrets = d.capabilities?.secrets?.supported;
+    const reasoning = capabilityFamily<{ reasoning?: Record<string, unknown>; tierOneSubsetCompliance?: unknown; reliability?: { completion?: Record<string, unknown> } & Record<string, unknown> }>(d, 'envelopes')?.reasoning?.supported;
+    const secrets = capabilityFamily<{ supported?: unknown }>(d, 'secrets')?.supported;
     if (reasoning !== true || secrets !== true) return; // soft-skip when either is absent
     // The contract is invariant-based, not capability-flag-based — the
     // advertisement-shape check here just confirms both surfaces are claimed.
@@ -257,7 +258,7 @@ describe.skipIf(HTTP_SKIP)('envelope-reasoning-secret-redaction: downstream-proj
     // RFC 0034 §B: gate on capabilities.observability.testSeams.otelScrape.
     // Hosts that don't advertise it soft-skip; hosts that DO advertise MUST serve a valid response.
     const d = await readDiscovery();
-    const otelScrapeAdvertised = d?.capabilities?.observability?.testSeams?.otelScrape === true;
+    const otelScrapeAdvertised = capabilityFamily<{ testSeams?: Record<string, unknown> }>(d, 'observability')?.testSeams?.otelScrape === true;
     if (!otelScrapeAdvertised) return; // soft-skip — host honest about not implementing per RFC 0034 §A
 
     const r = await acceptForRun(
@@ -291,7 +292,7 @@ describe.skipIf(HTTP_SKIP)('envelope-reasoning-secret-redaction: downstream-proj
   it("debug-bundle export MUST NOT include plaintext `secret:`-prefixed substrings from envelope.reasoning", async () => {
     // RFC 0034 §B: gate on capabilities.observability.testSeams.debugBundleExport.
     const d = await readDiscovery();
-    const debugBundleAdvertised = d?.capabilities?.observability?.testSeams?.debugBundleExport === true;
+    const debugBundleAdvertised = capabilityFamily<{ testSeams?: Record<string, unknown> }>(d, 'observability')?.testSeams?.debugBundleExport === true;
     if (!debugBundleAdvertised) return; // soft-skip — host honest about not implementing per RFC 0034 §A
 
     const r = await acceptForRun(

package/src/scenarios/envelope-reasoning-shape.test.ts

@@ -32,6 +32,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { driver } from '../lib/driver.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 
@@ -163,7 +164,7 @@ describe.skipIf(HTTP_SKIP)('envelope-reasoning-shape: capabilities.envelopes adv
   it('capabilities.envelopes.reasoning (when present) conforms to RFC 0030 §C', async () => {
     const d = await readDiscovery();
     if (d === null) return;
-    const reasoning = d.capabilities?.envelopes?.reasoning;
+    const reasoning = capabilityFamily<{ reasoning?: Record<string, unknown>; tierOneSubsetCompliance?: unknown; reliability?: { completion?: Record<string, unknown> } & Record<string, unknown> }>(d, 'envelopes')?.reasoning;
     if (reasoning === undefined) return; // optional block; host MAY omit
     expect(
       typeof reasoning.supported,
@@ -180,7 +181,7 @@ describe.skipIf(HTTP_SKIP)('envelope-reasoning-shape: capabilities.envelopes adv
   it('capabilities.envelopes.tierOneSubsetCompliance (when present) conforms to RFC 0030 §B', async () => {
     const d = await readDiscovery();
     if (d === null) return;
-    const compliance = d.capabilities?.envelopes?.tierOneSubsetCompliance;
+    const compliance = capabilityFamily<{ reasoning?: Record<string, unknown>; tierOneSubsetCompliance?: unknown; reliability?: { completion?: Record<string, unknown> } & Record<string, unknown> }>(d, 'envelopes')?.tierOneSubsetCompliance;
     if (compliance === undefined) return; // optional; host MAY omit
     expect(
       ['strict', 'warn', 'off'],