@openwop/openwop-conformance 1.72.2 → 1.98.0

package/src/scenarios/core-manifest-and-extension-registry.test.ts

@@ -0,0 +1,198 @@
+/**
+ * RFC 0155 §B + §C — the stable core manifest and the extension registry.
+ *
+ * §B's value is not the inventory. It is the sentence after it: *"prose and code
+ * profile definitions MUST be generated from or checked against this manifest."*
+ * Three places describe the core-standard floor independently — the profile
+ * prose, `PROFILE_FLOOR_SCENARIOS`, and the requirement registry — and before
+ * this they could only be assumed to agree.
+ *
+ * They did not. `PROFILE_FLOOR_SCENARIOS` was an incomplete transcription of
+ * `profiles.md`, and every profile it omitted verified as floor-proven against
+ * nothing (RFC 0148 §C). A manifest with a parity gate is the mechanism that
+ * would have caught that, which is why the manifest is DERIVED and never
+ * hand-listed: a hand-listed manifest drifts the moment the corpus moves and
+ * then asserts the drift with a digest attached.
+ *
+ * §C's bar for `stable` is deliberately hard — normative prose, schemas,
+ * non-vacuous conformance, SDK support, and at least one Tier-3 implementation.
+ * The consequence, stated plainly rather than worked around: **nothing in this
+ * corpus can currently be `stable`**, because no Tier-3 host exists. That is a
+ * fact about adoption, not about the work.
+ *
+ * Server-free; reads the corpus.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { V1_DIR } from '../lib/paths.js';
+import { PROFILE_FLOOR_SCENARIOS } from '../lib/profiles.js';
+import { requirementsFor } from '../lib/requirement-registry.js';
+
+const MATURITIES = ['experimental', 'draft', 'stable', 'deprecated'] as const;
+type Maturity = (typeof MATURITIES)[number];
+
+interface Extension {
+  readonly id: string;
+  readonly maturity: Maturity;
+  readonly owningRfc: string;
+  readonly capabilityPath: string;
+  readonly dependsOn: readonly string[];
+  readonly securityTier: string;
+  readonly minimumSuiteVersion: string | null;
+  readonly evidenceTier: string | null;
+  readonly note?: string;
+}
+
+/** The capability schema, for `capabilityPath` resolution. */
+function caps(): Record<string, unknown> {
+  return JSON.parse(
+    readFileSync(join(V1_DIR as string, '..', '..', 'schemas', 'capabilities.schema.json'), 'utf8'),
+  ) as Record<string, unknown>;
+}
+
+function readJson<T>(name: string): T {
+  return JSON.parse(readFileSync(join(V1_DIR as string, name), 'utf8')) as T;
+}
+
+describe.skipIf(V1_DIR === null)('RFC 0155 §B — core-standard manifest parity', () => {
+  const manifest = V1_DIR === null ? null : readJson<{
+    profile: string;
+    digest: string;
+    floor: { requiredScenarios: string[]; requiredAnyPrefix: string[] };
+    requirementIds: string[];
+    openapiOperations: string[];
+    schemas: { file: string; $id: string | null }[];
+  }>('core-standard-manifest.json');
+
+  it('the manifest exists and is non-trivial', () => {
+    // Guard: an empty manifest would make every parity leg below vacuously true,
+    // which is the exact shape RFC 0148 §C found in the floor verifier.
+    expect(manifest, 'RFC 0155 §B: the manifest MUST be published').not.toBeNull();
+    const m = manifest as NonNullable<typeof manifest>;
+    expect(m.profile).toBe('openwop-core-standard');
+    expect(m.digest, 'the manifest MUST carry a digest').toMatch(/^[0-9a-f]{64}$/);
+    expect(m.floor.requiredScenarios.length).toBeGreaterThan(5);
+    expect(m.openapiOperations.length).toBeGreaterThan(20);
+    expect(m.schemas.length).toBeGreaterThan(20);
+  });
+
+  it('the manifest floor matches the floor the suite actually enforces', () => {
+    // The parity §B asks for. If these drift, the manifest is asserting a floor
+    // nobody runs — worse than no manifest, because it looks authoritative.
+    const m = manifest as NonNullable<typeof manifest>;
+    const live = PROFILE_FLOOR_SCENARIOS['openwop-core-standard'];
+    expect(live, 'the suite MUST define a core-standard floor').toBeDefined();
+    expect([...m.floor.requiredScenarios].sort()).toEqual([...(live?.required ?? [])].sort());
+    expect([...m.floor.requiredAnyPrefix].sort()).toEqual([...(live?.requiredAnyPrefix ?? [])].sort());
+  });
+
+  it('the manifest requirement IDs match the requirement registry', () => {
+    const m = manifest as NonNullable<typeof manifest>;
+    const fromRegistry = requirementsFor('openwop-core-standard');
+    expect(fromRegistry, 'core-standard MUST have registered requirements').not.toBeNull();
+    expect([...m.requirementIds].sort()).toEqual([...(fromRegistry as readonly string[])].sort());
+  });
+
+  it('every schema the manifest lists declares an $id', () => {
+    const m = manifest as NonNullable<typeof manifest>;
+    const missing = m.schemas.filter((s) => s.$id === null).map((s) => s.file);
+    expect(missing, 'CONTRIBUTING.md: every schema carries an `$id` under openwop.dev/spec/v1/').toEqual([]);
+  });
+});
+
+describe.skipIf(V1_DIR === null)('RFC 0155 §C — extension registry', () => {
+  const registry = V1_DIR === null ? null : readJson<{ extensions: Extension[] }>('extensions.json');
+
+  it('the registry exists and every record is closed', () => {
+    expect(registry, 'RFC 0155 §C: `spec/v1/extensions.json` MUST exist').not.toBeNull();
+    const exts = (registry as NonNullable<typeof registry>).extensions;
+    expect(exts.length, 'the registry MUST cover the program extensions').toBeGreaterThan(3);
+    for (const e of exts) {
+      for (const k of ['id', 'maturity', 'owningRfc', 'capabilityPath', 'dependsOn', 'securityTier']) {
+        expect(e[k as keyof Extension], `${e.id} MUST declare ${k}`).toBeDefined();
+      }
+      expect(MATURITIES, `${e.id}: maturity is a closed enum`).toContain(e.maturity);
+    }
+    expect(new Set(exts.map((e) => e.id)).size, 'extension ids MUST be unique').toBe(exts.length);
+  });
+
+  it('no extension is `stable` without a Tier-3 implementation', () => {
+    // §C: stable requires normative prose, schemas, non-vacuous conformance, SDK
+    // support where applicable, and at least one Tier-3 implementation. The last
+    // one is the binding constraint here, and it is external to this repo — no
+    // Tier-3 host exists, so NOTHING can currently be stable. Recording that
+    // ceiling is the honest move; promoting anything past it would be the
+    // overclaim RFC 0147 §A bans.
+    const overclaimed = (registry as NonNullable<typeof registry>).extensions
+      .filter((e) => e.maturity === 'stable' && (e.evidenceTier === null || e.evidenceTier === undefined))
+      .map((e) => e.id);
+    expect(
+      overclaimed,
+      'RFC 0155 §C: `stable` requires at least one Tier-3 implementation, recorded in `evidenceTier`. ' +
+        'An extension marked stable with no evidence tier is a claim the corpus cannot substantiate.',
+    ).toEqual([]);
+  });
+
+  it('every dependency resolves to a known profile or listed extension', () => {
+    // A dependency on something that does not exist is a closure hole: the
+    // record looks complete and the graph does not.
+    const exts = (registry as NonNullable<typeof registry>).extensions;
+    const known = new Set<string>([...Object.keys(PROFILE_FLOOR_SCENARIOS), ...exts.map((e) => e.id)]);
+    const dangling = exts.flatMap((e) =>
+      e.dependsOn.filter((d) => !known.has(d)).map((d) => `${e.id} -> ${d}`),
+    );
+    expect(dangling, 'RFC 0155 §C: `dependsOn` MUST resolve').toEqual([]);
+  });
+
+  it('every capabilityPath resolves against the capability schema', () => {
+    // Fifth axis of the named-list check, and it found four of six broken.
+    // Three were typos introduced when this registry was written —
+    // `a2a.protocolVersion` for `protocolVersions`, the same for MCP, and
+    // `workloadIdentity.supported` omitting its `auth.` parent. The fourth,
+    // `idempotency.supported`, pointed at a field the corpus USES in its own
+    // examples but had never DECLARED; it validated only because that family
+    // carries `additionalProperties: true`, so a typo like `suported` was
+    // accepted silently.
+    //
+    // An extension whose capabilityPath does not resolve is unreachable: a
+    // consumer following the registry to find the flag finds nothing, and the
+    // registry looks complete while pointing at empty space.
+    const schema = caps() as { properties: Record<string, unknown> };
+    const unresolved: string[] = [];
+    for (const e of (registry as NonNullable<typeof registry>).extensions) {
+      let node = schema.properties as Record<string, { properties?: Record<string, unknown> }> | undefined;
+      let ok = true;
+      for (const part of e.capabilityPath.split('.')) {
+        if (node === undefined || !(part in node)) {
+          ok = false;
+          break;
+        }
+        node = node[part]?.properties as typeof node;
+      }
+      if (!ok) unresolved.push(`${e.id} -> ${e.capabilityPath}`);
+    }
+    expect(
+      unresolved,
+      'RFC 0155 §C: `capabilityPath` MUST resolve to a declared property in ' +
+        '`capabilities.schema.json`. An unresolvable path makes the extension unreachable — a ' +
+        'consumer following the registry to find the flag finds nothing, while the registry ' +
+        'still reads as complete.\n  ' + unresolved.join('\n  '),
+    ).toEqual([]);
+  });
+
+  it('every record names the RFC that owns it', () => {
+    // Vendor extensions may not use an `openwop-*` id without an accepted RFC
+    // (§F). The owning RFC is what makes that checkable.
+    for (const e of (registry as NonNullable<typeof registry>).extensions) {
+      expect(e.owningRfc, `${e.id} MUST name an owning RFC`).toMatch(/^\d{4}$/);
+      if (e.id.startsWith('openwop-')) {
+        expect(
+          e.owningRfc.length,
+          `${e.id}: an \`openwop-*\` id requires an accepted RFC (§F)`,
+        ).toBeGreaterThan(0);
+      }
+    }
+  });
+});

package/src/scenarios/discovery-canonical-family-no-shadow.test.ts

@@ -0,0 +1,219 @@
+/**
+ * RFC 0149 §E — a vendor extension MUST NOT shadow a canonical capability family.
+ *
+ * RFC 0073 put canonical families at the document root, and `host-extensions.md`
+ * §"Canonical prefixes" puts vendor surface under `x-host-<vendor>-*`,
+ * `vendor.<org>.*`, or `private.<host>.*`. Those two rules together are what make
+ * discovery negotiable: a consumer reads the root for what the protocol defines
+ * and treats a namespaced key as opaque.
+ *
+ * The gap is what happens when a canonical family name appears *inside* the
+ * namespaced region — `vendor.acme.auth`, or an `x-host-acme-*` object carrying
+ * its own `interrupts`. Nothing in the corpus forbade it, and a consumer that
+ * merges vendor surface over the root before negotiating reads a vendor's
+ * `auth` block as *the* auth contract. `host-extensions.md` already says clients
+ * MUST treat extension surface as opaque, but "opaque" is a rule about the
+ * consumer; it does not stop a host from publishing the collision, and the
+ * consumer that gets it wrong is the one that most needed the guardrail.
+ *
+ * §E's second clause is separate and unconditional: no discovery example may
+ * carry credentials or tenant data. Discovery is the one document a host serves
+ * credential-free to anonymous callers (RFC 0100 requires `agentCardUrl` to GET-
+ * resolve without credentials), so a secret pasted into an example is a secret
+ * in the most-copied, least-guarded artifact in the corpus.
+ *
+ * Both legs are structural and server-free — they read the corpus, not a host.
+ * `spec/v1/` and `RFCS/` are repository-only, so this self-skips under the
+ * published tarball layout.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join, resolve as pathResolve } from 'node:path';
+import { V1_DIR } from '../lib/paths.js';
+
+const SCHEMA_PATH =
+  V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'schemas', 'capabilities.schema.json');
+
+/** The canonical families, read from the schema rather than hand-listed. */
+function canonicalFamilies(): Set<string> {
+  if (SCHEMA_PATH === null) return new Set();
+  const schema = JSON.parse(readFileSync(SCHEMA_PATH, 'utf8')) as {
+    properties?: Record<string, unknown>;
+  };
+  return new Set(Object.keys(schema.properties ?? {}));
+}
+
+/** `host-extensions.md` §"Canonical prefixes". */
+function isVendorKey(key: string): boolean {
+  return /^x-host-/.test(key) || /^(vendor|private)\./.test(key);
+}
+
+interface Finding {
+  readonly file: string;
+  readonly line: number;
+  readonly detail: string;
+}
+
+/** Every fenced json/jsonc example under `dir`, paired with its source line. */
+function fencedObjects(dir: string): { file: string; line: number; value: unknown }[] {
+  const out: { file: string; line: number; value: unknown }[] = [];
+  for (const name of readdirSync(dir).filter((f) => f.endsWith('.md')).sort()) {
+    const lines = readFileSync(join(dir, name), 'utf8').split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      if (!/^```(json|jsonc)\s*$/.test(lines[i]!.trim())) continue;
+      const body: string[] = [];
+      let j = i + 1;
+      while (j < lines.length && lines[j]!.trim() !== '```') body.push(lines[j++]!);
+      try {
+        out.push({ file: name, line: i + 2, value: JSON.parse(body.join('\n')) });
+      } catch {
+        // Unparseable blocks are RFC 0150 §D's problem, not this gate's.
+      }
+      i = j;
+    }
+  }
+  return out;
+}
+
+/** Canonical family names appearing anywhere beneath a vendor-namespaced key. */
+function shadowed(value: unknown, families: Set<string>, insideVendor: boolean): string[] {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return [];
+  const hits: string[] = [];
+  for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+    const nowInside = insideVendor || isVendorKey(key);
+    if (insideVendor && families.has(key)) hits.push(key);
+    hits.push(...shadowed(child, families, nowInside));
+  }
+  return hits;
+}
+
+/**
+ * Credential detection runs on THREE axes with different failure modes, because
+ * no one of them is complete and the ways they are incomplete do not overlap.
+ *
+ * A peer put the problem precisely: *a negative existence claim cannot be
+ * established by grepping the vocabulary you would have chosen.* Axis 1 alone —
+ * a hand-picked list of issuer prefixes — reports clean on every credential
+ * format its author did not think of, and reports it in exactly the confident
+ * tone of a real check. That is the vacuous-witness pattern wearing a different
+ * hat: the gate is honest about what it observed and silent about what it
+ * cannot see.
+ *
+ * None of the three closes the claim. Together they fail differently, which is
+ * the most that can be said for them, and it is said here rather than implied by
+ * a green run.
+ */
+
+/** Axis 1 — known issuer prefixes. Blind to any format not listed. */
+const SECRET_PREFIX = [
+  /\bsk-[A-Za-z0-9]{16,}/,
+  /\bghp_[A-Za-z0-9]{20,}/,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}/,
+  /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+  /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
+];
+
+/** Axis 2 — the property NAME claims to hold a credential. Blind to odd names. */
+const CREDENTIAL_KEY = /secret|password|token|api_?key|credential|private_?key|bearer/i;
+
+/** An example is allowed to say `sk-…` or `<your-key>`; that is what examples are for. */
+function isPlaceholder(v: string): boolean {
+  if (v.length < 16) return true;
+  if (/^https?:\/\//.test(v)) return true;
+  return /\.\.\.|…|<|>|\bexample\b|\bplaceholder\b|\bredacted\b|\byour-|\bchangeme\b|x{4,}/i.test(v);
+}
+
+/**
+ * Axis 3 — dense random-looking material regardless of issuer. Requires no
+ * separators, mixed case, digits, and high Shannon entropy, which is what
+ * distinguishes a credential body from a long dotted identifier or an SRI hash.
+ * Blind to low-entropy secrets and to anything with word structure.
+ */
+function isDenseToken(v: string): boolean {
+  if (!/^[A-Za-z0-9]{24,}$/.test(v)) return false;
+  if (!(/[a-z]/.test(v) && /[A-Z]/.test(v) && /[0-9]/.test(v))) return false;
+  const counts = new Map<string, number>();
+  for (const ch of v) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let entropy = 0;
+  for (const c of counts.values()) {
+    const p = c / v.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy >= 4.2;
+}
+
+function secrets(value: unknown): string[] {
+  const hits: string[] = [];
+  const walk = (v: unknown, key: string | null): void => {
+    if (typeof v === 'string') {
+      for (const re of SECRET_PREFIX) if (re.test(v)) hits.push(`${v.slice(0, 24)} [issuer-prefix]`);
+      if (key !== null && CREDENTIAL_KEY.test(key) && !isPlaceholder(v)) {
+        hits.push(`${key}=${v.slice(0, 24)} [credential-named]`);
+      }
+      if (isDenseToken(v)) hits.push(`${v.slice(0, 24)} [dense-token]`);
+      return;
+    }
+    if (Array.isArray(v)) return v.forEach((c) => walk(c, key));
+    if (v !== null && typeof v === 'object') {
+      for (const [k, c] of Object.entries(v)) walk(c, k);
+    }
+  };
+  walk(value, null);
+  return [...new Set(hits)];
+}
+
+describe.skipIf(V1_DIR === null)('RFC 0149 §E — canonical families are not shadowed', () => {
+  const v1Dir = V1_DIR as string;
+  const rfcsDir = V1_DIR === null ? '' : pathResolve(v1Dir, '..', '..', 'RFCS');
+
+  it('the canonical family list and the example corpus are both non-empty', () => {
+    // Guard: an empty family set or an empty scan makes both legs vacuous —
+    // the failure RFC 0148 exists to close.
+    expect(canonicalFamilies().size, 'capabilities.schema.json MUST declare families').toBeGreaterThan(50);
+    expect(fencedObjects(v1Dir).length, 'spec/v1 MUST contain parseable json examples').toBeGreaterThan(20);
+  });
+
+  it('no vendor-namespaced object re-declares a canonical family', () => {
+    const families = canonicalFamilies();
+    const findings: Finding[] = [];
+    for (const dir of [v1Dir, rfcsDir]) {
+      for (const { file, line, value } of fencedObjects(dir)) {
+        const hits = shadowed(value, families, false);
+        if (hits.length > 0) {
+          const rel = dir === v1Dir ? 'spec/v1' : 'RFCS';
+          findings.push({ file, line, detail: `${rel}/${file}:${line} → ${[...new Set(hits)].join(', ')}` });
+        }
+      }
+    }
+    expect(
+      findings.map((f) => f.detail),
+      'RFC 0149 §E: a canonical family name inside `x-host-*` / `vendor.*` / `private.*` shadows ' +
+        'the family a consumer negotiates on. `host-extensions.md` tells clients to treat ' +
+        'extension surface as opaque, but that binds the consumer — it does not stop a host from ' +
+        'publishing the collision, and the consumer that merges vendor over root before ' +
+        'negotiating is exactly the one the rule was meant to protect.\n  ' +
+        findings.map((f) => f.detail).join('\n  '),
+    ).toEqual([]);
+  });
+
+  it('no discovery example carries credential material', () => {
+    const findings: string[] = [];
+    for (const dir of [v1Dir, rfcsDir]) {
+      for (const { file, line, value } of fencedObjects(dir)) {
+        const hits = secrets(value);
+        if (hits.length > 0) {
+          const rel = dir === v1Dir ? 'spec/v1' : 'RFCS';
+          findings.push(`${rel}/${file}:${line} → ${hits.join(', ')}…`);
+        }
+      }
+    }
+    expect(
+      findings,
+      'RFC 0149 §E: discovery is served credential-free to anonymous callers, so a real-shaped ' +
+        'secret in an example sits in the most-copied, least-guarded artifact in the corpus. ' +
+        'Use an obvious placeholder.\n  ' + findings.join('\n  '),
+    ).toEqual([]);
+  });
+});

package/src/scenarios/effect-identity-composition.test.ts

@@ -0,0 +1,129 @@
+/**
+ * RFC 0150 §B — the Layer-2 logical effect identity is stable across retries.
+ *
+ * `spec/v1/idempotency.md` contradicted itself. §"Idempotency key composition"
+ * put `attempt` — documented one line later as the "zero-based retry attempt
+ * counter" — inside the hash, while §"Composition: how the layers compose"
+ * promised that when "the engine retries the OpenAI call internally (transient
+ * 503), Layer 2's `invocationId` is identical, so the second call either
+ * short-circuits (cache hit) or hits OpenAI's own idempotency cache".
+ *
+ * Both cannot hold. A retry counter in the key means every retry hashes to a
+ * NEW key, so the invocation log never hits, the injected `Idempotency-Key`
+ * differs, and the provider's own dedup is defeated too. The composition
+ * guaranteed a duplicate side effect on precisely the path Layer 2 exists to
+ * protect — a duplicate charge, a duplicate send, a duplicate completion.
+ *
+ * The defect was invisible to every gate in the corpus because both halves are
+ * prose. Nothing parsed the formula, and nothing cross-read it against the
+ * paragraph asserting the opposite.
+ *
+ * This gate reads the normative composition block and holds it to §B: domain
+ * separation, tenant binding, a per-logical-invocation ordinal that is stable
+ * across retries, and NO retry counter. `attempt` remains legitimate telemetry;
+ * §B's requirement is that it MUST NOT participate in the identity.
+ *
+ * Server-free and always-on: it reads the corpus, never a host. `spec/v1/`
+ * ships in the repository and NOT in the published tarball, so it self-skips
+ * under the published layout — the asymmetry that has already produced three
+ * defects here (the `CORPUS-STAMP` gate, the link-checker's filesystem walk,
+ * and RFC 0146 leg A4).
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { V1_DIR } from '../lib/paths.js';
+
+const HEADING = '### Idempotency key composition';
+
+/**
+ * The first fenced block under the composition heading. Returns null when the
+ * heading or its fence is absent, so the guard leg can fail loudly rather than
+ * letting every assertion below pass over an empty string.
+ */
+function compositionBlock(doc: string): string | null {
+  const lines = doc.split('\n');
+  const start = lines.findIndex((l) => l.trim() === HEADING);
+  if (start === -1) return null;
+  const open = lines.findIndex((l, i) => i > start && /^```/.test(l.trim()));
+  if (open === -1) return null;
+  const body: string[] = [];
+  for (let i = open + 1; i < lines.length && lines[i]!.trim() !== '```'; i++) body.push(lines[i]!);
+  return body.length === 0 ? null : body.join('\n');
+}
+
+describe.skipIf(V1_DIR === null)('RFC 0150 §B — Layer-2 effect identity is retry-stable', () => {
+  const doc = V1_DIR === null ? '' : readFileSync(join(V1_DIR as string, 'idempotency.md'), 'utf8');
+
+  it('the normative composition block is found at all', () => {
+    // Guard: an extractor that matched nothing would make every leg below
+    // vacuously true. That is the exact failure RFC 0148 exists to close, and
+    // this gate must not become an instance of it.
+    expect(
+      compositionBlock(doc),
+      `spec/v1/idempotency.md MUST carry a fenced key composition under "${HEADING}"`,
+    ).not.toBeNull();
+  });
+
+  it('the retry counter does not participate in the identity', () => {
+    const block = compositionBlock(doc) ?? '';
+    expect(
+      /\battempt\b/.test(block),
+      'RFC 0150 §B: `attempt` is separate telemetry and MUST NOT participate in the logical ID. ' +
+        'A retry counter inside the hash gives every retry a different key, so the invocation ' +
+        'log never hits and the injected Idempotency-Key differs — the duplicate side effect ' +
+        'Layer 2 exists to prevent.\n' +
+        block,
+    ).toBe(false);
+  });
+
+  it('the identity is domain-separated and version-tagged', () => {
+    const block = compositionBlock(doc) ?? '';
+    expect(
+      block,
+      'RFC 0150 §B: the preimage MUST open with the `openwop:activity:v2` domain tag so a v1 ' +
+        'and a v2 identity for the same effect cannot collide.',
+    ).toContain('openwop:activity:v2');
+  });
+
+  it('the identity binds the tenant', () => {
+    const block = compositionBlock(doc) ?? '';
+    expect(
+      block,
+      'RFC 0150 §B: `tenantId` is part of the preimage. Without it two tenants that collide on ' +
+        '(runId, nodeId, providerKey) share an invocation-log entry, and one tenant reads the ' +
+        "other's cached provider response.",
+    ).toContain('tenantId');
+  });
+
+  it('the ordinal is documented as stable across retries', () => {
+    const block = compositionBlock(doc) ?? '';
+    expect(block, 'RFC 0150 §B: the preimage carries `logicalInvocationOrdinal`').toContain(
+      'logicalInvocationOrdinal',
+    );
+    // The ordinal only does its job if the prose pins it. An ordinal that a host
+    // is free to re-derive per attempt reintroduces the defect under a new name.
+    // Emphasis and code spans are stripped first so the assertion reads the
+    // requirement, not the markdown that happens to decorate it.
+    const plain = doc.replace(/[`*_]/g, '').replace(/\s+/g, ' ');
+    expect(
+      /logicalInvocationOrdinal MUST NOT change/.test(plain),
+      'RFC 0150 §B: `logicalInvocationOrdinal` MUST NOT change across transport/provider retries, ' +
+        'and the spec MUST say so — otherwise a host may re-derive it per attempt and the ' +
+        'retry-instability returns under a different field name.',
+    ).toBe(true);
+  });
+
+  it('the composition agrees with the claim that a retried call reuses the identity', () => {
+    // The two halves of the contradiction. This leg anchors the ones above to a
+    // real promise in the document rather than to the RFC alone: if the claim
+    // is ever deleted instead of the formula being fixed, this fails and says so.
+    expect(
+      /is identical/.test(doc),
+      'spec/v1/idempotency.md §"Composition: how the layers compose" MUST keep the guarantee ' +
+        'that an internally retried call reuses the same Layer-2 identity. It is the promise the ' +
+        'composition above has to honor.',
+    ).toBe(true);
+  });
+});

package/src/scenarios/effect-identity-cross-scope.test.ts

@@ -0,0 +1,82 @@
+/**
+ * RFC 0150 §B — Layer-2 identity is run-scoped, and the spec has to say what
+ * that costs.
+ *
+ * `runId` is in the §B preimage. An effect issued outside any run has no
+ * `runId`, so the two identities can never collide, and Layer 2 cannot
+ * deduplicate an in-run effect against the same logical effect issued through
+ * an operator route, an admin action, or a scheduled job.
+ *
+ * §"Why this exists" already says implementations "MUST support layer 2 for any
+ * node executor that performs an external side effect", and §"Layer 2" opens
+ * "Inside a workflow run…". A host reading those literally uses the §B form for
+ * the node path — correctly. If that same effect is *also* reachable outside a
+ * run, the two paths issue two effects for one logical operation, which is
+ * precisely the duplicate-effect class §B exists to kill, on the highest-stakes
+ * path it touches.
+ *
+ * Reported by a tier-1 host from a shipped node pack, not a thought experiment:
+ * `feature.commerce.nodes.refund-order` calls the same `refundOrder` that an
+ * HTTP route, a connect-admin route, and a seeder call. They key it on business
+ * identity rather than the §B form *deliberately*, because run-scoped identity
+ * is the wrong scope for that effect — and §B says as much about itself in the
+ * fork note, one face of the same limitation.
+ *
+ * The corpus was silent on this. Silence here reads as "the ordinal form is
+ * sufficient", which for a cross-entry-point effect is false.
+ *
+ * Server-free; reads the corpus, never a host.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { V1_DIR } from '../lib/paths.js';
+
+describe.skipIf(V1_DIR === null)('RFC 0150 §B — cross-scope effect identity', () => {
+  const doc = V1_DIR === null ? '' : readFileSync(join(V1_DIR as string, 'idempotency.md'), 'utf8');
+  const plain = doc.replace(/[`*_]/g, '').replace(/\s+/g, ' ');
+
+  it('the Layer-2 section is found at all', () => {
+    // Guard: an empty read makes every leg below vacuously true.
+    expect(doc.length, 'idempotency.md MUST be readable').toBeGreaterThan(1000);
+    expect(plain, 'the Layer-2 section MUST exist').toContain('Layer 2: Activity-level idempotency');
+  });
+
+  it('the spec states that Layer-2 identity is run-scoped', () => {
+    expect(
+      /run-scoped/.test(plain),
+      'RFC 0150 §B: `runId` is in the preimage, so the identity is scoped to a run. Saying so ' +
+        'explicitly is what makes the next requirement follow rather than look arbitrary.',
+    ).toBe(true);
+  });
+
+  it('the spec requires a business identity when the effect escapes the run', () => {
+    expect(
+      /reachable outside any run/.test(plain),
+      'RFC 0150 §B: the spec MUST name the case — a node side effect that is ALSO reachable ' +
+        'outside any run (operator route, admin action, scheduled job).',
+    ).toBe(true);
+    expect(
+      /MUST additionally key/.test(plain),
+      'RFC 0150 §B: for such an effect the host MUST additionally key on an identity derived from ' +
+        'the business operation. Layer-2 identity alone cannot dedupe across the boundary, because ' +
+        'the out-of-run path has no `runId` to put in the preimage — so a host following the ' +
+        'ordinal form literally reintroduces the duplicate effect §B exists to prevent.',
+    ).toBe(true);
+  });
+
+  it('the run-scope cost is tied to the fork limitation it shares a cause with', () => {
+    // Both are the same fact seen from two sides: `runId` in the preimage. The
+    // spec already documented the fork face; documenting only that one taught
+    // half a limitation.
+    // Asserts the linkage, not a magic phrase: the cross-scope section must
+    // name the fork limitation as the same fact seen from another side.
+    expect(
+      /fork note[\s\S]{0,120}?(one face|other face|same)/.test(plain),
+      'RFC 0150 §B: the fork note and the cross-scope note are one limitation seen twice — ' +
+        '`runId` in the preimage. The cross-scope section MUST reference the fork note, or a ' +
+        'reader concludes the fork case is a special exception rather than an instance.',
+    ).toBe(true);
+  });
+});