@openwop/openwop-conformance 1.72.2 → 1.98.0

package/src/scenarios/mcp-version-negotiation.test.ts

@@ -0,0 +1,159 @@
+/**
+ * RFC 0153 §A/§B — MCP revision negotiation, witnessed against the fake server.
+ *
+ * The companion to `a2a-version-negotiation.test.ts`, and it exists for the same
+ * reason: `McpFakeServer` recorded the JSON-RPC method, params, and timestamp
+ * but **not headers** — while MCP's revision is negotiated in
+ * `MCP-Protocol-Version`. A recorder that captures only the body can see that a
+ * call happened and not which revision it was made under, which is the whole of
+ * what §B governs.
+ *
+ * **Both fake peers had the identical gap**, which is the part worth keeping:
+ * it was not an oversight in one file but a shared assumption that the
+ * interesting part of a call is its body. Version negotiation is the case where
+ * that assumption is exactly wrong.
+ *
+ * MCP revisions are **dates**, and that shapes the assertions. A host that sends
+ * `2026-7-28` or `latest` has sent something no peer can match against a pinned
+ * revision, and the failure surfaces at the peer rather than at the handshake
+ * meant to prevent it. So the header is checked for date form, not merely for
+ * presence.
+ *
+ * `Pinned real MCP current peer passes in CI` stays separate and unmet — that
+ * item tests interoperation, which no fake stands in for, and RFC 0153's
+ * acceptance criteria still say so.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
+
+const PROFILE = 'mcp.versionNegotiation';
+const DATE_FORM = /^\d{4}-\d{2}-\d{2}$/;
+
+interface McpCaps {
+  readonly supported?: boolean;
+  readonly protocolVersions?: readonly string[];
+  readonly preferredVersion?: string;
+  readonly features?: readonly string[];
+}
+
+async function mcp(): Promise<McpCaps | undefined> {
+  const disco = await driver.get('/.well-known/openwop');
+  return capabilityFamily<McpCaps>(disco.json, 'mcp');
+}
+
+async function negotiationAdvertised(): Promise<boolean> {
+  const caps = await mcp();
+  return caps?.supported === true && (caps.protocolVersions?.length ?? 0) > 0;
+}
+
+describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
+  it('advertised revisions use MCP date form and include the preferred one', async () => {
+    if (!behaviorGate(PROFILE, await negotiationAdvertised())) return;
+    const caps = await mcp();
+    for (const v of caps?.protocolVersions ?? []) {
+      expect(
+        DATE_FORM.test(v),
+        driver.describe(
+          'RFCS/0153-mcp-2026-07-28-versioned-composition.md §A',
+          `'${v}' is not MCP's date form. MCP revisions ARE dates, and 'latest' or an unpadded ` +
+            'month lets two hosts disagree about which revision they share while both look valid.',
+        ),
+      ).toBe(true);
+    }
+    expect(
+      caps?.protocolVersions ?? [],
+      driver.describe('RFCS/0153 §A', '`preferredVersion` MUST be one the host actually lists'),
+    ).toContain(caps?.preferredVersion);
+  });
+
+  it('outbound calls carry MCP-Protocol-Version in date form', async () => {
+    if (!behaviorGate(PROFILE, await negotiationAdvertised())) return;
+    const server = getMcpFakeServer();
+    if (server === null) return;
+    server.reset();
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint() });
+    if (drive.status === 404 || drive.status === 403) {
+      expect(
+        drive.status,
+        driver.describe(
+          'RFCS/0153 §B',
+          'a host advertising MCP revisions MUST expose an invoke seam so the negotiated revision ' +
+            'is observable. Without it the requirement resolves to `blocked` per RFC 0148 §A — not ' +
+            'to a pass.',
+        ),
+      ).not.toBe(404);
+      return;
+    }
+    const calls = server.invocations();
+    expect(calls.length, 'the host MUST have called the server').toBeGreaterThan(0);
+    for (const c of calls) {
+      const v = c.headers['mcp-protocol-version'];
+      expect(
+        v,
+        driver.describe('RFCS/0153 §A', 'every MCP call MUST declare its revision'),
+      ).toBeTruthy();
+      expect(
+        DATE_FORM.test(v ?? ''),
+        driver.describe(
+          'RFCS/0153 §A',
+          `the revision on the wire MUST be MCP's date form; got '${v}'. A malformed revision is ` +
+            'unmatchable against a pinned peer, and the failure then surfaces at the peer rather ' +
+            'than at the handshake meant to prevent it.',
+        ),
+      ).toBe(true);
+    }
+  });
+
+  it('the negotiated revision is one the host advertises', async () => {
+    if (!behaviorGate(PROFILE, await negotiationAdvertised())) return;
+    const server = getMcpFakeServer();
+    if (server === null) return;
+    const caps = await mcp();
+    server.reset();
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint() });
+    if (drive.status === 404 || drive.status === 403) return;
+    // Discovery is a promise about behavior. A host that negotiates a revision
+    // it never advertised has made its own discovery document unreliable, which
+    // is worse than advertising nothing — a consumer that read it made a
+    // decision on a fact that was not true.
+    for (const c of server.invocations()) {
+      expect(
+        caps?.protocolVersions ?? [],
+        driver.describe(
+          'RFCS/0153 §A/§B',
+          'the revision sent on the wire MUST appear in `protocolVersions`. Negotiating an ' +
+            'unadvertised revision makes the discovery document unreliable for every consumer ' +
+            'that read it.',
+        ),
+      ).toContain(c.headers['mcp-protocol-version']);
+    }
+  });
+
+  it('an unsupported revision fails through the canonical interop envelope', async () => {
+    if (!behaviorGate(PROFILE, await negotiationAdvertised())) return;
+    const server = getMcpFakeServer();
+    if (server === null) return;
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', {
+      serverUrl: server.endpoint(),
+      requestVersion: '1999-01-01',
+    });
+    if (drive.status === 404 || drive.status === 403) return;
+    expect(
+      drive.status >= 400,
+      driver.describe('RFCS/0153 §B', 'an unsupported revision MUST fail rather than silently proceed'),
+    ).toBe(true);
+    expect(
+      (drive.json as { error?: { code?: string } }).error?.code,
+      driver.describe(
+        'RFCS/0153 §B',
+        'the upstream error MUST be projected through the canonical OpenWOP interop envelope — a ' +
+          'raw JSON-RPC error body leaves the caller parsing a foreign protocol to learn its own ' +
+          'request was rejected',
+      ),
+    ).toBeTruthy();
+  });
+});

package/src/scenarios/multi-region-effect-vocabulary.test.ts

@@ -0,0 +1,175 @@
+/**
+ * RFC 0150 §D — record reconciliation and effect authorization are separate
+ * claims, and the capability vocabulary must not conflate them.
+ *
+ * Two defects, both in the corpus rather than in any host.
+ *
+ * 1. `crossRegion` read as a safety ladder while meaning something else at the
+ *    top. `schemas/capabilities.schema.json` documented `strict` as
+ *    "cross-region read-visibility is bounded by
+ *    `multiRegion.replicationLagBoundMs`" — a LATENCY claim. A host can
+ *    replicate synchronously at 0 ms and still issue duplicate external effects
+ *    from two regions, because knowing what the other region wrote is not the
+ *    same as being authorized to act. `strict` therefore sat at the top of an
+ *    enum implementers read as an effect-safety claim while promising nothing
+ *    about effects. Its latency content already had its own field, so it is
+ *    removed rather than renamed: `fenced-effects` is a genuinely stronger
+ *    property, and promoting existing `strict` advertisements into it by rename
+ *    would assert evidence no host has produced.
+ *
+ * 2. `partitionRecoveryStrategy` offering rules the annex forbids.
+ *    `spec/v1/idempotency.md` §"Guarantees under partition" MUSTs lex-min(runId)
+ *    convergence, "deterministic without coordination", and the `multiRegion`
+ *    block MUSTs that "re-running the same conflict input MUST produce the same
+ *    survivor". Both `last-writer-wins` and `first-writer-wins` are time-ordered:
+ *    under a partition there is no shared clock, so both regions believe they
+ *    wrote last (or first), and neither can produce a reproducible survivor.
+ *    They also select a different survivor than the lex-min rule the same
+ *    document requires. The schema was advertising strategies that violate two
+ *    MUSTs already in force. RFC 0150 §D names only `last-writer-wins`; leaving
+ *    `first-writer-wins` would keep the identical defect under a different label.
+ *
+ * This gate reads the schema and the prose. It observes no host, and says
+ * nothing about whether any engine fences correctly — that is gap G10.
+ *
+ * `spec/v1/` ships in the repository and NOT in the published tarball, so the
+ * prose legs self-skip under the published layout; the schema ships in both.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join, resolve as pathResolve } from 'node:path';
+import { V1_DIR } from '../lib/paths.js';
+
+const SCHEMA_PATH =
+  V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'schemas', 'capabilities.schema.json');
+
+interface EnumLike {
+  readonly enum?: readonly string[];
+  readonly anyOf?: readonly EnumLike[];
+  readonly properties?: Record<string, EnumLike>;
+}
+
+function idempotencyCaps(): EnumLike | null {
+  if (SCHEMA_PATH === null) return null;
+  const schema = JSON.parse(readFileSync(SCHEMA_PATH, 'utf8')) as {
+    properties?: Record<string, EnumLike>;
+  };
+  return schema.properties?.['idempotency'] ?? null;
+}
+
+/** Every literal in an `enum`, including those nested under `anyOf`. */
+function literals(node: EnumLike | undefined): string[] {
+  if (node === undefined) return [];
+  return [...(node.enum ?? []), ...(node.anyOf ?? []).flatMap(literals)];
+}
+
+describe.skipIf(V1_DIR === null)('RFC 0150 §D — multi-region effect vocabulary', () => {
+  const idem = idempotencyCaps();
+  const doc = V1_DIR === null ? '' : readFileSync(join(V1_DIR as string, 'idempotency.md'), 'utf8');
+
+  it('the idempotency capability family is found at all', () => {
+    // Guard: a lookup that silently returned null would make every leg below
+    // vacuously true — the failure RFC 0148 exists to close.
+    expect(idem, 'capabilities.schema.json MUST declare an `idempotency` family').not.toBeNull();
+    expect(
+      literals(idem?.properties?.['crossRegion']).length,
+      'the `crossRegion` enum MUST be non-empty',
+    ).toBeGreaterThan(0);
+  });
+
+  it('crossRegion offers the three RFC 0150 §D postures', () => {
+    const values = literals(idem?.properties?.['crossRegion']);
+    expect(
+      [...values].sort(),
+      'RFC 0150 §D: the canonical postures are `single-region` (no cross-region guarantee), ' +
+        '`reconciled-records` (records converge, effects may remain at-least-once), and ' +
+        '`fenced-effects` (records converge AND every effect is fenced or provider-idempotent).',
+    ).toEqual(['fenced-effects', 'reconciled-records', 'single-region']);
+  });
+
+  it('crossRegion does not carry `strict`, which was a latency claim in a safety slot', () => {
+    const values = literals(idem?.properties?.['crossRegion']);
+    expect(
+      values.includes('strict'),
+      'RFC 0150 §D: `strict` promised bounded read-visibility, not effect authorization — a host ' +
+        'replicating at 0 ms can still issue duplicate effects from two regions. Its latency ' +
+        'content belongs to `multiRegion.replicationLagBoundMs`, which already carries it.',
+    ).toBe(false);
+  });
+
+  it('partitionRecoveryStrategy offers no time-ordered rule', () => {
+    const values = literals(idem?.properties?.['multiRegion']?.properties?.['partitionRecoveryStrategy']);
+    const timeOrdered = values.filter((v) => v === 'last-writer-wins' || v === 'first-writer-wins');
+    expect(
+      timeOrdered,
+      'RFC 0150 §D: under a partition there is no shared clock, so a time-ordered rule cannot ' +
+        'satisfy the annex MUST that "re-running the same conflict input MUST produce the same ' +
+        'survivor", and it selects a different survivor than the lex-min(runId) rule the same ' +
+        'document requires. Removing only `last-writer-wins` leaves the identical defect under ' +
+        `a different label. Found: ${timeOrdered.join(', ')}`,
+    ).toEqual([]);
+  });
+
+  it('partitionRecoveryStrategy names the rule the annex actually requires', () => {
+    const values = literals(idem?.properties?.['multiRegion']?.properties?.['partitionRecoveryStrategy']);
+    expect(
+      values,
+      'the annex MUSTs lex-min(runId) convergence, so that rule MUST be nameable in the ' +
+        'advertisement rather than reachable only through a vendor `x-host-*` extension.',
+    ).toContain('lexicographic-min-run-id');
+  });
+
+  it('the spec states that reconciliation does not authorize effects', () => {
+    const plain = doc.replace(/[`*_]/g, '').replace(/\s+/g, ' ');
+    expect(
+      /MUST NOT authorize effects/.test(plain),
+      'RFC 0150 §D: run-record reconciliation and permission to issue effects are separate. ' +
+        'Lexicographic run-ID reconciliation MAY select a surviving record but MUST NOT ' +
+        'authorize an external effect — the sentence the whole section rests on.',
+    ).toBe(true);
+  });
+
+  it('a host that can neither fence nor rely on provider dedup must say so', () => {
+    const plain = doc.replace(/[`*_]/g, '').replace(/\s+/g, ' ');
+    expect(
+      /at-least-once-risk/.test(plain),
+      'RFC 0150 §D: absent a fencing token or a provider guaranteeing duplicate suppression, a ' +
+        'host MUST NOT claim strict multi-region effect safety and MUST classify the effect as ' +
+        '`at-least-once-risk`. An unclassifiable risk is the one operators cannot plan around.',
+    ).toBe(true);
+  });
+
+  it('the capability advertisement example parses as JSON', () => {
+    // RFC 0149 §B found this and deliberately left it: the annex's example is
+    // fenced as ```json while containing `"single-region" | "best-effort" |
+    // "strict"`, which no parser accepts. An example that cannot parse is
+    // exactly what RFC 0150 §D's extraction requirement exists to catch.
+    const lines = doc.split('\n');
+    const blocks: { line: number; body: string }[] = [];
+    for (let i = 0; i < lines.length; i++) {
+      if (lines[i]!.trim() !== '```json') continue;
+      const body: string[] = [];
+      let j = i + 1;
+      while (j < lines.length && lines[j]!.trim() !== '```') body.push(lines[j++]!);
+      blocks.push({ line: i + 2, body: body.join('\n') });
+      i = j;
+    }
+    expect(blocks.length, 'idempotency.md MUST contain fenced json examples to check').toBeGreaterThan(0);
+    const unparseable = blocks
+      .filter((b) => {
+        try {
+          JSON.parse(b.body);
+          return false;
+        } catch {
+          return true;
+        }
+      })
+      .map((b) => `spec/v1/idempotency.md:${b.line}`);
+    expect(
+      unparseable,
+      'a block fenced as ```json MUST parse as JSON. Union-type notation belongs in prose or a ' +
+        '```text fence.\n  ' + unparseable.join('\n  '),
+    ).toEqual([]);
+  });
+});

package/src/scenarios/multi-region-idempotency.test.ts

@@ -3,8 +3,18 @@
  *
  * Verifies that hosts advertising the multi-region idempotency annex
  * surface a valid `capabilities.idempotency.crossRegion` value AND, when
- * claiming `'best-effort'` or `'strict'`, expose the operator-tier
- * metric names per `idempotency.md` §"Operator surface".
+ * claiming `'reconciled-records'` or `'fenced-effects'`, expose the
+ * operator-tier metric names per `idempotency.md` §"Operator surface".
+ *
+ * RFC 0150 §D revised the vocabulary. `best-effort` became
+ * `reconciled-records` — it always meant the RECORDS converge, and the old
+ * name invited hearing "a best effort at not duplicating effects". `strict`
+ * was removed rather than renamed: it promised only that read-visibility was
+ * bounded by `multiRegion.replicationLagBoundMs`, a LATENCY claim sitting at
+ * the top of a ladder implementers read as effect safety. `fenced-effects`
+ * takes that slot and means something different and stronger, so promoting
+ * old `strict` advertisements into it by rename would have asserted evidence
+ * no host produced.
  *
  * The annex's partition-replay convergence rule cannot be exercised
  * black-box (it requires multi-region host deployment under a real
@@ -22,7 +32,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
-const ALLOWED = new Set(['single-region', 'best-effort', 'strict']);
+const ALLOWED = new Set(['single-region', 'reconciled-records', 'fenced-effects']);
 const REQUIRED_METRICS_WHEN_MULTI_REGION = [
   'openwop.idempotency.cross_region_conflicts_total',
 ];
@@ -53,7 +63,7 @@ describe('multi-region-idempotency: capability shape', () => {
 
     expect(ALLOWED.has(idem.crossRegion), driver.describe(
       'idempotency.md §"Multi-region idempotency" §"Capability advertisement"',
-      'crossRegion MUST be one of {"single-region","best-effort","strict"}',
+      'crossRegion MUST be one of {"single-region","reconciled-records","fenced-effects"}',
     )).toBe(true);
 
     if (idem.layer1RetentionSeconds !== undefined) {
@@ -70,7 +80,7 @@ describe('multi-region-idempotency: capability shape', () => {
     const observability = capabilityFamily<ObservabilityCaps>(disco.json, 'observability');
     const crossRegion = idem?.crossRegion;
 
-    if (crossRegion !== 'best-effort' && crossRegion !== 'strict') {
+    if (crossRegion !== 'reconciled-records' && crossRegion !== 'fenced-effects') {
       // Single-region hosts have no conflicts to count — skip.
       return;
     }
@@ -130,13 +140,13 @@ describe('multi-region-idempotency: granular multiRegion advertisement shape (RF
       }
       if (mr.partitionRecoveryStrategy !== undefined) {
         const s = mr.partitionRecoveryStrategy as string;
-        const isCategorical = s === 'last-writer-wins' || s === 'first-writer-wins';
+        const isCategorical = s === 'lexicographic-min-run-id';
         const isExtension = /^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$/.test(s);
         expect(
           isCategorical || isExtension,
           driver.describe(
             'RFCS/0036-multi-region-and-cross-engine-guarantees.md §A',
-            'partitionRecoveryStrategy MUST be one of {last-writer-wins, first-writer-wins} OR match ^x-host-<host>-<key>$',
+            'partitionRecoveryStrategy MUST be `lexicographic-min-run-id` OR match ^x-host-<host>-<key>$ (RFC 0150 §D removed the time-ordered rules: with no shared clock under a partition, each region believes it wrote last, so neither can produce the reproducible survivor the annex requires)',
           ),
         ).toBe(true);
       }

package/src/scenarios/openapi-resolved-paths.test.ts

@@ -0,0 +1,127 @@
+/**
+ * RFC 0149 §A — canonical URL resolution.
+ *
+ * A generator resolves an operation's URL by joining a `servers[].url` with a
+ * path key. Both halves are individually valid here, and every existing
+ * validator checks them separately: `redocly lint` accepts the server, accepts
+ * the paths, and never composes the two. The defect only exists in the join.
+ *
+ * That is why this gate resolves the PAIR. `servers[].url` ending in `/v1`
+ * against path keys beginning with `/v1/` yields `/v1/v1/runs` — a route no
+ * host serves, emitted by every client generated from the canonical contract.
+ * The reference SDKs are the control: `OpenwopClient` issues `/v1/runs`
+ * against a bare base URL, so the SDKs and the OpenAPI document disagree about
+ * where the version segment lives, and the SDKs are the ones that work.
+ *
+ * Server-free and always-on: this is a property of the corpus, not of a host,
+ * so there is no capability to gate on and nothing to skip.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { API_DIR } from '../lib/paths.js';
+
+const OPENAPI_PATH = join(API_DIR, 'openapi.yaml');
+
+/**
+ * Top-level `servers[].url` values.
+ *
+ * Text-scanned rather than YAML-parsed to match the rest of the corpus gates
+ * (`spec-corpus-validity.test.ts` uses `readYamlHeader`), which keeps the
+ * conformance package free of a YAML dependency.
+ */
+function serverUrls(raw: string): string[] {
+  const urls: string[] = [];
+  let inServers = false;
+  for (const line of raw.split('\n')) {
+    if (/^servers:/.test(line)) {
+      inServers = true;
+      continue;
+    }
+    // Any other unindented, non-comment, non-blank line ends the block.
+    if (inServers && /^[^\s#]/.test(line)) break;
+    if (!inServers) continue;
+    const m = /^\s*-\s*url:\s*(\S+)\s*$/.exec(line);
+    if (m?.[1] !== undefined) urls.push(m[1]);
+  }
+  return urls;
+}
+
+/** Top-level path keys under `paths:` (two-space indented, starting with `/`). */
+function pathKeys(raw: string): string[] {
+  const keys: string[] = [];
+  let inPaths = false;
+  for (const line of raw.split('\n')) {
+    if (/^paths:/.test(line)) {
+      inPaths = true;
+      continue;
+    }
+    if (inPaths && /^[^\s#]/.test(line)) break;
+    if (!inPaths) continue;
+    const m = /^ {2}(\/\S*):\s*$/.exec(line);
+    if (m?.[1] !== undefined) keys.push(m[1]);
+  }
+  return keys;
+}
+
+/**
+ * The path portion of a resolved URL, with the `{host}` template left intact —
+ * `URL` cannot parse a templated authority, and substituting a placeholder
+ * host would test a string this corpus never emits.
+ */
+function resolvedPath(serverUrl: string, pathKey: string): string {
+  const afterScheme = serverUrl.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '');
+  const slash = afterScheme.indexOf('/');
+  const basePath = slash === -1 ? '' : afterScheme.slice(slash);
+  return `${basePath.replace(/\/$/, '')}${pathKey}`;
+}
+
+describe('RFC 0149 §A — every server/path pair resolves to exactly one /v1 segment', () => {
+  const raw = readFileSync(OPENAPI_PATH, 'utf8');
+  const servers = serverUrls(raw);
+  const paths = pathKeys(raw);
+
+  it('the document declares at least one server and one path', () => {
+    // Guards the gate itself: an extraction that silently found nothing would
+    // make every assertion below vacuously true — the exact failure mode
+    // RFC 0148 exists to prevent.
+    expect(servers.length, `${OPENAPI_PATH} MUST declare servers[]`).toBeGreaterThan(0);
+    expect(paths.length, `${OPENAPI_PATH} MUST declare paths`).toBeGreaterThan(0);
+  });
+
+  it('no versioned operation resolves to a duplicated /v1 prefix', () => {
+    const offenders: string[] = [];
+    for (const server of servers) {
+      for (const pathKey of paths) {
+        if (!pathKey.startsWith('/v1/') && pathKey !== '/v1') continue;
+        const resolved = resolvedPath(server, pathKey);
+        const segments = resolved.split('/').filter((s) => s === 'v1');
+        if (segments.length !== 1) offenders.push(`${server} + ${pathKey} -> ${resolved}`);
+      }
+    }
+    expect(
+      offenders,
+      'RFC 0149 §A: a versioned operation MUST resolve with exactly one `/v1` segment. ' +
+        'Offending server/path pairs:\n  ' +
+        offenders.join('\n  ') +
+        '\nFix: drop `/v1` from `servers[].url` and keep it in the path keys.',
+    ).toEqual([]);
+  });
+
+  it('the unversioned discovery route stays unversioned when resolved', () => {
+    // `/.well-known/openwop` is unversioned by RFC 0149 §A. A server base path
+    // would silently version it, which is the same class of defect pointing
+    // the other way.
+    const wellKnown = paths.filter((p) => p.startsWith('/.well-known/'));
+    for (const server of servers) {
+      for (const pathKey of wellKnown) {
+        const resolved = resolvedPath(server, pathKey);
+        expect(
+          resolved,
+          `RFC 0149 §A: ${pathKey} MUST remain unversioned; resolved as ${resolved}`,
+        ).toBe(pathKey);
+      }
+    }
+  });
+});

package/src/scenarios/protocol-version-grammar.test.ts

@@ -0,0 +1,119 @@
+/**
+ * RFC 0149 §C — `protocolVersion` is `<major>.<minor>`, and the corpus enforces it.
+ *
+ * The field was specified three incompatible ways at once. `capabilities.schema.json`
+ * constrained it to `minLength: 1` — so `"v1.0"`, `"1.0.0"`, `"01.0"`, and `"banana"` all
+ * validated. `profiles.ts` derived core-ness from `startsWith('1.')`, which admits
+ * `"1.0.0"` and `"1.banana"` while rejecting a legitimate future `"2.0"` for the right
+ * reason and `"1"` for the wrong one. Prose described it as semver while every example
+ * showed two components.
+ *
+ * The consequence is a negotiation the wire cannot decide. Version comparison needs an
+ * integer major as the hard compatibility boundary and an integer minor as the additive
+ * contract level. Neither can be extracted from a string the schema never constrained, so
+ * two hosts could advertise `"1.0"` and `"1.0.0"` and no consumer could tell whether it
+ * was looking at a patch convention, a typo, or a different protocol.
+ *
+ * RFC 0149 §C: ASCII `<major>.<minor>`, no leading zero except zero itself. Patch belongs
+ * to suite and SDK versions, not the spec version. This also closes gap V2 in
+ * `version-negotiation.md` §"Open spec gaps" — "concrete `protocolVersion` semver
+ * semantics" — which had sat open with owner `future`.
+ *
+ * Server-free. The schema ships in both the repository and the published tarball; the
+ * prose leg self-skips under the published layout.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join, resolve as pathResolve } from 'node:path';
+import { V1_DIR } from '../lib/paths.js';
+import { isCore } from '../lib/profiles.js';
+
+/** RFC 0149 §C. */
+const GRAMMAR = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+
+const SCHEMA_PATH =
+  V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'schemas', 'capabilities.schema.json');
+
+function protocolVersionSchema(): { pattern?: string } | null {
+  if (SCHEMA_PATH === null) return null;
+  const schema = JSON.parse(readFileSync(SCHEMA_PATH, 'utf8')) as {
+    properties?: Record<string, { pattern?: string }>;
+  };
+  return schema.properties?.['protocolVersion'] ?? null;
+}
+
+/** A discovery payload that is core-valid except for the version under test. */
+function payload(protocolVersion: unknown) {
+  return {
+    protocolVersion,
+    supportedEnvelopes: ['plan'],
+    schemaVersions: {},
+    limits: { clarificationRounds: 1, schemaRounds: 1, envelopesPerTurn: 1 },
+  };
+}
+
+const VALID = ['1.0', '1.12', '0.0', '2.0', '10.3'];
+const INVALID = ['1', '1.0.0', 'v1.0', '01.0', '1.', '.0', '1.0-rc1', '', ' 1.0', '1.0 '];
+
+describe.skipIf(V1_DIR === null)('RFC 0149 §C — protocolVersion grammar', () => {
+  it('the schema declares protocolVersion at all', () => {
+    // Guard: a lookup returning null would make the pattern leg vacuous.
+    expect(protocolVersionSchema(), 'capabilities.schema.json MUST declare `protocolVersion`').not.toBeNull();
+  });
+
+  it('the schema constrains protocolVersion by pattern, not merely by length', () => {
+    const node = protocolVersionSchema();
+    expect(
+      node?.pattern,
+      'RFC 0149 §C: `minLength: 1` admits `"v1.0"`, `"1.0.0"`, and `"banana"`. Compatibility ' +
+        'comparison needs an integer major and an integer minor, which cannot be extracted from ' +
+        'an unconstrained string.',
+    ).toBe(GRAMMAR.source);
+  });
+
+  it.each(VALID)('accepts %s', (v) => {
+    expect(GRAMMAR.test(v), `RFC 0149 §C: ${v} is a legal major.minor`).toBe(true);
+  });
+
+  it.each(INVALID)('rejects %s', (v) => {
+    expect(
+      GRAMMAR.test(v),
+      `RFC 0149 §C: ${JSON.stringify(v)} is not major.minor — patch belongs to suite and SDK ` +
+        'versions, and a leading zero is forbidden except for zero itself',
+    ).toBe(false);
+  });
+
+  it('core derivation applies the grammar rather than a prefix test', () => {
+    // `startsWith('1.')` admitted `1.0.0` and `1.banana` and rejected `1`. The
+    // predicate that decides whether a host is openwop-compatible at all must
+    // not be looser than the schema every host validates against.
+    expect(isCore(payload('1.0')), '`1.0` is core-valid').toBe(true);
+    for (const bad of ['1.0.0', '1.banana', '1', 'v1.0', '01.0']) {
+      expect(
+        isCore(payload(bad)),
+        `RFC 0149 §C: \`${bad}\` MUST NOT derive \`openwop-core\` — the predicate cannot be ` +
+          'more permissive than the grammar',
+      ).toBe(false);
+    }
+  });
+
+  it('a different major is not core; a higher minor is', () => {
+    // §C: consumers MUST reject a different unsupported major and MUST tolerate a
+    // higher minor under v1 additive rules. The predicate is the v1 suite's, so a
+    // v2 host is correctly not-core here — that is a major boundary, not a defect.
+    expect(isCore(payload('2.0')), 'a different major is outside this suite').toBe(false);
+    expect(isCore(payload('1.99')), 'a higher minor stays core under v1 additive rules').toBe(true);
+  });
+
+  it('the spec states the grammar normatively', () => {
+    // Searched raw: the grammar contains `*` and `_`-adjacent metacharacters, so
+    // the usual markdown-emphasis strip would eat its own quantifiers.
+    const doc = readFileSync(join(V1_DIR as string, 'version-negotiation.md'), 'utf8');
+    expect(
+      doc.includes(GRAMMAR.source),
+      'RFC 0149 §C: `version-negotiation.md` MUST carry the grammar, so the schema pattern has ' +
+        'a normative source rather than being the only place the rule exists.',
+    ).toBe(true);
+  });
+});