@openwop/openwop-conformance 1.72.2 → 1.98.0

package/src/scenarios/spec-corpus-validity.test.ts

@@ -1576,16 +1576,30 @@ describe.skipIf(RFC0089_BUNDLE_PATH === null || !existsSync(RFC0089_BUNDLE_PATH)
     expect(ok, JSON.stringify(validate.errors)).toBe(true);
   });
 
-  it('verifyBundle ACCEPTS the committed reference bundle — every claimed profile re-derives + is floor-proven (§B)', () => {
+  it('verifyBundle REJECTS the committed reference bundle — it is `invalidated` (RFC 0148 §D)', () => {
+    // This assertion was inverted on 2026-08-12. It previously asserted the
+    // bundle was ACCEPTED, commented "the host honestly claims ONLY profiles its
+    // discovery document derives, none of which it fails a floor scenario for."
+    // That comment was false: the bundle claims `openwop-stream-sse` while all
+    // three `stream-modes*` scenarios sit in its own `results.failed`. The old
+    // assertion passed only because those profiles had no floor definition, so
+    // `floorProven` came out vacuously true — a test defending a claim the
+    // bundle's own failure list contradicts.
+    //
+    // The bundle is now marked `invalidated` in
+    // `docs/CERTIFICATION-BUNDLE-INVENTORY.md`; reissue requires bundle v2.
+    // Until then the correct expectation is rejection, and the reasons are
+    // asserted individually so a future reissue cannot turn this green for the
+    // wrong cause.
     const bundle = readJson(bundlePath) as Parameters<typeof verifyBundle>[0];
     const r = verifyBundle(bundle);
-    // The host honestly claims ONLY profiles its discovery document derives, none
-    // of which it fails a floor scenario for — so verifyBundle MUST accept it.
-    const offending = r.verdicts.filter((v) => !v.valid);
-    expect(
-      r.valid,
-      `verifyBundle rejected claimed profile(s): ${JSON.stringify(offending)}`,
-    ).toBe(true);
+    expect(r.valid, 'the committed v1 bundle is invalidated, not merely historical').toBe(false);
+
+    const sse = r.verdicts.find((v) => v.profile === 'openwop-stream-sse');
+    expect(sse?.floorProven, 'profiles.md §openwop-stream-sse: predicate AND those scenarios pass').toBe(false);
+    expect(sse?.missingFloor, 'its own results.failed lists the stream-modes scenarios').toContain(
+      'stream-modes.test.ts',
+    );
   });
 
   it('discovery.sha256 is the canonical-JSON SHA-256 of the captured discovery.document', () => {

package/src/scenarios/strict-behavior-gate.test.ts

@@ -0,0 +1,120 @@
+/**
+ * RFC 0148 §B — strict behavior, and the MUST NOT that was enforced by a warning.
+ *
+ * §B: "When a host advertises a capability, every required behavioral assertion
+ * for that capability MUST execute or fail. `OPENWOP_REQUIRE_BEHAVIOR=true` MUST
+ * fail on `blocked`, unclassified early return, or a missing seam unless the
+ * profile was explicitly opted out before discovery capture. **A host MUST NOT
+ * both advertise and opt out of the same profile.**"
+ *
+ * That last sentence was not enforced. `behaviorGate()` detected the
+ * contradiction, emitted `console.warn`, and proceeded as if advertised. A
+ * warning in a conformance run is not a check — nothing consumes it, nothing
+ * fails on it, and a certification bundle produced from that run records a pass.
+ *
+ * It matters because the two claims are opposite in kind. Advertising says *this
+ * host implements the profile*; opting out says *the operator declares it does
+ * not*. A run where both are true has no defensible reading, and the one the
+ * gate chose — advertisement wins — is the one that produces MORE certification
+ * claim from a MORE contradictory input.
+ *
+ * The second half wires §B to §A: a gate decision now records a ledger
+ * disposition, so "skipped because opted out" and "not exercised at all" stop
+ * being the same observable. Before the ledger there was nothing to record into,
+ * which is why §B could not be implemented before §A.
+ *
+ * Server-free. Manipulates process env, so it restores it per-test.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { dispositionOf, resetLedger } from '../lib/requirement-ledger.js';
+import { __resetEnvCacheForTests } from '../lib/env.js';
+
+const ENV_KEYS = ['OPENWOP_REQUIRE_BEHAVIOR', 'OPENWOP_OPTED_OUT_PROFILES', 'OPENWOP_BASE_URL', 'OPENWOP_API_KEY'] as const;
+let saved: Record<string, string | undefined> = {};
+
+beforeEach(() => {
+  resetLedger();
+  saved = {};
+  for (const k of ENV_KEYS) {
+    saved[k] = process.env[k];
+    delete process.env[k];
+  }
+  // `loadEnv()` requires a base URL AND an api key even on paths that reach no
+  // host, and it caches — so both are stubbed and the cache dropped per test.
+  process.env['OPENWOP_BASE_URL'] = 'https://conformance.invalid';
+  process.env['OPENWOP_API_KEY'] = 'dummy-not-used-no-request-is-made';
+  __resetEnvCacheForTests();
+});
+
+afterEach(() => {
+  for (const k of ENV_KEYS) {
+    if (saved[k] === undefined) delete process.env[k];
+    else process.env[k] = saved[k];
+  }
+  __resetEnvCacheForTests();
+});
+
+describe('RFC 0148 §B — advertise and opt-out are mutually exclusive', () => {
+  it('advertising AND opting out of the same profile fails', () => {
+    // The defect: this was a `console.warn` that then proceeded as advertised.
+    // A MUST NOT enforced by a warning is not enforced — nothing consumes the
+    // warning, and the bundle produced from that run records a pass.
+    process.env['OPENWOP_OPTED_OUT_PROFILES'] = 'openwop-audit-log-integrity';
+    __resetEnvCacheForTests();
+    expect(
+      () => behaviorGate('openwop-audit-log-integrity', true),
+      'RFC 0148 §B: "A host MUST NOT both advertise and opt out of the same profile." ' +
+        'The two claims are opposite in kind — one says the host implements the profile, the ' +
+        'other says the operator declares it does not. A run where both hold has no defensible ' +
+        'reading, and resolving it in favour of advertisement extracts MORE certification claim ' +
+        'from a MORE contradictory input.',
+    ).toThrow(/MUST NOT both advertise and opt out/);
+  });
+
+  it('advertising alone proceeds', () => {
+    expect(behaviorGate('openwop-audit-log-integrity', true)).toBe(true);
+  });
+
+  it('opting out alone skips, in strict mode too', () => {
+    process.env['OPENWOP_OPTED_OUT_PROFILES'] = 'openwop-audit-log-integrity';
+    __resetEnvCacheForTests();
+    process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
+    __resetEnvCacheForTests();
+    expect(behaviorGate('openwop-audit-log-integrity', false)).toBe(false);
+  });
+
+  it('strict mode fails an unadvertised, non-opted-out profile', () => {
+    process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
+    __resetEnvCacheForTests();
+    expect(() => behaviorGate('openwop-audit-log-integrity', false)).toThrow();
+  });
+});
+
+describe('RFC 0148 §B — gate decisions record a ledger disposition', () => {
+  it('an honest opt-out records `skipped`, not silence', () => {
+    // §A resolves an unrecorded requirement to `blocked`. Without this wiring an
+    // opted-out profile and a never-run profile are the same observable, which
+    // is the distinction §B exists to make.
+    process.env['OPENWOP_OPTED_OUT_PROFILES'] = 'openwop-audit-log-integrity';
+    __resetEnvCacheForTests();
+    behaviorGate('openwop-audit-log-integrity', false);
+    expect(dispositionOf('openwop.profile.openwop-audit-log-integrity')).toBe('skipped');
+  });
+
+  it('a default-mode soft-skip records `inapplicable`', () => {
+    // The host does not advertise it and the operator made no declaration, so
+    // the requirement does not apply to this discovery set. That is a different
+    // statement from "we could not check", and it is certifiable where
+    // `blocked` is not.
+    behaviorGate('openwop-audit-log-integrity', false);
+    expect(dispositionOf('openwop.profile.openwop-audit-log-integrity')).toBe('inapplicable');
+  });
+
+  it('an unexercised profile stays `blocked`', () => {
+    // Nothing called the gate at all. §A's default holds: silence is not a pass,
+    // and it is not certifiable either.
+    expect(dispositionOf('openwop.profile.openwop-never-touched')).toBe('blocked');
+  });
+});

package/src/scenarios/versioned-composition-profiles.test.ts

@@ -0,0 +1,183 @@
+/**
+ * RFC 0152 + RFC 0153 — versioned A2A and MCP composition, shape only.
+ *
+ * **Stated first, because RFC 0147 §A.5 turns on it:** this file proves the
+ * discovery schema admits the versioned shapes §A describes and rejects the ones
+ * it forbids. It contacts no peer. It is therefore **not** evidence that this
+ * host interoperates with any A2A 1.0 or MCP 2026-07-28 implementation, and
+ * neither RFC can reach a defensible `Accepted` on it. Both additionally require
+ * a real upstream peer in CI, which is not a corpus deliverable.
+ *
+ * The defect both RFCs address is the same, which is why they land together:
+ * **`supported: true` with no version is a claim a peer cannot negotiate
+ * against.** It asserts the host speaks *some* A2A or *some* MCP. Two hosts can
+ * both advertise it, share no revision, and discover that only when a call
+ * fails — and the failure surfaces at the peer, not at the handshake that was
+ * supposed to prevent it. Versioning the advertisement moves the disagreement to
+ * the one place both sides are looking.
+ *
+ * Two shape choices worth keeping:
+ *
+ *   - **MCP versions are date-patterned, not free strings.** MCP revisions *are*
+ *     dates. Accepting `latest` or `2026-7-28` would let two hosts disagree
+ *     about which revision they share while both validate.
+ *   - **The MCP feature list is closed.** An unrecognized feature name is
+ *     indistinguishable from a typo, and a peer that silently ignores one has
+ *     negotiated a capability neither side implements.
+ *
+ * Server-free.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join, resolve as pathResolve } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import { SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
+
+/**
+ * Schemas ship inside the package; RFC prose does not. Deriving both from
+ * `V1_DIR` — null in the published tarball — and casting the null away with
+ * `as string` is what took this file down at import when installed from npm.
+ */
+const RFCS_DIR = V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'RFCS');
+
+function caps(): Record<string, unknown> {
+  return JSON.parse(
+    readFileSync(join(SCHEMAS_DIR, 'capabilities.schema.json'), 'utf8'),
+  ) as Record<string, unknown>;
+}
+
+/** Compile one capability family in isolation. */
+function familyValidator(family: string) {
+  const schema = caps() as { properties: Record<string, object> };
+  const ajv = new Ajv2020({ strict: false, allErrors: true });
+  return ajv.compile(schema.properties[family] as object);
+}
+
+describe('RFC 0152 §A — A2A versioned discovery', () => {
+  const validate = familyValidator('a2a');
+
+  /**
+   * The `a2a` family independently requires `agentCardUrl` (RFC 0100: it must
+   * GET-resolve credential-less). Every fixture below carries it.
+   *
+   * This is not tidiness. Without it the NEGATIVE legs would have failed
+   * validation for the missing card URL rather than for the version defect they
+   * name — passing for the wrong reason, which is the vacuity this whole
+   * program exists to close, committed inside a test written to prevent it.
+   */
+  const a2a = (over: Record<string, unknown>) => ({
+    supported: true,
+    agentCardUrl: 'https://host.example/.well-known/agent-card.json',
+    ...over,
+  });
+
+  it('a versioned advertisement validates', () => {
+    expect(
+      validate(a2a({
+        protocolVersions: ['1.0', '0.3'],
+        preferredVersion: '1.0',
+        profiles: ['a2a-1.0', 'a2a-0.3-legacy'],
+        durableTasks: true,
+      })),
+      JSON.stringify(validate.errors),
+    ).toBe(true);
+  });
+
+  it('a legacy-only host can say so explicitly', () => {
+    // The point of naming the legacy profile: a deprecation you can see is one
+    // you can time-bound. A bare `supported: true` hides the same fact.
+    expect(
+      validate(a2a({ protocolVersions: ['0.3'], preferredVersion: '0.3', profiles: ['a2a-0.3-legacy'] })),
+      JSON.stringify(validate.errors),
+    ).toBe(true);
+  });
+
+  it('an empty version list is rejected', () => {
+    expect(
+      validate(a2a({ protocolVersions: [] })),
+      'RFC 0152 §A: an A2A-capable host MUST advertise a NON-EMPTY `protocolVersions`. An empty ' +
+        'array is the bare `supported: true` problem wearing a schema — it validates and tells a ' +
+        'peer nothing it can negotiate against.',
+    ).toBe(false);
+  });
+
+  it('duplicate versions are rejected', () => {
+    expect(validate(a2a({ protocolVersions: ['1.0', '1.0'] }))).toBe(false);
+  });
+
+  it('a malformed version is rejected', () => {
+    for (const v of ['1', 'v1.0', 'latest', '1.0.0']) {
+      expect(
+        validate(a2a({ protocolVersions: [v] })),
+        `RFC 0152 §A: '${v}' is not an A2A major.minor version`,
+      ).toBe(false);
+    }
+  });
+
+  it('a malformed profile id is rejected', () => {
+    expect(validate(a2a({ protocolVersions: ['1.0'], profiles: ['a2a-latest'] }))).toBe(false);
+    expect(validate(a2a({ protocolVersions: ['1.0'], profiles: ['a2a-1.0'] }))).toBe(true);
+  });
+});
+
+describe('RFC 0153 §A — MCP versioned discovery', () => {
+  const validate = familyValidator('mcp');
+
+  it('a versioned advertisement validates', () => {
+    expect(
+      validate({
+        supported: true,
+        protocolVersions: ['2026-07-28', '2025-06-18'],
+        preferredVersion: '2026-07-28',
+        profiles: ['mcp-2026-07-28', 'mcp-2025-06-18-legacy'],
+        features: ['server-discover', 'mrtr', 'cacheable-lists', 'extensions'],
+      }),
+      JSON.stringify(validate.errors),
+    ).toBe(true);
+  });
+
+  it('versions use MCP date form exactly', () => {
+    // MCP revisions ARE dates. `latest` or a non-padded month would let two
+    // hosts disagree about which revision they share while both validate.
+    for (const v of ['latest', '2026-7-28', '2026-07', 'v2026-07-28']) {
+      expect(
+        validate({ supported: true, protocolVersions: [v] }),
+        `RFC 0153 §A: '${v}' is not MCP's date form`,
+      ).toBe(false);
+    }
+    expect(validate({ supported: true, protocolVersions: ['2026-07-28'] })).toBe(true);
+  });
+
+  it('the feature list is closed', () => {
+    expect(
+      validate({ supported: true, protocolVersions: ['2026-07-28'], features: ['server-discover', 'telepathy'] }),
+      'RFC 0153 §A: an unrecognized feature name is indistinguishable from a typo, and a peer ' +
+        'that silently ignores one has negotiated a capability neither side implements.',
+    ).toBe(false);
+  });
+
+  it('an empty version list is rejected', () => {
+    expect(validate({ supported: true, protocolVersions: [] })).toBe(false);
+  });
+});
+
+describe.skipIf(RFCS_DIR === null)('RFC 0152 + 0153 — what these do NOT establish', () => {
+  it('both RFCs keep their upstream-peer acceptance items unticked and annotated', () => {
+    // RFC 0147 §A.5 forbids `Accepted` on shape-only evidence for a behavioral
+    // requirement. Schema validity is not interop: nothing here speaks to a
+    // peer, and both RFCs require a real upstream implementation in CI. This
+    // leg exists so the suite cannot read as more than it is.
+    for (const [file, needle] of [
+      ['0152-a2a-1-0-versioned-composition.md', 'Real upstream A2A 1.0 peer passes in CI.'],
+      ['0153-mcp-2026-07-28-versioned-composition.md', 'Pinned real MCP current peer passes in CI.'],
+    ] as const) {
+      const rfc = readFileSync(join(RFCS_DIR as string, file), 'utf8');
+      expect(
+        new RegExp(`- \\[ \\] ${needle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*\\(`).test(rfc),
+        `${file}: the upstream-peer item MUST remain unticked and annotated — no peer is contacted ` +
+          'anywhere in this corpus, and interop is the one thing a schema cannot demonstrate.',
+      ).toBe(true);
+    }
+  });
+});

package/src/scenarios/workload-identity-behavior.test.ts

@@ -0,0 +1,188 @@
+/**
+ * RFC 0154 §A/§B — the workload-identity BEHAVIORAL witness.
+ *
+ * §A's requirements are behavioral and, from the wire alone, **invisible**: a
+ * host must cryptographically verify the presented identity, bind it to the
+ * request, resolve it to an OpenWOP principal *before* authorization, and fail
+ * closed when it cannot. A normal request either succeeds or 401s, and **both
+ * outcomes look identical whether the host verified anything or simply trusted
+ * a header.**
+ *
+ * That invisibility is why `host-sample-test-seams.md` §20 exists, and why this
+ * file reports a missing seam as `blocked` rather than skipping quietly. RFC
+ * 0148 §A resolves an unobservable requirement to `blocked`, never to a pass —
+ * so without the seam, RFC 0154 cannot be certified at all. That is the honest
+ * position, and stating it is the point.
+ *
+ * **The negative cases carry the weight here.** A host that echoes its input can
+ * satisfy every positive assertion; only the rejections distinguish a verifier
+ * from a passthrough. So each negative names the specific confusion it rules
+ * out:
+ *
+ *   - **audience mismatch** — an identity minted for another host, accepted
+ *     here, is how a credential valid elsewhere becomes valid here;
+ *   - **expired delegation** — a delegation without a live expiry is a standing
+ *     grant, which is not what delegation means;
+ *   - **missing sender constraint** — without proof-of-possession a bearer
+ *     credential is replayable by anyone who observed it, so the host would be
+ *     asserting *who called* rather than *that the caller held the key*.
+ *
+ * And the framing that no assertion can enforce, stated because it governs how
+ * a `200` here should be read: **identity is not authorization** (RFC 0147 R12).
+ * A resolution means the identity resolved. It never means the caller may act.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+
+const PROFILE = 'openwop-workload-identity';
+/**
+ * §B gates on its OWN flag, not on §A's.
+ *
+ * The first draft of this file gated every leg on `workloadIdentity.supported`,
+ * which meant a host that verifies workload identity but does NOT implement
+ * delegation had two options: advertise and hard-fail the §B legs under strict
+ * mode, or advertise nothing and get no witness for the §A behavior it does
+ * have. That is the overclaim-or-silence bind RFC 0155 §A names for
+ * `openwop-core`, reproduced one capability down.
+ *
+ * A tier-1 host caught it by asking whether the scenarios gate per-section or
+ * all-on-`supported`. They gate per-section now. §A-only is an honest,
+ * witnessable posture.
+ */
+const DELEGATION_PROFILE = 'openwop-workload-identity-delegation';
+const SEAM = '/v1/host/sample/test/workload-identity/resolve';
+
+interface AuthCaps {
+  readonly workloadIdentity?: {
+    readonly supported?: boolean;
+    readonly schemes?: readonly string[];
+    readonly senderConstraint?: readonly string[];
+    readonly delegation?: { readonly supported?: boolean; readonly maxChainDepth?: number };
+  };
+}
+
+async function caps(): Promise<AuthCaps['workloadIdentity']> {
+  const disco = await driver.get('/.well-known/openwop');
+  return capabilityFamily<AuthCaps>(disco.json, 'auth')?.workloadIdentity;
+}
+
+/** A seam response, or `null` when the seam is absent. */
+async function resolve(body: Record<string, unknown>): Promise<{ status: number; json: unknown } | null> {
+  const r = await driver.post(SEAM, body);
+  return r.status === 404 || r.status === 403 ? null : { status: r.status, json: r.json };
+}
+
+function reasonOf(json: unknown): string | undefined {
+  return (json as { error?: { code?: string } })?.error?.code;
+}
+
+const IDENTITY = { scheme: 'spiffe', subject: 'spiffe://example/dispatcher', issuer: 'spiffe://example' };
+
+describe('RFC 0154 §A — workload identity resolution (capability-gated behavior)', () => {
+  it('the seam is wired, or the requirement is blocked rather than skipped', async () => {
+    if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
+    const r = await resolve({ identity: { ...IDENTITY, audience: 'openwop-host' } });
+    expect(
+      r,
+      driver.describe(
+        'spec/v1/host-sample-test-seams.md §20',
+        'a host advertising `auth.workloadIdentity` MUST expose the resolution seam. §A\'s ' +
+          'requirements — verify, bind, resolve-before-authorize, fail closed — are invisible from ' +
+          'a normal request, where success and 401 look identical whether the host verified ' +
+          'anything or trusted a header. RFC 0148 §A resolves an unobservable requirement to ' +
+          '`blocked`, so without this seam RFC 0154 cannot be certified at all.',
+      ),
+    ).not.toBeNull();
+  });
+
+  it('a verified identity resolves to a principal', async () => {
+    if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
+    const r = await resolve({ identity: { ...IDENTITY, audience: 'openwop-host' } });
+    if (r === null) return;
+    expect(r.status, driver.describe('RFCS/0154 §A', 'a verified identity resolves')).toBe(200);
+    const principalId = (r.json as { principalId?: string }).principalId;
+    expect(principalId, driver.describe('RFCS/0154 §A', 'resolution yields an OpenWOP principal')).toBeTruthy();
+  });
+
+  it('an identity for another audience is rejected', async () => {
+    if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
+    const r = await resolve({ identity: { ...IDENTITY, audience: 'some-other-host' }, expectedAudience: 'openwop-host' });
+    if (r === null) return;
+    // The load-bearing negative. A host that echoes its input passes every
+    // positive assertion; only this distinguishes a verifier from a passthrough.
+    expect(
+      r.status >= 400,
+      driver.describe(
+        'RFCS/0154 §A + RFC 0147 R12',
+        'an identity minted for another host, accepted here, is how a credential valid elsewhere ' +
+          'becomes a credential valid here — the confused-deputy path this profile prevents',
+      ),
+    ).toBe(true);
+    expect(reasonOf(r.json)).toBe('audience_mismatch');
+  });
+
+  it('an expired delegation is rejected', async () => {
+    // §B, gated on §B's own flag. A host doing §A-only identity resolution is
+    // not failing this requirement — it has not claimed it.
+    if (!behaviorGate(DELEGATION_PROFILE, (await caps())?.delegation?.supported === true)) return;
+    const r = await resolve({
+      identity: {
+        ...IDENTITY,
+        audience: 'openwop-host',
+        delegation: {
+          chain: [{ subject: 'spiffe://example/dispatcher' }],
+          audience: 'openwop-host',
+          expiresAt: '2020-01-01T00:00:00Z',
+        },
+      },
+    });
+    if (r === null) return;
+    expect(
+      r.status >= 400,
+      driver.describe(
+        'RFCS/0154 §B',
+        'a delegation without a live expiry is a standing grant, which is not what delegation means',
+      ),
+    ).toBe(true);
+    expect(reasonOf(r.json)).toBe('delegation_expired');
+  });
+
+  it('a failure is non-retriable and carries a closed reason code', async () => {
+    if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
+    const r = await resolve({ identity: { scheme: 'spiffe', subject: 'spiffe://example/unknown' } });
+    if (r === null || r.status < 400) return;
+    const err = (r.json as { error?: { code?: string; retriable?: boolean } }).error;
+    expect(
+      err?.retriable,
+      driver.describe(
+        'spec/v1/host-sample-test-seams.md §20',
+        'an identity that does not resolve will not resolve on retry. Marking it retriable invites ' +
+          'a caller to hammer a failing authorization path.',
+      ),
+    ).toBe(false);
+    expect(
+      ['identity_unverified', 'identity_unresolvable', 'audience_mismatch', 'delegation_expired', 'sender_constraint_missing'],
+      driver.describe('RFCS/0154 §A', 'failures use a closed reason vocabulary'),
+    ).toContain(err?.code);
+  });
+
+  it('a resolution response carries no credential material', async () => {
+    if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
+    const r = await resolve({ identity: { ...IDENTITY, audience: 'openwop-host' } });
+    if (r === null) return;
+    const serialized = JSON.stringify(r.json ?? {});
+    for (const forbidden of ['-----BEGIN', 'Bearer ', 'eyJ']) {
+      expect(
+        serialized.includes(forbidden),
+        driver.describe(
+          'RFCS/0154 §A',
+          'a verified identity is a fact about a completed verification, not a container for the ' +
+            `material that proved it. Found: ${forbidden}`,
+        ),
+      ).toBe(false);
+    }
+  });
+});