@openwop/openwop-conformance 1.72.2 → 1.98.0

package/src/scenarios/workload-identity-profile.test.ts

@@ -0,0 +1,175 @@
+/**
+ * RFC 0154 §A/§B — workload identity and delegation, shape only.
+ *
+ * **What this proves:** the schema admits the identity and delegation shapes §A
+ * and §B describe, and — more importantly — **rejects credential material**. It
+ * verifies no host. RFC 0147 §A.5 forbids `Accepted` on shape-only evidence for
+ * a behavioral requirement, and §A's actual requirements are behavioral:
+ * cryptographically verify the presented identity, bind it to the request,
+ * resolve it to a principal before authorization, and fail closed when
+ * unresolvable. A schema cannot demonstrate any of those.
+ *
+ * What a schema *can* do is make the dangerous shape unrepresentable, and that
+ * is what this checks. The governing rule is negative: **raw certificates,
+ * tokens, proofs, and credentials MUST NOT enter these objects.** `subject` is
+ * an opaque identifier; `proofRef` and `thumbprintRef` are digest *references*.
+ * A verified identity is a fact about a completed verification, not a container
+ * for the material that proved it — and these objects are projected into events,
+ * spans, and audit records, which is precisely where credential material must
+ * never reach.
+ *
+ * The second rule the schema encodes is **identity is not authorization**
+ * (RFC 0147 R12). Knowing which workload called says nothing about what it may
+ * do. That one cannot be schema-enforced at all, which is why `audience` is
+ * required on a delegation: an identity minted for somewhere else is the
+ * confused-deputy path, and the audience check is what closes it.
+ *
+ * Server-free.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join, resolve as pathResolve } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
+
+/**
+ * Schemas ship inside the package; RFC prose does not. The two need different
+ * treatment, and collapsing them onto one `ROOT` derived from `V1_DIR` is what
+ * broke this file in the published layout — `V1_DIR` is null there, and the
+ * `as string` cast carried the null straight into `join()`.
+ */
+const RFCS_DIR = V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'RFCS');
+
+function validator() {
+  const schema = JSON.parse(
+    readFileSync(join(SCHEMAS_DIR, 'workload-identity.schema.json'), 'utf8'),
+  ) as object;
+  const ajv = new Ajv2020({ strict: false, allErrors: true });
+  addFormats(ajv);
+  return ajv.compile(schema);
+}
+
+const DIGEST = `sha256:${'a'.repeat(64)}`;
+
+describe('RFC 0154 §A — workload identity shape', () => {
+  const validate = validator();
+
+  it('a verified identity validates', () => {
+    expect(
+      validate({ scheme: 'spiffe', subject: 'spiffe://example/dispatcher', issuer: 'spiffe://example', audience: 'openwop-host' }),
+      JSON.stringify(validate.errors),
+    ).toBe(true);
+  });
+
+  it('the object is closed — credential material cannot be smuggled in', () => {
+    // The governing rule, and the one a schema can actually enforce. These
+    // objects reach events, spans, and audit records; an open object is an
+    // invitation for a token to ride along into all three.
+    for (const extra of [
+      { certificate: '-----BEGIN CERTIFICATE-----' },
+      { token: 'eyJhbGciOiJIUzI1NiJ9.x.y' },
+      { privateKey: 'secret' },
+      { proof: 'raw-proof-bytes' },
+    ]) {
+      expect(
+        validate({ scheme: 'spiffe', subject: 'spiffe://example/x', ...extra }),
+        `RFC 0154 §A: raw credentials MUST NOT enter the identity object — rejected \`${Object.keys(extra)[0]}\``,
+      ).toBe(false);
+    }
+  });
+
+  it('the scheme is a closed enum', () => {
+    expect(
+      validate({ scheme: 'trust-me', subject: 'x' }),
+      'RFC 0154 §A: an unrecognized scheme is a verification path nobody implemented. Accepting ' +
+        'the NAME without the verification is exactly the failure this profile prevents.',
+    ).toBe(false);
+  });
+
+  it('subject is required and non-empty', () => {
+    expect(validate({ scheme: 'spiffe' })).toBe(false);
+    expect(validate({ scheme: 'spiffe', subject: '' })).toBe(false);
+  });
+
+  it('a key binding carries a digest reference, never a key', () => {
+    expect(validate({ scheme: 'mtls-san', subject: 'x', keyBinding: { method: 'mtls', thumbprintRef: DIGEST } })).toBe(true);
+    expect(
+      validate({ scheme: 'mtls-san', subject: 'x', keyBinding: { method: 'mtls', thumbprintRef: 'MIIBIjANBgkqh' } }),
+      'RFC 0154 §A: `thumbprintRef` is pattern-constrained to a sha256 digest so a raw key cannot ' +
+        'be pasted here and still validate.',
+    ).toBe(false);
+    expect(validate({ scheme: 'mtls-san', subject: 'x', keyBinding: { method: 'telepathy' } })).toBe(false);
+  });
+});
+
+describe('RFC 0154 §B — delegated actor chain', () => {
+  const validate = validator();
+  const base = { scheme: 'spiffe' as const, subject: 'spiffe://example/planner' };
+
+  it('a verified delegation validates', () => {
+    expect(
+      validate({
+        ...base,
+        delegation: {
+          chain: [{ subject: 'spiffe://example/dispatcher', issuer: 'spiffe://example' }],
+          audience: 'openwop-host',
+          expiresAt: '2026-08-13T16:00:00Z',
+          proofRef: DIGEST,
+        },
+      }),
+      JSON.stringify(validate.errors),
+    ).toBe(true);
+  });
+
+  it('audience is required on a delegation', () => {
+    // The confused-deputy guard (RFC 0147 R12). An identity minted for somewhere
+    // else, accepted here, is how a credential valid elsewhere becomes a
+    // credential valid here.
+    expect(
+      validate({ ...base, delegation: { chain: [{ subject: 'x' }] } }),
+      'RFC 0154 §B: a delegation without an audience cannot be checked against this host.',
+    ).toBe(false);
+  });
+
+  it('an empty chain is rejected', () => {
+    expect(
+      validate({ ...base, delegation: { chain: [], audience: 'openwop-host' } }),
+      'RFC 0154 §B: a delegation context with no chain claims a delegation nobody can inspect.',
+    ).toBe(false);
+  });
+
+  it('proofRef is a digest reference, not the proof', () => {
+    expect(
+      validate({ ...base, delegation: { chain: [{ subject: 'x' }], audience: 'h', proofRef: 'eyJhbGciOiJIUzI1NiJ9.a.b' } }),
+      'RFC 0154 §B: `proofRef` is a REFERENCE. A JWT pasted here would put the proof itself into ' +
+        'every event and span this object reaches.',
+    ).toBe(false);
+  });
+
+  it('a chain hop cannot carry extra fields', () => {
+    expect(validate({ ...base, delegation: { chain: [{ subject: 'x', token: 'y' }], audience: 'h' } })).toBe(false);
+  });
+});
+
+describe.skipIf(RFCS_DIR === null)('RFC 0154 — what this does NOT establish', () => {
+  it('the behavioral and external-audit items stay unticked and annotated', () => {
+    // §A's real requirements are behavioral — verify, bind, resolve, fail closed
+    // — and none is schema-checkable. §A.5 forbids `Accepted` on this evidence.
+    const rfc = readFileSync(
+      join(RFCS_DIR as string, '0154-workload-identity-delegation-telemetry-and-provenance.md'),
+      'utf8',
+    );
+    for (const needle of [
+      'Verification, fail-closed authorization, sender constraint, and negative chain tests pass.',
+      'External auditor reviews the identity and provenance implementation.',
+    ]) {
+      expect(
+        new RegExp(`- \\[ \\] ${needle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*\\(`).test(rfc),
+        `RFC 0154: "${needle}" MUST remain unticked and annotated — a schema cannot demonstrate ` +
+          'cryptographic verification, and no host implements this profile.',
+      ).toBe(true);
+    }
+  });
+});

package/vectors/semantic-request-digest-v2.json

@@ -0,0 +1,236 @@
+{
+  "$comment": [
+    "RFC 0150 §C — golden vectors for the semantic request digest v2.",
+    "",
+    "These are the NORMATIVE cross-language vectors. An SDK implementing the digest",
+    "MUST reproduce every `digest` below from its `input`. They exist because §C's",
+    "acceptance criterion is that TypeScript, Python, and Go agree — and three",
+    "independent readings of prose is exactly how they would fail to.",
+    "",
+    "Each vector pins one rule, and several come in pairs whose whole purpose is the",
+    "relationship between them: tools sorted vs reversed MUST match, message order",
+    "reversed MUST NOT, and the two Unicode forms MUST NOT — because JCS does not",
+    "apply NFC and a fallback that adds it silently breaks cross-host agreement.",
+    "",
+    "`canonical` is the exact JCS byte string hashed. It is included so a failing",
+    "implementation can diff the preimage rather than stare at two hashes."
+  ],
+  "recipe": "openwop-semantic-request-v2",
+  "spec": "spec/v1/replay.md §\"LLM cache-key recipe\"",
+  "rfc": "RFC 0150 §C",
+  "hash": "sha256, lowercase hex, over the JCS-canonical UTF-8 bytes of `canonical`",
+  "vectors": [
+    {
+      "id": "minimal",
+      "why": "The floor: provider, model, one message. Anything simpler is not a request.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "user",
+            "content": "hello"
+          }
+        ]
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"messages\":[{\"content\":\"hello\",\"role\":\"user\"}]}}",
+      "digest": "c92498949e9cc0e38bb2887e88e55b6936932e219b8344f0a7059b1de960073d"
+    },
+    {
+      "id": "stop-changes-digest",
+      "why": "v1 EXCLUDED `stop`. Two requests differing only here produce different text, so they must not share a digest.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "user",
+            "content": "hello"
+          }
+        ],
+        "stop": [
+          "END"
+        ]
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"messages\":[{\"content\":\"hello\",\"role\":\"user\"}],\"stop\":[\"END\"]}}",
+      "digest": "2103c61f7b0e1e05c6535e562f52335649beae49e266b8264e60bc93c169dd87"
+    },
+    {
+      "id": "seed-changes-digest",
+      "why": "v1 EXCLUDED `seed`. Its entire purpose is to change the output.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "user",
+            "content": "hello"
+          }
+        ],
+        "seed": 7
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"messages\":[{\"content\":\"hello\",\"role\":\"user\"}],\"seed\":7}}",
+      "digest": "fb942dce9de88688c89d048499f4a4e5a19427775da08d0d5a7ad709c10b42d0"
+    },
+    {
+      "id": "max-output-changes-digest",
+      "why": "v1 EXCLUDED the output bound. It decides whether the response is truncated.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "user",
+            "content": "hello"
+          }
+        ],
+        "maxOutputTokens": 256
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"maxOutputTokens\":256,\"messages\":[{\"content\":\"hello\",\"role\":\"user\"}]}}",
+      "digest": "96f74b752619868e3b7fad15f093c03b86b223974ea3e2b89a1831d22a4845ad"
+    },
+    {
+      "id": "tools-sorted-by-name",
+      "why": "Tool order is not semantic; the recipe sorts by name so two orderings agree.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "user",
+            "content": "hello"
+          }
+        ],
+        "tools": [
+          {
+            "name": "zeta",
+            "parameters": {}
+          },
+          {
+            "name": "alpha",
+            "parameters": {}
+          }
+        ]
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"messages\":[{\"content\":\"hello\",\"role\":\"user\"}],\"tools\":[{\"name\":\"alpha\",\"parameters\":{}},{\"name\":\"zeta\",\"parameters\":{}}]}}",
+      "digest": "afb590dd7bf6c78915852e15318fd4c9d6d6e0d473288283f413e5e425ba0cd6"
+    },
+    {
+      "id": "tools-reversed-same-digest",
+      "why": "Same tools, opposite input order. MUST equal the previous vector.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "user",
+            "content": "hello"
+          }
+        ],
+        "tools": [
+          {
+            "name": "alpha",
+            "parameters": {}
+          },
+          {
+            "name": "zeta",
+            "parameters": {}
+          }
+        ]
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"messages\":[{\"content\":\"hello\",\"role\":\"user\"}],\"tools\":[{\"name\":\"alpha\",\"parameters\":{}},{\"name\":\"zeta\",\"parameters\":{}}]}}",
+      "digest": "afb590dd7bf6c78915852e15318fd4c9d6d6e0d473288283f413e5e425ba0cd6"
+    },
+    {
+      "id": "message-order-is-semantic",
+      "why": "Message order IS semantic and MUST NOT be sorted — this must differ from a reordered twin.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "user",
+            "content": "a"
+          },
+          {
+            "role": "assistant",
+            "content": "b"
+          }
+        ]
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"messages\":[{\"content\":\"a\",\"role\":\"user\"},{\"content\":\"b\",\"role\":\"assistant\"}]}}",
+      "digest": "06eb9873af60fb5c98222161bafdaec8f13a0f59b7b2c62a608a82a09520a74a"
+    },
+    {
+      "id": "message-order-reversed",
+      "why": "The reordered twin. MUST differ from the previous vector.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "assistant",
+            "content": "b"
+          },
+          {
+            "role": "user",
+            "content": "a"
+          }
+        ]
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"messages\":[{\"content\":\"b\",\"role\":\"assistant\"},{\"content\":\"a\",\"role\":\"user\"}]}}",
+      "digest": "896b9d814f5d9fe5da72fa50e2d2ea9751d9e2b78da324729dcfbd3c8bb09109"
+    },
+    {
+      "id": "provider-options-carried",
+      "why": "Unknown provider options are namespaced and hashed, never dropped.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "user",
+            "content": "hello"
+          }
+        ],
+        "providerOptions": {
+          "vendor.anthropic.reasoningEffort": "high"
+        }
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"providerOptions\":{\"vendor.anthropic.reasoningEffort\":\"high\"},\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"messages\":[{\"content\":\"hello\",\"role\":\"user\"}]}}",
+      "digest": "fa34555d16eb6fedb2c587a4c4ac7e2cbeec8d0e8be0299b60910fe79c4055bf"
+    },
+    {
+      "id": "non-ascii-not-normalized",
+      "why": "JCS does not apply NFC. The decomposed form MUST NOT hash equal to the composed form.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "user",
+            "content": "é"
+          }
+        ]
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"messages\":[{\"content\":\"é\",\"role\":\"user\"}]}}",
+      "digest": "7365573baec75c4eeda16eed9d60a17aa18cd44871f652d7dd25e602941956e9"
+    },
+    {
+      "id": "non-ascii-composed",
+      "why": "The composed twin (U+00E9). MUST differ from the decomposed vector above.",
+      "input": {
+        "provider": "anthropic",
+        "model": "claude-x",
+        "messages": [
+          {
+            "role": "user",
+            "content": "é"
+          }
+        ]
+      },
+      "canonical": "{\"model\":\"claude-x\",\"provider\":\"anthropic\",\"recipe\":\"openwop-semantic-request-v2\",\"request\":{\"messages\":[{\"content\":\"é\",\"role\":\"user\"}]}}",
+      "digest": "a4a0d2077fa984fe50411e671a77ee4cdab81911cf6bffe33b4f680c696b01af"
+    }
+  ]
+}