@openwop/openwop-conformance 1.72.2 → 1.98.0

package/schemas/workload-identity.schema.json

@@ -0,0 +1,73 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/workload-identity.schema.json",
+  "title": "OpenWOP workload identity and delegated actor chain (RFC 0154)",
+  "description": "RFC 0154 §A/§B. An authenticated workload identity, and the delegation context a request may carry.\n\nThe governing rule is negative and it is why every object here is closed: raw certificates, tokens, proofs, and credentials MUST NOT enter these objects. `subject` is an OPAQUE identifier and `proofRef` is a REFERENCE. A verified identity is a fact about a completed verification, not a container for the material that proved it — and these objects are projected into events, spans, and audit records, which is exactly where credential material must never reach (`SECURITY/threat-model-secret-leakage.md`).\n\nThe second rule is that identity is not authorization (RFC 0147 R12). Knowing which workload called says nothing about what it may do; tenant, audience, and policy are re-evaluated at every boundary.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["scheme", "subject"],
+  "properties": {
+    "scheme": {
+      "enum": ["spiffe", "mtls-san", "cloud-subject", "oauth-client"],
+      "description": "How the identity was presented and verified. Closed: an unrecognized scheme is a verification path nobody implemented."
+    },
+    "subject": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Opaque verified identifier, e.g. a SPIFFE ID. MUST NOT be a credential, token, or certificate."
+    },
+    "issuer": { "type": "string", "minLength": 1 },
+    "audience": {
+      "type": "string",
+      "minLength": 1,
+      "description": "RFC 0154 §A — the audience the presented identity was minted for. A host MUST reject an identity whose audience is not its own: accepting one is how a credential valid elsewhere becomes a credential valid here."
+    },
+    "keyBinding": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Proof-of-possession binding. Carries the METHOD and a thumbprint reference, never the key.",
+      "required": ["method"],
+      "properties": {
+        "method": { "enum": ["mtls", "dpop"] },
+        "thumbprintRef": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$",
+          "description": "Digest reference to the bound key. Pattern-constrained so a raw key cannot be pasted here and still validate."
+        }
+      }
+    },
+    "delegation": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "RFC 0154 §B — the verified delegation chain, if any.",
+      "required": ["chain", "audience"],
+      "properties": {
+        "chain": {
+          "type": "array",
+          "minItems": 1,
+          "description": "Ordered delegation hops. Non-empty: a delegation context with no chain claims a delegation nobody can inspect.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["subject"],
+            "properties": {
+              "subject": { "type": "string", "minLength": 1 },
+              "issuer": { "type": "string", "minLength": 1 }
+            }
+          }
+        },
+        "audience": { "type": "string", "minLength": 1 },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "RFC 0154 §B — a delegation without an expiry is a standing grant, which is not what delegation means."
+        },
+        "proofRef": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$",
+          "description": "Digest REFERENCE to the verified proof. Never the proof itself."
+        }
+      }
+    }
+  }
+}

package/src/cli.ts

@@ -50,6 +50,7 @@ interface ParsedArgs {
   readonly implVersion: string | undefined;
   /** RFC 0089 — emit a conformance certification bundle to this path. */
   readonly certify: string | undefined;
+  readonly bundleVersion: '1' | '2';
 }
 
 function parseArgs(argv: readonly string[]): ParsedArgs {
@@ -61,6 +62,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
   let impl: string | undefined;
   let implVersion: string | undefined;
   let certify: string | undefined;
+  let bundleVersion: '1' | '2' = '1';
 
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i] ?? '';
@@ -103,6 +105,15 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
       case '--implementation-version':
         implVersion = nextValue();
         break;
+      case '--bundle-version': {
+        const v = nextValue();
+        if (v !== '1' && v !== '2') {
+          process.stderr.write(`--bundle-version must be 1 or 2 (got '${v}')\n`);
+          process.exit(2);
+        }
+        bundleVersion = v;
+        break;
+      }
       case '--certify':
         certify = nextValue();
         break;
@@ -113,7 +124,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
     }
   }
 
-  return { baseUrl, apiKey, offline, filter, help, impl, implVersion, certify };
+  return { baseUrl, apiKey, offline, filter, help, impl, implVersion, certify, bundleVersion };
 }
 
 const HELP_TEXT = `openwop-conformance — run the openwop conformance suite against a server
@@ -134,6 +145,10 @@ Implementation labels (cosmetic — surface in failure messages):
   --impl-version <version>  Implementation version     (env: OPENWOP_IMPLEMENTATION_VERSION)
 
 Certification (RFC 0089):
+  --bundle-version <1|2>  Certification bundle format. Default 1. Version 2 (RFC 0148
+                        §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
+                        file lists, so "we could not check" stops being indistinguishable
+                        from "checked and it holds". See the note it prints.
   --certify <out.json>  Generate a machine-readable conformance certification
                         bundle: fetch /.well-known/openwop (captured verbatim +
                         SHA-256), derive claimedProfiles from it, run the suite
@@ -348,6 +363,109 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     },
   };
 
+  // (d2) RFC 0148 §C — bundle v2.
+  //
+  // v1's `{passed, failed, skipped}` file lists cannot express the distinction
+  // this program exists for. A file counted as `passed` whether its assertions
+  // ran or its runner returned early, and `skipped` flattened three different
+  // claims — operator-excluded, not-applicable, and could-not-check — of which
+  // only the first two are certifiable.
+  //
+  // THE HONEST LIMIT, stated because it changes what a v2 bundle from this
+  // runner means: the runner reads vitest's per-FILE outcome. It does not read
+  // the RFC 0148 §A requirement ledger, because scenarios do not yet record
+  // into it. So a skipped file cannot be split into `skipped` /`inapplicable` /
+  // `blocked` here, and §A's rule is that an unclassifiable requirement resolves
+  // to `blocked` — never to a pass. That is what this emits.
+  //
+  // The consequence is deliberate and correct: a v2 bundle produced today shows
+  // a large `blocked` count and therefore does NOT certify. That is not a defect
+  // in the emitter. It is the true state of the evidence, which v1 was unable to
+  // represent and therefore reported as a clean skip.
+  if (args.bundleVersion === '2') {
+    const scenarioIds = [...passed, ...failed, ...skipped].sort();
+    const manifestSha = createHash('sha256').update(scenarioIds.join('\n'), 'utf8').digest('hex');
+    // Configuration identity per RFC 0147 §A.4: what the run was pointed at, and
+    // the discovery it saw. Two runs against differently-configured hosts are
+    // different evidence, and this is what says so.
+    const configSha = createHash('sha256')
+      .update(`${args.baseUrl}\n${sha256}\n${process.env['OPENWOP_REQUIRE_BEHAVIOR'] ?? ''}`, 'utf8')
+      .digest('hex');
+
+    const requirements = [
+      ...passed.map((f) => ({
+        requirementId: `openwop.scenario.${f.replace(/\.test\.ts$/, '')}`,
+        scenarioId: f,
+        disposition: 'executed-pass' as const,
+      })),
+      ...failed.map((f) => ({
+        requirementId: `openwop.scenario.${f.replace(/\.test\.ts$/, '')}`,
+        scenarioId: f,
+        disposition: 'executed-fail' as const,
+        detail: 'the scenario executed and failed',
+      })),
+      ...skipped.map((f) => ({
+        requirementId: `openwop.scenario.${f.replace(/\.test\.ts$/, '')}`,
+        scenarioId: f,
+        disposition: 'blocked' as const,
+        detail:
+          'runner cannot classify a skipped file: the RFC 0148 §A requirement ledger is not ' +
+          'populated during a run, so skipped/inapplicable/blocked are indistinguishable here. ' +
+          '§A resolves an unclassifiable requirement to `blocked`, never to a pass.',
+      })),
+    ];
+
+    const v2 = {
+      bundleVersion: '2' as const,
+      generatedAt: new Date().toISOString(),
+      generator: { name: '@openwop/openwop-conformance --certify', version },
+      suite: { package: '@openwop/openwop-conformance' as const, version },
+      host,
+      discovery: { url: discoveryUrl, sha256, document },
+      claimedProfiles,
+      results: {
+        totals: {
+          executedPass: passed.length,
+          executedFail: failed.length,
+          skipped: 0,
+          inapplicable: 0,
+          blocked: skipped.length,
+        },
+        requirements,
+      },
+      scenarioManifestSha256: manifestSha,
+      targetConfigurationSha256: configSha,
+    };
+
+    const v2Schema = JSON.parse(
+      readFileSync(join(SCHEMAS_DIR, 'certification-bundle-v2.schema.json'), 'utf8'),
+    ) as Record<string, unknown>;
+    const v2Ajv = new Ajv2020({ allErrors: true, strict: false });
+    addFormats(v2Ajv);
+    const v2Validate = v2Ajv.compile(v2Schema);
+    if (!v2Validate(v2)) {
+      process.stderr.write(
+        'openwop-conformance --certify: assembled v2 bundle FAILED schema validation:\n' +
+          `${JSON.stringify(v2Validate.errors, null, 2)}\n`,
+      );
+      process.exit(2);
+    }
+    writeFileSync(outPath, `${JSON.stringify(v2, null, 2)}\n`);
+    process.stdout.write(
+      `openwop-conformance --certify: wrote bundle v2 to ${outPath}\n` +
+        `  host: ${host.name}@${host.version}\n` +
+        `  executed-pass ${passed.length} / executed-fail ${failed.length} / blocked ${skipped.length}\n` +
+        (skipped.length > 0
+          ? `  NOTE: ${skipped.length} requirement(s) are 'blocked', not 'skipped'. The runner cannot\n` +
+            `  classify a skipped file until scenarios record into the RFC 0148 §A ledger, and §A\n` +
+            `  resolves an unclassifiable requirement to 'blocked' rather than to a pass. A bundle\n` +
+            `  with blocked > 0 does NOT certify — that is the true state of the evidence, not a\n` +
+            `  defect in this emitter.\n`
+          : ''),
+    );
+    process.exit(failed.length > 0 ? 1 : 0);
+  }
+
   // (e) Validate against the bundle schema BEFORE writing.
   const schema = JSON.parse(
     readFileSync(join(SCHEMAS_DIR, 'conformance-certification-bundle.schema.json'), 'utf8'),

package/src/lib/a2a-fake-peer.ts

@@ -70,6 +70,20 @@ export interface A2APeerInvocation {
   readonly rpcMethod: string | null;
   readonly body: unknown;
   readonly timestamp: number;
+  /**
+   * Request headers as received, lowercased.
+   *
+   * Added for RFC 0152 §B, whose central requirement — the sender MUST send
+   * `A2A-Version` and a host MUST NOT silently downgrade an authenticated
+   * request — lives entirely in the headers. Without capturing them the peer
+   * could observe that a call happened but not which version was negotiated,
+   * which is the only part §B is about.
+   *
+   * The absence was itself the blocker: RFC 0152 was being described as needing
+   * a live upstream peer when part of what it needed was for this fake one to
+   * record what it already received.
+   */
+  readonly headers: Readonly<Record<string, string>>;
 }
 
 export class A2AFakePeer {
@@ -186,12 +200,18 @@ export class A2AFakePeer {
         ? String((body as { method: unknown }).method)
         : null;
 
+    const headers: Record<string, string> = {};
+    for (const [k, v] of Object.entries(req.headers)) {
+      if (typeof v === 'string') headers[k.toLowerCase()] = v;
+      else if (Array.isArray(v)) headers[k.toLowerCase()] = v.join(', ');
+    }
     this._invocations.push({
       method: req.method ?? 'GET',
       path: url,
       rpcMethod,
       body,
       timestamp: Date.now(),
+      headers,
     });
 
     // GET /.well-known/agent-card.json  — A2A v0.3 well-known path

package/src/lib/behavior-gate.ts

@@ -51,6 +51,12 @@
 
 import { expect } from 'vitest';
 import { loadEnv } from './env.js';
+import { recordRequirement } from './requirement-ledger.js';
+
+/** RFC 0148 §A requirement ID for a capability-gated profile decision. */
+export function profileRequirementId(profileName: string): string {
+  return `openwop.profile.${profileName}`;
+}
 
 /**
  * Returns true if the scenario should proceed with assertions (advertised),
@@ -69,18 +75,38 @@ export function behaviorGate(profileName: string, advertised: boolean): boolean
   const optedOut = env.optedOutProfiles.has(profileName);
 
   if (advertised && optedOut) {
-    // eslint-disable-next-line no-console
-    console.warn(
-      `[${profileName}] both ADVERTISED by the host AND listed in OPENWOP_OPTED_OUT_PROFILES — ` +
-        `opt-out is ignored. Remove from the env var to clear this warning.`,
+    // RFC 0148 §B: "A host MUST NOT both advertise and opt out of the same
+    // profile." This was a `console.warn` that then proceeded as advertised —
+    // and a MUST NOT enforced by a warning is not enforced. Nothing consumes the
+    // warning, nothing fails on it, and the certification bundle produced from
+    // that run records a pass.
+    //
+    // The two claims are opposite in kind: advertising says the host implements
+    // the profile, opting out says the operator declares it does not. A run
+    // where both hold has no defensible reading, and resolving it in favour of
+    // advertisement extracted MORE certification claim from a MORE
+    // contradictory input.
+    throw new Error(
+      `RFC 0148 §B: [${profileName}] is BOTH advertised by the host AND listed in ` +
+        `OPENWOP_OPTED_OUT_PROFILES. A host MUST NOT both advertise and opt out of the same ` +
+        `profile — the two are contradictory claims and neither can be trusted while both ` +
+        `stand. Remove it from OPENWOP_OPTED_OUT_PROFILES, or stop advertising it.`,
     );
   }
 
   if (advertised) return true;
 
   if (optedOut) {
-    // Honest opt-out: the operator declared the host does not implement
-    // this profile. Skip in BOTH default and strict mode.
+    // Honest opt-out: the operator declared the host does not implement this
+    // profile. Skip in BOTH default and strict mode. Recorded as `skipped`
+    // rather than left silent — RFC 0148 §A resolves an unrecorded requirement
+    // to `blocked`, so without this an opted-out profile and a never-run profile
+    // would be the same observable.
+    recordRequirement(
+      profileRequirementId(profileName),
+      'skipped',
+      'operator declared an honest opt-out via OPENWOP_OPTED_OUT_PROFILES',
+    );
     // eslint-disable-next-line no-console
     console.warn(
       `[${profileName}] honest opt-out (OPENWOP_OPTED_OUT_PROFILES); skipping`,
@@ -98,7 +124,16 @@ export function behaviorGate(profileName: string, advertised: boolean): boolean
     // expect.toBe(true) throws; we won't reach here.
   }
 
-  // Default-mode soft-skip.
+  // Default-mode soft-skip. Recorded as `inapplicable`: the host does not
+  // advertise the profile and the operator made no declaration, so the
+  // requirement does not apply to this discovery set. That is a different claim
+  // from `blocked` ("we could not check"), and it is certifiable where blocked
+  // is not — RFC 0148 §A.
+  recordRequirement(
+    profileRequirementId(profileName),
+    'inapplicable',
+    'profile not advertised in the captured discovery set',
+  );
   // eslint-disable-next-line no-console
   console.warn(
     `[${profileName}] profile not advertised; skipping (set OPENWOP_REQUIRE_BEHAVIOR=true to fail)`,

package/src/lib/llm-cache-key-recipe.ts

@@ -57,6 +57,57 @@ export function expectedCacheKey(input: Record<string, unknown>): string {
   return createHash('sha256').update(canonicalize(projectRecipe(input)), 'utf8').digest('hex');
 }
 
+/** RFC 0150 §C recipe stamp. Present in the preimage so a v1 digest and a v2
+ *  digest for the same request cannot be mistaken for each other. */
+export const SEMANTIC_REQUEST_RECIPE_V2 = 'openwop-semantic-request-v2';
+
+/**
+ * RFC 0150 §C — project to the **v2** semantic request.
+ *
+ * The difference from v1 is not additive tidying. v1 EXCLUDED `maxOutputTokens`,
+ * `stop`, and `seed`, and every one of them changes the completion — so two
+ * requests that produce different text hashed to the same key. That is a wrong
+ * hit rather than a miss, which is why v2 is a safety-fix and not a refinement.
+ *
+ * Transport-only fields are still excluded. The test is whether a field can
+ * change what the model returns, not whether it appears in the HTTP request.
+ */
+export function projectSemanticRequestV2(raw: Record<string, unknown>): Record<string, unknown> {
+  const request: Record<string, unknown> = { messages: raw.messages };
+  if (Array.isArray(raw.tools) && raw.tools.length > 0) {
+    request.tools = [...(raw.tools as Array<{ name: string }>)].sort((a, b) => a.name.localeCompare(b.name));
+  }
+  for (const k of ['temperature', 'topP', 'topK', 'maxOutputTokens', 'seed'] as const) {
+    if (typeof raw[k] === 'number') request[k] = raw[k];
+  }
+  if (Array.isArray(raw.stop)) request.stop = raw.stop;
+  if (raw.responseFormat !== undefined && typeof raw.responseFormat === 'object') {
+    request.responseFormat = raw.responseFormat;
+  }
+  if (raw.safetySettings !== undefined && typeof raw.safetySettings === 'object') {
+    request.safetySettings = raw.safetySettings;
+  }
+  const out: Record<string, unknown> = {
+    recipe: SEMANTIC_REQUEST_RECIPE_V2,
+    provider: raw.provider,
+    model: raw.model,
+    request,
+  };
+  // Carried, never dropped: a dropped option that alters output is
+  // indistinguishable from one that was never set.
+  if (raw.providerOptions !== undefined && typeof raw.providerOptions === 'object') {
+    out.providerOptions = raw.providerOptions;
+  }
+  return out;
+}
+
+/** RFC 0150 §C — SHA-256 over the JCS-canonical v2 object, lowercase hex. */
+export function semanticRequestDigestV2(input: Record<string, unknown>): string {
+  return createHash('sha256')
+    .update(canonicalize(projectSemanticRequestV2(input)), 'utf8')
+    .digest('hex');
+}
+
 /** Drive the host's `POST /v1/host/sample/test/llm-cache-key` test seam.
  *  Returns the host's emitted cacheKey when the seam responds 200; status
  *  alone when the seam returns 404 (host doesn't expose the seam → caller

package/src/lib/mcp-fake-server.ts

@@ -30,6 +30,20 @@ export interface McpInvocation {
   readonly method: string;
   readonly params: unknown;
   readonly timestamp: number;
+  /**
+   * Request headers as received, lowercased.
+   *
+   * Added for RFC 0153 §A/§B alongside the identical addition to
+   * `A2AFakePeer`. MCP's revision is negotiated in `MCP-Protocol-Version`, so a
+   * recorder that captures only the JSON-RPC method and params can see that a
+   * call happened and not which revision it was made under — which is the whole
+   * of what §B governs.
+   *
+   * Both fake peers had the same gap, which is worth noting: the omission was
+   * not an oversight in one file but a shared assumption that the interesting
+   * part of a call is its body.
+   */
+  readonly headers: Readonly<Record<string, string>>;
 }
 
 export class McpFakeServer {
@@ -93,10 +107,16 @@ export class McpFakeServer {
     }
 
     if (typeof rpc.method === 'string') {
+      const headers: Record<string, string> = {};
+      for (const [k, v] of Object.entries(req.headers)) {
+        if (typeof v === 'string') headers[k.toLowerCase()] = v;
+        else if (Array.isArray(v)) headers[k.toLowerCase()] = v.join(', ');
+      }
       this._invocations.push({
         method: rpc.method,
         params: rpc.params ?? null,
         timestamp: Date.now(),
+        headers,
       });
     }
 

package/src/lib/profiles.ts

@@ -83,6 +83,14 @@ function isNonNegativeInteger(value: unknown): value is number {
   return typeof value === 'number' && Number.isInteger(value) && value >= 0;
 }
 
+/**
+ * RFC 0149 §C — `protocolVersion` is ASCII `<major>.<minor>`, no leading zero
+ * except zero itself. Kept identical to the `pattern` in
+ * `schemas/capabilities.schema.json`; `protocol-version-grammar.test.ts` asserts
+ * the two agree, so this cannot drift into being the looser of the pair again.
+ */
+const PROTOCOL_VERSION_GRAMMAR = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+
 /**
  * `openwop-core` predicate. Every other profile implies `openwop-core`. A host
  * that fails this predicate is not openwop-compatible.
@@ -91,7 +99,13 @@ function isNonNegativeInteger(value: unknown): value is number {
  */
 export function isCore(c: DiscoveryPayload): boolean {
   if (typeof c.protocolVersion !== 'string') return false;
-  if (!c.protocolVersion.startsWith('1.')) return false;
+  // RFC 0149 §C. `startsWith('1.')` admitted `1.0.0` and `1.banana` while
+  // rejecting `1`, so the predicate deciding whether a host is openwop-compatible
+  // at all was looser than the schema every host validates against. The major is
+  // the hard boundary; a higher minor stays core under v1 additive rules.
+  const version = PROTOCOL_VERSION_GRAMMAR.exec(c.protocolVersion);
+  if (version === null) return false;
+  if (version[1] !== '1') return false;
   if (!Array.isArray(c.supportedEnvelopes)) return false;
   if (!c.supportedEnvelopes.every((entry) => typeof entry === 'string')) return false;
   if (typeof c.schemaVersions !== 'object' || c.schemaVersions === null) return false;
@@ -452,6 +466,14 @@ export interface ProfileFloor {
   readonly required: readonly string[];
   /** Prefix groups where ≥1 matching passed scenario satisfies the group. */
   readonly requiredAnyPrefix?: readonly string[];
+  /**
+   * The profile is discovery-payload-only: its predicate IS the whole claim and
+   * it has no runtime floor. This flag exists so an EMPTY floor is a decision on
+   * record rather than an absence — an absent key means "not yet transcribed",
+   * which `verifyBundleProfile()` treats as unprovable (RFC 0148 §C). Conflating
+   * the two is what let five undefined-floor claims verify as proven.
+   */
+  readonly discoveryOnly?: true;
 }
 
 export const PROFILE_FLOOR_SCENARIOS: Readonly<Record<string, ProfileFloor>> = {
@@ -469,6 +491,49 @@ export const PROFILE_FLOOR_SCENARIOS: Readonly<Record<string, ProfileFloor>> = {
     ],
     requiredAnyPrefix: ['interrupt-'],
   },
+
+  // ── Floors TRANSCRIBED from `profiles.md`, not invented here ────────────────
+  // `profiles.md` §"Claiming vs passing" already states the rule normatively:
+  // "A host CLAIMS a profile by satisfying its predicate AND passing the
+  // conformance scenarios labelled with the profile tag." Each per-profile
+  // section then names its scenarios. This map was an incomplete transcription
+  // of that prose, and every profile it omitted verified as floor-proven
+  // against nothing (RFC 0148 §C, gap G6).
+
+  // `profiles.md` §`openwop-core` is a pure discovery-payload predicate — it
+  // names no runtime scenario, so the predicate IS the whole claim.
+  'openwop-core': { required: [], discoveryOnly: true },
+
+  // `profiles.md` §`openwop-fixtures`: "The profile is discovery-payload-only —
+  // it confirms the host claims SOME fixture, not that any specific fixture is
+  // wired."
+  'openwop-fixtures': { required: [], discoveryOnly: true },
+
+  // `profiles.md` §`openwop-stream-sse`: "A host passes `openwop-stream-sse`
+  // when discovery passes the predicate AND those scenarios pass."
+  'openwop-stream-sse': {
+    required: ['stream-modes.test.ts', 'stream-modes-buffer.test.ts', 'stream-modes-mixed.test.ts'],
+  },
+
+  // `profiles.md` §`openwop-stream-poll`: "Conformance scenarios in
+  // `stream-modes.test.ts` exercise polling."
+  'openwop-stream-poll': { required: ['stream-modes.test.ts'] },
+
+  // `profiles.md` §`openwop-node-packs`: "a host passes `openwop-node-packs`
+  // when it passes those scenarios."
+  'openwop-node-packs': { required: ['pack-registry.test.ts', 'pack-registry-publish.test.ts'] },
+
+  // ── Deliberately NOT transcribed ───────────────────────────────────────────
+  // `openwop-replay-fork` cannot be expressed by this model. `profiles.md`
+  // §`openwop-replay-fork` says "Hosts MAY support either or both modes; the
+  // conformance scenarios pass on whichever mode the host advertises" — a floor
+  // conditional on the advertised mode, which a flat `required[]` cannot state.
+  // Forcing it would either over-require (failing an honest single-mode host) or
+  // under-require (the vacuity this fix removes). It stays unspecified, and is
+  // therefore unprovable, until the model can express a discovery-conditional
+  // floor. Same for `openwop-interrupts`, `openwop-secrets`,
+  // `openwop-provider-policy`, `openwop-memory`, and `openwop-trigger-bridge`,
+  // whose prose sections do not yet name a settled floor set.
 };
 
 /** Is `profile` derivable from a discovery document? Maps a profile name to its predicate (RFC 0089 §B(1)). */
@@ -496,6 +561,14 @@ export interface BundleProfileVerdict {
   readonly floorProven: boolean;
   readonly valid: boolean;
   readonly missingFloor: readonly string[];
+  /**
+   * True when no floor set is defined for this profile, so §B(2) cannot be
+   * evaluated at all. Distinct from `floorProven: false` with a populated
+   * `missingFloor`, which means the floor WAS evaluated and the bundle failed
+   * it. Both are invalid; only this one is a gap in the corpus rather than a
+   * defect in the host.
+   */
+  readonly floorUnspecified: boolean;
 }
 
 const scenarioBasename = (id: string): string => id.split('/').pop() ?? id;
@@ -507,11 +580,29 @@ const scenarioBasename = (id: string): string => id.split('/').pop() ?? id;
 export function verifyBundleProfile(bundle: CertificationBundleLike, profile: string): BundleProfileVerdict {
   const derivable = profileDerivable(bundle.discovery.document, profile);
   const floor = PROFILE_FLOOR_SCENARIOS[profile];
+
+  // An UNDEFINED floor set makes §B(2) unevaluable, so the claim is unprovable —
+  // never proven. Reading the old code, `missingFloor` fell to `[]` and
+  // `prefixOk` to `[].every(...)` === true, so `floorProven` came out TRUE for
+  // every profile this map omitted: the verifier reported a claim as floor-proven
+  // having checked nothing. An empty floor that is a real decision says so with
+  // `discoveryOnly` (RFC 0148 §C, gap G6).
+  if (floor === undefined) {
+    return { profile, derivable, floorProven: false, valid: false, missingFloor: [], floorUnspecified: true };
+  }
+
   const passed = new Set(bundle.results.passed.map(scenarioBasename));
-  const missingFloor = floor ? floor.required.filter((r) => !passed.has(scenarioBasename(r))) : [];
-  const prefixOk = (floor?.requiredAnyPrefix ?? []).every((p) => [...passed].some((s) => s.startsWith(p)));
+  const missingFloor = floor.required.filter((r) => !passed.has(scenarioBasename(r)));
+  const prefixOk = (floor.requiredAnyPrefix ?? []).every((p) => [...passed].some((s) => s.startsWith(p)));
   const floorProven = missingFloor.length === 0 && prefixOk;
-  return { profile, derivable, floorProven, valid: derivable && floorProven, missingFloor };
+  return {
+    profile,
+    derivable,
+    floorProven,
+    valid: derivable && floorProven,
+    missingFloor,
+    floorUnspecified: false,
+  };
 }
 
 /** Verify every profile in `bundle.claimedProfiles`; the bundle is valid iff all claims are valid. */