@openwop/openwop-conformance 1.99.0 → 1.102.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.99.0",
+  "version": "1.102.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.99.0",
-  "corpusCommit": "e30c3c5e8b14d76c90b608666deaf10411df0414"
+  "suiteVersion": "1.102.0",
+  "corpusCommit": "6fa46a846fa43fd14b8499fb38d8230a9bbb6eb3"
 }

package/src/lib/host-callback.ts

@@ -0,0 +1,90 @@
+/**
+ * Host-callback declaration — which scenarios need the HOST to reach the suite.
+ *
+ * ## The rule
+ *
+ * A scenario that requires the host to **originate a connection back to the
+ * harness** MUST declare it:
+ *
+ * ```ts
+ * export const REQUIRES_HOST_CALLBACK = 'the host exports OTLP to the suite collector';
+ * ```
+ *
+ * ## Why a declaration and not a detector
+ *
+ * The suite advertises harness-hosted endpoints to the host — a fake A2A peer,
+ * an MCP server, an OIDC issuer, an OTLP collector — and in-process that
+ * advertisement is free loopback. **It stops being free the moment the host is
+ * not the harness process.** From a container, VM, or remote origin,
+ * `127.0.0.1` is *that* environment, so the call never lands. The scenario does
+ * not fail because the host is non-conformant; it fails because there is no
+ * route.
+ *
+ * That is a networking property, not a measurement, and it holds for any
+ * consumer running the suite against anything that is not the harness process.
+ *
+ * **A detector cannot decide this reliably, and trying taught us why.** A first
+ * pass that grepped for URL-shaped identifiers flagged `form-content-packs`
+ * (where `webhookUrl` is a field name the scenario *forbids*) and
+ * `interrupt-external-event-correlation` (where `callbackUrl` flows host →
+ * suite, the opposite direction). It also missed the OTLP collector entirely,
+ * because nothing in those scenarios names a URL at all. **Two false positives
+ * and a false negative on the first attempt** — a list built that way would be
+ * wrong in both directions while looking authoritative.
+ *
+ * So the author declares, because the author knows which way the connection
+ * goes. The gate below enforces the declaration where the signal is
+ * unambiguous.
+ *
+ * ## What the gate is, and is not
+ *
+ * `host-callback-declaration.test.ts` requires the declaration on every scenario
+ * importing a module from {@link HARNESS_DOUBLE_MODULES}. That signal is
+ * unambiguous: those modules exist to stand up a server the host must reach.
+ *
+ * **It is a floor, not an oracle.** A scenario that constructs a
+ * harness-reachable URL some other way is callback-shaped and the gate will not
+ * notice. Saying so here is the point — a gate whose limits are unstated reads
+ * as completeness it does not have, which is the failure this whole program
+ * exists to close.
+ *
+ * ## What the declaration buys
+ *
+ * A consumer running the suite off-process can enumerate, **before running**,
+ * which scenarios cannot be witnessed in their environment:
+ *
+ * ```sh
+ * grep -l REQUIRES_HOST_CALLBACK node_modules/@openwop/openwop-conformance/src/scenarios/*.ts
+ * ```
+ *
+ * That converts a silent unwitnessable set into a list they can plan around —
+ * and RFC 0148 §A resolves an unwitnessed requirement to `blocked` rather than
+ * to a pass, which a consumer can only honour if they know which ones they are.
+ */
+
+/**
+ * Modules that stand up a harness-hosted server the host must reach.
+ *
+ * Derived from the library rather than remembered: these are the modules
+ * exposing an `endpoint()` a scenario hands to the host. The first informal
+ * account of this class named three (compat provider, OIDC issuer, webhook
+ * subscriber) and **missed the OTLP collector, which has the most consumers of
+ * any of them** — which is why this list lives next to the gate that reads it
+ * instead of in prose someone has to keep true.
+ */
+export const HARNESS_DOUBLE_MODULES: readonly string[] = [
+  'a2a-fake-peer',
+  'mcp-fake-server',
+  'oidc-issuer',
+  'otel-collector',
+];
+
+/**
+ * The declaration a callback-shaped scenario exports.
+ *
+ * The value is the REASON — which connection the host must originate — not a
+ * bare `true`. A boolean records that somebody ticked a box; a sentence records
+ * what a consumer needs to route, and is checkable against the scenario body by
+ * anyone reading the diff.
+ */
+export type HostCallbackDeclaration = string;

package/src/scenarios/a2a-task-roundtrip.test.ts

@@ -48,6 +48,14 @@ import { SCHEMAS_DIR } from '../lib/paths.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 
+/**
+ * Callback-shaped: the host issues A2A JSON-RPC calls to the suite's fake peer.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host issues A2A JSON-RPC calls to the suite's fake peer";
+
 const ROUNDTRIP_FIXTURE = 'conformance-a2a-task-roundtrip';
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 

package/src/scenarios/a2a-version-negotiation.test.ts

@@ -29,6 +29,14 @@ import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { getA2AFakePeer } from '../lib/a2a-fake-peer.js';
 
+/**
+ * Callback-shaped: the host issues A2A calls to the suite's fake peer, which records the negotiated version header.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host issues A2A calls to the suite's fake peer, which records the negotiated version header";
+
 const PROFILE = 'a2a.versionNegotiation';
 
 interface A2ACaps {

package/src/scenarios/auth-oauth2-client-credentials.test.ts

@@ -35,6 +35,14 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { createSyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
+/**
+ * Callback-shaped: the host fetches the token endpoint on the suite's synthetic OIDC issuer.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host fetches the token endpoint on the suite's synthetic OIDC issuer";
+
 interface OAuth2Caps {
   supported?: boolean;
   issuer?: string;

package/src/scenarios/auth-oidc-user-bearer.test.ts

@@ -49,6 +49,14 @@ import {
 } from '../lib/oidc-issuer.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
+/**
+ * Callback-shaped: the host fetches JWKS and discovery from the suite's synthetic OIDC issuer.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host fetches JWKS and discovery from the suite's synthetic OIDC issuer";
+
 interface OIDCCaps {
   supported?: boolean;
   issuers?: string[];

package/src/scenarios/cost-attribution.test.ts

@@ -37,6 +37,14 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { getCollector, waitForRunSpans } from '../lib/otel-collector.js';
 
+/**
+ * Callback-shaped: the host exports OTLP metrics to the suite's collector.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host exports OTLP metrics to the suite's collector";
+
 const NOOP_WORKFLOW_ID = 'conformance-noop';
 const COST_EMIT_WORKFLOW_ID = 'openwop-smoke-cost-emit';
 const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);

package/src/scenarios/host-callback-declaration.test.ts

@@ -0,0 +1,127 @@
+/**
+ * Every callback-shaped scenario declares itself.
+ *
+ * See `../lib/host-callback.ts` for the rule and why it is a declaration rather
+ * than a detector. In short: a scenario needing the HOST to originate a
+ * connection back to the harness cannot be witnessed when the host is in a
+ * separate network namespace, and **that is a networking property, not host
+ * non-conformance.**
+ *
+ * This gate enforces the declaration where the signal is unambiguous — a
+ * scenario importing a module that stands up a harness-hosted server. It is a
+ * floor, not an oracle, and the docblock next door says so.
+ *
+ * Server-free; reads the suite's own sources.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { SCENARIOS_DIR } from '../lib/paths.js';
+import { HARNESS_DOUBLE_MODULES } from '../lib/host-callback.js';
+
+const DECLARATION = /export\s+const\s+REQUIRES_HOST_CALLBACK\s*[:=]/;
+/**
+ * The authored opt-out, for a scenario that imports a double but drives BOTH
+ * ends itself. Importing a harness module is the signal the gate can see; it is
+ * not proof a host participates. The opt-out carries a reason for the same
+ * reason the declaration does — an unexplained exception is indistinguishable
+ * from an author who forgot.
+ */
+const OPT_OUT = /export\s+const\s+HOST_CALLBACK_NOT_REQUIRED\s*[:=]/;
+
+interface Scenario {
+  readonly file: string;
+  readonly source: string;
+  readonly doubles: readonly string[];
+  readonly declared: boolean;
+  readonly optedOut: boolean;
+}
+
+function scan(dir: string): Scenario[] {
+  return readdirSync(dir)
+    .filter((f) => f.endsWith('.test.ts'))
+    .sort()
+    .map((file) => {
+      const source = readFileSync(join(dir, file), 'utf8');
+      return {
+        file,
+        source,
+        doubles: HARNESS_DOUBLE_MODULES.filter((m) =>
+          new RegExp(`from '\\.\\./lib/${m}(\\.js)?'`).test(source),
+        ),
+        declared: DECLARATION.test(source),
+        optedOut: OPT_OUT.test(source),
+      };
+    });
+}
+
+describe.skipIf(SCENARIOS_DIR === null)('host-callback declaration (conformance/README §"Where the suite runs")', () => {
+  const all = SCENARIOS_DIR === null ? [] : scan(SCENARIOS_DIR);
+
+  it('the scan reaches the scenario corpus', () => {
+    // Guard: an empty scan makes every leg below vacuously true, which is the
+    // shape RFC 0148 §C found in the floor verifier. A gate that passes by
+    // having looked at nothing is worse than no gate, because it reports clean.
+    expect(all.length, 'the scenario directory MUST be readable and populated').toBeGreaterThan(100);
+    expect(
+      all.filter((s) => s.doubles.length > 0).length,
+      'the suite MUST contain scenarios that drive harness doubles — if this hits zero the ' +
+        'module list in `host-callback.ts` has drifted from the imports it is meant to track, ' +
+        'and the gate is measuring nothing',
+    ).toBeGreaterThan(0);
+  });
+
+  it('every scenario driving a harness double declares the callback', () => {
+    const undeclared = all
+      .filter((s) => s.doubles.length > 0 && !s.declared && !s.optedOut)
+      .map((s) => `${s.file} (imports ${s.doubles.join(', ')})`);
+    expect(
+      undeclared,
+      'A scenario that hands the host a harness-hosted endpoint MUST export ' +
+        '`REQUIRES_HOST_CALLBACK` naming the connection the host has to originate — or ' +
+        '`HOST_CALLBACK_NOT_REQUIRED` explaining why it drives both ends itself.\n\n' +
+        'Without it, a consumer running the suite off-process — against a container, VM, or ' +
+        'remote origin — discovers the scenario is unwitnessable by watching it fail, and reads ' +
+        'a routing problem as host non-conformance. RFC 0148 §A resolves an unwitnessed ' +
+        'requirement to `blocked` rather than to a pass, and a consumer can only honour that ' +
+        'for scenarios they can identify in advance.\n  ' + undeclared.join('\n  '),
+    ).toEqual([]);
+  });
+
+  it('the declaration states a reason rather than a bare flag', () => {
+    // A boolean records that somebody ticked a box. A sentence records what a
+    // consumer must route, and is checkable against the scenario body by anyone
+    // reading the diff — the same annotated-vs-bare rule RFC 0149 §D applies to
+    // acceptance criteria, one artifact over.
+    const bare: string[] = [];
+    for (const s of all.filter((x) => x.declared || x.optedOut)) {
+      const m = /export\s+const\s+(?:REQUIRES_HOST_CALLBACK|HOST_CALLBACK_NOT_REQUIRED)\s*[:=][^\n]*(?:\n[^\n;]*)?/.exec(s.source);
+      const line = m?.[0] ?? '';
+      if (/=\s*(true|false)\s*;?\s*$/.test(line) || !/['"`]/.test(line)) bare.push(`${s.file}: ${line.trim()}`);
+    }
+    expect(
+      bare,
+      '`REQUIRES_HOST_CALLBACK` MUST be a string naming which connection the host originates — ' +
+        'a bare boolean says a box was ticked, not what a consumer has to route.\n  ' +
+        bare.join('\n  '),
+    ).toEqual([]);
+  });
+
+  it('nothing declares a callback it does not make', () => {
+    // The reverse direction, and the one that keeps the list honest as the
+    // corpus moves. A declaration left behind after the double was removed
+    // would tell a consumer to route something nobody needs — a stale claim,
+    // and the cheapest kind to leave lying around.
+    const orphaned = all
+      .filter((s) => s.declared && s.doubles.length === 0)
+      .filter((s) => !/endpoint\(\)/.test(s.source))
+      .map((s) => s.file);
+    expect(
+      orphaned,
+      'a scenario declaring `REQUIRES_HOST_CALLBACK` MUST actually drive a harness-hosted ' +
+        'endpoint. A declaration that outlived its double is a routing instruction for a ' +
+        'connection nobody makes.\n  ' + orphaned.join('\n  '),
+    ).toEqual([]);
+  });
+});

package/src/scenarios/mcp-tool-roundtrip.test.ts

@@ -66,6 +66,14 @@ import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 
+/**
+ * Callback-shaped: the host issues MCP JSON-RPC calls to the suite's fake server.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host issues MCP JSON-RPC calls to the suite's fake server";
+
 const ROUNDTRIP_FIXTURE = 'conformance-mcp-tool-roundtrip';
 
 /**

package/src/scenarios/mcp-version-negotiation.test.ts

@@ -30,6 +30,14 @@ import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
 
+/**
+ * Callback-shaped: the host issues MCP calls to the suite's fake server, which records the revision header.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host issues MCP calls to the suite's fake server, which records the revision header";
+
 const PROFILE = 'mcp.versionNegotiation';
 const DATE_FORM = /^\d{4}-\d{2}-\d{2}$/;
 

package/src/scenarios/metric-emission.test.ts

@@ -24,6 +24,14 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { getCollector } from '../lib/otel-collector.js';
 
+/**
+ * Callback-shaped: the host exports OTLP metrics to the suite's collector.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host exports OTLP metrics to the suite's collector";
+
 const FIXTURE = 'conformance-noop';
 
 interface MetricsCaps {

package/src/scenarios/otel-collector-canary-inspection.test.ts

@@ -38,6 +38,20 @@
 import { describe, it, expect, afterEach } from 'vitest';
 import { OtelCollector } from '../lib/otel-collector.js';
 
+/**
+ * NOT callback-shaped, despite importing the collector.
+ *
+ * This scenario stands up the collector and POSTs synthetic OTLP payloads to
+ * it ITSELF — the suite is both ends. No host is involved, so there is no
+ * connection for a host to originate and nothing to route in a container.
+ *
+ * Stated rather than silently exempted: importing a harness double is the
+ * signal the gate can see, and an unexplained exception is indistinguishable
+ * from an author who forgot.
+ */
+export const HOST_CALLBACK_NOT_REQUIRED =
+  "the suite posts synthetic OTLP payloads to its own collector; no host participates";
+
 const CANARY = 'sk-canary-DO-NOT-LEAK-0f3a9c';
 const REDACTED = '[REDACTED:openwop-conformance-canary-secret]';
 

package/src/scenarios/otel-emission-grpc.test.ts

@@ -31,6 +31,14 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { getCollector, waitForRunSpans } from '../lib/otel-collector.js';
 
+/**
+ * Callback-shaped: the host exports OTLP/gRPC spans to the suite's collector.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host exports OTLP/gRPC spans to the suite's collector";
+
 const FIXTURE = 'conformance-noop';
 
 async function advertisesGrpcExport(): Promise<boolean> {

package/src/scenarios/otel-emission.test.ts

@@ -29,6 +29,14 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { getCollector, waitForRunSpans } from '../lib/otel-collector.js';
 
+/**
+ * Callback-shaped: the host exports OTLP/HTTP spans to the suite's collector.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host exports OTLP/HTTP spans to the suite's collector";
+
 const FIXTURE = 'conformance-noop';
 
 async function isObservabilityAdvertised(): Promise<boolean> {

package/src/scenarios/otel-trace-propagation-subworkflow.test.ts

@@ -40,6 +40,14 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { isScenarioOptedOut } from '../lib/env.js';
 import { getCollector, waitForRunSpans } from '../lib/otel-collector.js';
 
+/**
+ * Callback-shaped: the host exports OTLP spans to the suite's collector.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host exports OTLP spans to the suite's collector";
+
 const PARENT_FIXTURE = 'conformance-subworkflow-parent';
 const SCENARIO_ID = 'otel-trace-propagation-subworkflow';
 

package/src/scenarios/otel-trace-propagation.test.ts

@@ -23,6 +23,14 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { getCollector, waitForRunSpans } from '../lib/otel-collector.js';
 
+/**
+ * Callback-shaped: the host exports OTLP spans to the suite's collector.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host exports OTLP spans to the suite's collector";
+
 const FIXTURE = 'conformance-noop';
 
 /** Build a syntactically-valid traceparent with a known traceId. */

package/src/scenarios/run-execution-bounds-shape.test.ts

@@ -122,11 +122,54 @@ describe.skipIf(SKIP_TIMEOUT)('run-execution-bounds: run-duration breach (RFC 00
       'run-event-payloads.schema.json §capBreached.kind',
       'cap.breached payload MUST carry kind="run-duration"',
     )).toBe('run-duration');
+    // Three distinct failure modes, asserted separately and WITH THE VALUES.
+    //
+    // The previous form ANDed all three into one boolean over a message that
+    // named none of them, so a failure said only "MUST be strictly greater" —
+    // you could not tell whether `observed` was missing, equal, or smaller. A
+    // tier-1 host hit this intermittently and had to reason out the mechanism
+    // from first principles, because the assertion about observed values did
+    // not report the observed values.
     expect(
-      typeof payload?.observed === 'number' && typeof payload?.limit === 'number' && payload!.observed > payload!.limit,
+      typeof payload?.observed,
       driver.describe(
         'run-event-payloads.schema.json §capBreached.observed',
-        'observed (elapsedMs) MUST be strictly greater than limit (resolved timeout)',
+        `cap.breached MUST carry a numeric \`observed\`; got ${JSON.stringify(payload?.observed)}`,
+      ),
+    ).toBe('number');
+    expect(
+      typeof payload?.limit,
+      driver.describe(
+        'run-event-payloads.schema.json §capBreached.limit',
+        `cap.breached MUST carry a numeric \`limit\`; got ${JSON.stringify(payload?.limit)}`,
+      ),
+    ).toBe('number');
+
+    // `capabilities.md` §"Engine-enforced limits": *"Always strictly greater
+    // than limit."* This is satisfiable and it constrains the host's comparison:
+    // breach when elapsed EXCEEDS the deadline, not when it reaches it. A host
+    // testing `elapsed >= limit` emits `observed === limit` exactly when the
+    // clock lands on the boundary — which is rare, machine-dependent, and
+    // therefore reads as flake rather than as the deterministic defect it is.
+    //
+    // That asymmetry is why the diagnosis belongs in the message: system load
+    // makes elapsed LARGER, so it makes this assertion easier to satisfy, not
+    // harder. An `observed === limit` failure is not a loaded box — it is a
+    // `>=` comparison in the host.
+    const { observed = NaN, limit = NaN } = payload ?? {};
+    expect(
+      observed > limit,
+      driver.describe(
+        'run-event-payloads.schema.json §capBreached.observed',
+        `observed (elapsedMs) MUST be strictly greater than limit (resolved timeout). ` +
+          `Got observed=${observed}, limit=${limit}` +
+          (observed === limit
+            ? '. They are EQUAL, which means the host breached at `elapsed >= limit` rather than ' +
+              '`elapsed > limit`. The limit is not breached until it has been passed. This is ' +
+              'deterministic in the host and only surfaces when the clock lands exactly on the ' +
+              'boundary, so it presents as an intermittent failure — load makes elapsed larger and ' +
+              'therefore makes this assertion PASS more often, not less.'
+            : '.'),
       ),
     ).toBe(true);
   });

package/src/scenarios/secret-leakage-otel-attribute.test.ts

@@ -58,6 +58,14 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { getCollector, waitForRunSpans } from '../lib/otel-collector.js';
 
+/**
+ * Callback-shaped: the host exports OTLP spans to the suite's collector, which scans them for the BYOK canary.
+ *
+ * Unwitnessable when the host is in a separate network namespace — see
+ * `../lib/host-callback.ts`. Not host non-conformance; no route.
+ */
+export const REQUIRES_HOST_CALLBACK = "the host exports OTLP spans to the suite's collector, which scans them for the BYOK canary";
+
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 const BYOK_WORKFLOW_ID = 'openwop-smoke-byok-roundtrip';
 const FIXTURE_SKIP = !isFixtureAdvertised(BYOK_WORKFLOW_ID);

package/src/scenarios/workflow-chain-host-expansion.test.ts

@@ -108,8 +108,36 @@ describe('workflow-chain-host-expansion: live host wraps expansion algorithm cor
         'a host serving the RFC 0013 host-expansion test seam MUST set `hostExpansionSeam: true` (and, being a chain-pack consumer, `supported: true`) in the discovery block',
       ),
     ).toBeDefined();
-    expect(caps?.hostExpansionSeam).toBe(true);
     expect(caps?.supported).toBe(true);
+
+    // `hostExpansionSeam === true` is NOT asserted here, deliberately: this leg
+    // only runs when `isExpansionAdvertised()` already read it as true, so
+    // asserting it again is a tautology that can never fail. It looked like a
+    // check and was a restatement — the same shape as a golden-vector gate
+    // comparing two stored constants.
+    //
+    // What this leg's NAME promises is that the seam is *served*, so that is
+    // what it now verifies. A host advertising the flag while the route 404s
+    // has made its discovery document false, and a consumer that read it
+    // planned against a capability that is not there.
+    //
+    // Found by a tier-1 host running the suite against its release IMAGE: the
+    // seam resolved its fixture manifest through `require.resolve` on a
+    // devDependency at request time, which succeeds in a source tree and fails
+    // under `npm ci --omit=dev`. Advertised, 404ing, **and this leg passed** —
+    // the defect surfaced three legs later as a confusing expansion mismatch
+    // rather than here, where the name says it belongs.
+    const probe = await driver.post(EXPAND_PATH, { packName: SAMPLE_PACK, chainId: CHAIN_1_NODE, parameters: {} });
+    expect(
+      probe.status,
+      driver.describe(
+        'capabilities.md §workflowChainPacks',
+        `a host advertising \`hostExpansionSeam: true\` MUST serve ${EXPAND_PATH}. Got ${probe.status} — ` +
+          'the discovery document promises a seam the host does not route. Advertising a capability ' +
+          'that 404s is worse than advertising nothing: a consumer that read the flag made a plan ' +
+          'on a fact that was not true.',
+      ),
+    ).not.toBe(404);
   });
 
   it('positive — 1-node chain expansion matches the reference library for the bundled pack', async () => {