@openwop/openwop-conformance 2.0.0-rc.0 → 2.0.0-rc.1

package/src/scenarios/v2-negotiation-decided-emitted.test.ts

@@ -0,0 +1,149 @@
+/**
+ * RFC 0175 §D.3 — `negotiation-decided-emitted` (suite 2.0.0, target major 2; gated on a2a/mcp + seams).
+ *
+ * Every negotiation outcome — including the refused one — MUST emit a
+ * content-free `negotiation.decided` event on the host's own event log
+ * (`schemas/v2/run-event-payloads.schema.json#/$defs/negotiationDecided`:
+ * `{ protocol, outcome, version?, floor?, peerDigest?, reason?, at }`, the peer
+ * as a SHA-256 digest of its origin, never in clear). The event on the host's
+ * log is the NORMATIVE witness of the silent-downgrade invariants; the seams
+ * profile drives the exchange (`spec/v2/core/interop.md` §The audit event;
+ * RFC 0175 §D.3/§D.5, row C8.5).
+ *
+ * How the exchange is driven: exactly as the v1 versioned-composition
+ * scenarios do (`a2a-version-negotiation.test.ts`, `mcp-version-negotiation.test.ts`)
+ * — the host's real client path is pointed at the suite's fake peer / server
+ * through the §22/§23 invoke seams (`/conformance/seams/sample/{a2a,mcp}/invoke`
+ * under the v2 seams profile). The seam's `200` answers with the run whose log
+ * carries the event (`runId`); the event is then read on the normative surface
+ * (`GET /runs/{runId}/events/poll`). A seam answer without a `runId` leaves the
+ * log unaddressable and records `blocked`.
+ *
+ * Callback-shaped (the host calls the suite's peer): unwitnessable when the
+ * host is in a separate network namespace — `../lib/host-callback.ts`.
+ *
+ * @see spec/v2/core/interop.md §Negotiation is a protocol
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { getA2AFakePeer } from '../lib/a2a-fake-peer.js';
+import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+export const REQUIRES_HOST_CALLBACK = "the host's A2A/MCP client calls the suite's fake peer/server through the invoke seams; the negotiation.decided event is then read on the host's own log";
+
+const EVENT = 'negotiation.decided';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+/** Ajv over the `negotiationDecided` payload definition (self-contained — no $refs). */
+function payloadValidator(): ((p: unknown) => { ok: boolean; errors: string }) | null {
+  const path = join(SCHEMAS_DIR, 'v2', 'run-event-payloads.schema.json');
+  let def: unknown;
+  try {
+    def = (JSON.parse(readFileSync(path, 'utf8')) as { $defs?: Record<string, unknown> }).$defs?.['negotiationDecided'];
+  } catch { return null; }
+  if (!def || typeof def !== 'object') return null;
+  const ajv = new Ajv2020({ allErrors: true, strict: false });
+  addFormats(ajv);
+  const validate = ajv.compile(def as Record<string, unknown>);
+  return (p) => ({ ok: validate(p) as boolean, errors: ajv.errorsText(validate.errors, { separator: '; ' }) });
+}
+
+interface EventRow { type?: unknown; payload?: Record<string, unknown>; sequence?: unknown }
+async function eventsOf(runId: string): Promise<EventRow[]> {
+  const res = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`);
+  return res.status === 200 ? ((res.json as { events?: EventRow[] } | null)?.events ?? []) : [];
+}
+
+/** Drive one exchange; returns the seam response or null with the reason recorded. */
+async function drive(protocol: 'a2a' | 'mcp', peerUrl: string): Promise<{ status: number; body: Record<string, unknown> } | null> {
+  const path = `${SEAMS_PREFIX}/sample/${protocol}/invoke`;
+  const res = await driver.post(path, protocol === 'a2a' ? { peerUrl } : { serverUrl: peerUrl });
+  if (res.status === 404 || res.status === 403 || res.status === 405) {
+    seamAbsent(`host advertises ${protocol} but the invoke seam ${path} answered ${res.status} — the exchange cannot be driven (host-sample-test-seams.md §22/§23)`);
+    return null;
+  }
+  return { status: res.status, body: (res.json ?? {}) as Record<string, unknown> };
+}
+
+function originDigest(url: string): string {
+  return createHash('sha256').update(new URL(url).origin, 'utf8').digest('hex');
+}
+
+async function leg(protocol: 'a2a' | 'mcp', id: string): Promise<void> {
+  const doc = await discovery();
+  if (!doc) return softSkip('blocked', 'discovery unreachable');
+  const facet = await familyAdvertised(protocol);
+  if (!facet) return softSkip('inapplicable', `${protocol} facet not advertised — no negotiation to audit`);
+  if (!seamsProfileAdvertised(doc)) return softSkip('blocked', `the exchange is driven through the seams profile (RFC 0175 §D.3) — conformance.seamsProfile is not openwop-conformance-seams-v2`);
+  const peer = protocol === 'a2a' ? getA2AFakePeer() : getMcpFakeServer();
+  if (peer === null) return softSkip('blocked', `the suite ${protocol === 'a2a' ? 'A2A fake peer (OPENWOP_A2A_FAKE_PEER=true)' : 'MCP fake server (OPENWOP_MCP_FAKE_SERVER=true)'} is not started in this run`);
+  peer.reset();
+  const validate = payloadValidator();
+  if (!validate) return softSkip('blocked', 'run-event-payloads.schema.json#/$defs/negotiationDecided not readable from SCHEMAS_DIR');
+
+  const driven = await drive(protocol, peer.endpoint());
+  if (!driven) return softSkip('blocked', 'invoke seam unavailable (reason recorded above)');
+  const runId = driven.body['runId'];
+  if (typeof runId !== 'string') {
+    return softSkip('blocked', `the ${protocol} invoke seam answered ${driven.status} without a runId — the host log that carries ${EVENT} is not addressable from the suite (the seam MUST name the run whose log recorded the decision)`);
+  }
+  const events = await eventsOf(runId);
+  const decided = events.filter((e) => e.type === EVENT);
+  expect(
+    decided.length,
+    req(id, 'interop.md §The audit event', `every ${protocol} negotiation outcome MUST emit ${EVENT} on the host's own event log (RFC 0175 §D.3) — none found on run ${runId}`),
+  ).toBeGreaterThan(0);
+  const outcomeExpected = driven.status < 400 ? 'accepted' : 'refused';
+  for (const e of decided) {
+    const p = e.payload ?? {};
+    const check = validate(p);
+    expect(check.ok, req(id, 'run-event-payloads.schema.json negotiationDecided', `the payload MUST validate: ${check.errors}`)).toBe(true);
+    expect(p['protocol'], req(id, 'run-event-payloads.schema.json negotiationDecided.protocol', `protocol MUST be ${protocol}`)).toBe(protocol);
+    if (typeof p['peerDigest'] === 'string') {
+      expect(
+        p['peerDigest'],
+        req(id, 'interop.md §The audit event', 'peerDigest MUST be the SHA-256 of the peer origin — never the origin in clear (RFC 0175 §D.3)'),
+      ).toBe(originDigest(peer.endpoint()));
+    }
+    for (const v of Object.values(p)) {
+      expect(
+        typeof v === 'string' && v.includes(new URL(peer.endpoint()).host),
+        req(id, 'interop.md §The audit event', 'the event is content-free: the peer origin MUST NOT appear in clear in any field'),
+      ).toBe(false);
+    }
+  }
+  const last = decided[decided.length - 1]!.payload ?? {};
+  expect(
+    last['outcome'],
+    req(id, 'run-event-payloads.schema.json negotiationDecided.outcome', `the seam answered ${driven.status}, so the recorded outcome MUST be ${outcomeExpected}`),
+  ).toBe(outcomeExpected);
+  if (driven.status < 400) {
+    expect(
+      last['version'],
+      req(id, 'interop.md §The audit event', 'an accepted negotiation records the version the host actually used, which MUST equal the seam-reported negotiatedVersion'),
+    ).toBe(driven.body['negotiatedVersion']);
+  }
+}
+
+describe('RFC 0175 §D.3 — negotiation-decided-emitted (gated on a2a/mcp + seams)', () => {
+  it('an A2A exchange leaves negotiation.decided on the host log', async () => {
+    await leg('a2a', 'openwop.requirement.0175.negotiation-decided-emitted');
+  });
+  it('an MCP exchange leaves negotiation.decided on the host log', async () => {
+    await leg('mcp', 'openwop.requirement.0175.negotiation-decided-emitted.mcp');
+  });
+});

package/src/scenarios/v2-no-transport-advertisement.test.ts

@@ -0,0 +1,57 @@
+/**
+ * RFC 0175 §A.1 / §B.1 — `no-transport-advertisement` (suite 2.0.0, target major 2; unaided).
+ *
+ * REST and SSE are the wire. A v2 host MUST NOT advertise a transport list:
+ * `supportedTransports` does not exist in `schemas/v2/capabilities.schema.json`
+ * (row C8.2), and the `grpc` block is removed from the closed root because an
+ * unwitnessable family is not advertisable (row C8.3; RFC 0169 §A.1). A2A and
+ * MCP are compositions advertised by their own facets (`spec/v2/core/interop.md`
+ * §REST is the wire, §gRPC).
+ *
+ * Unaided: the v2 representation of `/.well-known/openwop` is enough. The
+ * schema check (closed root) is the belt; the named-key checks are the braces,
+ * so a host whose document fails validation for some other reason still gets
+ * the specific finding.
+ *
+ * @see spec/v2/core/interop.md §REST is the wire, §gRPC
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+describe('RFC 0175 §A.1/§B.1 — no-transport-advertisement (unaided)', () => {
+  it('the v2 root carries no supportedTransports and no grpc block', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    expect(
+      'supportedTransports' in doc,
+      req('openwop.requirement.0175.no-transport-advertisement', 'interop.md §REST is the wire', 'a v2 host MUST NOT advertise a transport list — `supportedTransports` does not exist in v2 (RFC 0175 §B.1, row C8.2)'),
+    ).toBe(false);
+    expect(
+      'grpc' in doc,
+      req('openwop.requirement.0175.no-transport-advertisement', 'interop.md §gRPC', 'a v2 host MUST NOT advertise a `grpc` capability block — an unwitnessable family is not advertisable (RFC 0175 §A.1, row C8.3)'),
+    ).toBe(false);
+    // Neither may hide inside a nested family: an `a2a.transports` or
+    // `mcp.supportedTransports` would be the same claim one level down.
+    for (const family of ['a2a', 'mcp']) {
+      const rec = doc[family];
+      if (rec && typeof rec === 'object') {
+        expect(
+          'supportedTransports' in (rec as Record<string, unknown>),
+          req('openwop.requirement.0175.no-transport-advertisement', 'interop.md §The facets', `${family} is a composition facet, not a transport advertisement — no supportedTransports inside it`),
+        ).toBe(false);
+      }
+    }
+    const check = v2Validator('capabilities')(doc);
+    expect(
+      check.ok,
+      req('openwop.requirement.0175.no-transport-advertisement', 'capabilities.schema.json (closed root)', `the v2 discovery document MUST validate against the closed root — a transport list or a grpc block fails it: ${check.errors}`),
+    ).toBe(true);
+  });
+});

package/src/scenarios/v2-owner-subject-required.test.ts

@@ -0,0 +1,72 @@
+/**
+ * v2 — `owner-subject-required` (suite 2.0.0; RFC 0170 §A.1;
+ * `spec/v2/core/identity.md` §1.1 "Shape").
+ *
+ * Witness class: witnessable — unaided. `RunSnapshot.owner` is
+ * `{ tenant, workspace?, subject }` with `subject` REQUIRED and validating
+ * against `schemas/v2/subject.schema.json`; `principal` / `principalKind` are
+ * removed. The run is created through `POST /runs` with the smallest valid body
+ * (the `conformance-noop` fixture); a refusal to create records `blocked` with
+ * the host's envelope.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/identity.md §1.1';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+type Created = { readonly ok: true; readonly runId: string } | { readonly ok: false; readonly reason: string };
+
+async function createRun(): Promise<Created> {
+  const res = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }));
+  if (res === null) return { ok: false, reason: 'POST /runs unreachable (fetch failed)' };
+  const runId = (res.json as { runId?: unknown } | undefined)?.runId;
+  if (res.status !== 201 || typeof runId !== 'string') {
+    return { ok: false, reason: `POST /runs {workflowId: ${NOOP_WORKFLOW_ID}} answered ${res.status} ${readErrorCode(res.json) ?? ''} — the smallest valid create was refused (fixture not seeded?)`.trim() };
+  }
+  return { ok: true, runId };
+}
+
+async function snapshot(): Promise<{ owner: Record<string, unknown> } | { reason: string }> {
+  if (!(await discovery())) return { reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
+  const created = await createRun();
+  if (!created.ok) return { reason: created.reason };
+  const res = await http(() => driver.get(`/runs/${encodeURIComponent(created.runId)}`));
+  if (res === null || res.status !== 200) return { reason: `GET /runs/{runId} answered ${res?.status ?? 'no response'} for the run just created` };
+  const owner = (res.json as { owner?: unknown } | undefined)?.owner;
+  if (owner === null || typeof owner !== 'object') return { reason: 'GET /runs/{runId} carries no `owner` object — RunSnapshot.owner is REQUIRED (schemas/v2/run-snapshot.schema.json)' };
+  return { owner: owner as Record<string, unknown> };
+}
+
+describe('v2 owner-subject-required (RFC 0170 §A.1)', () => {
+  it('owner.subject is present and validates against subject.schema.json', async () => {
+    const s = await snapshot();
+    if ('reason' in s) return softSkip('blocked', s.reason);
+    const validate = v2Validator('subject');
+    expect(s.owner['subject'], req('openwop.requirement.0170.owner-subject-required.subject', DOC, 'RunSnapshot.owner.subject is REQUIRED')).toBeDefined();
+    const r = validate(s.owner['subject']);
+    expect(r.ok, req('openwop.requirement.0170.owner-subject-required.subject', DOC, `owner.subject MUST validate against schemas/v2/subject.schema.json (issuer, subjectId, tenant, lane, kind; closed) (${r.errors})`)).toBe(true);
+    expect(typeof s.owner['tenant'], req('openwop.requirement.0170.owner-subject-required.subject', DOC, 'RunSnapshot.owner.tenant is REQUIRED')).toBe('string');
+  });
+
+  it('owner carries no principal / principalKind', async () => {
+    const s = await snapshot();
+    if ('reason' in s) return softSkip('blocked', s.reason);
+    expect(s.owner['principal'], req('openwop.requirement.0170.owner-subject-required.no-principal', DOC, '`principal` is removed from RunSnapshot.owner — subject.subjectId carries it')).toBeUndefined();
+    expect(s.owner['principalKind'], req('openwop.requirement.0170.owner-subject-required.no-principal', DOC, '`principalKind` is removed from RunSnapshot.owner — subject.kind carries it')).toBeUndefined();
+    const extra = Object.keys(s.owner).filter((k) => !['tenant', 'workspace', 'subject'].includes(k));
+    expect(extra, req('openwop.requirement.0170.owner-subject-required.no-principal', DOC, 'owner is the closed block { tenant, workspace?, subject }')).toEqual([]);
+  });
+});

package/src/scenarios/v2-pack-isolation.test.ts

@@ -0,0 +1,147 @@
+/**
+ * RFC 0173 §B — `pack-isolation` (suite 2.0.0, target major 2; gated on `packs` + `sandbox`).
+ *
+ * Isolation binds with pack EXECUTION: a host that executes third-party packs
+ * MUST enforce the eight `node-pack-sandbox-*` invariants and MUST advertise
+ * `sandbox.isolationModel ∈ wasm | process | container | vm`
+ * (`spec/v2/facets/sandbox.schema.json`); `node:vm` is not a value — it "is
+ * escapable by design" (RFC 0035 §130) and RFC 0173 §D.1 disposes of it
+ * (`spec/v2/core/security-defaults.md` §Sandbox isolation; RFC 0173 §B row C6.5).
+ *
+ * Legs:
+ *   - unaided on the gate: the facet names a mechanism from the closed set and
+ *     never `node:vm`;
+ *   - the eight behavioural legs are seam-driven through the RFC 0035 §B
+ *     misbehaving-pack registry (`host-sample-test-seams.md` §8,
+ *     `POST /v1/host/sample/test/sandbox-invoke` → `/conformance/seams/sample/test/sandbox-invoke`
+ *     under the v2 seams profile): fs read, fs write, env, network, process,
+ *     timeout, memory cap, cross-pack context. Each is `blocked` unless the
+ *     seams profile is advertised and the seam answers. `no-eval` stays
+ *     reference-impl (`ext/sandbox-runtime-notes`, RFC 0173 §D.1) and is not a
+ *     suite leg.
+ *
+ * @see spec/v2/core/security-defaults.md §Sandbox isolation
+ * @see spec/v1/host-sample-test-seams.md §8
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ISOLATION_MODELS = ['wasm', 'process', 'container', 'vm'];
+const INVOKE = `${SEAMS_PREFIX}/sample/test/sandbox-invoke`;
+
+interface SandboxError { code?: string; details?: { escapeKind?: string; requestedCapability?: string; message?: string } }
+interface InvokeResult { result?: unknown; error?: SandboxError }
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+/** Gate for every leg: packs + sandbox advertised. Returns the sandbox facet or null (reason recorded). */
+async function gated(): Promise<Record<string, unknown> | null> {
+  const doc = await discovery();
+  if (!doc) { softSkip('blocked', 'discovery unreachable'); return null; }
+  if (!(await gateFamily('packs'))) { softSkip('inapplicable', 'packs family not advertised — no pack execution, no isolation obligation (gate recorded under openwop.family.packs)'); return null; }
+  const sandbox = await gateFamily('sandbox');
+  if (!sandbox) { softSkip('inapplicable', 'sandbox family not advertised (gate recorded under openwop.family.sandbox)'); return null; }
+  return sandbox;
+}
+
+/** Drive one misbehaving typeId through the sandbox seam; null (reason recorded) when the seam is absent. */
+async function invoke(typeId: string, extra: Record<string, unknown> = {}): Promise<InvokeResult | null> {
+  const doc = await discovery();
+  if (!doc || !seamsProfileAdvertised(doc)) { softSkip('blocked', `the ${typeId} leg is seam-driven — seams profile (conformance.seamsProfile = openwop-conformance-seams-v2) not advertised`); return null; }
+  const res = await driver.post(INVOKE, { typeId, ...extra });
+  if (res.status === 404 || res.status === 403 || res.status === 405) { seamAbsent(`host advertises packs + sandbox but ${INVOKE} answered ${res.status} — the ${typeId} leg is unobservable (host-sample-test-seams.md §8)`); return null; }
+  expect(res.status, req('openwop.requirement.0173.pack-isolation.seam', 'host-sample-test-seams.md §8', `${INVOKE} MUST answer 200 { result } | 200 { error } for ${typeId}`)).toBe(200);
+  return (res.json ?? {}) as InvokeResult;
+}
+
+function expectEscape(id: string, r: InvokeResult, escapeKind: string, invariant: string): void {
+  expect(r.error?.code, req(id, 'security-defaults.md §Sandbox isolation', `${invariant}: the sandbox MUST refuse with sandbox_escape_attempt (RFC 0173 §B binds the invariant with pack execution)`)).toBe('sandbox_escape_attempt');
+  expect(r.error?.details?.escapeKind, req(id, 'host-sample-test-seams.md §8 SandboxError', `escapeKind MUST be ${escapeKind}`)).toBe(escapeKind);
+}
+
+describe('RFC 0173 §B — pack-isolation (gated on packs + sandbox)', () => {
+  it('sandbox.isolationModel names a real mechanism, never node:vm', async () => {
+    const sandbox = await gated();
+    if (!sandbox) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const model = sandbox['isolationModel'];
+    expect(
+      model,
+      req('openwop.requirement.0173.pack-isolation', 'facets/sandbox.schema.json isolationModel', 'isolationModel MUST NOT be node:vm — it is escapable by design (RFC 0035 §130) and is not a v2 value (RFC 0173 §D.1)'),
+    ).not.toBe('node:vm');
+    expect(
+      ISOLATION_MODELS,
+      req('openwop.requirement.0173.pack-isolation', 'facets/sandbox.schema.json isolationModel', `isolationModel MUST be one of ${ISOLATION_MODELS.join(' | ')} (got ${String(model)})`),
+    ).toContain(model);
+  });
+
+  it('node-pack-sandbox-fs-gated: a host filesystem read is refused', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.fs-escape-read');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expectEscape('openwop.requirement.0173.pack-isolation.fs-read', r, 'host-fs-escape', 'node-pack-sandbox-fs-gated');
+  });
+
+  it('node-pack-sandbox-fs-gated: a host filesystem write is refused', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.fs-escape-write');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expectEscape('openwop.requirement.0173.pack-isolation.fs-write', r, 'host-fs-escape', 'node-pack-sandbox-fs-gated');
+  });
+
+  it('node-pack-sandbox-no-env: the host environment does not leak', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.env-leak');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expectEscape('openwop.requirement.0173.pack-isolation.no-env', r, 'host-env-leak', 'node-pack-sandbox-no-env');
+  });
+
+  it('node-pack-sandbox-network-gated: ungated network egress is refused', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.network-escape');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expectEscape('openwop.requirement.0173.pack-isolation.network', r, 'network-escape', 'node-pack-sandbox-network-gated');
+  });
+
+  it('node-pack-sandbox-no-process: host process access is refused', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.process-escape');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expectEscape('openwop.requirement.0173.pack-isolation.no-process', r, 'host-process-escape', 'node-pack-sandbox-no-process');
+  });
+
+  it('node-pack-sandbox-timeout: exceeding wallClockLimitMs fails with sandbox_timeout', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.timeout');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expect(r.error?.code, req('openwop.requirement.0173.pack-isolation.timeout', 'security-defaults.md §Sandbox isolation', 'node-pack-sandbox-timeout: a wall-clock overrun MUST fail with sandbox_timeout')).toBe('sandbox_timeout');
+  });
+
+  it('node-pack-sandbox-memory-cap: exceeding memoryLimitBytes fails with sandbox_memory_exceeded', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.memory-bomb');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expect(r.error?.code, req('openwop.requirement.0173.pack-isolation.memory-cap', 'security-defaults.md §Sandbox isolation', 'node-pack-sandbox-memory-cap: a memory overrun MUST fail with sandbox_memory_exceeded')).toBe('sandbox_memory_exceeded');
+  });
+
+  it('node-pack-sandbox-isolated-context: a pack cannot mutate state another invocation sees', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const first = await invoke('misbehave.cross-pack-mutate');
+    if (!first) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    const second = await invoke('misbehave.cross-pack-mutate');
+    if (!second) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    for (const r of [first, second]) {
+      expect(r.error, req('openwop.requirement.0173.pack-isolation.isolated-context', 'host-sample-test-seams.md §8', 'misbehave.cross-pack-mutate is not a failure mode — it MUST return a result')).toBeUndefined();
+      expect(
+        (r.result as { shared?: unknown } | undefined)?.shared,
+        req('openwop.requirement.0173.pack-isolation.isolated-context', 'security-defaults.md §Sandbox isolation', 'node-pack-sandbox-isolated-context: result.shared MUST equal 1 on every invocation — a mutation MUST NOT leak into a fresh context'),
+      ).toBe(1);
+    }
+  });
+});

package/src/scenarios/v2-payload-registry-closed.test.ts

@@ -0,0 +1,110 @@
+/**
+ * v2 — `payload-registry-closed` (suite 2.0.0; RFC 0171 §A.4;
+ * `spec/v2/core/events.md` §"Payloads").
+ *
+ * Witness class: witnessable — unaided. `schemas/v2/run-event-payloads.schema.json`
+ * holds one closed `$defs` entry per payload and the NORMATIVE `_typeIndex`
+ * from v2 type to `$defs` key. A host MUST emit, for every registered type, a
+ * payload that validates against the entry `_typeIndex` names; a registered
+ * type with no index entry is a corpus defect and fails here too. Vendor
+ * events have no registry entry and are not checked. The payload validator is
+ * built locally (a `$ref` into the payload registry's `$defs`), because
+ * `v2Validator` resolves whole schema files only.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery } from '../lib/v2.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/events.md §Payloads';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+const PAYLOADS_ID = 'https://openwop.dev/spec/v2/run-event-payloads.schema.json';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+const TIMEOUT_MS = Number(process.env['OPENWOP_LIFECYCLE_TIMEOUT_MS'] ?? 10_000);
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+let ajv: Ajv2020 | undefined;
+function registry(): Ajv2020 {
+  if (ajv) return ajv;
+  ajv = new Ajv2020({ allErrors: true, strict: false });
+  addFormats(ajv);
+  const walk = (d: string): string[] => readdirSync(d).flatMap((n) => { const p = join(d, n); return statSync(p).isDirectory() ? walk(p) : p.endsWith('.schema.json') ? [p] : []; });
+  for (const p of walk(join(SCHEMAS_DIR, 'v2'))) { try { ajv.addSchema(JSON.parse(readFileSync(p, 'utf8')) as Record<string, unknown>); } catch { /* a duplicate $id is registered once */ } }
+  return ajv;
+}
+
+/** `_typeIndex.properties[type].$ref` → the `$defs` key. */
+function typeIndex(): Map<string, string> {
+  const schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'run-event-payloads.schema.json'), 'utf8')) as { _typeIndex?: { properties?: Record<string, { $ref?: string }> } };
+  const out = new Map<string, string>();
+  for (const [type, ref] of Object.entries(schema._typeIndex?.properties ?? {})) {
+    const key = ref.$ref?.replace(/^#\/\$defs\//, '');
+    if (key !== undefined) out.set(type, key);
+  }
+  return out;
+}
+
+function protocolTypes(): Set<string> {
+  const schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'run-event.schema.json'), 'utf8')) as { properties: { type: { oneOf: Array<{ enum?: string[] }> } } };
+  return new Set(schema.properties.type.oneOf.flatMap((b) => b.enum ?? []));
+}
+
+const defValidators = new Map<string, ReturnType<Ajv2020['compile']>>();
+function validatePayload(defKey: string, payload: unknown): { ok: boolean; errors: string } {
+  const a = registry();
+  let v = defValidators.get(defKey);
+  if (v === undefined) { v = a.compile({ $ref: `${PAYLOADS_ID}#/$defs/${defKey}` }); defValidators.set(defKey, v); }
+  return { ok: v(payload) as boolean, errors: a.errorsText(v.errors, { separator: '; ' }) };
+}
+
+async function terminalEvents(): Promise<unknown[] | { reason: string }> {
+  if (!(await discovery())) return { reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
+  const created = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }));
+  if (created === null) return { reason: 'POST /runs unreachable (fetch failed)' };
+  const runId = (created.json as { runId?: unknown } | undefined)?.runId;
+  if (created.status !== 201 || typeof runId !== 'string') return { reason: `POST /runs {workflowId: ${NOOP_WORKFLOW_ID}} answered ${created.status} ${readErrorCode(created.json) ?? ''} — the smallest valid create was refused (fixture not seeded?)`.trim() };
+  const deadline = Date.now() + TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    const snap = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
+    if (snap !== null && TERMINAL.has(String((snap.json as { status?: unknown } | undefined)?.status))) break;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+  const poll = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`));
+  if (poll === null || poll.status !== 200) return { reason: `GET /runs/{runId}/events/poll answered ${poll?.status ?? 'no response'}` };
+  const events = (poll.json as { events?: unknown } | undefined)?.events;
+  if (!Array.isArray(events) || events.length === 0) return { reason: 'the poll returned no events for a run driven to terminal status — no payload is observable' };
+  return events;
+}
+
+describe('v2 payload-registry-closed (RFC 0171 §A.4)', () => {
+  it('every registered event carries a payload that validates against its _typeIndex entry', async () => {
+    const events = await terminalEvents();
+    if (!Array.isArray(events)) return softSkip('blocked', events.reason);
+    const index = typeIndex();
+    const enumSet = protocolTypes();
+    const registered = events.filter((ev) => enumSet.has(String((ev as { type?: unknown }).type)));
+    if (registered.length === 0) return softSkip('blocked', 'the run emitted only vendor events — no registered payload to check');
+    for (const ev of registered) {
+      const type = String((ev as { type?: unknown }).type);
+      const key = index.get(type);
+      expect(key, req('openwop.requirement.0171.payload-registry-closed', DOC, `_typeIndex is normative: registered type ${type} MUST map to a $defs entry in run-event-payloads.schema.json`)).toBeDefined();
+      if (key === undefined) continue;
+      const r = validatePayload(key, (ev as { payload?: unknown }).payload);
+      expect(r.ok, req('openwop.requirement.0171.payload-registry-closed', DOC, `the payload of ${type} MUST validate against $defs/${key} (every entry additionalProperties: false) (${r.errors})`)).toBe(true);
+    }
+  });
+});