@openwop/openwop-conformance 2.0.0-rc.0 → 2.0.0-rc.2

package/README.md

@@ -112,7 +112,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 444 scenario files under `src/scenarios/`.
+The current suite has 495 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -457,7 +457,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 444 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 495 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -34,8 +34,9 @@
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath, join } from 'node:path';
+import { createRequire } from 'node:module';
 import { createHash } from 'node:crypto';
-import { readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
@@ -43,7 +44,8 @@ import { SCHEMAS_DIR } from './lib/paths.js';
 import { readLedgerFile } from './lib/requirement-ledger.js';
 import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
-import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, } from './lib/profiles.js';
+import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
+import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
 function parseArgs(argv) {
     let baseUrl;
     let apiKey;
@@ -56,7 +58,10 @@ function parseArgs(argv) {
     // Suite 1.152.0: bundle v2 (RFC 0148) is the default. v1 stays reachable via
     // `--bundle-version 1` through the RFC 0148 migration window (ends
     // 2026-11-10) and is removed at v2.0 (spec/v1/deprecations.json).
-    let bundleVersion = '2';
+    let bundleVersion = '3';
+    let hostBuild;
+    let evidenceTier = 'self';
+    let signingKeyPath, signingKeyId, verifierKeyPath, verifierKeyId;
     let targetMajor;
     let maxWorkers = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
     for (let i = 0; i < argv.length; i++) {
@@ -110,17 +115,47 @@ function parseArgs(argv) {
                 implVersion = nextValue();
                 break;
             case '--bundle-version': {
-                const v = nextValue();
-                if (v !== '1' && v !== '2') {
-                    process.stderr.write(`--bundle-version must be 1 or 2 (got '${v}')\n`);
+                const v = argv[++i];
+                if (v !== '2' && v !== '3') {
+                    process.stderr.write(`openwop-conformance: --bundle-version must be 2 or 3 (got ${String(v)}); v1 is gone in suite 2.0.0 (RFC 0168 §E.3)\n`);
                     process.exit(2);
                 }
+                if (v === '2')
+                    process.stderr.write('openwop-conformance: --bundle-version 2 is DEPRECATED — v2 bundles stop substantiating a certification at v1 end-of-support (RFC 0168 §E.3); the default is 3.\n');
                 bundleVersion = v;
-                if (v === '1') {
-                    process.stderr.write('openwop-conformance: --bundle-version 1 is DEPRECATED (RFC 0148). A v1 bundle ceases to substantiate a new certification after 2026-11-10 and the format is removed at v2.0; omit the flag to emit bundle v2.\n');
+                break;
+            }
+            case '--host-build': {
+                const v = argv[++i] ?? '';
+                const mm = /^(image-digest|commit|artifact-sha256):(.+)$/.exec(v);
+                if (!mm) {
+                    process.stderr.write(`openwop-conformance: --host-build must be <image-digest|commit|artifact-sha256>:<id> (got ${JSON.stringify(v)})\n`);
+                    process.exit(2);
+                }
+                hostBuild = { kind: mm[1], id: mm[2] };
+                break;
+            }
+            case '--evidence-tier': {
+                const v = argv[++i];
+                if (v !== 'self' && v !== 'steward' && v !== 'independent') {
+                    process.stderr.write('openwop-conformance: --evidence-tier must be self, steward or independent\n');
+                    process.exit(2);
                 }
+                evidenceTier = v;
                 break;
             }
+            case '--signing-key':
+                signingKeyPath = argv[++i];
+                break;
+            case '--signing-key-id':
+                signingKeyId = argv[++i];
+                break;
+            case '--verifier-key':
+                verifierKeyPath = argv[++i];
+                break;
+            case '--verifier-key-id':
+                verifierKeyId = argv[++i];
+                break;
             case '--certify':
                 certify = nextValue();
                 break;
@@ -144,6 +179,12 @@ function parseArgs(argv) {
         certify,
         bundleVersion,
         targetMajor,
+        hostBuild,
+        evidenceTier,
+        signingKeyPath,
+        signingKeyId,
+        verifierKeyPath,
+        verifierKeyId,
         maxWorkers,
     };
 }
@@ -183,7 +224,11 @@ Certification (RFC 0089):
   --target-major <1|2>    Suite 2.0.0 (RFC 0168 §D.3): run the scenarios for this protocol
                           major. Default: the host's preferredVersion (RFC 0179), else
                           max(protocolVersions[]), else 1. Selection is scenario-majors.json.
-  --bundle-version <1|2>  Certification bundle format. Default 2 (corrected 2026-09-03, RFC 0168 §E.4; the text said 1 while the code set 2). Version 2 (RFC 0148
+  --host-build <k>:<id>   v3: the build identity (image-digest|commit|artifact-sha256), or OPENWOP_HOST_BUILD.
+  --signing-key <pem>     v3: Ed25519 private key (PKCS8 PEM) that signs the bundle, or OPENWOP_BUNDLE_SIGNING_KEY.
+  --signing-key-id <id>   v3: the keyId the host publishes for that key, or OPENWOP_BUNDLE_SIGNING_KEY_ID.
+  --evidence-tier <t>     v3: self | steward | independent (independent needs --verifier-key/--verifier-key-id).
+  --bundle-version <2|3>  Certification bundle format. Default 2 (corrected 2026-09-03, RFC 0168 §E.4; the text said 1 while the code set 2). Version 2 (RFC 0148
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.
@@ -245,6 +290,58 @@ function claimedProfilesFor(doc) {
         profiles.push('openwop-agent-platform');
     return profiles;
 }
+/**
+ * The v2 profile registry is a set of predicates over the DECLARATION
+ * (RFC 0169 §C.1): every listed family present as a record, every listed
+ * metadata key present. The v1 derivation cannot stand in — `isCore` wants a
+ * root `protocolVersion` plus `supportedEnvelopes`/`schemaVersions`/`limits`,
+ * shapes a closed v2 root does not have — so a major-2 run claimed NOTHING and
+ * no v2 host could ever certify. Falls back to the empty set only when the
+ * registry is genuinely absent from the layout, and says so.
+ */
+function claimedProfilesForV2(doc, conformanceRoot) {
+    // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
+    // this package — instead of guessing directory shapes. Hand-rolled candidates
+    // found the registry in a repo checkout and missed it in every published
+    // install, where npm hoists the peer to a SIBLING package dir: the probe that
+    // walked one level up landed on the `@openwop/` scope directory, not a
+    // package, so a real host run silently claimed nothing.
+    const candidates = [];
+    try {
+        const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
+        candidates.push(resolvePath(dirname(req.resolve('@openwop/spec-artifacts/package.json')), 'spec', 'v2', 'profiles.json'));
+    }
+    catch { /* not installed as a package; the repo-layout candidates below */ }
+    candidates.push(resolvePath(conformanceRoot, 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec-artifacts', 'spec', 'v2', 'profiles.json'));
+    const found = candidates.find((c) => existsSync(c));
+    if (found === undefined) {
+        process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
+        return [];
+    }
+    let registry;
+    try {
+        registry = JSON.parse(readFileSync(found, 'utf8'));
+    }
+    catch {
+        process.stderr.write(`openwop-conformance --certify: ${found} is unreadable; claimedProfiles is empty.\n`);
+        return [];
+    }
+    const root = doc;
+    const isRecord = (k) => {
+        const v = root[k];
+        return typeof v === 'object' && v !== null && !Array.isArray(v);
+    };
+    const out = [];
+    for (const p of registry.profiles ?? []) {
+        if (typeof p.id !== 'string')
+            continue;
+        const families = Array.isArray(p.predicate?.families) ? p.predicate.families.map(String) : [];
+        const metadata = Array.isArray(p.predicate?.metadata) ? p.predicate.metadata.map(String) : [];
+        if (families.every(isRecord) && metadata.every((k) => root[k] !== undefined))
+            out.push(p.id);
+    }
+    return out;
+}
 /**
  * Reduce a vitest JSON report into a per-scenario-file terminal state, keyed by
  * the test-file basename (e.g. `discovery.test.ts`) to align with the basenames
@@ -294,11 +391,14 @@ function scenarioStatesFromReport(report) {
 async function resolveTargetMajor(args, baseUrl, apiKey, conformanceRoot) {
     let major = args.targetMajor;
     let source = 'flag';
+    let dualStack = false;
     if (major === undefined && baseUrl) {
         try {
             const res = await fetch(`${baseUrl.replace(/\/$/, '')}/.well-known/openwop`, { headers: apiKey ? { authorization: `Bearer ${apiKey}` } : {} });
             const doc = (await res.json());
             const pv = doc.preferredVersion ?? (doc.protocolVersions ?? []).map((v) => v).sort((a, b) => Number(b.split('.')[0]) - Number(a.split('.')[0]))[0];
+            if ((doc.protocolVersions ?? []).some((v) => v.startsWith('2.')))
+                dualStack = true;
             if (pv) {
                 major = Number(pv.split('.')[0]) >= 2 ? 2 : 1;
                 source = doc.preferredVersion ? 'preferredVersion' : 'max(protocolVersions[])';
@@ -310,6 +410,11 @@ async function resolveTargetMajor(args, baseUrl, apiKey, conformanceRoot) {
         major = 1;
         source = 'default';
     }
+    // Through the overlap `preferredVersion` names the 1.x member (versioning.md
+    // §1.1), so auto-detection on a dual-stack host resolves to major 1 by design.
+    // Say so, or an operator reads a v1 run as the host's only option.
+    if (major === 1 && dualStack)
+        source += ' (the host also serves 2.x — pass --target-major 2 to measure it)';
     const manifest = JSON.parse(readFileSync(resolvePath(conformanceRoot, 'scenario-majors.json'), 'utf8'));
     const files = Object.entries(manifest.majors).filter(([, m]) => m.includes(major)).map(([f]) => `src/scenarios/${f}`);
     return { major, files, source };
@@ -319,10 +424,19 @@ async function runCertify(args, baseUrl, apiKey) {
     if (outPath === undefined)
         process.exit(2);
     // (a) Fetch /.well-known/openwop verbatim + its canonical-JSON SHA-256.
+    // The target is resolved FIRST: `/.well-known/openwop` is one resource whose
+    // representation the `OpenWOP-Version` header selects, and through the overlap
+    // the header-less representation is the v1 document (spec/v2/core/versioning.md
+    // §1.1). Fetching it header-less on a major-2 run captured the v1 rendering, so
+    // `claimedProfiles` came out as the v1 set and the bundle described a contract
+    // the run never measured.
+    const here = dirname(fileURLToPath(import.meta.url));
+    const conformanceRoot = resolvePath(here, '..');
+    const target = await resolveTargetMajor(args, baseUrl, apiKey, conformanceRoot);
     const discoveryUrl = `${baseUrl.replace(/\/$/, '')}/.well-known/openwop`;
     let document;
     try {
-        const resp = await fetch(discoveryUrl, { headers: { Accept: 'application/json' } });
+        const resp = await fetch(discoveryUrl, { headers: { Accept: 'application/json', ...(target.major === 2 ? { 'OpenWOP-Version': '2.0' } : {}) } });
         if (!resp.ok) {
             process.stderr.write(`openwop-conformance --certify: GET ${discoveryUrl} returned HTTP ${resp.status}.\n`);
             process.exit(2);
@@ -335,11 +449,9 @@ async function runCertify(args, baseUrl, apiKey) {
     }
     const sha256 = createHash('sha256').update(canonicalJSON(document)).digest('hex');
     // (b) Derive claimedProfiles from the captured document.
-    const claimedProfiles = claimedProfilesFor(document);
+    const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document, conformanceRoot) : claimedProfilesFor(document);
     // (c) Run the suite, capturing per-scenario terminal state via the vitest
     // JSON reporter. server-targeted scenarios live under src/scenarios/.
-    const here = dirname(fileURLToPath(import.meta.url));
-    const conformanceRoot = resolvePath(here, '..');
     const reportDir = mkdtempSync(join(tmpdir(), 'owp-certify-'));
     const reportFile = join(reportDir, 'vitest-report.json');
     // RFC 0148 §A ledger sink (S6): every scenario file records its disposition
@@ -354,7 +466,6 @@ async function runCertify(args, baseUrl, apiKey) {
         env.OPENWOP_IMPLEMENTATION_NAME = args.impl;
     if (args.implVersion)
         env.OPENWOP_IMPLEMENTATION_VERSION = args.implVersion;
-    const target = await resolveTargetMajor(args, baseUrl, apiKey, conformanceRoot);
     env.OPENWOP_TARGET_MAJOR = String(target.major);
     process.stderr.write(`openwop-conformance --certify: target major ${target.major} (${target.source}); ${target.files.length} scenario file(s)\n`);
     const vitestArgs = [
@@ -460,6 +571,90 @@ async function runCertify(args, baseUrl, apiKey) {
             '  evidence is inspectable, but it does not certify and this process exits 3.\n' +
             rejectedProfiles.map((v) => `  - ${v.profile}: ${v.unclassified.join(', ')}\n`).join(''));
     }
+    if (args.bundleVersion === '3') {
+        // ── Bundle v3 (RFC 0168 §E) ─────────────────────────────────────────────
+        const build = args.hostBuild ?? (() => {
+            const mm = /^(image-digest|commit|artifact-sha256):(.+)$/.exec(process.env['OPENWOP_HOST_BUILD'] ?? '');
+            return mm ? { kind: mm[1], id: mm[2] } : undefined;
+        })();
+        const signingKeyPem = args.signingKeyPath ? readFileSync(args.signingKeyPath, 'utf8') : process.env['OPENWOP_BUNDLE_SIGNING_KEY'];
+        const keyId = args.signingKeyId ?? process.env['OPENWOP_BUNDLE_SIGNING_KEY_ID'];
+        if (!build || !signingKeyPem || !keyId) {
+            process.stderr.write('openwop-conformance --certify: a v3 bundle needs --host-build <kind>:<id> (or OPENWOP_HOST_BUILD), --signing-key <pem> (or OPENWOP_BUNDLE_SIGNING_KEY) and --signing-key-id (or OPENWOP_BUNDLE_SIGNING_KEY_ID) — an unsigned bundle does not exist in v3 (RFC 0168 §E.2).\n');
+            process.exit(2);
+        }
+        const rows3 = derived.requirements.map((r) => ({ id: r.requirementId, scenario: r.scenarioId, result: r.disposition, ...(r.assertionCount === undefined ? {} : { assertions: r.assertionCount }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+        const totals3 = derived.totals;
+        const doc3 = document;
+        const protocolVersions = Array.isArray(doc3['protocolVersions']) ? doc3['protocolVersions'] : [String(doc3['protocolVersion'] ?? '')];
+        const preferredVersion = typeof doc3['preferredVersion'] === 'string' ? doc3['preferredVersion'] : (protocolVersions[0] ?? '');
+        // witnessCount: executed-pass rows on the profile's floor (PROFILE_FLOOR_SCENARIOS required + requiredAnyPrefix).
+        const witnessCountFor = (profile) => {
+            const floor = PROFILE_FLOOR_SCENARIOS[profile];
+            if (!floor)
+                return 0;
+            const onFloor = (scenario) => floor.required.includes(scenario) || (floor.requiredAnyPrefix ?? []).some((pre) => scenario.startsWith(pre));
+            return derived.requirements.filter((r) => r.disposition === 'executed-pass' && onFloor(r.scenarioId)).length;
+        };
+        const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
+        let relaxations;
+        if (process.env['OPENWOP_HOST_RELAXATIONS']) {
+            try {
+                relaxations = JSON.parse(process.env['OPENWOP_HOST_RELAXATIONS']);
+            }
+            catch {
+                process.stderr.write('openwop-conformance --certify: OPENWOP_HOST_RELAXATIONS is not JSON\n');
+                process.exit(2);
+            }
+        }
+        const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
+        const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')) : undefined;
+        const nonPass = rows3.filter((r) => r.result !== 'executed-pass');
+        const unsigned = {
+            bundleVersion: '3',
+            generatedAt: new Date().toISOString(),
+            suite: { name: '@openwop/openwop-conformance', version, targetMajor: target.major, specArtifactsVersion: lock?.version ?? 'repo-layout', ...(lock ? { stampSha256: lock.stampSha256 } : {}) },
+            host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}) },
+            discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion },
+            claimedProfiles: claimed3,
+            results: { totals: totals3, requirements: rows3 },
+            witnessSha256: witnessDigest(rows3),
+            assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
+            ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
+        };
+        const signature = signBundleV3(unsigned, signingKeyPem, keyId);
+        const v3 = { ...unsigned, signature };
+        if (args.evidenceTier === 'independent') {
+            const vk = args.verifierKeyPath ? readFileSync(args.verifierKeyPath, 'utf8') : process.env['OPENWOP_BUNDLE_VERIFIER_KEY'];
+            const vkId = args.verifierKeyId ?? process.env['OPENWOP_BUNDLE_VERIFIER_KEY_ID'];
+            if (!vk || !vkId) {
+                process.stderr.write('openwop-conformance --certify: --evidence-tier independent needs --verifier-key and --verifier-key-id (RFC 0168 §E.2)\n');
+                process.exit(2);
+            }
+            v3.verifierSignature = verifierSign(unsigned, vk, vkId);
+        }
+        const secrets3 = evidenceSecretsFromEnv(process.env, [apiKey, signingKeyPem]);
+        const scrubbed3 = scrubEvidence(v3, secrets3);
+        const v3Out = scrubbed3.value;
+        const audit3 = verifyBundleV3(v3Out, { hostPublicKeyPem: publicKeyFromPrivate(signingKeyPem) });
+        const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'relaxed-profile-certified', 'independent-unverifiable'].includes(r.kind));
+        if (emitterDefects.length > 0) {
+            process.stderr.write('openwop-conformance --certify: assembled v3 bundle FAILED self-verification (emitter defect):\n' + emitterDefects.map((r) => `  - [${r.kind}] ${r.detail}`).join('\n') + '\n');
+            process.exit(2);
+        }
+        const v3Schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'certification-bundle.schema.json'), 'utf8'));
+        const v3Ajv = new Ajv2020({ allErrors: true, strict: false });
+        addFormats(v3Ajv);
+        v3Ajv.addSchema(JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'ids.schema.json'), 'utf8')));
+        const v3Validate = v3Ajv.compile(v3Schema);
+        if (!v3Validate(v3Out)) {
+            process.stderr.write('openwop-conformance --certify: assembled v3 bundle FAILED schema validation:\n' + `${JSON.stringify(v3Validate.errors, null, 2)}\n`);
+            process.exit(2);
+        }
+        writeFileSync(outPath, `${JSON.stringify(v3Out, null, 2)}\n`);
+        process.stdout.write(`openwop-conformance --certify: wrote bundle v3 → ${outPath} (${rows3.length} requirement rows, ${v3Out.assertionCount} assertions, witness ${v3Out.witnessSha256.slice(0, 12)}, signed by ${keyId}; certified: ${audit3.certifiedProfiles.join(', ') || 'none'})\n`);
+        process.exit(rejectedProfiles.length > 0 ? 3 : failed.length > 0 ? 1 : 0);
+    }
     if (args.bundleVersion === '2') {
         const scenarioIds = [...passed, ...failed, ...skipped].sort();
         const manifestSha = createHash('sha256').update(scenarioIds.join('\n'), 'utf8').digest('hex');

package/dist/lib/certification-bundle-v3.js

@@ -0,0 +1,142 @@
+/**
+ * Certification bundle v3 (RFC 0168 §E; schemas/v2/certification-bundle.schema.json).
+ *
+ * What v3 adds over v2 and why:
+ *   - a closed root and `witnessSha256` over the reporter record (RFC 0148 §C
+ *     asked for it; the v2 schema listed it optional and no emitter wrote it);
+ *   - `assertionCount`, `host.build`, per-profile `evidenceTier`/`witnessCount`,
+ *     `detail` (required when any result is not executed-pass);
+ *   - an Ed25519 attestation over the canonical JSON of
+ *     { witnessSha256, host.build, suite.version, discovery.sha256 } — the same
+ *     commit rebuilt once scored 283/22 and 303/2 and nothing in the bundle could
+ *     tell them apart; the build id plus the signature can;
+ *   - `evidenceTier: independent` REQUIRES a verifier signature under a key id
+ *     distinct from the host's (RFC 0148 R5: a malicious generator fabricates
+ *     witnesses — a self-signed "independent" claim is refused, not warned).
+ *
+ * This module is schema-agnostic on purpose (the schema check is a separate step
+ * in cli.ts) and pure: it never reads the environment.
+ */
+import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from 'node:crypto';
+export const SIGNATURE_OVER = ['witnessSha256', 'host.build', 'suite.version', 'discovery.sha256'];
+/** Deterministic JSON: keys sorted at every level, no whitespace. */
+export function canonicalJSON(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJSON).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonicalJSON(value[k])}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+/** RFC 0148 §C — the digest over the reporter record (the requirement rows). */
+export function witnessDigest(rows) {
+    const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+    return createHash('sha256').update(canonicalJSON(canonicalRows), 'utf8').digest('hex');
+}
+/** The bytes the attestation covers. */
+export function attestationPayload(b) {
+    return Buffer.from(canonicalJSON({ witnessSha256: b.witnessSha256, 'host.build': b.host.build, 'suite.version': b.suite.version, 'discovery.sha256': b.discovery.sha256 }), 'utf8');
+}
+function toBase64url(buf) { return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, ''); }
+function fromBase64url(s) { return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64'); }
+export function signBundleV3(bundle, privateKeyPem, keyId) {
+    const key = createPrivateKey(privateKeyPem);
+    if (key.asymmetricKeyType !== 'ed25519')
+        throw new Error(`bundle v3 signing key must be Ed25519, got ${String(key.asymmetricKeyType)}`);
+    const sig = edSign(null, attestationPayload(bundle), key);
+    return { alg: 'ed25519', keyId, sig: toBase64url(sig), over: [...SIGNATURE_OVER] };
+}
+export function verifierSign(bundle, privateKeyPem, keyId) {
+    const key = createPrivateKey(privateKeyPem);
+    return { alg: 'ed25519', keyId, sig: toBase64url(edSign(null, attestationPayload(bundle), key)) };
+}
+export function publicKeyFromPrivate(privateKeyPem) {
+    return createPublicKey(createPrivateKey(privateKeyPem)).export({ type: 'spki', format: 'pem' });
+}
+export function verifyBundleV3(bundle, opts = {}) {
+    const rejections = [];
+    if (bundle.bundleVersion !== '3')
+        rejections.push({ kind: 'not-v3', detail: `bundleVersion is ${JSON.stringify(bundle.bundleVersion)}, expected "3"` });
+    const rows = bundle.results?.requirements ?? [];
+    const seen = new Set();
+    for (const r of rows) {
+        if (seen.has(r.id))
+            rejections.push({ kind: 'duplicate-requirement', detail: `${r.id}: more than one row (RFC 0148 §A)` });
+        seen.add(r.id);
+        if (r.result !== 'executed-pass' && !(r.detail && r.detail.trim()))
+            rejections.push({ kind: 'reason-missing', detail: `${r.id}: '${r.result}' recorded without a reason` });
+        if (r.result === 'executed-pass' && !(r.assertions && r.assertions > 0))
+            rejections.push({ kind: 'vacuous-pass', detail: `${r.id}: executed-pass with no assertions is a witness of nothing (RFC 0148 §C)` });
+    }
+    const count = (d) => rows.filter((r) => r.result === d).length;
+    const expected = { executedPass: count('executed-pass'), executedFail: count('executed-fail'), skipped: count('skipped'), inapplicable: count('inapplicable'), blocked: count('blocked') };
+    for (const k of Object.keys(expected))
+        if (bundle.results?.totals?.[k] !== expected[k])
+            rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(bundle.results?.totals?.[k])} but the rows count ${expected[k]}` });
+    const digest = witnessDigest(rows);
+    if (bundle.witnessSha256 !== digest)
+        rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows (${digest.slice(0, 12)})` });
+    const assertions = rows.reduce((n, r) => n + (r.assertions ?? 0), 0);
+    if (bundle.assertionCount !== assertions)
+        rejections.push({ kind: 'assertion-count', detail: `assertionCount is ${String(bundle.assertionCount)} but the rows sum to ${assertions}` });
+    const nonPass = rows.filter((r) => r.result !== 'executed-pass');
+    if (nonPass.length > 0 && !bundle.detail)
+        rejections.push({ kind: 'detail-missing', detail: `${nonPass.length} non-pass row(s) and no detail block` });
+    if (!bundle.host?.build?.kind || !bundle.host?.build?.id)
+        rejections.push({ kind: 'build-missing', detail: 'host.build.{kind,id} is required — a bundle attributes to a BUILD, not a commit' });
+    // Signature
+    let signatureVerified = false;
+    const sig = bundle.signature;
+    if (!sig || sig.alg !== 'ed25519' || !sig.keyId || !sig.sig)
+        rejections.push({ kind: 'signature-missing', detail: 'signature.{alg: ed25519, keyId, sig} is required in v3' });
+    else if (JSON.stringify(sig.over) !== JSON.stringify(SIGNATURE_OVER))
+        rejections.push({ kind: 'signature-over', detail: `signature.over must be ${JSON.stringify(SIGNATURE_OVER)}` });
+    else if (opts.hostPublicKeyPem) {
+        const key = createPublicKey(opts.hostPublicKeyPem);
+        signatureVerified = edVerify(null, attestationPayload(bundle), key, fromBase64url(sig.sig));
+        if (!signatureVerified)
+            rejections.push({ kind: 'signature-invalid', detail: 'the attestation does not verify under the host key' });
+    }
+    // Independent tier
+    let verifierSignatureVerified = false;
+    const claimsIndependent = (bundle.claimedProfiles ?? []).some((p) => p.evidenceTier === 'independent');
+    if (claimsIndependent) {
+        const vs = bundle.verifierSignature;
+        if (!vs || !vs.keyId || !vs.sig)
+            rejections.push({ kind: 'independent-unsigned', detail: 'evidenceTier independent requires a verifierSignature (RFC 0168 §E.2)' });
+        else if (vs.keyId === sig?.keyId || vs.keyId === bundle.host?.signingKeyId)
+            rejections.push({ kind: 'independent-self-signed', detail: 'the verifier key must be distinct from the host key (RFC 0148 R5)' });
+        else if (opts.verifierPublicKeyPem) {
+            verifierSignatureVerified = edVerify(null, attestationPayload(bundle), createPublicKey(opts.verifierPublicKeyPem), fromBase64url(vs.sig));
+            if (!verifierSignatureVerified)
+                rejections.push({ kind: 'verifier-signature-invalid', detail: 'the verifier attestation does not verify' });
+        }
+        else
+            rejections.push({ kind: 'independent-unverifiable', detail: 'an independent claim needs the verifier public key to verify; refused, not assumed' });
+    }
+    // Relaxations: a relaxed obligation's profile cannot certify (RFC 0173 §A.2).
+    const relaxed = new Set((bundle.host?.relaxations ?? []).map((r) => r.obligation.split('.')[0]));
+    const certifiedProfiles = [];
+    for (const p of bundle.claimedProfiles ?? []) {
+        if (p.certified && relaxed.size > 0 && [...relaxed].some((o) => p.id.includes(o)))
+            rejections.push({ kind: 'relaxed-profile-certified', profile: p.id, detail: `${p.id} is marked certified while a relaxation on ${[...relaxed].join(', ')} is recorded (RFC 0173 §A.2)` });
+        else if (p.certified)
+            certifiedProfiles.push(p.id);
+    }
+    if (expected.blocked > 0 && certifiedProfiles.length > 0)
+        rejections.push({ kind: 'blocked-certified', detail: `${expected.blocked} blocked row(s): a bundle with blocked > 0 does not certify (RFC 0168 §E.1)` });
+    // RFC 0168 §E.2: the verifier REFUSES, it does not warn — but a refusal is
+    // scoped to what it names. A rejection carrying a `profile` removes that
+    // profile only (a relaxation on one obligation does not poison an unrelated
+    // one, RFC 0173 §A.2); a rejection that names no profile is a statement about
+    // the bundle — a bad witness digest, an unverifiable signature, a self-signed
+    // `independent` claim, a blocked row — and nothing in it certifies.
+    const bundleWide = rejections.filter((r) => !('profile' in r) || !r.profile);
+    const scoped = new Set(rejections.map((r) => r.profile).filter((p) => typeof p === 'string'));
+    return {
+        rejections,
+        signatureVerified,
+        verifierSignatureVerified,
+        certifiedProfiles: bundleWide.length > 0 ? [] : certifiedProfiles.filter((p) => !scoped.has(p)),
+    };
+}

package/dist/lib/requirement-ids.js

@@ -69,6 +69,29 @@ export function scenarioFileOfItId(requirementId) {
         return null;
     return `${rest.slice(0, dot)}.test.ts`;
 }
+/**
+ * Every FILE-derived id back to its file: the per-test `openwop.it.<stem>.<title>`
+ * plus the per-file rows the ledger also carries, `openwop.scenario.<stem>` and
+ * `openwop.floor.<stem>`. Gate rows (`openwop.profile.*`, `openwop.family.*`),
+ * explicit `req()` ids and the `openwop.floor.any.<prefix>` GROUP name no single
+ * file and return null. A caller that understood only `it` ids read a per-file
+ * row as an un-cited requirement and demanded a `req()` literal that, by
+ * construction, never exists.
+ */
+export function scenarioFileOfId(requirementId) {
+    const it = scenarioFileOfItId(requirementId);
+    if (it !== null)
+        return it;
+    for (const prefix of ['openwop.scenario.', 'openwop.floor.']) {
+        if (!requirementId.startsWith(prefix))
+            continue;
+        const rest = requirementId.slice(prefix.length);
+        if (rest.length === 0 || rest.startsWith('any.'))
+            return null;
+        return `${rest}.test.ts`;
+    }
+    return null;
+}
 /**
  * Collision suffixing: the first occurrence keeps the bare id, later ones get
  * `~2`, `~3`, … Keyed per file so a worker running many files never crosses

package/dist/lib/requirement-ledger.js

@@ -63,6 +63,7 @@ export function recordRequirement(requirementId, disposition, detail, extras) {
         disposition,
         ...(detail === undefined ? {} : { detail }),
         ...(extras?.assertionCount === undefined ? {} : { assertionCount: extras.assertionCount }),
+        ...(extras?.scenarioFile === undefined ? {} : { scenarioFile: extras.scenarioFile }),
     };
     ledger.set(requirementId, entry);
     journal.push(entry);

package/dist/lib/scenario-disposition.js

@@ -241,7 +241,11 @@ document) {
     // them. This is the granularity RFC 0148 §A describes and the G8 fix.
     const emitted = new Set(rows.map((r) => r.requirementId));
     for (const e of [...ledger].sort((a, b) => a.requirementId.localeCompare(b.requirementId))) {
-        const file = scenarioFileOfItId(e.requirementId);
+        // Prefer the file the entry recorded: an explicit `req()` id
+        // (`openwop.requirement.…`) is authored, not file-derived, so deriving a
+        // file from the id alone returned null and the row was dropped — every
+        // explicit requirement id was missing from bundle v3 for that reason.
+        const file = e.scenarioFile ?? scenarioFileOfItId(e.requirementId);
         // Attribute only to files this run reported on: a worker's ledger can carry
         // rows from files outside the certified set (the suite's own lib tests, or
         // a filtered run), and those are not evidence about the host.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.0",
-  "stampSha256": "9596838d163c3c9bc51311776e20216fa6abcd9d315077af05f5301bab4fdcd9"
+  "version": "2.0.0-rc.2",
+  "stampSha256": "b238d58665762e832fcd76df7149671705ffa588969cc80737358255d29488c9"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.0",
+  "version": "2.0.0-rc.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.0"
+    "@openwop/spec-artifacts": "2.0.0-rc.2"
   }
 }