@openwop/openwop-conformance 2.0.0-rc.0 → 2.0.0-rc.2

package/src/scenarios/v2-negotiation-authenticated.test.ts

@@ -0,0 +1,125 @@
+/**
+ * RFC 0175 §D.1 — `negotiation-authenticated` (suite 2.0.0, target major 2; gated on a2a/mcp + seams).
+ *
+ * A version-negotiation exchange MUST be authenticated: the peer identity is
+ * the caller's Subject or the host's own outbound identity, and an
+ * UNAUTHENTICATED exchange MUST NOT lower the negotiated version below
+ * `preferredVersion` (`spec/v2/core/interop.md` §Authentication; RFC 0175 §D.1,
+ * row C8.6; invariant `interop-negotiation-authenticated`).
+ *
+ * The load-bearing requirement is negative, as in the v1 silent-downgrade
+ * scenarios: an unauthenticated peer that offers only a lower version must
+ * produce either a refusal or a negotiation at `preferredVersion` — never a
+ * success at the lower version. Both legs are checked: the host's report
+ * (`negotiatedVersion`), the wire the suite's peer captured (`A2A-Version` /
+ * `MCP-Protocol-Version` on every call), and, where the seam names the run, the
+ * `negotiation.decided` event (`outcome: refused`, `reason: unauthenticated`).
+ *
+ * Driven through the §22/§23 invoke seams with `authenticated: false` and a
+ * peer that offers only the lower era the suite can speak. When the host's
+ * `preferredVersion` is already the lowest version the suite can offer there
+ * is nothing lower to offer and the leg records `blocked`.
+ *
+ * Callback-shaped (the host calls the suite's peer): unwitnessable when the
+ * host is in a separate network namespace — `../lib/host-callback.ts`.
+ *
+ * @see spec/v2/core/interop.md §Negotiation is a protocol
+ * @see SECURITY/threat-model-interop.md (interop-negotiation-authenticated)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
+import { A2AFakePeer } from '../lib/a2a-fake-peer.js';
+import { McpFakeServer } from '../lib/mcp-fake-server.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+export const REQUIRES_HOST_CALLBACK = "the host's A2A/MCP client calls a suite-owned peer offering only a lower version, under an unauthenticated principal";
+
+const A2A_LOWER = '0.3';
+const MCP_LOWER = '2025-06-18';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+interface EventRow { type?: unknown; payload?: Record<string, unknown> }
+async function decidedEvents(runId: string): Promise<EventRow[]> {
+  const res = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`);
+  const events = res.status === 200 ? ((res.json as { events?: EventRow[] } | null)?.events ?? []) : [];
+  return events.filter((e) => e.type === 'negotiation.decided');
+}
+
+async function assertNotLowered(id: string, preferred: string, lower: string, res: { status: number; json: unknown }, wireVersions: string[]): Promise<void> {
+  if (res.status < 400) {
+    const negotiated = (res.json as { negotiatedVersion?: unknown } | null)?.negotiatedVersion;
+    expect(
+      negotiated,
+      req(id, 'interop.md §Authentication', `an unauthenticated exchange MUST NOT lower the version below preferredVersion (${preferred}) — the host reports ${String(negotiated)} (RFC 0175 §D.1)`),
+    ).toBe(preferred);
+  }
+  for (const v of wireVersions) {
+    expect(
+      v,
+      req(id, 'interop.md §Authentication', `the wire toward the peer MUST NOT carry the lower version (${lower}) under an unauthenticated exchange — captured ${v}`),
+    ).not.toBe(lower);
+  }
+  const runId = (res.json as { runId?: unknown } | null)?.runId;
+  if (typeof runId !== 'string') {
+    softSkip('blocked', 'the seam answered without a runId — the negotiation.decided event for the unauthenticated exchange is not addressable from the suite');
+    return;
+  }
+  const decided = await decidedEvents(runId);
+  expect(decided.length, req(id, 'interop.md §The audit event', 'the unauthenticated exchange MUST also emit negotiation.decided (every outcome, RFC 0175 §D.3)')).toBeGreaterThan(0);
+  const last = decided[decided.length - 1]!.payload ?? {};
+  if (res.status >= 400) {
+    expect(last['outcome'], req(id, 'run-event-payloads.schema.json negotiationDecided.outcome', 'a refused unauthenticated exchange records outcome: refused')).toBe('refused');
+    expect(['unauthenticated', 'below-floor', 'unsupported'], req(id, 'run-event-payloads.schema.json negotiationDecided.reason', 'the reason names why (unauthenticated when the floor was not the cause)')).toContain(last['reason']);
+  } else {
+    expect(last['version'], req(id, 'interop.md §The audit event', 'an accepted unauthenticated exchange records the preferred version — nothing lower')).toBe(preferred);
+  }
+}
+
+describe('RFC 0175 §D.1 — negotiation-authenticated (gated on a2a/mcp + seams)', () => {
+  it('an unauthenticated A2A exchange cannot lower the version below preferredVersion', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const facet = await familyAdvertised('a2a');
+    if (!facet) return softSkip('inapplicable', 'a2a facet not advertised — no negotiation to authenticate');
+    if (!seamsProfileAdvertised(doc)) return softSkip('blocked', 'the unauthenticated exchange is driven through the seams profile — conformance.seamsProfile is not openwop-conformance-seams-v2');
+    const preferred = String(facet['preferredVersion']);
+    if (preferred === A2A_LOWER) return softSkip('blocked', `a2a.preferredVersion is ${preferred}, the lowest version the suite peer can offer — no lower version can be offered`);
+    const peer = new A2AFakePeer({ protocolVersions: ['0.3'] });
+    await peer.start();
+    try {
+      const res = await driver.post(`${SEAMS_PREFIX}/sample/a2a/invoke`, { peerUrl: peer.endpoint(), authenticated: false, peerOffersOnly: A2A_LOWER });
+      if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises a2a but ${SEAMS_PREFIX}/sample/a2a/invoke answered ${res.status} (host-sample-test-seams.md §22)`);
+      const wire = peer.invocations().filter((i) => i.method !== 'GET').map((i) => String(i.headers['a2a-version'] ?? ''));
+      await assertNotLowered('openwop.requirement.0175.negotiation-authenticated', preferred, A2A_LOWER, res, wire);
+    } finally {
+      await peer.stop();
+    }
+  });
+
+  it('an unauthenticated MCP exchange cannot lower the revision below preferredVersion', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const facet = await familyAdvertised('mcp');
+    if (!facet) return softSkip('inapplicable', 'mcp facet not advertised — no negotiation to authenticate');
+    if (!seamsProfileAdvertised(doc)) return softSkip('blocked', 'the unauthenticated exchange is driven through the seams profile — conformance.seamsProfile is not openwop-conformance-seams-v2');
+    const preferred = String(facet['preferredVersion']);
+    if (!(MCP_LOWER < preferred)) return softSkip('blocked', `mcp.preferredVersion is ${preferred}, at or below the lowest revision the suite server can offer (${MCP_LOWER}) — no lower revision can be offered`);
+    const server = new McpFakeServer({ protocolVersions: ['2025-06-18'] });
+    await server.start();
+    try {
+      const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, { serverUrl: server.endpoint(), authenticated: false });
+      if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises mcp but ${SEAMS_PREFIX}/sample/mcp/invoke answered ${res.status} (host-sample-test-seams.md §23)`);
+      const wire = server.invocations().map((i) => String(i.headers['mcp-protocol-version'] ?? ''));
+      await assertNotLowered('openwop.requirement.0175.negotiation-authenticated.mcp', preferred, MCP_LOWER, res, wire);
+    } finally {
+      await server.stop();
+    }
+  });
+});

package/src/scenarios/v2-negotiation-decided-emitted.test.ts

@@ -0,0 +1,149 @@
+/**
+ * RFC 0175 §D.3 — `negotiation-decided-emitted` (suite 2.0.0, target major 2; gated on a2a/mcp + seams).
+ *
+ * Every negotiation outcome — including the refused one — MUST emit a
+ * content-free `negotiation.decided` event on the host's own event log
+ * (`schemas/v2/run-event-payloads.schema.json#/$defs/negotiationDecided`:
+ * `{ protocol, outcome, version?, floor?, peerDigest?, reason?, at }`, the peer
+ * as a SHA-256 digest of its origin, never in clear). The event on the host's
+ * log is the NORMATIVE witness of the silent-downgrade invariants; the seams
+ * profile drives the exchange (`spec/v2/core/interop.md` §The audit event;
+ * RFC 0175 §D.3/§D.5, row C8.5).
+ *
+ * How the exchange is driven: exactly as the v1 versioned-composition
+ * scenarios do (`a2a-version-negotiation.test.ts`, `mcp-version-negotiation.test.ts`)
+ * — the host's real client path is pointed at the suite's fake peer / server
+ * through the §22/§23 invoke seams (`/conformance/seams/sample/{a2a,mcp}/invoke`
+ * under the v2 seams profile). The seam's `200` answers with the run whose log
+ * carries the event (`runId`); the event is then read on the normative surface
+ * (`GET /runs/{runId}/events/poll`). A seam answer without a `runId` leaves the
+ * log unaddressable and records `blocked`.
+ *
+ * Callback-shaped (the host calls the suite's peer): unwitnessable when the
+ * host is in a separate network namespace — `../lib/host-callback.ts`.
+ *
+ * @see spec/v2/core/interop.md §Negotiation is a protocol
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { getA2AFakePeer } from '../lib/a2a-fake-peer.js';
+import { getMcpFakeServer } from '../lib/mcp-fake-server.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+export const REQUIRES_HOST_CALLBACK = "the host's A2A/MCP client calls the suite's fake peer/server through the invoke seams; the negotiation.decided event is then read on the host's own log";
+
+const EVENT = 'negotiation.decided';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+/** Ajv over the `negotiationDecided` payload definition (self-contained — no $refs). */
+function payloadValidator(): ((p: unknown) => { ok: boolean; errors: string }) | null {
+  const path = join(SCHEMAS_DIR, 'v2', 'run-event-payloads.schema.json');
+  let def: unknown;
+  try {
+    def = (JSON.parse(readFileSync(path, 'utf8')) as { $defs?: Record<string, unknown> }).$defs?.['negotiationDecided'];
+  } catch { return null; }
+  if (!def || typeof def !== 'object') return null;
+  const ajv = new Ajv2020({ allErrors: true, strict: false });
+  addFormats(ajv);
+  const validate = ajv.compile(def as Record<string, unknown>);
+  return (p) => ({ ok: validate(p) as boolean, errors: ajv.errorsText(validate.errors, { separator: '; ' }) });
+}
+
+interface EventRow { type?: unknown; payload?: Record<string, unknown>; sequence?: unknown }
+async function eventsOf(runId: string): Promise<EventRow[]> {
+  const res = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`);
+  return res.status === 200 ? ((res.json as { events?: EventRow[] } | null)?.events ?? []) : [];
+}
+
+/** Drive one exchange; returns the seam response or null with the reason recorded. */
+async function drive(protocol: 'a2a' | 'mcp', peerUrl: string): Promise<{ status: number; body: Record<string, unknown> } | null> {
+  const path = `${SEAMS_PREFIX}/sample/${protocol}/invoke`;
+  const res = await driver.post(path, protocol === 'a2a' ? { peerUrl } : { serverUrl: peerUrl });
+  if (res.status === 404 || res.status === 403 || res.status === 405) {
+    seamAbsent(`host advertises ${protocol} but the invoke seam ${path} answered ${res.status} — the exchange cannot be driven (host-sample-test-seams.md §22/§23)`);
+    return null;
+  }
+  return { status: res.status, body: (res.json ?? {}) as Record<string, unknown> };
+}
+
+function originDigest(url: string): string {
+  return createHash('sha256').update(new URL(url).origin, 'utf8').digest('hex');
+}
+
+async function leg(protocol: 'a2a' | 'mcp', id: string): Promise<void> {
+  const doc = await discovery();
+  if (!doc) return softSkip('blocked', 'discovery unreachable');
+  const facet = await familyAdvertised(protocol);
+  if (!facet) return softSkip('inapplicable', `${protocol} facet not advertised — no negotiation to audit`);
+  if (!seamsProfileAdvertised(doc)) return softSkip('blocked', `the exchange is driven through the seams profile (RFC 0175 §D.3) — conformance.seamsProfile is not openwop-conformance-seams-v2`);
+  const peer = protocol === 'a2a' ? getA2AFakePeer() : getMcpFakeServer();
+  if (peer === null) return softSkip('blocked', `the suite ${protocol === 'a2a' ? 'A2A fake peer (OPENWOP_A2A_FAKE_PEER=true)' : 'MCP fake server (OPENWOP_MCP_FAKE_SERVER=true)'} is not started in this run`);
+  peer.reset();
+  const validate = payloadValidator();
+  if (!validate) return softSkip('blocked', 'run-event-payloads.schema.json#/$defs/negotiationDecided not readable from SCHEMAS_DIR');
+
+  const driven = await drive(protocol, peer.endpoint());
+  if (!driven) return softSkip('blocked', 'invoke seam unavailable (reason recorded above)');
+  const runId = driven.body['runId'];
+  if (typeof runId !== 'string') {
+    return softSkip('blocked', `the ${protocol} invoke seam answered ${driven.status} without a runId — the host log that carries ${EVENT} is not addressable from the suite (the seam MUST name the run whose log recorded the decision)`);
+  }
+  const events = await eventsOf(runId);
+  const decided = events.filter((e) => e.type === EVENT);
+  expect(
+    decided.length,
+    req(id, 'interop.md §The audit event', `every ${protocol} negotiation outcome MUST emit ${EVENT} on the host's own event log (RFC 0175 §D.3) — none found on run ${runId}`),
+  ).toBeGreaterThan(0);
+  const outcomeExpected = driven.status < 400 ? 'accepted' : 'refused';
+  for (const e of decided) {
+    const p = e.payload ?? {};
+    const check = validate(p);
+    expect(check.ok, req(id, 'run-event-payloads.schema.json negotiationDecided', `the payload MUST validate: ${check.errors}`)).toBe(true);
+    expect(p['protocol'], req(id, 'run-event-payloads.schema.json negotiationDecided.protocol', `protocol MUST be ${protocol}`)).toBe(protocol);
+    if (typeof p['peerDigest'] === 'string') {
+      expect(
+        p['peerDigest'],
+        req(id, 'interop.md §The audit event', 'peerDigest MUST be the SHA-256 of the peer origin — never the origin in clear (RFC 0175 §D.3)'),
+      ).toBe(originDigest(peer.endpoint()));
+    }
+    for (const v of Object.values(p)) {
+      expect(
+        typeof v === 'string' && v.includes(new URL(peer.endpoint()).host),
+        req(id, 'interop.md §The audit event', 'the event is content-free: the peer origin MUST NOT appear in clear in any field'),
+      ).toBe(false);
+    }
+  }
+  const last = decided[decided.length - 1]!.payload ?? {};
+  expect(
+    last['outcome'],
+    req(id, 'run-event-payloads.schema.json negotiationDecided.outcome', `the seam answered ${driven.status}, so the recorded outcome MUST be ${outcomeExpected}`),
+  ).toBe(outcomeExpected);
+  if (driven.status < 400) {
+    expect(
+      last['version'],
+      req(id, 'interop.md §The audit event', 'an accepted negotiation records the version the host actually used, which MUST equal the seam-reported negotiatedVersion'),
+    ).toBe(driven.body['negotiatedVersion']);
+  }
+}
+
+describe('RFC 0175 §D.3 — negotiation-decided-emitted (gated on a2a/mcp + seams)', () => {
+  it('an A2A exchange leaves negotiation.decided on the host log', async () => {
+    await leg('a2a', 'openwop.requirement.0175.negotiation-decided-emitted');
+  });
+  it('an MCP exchange leaves negotiation.decided on the host log', async () => {
+    await leg('mcp', 'openwop.requirement.0175.negotiation-decided-emitted.mcp');
+  });
+});

package/src/scenarios/v2-no-transport-advertisement.test.ts

@@ -0,0 +1,57 @@
+/**
+ * RFC 0175 §A.1 / §B.1 — `no-transport-advertisement` (suite 2.0.0, target major 2; unaided).
+ *
+ * REST and SSE are the wire. A v2 host MUST NOT advertise a transport list:
+ * `supportedTransports` does not exist in `schemas/v2/capabilities.schema.json`
+ * (row C8.2), and the `grpc` block is removed from the closed root because an
+ * unwitnessable family is not advertisable (row C8.3; RFC 0169 §A.1). A2A and
+ * MCP are compositions advertised by their own facets (`spec/v2/core/interop.md`
+ * §REST is the wire, §gRPC).
+ *
+ * Unaided: the v2 representation of `/.well-known/openwop` is enough. The
+ * schema check (closed root) is the belt; the named-key checks are the braces,
+ * so a host whose document fails validation for some other reason still gets
+ * the specific finding.
+ *
+ * @see spec/v2/core/interop.md §REST is the wire, §gRPC
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+describe('RFC 0175 §A.1/§B.1 — no-transport-advertisement (unaided)', () => {
+  it('the v2 root carries no supportedTransports and no grpc block', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    expect(
+      'supportedTransports' in doc,
+      req('openwop.requirement.0175.no-transport-advertisement', 'interop.md §REST is the wire', 'a v2 host MUST NOT advertise a transport list — `supportedTransports` does not exist in v2 (RFC 0175 §B.1, row C8.2)'),
+    ).toBe(false);
+    expect(
+      'grpc' in doc,
+      req('openwop.requirement.0175.no-transport-advertisement', 'interop.md §gRPC', 'a v2 host MUST NOT advertise a `grpc` capability block — an unwitnessable family is not advertisable (RFC 0175 §A.1, row C8.3)'),
+    ).toBe(false);
+    // Neither may hide inside a nested family: an `a2a.transports` or
+    // `mcp.supportedTransports` would be the same claim one level down.
+    for (const family of ['a2a', 'mcp']) {
+      const rec = doc[family];
+      if (rec && typeof rec === 'object') {
+        expect(
+          'supportedTransports' in (rec as Record<string, unknown>),
+          req('openwop.requirement.0175.no-transport-advertisement', 'interop.md §The facets', `${family} is a composition facet, not a transport advertisement — no supportedTransports inside it`),
+        ).toBe(false);
+      }
+    }
+    const check = v2Validator('capabilities')(doc);
+    expect(
+      check.ok,
+      req('openwop.requirement.0175.no-transport-advertisement', 'capabilities.schema.json (closed root)', `the v2 discovery document MUST validate against the closed root — a transport list or a grpc block fails it: ${check.errors}`),
+    ).toBe(true);
+  });
+});

package/src/scenarios/v2-owner-subject-required.test.ts

@@ -0,0 +1,72 @@
+/**
+ * v2 — `owner-subject-required` (suite 2.0.0; RFC 0170 §A.1;
+ * `spec/v2/core/identity.md` §1.1 "Shape").
+ *
+ * Witness class: witnessable — unaided. `RunSnapshot.owner` is
+ * `{ tenant, workspace?, subject }` with `subject` REQUIRED and validating
+ * against `schemas/v2/subject.schema.json`; `principal` / `principalKind` are
+ * removed. The run is created through `POST /runs` with the smallest valid body
+ * (the `conformance-noop` fixture); a refusal to create records `blocked` with
+ * the host's envelope.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/identity.md §1.1';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+type Created = { readonly ok: true; readonly runId: string } | { readonly ok: false; readonly reason: string };
+
+async function createRun(): Promise<Created> {
+  const res = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }));
+  if (res === null) return { ok: false, reason: 'POST /runs unreachable (fetch failed)' };
+  const runId = (res.json as { runId?: unknown } | undefined)?.runId;
+  if (res.status !== 201 || typeof runId !== 'string') {
+    return { ok: false, reason: `POST /runs {workflowId: ${NOOP_WORKFLOW_ID}} answered ${res.status} ${readErrorCode(res.json) ?? ''} — the smallest valid create was refused (fixture not seeded?)`.trim() };
+  }
+  return { ok: true, runId };
+}
+
+async function snapshot(): Promise<{ owner: Record<string, unknown> } | { reason: string }> {
+  if (!(await discovery())) return { reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
+  const created = await createRun();
+  if (!created.ok) return { reason: created.reason };
+  const res = await http(() => driver.get(`/runs/${encodeURIComponent(created.runId)}`));
+  if (res === null || res.status !== 200) return { reason: `GET /runs/{runId} answered ${res?.status ?? 'no response'} for the run just created` };
+  const owner = (res.json as { owner?: unknown } | undefined)?.owner;
+  if (owner === null || typeof owner !== 'object') return { reason: 'GET /runs/{runId} carries no `owner` object — RunSnapshot.owner is REQUIRED (schemas/v2/run-snapshot.schema.json)' };
+  return { owner: owner as Record<string, unknown> };
+}
+
+describe('v2 owner-subject-required (RFC 0170 §A.1)', () => {
+  it('owner.subject is present and validates against subject.schema.json', async () => {
+    const s = await snapshot();
+    if ('reason' in s) return softSkip('blocked', s.reason);
+    const validate = v2Validator('subject');
+    expect(s.owner['subject'], req('openwop.requirement.0170.owner-subject-required.subject', DOC, 'RunSnapshot.owner.subject is REQUIRED')).toBeDefined();
+    const r = validate(s.owner['subject']);
+    expect(r.ok, req('openwop.requirement.0170.owner-subject-required.subject', DOC, `owner.subject MUST validate against schemas/v2/subject.schema.json (issuer, subjectId, tenant, lane, kind; closed) (${r.errors})`)).toBe(true);
+    expect(typeof s.owner['tenant'], req('openwop.requirement.0170.owner-subject-required.subject', DOC, 'RunSnapshot.owner.tenant is REQUIRED')).toBe('string');
+  });
+
+  it('owner carries no principal / principalKind', async () => {
+    const s = await snapshot();
+    if ('reason' in s) return softSkip('blocked', s.reason);
+    expect(s.owner['principal'], req('openwop.requirement.0170.owner-subject-required.no-principal', DOC, '`principal` is removed from RunSnapshot.owner — subject.subjectId carries it')).toBeUndefined();
+    expect(s.owner['principalKind'], req('openwop.requirement.0170.owner-subject-required.no-principal', DOC, '`principalKind` is removed from RunSnapshot.owner — subject.kind carries it')).toBeUndefined();
+    const extra = Object.keys(s.owner).filter((k) => !['tenant', 'workspace', 'subject'].includes(k));
+    expect(extra, req('openwop.requirement.0170.owner-subject-required.no-principal', DOC, 'owner is the closed block { tenant, workspace?, subject }')).toEqual([]);
+  });
+});

package/src/scenarios/v2-pack-isolation.test.ts

@@ -0,0 +1,147 @@
+/**
+ * RFC 0173 §B — `pack-isolation` (suite 2.0.0, target major 2; gated on `packs` + `sandbox`).
+ *
+ * Isolation binds with pack EXECUTION: a host that executes third-party packs
+ * MUST enforce the eight `node-pack-sandbox-*` invariants and MUST advertise
+ * `sandbox.isolationModel ∈ wasm | process | container | vm`
+ * (`spec/v2/facets/sandbox.schema.json`); `node:vm` is not a value — it "is
+ * escapable by design" (RFC 0035 §130) and RFC 0173 §D.1 disposes of it
+ * (`spec/v2/core/security-defaults.md` §Sandbox isolation; RFC 0173 §B row C6.5).
+ *
+ * Legs:
+ *   - unaided on the gate: the facet names a mechanism from the closed set and
+ *     never `node:vm`;
+ *   - the eight behavioural legs are seam-driven through the RFC 0035 §B
+ *     misbehaving-pack registry (`host-sample-test-seams.md` §8,
+ *     `POST /v1/host/sample/test/sandbox-invoke` → `/conformance/seams/sample/test/sandbox-invoke`
+ *     under the v2 seams profile): fs read, fs write, env, network, process,
+ *     timeout, memory cap, cross-pack context. Each is `blocked` unless the
+ *     seams profile is advertised and the seam answers. `no-eval` stays
+ *     reference-impl (`ext/sandbox-runtime-notes`, RFC 0173 §D.1) and is not a
+ *     suite leg.
+ *
+ * @see spec/v2/core/security-defaults.md §Sandbox isolation
+ * @see spec/v1/host-sample-test-seams.md §8
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ISOLATION_MODELS = ['wasm', 'process', 'container', 'vm'];
+const INVOKE = `${SEAMS_PREFIX}/sample/test/sandbox-invoke`;
+
+interface SandboxError { code?: string; details?: { escapeKind?: string; requestedCapability?: string; message?: string } }
+interface InvokeResult { result?: unknown; error?: SandboxError }
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+/** Gate for every leg: packs + sandbox advertised. Returns the sandbox facet or null (reason recorded). */
+async function gated(): Promise<Record<string, unknown> | null> {
+  const doc = await discovery();
+  if (!doc) { softSkip('blocked', 'discovery unreachable'); return null; }
+  if (!(await gateFamily('packs'))) { softSkip('inapplicable', 'packs family not advertised — no pack execution, no isolation obligation (gate recorded under openwop.family.packs)'); return null; }
+  const sandbox = await gateFamily('sandbox');
+  if (!sandbox) { softSkip('inapplicable', 'sandbox family not advertised (gate recorded under openwop.family.sandbox)'); return null; }
+  return sandbox;
+}
+
+/** Drive one misbehaving typeId through the sandbox seam; null (reason recorded) when the seam is absent. */
+async function invoke(typeId: string, extra: Record<string, unknown> = {}): Promise<InvokeResult | null> {
+  const doc = await discovery();
+  if (!doc || !seamsProfileAdvertised(doc)) { softSkip('blocked', `the ${typeId} leg is seam-driven — seams profile (conformance.seamsProfile = openwop-conformance-seams-v2) not advertised`); return null; }
+  const res = await driver.post(INVOKE, { typeId, ...extra });
+  if (res.status === 404 || res.status === 403 || res.status === 405) { seamAbsent(`host advertises packs + sandbox but ${INVOKE} answered ${res.status} — the ${typeId} leg is unobservable (host-sample-test-seams.md §8)`); return null; }
+  expect(res.status, req('openwop.requirement.0173.pack-isolation.seam', 'host-sample-test-seams.md §8', `${INVOKE} MUST answer 200 { result } | 200 { error } for ${typeId}`)).toBe(200);
+  return (res.json ?? {}) as InvokeResult;
+}
+
+function expectEscape(id: string, r: InvokeResult, escapeKind: string, invariant: string): void {
+  expect(r.error?.code, req(id, 'security-defaults.md §Sandbox isolation', `${invariant}: the sandbox MUST refuse with sandbox_escape_attempt (RFC 0173 §B binds the invariant with pack execution)`)).toBe('sandbox_escape_attempt');
+  expect(r.error?.details?.escapeKind, req(id, 'host-sample-test-seams.md §8 SandboxError', `escapeKind MUST be ${escapeKind}`)).toBe(escapeKind);
+}
+
+describe('RFC 0173 §B — pack-isolation (gated on packs + sandbox)', () => {
+  it('sandbox.isolationModel names a real mechanism, never node:vm', async () => {
+    const sandbox = await gated();
+    if (!sandbox) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const model = sandbox['isolationModel'];
+    expect(
+      model,
+      req('openwop.requirement.0173.pack-isolation', 'facets/sandbox.schema.json isolationModel', 'isolationModel MUST NOT be node:vm — it is escapable by design (RFC 0035 §130) and is not a v2 value (RFC 0173 §D.1)'),
+    ).not.toBe('node:vm');
+    expect(
+      ISOLATION_MODELS,
+      req('openwop.requirement.0173.pack-isolation', 'facets/sandbox.schema.json isolationModel', `isolationModel MUST be one of ${ISOLATION_MODELS.join(' | ')} (got ${String(model)})`),
+    ).toContain(model);
+  });
+
+  it('node-pack-sandbox-fs-gated: a host filesystem read is refused', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.fs-escape-read');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expectEscape('openwop.requirement.0173.pack-isolation.fs-read', r, 'host-fs-escape', 'node-pack-sandbox-fs-gated');
+  });
+
+  it('node-pack-sandbox-fs-gated: a host filesystem write is refused', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.fs-escape-write');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expectEscape('openwop.requirement.0173.pack-isolation.fs-write', r, 'host-fs-escape', 'node-pack-sandbox-fs-gated');
+  });
+
+  it('node-pack-sandbox-no-env: the host environment does not leak', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.env-leak');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expectEscape('openwop.requirement.0173.pack-isolation.no-env', r, 'host-env-leak', 'node-pack-sandbox-no-env');
+  });
+
+  it('node-pack-sandbox-network-gated: ungated network egress is refused', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.network-escape');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expectEscape('openwop.requirement.0173.pack-isolation.network', r, 'network-escape', 'node-pack-sandbox-network-gated');
+  });
+
+  it('node-pack-sandbox-no-process: host process access is refused', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.process-escape');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expectEscape('openwop.requirement.0173.pack-isolation.no-process', r, 'host-process-escape', 'node-pack-sandbox-no-process');
+  });
+
+  it('node-pack-sandbox-timeout: exceeding wallClockLimitMs fails with sandbox_timeout', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.timeout');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expect(r.error?.code, req('openwop.requirement.0173.pack-isolation.timeout', 'security-defaults.md §Sandbox isolation', 'node-pack-sandbox-timeout: a wall-clock overrun MUST fail with sandbox_timeout')).toBe('sandbox_timeout');
+  });
+
+  it('node-pack-sandbox-memory-cap: exceeding memoryLimitBytes fails with sandbox_memory_exceeded', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const r = await invoke('misbehave.memory-bomb');
+    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    expect(r.error?.code, req('openwop.requirement.0173.pack-isolation.memory-cap', 'security-defaults.md §Sandbox isolation', 'node-pack-sandbox-memory-cap: a memory overrun MUST fail with sandbox_memory_exceeded')).toBe('sandbox_memory_exceeded');
+  });
+
+  it('node-pack-sandbox-isolated-context: a pack cannot mutate state another invocation sees', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const first = await invoke('misbehave.cross-pack-mutate');
+    if (!first) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    const second = await invoke('misbehave.cross-pack-mutate');
+    if (!second) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    for (const r of [first, second]) {
+      expect(r.error, req('openwop.requirement.0173.pack-isolation.isolated-context', 'host-sample-test-seams.md §8', 'misbehave.cross-pack-mutate is not a failure mode — it MUST return a result')).toBeUndefined();
+      expect(
+        (r.result as { shared?: unknown } | undefined)?.shared,
+        req('openwop.requirement.0173.pack-isolation.isolated-context', 'security-defaults.md §Sandbox isolation', 'node-pack-sandbox-isolated-context: result.shared MUST equal 1 on every invocation — a mutation MUST NOT leak into a fresh context'),
+      ).toBe(1);
+    }
+  });
+});