@openwop/openwop-conformance 2.0.0-rc.0 → 2.0.0-rc.2

package/src/scenarios/v2-provider-conflict.test.ts

@@ -0,0 +1,115 @@
+/**
+ * v2-provider-conflict — RFC 0177 §D.1; `spec/v2/core/connection-packs.md`
+ * §"Provider identity" and §"The qualified form".
+ *
+ * Suite 2.0.0, target major 2. A `provider.id` MUST be unique per host. When an
+ * installed pack and a built-in, or two installed packs, define the same bare
+ * id the host MUST refuse the later registration with
+ * `connection_provider_conflict` (409 in `spec/v2/errors.json`); version-based
+ * precedence is gone. A connector MAY name a provider by the qualified form
+ * `<packName>#<id>`, which resolves only to the named pack's definition.
+ *
+ * Seam-gated: driven through the RFC 0095 install/resolve seams
+ * (`POST /v1/host/sample/connection-packs/{install,resolve}`,
+ * `spec/v1/host-sample-test-seams.md` §10; the driver rewrites the v1 seam path
+ * to `/conformance/seams/sample/…` under target major 2), gated on
+ * `connections.packsSupported`.
+ *
+ *   1. install the `connection-pack-github` fixture (engines rewritten to admit
+ *      major 2), then a second pack claiming bare `github` → the later one is
+ *      refused with connection_provider_conflict. A host that ships a built-in
+ *      `github` witnesses the same rule on the FIRST install.
+ *   2. `resolve { provider: "<packName>#github" }` → resolved, source: pack.
+ *
+ * @see RFCS/0177-v2-registry-packs-and-extension-tail.md §D.1
+ * @see spec/v2/core/connection-packs.md
+ * @see spec/v1/host-sample-test-seams.md §10
+ */
+
+import { describe, it, expect } from 'vitest';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { FIXTURES_DIR } from '../lib/paths.js';
+import { driver } from '../lib/driver.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip, type SoftSkipKind } from '../lib/soft-skip.js';
+import { targetMajor } from '../lib/seams.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+
+const SECTION = 'connection-packs.md §"Provider identity" (RFC 0177 §D.1)';
+const FIXTURE = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-github.json');
+const INSTALL = '/v1/host/sample/connection-packs/install';
+const RESOLVE = '/v1/host/sample/connection-packs/resolve';
+
+type Manifest = Record<string, unknown> & { name: string; provider: Record<string, unknown> & { id: string } };
+interface InstallResult { installed?: boolean; errors?: Array<{ code?: string; path?: string }> }
+interface ResolveResult { resolved?: boolean; source?: 'pack' | 'builtin'; version?: string; code?: string }
+
+function fixture(): Manifest {
+  const m = JSON.parse(readFileSync(FIXTURE, 'utf8')) as Manifest;
+  // The v1 fixture pins `>=1.0.0`; a v2 host reads that as `<2.0.0` (RFC 0177 §A.1).
+  return { ...m, engines: { openwop: '>=2.0.0 <3.0.0' } };
+}
+function conflicting(base: Manifest): Manifest {
+  return { ...base, name: `core.openwop.v2-provider-conflict-${Date.now()}-${Math.random().toString(36).slice(2, 8)}` };
+}
+function codes(r: InstallResult | undefined): string[] {
+  return (r?.errors ?? []).map((e) => e.code ?? '').filter((c) => c.length > 0);
+}
+
+async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | null> {
+  if (targetMajor() !== 2) return { kind: 'inapplicable', reason: 'suite 2.0.0 v2 scenario: OPENWOP_TARGET_MAJOR is not 2' };
+  let doc: Record<string, unknown> | null;
+  try {
+    doc = await v2Discovery();
+  } catch {
+    doc = null;
+  }
+  if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
+  const connections = await familyAdvertised('connections');
+  if (!behaviorGate('connections.packsSupported', connections?.['packsSupported'] === true)) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise connections.packsSupported (RFC 0095 §C)' };
+  if (!existsSync(FIXTURE)) return { kind: 'blocked', reason: 'fixture connection-packs/connection-pack-github.json is absent from this layout' };
+  return null;
+}
+
+/** Install the fixture; null when the seam is unwired. */
+async function installFixture(): Promise<{ res: InstallResult | undefined; status: number } | null> {
+  const res = await driver.post(INSTALL, { manifest: fixture() });
+  if (res.status === 404 || res.status === 403) return null;
+  return { res: res.json as InstallResult | undefined, status: res.status };
+}
+
+describe('v2-provider-conflict (RFC 0177 §D.1)', () => {
+  it('two definitions of one bare provider id fail closed: the later registration is refused with connection_provider_conflict', async () => {
+    const skip = await preflight();
+    if (skip) return softSkip(skip.kind, skip.reason);
+    const first = await installFixture();
+    if (!first) return softSkip('blocked', 'RFC 0095 install seam not mounted (404/403) — connections.packsSupported advertised but /conformance/seams/sample/connection-packs/install is absent');
+    // A host that ships a built-in `github` makes the fixture the LATER
+    // registration, so the rule fires on the first install; otherwise the
+    // fixture installs and a second pack claiming bare `github` is the later one.
+    const later = first.res?.installed === false && codes(first.res).includes('connection_provider_conflict')
+      ? first.res
+      : await (async () => {
+          expect(first.res?.installed, req('openwop.requirement.0177.provider-conflict.fail-closed', SECTION, `the well-formed fixture MUST install when no other definition of github exists (got ${first.status}: ${JSON.stringify(first.res)})`)).toBe(true);
+          return (await driver.post(INSTALL, { manifest: conflicting(fixture()) })).json as InstallResult | undefined;
+        })();
+    expect(later?.installed, req('openwop.requirement.0177.provider-conflict.fail-closed', SECTION, 'the later registration of a bare provider id MUST NOT install (no version precedence)')).toBe(false);
+    expect(codes(later), req('openwop.requirement.0177.provider-conflict.fail-closed', SECTION, 'the later registration MUST be refused with connection_provider_conflict')).toContain('connection_provider_conflict');
+  });
+
+  it('the qualified form <packName>#github resolves to the named pack\'s definition', async () => {
+    const skip = await preflight();
+    if (skip) return softSkip(skip.kind, skip.reason);
+    const first = await installFixture();
+    if (!first) return softSkip('blocked', 'RFC 0095 install seam not mounted (404/403) — connections.packsSupported advertised but /conformance/seams/sample/connection-packs/install is absent');
+    if (first.res?.installed !== true) return softSkip('blocked', `the fixture did not install (${codes(first.res).join(',') || first.status}) — a host with a built-in github cannot exercise the qualified form through the pack`);
+    const packName = fixture().name;
+    const hit = await driver.post(RESOLVE, { provider: `${packName}#github` });
+    if (hit.status === 404) return softSkip('blocked', 'RFC 0095 resolve seam not mounted (404)');
+    const resolved = hit.json as ResolveResult | undefined;
+    expect(resolved?.resolved, req('openwop.requirement.0177.provider-conflict.qualified-form', 'connection-packs.md §"The qualified form" (RFC 0177 §D.1)', `${packName}#github MUST resolve (got ${JSON.stringify(resolved)})`)).toBe(true);
+    expect(resolved?.source, req('openwop.requirement.0177.provider-conflict.qualified-form', 'connection-packs.md §"The qualified form" (RFC 0177 §D.1)', 'a qualified reference resolves only to the named pack\'s definition (source: pack)')).toBe('pack');
+  });
+});

package/src/scenarios/v2-refresh-sla.test.ts

@@ -0,0 +1,78 @@
+/**
+ * RFC 0175 §D.4 — `refresh-sla` (suite 2.0.0, target major 2; unaided, gated on a2a or mcp).
+ *
+ * A host MUST re-evaluate its advertised `versions[]` / `revisions[]` against
+ * the upstream registry within the window its `refreshedAt` declares, and that
+ * window MUST NOT exceed 90 days; an advertisement older than its window is
+ * non-conformant (`spec/v2/core/interop.md` §Negotiation is a protocol — The
+ * refresh SLA; RFC 0147 R10; RFC 0175 row C8.4).
+ *
+ * `refreshedAt` is a `date` (`spec/v2/facets/a2a|mcp.schema.json`), REQUIRED on
+ * both facets. The check is against the suite's clock: `now - refreshedAt ≤ 90
+ * days`, and not in the future (a refresh date ahead of the clock is a claim
+ * about a check that has not happened). The preferred version and the floor
+ * MUST be members of the offered set, or the advertisement names something a
+ * peer cannot act on.
+ *
+ * @see spec/v2/core/interop.md §Negotiation is a protocol
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const WINDOW_DAYS = 90;
+const DAY_MS = 86_400_000;
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+describe('RFC 0175 §D.4 — refresh-sla (unaided; gated on a2a or mcp)', () => {
+  it('refreshedAt on each embedded-protocol facet is within 90 days of now', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const facets: Array<{ family: 'a2a' | 'mcp'; offered: string; preferred: string; floor: string }> = [
+      { family: 'a2a', offered: 'versions', preferred: 'preferredVersion', floor: 'minimumVersion' },
+      { family: 'mcp', offered: 'revisions', preferred: 'preferredVersion', floor: 'minimumRevision' },
+    ];
+    let checked = 0;
+    const now = Date.now();
+    for (const f of facets) {
+      const rec = await familyAdvertised(f.family);
+      if (!rec) continue;
+      checked++;
+      const refreshedAt = rec['refreshedAt'];
+      expect(
+        typeof refreshedAt === 'string' && DATE.test(refreshedAt),
+        req('openwop.requirement.0175.refresh-sla', `facets/${f.family}.schema.json refreshedAt`, `${f.family}.refreshedAt is REQUIRED and MUST be a date (got ${JSON.stringify(refreshedAt)})`),
+      ).toBe(true);
+      const at = Date.parse(`${String(refreshedAt)}T00:00:00Z`);
+      const ageDays = (now - at) / DAY_MS;
+      expect(
+        ageDays,
+        req('openwop.requirement.0175.refresh-sla', 'interop.md §The refresh SLA', `${f.family}.refreshedAt (${String(refreshedAt)}) MUST be within ${WINDOW_DAYS} days of now — an advertisement older than its window is non-conformant (RFC 0175 §D.4)`),
+      ).toBeLessThanOrEqual(WINDOW_DAYS);
+      expect(
+        ageDays,
+        req('openwop.requirement.0175.refresh-sla', 'interop.md §The refresh SLA', `${f.family}.refreshedAt (${String(refreshedAt)}) MUST NOT be in the future — a refresh that has not happened is not a refresh`),
+      ).toBeGreaterThanOrEqual(-1);
+      const offered = Array.isArray(rec[f.offered]) ? (rec[f.offered] as unknown[]) : [];
+      expect(
+        offered.length,
+        req('openwop.requirement.0175.refresh-sla', `facets/${f.family}.schema.json ${f.offered}`, `${f.family}.${f.offered}[] MUST offer at least one entry`),
+      ).toBeGreaterThan(0);
+      expect(
+        offered,
+        req('openwop.requirement.0175.refresh-sla', 'interop.md §The facets', `${f.family}.${f.preferred} MUST be one of the offered ${f.offered}[]`),
+      ).toContain(rec[f.preferred]);
+      expect(
+        offered,
+        req('openwop.requirement.0175.refresh-sla', 'interop.md §The facets', `${f.family}.${f.floor} MUST be one of the offered ${f.offered}[] — a floor below every offer refuses nothing`),
+      ).toContain(rec[f.floor]);
+    }
+    if (checked === 0) return softSkip('inapplicable', 'host advertises neither a2a nor mcp — no refreshedAt to check');
+  });
+});

package/src/scenarios/v2-relaxation-recorded.test.ts

@@ -0,0 +1,134 @@
+/**
+ * RFC 0173 §A.2 — `relaxation-recorded` (suite 2.0.0, target major 2; unaided).
+ *
+ * A relaxation is an operator setting recorded in the certification bundle
+ * (`host.relaxations[]`, bundle v3) with a durability class from a closed set,
+ * and "a bundle that records a relaxation cannot certify the profile the
+ * relaxed obligation belongs to" (`spec/v2/core/security-defaults.md`
+ * §Relaxations; RFC 0173 §A.2, row C6.8). Both halves are witnessable without a
+ * host: the suite builds a bundle v3 fixture and runs the verifier and the
+ * schema over it. No discovery fetch, no seam.
+ *
+ * Two legs:
+ *   1. `verifyBundleV3` rejects `relaxed-profile-certified` when a claimed
+ *      profile is `certified: true` while a relaxation on one of its
+ *      obligations is recorded — with a positive control (the same bundle
+ *      without the relaxation certifies) so the rejection is attributable to
+ *      the relaxation rather than to some other defect of the fixture.
+ *   2. `durability` outside `session | deployment | persisted` fails
+ *      `schemas/v2/certification-bundle.schema.json`; every member of the
+ *      closed set validates.
+ *
+ * @see spec/v2/core/security-defaults.md §Relaxations
+ * @see RFCS/0173-v2-security-defaults.md §A.2
+ */
+
+import { describe, it, expect } from 'vitest';
+import { generateKeyPairSync } from 'node:crypto';
+import { signBundleV3, verifyBundleV3, witnessDigest, type BundleV3, type BundleV3Relaxation } from '../lib/certification-bundle-v3.js';
+import { v2Validator } from '../lib/v2.js';
+import { req } from '../lib/requirement-ids.js';
+
+const host = generateKeyPairSync('ed25519');
+const hostPem = host.privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
+
+const ROWS: BundleV3['results']['requirements'] = [
+  { id: 'openwop.requirement.0173.webhook-durable-delivery', scenario: 'v2-webhook-durable-delivery.test.ts', result: 'executed-pass', assertions: 4 },
+  { id: 'openwop.requirement.0169.capabilities-root-closed', scenario: 'v2-capabilities-root-closed.test.ts', result: 'executed-pass', assertions: 3 },
+];
+
+/** A schema-valid, verifier-clean bundle v3; `relaxations` and the claimed profile vary per leg. */
+function bundle(opts: { relaxations?: BundleV3Relaxation[]; certified: boolean }): BundleV3 {
+  const unsigned: Omit<BundleV3, 'signature'> = {
+    bundleVersion: '3',
+    generatedAt: '2026-09-03T00:00:00Z',
+    suite: { name: '@openwop/openwop-conformance', version: '2.0.0', targetMajor: 2, specArtifactsVersion: '2.0.0' },
+    host: {
+      name: 'fixture-host',
+      version: '2.0.0',
+      build: { kind: 'commit', id: 'deadbeef' },
+      signingKeyId: 'host-key-1',
+      ...(opts.relaxations ? { relaxations: opts.relaxations } : {}),
+    },
+    discovery: { url: 'https://fixture.invalid/.well-known/openwop', sha256: 'a'.repeat(64), protocolVersions: ['2.0'], preferredVersion: '2.0' },
+    claimedProfiles: [
+      { id: 'openwop-webhooks', evidenceTier: 'self', witnessCount: 1, certified: opts.certified },
+      { id: 'openwop-discovery-core', evidenceTier: 'self', witnessCount: 1, certified: true },
+    ],
+    results: { totals: { executedPass: ROWS.length, executedFail: 0, skipped: 0, inapplicable: 0, blocked: 0 }, requirements: ROWS },
+    witnessSha256: witnessDigest(ROWS),
+    assertionCount: ROWS.reduce((n, r) => n + (r.assertions ?? 0), 0),
+  };
+  return { ...unsigned, signature: signBundleV3(unsigned, hostPem, 'host-key-1') };
+}
+
+const RELAXED: BundleV3Relaxation = { obligation: 'webhooks.durable-delivery', durability: 'deployment', reason: 'development deployment; no delivery queue' };
+
+describe('RFC 0173 §A.2 — relaxation-recorded (unaided, fixture bundle)', () => {
+  it('a bundle recording a relaxation cannot certify the relaxed profile', () => {
+    // Positive control first: without the relaxation the same bundle certifies
+    // `openwop-webhooks`, so the rejection below is the relaxation's, not the fixture's.
+    const control = verifyBundleV3(bundle({ certified: true }));
+    expect(
+      control.rejections,
+      req('openwop.requirement.0173.relaxation-recorded', 'security-defaults.md §Relaxations', 'control: a bundle with no relaxation and a fully witnessed profile MUST verify clean'),
+    ).toEqual([]);
+    expect(
+      control.certifiedProfiles,
+      req('openwop.requirement.0173.relaxation-recorded', 'security-defaults.md §Relaxations', 'control: the unrelaxed profile certifies'),
+    ).toContain('openwop-webhooks');
+
+    const relaxed = verifyBundleV3(bundle({ relaxations: [RELAXED], certified: true }));
+    expect(
+      relaxed.rejections.map((r) => r.kind),
+      req('openwop.requirement.0173.relaxation-recorded', 'security-defaults.md §Relaxations', 'a bundle that records a relaxation MUST NOT certify the profile the relaxed obligation belongs to (`relaxed-profile-certified`, RFC 0173 §A.2)'),
+    ).toContain('relaxed-profile-certified');
+    expect(
+      relaxed.rejections.find((r) => r.kind === 'relaxed-profile-certified')?.profile,
+      req('openwop.requirement.0173.relaxation-recorded', 'security-defaults.md §Relaxations', 'the rejection names the relaxed profile'),
+    ).toBe('openwop-webhooks');
+    expect(
+      relaxed.certifiedProfiles,
+      req('openwop.requirement.0173.relaxation-recorded', 'security-defaults.md §Relaxations', 'the relaxed profile is not in `certifiedProfiles`'),
+    ).not.toContain('openwop-webhooks');
+    // A relaxation on one obligation does not poison an unrelated profile.
+    expect(
+      relaxed.certifiedProfiles,
+      req('openwop.requirement.0173.relaxation-recorded', 'security-defaults.md §Relaxations', 'an unrelated profile still certifies — the relaxation is scoped to the obligation it names'),
+    ).toContain('openwop-discovery-core');
+
+    // A host that records the relaxation AND does not claim the profile is the honest shape.
+    const honest = verifyBundleV3(bundle({ relaxations: [RELAXED], certified: false }));
+    expect(
+      honest.rejections.map((r) => r.kind),
+      req('openwop.requirement.0173.relaxation-recorded', 'security-defaults.md §Relaxations', 'a relaxation recorded against an unclaimed profile is not a rejection — recording is the obligation, claiming is the defect'),
+    ).not.toContain('relaxed-profile-certified');
+  });
+
+  it('durability is a closed set: session | deployment | persisted', () => {
+    const validate = v2Validator('certification-bundle');
+    const withDurability = (durability: string): unknown => {
+      const b = bundle({ relaxations: [{ ...RELAXED, durability: durability as BundleV3Relaxation['durability'] }], certified: false });
+      // The verifier fixture is schema-shaped; hand it to Ajv as plain data.
+      return JSON.parse(JSON.stringify(b));
+    };
+    for (const d of ['session', 'deployment', 'persisted']) {
+      const r = validate(withDurability(d));
+      expect(
+        r.ok,
+        req('openwop.requirement.0173.relaxation-recorded.durability-closed', 'certification-bundle.schema.json host.relaxations[].durability', `durability "${d}" is a member of the closed set and MUST validate: ${r.errors}`),
+      ).toBe(true);
+    }
+    for (const d of ['permanent', 'runtime', '']) {
+      const r = validate(withDurability(d));
+      expect(
+        r.ok,
+        req('openwop.requirement.0173.relaxation-recorded.durability-closed', 'certification-bundle.schema.json host.relaxations[].durability', `durability "${d}" is outside session | deployment | persisted and MUST fail the bundle schema (RFC 0173 §A.2)`),
+      ).toBe(false);
+      expect(
+        r.errors,
+        req('openwop.requirement.0173.relaxation-recorded.durability-closed', 'certification-bundle.schema.json host.relaxations[].durability', 'the failure names the durability enum'),
+      ).toMatch(/durability|enum/);
+    }
+  });
+});

package/src/scenarios/v2-revocation-honored.test.ts

@@ -0,0 +1,66 @@
+/**
+ * v2 — `revocation-honored` (suite 2.0.0; RFC 0170 §B.3;
+ * `spec/v2/core/identity.md` §2.2 "Trust roots and revocation").
+ *
+ * Witness class: seam-gated (`openwop-conformance-seams-v2`, advertised as
+ * `conformance.seamsProfile`). Revocation exists for every lane; for the two
+ * `next-request` lanes (`api-key`, `session`) a revoked credential MUST be
+ * refused on the very next request with `401 credential_revoked`. The
+ * per-lane revoke seam RFC 0170 names ("the §20 seam family grows one leg per
+ * lane") is not yet in `spec/v1/host-sample-test-seams.md`; this scenario
+ * drives `POST /conformance/seams/sample/auth/credential/{mint,revoke}` (the
+ * v1-shaped address `/v1/host/sample/auth/credential/…` through `seamPath()`)
+ * with `{ lane }` / `{ lane, credential }` and records `blocked` when the host
+ * does not mount it. Windowed lanes (`exp-and-recheck`, `short-lived`, `rebind`)
+ * have no wire-observable "next request" and record `inapplicable`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { seamPath, seamsProfileAdvertised } from '../lib/seams.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/identity.md §2.2';
+const MINT = seamPath('/v1/host/sample/auth/credential/mint');
+const REVOKE = seamPath('/v1/host/sample/auth/credential/revoke');
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+describe('v2 revocation-honored (RFC 0170 §B.3 — seam-gated)', () => {
+  it('a revoked next-request credential is refused on the next request with credential_revoked', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    if (!seamsProfileAdvertised(doc)) return softSkip('blocked', 'seams profile not advertised (conformance.seamsProfile !== openwop-conformance-seams-v2) — revocation is seam-gated and cannot be observed from the canonical API');
+    const auth = await familyAdvertised('auth');
+    const lanes = Array.isArray(auth?.['lanes']) ? (auth['lanes'] as Array<Record<string, unknown>>) : [];
+    const nextRequest = lanes.filter((l) => l['revocation'] === 'next-request').map((l) => String(l['lane']));
+    if (nextRequest.length === 0) return softSkip('inapplicable', 'no advertised lane uses revocation: next-request (api-key / session) — windowed lanes have no wire-observable next request');
+
+    for (const lane of nextRequest) {
+      const minted = await http(() => driver.post(MINT, { lane }));
+      if (minted === null) return softSkip('blocked', `${MINT} unreachable (fetch failed)`);
+      if (minted.status === 404 || minted.status === 403) return seamAbsent(`${MINT} not mounted (${minted.status}) — the per-lane revoke seam RFC 0170 §B.3 names is not specified in host-sample-test-seams.md and this host does not serve it`);
+      const credential = (minted.json as { credential?: unknown } | undefined)?.credential;
+      expect(typeof credential, req('openwop.requirement.0170.revocation-honored', DOC, `the mint seam MUST answer { credential } for lane ${lane}`)).toBe('string');
+
+      // Positive control — the minted credential authenticates before revocation.
+      const before = await http(() => driver.get('/runs/openwop-conformance-tenant/revocationprobe0123456789', { authenticated: false, headers: { Authorization: `Bearer ${String(credential)}` } }));
+      expect(before !== null && before.status !== 401, req('openwop.requirement.0170.revocation-honored', DOC, `a freshly minted ${lane} credential MUST authenticate before revocation (got ${before?.status ?? 'no response'})`)).toBe(true);
+
+      const revoked = await http(() => driver.post(REVOKE, { lane, credential }));
+      expect(revoked !== null && revoked.status < 400, req('openwop.requirement.0170.revocation-honored', DOC, `the revoke seam MUST accept the credential it minted for lane ${lane} (got ${revoked?.status ?? 'no response'})`)).toBe(true);
+
+      const after = await http(() => driver.get('/runs/openwop-conformance-tenant/revocationprobe0123456789', { authenticated: false, headers: { Authorization: `Bearer ${String(credential)}` } }));
+      expect(after?.status, req('openwop.requirement.0170.revocation-honored', DOC, `lane ${lane} MUST refuse a revoked credential on the next request with 401`)).toBe(401);
+      expect(readErrorCode(after?.json), req('openwop.requirement.0170.revocation-honored', DOC, `the refusal code MUST be credential_revoked (lane ${lane})`)).toBe('credential_revoked');
+    }
+  });
+});

package/src/scenarios/v2-subject-link-record.test.ts

@@ -0,0 +1,102 @@
+/**
+ * v2 — `subject-link-record` (suite 2.0.0; RFC 0170 §C.1;
+ * `spec/v2/core/identity.md` §3 "The link is a record";
+ * `schemas/v2/subject-link.schema.json`).
+ *
+ * Witness class: seam-gated (`openwop-conformance-seams-v2`). Advertising both
+ * the `saml` and `scim` lanes implies the linking contract. Through the RFC
+ * 0163 seams (`POST /conformance/seams/sample/auth/scim/provision`,
+ * `POST /conformance/seams/sample/auth/saml/validate` — the v1-shaped paths
+ * through `seamPath()`) a SCIM-provisioned user and a SAML assertion carrying
+ * the same persistent NameID form a link; the record MUST validate against
+ * `subject-link.schema.json` (closed; two SubjectRefs; never legacy or
+ * anonymous), and deactivation MUST set `deniedAt` and deny the SAML path. The
+ * record is read from the seam responses (`link`) or from
+ * `GET …/auth/subject-links?externalId=`; a host that surfaces neither records
+ * `blocked`. Opt-in: `OPENWOP_TEST_SAML_IDP_URL` + `OPENWOP_TEST_SCIM_URL`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, v2Validator, familyAdvertised } from '../lib/v2.js';
+import { seamPath, seamsProfileAdvertised } from '../lib/seams.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/identity.md §3';
+const PROVISION = seamPath('/v1/host/sample/auth/scim/provision');
+const VALIDATE = seamPath('/v1/host/sample/auth/saml/validate');
+const LINKS = seamPath('/v1/host/sample/auth/subject-links');
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+type Formed = { readonly link: Record<string, unknown>; readonly externalId: string; readonly idpUrl: string; readonly scimUrl: string } | { readonly kind: 'blocked' | 'inapplicable' | 'skipped' | 'absent'; readonly reason: string };
+
+function linkOf(json: unknown): Record<string, unknown> | null {
+  const l = (json as { link?: unknown } | undefined)?.link;
+  return l !== null && typeof l === 'object' && !Array.isArray(l) ? (l as Record<string, unknown>) : null;
+}
+
+async function readLink(externalId: string): Promise<Record<string, unknown> | null> {
+  const res = await http(() => driver.get(`${LINKS}?externalId=${encodeURIComponent(externalId)}`));
+  if (res === null || res.status !== 200) return null;
+  const body = res.json as { link?: unknown; links?: unknown } | undefined;
+  const direct = linkOf(body);
+  if (direct !== null) return direct;
+  const arr = body?.links;
+  return Array.isArray(arr) && arr.length > 0 && arr[0] !== null && typeof arr[0] === 'object' ? (arr[0] as Record<string, unknown>) : null;
+}
+
+/** Provision + assert; returns the link record the seams surfaced, or a reason. */
+async function form(): Promise<Formed> {
+  const doc = await discovery();
+  if (!doc) return { kind: 'blocked', reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
+  if (!seamsProfileAdvertised(doc)) return { kind: 'blocked', reason: 'seams profile not advertised (conformance.seamsProfile !== openwop-conformance-seams-v2) — the link record is seam-gated' };
+  const auth = await familyAdvertised('auth');
+  const lanes = new Set((Array.isArray(auth?.['lanes']) ? (auth['lanes'] as Array<Record<string, unknown>>) : []).map((l) => String(l['lane'])));
+  if (!(lanes.has('saml') && lanes.has('scim'))) return { kind: 'inapplicable', reason: 'the host does not advertise both the saml and scim lanes — advertising both is what implies the linking contract (row C2.5)' };
+  const idpUrl = process.env['OPENWOP_TEST_SAML_IDP_URL'];
+  const scimUrl = process.env['OPENWOP_TEST_SCIM_URL'];
+  if (!idpUrl || !scimUrl) return { kind: 'skipped', reason: 'opt-in not supplied: OPENWOP_TEST_SAML_IDP_URL and OPENWOP_TEST_SCIM_URL are required to drive the SCIM/SAML seams' };
+
+  const externalId = `idp-op-${Date.now().toString(36)}`;
+  const provision = await http(() => driver.post(PROVISION, { scimUrl, op: 'create-user', externalId, userName: 'r.smith' }));
+  if (provision === null) return { kind: 'blocked', reason: `${PROVISION} unreachable (fetch failed)` };
+  if (provision.status === 404 || provision.status === 403) return { kind: 'absent', reason: `${PROVISION} not mounted (${provision.status})` };
+  const assertion = await http(() => driver.post(VALIDATE, { idpUrl, variant: 'valid', nameId: externalId }));
+  if (assertion === null) return { kind: 'blocked', reason: `${VALIDATE} unreachable (fetch failed)` };
+  if (assertion.status === 404 || assertion.status === 403) return { kind: 'absent', reason: `${VALIDATE} not mounted (${assertion.status})` };
+  const link = linkOf(assertion.json) ?? linkOf(provision.json) ?? (await readLink(externalId));
+  if (link === null) return { kind: 'absent', reason: `neither seam response carries \`link\` and ${LINKS}?externalId= is not served — the SubjectLink record RFC 0170 §C.1 defines is not surfaced by this host` };
+  return { link, externalId, idpUrl, scimUrl };
+}
+
+describe('v2 subject-link-record (RFC 0170 §C.1 — seam-gated)', () => {
+  it('the link formed across SCIM and SAML is a closed SubjectLink record', async () => {
+    const f = await form();
+    if ('kind' in f) return f.kind === 'absent' ? seamAbsent(f.reason) : softSkip(f.kind, f.reason);
+    const r = v2Validator('subject-link')(f.link);
+    expect(r.ok, req('openwop.requirement.0170.subject-link-record.shape', DOC, `the link MUST validate against schemas/v2/subject-link.schema.json — { a, b, keyClass, issuer, tenant, formedAt, deniedAt? }, closed, never a legacy or anonymous subject (${r.errors})`)).toBe(true);
+    const a = f.link['a'] as { issuer?: unknown; subjectId?: unknown };
+    const b = f.link['b'] as { issuer?: unknown; subjectId?: unknown };
+    expect(`${String(a.issuer)}/${String(a.subjectId)}` !== `${String(b.issuer)}/${String(b.subjectId)}`, req('openwop.requirement.0170.subject-link-record.shape', DOC, 'a link MUST join exactly two distinct subjects')).toBe(true);
+    expect(f.link['deniedAt'], req('openwop.requirement.0170.subject-link-record.shape', DOC, 'a freshly formed link carries no deniedAt')).toBeUndefined();
+  });
+
+  it('deactivation sets deniedAt and the SAML decision path consults it', async () => {
+    const f = await form();
+    if ('kind' in f) return f.kind === 'absent' ? seamAbsent(f.reason) : softSkip(f.kind, f.reason);
+    const deactivate = await http(() => driver.post(PROVISION, { scimUrl: f.scimUrl, op: 'deactivate-user', externalId: f.externalId }));
+    expect(deactivate !== null && deactivate.status < 400, req('openwop.requirement.0170.subject-link-record.denied-at', DOC, `SCIM deactivation MUST succeed (got ${deactivate?.status ?? 'no response'})`)).toBe(true);
+    const after = await http(() => driver.post(VALIDATE, { idpUrl: f.idpUrl, variant: 'valid', nameId: f.externalId }));
+    const denied = linkOf(deactivate?.json) ?? linkOf(after?.json) ?? (await readLink(f.externalId));
+    if (denied === null) return seamAbsent('the deactivated link record is not surfaced by the seams — deniedAt cannot be read');
+    expect(typeof denied['deniedAt'] === 'string' && !Number.isNaN(Date.parse(denied['deniedAt'] as string)), req('openwop.requirement.0170.subject-link-record.denied-at', DOC, 'deactivation MUST set deniedAt (date-time) on the link record')).toBe(true);
+    expect((after?.json as { authenticated?: unknown } | undefined)?.authenticated === true, req('openwop.requirement.0170.subject-link-record.denied-at', DOC, 'after deniedAt is set the SAML decision path MUST deny the linked subject (the leaver contract)')).toBe(false);
+  });
+});

package/src/scenarios/v2-unmapped-type-refused.test.ts

@@ -0,0 +1,95 @@
+/**
+ * RFC 0176 §A.3 — `unmapped-type-refused` (suite 2.0.0, target major 2;
+ * seam-gated on `openwop-conformance-seams-v2`).
+ *
+ * A type the codemap does not name and that carries no reserved vendor prefix
+ * MUST fail the read with `event_type_unmapped` (`spec/v2/errors.json`, `500`,
+ * not retriable) — a run whose log the host cannot translate is not readable,
+ * not "tolerantly" readable (`spec/v2/core/persistence.md` §The reader rule;
+ * migration row C9.3). The v1 tolerant reader (unknown type passed through) is
+ * the forbidden path.
+ *
+ * An era-2 log carrying one `foo.bar` row is seeded through the event-log seed
+ * seam (lib/era2-seed.ts); the read is driven through poll and, where `replay`
+ * is advertised, through a fork. A vendor-prefixed control (read under its own
+ * name) needs an org registered under `extensions` in `spec/v2/declaration.json`
+ * that the suite does not own, so that half is not driven.
+ *
+ * @see spec/v2/core/persistence.md §The reader rule
+ * @see spec/v2/core/events.md §Reading an era-2 log
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { era2Gate, eventsOf, forkRun, pollEvents, seedEra2Log, type SeedEvent } from '../lib/era2-seed.js';
+
+const DOC = 'spec/v2/core/persistence.md §The reader rule';
+const CODE = 'event_type_unmapped';
+const UNMAPPED = 'foo.bar';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+function unmappedLog(): SeedEvent[] {
+  const t0 = Date.parse('2026-01-15T11:00:00.000Z');
+  const ts = (i: number) => new Date(t0 + i * 1000).toISOString();
+  return [
+    { type: 'run.started', sequence: 0, payload: { workflowId: 'conformance-noop' }, timestamp: ts(0) },
+    { type: UNMAPPED, sequence: 1, payload: { note: 'not a codemap row, not a vendor org' }, timestamp: ts(1) },
+    { type: 'run.completed', sequence: 2, payload: { durationMs: 2000 }, timestamp: ts(2) },
+  ];
+}
+
+describe('RFC 0176 §A.3 — unmapped-type-refused (seam-gated)', () => {
+  it('poll over a log with an unmapped, unprefixed type fails with 500 event_type_unmapped', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const gate = era2Gate(doc);
+    if (gate !== null && !gate.ok) return softSkip(gate.kind, gate.reason);
+    const seeded = await seedEra2Log(unmappedLog(), 'completed');
+    if (!seeded.ok) return softSkip(seeded.kind, seeded.reason);
+    const res = await pollEvents(seeded.runId);
+    if (res === null) return softSkip('blocked', 'GET /runs/{runId}/events/poll unreachable (fetch failed)');
+    expect(
+      res.status,
+      req('openwop.requirement.0176.unmapped-type-refused', DOC, `a read over a log the host cannot translate MUST fail — ${CODE} is registered 500 (spec/v2/errors.json); got ${res.status}${res.status === 200 ? ` with types [${eventsOf(res.json).map((e) => String(e.type)).join(', ')}] — the tolerant reader RFC 0176 forbids` : ''}`),
+    ).toBe(500);
+    expect(
+      readErrorCode(res.json),
+      req('openwop.requirement.0176.unmapped-type-refused', DOC, `the refusal MUST name ${CODE} in the canonical envelope`),
+    ).toBe(CODE);
+    expect(
+      readRetriable(res.json) === true,
+      req('openwop.requirement.0176.unmapped-type-refused', 'spec/v2/errors.json', `${CODE} is not retriable — the log does not become translatable by asking again`),
+    ).toBe(false);
+  });
+
+  it('a fork of the same log is refused for the same reason — the rule binds every reader', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const gate = era2Gate(doc);
+    if (gate !== null && !gate.ok) return softSkip(gate.kind, gate.reason);
+    if (!(await gateFamily('replay'))) return softSkip('inapplicable', 'replay family not advertised (gate recorded under openwop.family.replay) — the fork reader has no surface');
+    const log = unmappedLog();
+    const seeded = await seedEra2Log(log, 'completed');
+    if (!seeded.ok) return softSkip(seeded.kind, seeded.reason);
+    const last = Math.max(...log.map((e) => e.sequence));
+    const fork = await forkRun(seeded.runId, { mode: 'replay', fromSeq: last });
+    if (fork === null) return softSkip('blocked', 'POST /runs/{runId}:fork unreachable (fetch failed)');
+    // The fork loads the source prefix through the storage boundary (replay.md
+    // §Replay-from-event-log internals step 1) — the unmapped row at sequence 1
+    // is inside it, so the fork MUST fail the read rather than copy the row.
+    expect(
+      fork.status,
+      req('openwop.requirement.0176.unmapped-type-refused.fork', 'spec/v2/core/replay.md §Replay-from-event-log internals', `a fork whose inherited prefix holds an unmapped type MUST fail the read with ${CODE} (500) — got ${fork.status}; a 201 copied a row the host cannot translate into a new log`),
+    ).toBe(500);
+    expect(
+      readErrorCode(fork.json),
+      req('openwop.requirement.0176.unmapped-type-refused.fork', DOC, `the fork's refusal MUST name ${CODE}`),
+    ).toBe(CODE);
+  });
+});