@openwop/openwop-conformance 2.0.0-rc.0 → 2.0.0-rc.2

package/src/scenarios/v2-approver-enforced.test.ts

@@ -0,0 +1,97 @@
+/**
+ * RFC 0173 §B — `approver-enforced` (suite 2.0.0, target major 2; gated on `interrupt` + `refKinds`).
+ *
+ * Enforcement is an obligation of the fields, not a discovery flag: a host that
+ * advertises `interrupt` MUST refuse a resolver not in `approversList`
+ * everywhere, and MUST enforce `approverGroupRefs` / `approverRoleRefs` where
+ * `refKinds` includes `group` / `role` (`spec/v2/core/interrupt.md` §Approver
+ * enforcement; security-defaults.md §Approver enforcement; RFC 0173 §B row C6.4).
+ *
+ * Gate: the `interrupt` family with a `refKinds[]` facet
+ * (`spec/v2/facets/interrupt.schema.json`). Absent facet ⇒ `inapplicable`.
+ *
+ * What the suite can drive: it holds ONE bearer. A fixture whose approval gate
+ * names a synthetic principal the suite is not (`conformance-approval-approvers`,
+ * approversList: ["urn:conformance:listed-approver"]) makes the suite's own
+ * bearer the non-listed resolver by construction. No such fixture ships in
+ * `conformance/fixtures/` (`conformance-approval` has no approversList), so a
+ * host that does not advertise it records `blocked` naming it.
+ *
+ * @see spec/v2/core/interrupt.md §Approver enforcement
+ * @see spec/v2/core/security-defaults.md §Approver enforcement
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+/** An approval fixture whose `approversList` names a principal the suite's bearer is not. */
+const FIXTURE = 'conformance-approval-approvers';
+const NODE_ID = 'gate';
+const REF_KINDS = ['principal', 'group', 'role'];
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+async function waitStatus(runId: string, wanted: ReadonlySet<string>, timeoutMs: number): Promise<string | null> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const res = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+    const status = res.status === 200 ? String((res.json as { status?: unknown } | null)?.status ?? '') : null;
+    if (status !== null && wanted.has(status)) return status;
+    if (Date.now() > deadline) return status;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+}
+
+describe('RFC 0173 §B — approver-enforced (gated on interrupt + refKinds)', () => {
+  it('a resolver outside approversList is refused at resolve time', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const interrupt = await gateFamily('interrupt');
+    if (!interrupt) return softSkip('inapplicable', 'interrupt family not advertised (gate recorded under openwop.family.interrupt)');
+    const refKinds = interrupt['refKinds'];
+    if (!Array.isArray(refKinds)) return softSkip('inapplicable', 'interrupt.refKinds facet absent — the host advertises no approver ref kinds (interrupt.md §Approver enforcement binds approversList everywhere, but the facet is the gate this scenario keys on)');
+    for (const k of refKinds) {
+      expect(
+        REF_KINDS,
+        req('openwop.requirement.0173.approver-enforced', 'facets/interrupt.schema.json refKinds', `refKinds[] MUST be ⊆ principal | group | role (got ${String(k)})`),
+      ).toContain(k);
+    }
+    const fixtures = Array.isArray(doc['fixtures']) ? (doc['fixtures'] as unknown[]) : [];
+    if (!fixtures.includes(FIXTURE)) {
+      return softSkip('blocked', `no interrupt-raising fixture with an approversList the suite's bearer is not on — advertise \`${FIXTURE}\` (a core.approvalGate whose approversList is ["urn:conformance:listed-approver"]) so a non-listed resolve can be driven`);
+    }
+
+    const create = await driver.post('/runs', { workflowId: FIXTURE });
+    expect(create.status, req('openwop.requirement.0173.approver-enforced', 'runs.md §Create', `POST /runs MUST answer 201 for the advertised ${FIXTURE} fixture`)).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+    const status = await waitStatus(runId, new Set(['waiting-approval', 'completed', 'failed', 'cancelled']), 10_000);
+    expect(
+      status,
+      req('openwop.requirement.0173.approver-enforced', 'interrupt.md §Approver enforcement', 'the fixture MUST suspend on its approval gate (status waiting-approval) before a resolve can be attempted'),
+    ).toBe('waiting-approval');
+
+    // The suite's bearer is not `urn:conformance:listed-approver`.
+    const resolve = await driver.post(`/runs/${encodeURIComponent(runId)}/interrupts/${encodeURIComponent(NODE_ID)}`, { resumeValue: { action: 'accept' } });
+    expect(
+      resolve.status,
+      req('openwop.requirement.0173.approver-enforced', 'interrupt.md §Approver enforcement', 'a host advertising `interrupt` MUST refuse a resolver not in approversList with 403 (RFC 0173 §B — enforcement, not advice)'),
+    ).toBe(403);
+    expect(
+      ['forbidden', 'run_forbidden'],
+      req('openwop.requirement.0173.approver-enforced', 'errors.json', 'the refusal MUST carry a registered 403 code (forbidden | run_forbidden) in the canonical envelope'),
+    ).toContain(readErrorCode(resolve.json));
+    // The gate is still pending: a refused resolve MUST NOT advance it.
+    const after = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+    expect(
+      (after.json as { status?: unknown } | null)?.status,
+      req('openwop.requirement.0173.approver-enforced', 'interrupt.md §Approver enforcement', 'a refused resolve MUST NOT resume the run — the interrupt stays pending'),
+    ).toBe('waiting-approval');
+    await driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {});
+  });
+});

package/src/scenarios/v2-assurance-downgrade-audited.test.ts

@@ -0,0 +1,75 @@
+/**
+ * v2 — `assurance-downgrade-audited` (suite 2.0.0; RFC 0170 §B.4;
+ * `spec/v2/core/identity.md` §2.3 "Minimum assurance"; RFC 0154 R3).
+ *
+ * Witness class: seam-gated (`openwop-conformance-seams-v2`). A request below
+ * the lane's `minimumAssurance` MUST be refused with
+ * `401 sender_constraint_missing`, and an audit fact MUST record the assurance
+ * actually used; a bearer fallback never inherits a sender-constrained label.
+ * Driven through the §20 workload-identity seam
+ * (`POST /conformance/seams/sample/test/workload-identity/resolve`, the
+ * v1-shaped path through `seamPath()`): an identity presented WITHOUT
+ * `keyBinding` on a `workload` lane whose floor is above `bearer` MUST be
+ * refused; an identity WITH a key binding resolves, and the seam's response is
+ * expected to surface `assurance` (the audited fact) — §20 does not yet declare
+ * that field, so its absence records `blocked` rather than a pass.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { seamPath, seamsProfileAdvertised } from '../lib/seams.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/identity.md §2.3';
+const SEAM = seamPath('/v1/host/sample/test/workload-identity/resolve');
+const IDENTITY = { scheme: 'spiffe', subject: 'spiffe://example/dispatcher', issuer: 'spiffe://example', audience: 'openwop-host' };
+const ASSURANCE = new Set(['bearer', 'sender-constrained', 'key-bound']);
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+/** The advertised workload lane when its floor is above bearer, else a reason. */
+async function gate(): Promise<{ floor: string } | { kind: 'blocked' | 'inapplicable'; reason: string }> {
+  const doc = await discovery();
+  if (!doc) return { kind: 'blocked', reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
+  if (!seamsProfileAdvertised(doc)) return { kind: 'blocked', reason: 'seams profile not advertised (conformance.seamsProfile !== openwop-conformance-seams-v2) — the assurance floor is seam-gated' };
+  const auth = await familyAdvertised('auth');
+  const lanes = Array.isArray(auth?.['lanes']) ? (auth['lanes'] as Array<Record<string, unknown>>) : [];
+  const workload = lanes.find((l) => l['lane'] === 'workload');
+  if (workload === undefined) return { kind: 'inapplicable', reason: 'the host does not advertise a `workload` lane' };
+  const floor = String(workload['minimumAssurance']);
+  if (floor === 'bearer') return { kind: 'inapplicable', reason: 'the workload lane advertises minimumAssurance: bearer — no request can be below the floor' };
+  return { floor };
+}
+
+describe('v2 assurance-downgrade-audited (RFC 0170 §B.4 — seam-gated)', () => {
+  it('an identity below the lane floor is refused with sender_constraint_missing', async () => {
+    const g = await gate();
+    if ('kind' in g) return softSkip(g.kind, g.reason);
+    const res = await http(() => driver.post(SEAM, { identity: IDENTITY, expectedAudience: 'openwop-host' }));
+    if (res === null) return softSkip('blocked', `${SEAM} unreachable (fetch failed)`);
+    if (res.status === 404 || res.status === 403) return seamAbsent(`${SEAM} not mounted (${res.status}) — host-sample-test-seams.md §20`);
+    expect(res.status, req('openwop.requirement.0170.assurance-downgrade-audited.refused', DOC, `the workload lane advertises minimumAssurance: ${g.floor}; an identity presented without a key binding is below the floor and MUST be refused with 401`)).toBe(401);
+    expect(readErrorCode(res.json), req('openwop.requirement.0170.assurance-downgrade-audited.refused', DOC, 'the refusal code MUST be sender_constraint_missing')).toBe('sender_constraint_missing');
+  });
+
+  it('a resolved identity records the assurance actually used, never a downgraded bearer under a sender-constrained label', async () => {
+    const g = await gate();
+    if ('kind' in g) return softSkip(g.kind, g.reason);
+    const res = await http(() => driver.post(SEAM, { identity: { ...IDENTITY, keyBinding: { method: 'mtls', thumbprintRef: 'openwop-conformance-thumbprint' } }, expectedAudience: 'openwop-host' }));
+    if (res === null) return softSkip('blocked', `${SEAM} unreachable (fetch failed)`);
+    if (res.status === 404 || res.status === 403) return seamAbsent(`${SEAM} not mounted (${res.status}) — host-sample-test-seams.md §20`);
+    if (res.status !== 200) return softSkip('blocked', `the seam refused the key-bound identity (${res.status} ${readErrorCode(res.json) ?? ''}) — the audit fact of a resolved request cannot be read`);
+    const assurance = (res.json as { assurance?: unknown } | undefined)?.assurance;
+    if (assurance === undefined) return seamAbsent('the §20 seam response carries no `assurance` field — RFC 0170 §B.4 "an audit fact MUST record the assurance actually used" is unobservable until the seam surfaces it (RFC 0154 R3)');
+    expect(ASSURANCE.has(String(assurance)), req('openwop.requirement.0170.assurance-downgrade-audited.audited', DOC, `the audited assurance MUST be one of bearer | sender-constrained | key-bound (got ${String(assurance)})`)).toBe(true);
+    expect(assurance !== 'bearer', req('openwop.requirement.0170.assurance-downgrade-audited.audited', DOC, `a key-bound presentation resolved above the ${g.floor} floor MUST NOT be recorded as bearer, and a bearer fallback MUST NOT inherit a sender-constrained label (invariant sender-constraint-no-bearer-downgrade)`)).toBe(true);
+  });
+});

package/src/scenarios/v2-bundle-v3-signed.test.ts

@@ -0,0 +1,96 @@
+/**
+ * v2-bundle-v3-signed — RFC 0168 §E.1/§E.2; `spec/v2/core/conformance.md`
+ * §"Bundle v3".
+ *
+ * Suite 2.0.0. A certification bundle validates against
+ * `schemas/v2/certification-bundle.schema.json` (closed root, `bundleVersion: "3"`),
+ * carries `witnessSha256` over the reporter record and an Ed25519 attestation
+ * over `{ witnessSha256, host.build, suite.version, discovery.sha256 }`; an
+ * `evidenceTier: independent` claim MUST carry a verifier signature under a key
+ * distinct from the host's, and the verifier MUST refuse, not warn. Unaided and
+ * fixture-based, with `lib/certification-bundle-v3.ts` as the signer/verifier:
+ *
+ *   1. §E.1 — a signed fixture validates against the schema; the same fixture
+ *      with one extra root key is rejected (closed root).
+ *   2. §E.2 — the signed fixture verifies under the host key; flipping
+ *      `witnessSha256` is refused with `witness-digest` (and the signature no
+ *      longer verifies, since the digest is inside the attestation payload).
+ *   3. §E.2 — an `independent` claim whose verifier signature uses the host's
+ *      key id is refused with `independent-self-signed`; a distinct verifier
+ *      key verifies.
+ *
+ * @see RFCS/0168-v2-evidence-and-conformance.md §E.1, §E.2
+ * @see spec/v2/core/conformance.md §"Bundle v3"
+ * @see conformance/src/lib/certification-bundle-v3.ts
+ */
+
+import { describe, it, expect } from 'vitest';
+import { generateKeyPairSync } from 'node:crypto';
+import { req } from '../lib/requirement-ids.js';
+import { v2Validator } from '../lib/v2.js';
+import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest, type BundleV3, type BundleV3Requirement } from '../lib/certification-bundle-v3.js';
+
+const SECTION = 'conformance.md §"Bundle v3" (RFC 0168 §E)';
+const HOST_KEY_ID = 'fixture-host-key';
+
+function keyPem(): string {
+  return generateKeyPairSync('ed25519').privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
+}
+
+function fixture(hostPem: string): BundleV3 {
+  const rows: BundleV3Requirement[] = [
+    { id: 'openwop.requirement.0168.bundle-v3-signed.fixture-a', scenario: 'v2-bundle-v3-signed.test.ts', result: 'executed-pass', assertions: 2 },
+    { id: 'openwop.requirement.0168.bundle-v3-signed.fixture-b', scenario: 'v2-bundle-v3-signed.test.ts', result: 'executed-pass', assertions: 1 },
+  ];
+  const unsigned: Omit<BundleV3, 'signature'> = {
+    bundleVersion: '3',
+    generatedAt: new Date().toISOString(),
+    suite: { name: '@openwop/openwop-conformance', version: '2.0.0', targetMajor: 2, specArtifactsVersion: '2.0.0' },
+    host: { name: 'fixture-host', version: '0.0.0', build: { kind: 'commit', id: 'fixture' }, signingKeyId: HOST_KEY_ID },
+    discovery: { url: 'https://host.invalid/.well-known/openwop', sha256: 'b'.repeat(64), protocolVersions: ['2.0'], preferredVersion: '2.0' },
+    claimedProfiles: [{ id: 'openwop-core-v2', evidenceTier: 'self', witnessCount: 2, certified: true }],
+    results: { totals: { executedPass: 2, executedFail: 0, skipped: 0, inapplicable: 0, blocked: 0 }, requirements: rows },
+    witnessSha256: witnessDigest(rows),
+    assertionCount: 3,
+  };
+  return { ...unsigned, signature: signBundleV3(unsigned, hostPem, HOST_KEY_ID) };
+}
+
+describe('v2-bundle-v3-signed (RFC 0168 §E)', () => {
+  it('a signed v3 bundle validates against the closed-root schema; an extra root key is rejected', () => {
+    const validate = v2Validator('certification-bundle');
+    const bundle = fixture(keyPem());
+    const ok = validate(bundle);
+    expect(ok.ok, req('openwop.requirement.0168.bundle-v3-signed.schema-closed-root', SECTION, `a signed v3 bundle with the required fields MUST validate (${ok.errors})`)).toBe(true);
+    const open = validate({ ...bundle, vendorNote: 'not a v3 field' });
+    expect(open.ok, req('openwop.requirement.0168.bundle-v3-signed.schema-closed-root', SECTION, 'the v3 root is closed — an unknown root key MUST be rejected (RFC 0168 §E.1)')).toBe(false);
+  });
+
+  it('the attestation verifies under the host key, and a flipped witnessSha256 is refused with witness-digest', () => {
+    const hostPem = keyPem();
+    const bundle = fixture(hostPem);
+    const hostPublicKeyPem = publicKeyFromPrivate(hostPem);
+    const clean = verifyBundleV3(bundle, { hostPublicKeyPem });
+    expect(clean.rejections, req('openwop.requirement.0168.bundle-v3-signed.witness-digest', SECTION, `an untampered signed bundle MUST verify with no rejections (${clean.rejections.map((r) => r.kind).join(',')})`)).toEqual([]);
+    expect(clean.signatureVerified, req('openwop.requirement.0168.bundle-v3-signed.witness-digest', SECTION, 'the Ed25519 attestation MUST verify under the host key')).toBe(true);
+    const flipped: BundleV3 = { ...bundle, witnessSha256: bundle.witnessSha256.startsWith('0') ? `1${bundle.witnessSha256.slice(1)}` : `0${bundle.witnessSha256.slice(1)}` };
+    const verdict = verifyBundleV3(flipped, { hostPublicKeyPem });
+    expect(verdict.rejections.map((r) => r.kind), req('openwop.requirement.0168.bundle-v3-signed.witness-digest', SECTION, 'a witnessSha256 that is not the digest of the rows MUST be refused with witness-digest (RFC 0148 §C)')).toContain('witness-digest');
+    expect(verdict.signatureVerified, req('openwop.requirement.0168.bundle-v3-signed.witness-digest', SECTION, 'the attestation covers witnessSha256, so a flipped digest MUST NOT verify under the host key')).toBe(false);
+  });
+
+  it('an independent claim self-signed under the host key is refused; a distinct verifier key verifies', () => {
+    const hostPem = keyPem();
+    const verifierPem = keyPem();
+    const base = fixture(hostPem);
+    const independent: BundleV3 = { ...base, claimedProfiles: [{ id: 'openwop-core-v2', evidenceTier: 'independent', witnessCount: 2, certified: true }] };
+    const selfSigned: BundleV3 = { ...independent, verifierSignature: verifierSign(independent, hostPem, HOST_KEY_ID) };
+    const refused = verifyBundleV3(selfSigned, { hostPublicKeyPem: publicKeyFromPrivate(hostPem), verifierPublicKeyPem: publicKeyFromPrivate(hostPem) });
+    expect(refused.rejections.map((r) => r.kind), req('openwop.requirement.0168.bundle-v3-signed.independent-self-signed', SECTION, 'an independent claim whose verifier key id equals the host key id MUST be refused with independent-self-signed (RFC 0148 R5)')).toContain('independent-self-signed');
+    expect(refused.certifiedProfiles, req('openwop.requirement.0168.bundle-v3-signed.independent-self-signed', SECTION, 'a refused independent claim MUST NOT certify')).not.toContain('openwop-core-v2');
+    const distinct: BundleV3 = { ...independent, verifierSignature: verifierSign(independent, verifierPem, 'fixture-verifier-key') };
+    const accepted = verifyBundleV3(distinct, { hostPublicKeyPem: publicKeyFromPrivate(hostPem), verifierPublicKeyPem: publicKeyFromPrivate(verifierPem) });
+    expect(accepted.rejections, req('openwop.requirement.0168.bundle-v3-signed.independent-self-signed', SECTION, `a distinct verifier key MUST verify with no rejections (${accepted.rejections.map((r) => r.kind).join(',')})`)).toEqual([]);
+    expect(accepted.verifierSignatureVerified, req('openwop.requirement.0168.bundle-v3-signed.independent-self-signed', SECTION, 'the verifier attestation MUST verify under the verifier key')).toBe(true);
+  });
+});

package/src/scenarios/v2-capabilities-root-closed.test.ts

@@ -0,0 +1,63 @@
+/**
+ * v2 — `capabilities-root-closed` (suite 2.0.0; RFC 0169 §A.4, §C.1;
+ * `spec/v2/core/capabilities.md` §3 "The closed root").
+ *
+ * Witness class: witnessable — unaided. The v2 representation of
+ * `/.well-known/openwop` MUST validate against `schemas/v2/capabilities.schema.json`,
+ * whose root is `additionalProperties: false`. A copy of the host's document with
+ * an unknown root key, a dotted mirror key, the v1 `capabilities` wrapper, or a
+ * root `profiles[]` injected MUST fail validation — the closure is a property of
+ * the schema artifact, so those legs run against the host's document when it is
+ * reachable and against the minimal valid root otherwise.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/capabilities.md §3';
+const MINIMAL_ROOT: Record<string, unknown> = { protocolVersions: ['2.0'], preferredVersion: '2.0' };
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+/** The host's document when reachable, else the minimal valid v2 root. */
+async function base(): Promise<Record<string, unknown>> {
+  return (await discovery()) ?? MINIMAL_ROOT;
+}
+
+describe('v2 capabilities-root-closed (RFC 0169 §A.4, §C.1)', () => {
+  it('the host document validates against capabilities.schema.json', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const validate = v2Validator('capabilities');
+    const r = validate(doc);
+    expect(r.ok, req('openwop.requirement.0169.capabilities-root-closed.valid', DOC, `the v2 discovery document MUST validate against schemas/v2/capabilities.schema.json (${r.errors})`)).toBe(true);
+  });
+
+  it('an unknown root key fails validation', async () => {
+    const validate = v2Validator('capabilities');
+    const injected = { ...(await base()), openwopConformanceUnknownRootKey: { status: 'stable', since: '2.0', witness: 'claims-check' } };
+    expect(validate(injected).ok, req('openwop.requirement.0169.capabilities-root-closed.unknown-root-key', DOC, 'any root key that is not a metadata key, a declared family, or `extensions` MUST fail validation')).toBe(false);
+  });
+
+  it('a dotted mirror key fails validation', async () => {
+    const validate = v2Validator('capabilities');
+    const injected = { ...(await base()), 'host.replay': { status: 'stable', since: '2.0', witness: 'claims-check' } };
+    expect(validate(injected).ok, req('openwop.requirement.0169.capabilities-root-closed.dotted-key', DOC, 'a dotted key (the v1 `host.<family>` mirror) MUST fail validation at the closed root')).toBe(false);
+  });
+
+  it('the v1 `capabilities` wrapper fails validation', async () => {
+    const validate = v2Validator('capabilities');
+    const injected = { ...(await base()), capabilities: {} };
+    expect(validate(injected).ok, req('openwop.requirement.0169.capabilities-root-closed.wrapper', DOC, 'the v1 `capabilities` wrapper MUST fail validation at the closed root (migration row C2.1)')).toBe(false);
+  });
+
+  it('a root `profiles[]` fails validation', async () => {
+    const validate = v2Validator('capabilities');
+    const injected = { ...(await base()), profiles: ['openwop-discovery-core'] };
+    expect(validate(injected).ok, req('openwop.requirement.0169.capabilities-root-closed.profiles', 'spec/v2/core/capabilities.md §7', 'no `profiles[]` exists at the v2 root; a host that emits one MUST fail schema validation (row C2.10)')).toBe(false);
+  });
+});

package/src/scenarios/v2-capability-record-shape.test.ts

@@ -0,0 +1,104 @@
+/**
+ * v2 — `capability-record-shape` (suite 2.0.0; RFC 0169 §A.1–§A.3;
+ * `spec/v2/core/capabilities.md` §2 "The capability record").
+ *
+ * Witness class: witnessable — unaided. Every family record at the v2 root
+ * carries `status`, `since`, `witness`; `until` is present iff the record is
+ * not `stable`; an `until` already in the past makes the document
+ * non-conformant. Which root keys are family records is read from the
+ * generated `schemas/v2/capabilities.schema.json` (a property whose schema
+ * requires `status`, `since`, `witness`), so metadata keys (§3.1) are never
+ * mistaken for records.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { v2Discovery } from '../lib/v2.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/capabilities.md §2';
+const STATUS = new Set(['stable', 'experimental', 'deprecated']);
+const WITNESS = new Set(['witnessable-unaided', 'witnessable-gated', 'seam-gated', 'claims-check', 'negative-existence']);
+const VERSION = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+/** Root keys the generated schema declares as family records. */
+function familyKeys(): Set<string> {
+  const schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'capabilities.schema.json'), 'utf8')) as { properties?: Record<string, { required?: string[] }> };
+  const out = new Set<string>();
+  for (const [key, prop] of Object.entries(schema.properties ?? {})) {
+    const required = prop.required ?? [];
+    if (['status', 'since', 'witness'].every((r) => required.includes(r))) out.add(key);
+  }
+  return out;
+}
+
+/** The records the host actually advertises, keyed by family. */
+function records(doc: Record<string, unknown>): Array<[string, Record<string, unknown>]> {
+  const keys = familyKeys();
+  return Object.entries(doc)
+    .filter(([k, v]) => keys.has(k) && v !== null && typeof v === 'object' && !Array.isArray(v))
+    .map(([k, v]) => [k, v as Record<string, unknown>]);
+}
+
+/**
+ * `until` in the past: a date form is compared with today's UTC date; a
+ * `<major>.<minor>` form is "past" once the host already serves a version at or
+ * beyond it (the deprecation horizon has been reached on this very host).
+ */
+function untilInPast(until: string, served: string[]): boolean {
+  if (DATE.test(until)) return until < new Date().toISOString().slice(0, 10);
+  const [maj, min] = until.split('.').map(Number) as [number, number];
+  return served.some((v) => {
+    const [a, b] = v.split('.').map(Number) as [number, number];
+    return a > maj || (a === maj && b >= min);
+  });
+}
+
+describe('v2 capability-record-shape (RFC 0169 §A.1–§A.3)', () => {
+  it('every family record carries status, since and witness from the wire-legal sets', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const recs = records(doc);
+    if (recs.length === 0) return softSkip('inapplicable', 'the host advertises no family record at the v2 root (metadata only)');
+    for (const [key, rec] of recs) {
+      expect(STATUS.has(String(rec['status'])), req('openwop.requirement.0169.capability-record-shape.required-fields', DOC, `${key}.status MUST be one of stable | experimental | deprecated`)).toBe(true);
+      expect(typeof rec['since'] === 'string' && VERSION.test(rec['since']), req('openwop.requirement.0169.capability-record-shape.required-fields', DOC, `${key}.since MUST be present as <major>.<minor>`)).toBe(true);
+      expect(WITNESS.has(String(rec['witness'])), req('openwop.requirement.0169.capability-record-shape.required-fields', DOC, `${key}.witness MUST be one of the five wire-legal classes (unwitnessable MUST NOT appear on a wire record)`)).toBe(true);
+      expect('supported' in rec, req('openwop.requirement.0169.capability-record-shape.required-fields', DOC, `${key}: \`supported\` does not exist in v2 — presence of the record is the claim (§A.2)`)).toBe(false);
+    }
+  });
+
+  it('`until` is present iff the record is experimental or deprecated', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const recs = records(doc);
+    if (recs.length === 0) return softSkip('inapplicable', 'the host advertises no family record at the v2 root (metadata only)');
+    for (const [key, rec] of recs) {
+      const hasUntil = rec['until'] !== undefined;
+      const stable = rec['status'] === 'stable';
+      expect(hasUntil, req('openwop.requirement.0169.capability-record-shape.until-iff-not-stable', DOC, `${key}: \`until\` is REQUIRED when status is experimental or deprecated and MUST NOT be present when stable (status=${String(rec['status'])})`)).toBe(!stable);
+      if (hasUntil) {
+        expect(typeof rec['until'] === 'string' && (VERSION.test(rec['until']) || DATE.test(rec['until'])), req('openwop.requirement.0169.capability-record-shape.until-iff-not-stable', DOC, `${key}.until MUST be <major>.<minor> or YYYY-MM-DD`)).toBe(true);
+      }
+    }
+  });
+
+  it('no advertised record carries an `until` already in the past', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const served = Array.isArray(doc['protocolVersions']) ? (doc['protocolVersions'] as unknown[]).filter((v): v is string => typeof v === 'string') : [];
+    const dated = records(doc).filter(([, rec]) => typeof rec['until'] === 'string');
+    if (dated.length === 0) return softSkip('inapplicable', 'no advertised family record carries an `until` (every record is stable, or none is advertised)');
+    for (const [key, rec] of dated) {
+      expect(untilInPast(rec['until'] as string, served), req('openwop.requirement.0169.capability-record-shape.until-not-past', 'spec/v2/core/capabilities.md §2 (`until` in the past)', `${key}.until=${String(rec['until'])} is in the past — the document is non-conformant (a validator answers 400 until_in_past)`)).toBe(false);
+    }
+  });
+});

package/src/scenarios/v2-chain-pin-exact.test.ts

@@ -0,0 +1,118 @@
+/**
+ * v2-chain-pin-exact — RFC 0177 §E.1; `spec/v2/core/workflow-chain-packs.md`
+ * §"Exact pins".
+ *
+ * Suite 2.0.0, target major 2. Every reference a chain makes to a node type
+ * MUST pin an exact version per referenced `typeId` (`core.ai.callPrompt@1.0.0`);
+ * a host MUST refuse to register a chain whose reference carries a range or no
+ * version. Ranges are a v2.x additive follow-up.
+ *
+ *   1. a chain manifest referencing `core.ai.callPrompt@^1` is refused at
+ *      register (4xx with an error code).
+ *   2. the same chain referencing `core.ai.callPrompt@1.0.0` registers.
+ *
+ * Both go through the seams-profile publish seam
+ * (`/conformance/seams/packs-test/…`, RFC 0168 §C.2), gated on
+ * `workflowChainPacks` + the seams profile. The exact-pin manifest is first
+ * validated against `schemas/v2/workflow-chain-pack-manifest.schema.json`: the
+ * schema's `FragmentNode.typeId` pattern has no room for `@<version>` and no
+ * sibling pin field exists, so while that gap stands the legs record `blocked`
+ * naming it (RFC 0177 §E.1 schema follow-up) rather than a pass.
+ *
+ * @see RFCS/0177-v2-registry-packs-and-extension-tail.md §E.1
+ * @see spec/v2/core/workflow-chain-packs.md §"Exact pins"
+ * @see schemas/v2/workflow-chain-pack-manifest.schema.json
+ */
+
+import { describe, it, expect } from 'vitest';
+import { gzipSync } from 'node:zlib';
+import { driver } from '../lib/driver.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip, type SoftSkipKind } from '../lib/soft-skip.js';
+import { seamsProfileAdvertised, targetMajor } from '../lib/seams.js';
+import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
+
+const SECTION = 'workflow-chain-packs.md §"Exact pins" (RFC 0177 §E.1)';
+const SCHEMA_GAP = 'workflow-chain-pack-manifest.schema.json carries no per-typeId version pin (FragmentNode.typeId rejects `core.ai.callPrompt@1.0.0` and no pin field exists) — RFC 0177 §E.1 schema follow-up';
+
+function tarEntry(name: string, data: Buffer): Buffer {
+  const h = Buffer.alloc(512, 0);
+  h.write(name, 0, 100, 'utf8');
+  h.write('0000644\0', 100, 8, 'utf8');
+  h.write('0000000\0', 108, 8, 'utf8');
+  h.write('0000000\0', 116, 8, 'utf8');
+  h.write(`${data.length.toString(8).padStart(11, '0')}\0`, 124, 12, 'utf8');
+  h.write('00000000000\0', 136, 12, 'utf8');
+  h.write('        ', 148, 8, 'utf8');
+  h.write('0', 156, 1, 'utf8');
+  h.write('ustar\0', 257, 6, 'utf8');
+  h.write('00', 263, 2, 'utf8');
+  let sum = 0;
+  for (const b of h) sum += b;
+  h.write(`${sum.toString(8).padStart(6, '0')}\0 `, 148, 8, 'utf8');
+  const pad = (512 - (data.length % 512)) % 512;
+  return Buffer.concat([h, data, Buffer.alloc(pad, 0)]);
+}
+function packTarball(files: Record<string, string>): Buffer {
+  return gzipSync(Buffer.concat([...Object.entries(files).map(([n, c]) => tarEntry(n, Buffer.from(c, 'utf8'))), Buffer.alloc(1024, 0)]));
+}
+function freshName(slug: string): string {
+  return `core.openwop.v2-${slug}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function chainPack(name: string, reference: string): Record<string, unknown> {
+  return {
+    name,
+    version: '1.0.0',
+    kind: 'workflow-chain',
+    engines: { openwop: '>=2.0.0 <3.0.0' },
+    chains: [{
+      chainId: `${name}.chain`,
+      version: '1.0.0',
+      label: 'Pin fixture',
+      description: 'A one-node chain whose only reference is the pin under test.',
+      parameters: { type: 'object', properties: {} },
+      dag: { nodes: [{ id: 'n1', typeId: reference }], edges: [] },
+    }],
+  };
+}
+async function publish(manifest: Record<string, unknown>) {
+  const name = manifest['name'] as string;
+  const version = manifest['version'] as string;
+  return driver.put(`/v1/packs-test/${encodeURIComponent(name)}/-/${encodeURIComponent(version)}.tgz`, packTarball({ 'pack.json': JSON.stringify(manifest, null, 2) }), {
+    headers: { 'Content-Type': 'application/octet-stream' },
+  });
+}
+async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | null> {
+  if (targetMajor() !== 2) return { kind: 'inapplicable', reason: 'suite 2.0.0 v2 scenario: OPENWOP_TARGET_MAJOR is not 2' };
+  let doc: Record<string, unknown> | null;
+  try {
+    doc = await v2Discovery();
+  } catch {
+    doc = null;
+  }
+  if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
+  if (!(await gateFamily('workflowChainPacks'))) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise the workflowChainPacks family (RFC 0169 §A.2)' };
+  if (!seamsProfileAdvertised(doc)) return { kind: 'blocked', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only register path the suite can drive (RFC 0168 §C.1)' };
+  if (!v2Validator('workflow-chain-pack-manifest')(chainPack('core.openwop.pin-probe', 'core.ai.callPrompt@1.0.0')).ok) return { kind: 'blocked', reason: SCHEMA_GAP };
+  return null;
+}
+
+describe('v2-chain-pin-exact (RFC 0177 §E.1)', () => {
+  it('a chain reference carrying a range (core.ai.callPrompt@^1) is refused at register', async () => {
+    const skip = await preflight();
+    if (skip) return softSkip(skip.kind, skip.reason);
+    const res = await publish(chainPack(freshName('chain-range'), 'core.ai.callPrompt@^1'));
+    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    expect(res.status >= 400 && res.status < 500, req('openwop.requirement.0177.chain-pin-exact.range-refused', SECTION, `a ranged reference MUST be refused at register (got ${res.status})`)).toBe(true);
+    expect(typeof readErrorCode(res.json), req('openwop.requirement.0177.chain-pin-exact.range-refused', SECTION, 'the refusal MUST carry an error code in the canonical envelope')).toBe('string');
+  });
+
+  it('a chain reference pinning an exact version (core.ai.callPrompt@1.0.0) registers', async () => {
+    const skip = await preflight();
+    if (skip) return softSkip(skip.kind, skip.reason);
+    const res = await publish(chainPack(freshName('chain-exact'), 'core.ai.callPrompt@1.0.0'));
+    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    expect([200, 201].includes(res.status), req('openwop.requirement.0177.chain-pin-exact.exact-accepted', SECTION, `an exact pin MUST register (got ${res.status} ${readErrorCode(res.json) ?? ''})`)).toBe(true);
+  });
+});