@openwop/openwop-conformance 2.0.0-rc.0 → 2.0.0-rc.2

package/src/scenarios/v2-fork-a-v1-run.test.ts

@@ -0,0 +1,109 @@
+/**
+ * RFC 0176 §A.5 — `fork-a-v1-run` (suite 2.0.0, target major 2; seam-gated on
+ * `openwop-conformance-seams-v2` and gated on `replay`).
+ *
+ * A v2 host MUST fork a run created before the cut (era `2`). The fork's
+ * prefix MUST be byte-equivalent to the TRANSLATED parent — the parent as read
+ * through the codemap, not its stored bytes — under RFC 0041 §C (observable
+ * output modulo clock fields and freshly minted ids), and `run.started` on the
+ * fork MUST carry the legacy Subject (`issuer: urn:openwop:legacy`,
+ * identity.md) where the parent had none (`spec/v2/core/replay.md` §Forking a
+ * v1 run; persistence.md §Forking a v1 run; RFC 0170 §A.3).
+ *
+ * The era-2 parent is seeded in v1 vocabulary with a `run.started` that
+ * carries no `owner` (a v1 payload) through the event-log seed seam
+ * (lib/era2-seed.ts); the fork is `{ mode: replay, fromSeq: <last> }` so the
+ * whole log below the terminal row is inherited history.
+ *
+ * @see spec/v2/core/replay.md §Forking a v1 run, §Byte-equivalence of the prefix
+ * @see spec/v2/core/identity.md §1.2 (the legacy subject)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { era2Gate, eventsOf, forkRun, observable, pollEvents, seedEra2Log, v1FixtureLog, type ReadEvent } from '../lib/era2-seed.js';
+
+const DOC = 'spec/v2/core/replay.md §Forking a v1 run';
+const LEGACY_ISSUER = 'urn:openwop:legacy';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+type Forked =
+  | { readonly ok: true; readonly parent: ReadEvent[]; readonly fork: ReadEvent[]; readonly fromSeq: number }
+  | { readonly ok: false; readonly kind: 'blocked' | 'inapplicable' | 'skipped'; readonly reason: string };
+
+async function forkedPair(): Promise<Forked> {
+  const doc = await discovery();
+  if (!doc) return { ok: false, kind: 'blocked', reason: 'discovery unreachable' };
+  const gate = era2Gate(doc);
+  if (gate !== null && !gate.ok) return { ok: false, kind: gate.kind, reason: gate.reason };
+  if (!(await gateFamily('replay'))) return { ok: false, kind: 'inapplicable', reason: 'replay family not advertised (gate recorded under openwop.family.replay) — forkRun has no surface' };
+  const log = v1FixtureLog();
+  const seeded = await seedEra2Log(log, 'completed');
+  if (!seeded.ok) return { ok: false, kind: seeded.kind, reason: seeded.reason };
+  const parentRead = await pollEvents(seeded.runId);
+  if (parentRead === null || parentRead.status !== 200) return { ok: false, kind: 'blocked', reason: `the translated parent could not be read — GET /runs/{runId}/events/poll answered ${parentRead?.status ?? 'no response'}` };
+  const fromSeq = Math.max(...log.map((e) => e.sequence));
+  const fork = await forkRun(seeded.runId, { mode: 'replay', fromSeq });
+  if (fork === null) return { ok: false, kind: 'blocked', reason: 'POST /runs/{runId}:fork unreachable (fetch failed)' };
+  if (fork.status !== 201) return { ok: false, kind: 'blocked', reason: `POST /runs/{runId}:fork on the era-2 parent answered ${fork.status} — the fork-a-v1-run obligation is asserted by openwop.requirement.0176.fork-a-v1-run.prefix, which records this refusal` };
+  const forkId = (fork.json as { runId?: unknown } | undefined)?.runId;
+  if (typeof forkId !== 'string') return { ok: false, kind: 'blocked', reason: 'the fork answered 201 without a runId' };
+  const forkRead = await pollEvents(forkId);
+  if (forkRead === null || forkRead.status !== 200) return { ok: false, kind: 'blocked', reason: `the fork's log could not be read — GET /runs/{forkId}/events/poll answered ${forkRead?.status ?? 'no response'}` };
+  return { ok: true, parent: eventsOf(parentRead.json), fork: eventsOf(forkRead.json), fromSeq };
+}
+
+describe('RFC 0176 §A.5 — fork-a-v1-run (seam-gated, replay)', () => {
+  it('the fork of an era-2 run is accepted and its prefix is byte-equivalent to the translated parent', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const pair = await forkedPair();
+    if (!pair.ok) {
+      // A refusal of the fork itself is the failure this leg exists to catch.
+      if (pair.reason.includes(':fork on the era-2 parent answered')) {
+        expect(pair.reason, req('openwop.requirement.0176.fork-a-v1-run.prefix', DOC, `a v2 host MUST fork a run created before the cut — ${pair.reason}`)).toBe('');
+      }
+      return softSkip(pair.kind, pair.reason);
+    }
+    const prefixOf = (events: ReadEvent[]) => events.filter((e) => typeof e.sequence === 'number' && e.sequence < pair.fromSeq).sort((a, b) => (a.sequence as number) - (b.sequence as number));
+    const parent = prefixOf(pair.parent);
+    const fork = prefixOf(pair.fork);
+    expect(parent.length, req('openwop.requirement.0176.fork-a-v1-run.prefix', DOC, `the translated parent MUST expose its prefix [0, ${pair.fromSeq}) — got ${parent.length} rows`)).toBe(pair.fromSeq);
+    expect(fork.length, req('openwop.requirement.0176.fork-a-v1-run.prefix', DOC, `the fork MUST inherit the whole prefix [0, ${pair.fromSeq}) as fixed history — got ${fork.length} rows`)).toBe(pair.fromSeq);
+    for (let i = 0; i < parent.length; i++) {
+      expect(
+        fork[i] === undefined ? null : observable(fork[i]!),
+        req('openwop.requirement.0176.fork-a-v1-run.prefix', 'spec/v2/core/replay.md §Byte-equivalence of the prefix', `sequence ${String(parent[i]!.sequence)}: the fork's row MUST be byte-equivalent (type, sequence, payload) to the TRANSLATED parent row — the parent as read through the codemap, never its stored v1 bytes (RFC 0041 §C)`),
+      ).toBe(observable(parent[i]!));
+    }
+  });
+
+  it('run.started on the fork carries the legacy Subject where the parent had none', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const pair = await forkedPair();
+    if (!pair.ok) return softSkip(pair.kind, pair.reason);
+    const started = pair.fork.find((e) => e.type === 'run.started');
+    expect(started, req('openwop.requirement.0176.fork-a-v1-run.legacy-subject', DOC, 'the fork\'s log MUST carry run.started at its head')).toBeDefined();
+    const owner = (started?.payload as { owner?: { subject?: { issuer?: unknown } } } | undefined)?.owner;
+    expect(
+      owner?.subject,
+      req('openwop.requirement.0176.fork-a-v1-run.legacy-subject', 'spec/v2/core/identity.md §1.2', 'run.started on the fork MUST carry owner.subject — the seeded parent had none, so the host stamps the legacy Subject at first v2 read (RFC 0170 §A.3) and the fork copies it verbatim (replay.md §The surface)'),
+    ).toBeDefined();
+    expect(
+      owner?.subject?.issuer,
+      req('openwop.requirement.0176.fork-a-v1-run.legacy-subject', 'spec/v2/core/identity.md §1.2', `the stamped subject's issuer MUST be ${LEGACY_ISSUER} — nothing can attest the issuer of a historical principal, so a real issuer here is a forged provenance`),
+    ).toBe(LEGACY_ISSUER);
+    const parentStarted = pair.parent.find((e) => e.type === 'run.started');
+    const parentIssuer = (parentStarted?.payload as { owner?: { subject?: { issuer?: unknown } } } | undefined)?.owner?.subject?.issuer;
+    expect(
+      parentIssuer,
+      req('openwop.requirement.0176.fork-a-v1-run.legacy-subject', 'spec/v2/core/persistence.md §Everything else a v1 host persisted', `the parent read through v2 MUST carry the same legacy stamp (legacy-stamped at first v2 read, never rewritten) — got ${String(parentIssuer)}`),
+    ).toBe(LEGACY_ISSUER);
+  });
+});

package/src/scenarios/v2-form-when-reuses-edge-conditions.test.ts

@@ -0,0 +1,70 @@
+/**
+ * v2-form-when-reuses-edge-conditions — RFC 0177 §E.4;
+ * `spec/v2/core/form-content-packs.md` §"Conditional visibility".
+ *
+ * Suite 2.0.0, target major 2. A form field MAY carry `when: <EdgeCondition>`;
+ * the grammar is the `WorkflowEdge.condition` object `{ type, left, right }` of
+ * `schemas/v2/workflow-definition.schema.json` with the operator set
+ * `expression | equals | notEquals | contains | regex | truthy | falsy`, and no
+ * second expression language is accepted.
+ *
+ * Witnessed against `schemas/v2/form-content-pack-manifest.schema.json` (no
+ * reference host: `host-pending`), gated on the `forms` family: a form-content
+ * pack whose field carries `when: { type: "equals", left, right }` validates,
+ * and a field whose `when` names an operator outside the set is rejected. If
+ * the schema does not carry `when` yet (RFC 0177 §E.4 schema follow-up) the
+ * leg records `blocked` naming the gap rather than a pass.
+ *
+ * @see RFCS/0177-v2-registry-packs-and-extension-tail.md §E.4
+ * @see spec/v2/core/form-content-packs.md §"Conditional visibility"
+ * @see spec/v2/core/workflow-chain-packs.md §"Edge conditions"
+ */
+
+import { describe, it, expect } from 'vitest';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { targetMajor } from '../lib/seams.js';
+import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
+
+const SECTION = 'form-content-packs.md §"Conditional visibility" (RFC 0177 §E.4)';
+
+function formPack(when: Record<string, unknown>): Record<string, unknown> {
+  return {
+    name: 'core.openwop.v2-form-when-fixture',
+    version: '1.0.0',
+    kind: 'form-content',
+    engines: { openwop: '>=2.0.0 <3.0.0' },
+    templates: [{
+      templateId: 'core.openwop.v2-form-when-fixture.shipping',
+      version: '1.0.0',
+      label: 'Shipping',
+      title: 'Shipping details',
+      fields: [
+        { id: 'shipping', type: 'text', label: 'Shipping' },
+        { id: 'region', type: 'text', label: 'Region', when },
+      ],
+    }],
+  };
+}
+
+describe('v2-form-when-reuses-edge-conditions (RFC 0177 §E.4)', () => {
+  it('a field `when` is the edge-condition grammar { type, left, right } and no other expression language', async () => {
+    if (targetMajor() !== 2) return softSkip('inapplicable', 'suite 2.0.0 v2 scenario: OPENWOP_TARGET_MAJOR is not 2');
+    let doc: Record<string, unknown> | null;
+    try {
+      doc = await v2Discovery();
+    } catch {
+      doc = null;
+    }
+    if (!doc) return softSkip('blocked', 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON');
+    if (!(await gateFamily('forms'))) return softSkip('inapplicable', 'v2 discovery does not advertise the forms family (RFC 0169 §A.2)');
+    const validate = v2Validator('form-content-pack-manifest');
+    const edge = validate(formPack({ type: 'equals', left: 'fields.shipping', right: 'international' }));
+    if (!edge.ok && /\bwhen\b/.test(edge.errors)) return softSkip('blocked', 'form-content-pack-manifest.schema.json lacks `when` — RFC 0177 §E.4 schema follow-up');
+    expect(edge.ok, req('openwop.requirement.0177.form-when-reuses-edge-conditions', SECTION, `a field carrying when: { type: "equals", left, right } MUST validate (${edge.errors})`)).toBe(true);
+    const foreign = validate(formPack({ op: 'eq', path: 'fields.shipping', value: 'international' }));
+    expect(foreign.ok, req('openwop.requirement.0177.form-when-reuses-edge-conditions', SECTION, 'a `when` outside the edge-condition grammar (a second expression language) MUST be rejected')).toBe(false);
+    const operator = validate(formPack({ type: 'jsonata', left: 'fields.shipping', right: 'international' }));
+    expect(operator.ok, req('openwop.requirement.0177.form-when-reuses-edge-conditions', SECTION, 'an operator outside expression|equals|notEquals|contains|regex|truthy|falsy MUST be rejected')).toBe(false);
+  });
+});

package/src/scenarios/v2-header-scheme.test.ts

@@ -0,0 +1,67 @@
+/**
+ * v2 — `header-scheme` (suite 2.0.0; RFC 0171 §C.1; RFC 0172 §A.4;
+ * `spec/v2/core/headers.md` §"Removed in v2"; `spec/v2/core/versioning.md` §1.4).
+ *
+ * Witness class: witnessable — unaided. Every non-standard header is
+ * `OpenWOP-<Name>`; `Capabilities-Etag`, `X-Dedup` and the `X-openwop-*` family
+ * are removed from the v2 representation. Every response on any path MUST
+ * carry `OpenWOP-Version: <major>.<minor>`. The responses inspected are the
+ * v2 discovery document, a deliberately bad `GET /runs/does-not-exist`, and
+ * (when the fixture is seeded) a `POST /runs`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/headers.md §Removed in v2';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+const VERSION = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+async function responses(): Promise<Array<[string, OpenWOPResponse]> | { reason: string }> {
+  if (!(await discovery())) return { reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
+  const out: Array<[string, OpenWOPResponse]> = [];
+  const disco = await http(() => driver.get('/.well-known/openwop', { authenticated: false }));
+  if (disco !== null) out.push(['GET /.well-known/openwop', disco]);
+  const bad = await http(() => driver.get('/runs/does-not-exist'));
+  if (bad !== null) out.push(['GET /runs/does-not-exist', bad]);
+  const created = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }));
+  if (created !== null) out.push(['POST /runs', created]);
+  if (out.length === 0) return { reason: 'no response could be collected (fetch failed on every probe)' };
+  return out;
+}
+
+function offending(name: string): boolean {
+  const n = name.toLowerCase();
+  return n.startsWith('x-openwop-') || n === 'capabilities-etag' || n === 'x-dedup' || n === 'x-force-engine-version' || n.startsWith('x-pack-');
+}
+
+describe('v2 header-scheme (RFC 0171 §C.1; RFC 0172 §A.4)', () => {
+  it('no removed header family appears on any response', async () => {
+    const rs = await responses();
+    if (!Array.isArray(rs)) return softSkip('blocked', rs.reason);
+    for (const [label, res] of rs) {
+      const bad = [...res.headers.keys()].filter(offending);
+      expect(bad, req('openwop.requirement.0171.header-scheme.no-legacy-headers', DOC, `${label}: Capabilities-Etag, X-Dedup, X-Force-Engine-Version, X-Pack-* and X-openwop-* are removed in v2 — every non-standard header is OpenWOP-<Name>`)).toEqual([]);
+    }
+  });
+
+  it('OpenWOP-Version names the contract on every response', async () => {
+    const rs = await responses();
+    if (!Array.isArray(rs)) return softSkip('blocked', rs.reason);
+    for (const [label, res] of rs) {
+      const v = res.headers.get('openwop-version');
+      expect(v !== null && VERSION.test(v.trim()), req('openwop.requirement.0171.header-scheme.version-on-every-response', 'spec/v2/core/versioning.md §1.4', `${label}: a response on any path MUST carry OpenWOP-Version: <major>.<minor> (got ${String(v)})`)).toBe(true);
+      expect(v?.trim().split('.')[0], req('openwop.requirement.0171.header-scheme.version-on-every-response', 'spec/v2/core/versioning.md §1.4', `${label}: the request named major 2, so the response MUST report the 2.x contract it used (reporting another major is a silent downgrade)`)).toBe('2');
+    }
+  });
+});

package/src/scenarios/v2-id-grammar.test.ts

@@ -0,0 +1,77 @@
+/**
+ * v2 — `id-grammar` (suite 2.0.0; RFC 0170 §D.1;
+ * `spec/v2/core/identity.md` §5 "Identifier grammars").
+ *
+ * Witness class: witnessable — unaided. Every id in a run snapshot and in its
+ * event log matches its kind in `schemas/v2/ids.schema.json` (the snapshot and
+ * event schemas `$ref` the grammars, so a full-document validation is the
+ * witness; `runId` is additionally checked against the tenant-bound grammar
+ * by hand so a failure names the field). A crafted id whose tenant segment is
+ * not the caller's MUST be refused — `403 id_tenant_mismatch`, or `404
+ * not_found` where the host chooses not to leak existence.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/identity.md §5';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+const RUN_ID = /^[A-Za-z0-9._~-]{1,128}\/[A-Za-z0-9._~-]{16,128}$/;
+const FOREIGN_RUN_ID = 'openwop-conformance-foreign-tenant/foreignopaque0123456789abcdef';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+async function createRun(): Promise<{ runId: string } | { reason: string }> {
+  if (!(await discovery())) return { reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
+  const res = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }));
+  if (res === null) return { reason: 'POST /runs unreachable (fetch failed)' };
+  const runId = (res.json as { runId?: unknown } | undefined)?.runId;
+  if (res.status !== 201 || typeof runId !== 'string') return { reason: `POST /runs {workflowId: ${NOOP_WORKFLOW_ID}} answered ${res.status} ${readErrorCode(res.json) ?? ''} — the smallest valid create was refused (fixture not seeded?)`.trim() };
+  return { runId };
+}
+
+describe('v2 id-grammar (RFC 0170 §D.1)', () => {
+  it('every id on the run snapshot matches its ids.schema.json kind', async () => {
+    const c = await createRun();
+    if ('reason' in c) return softSkip('blocked', c.reason);
+    const res = await http(() => driver.get(`/runs/${encodeURIComponent(c.runId)}`));
+    if (res === null || res.status !== 200) return softSkip('blocked', `GET /runs/{runId} answered ${res?.status ?? 'no response'} for the run just created`);
+    expect(RUN_ID.test(c.runId), req('openwop.requirement.0170.id-grammar.snapshot', DOC, `runId MUST be tenant-bound <tenantId>/<opaque> with a host-minted opaque segment ^[A-Za-z0-9._~-]{16,128}$ (got ${c.runId})`)).toBe(true);
+    const r = v2Validator('run-snapshot')(res.json);
+    expect(r.ok, req('openwop.requirement.0170.id-grammar.snapshot', DOC, `every id field on RunSnapshot MUST match its kind in schemas/v2/ids.schema.json (${r.errors})`)).toBe(true);
+  });
+
+  it('every id on the run events matches its ids.schema.json kind', async () => {
+    const c = await createRun();
+    if ('reason' in c) return softSkip('blocked', c.reason);
+    const res = await http(() => driver.get(`/runs/${encodeURIComponent(c.runId)}/events/poll?timeout=1`));
+    if (res === null || res.status !== 200) return softSkip('blocked', `GET /runs/{runId}/events/poll answered ${res?.status ?? 'no response'}`);
+    const events = (res.json as { events?: unknown } | undefined)?.events;
+    if (!Array.isArray(events) || events.length === 0) return softSkip('blocked', 'the poll returned no events for the run just created — nothing to check the eventId / runId / nodeId grammars against');
+    const validate = v2Validator('run-event');
+    for (const ev of events) {
+      const r = validate(ev);
+      expect(r.ok, req('openwop.requirement.0170.id-grammar.events', DOC, `every RunEventDoc id (eventId, runId, nodeId, causationId) MUST match its kind — event ${String((ev as { eventId?: unknown }).eventId)} (${r.errors})`)).toBe(true);
+      expect((ev as { runId?: unknown }).runId, req('openwop.requirement.0170.id-grammar.events', DOC, 'every event MUST carry the run\'s own runId')).toBe(c.runId);
+    }
+  });
+
+  it('a run id whose tenant segment is not the caller\'s is refused', async () => {
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const res = await http(() => driver.get(`/runs/${encodeURIComponent(FOREIGN_RUN_ID)}`));
+    if (res === null) return softSkip('blocked', 'GET /runs/{foreign runId} unreachable (fetch failed)');
+    expect([403, 404].includes(res.status), req('openwop.requirement.0170.id-grammar.tenant-binding', DOC, `a tenant-bound id whose tenant segment is not the caller's MUST be rejected with 403 id_tenant_mismatch (or 404 not_found where existence is not leaked); got ${res.status}`)).toBe(true);
+    const code = readErrorCode(res.json);
+    expect(code === 'id_tenant_mismatch' || code === 'not_found', req('openwop.requirement.0170.id-grammar.tenant-binding', DOC, `the refusal MUST carry id_tenant_mismatch or not_found (got ${String(code)})`)).toBe(true);
+    expect(res.status === 403 ? code === 'id_tenant_mismatch' : code === 'not_found', req('openwop.requirement.0170.id-grammar.tenant-binding', 'spec/v2/core/errors.md', 'the code MUST be answered with its registered HTTP status (id_tenant_mismatch → 403, not_found → 404)')).toBe(true);
+  });
+});

package/src/scenarios/v2-idempotency-key-grammar.test.ts

@@ -0,0 +1,65 @@
+/**
+ * v2 — `idempotency-key-grammar` (suite 2.0.0; RFC 0170 §D.3;
+ * `spec/v2/core/idempotency.md` §"Layer 1: Idempotency-Key").
+ *
+ * Witness class: witnessable — unaided. `Idempotency-Key` MUST match
+ * `^[A-Za-z0-9._~-]{22,128}$`; a value outside the grammar MUST be rejected
+ * with `400 idempotency_key_invalid` (and MUST NOT be cached); a 22+ character
+ * key with 128 bits of entropy is accepted. The positive leg runs first so a
+ * host that cannot create the noop fixture at all records `blocked` rather than
+ * a false negative on the grammar.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/idempotency.md §Layer 1';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+const GRAMMAR = /^[A-Za-z0-9._~-]{22,128}$/;
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+/** 128 bits of entropy, base64url — 22 characters, inside the grammar. */
+function validKey(): string {
+  return randomBytes(16).toString('base64url');
+}
+
+describe('v2 idempotency-key-grammar (RFC 0170 §D.3)', () => {
+  it('a 22+ character key inside the grammar is accepted', async () => {
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const key = validKey();
+    expect(GRAMMAR.test(key), req('openwop.requirement.0170.idempotency-key-grammar.valid-accepted', DOC, 'the suite\'s key MUST itself be inside ^[A-Za-z0-9._~-]{22,128}$')).toBe(true);
+    const res = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }, { headers: { 'Idempotency-Key': key } }));
+    if (res === null) return softSkip('blocked', 'POST /runs unreachable (fetch failed)');
+    if (res.status >= 400 && readErrorCode(res.json) !== 'idempotency_key_invalid') {
+      return softSkip('blocked', `POST /runs {workflowId: ${NOOP_WORKFLOW_ID}} answered ${res.status} ${readErrorCode(res.json) ?? ''} — the create itself was refused, so the key grammar cannot be observed (fixture not seeded?)`);
+    }
+    expect(res.status, req('openwop.requirement.0170.idempotency-key-grammar.valid-accepted', DOC, 'a UUIDv4-strength key in base64url form satisfies the grammar and MUST NOT be refused as idempotency_key_invalid')).toBe(201);
+  });
+
+  it('a key outside the grammar is refused with 400 idempotency_key_invalid', async () => {
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const res = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }, { headers: { 'Idempotency-Key': 'short' } }));
+    if (res === null) return softSkip('blocked', 'POST /runs unreachable (fetch failed)');
+    if (res.status >= 400 && readErrorCode(res.json) !== 'idempotency_key_invalid') {
+      // Disambiguate "the key was not examined" from "the host refused the
+      // create for another reason": the same body under a valid key is the control.
+      const control = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }, { headers: { 'Idempotency-Key': validKey() } }));
+      if (control === null || control.status >= 400) {
+        return softSkip('blocked', `POST /runs answered ${res.status} ${readErrorCode(res.json) ?? ''} and the control create under a valid key answered ${control?.status ?? 'no response'} — the create itself is refused, so the key grammar cannot be observed (fixture not seeded?)`);
+      }
+    }
+    expect(res.status, req('openwop.requirement.0170.idempotency-key-grammar.invalid-refused', DOC, 'a host MUST reject an Idempotency-Key outside ^[A-Za-z0-9._~-]{22,128}$ with 400')).toBe(400);
+    expect(readErrorCode(res.json), req('openwop.requirement.0170.idempotency-key-grammar.invalid-refused', DOC, 'the refusal code MUST be idempotency_key_invalid')).toBe('idempotency_key_invalid');
+  });
+});

package/src/scenarios/v2-interrupt-token-scheme.test.ts

@@ -0,0 +1,55 @@
+/**
+ * v2 — `interrupt-token-scheme` (suite 2.0.0; RFC 0170 §E.1;
+ * `spec/v2/core/identity.md` §4 "Resume tokens"; `spec/v2/core/interrupt.md` §Tokens).
+ *
+ * Witness class: witnessable — unaided. A resume token is
+ * `ow2.<alg>.<kid>.<payload>.<mac>`. A host MUST refuse a token whose `alg` it
+ * does not advertise or whose `kid` it does not hold with
+ * `401 interrupt_token_invalid`. The signed-token surface
+ * (`GET /interrupts/{token}`) is a SHOULD, so a host that answers `404
+ * not_found` to every token probe records `inapplicable`; once the surface is
+ * observed to be mounted, a well-formed token under an unheld `kid` MUST be
+ * `interrupt_token_invalid`, never `not_found`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/identity.md §4';
+const UNPREFIXED = 'b3BlbndvcC1jb25mb3JtYW5jZQ.0123456789abcdef0123456789abcdef';
+const UNHELD_KID = 'ow2.hs256.nokid.b3BlbndvcC1jb25mb3JtYW5jZQ.0123456789abcdef0123456789abcdef';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+function inspect(token: string): Promise<OpenWOPResponse | null> {
+  return http(() => driver.get(`/interrupts/${encodeURIComponent(token)}`, { authenticated: false }));
+}
+
+describe('v2 interrupt-token-scheme (RFC 0170 §E.1)', () => {
+  it('a token without the ow2. prefix is refused', async () => {
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const res = await inspect(UNPREFIXED);
+    if (res === null) return softSkip('blocked', 'GET /interrupts/{token} unreachable (fetch failed)');
+    expect([401, 404].includes(res.status), req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', DOC, `a token outside the ow2.<alg>.<kid>.<payload>.<mac> grammar MUST NOT resolve — 401 interrupt_token_invalid (or 404 not_found where the signed-token surface is not mounted); got ${res.status}`)).toBe(true);
+    const code = readErrorCode(res.json);
+    expect(res.status === 401 ? code === 'interrupt_token_invalid' : code === 'not_found', req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', 'spec/v2/core/interrupt.md §Tokens', `the refusal MUST carry its registered code (401 → interrupt_token_invalid, 404 → not_found); got ${String(code)}`)).toBe(true);
+  });
+
+  it('a well-formed token under a kid the host does not hold is 401 interrupt_token_invalid', async () => {
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const probe = await inspect(UNPREFIXED);
+    const res = await inspect(UNHELD_KID);
+    if (probe === null || res === null) return softSkip('blocked', 'GET /interrupts/{token} unreachable (fetch failed)');
+    if (probe.status === 404 && res.status === 404) return softSkip('inapplicable', 'the signed-token surface GET /interrupts/{token} is not mounted (404 to every token probe) — a SHOULD in interrupt.md; the kid rule cannot be observed');
+    expect(res.status, req('openwop.requirement.0170.interrupt-token-scheme.unheld-kid-refused', DOC, 'a host MUST refuse a token whose kid it does not hold with 401')).toBe(401);
+    expect(readErrorCode(res.json), req('openwop.requirement.0170.interrupt-token-scheme.unheld-kid-refused', DOC, 'the refusal code MUST be interrupt_token_invalid (one code per state — never not_found for a token the host cannot verify)')).toBe('interrupt_token_invalid');
+  });
+});

package/src/scenarios/v2-lane-issuer-advertised.test.ts

@@ -0,0 +1,62 @@
+/**
+ * v2 — `lane-issuer-advertised` (suite 2.0.0; RFC 0170 §B.2–§B.4;
+ * `spec/v2/core/identity.md` §2.1–§2.3; facet `spec/v2/facets/auth.schema.json`).
+ *
+ * Witness class: witnessable — unaided. Every member of `auth.lanes[]` MUST
+ * name `lane`, `issuers[]` (min 1, the realm), `revocation` and
+ * `minimumAssurance`; `revocationWindowSeconds` MUST accompany a rule that
+ * names a window (`exp-and-recheck`, `short-lived`, `rebind`). A host that does
+ * not advertise the `auth` family records `inapplicable`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/identity.md §2.1';
+const LANES = new Set(['api-key', 'oauth2', 'oidc', 'mtls', 'saml', 'scim', 'ldap', 'workload', 'session', 'anonymous']);
+const REVOCATION = new Set(['next-request', 'exp-and-recheck', 'crl', 'ocsp', 'short-lived', 'not-on-or-after', 'bound-connection', 'rebind', 'delegation-expiry']);
+const WINDOWED = new Set(['exp-and-recheck', 'short-lived', 'rebind']);
+const ASSURANCE = new Set(['bearer', 'sender-constrained', 'key-bound']);
+const PROOFS = new Set(['mtls-key-binding', 'dpop', 'svid-chain']);
+
+async function lanes(): Promise<Array<Record<string, unknown>> | { reason: string }> {
+  let doc: Record<string, unknown> | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  if (!doc) return { reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
+  const auth = await familyAdvertised('auth');
+  if (auth === null) return { reason: 'the host does not advertise the `auth` family at the v2 root' };
+  const arr = auth['lanes'];
+  if (!Array.isArray(arr) || arr.length === 0) return { reason: 'FAIL-SHAPED: `auth` is advertised but `auth.lanes[]` is absent or empty (REQUIRED, minItems 1) — the capabilities-root-closed scenario fails the document' };
+  return arr.filter((l): l is Record<string, unknown> => l !== null && typeof l === 'object');
+}
+
+describe('v2 lane-issuer-advertised (RFC 0170 §B.2–§B.4)', () => {
+  it('every auth.lanes[] member names lane, issuers[], revocation and minimumAssurance', async () => {
+    const ls = await lanes();
+    if (!Array.isArray(ls)) return softSkip(ls.reason.startsWith('FAIL-SHAPED') ? 'blocked' : 'inapplicable', ls.reason);
+    for (const l of ls) {
+      const name = String(l['lane']);
+      expect(LANES.has(name), req('openwop.requirement.0170.lane-issuer-advertised.members', DOC, `auth.lanes[].lane MUST be one of the ten lanes (got ${name})`)).toBe(true);
+      const issuers = l['issuers'];
+      expect(Array.isArray(issuers) && issuers.length > 0 && issuers.every((i) => typeof i === 'string' && i.length > 0), req('openwop.requirement.0170.lane-issuer-advertised.members', 'spec/v2/core/identity.md §2.2', `lane ${name} MUST advertise its trust root in issuers[] (min 1, non-empty strings)`)).toBe(true);
+      expect(REVOCATION.has(String(l['revocation'])), req('openwop.requirement.0170.lane-issuer-advertised.members', 'spec/v2/core/identity.md §2.2', `lane ${name} MUST name its revocation rule`)).toBe(true);
+      expect(ASSURANCE.has(String(l['minimumAssurance'])), req('openwop.requirement.0170.lane-issuer-advertised.members', 'spec/v2/core/identity.md §2.3', `lane ${name} MUST advertise minimumAssurance: bearer | sender-constrained | key-bound`)).toBe(true);
+      if (l['delegationProofs'] !== undefined) {
+        expect(Array.isArray(l['delegationProofs']) && (l['delegationProofs'] as unknown[]).every((p) => PROOFS.has(String(p))), req('openwop.requirement.0170.lane-issuer-advertised.members', 'spec/v2/core/identity.md §2.4', `lane ${name}: delegationProofs[] MUST be drawn from mtls-key-binding | dpop | svid-chain`)).toBe(true);
+      }
+    }
+  });
+
+  it('a windowed revocation rule advertises revocationWindowSeconds', async () => {
+    const ls = await lanes();
+    if (!Array.isArray(ls)) return softSkip(ls.reason.startsWith('FAIL-SHAPED') ? 'blocked' : 'inapplicable', ls.reason);
+    const windowed = ls.filter((l) => WINDOWED.has(String(l['revocation'])));
+    if (windowed.length === 0) return softSkip('inapplicable', 'no advertised lane uses a windowed revocation rule (exp-and-recheck | short-lived | rebind)');
+    for (const l of windowed) {
+      const w = l['revocationWindowSeconds'];
+      expect(Number.isInteger(w) && (w as number) >= 1, req('openwop.requirement.0170.lane-issuer-advertised.window', 'spec/v2/core/identity.md §2.2', `lane ${String(l['lane'])} (revocation ${String(l['revocation'])}) MUST advertise revocationWindowSeconds (integer ≥ 1)`)).toBe(true);
+    }
+  });
+});

package/src/scenarios/v2-legacy-profiles-absent.test.ts

@@ -0,0 +1,78 @@
+/**
+ * RFC 0175 §C.1 — `legacy-profiles-absent` (suite 2.0.0, target major 2; unaided).
+ *
+ * `a2a-0.3-legacy` and `mcp-2025-06-18-legacy` do not exist in the v2 tree: the
+ * `profiles[]` item patterns admit no `-legacy` suffix
+ * (`spec/v2/facets/a2a.schema.json` `^a2a-[0-9]+\.[0-9]+$`,
+ * `spec/v2/facets/mcp.schema.json` `^mcp-[0-9]{4}-[0-9]{2}-[0-9]{2}$`), and a
+ * host that still speaks a legacy version does so as a private, non-advertised
+ * behavior (`spec/v2/core/interop.md` §Legacy profiles are absent; RFC 0175 row
+ * C8.1). No root `profiles[]` exists either (RFC 0169 §C.1).
+ *
+ * Unaided; gated only in the sense that a host advertising neither facet has
+ * no `profiles[]` to check — that leg records `inapplicable`, the root leg runs
+ * on every host.
+ *
+ * @see spec/v2/core/interop.md §Legacy profiles are absent
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const PATTERNS: Record<string, RegExp> = {
+  a2a: /^a2a-[0-9]+\.[0-9]+$/,
+  mcp: /^mcp-[0-9]{4}-[0-9]{2}-[0-9]{2}$/,
+};
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+function profilesOf(doc: Record<string, unknown>, family: string): string[] | null {
+  const rec = doc[family];
+  if (!rec || typeof rec !== 'object') return null;
+  const p = (rec as { profiles?: unknown }).profiles;
+  return Array.isArray(p) ? p.map(String) : [];
+}
+
+describe('RFC 0175 §C.1 — legacy-profiles-absent (unaided)', () => {
+  it('no -legacy id appears in a2a.profiles or mcp.profiles and each id matches its facet pattern', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    let checked = 0;
+    for (const family of ['a2a', 'mcp'] as const) {
+      const profiles = profilesOf(doc, family);
+      if (profiles === null) continue;
+      checked++;
+      for (const id of profiles) {
+        expect(
+          /-legacy$/.test(id),
+          req('openwop.requirement.0175.legacy-profiles-absent', 'interop.md §Legacy profiles are absent', `${family}.profiles MUST NOT carry a -legacy id (got ${id}); the legacy code paths are not part of the v2 corpus (RFC 0175 §C.1)`),
+        ).toBe(false);
+        expect(
+          PATTERNS[family]!.test(id),
+          req('openwop.requirement.0175.legacy-profiles-absent', `facets/${family}.schema.json profiles[]`, `${family}.profiles ids MUST match ${PATTERNS[family]!.source} (got ${id})`),
+        ).toBe(true);
+      }
+      // The facet as a whole — versions/revisions, floor, refreshedAt — validates
+      // through the capabilities schema, whose family records are the facets.
+      const check = v2Validator('capabilities')({ protocolVersions: ['2.0'], preferredVersion: '2.0', [family]: doc[family] });
+      expect(
+        check.ok,
+        req('openwop.requirement.0175.legacy-profiles-absent', `facets/${family}.schema.json`, `the ${family} facet MUST validate against its facet schema (capabilities.schema.json ${family}): ${check.errors}`),
+      ).toBe(true);
+    }
+    if (checked === 0) softSkip('inapplicable', 'host advertises neither a2a nor mcp — no profiles[] to check for a -legacy id');
+  });
+
+  it('no root profiles[] exists in the v2 representation', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    expect(
+      'profiles' in doc,
+      req('openwop.requirement.0175.legacy-profiles-absent.no-root-profiles', 'capabilities.md §Profiles', 'no `profiles[]` exists at the v2 root — a profile is a predicate over the declaration file, not an advertisement (RFC 0169 §C.1)'),
+    ).toBe(false);
+  });
+});