@openwop/openwop-conformance 2.0.0-rc.1 → 2.0.0-rc.3

package/README.md

@@ -112,7 +112,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 494 scenario files under `src/scenarios/`.
+The current suite has 495 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -457,7 +457,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 494 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 495 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -46,6 +46,7 @@ import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
 import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
+import { setV2ProfileFloors } from './lib/requirement-registry.js';
 function parseArgs(argv) {
     let baseUrl;
     let apiKey;
@@ -299,13 +300,7 @@ function claimedProfilesFor(doc) {
  * no v2 host could ever certify. Falls back to the empty set only when the
  * registry is genuinely absent from the layout, and says so.
  */
-function claimedProfilesForV2(doc, conformanceRoot) {
-    // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
-    // this package — instead of guessing directory shapes. Hand-rolled candidates
-    // found the registry in a repo checkout and missed it in every published
-    // install, where npm hoists the peer to a SIBLING package dir: the probe that
-    // walked one level up landed on the `@openwop/` scope directory, not a
-    // package, so a real host run silently claimed nothing.
+function v2RegistryPath(conformanceRoot) {
     const candidates = [];
     try {
         const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
@@ -313,8 +308,17 @@ function claimedProfilesForV2(doc, conformanceRoot) {
     }
     catch { /* not installed as a package; the repo-layout candidates below */ }
     candidates.push(resolvePath(conformanceRoot, 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec-artifacts', 'spec', 'v2', 'profiles.json'));
-    const found = candidates.find((c) => existsSync(c));
-    if (found === undefined) {
+    return candidates.find((c) => existsSync(c)) ?? null;
+}
+function claimedProfilesForV2(doc, conformanceRoot) {
+    // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
+    // this package — instead of guessing directory shapes. Hand-rolled candidates
+    // found the registry in a repo checkout and missed it in every published
+    // install, where npm hoists the peer to a SIBLING package dir: the probe that
+    // walked one level up landed on the `@openwop/` scope directory, not a
+    // package, so a real host run silently claimed nothing.
+    const found = v2RegistryPath(conformanceRoot);
+    if (found === null) {
         process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
         return [];
     }
@@ -342,6 +346,46 @@ function claimedProfilesForV2(doc, conformanceRoot) {
     }
     return out;
 }
+/**
+ * `spec/v2/profiles.json` `floorScenarios` → scenario file names. A
+ * `planned:<name>` entry names a scenario the registry expects but that may not
+ * exist yet; it resolves to `v2-<name>.test.ts` when that file is in the
+ * manifest and is dropped otherwise, so a planned-but-unwritten floor cannot
+ * fail a host for the corpus's own backlog.
+ */
+function v2ProfileFloors(conformanceRoot) {
+    const registryPath = v2RegistryPath(conformanceRoot);
+    if (registryPath === null)
+        return {};
+    let known;
+    try {
+        known = new Set(Object.keys(JSON.parse(readFileSync(resolvePath(conformanceRoot, 'scenario-majors.json'), 'utf8')).majors));
+    }
+    catch {
+        known = new Set();
+    }
+    let registry;
+    try {
+        registry = JSON.parse(readFileSync(registryPath, 'utf8'));
+    }
+    catch {
+        return {};
+    }
+    const out = {};
+    for (const p of registry.profiles ?? []) {
+        if (typeof p.id !== 'string')
+            continue;
+        const raw = Array.isArray(p.floorScenarios) ? p.floorScenarios.map(String) : [];
+        const files = [];
+        for (const entry of raw) {
+            const name = entry.startsWith('planned:') ? `v2-${entry.slice('planned:'.length)}.test.ts` : entry.endsWith('.test.ts') ? entry : `${entry}.test.ts`;
+            if (known.size === 0 || known.has(name))
+                files.push(name);
+        }
+        out[p.id] = files;
+    }
+    return out;
+}
 /**
  * Reduce a vitest JSON report into a per-scenario-file terminal state, keyed by
  * the test-file basename (e.g. `discovery.test.ts`) to align with the basenames
@@ -450,6 +494,10 @@ async function runCertify(args, baseUrl, apiKey) {
     const sha256 = createHash('sha256').update(canonicalJSON(document)).digest('hex');
     // (b) Derive claimedProfiles from the captured document.
     const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document, conformanceRoot) : claimedProfilesFor(document);
+    // Major-2 floors come from spec/v2/profiles.json. Without this the derivation
+    // measures a v2 host against v1 scenario files a major-2 run never executes,
+    // and refuses certification for not running them.
+    setV2ProfileFloors(target.major === 2 ? v2ProfileFloors(conformanceRoot) : null);
     // (c) Run the suite, capturing per-scenario terminal state via the vitest
     // JSON reporter. server-targeted scenarios live under src/scenarios/.
     const reportDir = mkdtempSync(join(tmpdir(), 'owp-certify-'));

package/dist/lib/requirement-registry.js

@@ -76,7 +76,27 @@ export function floorFilesFor(profile, document) {
  * discovery-conditional floor (RFC 0148 §C G7 — `openwop-replay-fork`): without
  * it such a floor is UNEVALUABLE and this returns `null`, never `[]`.
  */
+/**
+ * Major-2 floors come from `spec/v2/profiles.json`, not from the v1 table.
+ * `PROFILE_FLOOR_SCENARIOS` names v1 scenario FILES (`runs-lifecycle.test.ts`,
+ * `discovery.test.ts`, …) that `scenario-majors.json` assigns to major 1 and a
+ * major-2 run therefore never executes — so every one of them came back
+ * unclassified and a v2 host was refused certification for not running v1
+ * scenarios. Set by the runner before deriving; empty means the registry
+ * declares no floor for that profile, which is a real "witnesses nothing yet",
+ * not an unclassified return.
+ */
+let v2Floors = null;
+export function setV2ProfileFloors(floors) {
+    v2Floors = floors;
+}
 export function requirementsFor(profile, document) {
+    if (v2Floors !== null) {
+        const files = v2Floors[profile];
+        if (files === undefined)
+            return null;
+        return files.map(requirementIdForScenario);
+    }
     const floor = PROFILE_FLOOR_SCENARIOS[profile];
     if (floor === undefined)
         return null;

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.1",
-  "stampSha256": "c588b39fdcedb05d753c738cfe8e335093cdd2e9431f789d9d2085df4629e794"
+  "version": "2.0.0-rc.3",
+  "stampSha256": "b34c4d48c32a17887eee8a62841993f3fb19565c97ce602f35d682ed26ff0709"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.1",
+  "version": "2.0.0-rc.3",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.1"
+    "@openwop/spec-artifacts": "2.0.0-rc.3"
   }
 }

package/requirements.json

@@ -2,9 +2,9 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 538,
-    "tests": 2106,
-    "withStableId": 2106,
+    "files": 539,
+    "tests": 2108,
+    "withStableId": 2108,
     "interpolatedTitles": 0,
     "explicitIds": 2057
   },
@@ -26501,6 +26501,49 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-era-2-append-vocabulary.a-host-append-to-an-open-era-2-run-keeps-the-log-in-v1-vocabulary-so-the-whole-l",
+      "file": "v2-era-2-append-vocabulary.test.ts",
+      "line": 48,
+      "title": "a host append to an open era-2 run keeps the log in v1 vocabulary, so the whole log still reads",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-era-2-append-vocabulary.the-run-keeps-the-era-it-was-created-with-an-append-does-not-promote-it-to-era-3",
+      "file": "v2-era-2-append-vocabulary.test.ts",
+      "line": 119,
+      "title": "the run keeps the era it was created with; an append does not promote it to era 3",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-era-key.a-run-created-now-carries-eventlogschemaversion-3-on-its-snapshot",
       "file": "v2-era-key.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 494,
+    "files": 495,
     "v1": 444,
-    "v2": 51
+    "v2": 52
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1267,6 +1267,9 @@
     "v2-enum-growth-rule.test.ts": [
       2
     ],
+    "v2-era-2-append-vocabulary.test.ts": [
+      2
+    ],
     "v2-era-key.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.1",
+  "version": "2.0.0-rc.3",
   "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -9,9 +9,9 @@
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "52fef8b9294f66a4b0bbf2fa53e6295808b643c8330418c478b4062e30952dd7",
-    "api/v2/asyncapi.yaml": "1362b62925d194848b269911ef7aedba46da07160dbc6f0a5c1438669d612855",
-    "api/v2/openapi.yaml": "834cdda6d57322f42061a60d8bb3b89cad8e51361506e59cb269251b8c30b86b",
+    "api/seams-v2.yaml": "c8c932e1a7b061928170802360d21a324e01630d730d5d62e6162b4e58db340e",
+    "api/v2/asyncapi.yaml": "aef56a195e8a9d064e626c5c60fb96bafb8236e3cb0c415f02b97dd1eddebc49",
+    "api/v2/openapi.yaml": "889d1dee9ffbfc05c8d950f42c815b474f32e3839b2cb4fcad6444faeede3d59",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -198,7 +198,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "ba7d24beac18e8b0a95becf73e89c37e7720920a71bff6bdd2e98c291c70afb7",
+    "spec/v1/core-standard-manifest.json": "92c4313bcf5d401de92325f16b05ab9563fa882b83e24129022201fa45ef2466",
     "spec/v1/deprecations.json": "520d79927a8ed43ccf62c207a7cf6cf7b19b16e00bbbbdf0410667e939c19d85",
     "spec/v1/deprecations.schema.json": "4cdbbb8eb9c0092913a5704c943880f0c8581bcf0f640a7df5a84105d53c8aee",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -228,7 +228,7 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "1f0ee40491131cf561ef19a0394c47ba476b4567514fe16befb6cada4a10a5a4",
-    "spec/v2/release.json": "41b69aed1e0c366cb287b05133ad561a1d4975b7a9e6786edf355ce976f4f12e"
+    "spec/v2/release.json": "01c044e1664b1e642e3e746dd327c941ef28595a39172ea9d9bf65baa1dd4f8f"
   },
-  "corpusCommit": "56cd5d7bb1dd663a887f884a0a4504c878d71b52"
+  "corpusCommit": "75d572d9adf36a5e749a39bea9ccc5c5180cbec9"
 }

package/src/cli.ts

@@ -54,6 +54,7 @@ import {
   type DiscoveryPayload,
   PROFILE_FLOOR_SCENARIOS,
 } from './lib/profiles.js';
+import { setV2ProfileFloors } from './lib/requirement-registry.js';
 
 interface ParsedArgs {
   readonly baseUrl: string | undefined;
@@ -320,14 +321,8 @@ function claimedProfilesFor(doc: DiscoveryPayload): string[] {
  * no v2 host could ever certify. Falls back to the empty set only when the
  * registry is genuinely absent from the layout, and says so.
  */
-function claimedProfilesForV2(doc: DiscoveryPayload, conformanceRoot: string): string[] {
-  // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
-  // this package — instead of guessing directory shapes. Hand-rolled candidates
-  // found the registry in a repo checkout and missed it in every published
-  // install, where npm hoists the peer to a SIBLING package dir: the probe that
-  // walked one level up landed on the `@openwop/` scope directory, not a
-  // package, so a real host run silently claimed nothing.
-  const candidates = [];
+function v2RegistryPath(conformanceRoot: string): string | null {
+  const candidates: string[] = [];
   try {
     const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
     candidates.push(resolvePath(dirname(req.resolve('@openwop/spec-artifacts/package.json')), 'spec', 'v2', 'profiles.json'));
@@ -337,8 +332,18 @@ function claimedProfilesForV2(doc: DiscoveryPayload, conformanceRoot: string): s
     resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'),
     resolvePath(conformanceRoot, '..', 'spec-artifacts', 'spec', 'v2', 'profiles.json'),
   );
-  const found = candidates.find((c) => existsSync(c));
-  if (found === undefined) {
+  return candidates.find((c) => existsSync(c)) ?? null;
+}
+
+function claimedProfilesForV2(doc: DiscoveryPayload, conformanceRoot: string): string[] {
+  // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
+  // this package — instead of guessing directory shapes. Hand-rolled candidates
+  // found the registry in a repo checkout and missed it in every published
+  // install, where npm hoists the peer to a SIBLING package dir: the probe that
+  // walked one level up landed on the `@openwop/` scope directory, not a
+  // package, so a real host run silently claimed nothing.
+  const found = v2RegistryPath(conformanceRoot);
+  if (found === null) {
     process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
     return [];
   }
@@ -364,6 +369,42 @@ function claimedProfilesForV2(doc: DiscoveryPayload, conformanceRoot: string): s
   return out;
 }
 
+/**
+ * `spec/v2/profiles.json` `floorScenarios` → scenario file names. A
+ * `planned:<name>` entry names a scenario the registry expects but that may not
+ * exist yet; it resolves to `v2-<name>.test.ts` when that file is in the
+ * manifest and is dropped otherwise, so a planned-but-unwritten floor cannot
+ * fail a host for the corpus's own backlog.
+ */
+function v2ProfileFloors(conformanceRoot: string): Record<string, readonly string[]> {
+  const registryPath = v2RegistryPath(conformanceRoot);
+  if (registryPath === null) return {};
+  let known: Set<string>;
+  try {
+    known = new Set(Object.keys((JSON.parse(readFileSync(resolvePath(conformanceRoot, 'scenario-majors.json'), 'utf8')) as { majors: Record<string, number[]> }).majors));
+  } catch {
+    known = new Set();
+  }
+  let registry: { profiles?: Array<{ id?: unknown; floorScenarios?: unknown }> };
+  try {
+    registry = JSON.parse(readFileSync(registryPath, 'utf8'));
+  } catch {
+    return {};
+  }
+  const out: Record<string, readonly string[]> = {};
+  for (const p of registry.profiles ?? []) {
+    if (typeof p.id !== 'string') continue;
+    const raw = Array.isArray(p.floorScenarios) ? (p.floorScenarios as unknown[]).map(String) : [];
+    const files: string[] = [];
+    for (const entry of raw) {
+      const name = entry.startsWith('planned:') ? `v2-${entry.slice('planned:'.length)}.test.ts` : entry.endsWith('.test.ts') ? entry : `${entry}.test.ts`;
+      if (known.size === 0 || known.has(name)) files.push(name);
+    }
+    out[p.id] = files;
+  }
+  return out;
+}
+
 /** A single scenario test file's terminal state, derived from the vitest JSON report. */
 type ScenarioState = 'passed' | 'failed' | 'skipped';
 
@@ -475,6 +516,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
 
   // (b) Derive claimedProfiles from the captured document.
   const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document, conformanceRoot) : claimedProfilesFor(document);
+  // Major-2 floors come from spec/v2/profiles.json. Without this the derivation
+  // measures a v2 host against v1 scenario files a major-2 run never executes,
+  // and refuses certification for not running them.
+  setV2ProfileFloors(target.major === 2 ? v2ProfileFloors(conformanceRoot) : null);
 
   // (c) Run the suite, capturing per-scenario terminal state via the vitest
   // JSON reporter. server-targeted scenarios live under src/scenarios/.

package/src/lib/requirement-registry.ts

@@ -78,7 +78,28 @@ export function floorFilesFor(profile: string, document?: Readonly<Record<string
  * discovery-conditional floor (RFC 0148 §C G7 — `openwop-replay-fork`): without
  * it such a floor is UNEVALUABLE and this returns `null`, never `[]`.
  */
+/**
+ * Major-2 floors come from `spec/v2/profiles.json`, not from the v1 table.
+ * `PROFILE_FLOOR_SCENARIOS` names v1 scenario FILES (`runs-lifecycle.test.ts`,
+ * `discovery.test.ts`, …) that `scenario-majors.json` assigns to major 1 and a
+ * major-2 run therefore never executes — so every one of them came back
+ * unclassified and a v2 host was refused certification for not running v1
+ * scenarios. Set by the runner before deriving; empty means the registry
+ * declares no floor for that profile, which is a real "witnesses nothing yet",
+ * not an unclassified return.
+ */
+let v2Floors: Readonly<Record<string, readonly string[]>> | null = null;
+
+export function setV2ProfileFloors(floors: Readonly<Record<string, readonly string[]>> | null): void {
+  v2Floors = floors;
+}
+
 export function requirementsFor(profile: string, document?: Readonly<Record<string, unknown>>): readonly string[] | null {
+  if (v2Floors !== null) {
+    const files = v2Floors[profile];
+    if (files === undefined) return null;
+    return files.map(requirementIdForScenario);
+  }
   const floor = PROFILE_FLOOR_SCENARIOS[profile];
   if (floor === undefined) return null;
   if (floor.discoveryOnly === true) return [];

package/src/scenarios/v2-era-2-append-vocabulary.test.ts

@@ -0,0 +1,140 @@
+/**
+ * RFC 0176 §A / `spec/v2/core/persistence.md` §The writer rule — an append to a
+ * run in era `2` uses v1 vocabulary (suite 2.0.0, target major 2; seam-gated).
+ *
+ * The reader rule translates an era-`2` log through the codemap at the storage
+ * boundary. That is only coherent if the log stays in ONE vocabulary: the era
+ * key is fixed at run creation and fixes the log's vocabulary for the run's
+ * lifetime. A host that upgrades while runs are open and then begins writing v2
+ * names into an era-`2` log breaks the reader two ways — a renamed type gets
+ * mapped a second time, and a v2-only name is not on the codemap's v1 side at
+ * all, so the read fails with `event_type_unmapped`.
+ *
+ * This is not a hypothetical for a host with human-approval interrupts, where a
+ * run can stay open for days across a deploy. Draining era-`2` runs before
+ * serving v2 is explicitly not the path (`persistence.md` §"Runs pinned to v1"),
+ * so the writer rule is what makes an in-flight run safe across the cut.
+ *
+ * The witness: seed an era-`2` run that is still `running`, drive one canonical
+ * mutation so the HOST's own writer appends a terminal event, then read the
+ * whole log back under major 2. A host that appended in v1 vocabulary reads
+ * back cleanly; a host that appended in v2 vocabulary fails the read or returns
+ * a type the closed v2 registry does not carry.
+ *
+ * @see spec/v2/core/persistence.md §The writer rule
+ * @see RFCS/0176-v2-persisted-data-and-coexistence.md §A
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { codemapV1toV2, era2Gate, eventsOf, pollEvents, seedEra2Log, v1FixtureLog, type ReadEvent } from '../lib/era2-seed.js';
+
+const ID = 'openwop.requirement.0176.era-2-append-vocabulary';
+const DOC = 'spec/v2/core/persistence.md §The writer rule';
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try {
+    return await fn();
+  } catch {
+    return null;
+  }
+}
+
+describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () => {
+  it('a host append to an open era-2 run keeps the log in v1 vocabulary, so the whole log still reads', async () => {
+    const doc = await v2Discovery().catch(() => null);
+    const gate = era2Gate(doc);
+    if (gate !== null && !gate.ok) return softSkip(gate.kind, gate.reason);
+
+    // An era-2 log that is still OPEN: `running`, not `completed`. A completed
+    // run is never appended to, so it cannot witness the writer rule.
+    const seeded = await seedEra2Log(v1FixtureLog().slice(0, 2), 'running');
+    if (!seeded.ok) return softSkip(seeded.kind, seeded.reason);
+    const runId = seeded.runId;
+
+    const before = await pollEvents(runId);
+    if (before === null || before.status !== 200) {
+      return softSkip('blocked', `GET /runs/${runId}/events/poll answered ${before?.status ?? 'no response'} on the seeded era-2 run — the log cannot be read back`);
+    }
+    const seedCount = eventsOf(before).length;
+
+    // One canonical mutation so the HOST's own writer appends. Cancel is the
+    // universally available terminal transition; a host that refuses it on a
+    // seeded run records `blocked` rather than a pass.
+    const cancelled = await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
+    if (cancelled === null || (cancelled.status !== 200 && cancelled.status !== 202 && cancelled.status !== 204)) {
+      return softSkip('blocked', `POST /runs/{runId}/cancel answered ${cancelled?.status ?? 'no response'} on a seeded era-2 run — no canonical mutation drove the host's writer, so the append is unwitnessed`);
+    }
+
+    const after = await pollEvents(runId);
+    if (after === null) return softSkip('blocked', 'the event read failed after the append');
+
+    // Failure mode 1: the read itself refuses. A host that wrote a v2-only name
+    // into an era-2 log produces a type the codemap cannot map FROM.
+    if (after.status !== 200) {
+      const code = readErrorCode(after.json);
+      expect(
+        code,
+        req(ID, DOC, `reading the era-2 log after the host's own append failed with ${after.status} ${String(code)} — an append in v2 vocabulary is exactly what makes a translated read fail, and the era key fixes the log's vocabulary for the run's lifetime`),
+      ).toBe(null);
+      return softSkip('blocked', `the era-2 read failed with ${after.status} after the host's own append — the assertion above already recorded the refusal`);
+    }
+
+    const rows = eventsOf(after) as ReadEvent[];
+    expect(
+      rows.length,
+      req(ID, DOC, `the append MUST be visible in the log (seeded ${seedCount}, read ${rows.length} after cancel)`),
+    ).toBeGreaterThan(seedCount);
+
+    // Failure mode 2: the read succeeds but returns a name the v2 registry does
+    // not carry — a v1 name that survived untranslated because it was written
+    // after the upgrade and the host treated the log as era 3.
+    const v2Names = new Set(codemapV1toV2().values());
+    const v1Names = new Set(codemapV1toV2().keys());
+    for (const row of rows.slice(seedCount)) {
+      const type = String(row.type ?? '');
+      // A renamed type is the discriminator: its v1 spelling must NOT appear on
+      // the wire, because every reader translates an era-2 log.
+      const renamedV1 = v1Names.has(type) && !v2Names.has(type);
+      expect(
+        renamedV1,
+        req(ID, DOC, `the appended event reads as its v2 name, not its v1 spelling (${type}) — every reader translates an era-2 log, so a v1 name reaching the wire means the append bypassed the storage boundary`),
+      ).toBe(false);
+    }
+
+    // Sequence stays contiguous across the era boundary the append crosses.
+    const seqs = rows.map((r) => Number(r.sequence)).sort((a, b) => a - b);
+    for (let i = 0; i < seqs.length; i++) {
+      expect(
+        seqs[i],
+        req(ID, DOC, `the appended rows continue the seeded sequence space without a gap or restart (expected ${i}, got ${String(seqs[i])})`),
+      ).toBe(i);
+    }
+  });
+
+  it('the run keeps the era it was created with; an append does not promote it to era 3', async () => {
+    const doc = await v2Discovery().catch(() => null);
+    const gate = era2Gate(doc);
+    if (gate !== null && !gate.ok) return softSkip(gate.kind, gate.reason);
+
+    const seeded = await seedEra2Log(v1FixtureLog().slice(0, 2), 'running');
+    if (!seeded.ok) return softSkip(seeded.kind, seeded.reason);
+    const runId = seeded.runId;
+
+    await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
+
+    const snap = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
+    if (snap === null || snap.status !== 200) {
+      return softSkip('blocked', `GET /runs/{runId} answered ${snap?.status ?? 'no response'} — the era key cannot be read back`);
+    }
+    const era = (snap.json as { eventLogSchemaVersion?: unknown } | null)?.eventLogSchemaVersion;
+    expect(
+      era === undefined || era === 2,
+      req(ID, DOC, `the era key is fixed at run creation: a run seeded in era 2 and then appended to MUST still read as era 2 (got ${String(era)}) — promoting it to 3 would strand the seeded rows in a vocabulary the reader no longer translates`),
+    ).toBe(true);
+  });
+});