@openwop/openwop-conformance 2.0.0-rc.2 → 2.0.0-rc.28

package/README.md

@@ -112,7 +112,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 495 scenario files under `src/scenarios/`.
+The current suite has 500 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -457,7 +457,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 495 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 500 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -46,6 +46,7 @@ import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
 import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
+import { setV2ProfileFloors } from './lib/requirement-registry.js';
 function parseArgs(argv) {
     let baseUrl;
     let apiKey;
@@ -299,13 +300,7 @@ function claimedProfilesFor(doc) {
  * no v2 host could ever certify. Falls back to the empty set only when the
  * registry is genuinely absent from the layout, and says so.
  */
-function claimedProfilesForV2(doc, conformanceRoot) {
-    // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
-    // this package — instead of guessing directory shapes. Hand-rolled candidates
-    // found the registry in a repo checkout and missed it in every published
-    // install, where npm hoists the peer to a SIBLING package dir: the probe that
-    // walked one level up landed on the `@openwop/` scope directory, not a
-    // package, so a real host run silently claimed nothing.
+function v2RegistryPath(conformanceRoot) {
     const candidates = [];
     try {
         const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
@@ -313,8 +308,17 @@ function claimedProfilesForV2(doc, conformanceRoot) {
     }
     catch { /* not installed as a package; the repo-layout candidates below */ }
     candidates.push(resolvePath(conformanceRoot, 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec-artifacts', 'spec', 'v2', 'profiles.json'));
-    const found = candidates.find((c) => existsSync(c));
-    if (found === undefined) {
+    return candidates.find((c) => existsSync(c)) ?? null;
+}
+function claimedProfilesForV2(doc, conformanceRoot) {
+    // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
+    // this package — instead of guessing directory shapes. Hand-rolled candidates
+    // found the registry in a repo checkout and missed it in every published
+    // install, where npm hoists the peer to a SIBLING package dir: the probe that
+    // walked one level up landed on the `@openwop/` scope directory, not a
+    // package, so a real host run silently claimed nothing.
+    const found = v2RegistryPath(conformanceRoot);
+    if (found === null) {
         process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
         return [];
     }
@@ -342,6 +346,46 @@ function claimedProfilesForV2(doc, conformanceRoot) {
     }
     return out;
 }
+/**
+ * `spec/v2/profiles.json` `floorScenarios` → scenario file names. A
+ * `planned:<name>` entry names a scenario the registry expects but that may not
+ * exist yet; it resolves to `v2-<name>.test.ts` when that file is in the
+ * manifest and is dropped otherwise, so a planned-but-unwritten floor cannot
+ * fail a host for the corpus's own backlog.
+ */
+function v2ProfileFloors(conformanceRoot) {
+    const registryPath = v2RegistryPath(conformanceRoot);
+    if (registryPath === null)
+        return {};
+    let known;
+    try {
+        known = new Set(Object.keys(JSON.parse(readFileSync(resolvePath(conformanceRoot, 'scenario-majors.json'), 'utf8')).majors));
+    }
+    catch {
+        known = new Set();
+    }
+    let registry;
+    try {
+        registry = JSON.parse(readFileSync(registryPath, 'utf8'));
+    }
+    catch {
+        return {};
+    }
+    const out = {};
+    for (const p of registry.profiles ?? []) {
+        if (typeof p.id !== 'string')
+            continue;
+        const raw = Array.isArray(p.floorScenarios) ? p.floorScenarios.map(String) : [];
+        const files = [];
+        for (const entry of raw) {
+            const name = entry.startsWith('planned:') ? `v2-${entry.slice('planned:'.length)}.test.ts` : entry.endsWith('.test.ts') ? entry : `${entry}.test.ts`;
+            if (known.size === 0 || known.has(name))
+                files.push(name);
+        }
+        out[p.id] = files;
+    }
+    return out;
+}
 /**
  * Reduce a vitest JSON report into a per-scenario-file terminal state, keyed by
  * the test-file basename (e.g. `discovery.test.ts`) to align with the basenames
@@ -450,6 +494,10 @@ async function runCertify(args, baseUrl, apiKey) {
     const sha256 = createHash('sha256').update(canonicalJSON(document)).digest('hex');
     // (b) Derive claimedProfiles from the captured document.
     const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document, conformanceRoot) : claimedProfilesFor(document);
+    // Major-2 floors come from spec/v2/profiles.json. Without this the derivation
+    // measures a v2 host against v1 scenario files a major-2 run never executes,
+    // and refuses certification for not running them.
+    setV2ProfileFloors(target.major === 2 ? v2ProfileFloors(conformanceRoot) : null);
     // (c) Run the suite, capturing per-scenario terminal state via the vitest
     // JSON reporter. server-targeted scenarios live under src/scenarios/.
     const reportDir = mkdtempSync(join(tmpdir(), 'owp-certify-'));

package/dist/lib/requirement-registry.js

@@ -76,7 +76,27 @@ export function floorFilesFor(profile, document) {
  * discovery-conditional floor (RFC 0148 §C G7 — `openwop-replay-fork`): without
  * it such a floor is UNEVALUABLE and this returns `null`, never `[]`.
  */
+/**
+ * Major-2 floors come from `spec/v2/profiles.json`, not from the v1 table.
+ * `PROFILE_FLOOR_SCENARIOS` names v1 scenario FILES (`runs-lifecycle.test.ts`,
+ * `discovery.test.ts`, …) that `scenario-majors.json` assigns to major 1 and a
+ * major-2 run therefore never executes — so every one of them came back
+ * unclassified and a v2 host was refused certification for not running v1
+ * scenarios. Set by the runner before deriving; empty means the registry
+ * declares no floor for that profile, which is a real "witnesses nothing yet",
+ * not an unclassified return.
+ */
+let v2Floors = null;
+export function setV2ProfileFloors(floors) {
+    v2Floors = floors;
+}
 export function requirementsFor(profile, document) {
+    if (v2Floors !== null) {
+        const files = v2Floors[profile];
+        if (files === undefined)
+            return null;
+        return files.map(requirementIdForScenario);
+    }
     const floor = PROFILE_FLOOR_SCENARIOS[profile];
     if (floor === undefined)
         return null;

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.2",
-  "stampSha256": "b238d58665762e832fcd76df7149671705ffa588969cc80737358255d29488c9"
+  "version": "2.0.0-rc.28",
+  "stampSha256": "c7d6661057eca87dffb69c7d262e9b0dd6025087be2950df2007214fda6b0e57"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.2",
+  "version": "2.0.0-rc.28",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.2"
+    "@openwop/spec-artifacts": "2.0.0-rc.28"
   }
 }

package/requirements.json

@@ -2,9 +2,9 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 539,
-    "tests": 2108,
-    "withStableId": 2108,
+    "files": 546,
+    "tests": 2122,
+    "withStableId": 2122,
     "interpolatedTitles": 0,
     "explicitIds": 2057
   },
@@ -12262,6 +12262,58 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.era-key-stamped-v1.a-run-the-host-just-created-carries-eventlogschemaversion",
+      "file": "era-key-stamped-v1.test.ts",
+      "line": 75,
+      "title": "a run the host just created carries eventLogSchemaVersion",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "every persisted run document MUST carry an eventLogSchemaVersion — the field is prose-only (run-snapshot.schema.json requires just runId, workflowId and status), so a snapshot without it validates cleanly and only this check can see its absence",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.era-key-stamped-v1.a-freshly-created-run-is-not-classified-legacy-by-the-host-s-own-rule",
+      "file": "era-key-stamped-v1.test.ts",
+      "line": 98,
+      "title": "a freshly created run is not classified legacy by the host's own rule",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v1/version-negotiation.md §Legacy detection",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.era-key-stamped-v1.a-run-the-host-just-created-carries-engineversion-the-legacy-escape-cannot-reach",
+      "file": "era-key-stamped-v1.test.ts",
+      "line": 124,
+      "title": "a run the host just created carries engineVersion — the legacy escape cannot reach it",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "every persisted run document MUST carry engineVersion; the \"MAY omit\" escape applies only to legacy runs that predate the contract, and this run was created moments ago",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.errors.get-v1-runs-nonexistentid-returns-canonical-envelope",
       "file": "errors.test.ts",
@@ -25741,6 +25793,39 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-advertised-fixtures-exist.a-sampled-advertised-fixture-is-actually-creatable-not-just-listed",
+      "file": "v2-advertised-fixtures-exist.test.ts",
+      "line": 62,
+      "title": "a sampled advertised fixture is actually creatable, not just listed",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-advertised-path-space-served.a-host-advertising-major-2-reaches-the-surfaces-it-already-serves-under-v1",
+      "file": "v2-advertised-path-space-served.test.ts",
+      "line": 87,
+      "title": "a host advertising major 2 reaches the surfaces it already serves under /v1",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "at least one non-well-known surface MUST be reachable under major 2, or the advertisement rests entirely on the one resource the header selects",
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-approver-enforced.a-resolver-outside-approverslist-is-refused-at-resolve-time",
       "file": "v2-approver-enforced.test.ts",
@@ -26243,7 +26328,8 @@
         },
         {
           "section": "spec/v2/core/versioning.md §5",
-          "requirement": "the v2 read MUST name the same run"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "spec/v2/core/versioning.md §1.4",
@@ -26254,7 +26340,7 @@
     {
       "id": "openwop.it.v2-dual-stack-negotiation.an-unlisted-major-is-406-protocol-version-unsupported-with-details-protocolversi",
       "file": "v2-dual-stack-negotiation.test.ts",
-      "line": 83,
+      "line": 108,
       "title": "an unlisted major is 406 protocol_version_unsupported with details.protocolVersions[]",
       "explicitId": "openwop.requirement.0172.dual-stack-negotiation.unlisted-major",
       "citations": [
@@ -26278,7 +26364,7 @@
     {
       "id": "openwop.it.v2-dual-stack-negotiation.openwop-version-2-0-on-a-v1-path-is-400-protocol-version-mismatch",
       "file": "v2-dual-stack-negotiation.test.ts",
-      "line": 94,
+      "line": 119,
       "title": "OpenWOP-Version: 2.0 on a /v1/ path is 400 protocol_version_mismatch",
       "explicitId": "openwop.requirement.0172.dual-stack-negotiation.v1-path-mismatch",
       "citations": [
@@ -26297,7 +26383,7 @@
     {
       "id": "openwop.it.v2-dual-stack-negotiation.every-response-reports-the-contract-that-produced-it",
       "file": "v2-dual-stack-negotiation.test.ts",
-      "line": 103,
+      "line": 128,
       "title": "every response reports the contract that produced it",
       "explicitId": "openwop.requirement.0172.dual-stack-negotiation.response-header",
       "citations": [
@@ -26533,7 +26619,7 @@
     {
       "id": "openwop.it.v2-era-2-append-vocabulary.the-run-keeps-the-era-it-was-created-with-an-append-does-not-promote-it-to-era-3",
       "file": "v2-era-2-append-vocabulary.test.ts",
-      "line": 119,
+      "line": 128,
       "title": "the run keeps the era it was created with; an append does not promote it to era 3",
       "explicitId": null,
       "citations": [
@@ -26587,6 +26673,44 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-era-stamp-universal.discovery-advertises-an-era-the-host-actually-writes-and-a-new-run-carries-it",
+      "file": "v2-era-stamp-universal.test.ts",
+      "line": 40,
+      "title": "discovery advertises an era the host actually writes, and a new run carries it",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-era-stamp-universal.a-v2-era-host-stamps-3-so-its-new-runs-are-never-read-as-the-v1-era",
+      "file": "v2-era-stamp-universal.test.ts",
+      "line": 80,
+      "title": "a v2-era host stamps 3, so its new runs are never read as the v1 era",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a host advertising era 3 MUST stamp 3 on every run it creates — an unstamped run made after the cut is indistinguishable from a pre-cut run and every reader translates it as era 2, which is a silent wrong read rather than an error",
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-error-registry.an-error-response-is-the-closed-envelope-with-a-registered-code-at-its-registere",
       "file": "v2-error-registry.test.ts",
@@ -28058,6 +28182,49 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-version-header-honored.openwop-version-is-honored-or-refused-never-ignored",
+      "file": "v2-version-header-honored.test.ts",
+      "line": 61,
+      "title": "OpenWOP-Version is honored or refused — never ignored",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a host that does not serve major 2 MUST refuse with 406 protocol_version_unsupported, which it did",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "answering 200 to OpenWOP-Version: 2.0 with a body byte-identical to the header-less fetch means the header was IGNORED, not honored — the host served v1 and called it v2. Refusing with 406 is the correct answer for a host that does not implement major 2; silently returning v1 is the one answer that no presence-gated scenario can detect, because an absent v2 shape records `inapplicable` whether the host refused or ignored",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-version-header-honored.a-host-advertising-two-majors-serves-two-different-representations",
+      "file": "v2-version-header-honored.test.ts",
+      "line": 92,
+      "title": "a host advertising two majors serves two different representations",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the v1 document and the closed v2 root differ by construction (capabilities.md §1), so a host advertising both majors returning identical bytes for both has advertised a major it does not actually serve",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
@@ -28311,7 +28478,7 @@
     {
       "id": "openwop.it.version-negotiation.get-well-known-openwop-returns-capabilities-with-protocolversion-string",
       "file": "version-negotiation.test.ts",
-      "line": 46,
+      "line": 68,
       "title": "GET /.well-known/openwop returns Capabilities with protocolVersion (string)",
       "explicitId": "openwop.it.version-negotiation.get-well-known-openwop-returns-capabilities-with-protocolversion-string",
       "citations": [
@@ -28324,7 +28491,7 @@
     {
       "id": "openwop.it.version-negotiation.every-event-has-the-6-required-runeventdoc-fields-per-run-event-schema-json",
       "file": "version-negotiation.test.ts",
-      "line": 60,
+      "line": 82,
       "title": "every event has the 6 required RunEventDoc fields per run-event.schema.json",
       "explicitId": "openwop.it.version-negotiation.every-event-has-the-6-required-runeventdoc-fields-per-run-event-schema-json",
       "citations": [
@@ -28365,7 +28532,7 @@
     {
       "id": "openwop.it.version-negotiation.event-sequences-within-a-run-are-strictly-monotonic",
       "file": "version-negotiation.test.ts",
-      "line": 104,
+      "line": 126,
       "title": "event sequences within a run are strictly monotonic",
       "explicitId": "openwop.it.version-negotiation.event-sequences-within-a-run-are-strictly-monotonic",
       "citations": [
@@ -28379,7 +28546,7 @@
     {
       "id": "openwop.it.version-negotiation.events-poll-with-lastsequence-past-current-end-returns-empty-events-iscomplete",
       "file": "version-negotiation.test.ts",
-      "line": 132,
+      "line": 154,
       "title": "events/poll with lastSequence past current end returns empty events + isComplete",
       "explicitId": "openwop.it.version-negotiation.events-poll-with-lastsequence-past-current-end-returns-empty-events-iscomplete",
       "citations": [
@@ -34426,6 +34593,82 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-v2-discovery-root-publishes-signingkeys-the-surface-the-rfc-named",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 103,
+      "title": "the v2 discovery root publishes signingKeys[] — the surface the RFC named",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the v2 discovery root MUST carry signingKeys[] — RFC 0168 disposed of \"an Ed25519 attestation without a key registry is a signature nobody can check\" by naming this surface, so if it is absent the disposition names a place that does not exist and every bundle signature is unattributable",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a signingKeys[] entry MUST be closed; an open key record lets a host attach meaning the verifier does not read",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a signingKeys[] entry MUST be able to record retirement, because a retired key has to stay listed — dropping it silently invalidates every bundle it already signed, which is the opposite of what an evidence trail is for",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-front-door-gate-verifies-the-attestation-instead-of-inspecting-the-string",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 134,
+      "title": "the Front-door gate verifies the attestation instead of inspecting the string",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the gate MUST NOT accept a bundle signature by presence: `typeof signature.sig === 'string'` is satisfied by any string, so it cannot distinguish a host key from a keypair minted seconds earlier by whoever wrote the bundle",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the gate MUST resolve signature.keyId against the host's published signingKeys[] and verify the Ed25519 attestation under it — resolving without verifying, or verifying against a key the bundle supplied itself, both leave the signature unaccountable",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-four-signature-outcomes-stay-distinct-collapsing-any-two-restores-the-defect",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 149,
+      "title": "the four signature outcomes stay distinct — collapsing any two restores the defect",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.signingkeys-is-reachable-from-a-v1-root-too-a-bundle-is-v3-regardless-of-major",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 170,
+      "title": "signingKeys[] is reachable from a v1 root too — a bundle is v3 regardless of major",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the v1 discovery root MUST also carry signingKeys[]: a certification bundle is v3 regardless of major, and a v1-only host has only this document to resolve signature.keyId against — putting the key on the v2 root alone leaves every v1 host bundle unattributable",
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-corpus-tag-pinned.every-vendoring-consumer-in-the-cross-repo-inventory-records-a-published-corpus",
       "file": "v2-corpus-tag-pinned.test.ts",
@@ -34454,6 +34697,30 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-error-registry-prose-parity.errors-md-states-the-registry-count-it-was-generated-from-and-renders-every-code",
+      "file": "v2-error-registry-prose-parity.test.ts",
+      "line": 26,
+      "title": "errors.md states the registry count it was generated from and renders every code",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "errors.md states the registry size at least once, so the claim is checkable",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-event-naming-rule.every-closed-enum-v2-event-type-is-two-kebab-segments-and-every-recorded-artifac",
       "file": "v2-event-naming-rule.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 495,
-    "v1": 444,
-    "v2": 52
+    "files": 500,
+    "v1": 445,
+    "v2": 56
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -564,6 +564,9 @@
     "envelope-variant-discriminator-static.test.ts": [
       1
     ],
+    "era-key-stamped-v1.test.ts": [
+      1
+    ],
     "errors.test.ts": [
       1
     ],
@@ -1228,6 +1231,12 @@
     "trigger-stream-cdc-sources.test.ts": [
       1
     ],
+    "v2-advertised-fixtures-exist.test.ts": [
+      2
+    ],
+    "v2-advertised-path-space-served.test.ts": [
+      2
+    ],
     "v2-approver-enforced.test.ts": [
       2
     ],
@@ -1273,6 +1282,9 @@
     "v2-era-key.test.ts": [
       2
     ],
+    "v2-era-stamp-universal.test.ts": [
+      2
+    ],
     "v2-error-registry.test.ts": [
       2
     ],
@@ -1375,6 +1387,9 @@
     "v2-v1-signed-webhook-accepted.test.ts": [
       2
     ],
+    "v2-version-header-honored.test.ts": [
+      2
+    ],
     "v2-webhook-durable-delivery.test.ts": [
       2
     ],