@openwop/openwop-conformance 2.0.0-rc.38 → 2.0.0-rc.8

package/src/global-setup.ts

@@ -75,17 +75,6 @@ export function setup(): void {
   // Suite 2.0.0: in the published layout the contract is the spec-artifacts peer (RFC 0168 §D.2).
   const stamp = LAYOUT === 'published' ? verifyPeerContract(PKG_ROOT_PATH) : verifyCorpusStamp(PKG_ROOT_PATH, LAYOUT);
   process.stderr.write(`${describeVerdict(stamp)}\n`);
-  // A version skew and a digest mismatch both have to refuse, but they are
-  // different faults with different fixes, and reporting them in the same words
-  // sends the reader to debug a corrupt install when nothing is corrupt.
-  if (stamp.kind === 'peer-version') {
-    throw new Error(
-      `openwop-conformance: refusing to run — this suite was packed against @openwop/spec-artifacts@${stamp.lockVersion}, ` +
-      `but @openwop/spec-artifacts@${stamp.peerVersion} is installed. They are declared EXACT peers. ` +
-      `Install both at the same explicit version; do NOT install at a dist-tag such as \`next\`, which moves per package ` +
-      `and can name a pair that was never published together.`,
-    );
-  }
   if (stamp.kind === 'mismatch') {
     throw new Error('openwop-conformance: refusing to run — schemas/CORPUS-STAMP.json digests do not match the vendored api/ + schemas/ files. Reinstall the package; do not hand-patch vendored contract files.');
   }

package/src/lib/corpus-stamp.ts

@@ -39,17 +39,7 @@ export interface CorpusStamp {
 export type StampVerdict =
   | { readonly kind: 'verified'; readonly files: number }
   | { readonly kind: 'not-applicable'; readonly reason: string }
-  | { readonly kind: 'mismatch'; readonly missing: readonly string[]; readonly altered: readonly string[]; readonly extra: readonly string[] }
-  /**
-   * The peer is INSTALLED and INTACT but is a different version than the suite
-   * was packed against. Its own kind because the remedy is completely different
-   * from a digest mismatch — nothing is corrupt, two versions are simply out of
-   * step — and because the generic message sends readers to debug a broken
-   * install. Reported by a tier-2 host that hit it through the `next` dist-tag:
-   * the tag moves per package, so `@next` can name an exact-peer PAIR that was
-   * never published together.
-   */
-  | { readonly kind: 'peer-version'; readonly peerVersion: string; readonly lockVersion: string };
+  | { readonly kind: 'mismatch'; readonly missing: readonly string[]; readonly altered: readonly string[]; readonly extra: readonly string[] };
 
 export const STAMP_RELATIVE_PATH = join('schemas', 'CORPUS-STAMP.json');
 
@@ -104,11 +94,7 @@ export function verifyPeerContract(pkgRoot: string): StampVerdict {
   if (!existsSync(stampPath)) return { kind: 'mismatch', missing: ['@openwop/spec-artifacts/CORPUS-STAMP.json'], altered: [], extra: [] };
   const stamp = JSON.parse(readFileSync(stampPath, 'utf8')) as { package: string; version: string; files: Record<string, string> };
   const digest = createHash('sha256').update(JSON.stringify({ package: stamp.package, version: stamp.version, files: stamp.files })).digest('hex');
-  // A plain version difference is NOT corruption; report it as itself so the
-  // message names the two versions and the fix, instead of sending the reader
-  // to hunt a damaged install.
-  if (stamp.version !== lock.version) return { kind: 'peer-version', peerVersion: stamp.version, lockVersion: lock.version };
-  if (digest !== lock.stampSha256) return { kind: 'mismatch', missing: [], altered: [`@openwop/spec-artifacts ${stamp.version} stamp digest ${digest.slice(0, 12)} ≠ the suite's lock ${lock.stampSha256.slice(0, 12)} — same version, different contents`], extra: [] };
+  if (stamp.version !== lock.version || digest !== lock.stampSha256) return { kind: 'mismatch', missing: [], altered: [`@openwop/spec-artifacts ${stamp.version} (digest ${digest.slice(0, 12)}) ≠ the suite's lock ${lock.version} (${lock.stampSha256.slice(0, 12)})`], extra: [] };
   const missing: string[] = []; const altered: string[] = [];
   for (const [rel, d] of Object.entries(stamp.files)) { const p = join(peerRoot, ...rel.split('/')); if (!existsSync(p)) missing.push(rel); else if (sha256File(p) !== d) altered.push(rel); }
   if (missing.length || altered.length) return { kind: 'mismatch', missing, altered, extra: [] };
@@ -157,14 +143,6 @@ export function describeVerdict(v: StampVerdict): string {
       return `[openwop-conformance] corpus stamp VERIFIED — ${v.files} vendored api/ + schemas/ files match their SHA-256 digests`;
     case 'not-applicable':
       return `[openwop-conformance] corpus stamp not checked — ${v.reason}`;
-    case 'peer-version':
-      return (
-        `[openwop-conformance] peer version MISMATCH — this suite was packed against ` +
-        `@openwop/spec-artifacts@${v.lockVersion} but @openwop/spec-artifacts@${v.peerVersion} is installed. ` +
-        `Nothing is corrupt: the two are declared EXACT peers and are simply out of step. ` +
-        `Install both at the same explicit version — never at a dist-tag such as \`next\`, which moves per package ` +
-        `and can therefore name a pair that was never published together.`
-      );
     case 'mismatch':
       return (
         `[openwop-conformance] corpus stamp MISMATCH — the vendored contract is not the one this suite shipped ` +

package/src/scenarios/v2-advertised-fixtures-exist.test.ts

@@ -3,42 +3,40 @@
  * the host must be able to honour (suite 2.0.0, target major 2; unaided).
  *
  * `fixtures[]` in discovery gates scenarios: `isFixtureAdvertised(id)` decides
- * whether a scenario runs at all. So a host whose advertised list and seeded set
- * drift apart fails somewhere else entirely — the scenario gated on the missing
- * fixture attempts, fails on a run that cannot be created, and the failure is
- * attributed to that scenario's requirement rather than to the advertisement
- * that was wrong. That misattribution is what this scenario exists to catch.
+ * whether a scenario runs at all. Nothing checked that an advertised id names a
+ * fixture the corpus actually defines, or that the host can serve it. A host
+ * whose advertised list and seeded set drift apart therefore fails somewhere
+ * else entirely — the scenario gated on the missing fixture attempts, fails on
+ * a run that cannot be created, and the failure is attributed to that
+ * scenario's requirement rather than to the advertisement that was wrong.
  *
- * **This scenario shipped with a second leg that was wrong, and the correction
- * matters more than the check.** That leg asserted the advertised ids are a
- * SUBSET of `conformance/fixtures/` — "the vocabulary is closed, so an id the
- * corpus does not define is a typo or an invention". The vocabulary is not
- * closed. Host-supplied fixtures are the normal case: dozens of ids the
- * scenarios gate on are deliberately not shipped, and `v2-approver-enforced`
- * says so in its own docstring — it needs an approval fixture whose
- * `approversList` names a principal the suite is not, and records `blocked`
- * naming it precisely because "no such fixture ships in `conformance/fixtures/`".
+ * No host is currently known to exhibit this. A tier-2 host was thought to
+ * (46 seeded against 47 advertised) and then verified and retracted it — the
+ * count had been eyeballed from an array literal rather than measured, and the
+ * two sets are in fact identical. The scenario is kept because the failure mode
+ * is a property of the gating mechanism, not of that host: `fixtures[]` decides
+ * whether a scenario runs, so a wrong advertisement is charged to whatever runs
+ * next. Leg 1 is also the stronger check — an id the corpus catalog does not
+ * define is wrong however well a host's own two lists agree with each other.
  *
- * So the leg failed a host for doing exactly what the corpus asks. It was found
- * by running the suite against the reference host, which advertised two
- * host-supplied fixtures and was marked non-conformant for it. Set membership
- * cannot distinguish a typo from a legitimate host fixture, and a check that
- * cannot tell those apart is not a check — it is a coin flip that happens to
- * land on "fail" for correct hosts.
- *
- * What survives is the leg that was always sound: an advertised fixture MUST be
- * creatable. That holds whoever defines it, and it is the one that catches the
- * drift the misattribution comes from.
+ * Two legs, both cheap:
+ *   1. the advertised ids are a subset of the corpus fixture catalog — the
+ *      vocabulary is closed, so an id the corpus does not define is a typo or
+ *      an invention, not a capability;
+ *   2. a bounded sample of advertised fixtures is actually creatable, so the
+ *      list is a claim about reachable state rather than a wish.
  *
  * @see spec/v2/core/conformance.md
- * @see conformance/src/scenarios/v2-approver-enforced.test.ts (a host-supplied fixture, by design)
+ * @see conformance/fixtures.md
  */
 
 import { describe, it, expect } from 'vitest';
+import { existsSync, readdirSync } from 'node:fs';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery } from '../lib/v2.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
+import { FIXTURES_DIR } from '../lib/paths.js';
 
 const ID = 'openwop.requirement.0168.advertised-fixtures-exist';
 const DOC = 'spec/v2/core/conformance.md §Fixtures';
@@ -59,6 +57,26 @@ function advertisedIds(doc: Record<string, unknown>): string[] {
 }
 
 describe('v2-advertised-fixtures-exist (conformance.md §Fixtures)', () => {
+  it('every advertised fixture id is one the corpus defines', async () => {
+    const doc = await v2Discovery().catch(() => null);
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable');
+    const ids = advertisedIds(doc);
+    if (ids.length === 0) return softSkip('inapplicable', 'the host advertises no fixtures[] — there is no claim to falsify');
+    if (FIXTURES_DIR === null || !existsSync(FIXTURES_DIR)) {
+      return softSkip('blocked', 'the fixture catalog is absent from this layout, so an advertised id cannot be checked against it');
+    }
+    const catalog = new Set(
+      readdirSync(FIXTURES_DIR)
+        .filter((f) => f.endsWith('.json'))
+        .map((f) => f.replace(/\.json$/, '')),
+    );
+    const unknown = ids.filter((id) => !catalog.has(id));
+    expect(
+      unknown,
+      req(ID, DOC, `every id in fixtures[] MUST name a fixture the corpus defines — the vocabulary is closed, so an id the catalog does not carry is a typo or an invention rather than a capability (${unknown.length} unknown of ${ids.length}: ${unknown.slice(0, 5).join(', ')})`),
+    ).toEqual([]);
+  });
+
   it('a sampled advertised fixture is actually creatable, not just listed', async () => {
     const doc = await v2Discovery().catch(() => null);
     if (!doc) return softSkip('blocked', 'v2 discovery unreachable');

package/src/scenarios/v2-dual-stack-negotiation.test.ts

@@ -76,35 +76,7 @@ describe('v2 dual-stack-negotiation (RFC 0172 §A.3–§A.4 — gated on two maj
     const read = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`, { headers: { 'OpenWOP-Version': '2.0' } }));
     if (read === null) return softSkip('blocked', 'GET /runs/{runId} unreachable (fetch failed)');
     expect(read.status, req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', 'the overlap: a run created through /v1/runs MUST be readable through GET /runs/{runId} with OpenWOP-Version: 2.0')).toBe(200);
-    // The v2 read MUST name the same run BY ITS TENANT-BOUND PROJECTION.
-    //
-    // This assertion has been wrong twice, in opposite directions, and the pair
-    // is the point:
-    //
-    //   until 2026-09-04  `.toBe(runId)` — byte-equality with the v1 id, cited to
-    //                     versioning.md §5, which said nothing about identifiers.
-    //                     TIGHTER than its prose: it failed a host that had
-    //                     implemented identity.md §5 faithfully.
-    //   rc.28             accepted the bare v1 id OR its projection. LOOSER than
-    //                     its prose: `run-snapshot.schema.json` binds `runId` to
-    //                     `ids.schema.json#/$defs/runId`, whose pattern REQUIRES
-    //                     the `/`. rc.28 passed a response the v2 contract
-    //                     rejects — the same defect it was written to fix,
-    //                     committed in the act of fixing it.
-    //
-    // §5 now states the rule outright, and the reason it is a MUST is not
-    // stylistic: `identity.md` §5 requires a host to refuse a tenant-bound id
-    // whose tenant segment is not the caller's (`403 id_tenant_mismatch`). A
-    // bare id HAS no tenant segment, so that mandatory check cannot run on it.
-    // A legacy unprefixed form would be a class of ids — precisely the ones
-    // carried over from v1 — exempt from major 2's tenant isolation.
-    //
-    // So: the projection, and only the projection. A bare id here is a finding.
-    const readId = (read.json as { runId?: unknown } | undefined)?.runId;
-    expect(
-      readId,
-      req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', `a run minted under major 1 MUST be named by its tenant-bound projection <tenantId>/${'${the v1 id}'} when read under major 2 — the bare id is not merely unconventional, it carries no tenant segment for the mandatory 403 id_tenant_mismatch check to read (identity.md §5), and ids.schema.json#/$defs/runId has no legacy branch. Got ${JSON.stringify(readId)} for a run created as ${JSON.stringify(runId)}`),
-    ).toMatch(new RegExp(`^[A-Za-z0-9._~-]{1,128}/${runId.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`));
+    expect((read.json as { runId?: unknown } | undefined)?.runId, req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', 'the v2 read MUST name the same run')).toBe(runId);
     expect(major(read), req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §1.4', 'the v2 read MUST report the 2.x contract that produced it')).toBe('2');
   });
 

package/src/scenarios/v2-era-2-append-vocabulary.test.ts

@@ -61,15 +61,6 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
       return softSkip('blocked', `GET /runs/${runId}/events/poll answered ${before?.status ?? 'no response'} on the seeded era-2 run — the log cannot be read back`);
     }
     const seedCount = eventsOf(before).length;
-    // The seam returning ok is a WRAPPER claim; the readable log is the artifact.
-    // A seam that reports success and seeds nothing leaves no era-2 log to append
-    // to, so there is nothing here to witness the writer rule with — that is
-    // `blocked`, not a writer-rule failure. Asserting against an empty log would
-    // charge this requirement for a seam defect, which is the misattribution the
-    // suite exists to avoid.
-    if (seedCount === 0) {
-      return softSkip('blocked', `seedEra2Log reported success but the log reads back empty (0 events) — the seam's return value is not evidence that a log exists, and without a seeded era-2 log the writer rule is unwitnessed here`);
-    }
 
     // One canonical mutation so the HOST's own writer appends. Cancel is the
     // universally available terminal transition; a host that refuses it on a

package/src/scenarios/v2-interrupt-token-scheme.test.ts

@@ -40,7 +40,7 @@ describe('v2 interrupt-token-scheme (RFC 0170 §E.1)', () => {
     if (res === null) return softSkip('blocked', 'GET /interrupts/{token} unreachable (fetch failed)');
     expect([401, 404].includes(res.status), req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', DOC, `a token outside the ow2.<alg>.<kid>.<payload>.<mac> grammar MUST NOT resolve — 401 interrupt_token_invalid (or 404 not_found where the signed-token surface is not mounted); got ${res.status}`)).toBe(true);
     const code = readErrorCode(res.json);
-    expect(res.status === 401 ? code === 'interrupt_token_invalid' : (code === 'not_found' || code === 'interrupt_not_found'), req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', 'spec/v2/core/interrupt.md §Tokens', `the refusal MUST carry a registered code (401 → interrupt_token_invalid; 404 → not_found OR the more precise interrupt_not_found, both registered in spec/v2/errors.json for this state — a scenario narrower than its own registry fails the host that answers more precisely); got ${String(code)}`)).toBe(true);
+    expect(res.status === 401 ? code === 'interrupt_token_invalid' : code === 'not_found', req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', 'spec/v2/core/interrupt.md §Tokens', `the refusal MUST carry its registered code (401 → interrupt_token_invalid, 404 → not_found); got ${String(code)}`)).toBe(true);
   });
 
   it('a well-formed token under a kid the host does not hold is 401 interrupt_token_invalid', async () => {

package/src/scenarios/version-negotiation.test.ts

@@ -7,31 +7,9 @@
  *
  * What we CAN test cheaply:
  *   1. Server advertises a `protocolVersion` in `Capabilities`.
- *   2. `protocolVersion` is advertised, and every event carries the six
- *      required `RunEventDoc` fields.
- *
- *   This file previously claimed to check "the four version axes
- *   (`engineVersion`, `eventLogSchemaVersion`, per-event `schemaVersion`,
- *   `pinnedVersions`)". IT DID NOT. `protocolVersion` was the only axis
- *   asserted, and across all 444 v1 scenario files the sole occurrence of the
- *   identifier `eventLogSchemaVersion` was that sentence — a docstring
- *   describing a check that did not exist. A comment claiming coverage is
- *   worse than no comment: it answers "is this tested?" for anyone who greps,
- *   and answers it wrongly.
- *
- *   Current state of the four, stated so this comment can be checked rather
- *   than trusted: `eventLogSchemaVersion` and `engineVersion` are witnessed by
- *   `era-key-stamped-v1.test.ts` (both are run-document `MUST`s in
- *   `version-negotiation.md` §Stamping, and both were unasserted until
- *   2026-09-04). Per-event `schemaVersion` and `pinnedVersions` are **not
- *   asserted here and carry no `MUST` in that document** — checked, rather
- *   than assumed to be a gap.
- *
- *   This paragraph was itself wrong for one release candidate: it said
- *   `engineVersion` "remains UNASSERTED" after the leg asserting it had
- *   landed. A docstring that describes coverage goes stale the moment
- *   coverage changes, which is the argument for stating what can be
- *   re-derived rather than what was true once.
+ *   2. The four version axes (`engineVersion`,
+ *      `eventLogSchemaVersion`, per-event `schemaVersion`,
+ *      `pinnedVersions`) appear where the spec says they should.
  *   3. Forward-compat read: events carrying an UNKNOWN
  *      `schemaVersion` SHOULD still be readable via the events/poll
  *      endpoint without 5xx (best-effort fold per

package/src/setup.ts

@@ -40,8 +40,6 @@ import { softSkipDisposition } from './lib/soft-skip.js';
 import { ItIdAllocator, takeExplicitRequirementId } from './lib/requirement-ids.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './lib/spec-coherence.js';
 import type { DiscoveryPayload } from './lib/profiles.js';
-import { targetMajor } from './lib/seams.js';
-import { softSkip } from './lib/soft-skip.js';
 
 const SUITE_INIT_TIMEOUT_MS = 5_000;
 
@@ -279,62 +277,6 @@ function _fileOf(task: { file?: { filepath?: string; name?: string } } | undefin
   const f = task?.file?.filepath ?? task?.file?.name;
   return typeof f === 'string' && f.length > 0 ? basename(f) : null;
 }
-// ---------------------------------------------------------------------------
-// The applicability check and the assertion MUST run under the same contract.
-//
-// A scenario's registration in scenario-majors.json says which target majors it
-// is written for. The driver reads OPENWOP_TARGET_MAJOR to decide which header
-// and path space every probe uses. Nothing connected the two: a lane that ran
-// vitest directly over all 501 files at the default (major 1) executed every
-// major-2 scenario with major-1 requests. The scenarios' own gates call
-// v2Discovery(), which sets the header EXPLICITLY, so the gate passed and the
-// probe went out as v1 — a check that proved the host speaks v2 with one
-// request, then tested a v2 requirement with a request that did not.
-//
-// Measured on a tier-1 host 2026-09-04: three "host defects" reported from that
-// lane, all of which evaporated at major 2; the host was one edit from "fixing"
-// correct behaviour. And in the other direction: 4 of 56 v2 files fail on every
-// host forever under a major-1 driver, so a gate that runs them that way is red
-// by construction and gets reasoned past. Both are the same defect: a scoped
-// signal read as unscoped, with the scope nowhere in the output.
-//
-// So: a file whose registered majors do not include the driver's target major
-// is INAPPLICABLE to this lane, recorded as such with the reason, and never
-// probes. Files not in the registry (coherence checks, lib tests) are untouched.
-// ---------------------------------------------------------------------------
-const SCENARIO_MAJORS: Record<string, number[]> = (() => {
-  try {
-    const p = join(PKG_ROOT_PATH, 'scenario-majors.json');
-    if (!existsSync(p)) return {};
-    return (JSON.parse(readFileSync(p, 'utf8')) as { majors?: Record<string, number[]> }).majors ?? {};
-  } catch {
-    return {};
-  }
-})();
-
-beforeEach((ctx) => {
-  const p = (expect.getState() as { testPath?: string }).testPath;
-  if (!p) return;
-  const file = basename(p);
-  const majors = SCENARIO_MAJORS[file];
-  if (!majors) return;
-  const lane = targetMajor();
-  if (majors.includes(lane)) return;
-  const detail = `registered for target major ${majors.join('/')} and this lane runs at major ${lane} (OPENWOP_TARGET_MAJOR) — the probe would go out under a contract the scenario's gate does not use; select files with --target-major or set the variable`;
-  // Two records, one per resolver. The per-TEST disposition is read from the
-  // requirement journal (the same entry behaviorGate writes), so the row lands
-  // as `inapplicable` with this reason rather than `skipped`, which under RFC
-  // 0148 would claim the operator opted out. The per-FILE note covers the
-  // all-skipped fallback in resolveFileRecord.
-  try {
-    recordRequirement('openwop.family.lane-target-major', 'inapplicable', detail, { scenarioFile: file });
-  } catch {
-    /* never fail a test for bookkeeping */
-  }
-  softSkip('inapplicable', detail);
-  ctx.skip();
-});
-
 beforeAll(({}, suite) => {
   // Mark the ledger journal BEFORE the file's tests run, so a behaviorGate
   // decision made by the very first test is inside the file's window.

package/src/scenarios/era-key-stamped-v1.test.ts

@@ -1,156 +0,0 @@
-/**
- * `spec/v1/version-negotiation.md` §Stamping / §Legacy detection — the two
- * run-document stamping MUSTs, and the legacy rule that makes their absence
- * actively harmful (suite 2.0.0, target major 1; unaided).
- *
- * The rule is a v1 `MUST` and has been since the contract was written:
- *
- *   §Stamping        "Every persisted run document MUST carry an
- *                     `eventLogSchemaVersion: number` field. The current v1
- *                     value is `2`."
- *   §Legacy detection "Hosts identify an older run document as legacy when
- *                     `eventLogSchemaVersion` is undefined or `< 2`" … legacy
- *                     runs have "no event subcollection … Readers MUST fall
- *                     back to the snapshot for state."
- *
- * **Nothing in the suite has ever asserted it.** `version-negotiation.test.ts`
- * opens by claiming it checks "the four version axes (`engineVersion`,
- * `eventLogSchemaVersion`, per-event `schemaVersion`, `pinnedVersions`) appear
- * where the spec says they should" — and `protocolVersion` is the only axis it
- * asserts. Across all 444 v1 scenario files the sole occurrence of the
- * identifier `eventLogSchemaVersion` was that sentence: a docstring describing
- * a check that does not exist. **A comment claiming coverage is worse than no
- * comment**, because it answers "is this tested?" for anyone who greps, and
- * answers it wrongly.
- *
- * Both production hosts were measured on 2026-09-04 and neither stamps the
- * field on any run it has ever served. Each found it independently, after the
- * other published its own greps.
- *
- * The consequence fails in the direction that punishes correctness. A client
- * following §Legacy detection exactly classifies every such run as legacy and
- * reads the snapshot — **ignoring the event log the host is in fact serving**.
- * The host under-serves the conforming reader and over-serves the careless one.
- *
- * Why the schema could not catch it: `run-snapshot.schema.json` requires only
- * `runId`, `workflowId` and `status`, so a snapshot missing the field validates
- * cleanly. The obligation is prose-only, which is exactly the shape that needs
- * a scenario rather than a keyword.
- *
- * @see spec/v1/version-negotiation.md §Stamping
- * @see spec/v1/version-negotiation.md §Legacy detection
- */
-
-import { describe, it, expect } from 'vitest';
-import { driver } from '../lib/driver.js';
-import { softSkip } from '../lib/soft-skip.js';
-import { req } from '../lib/requirement-ids.js';
-
-const ID_STAMPED = 'openwop.requirement.version-negotiation.era-key-stamped';
-const ID_NOT_LEGACY = 'openwop.requirement.version-negotiation.era-key-not-legacy';
-const ID_ENGINE = 'openwop.requirement.version-negotiation.engine-version-stamped';
-const DOC = 'spec/v1/version-negotiation.md §Stamping';
-
-interface Snapshot { readonly eventLogSchemaVersion?: unknown; readonly engineVersion?: unknown }
-
-/** A run this host created moments ago — the one case where "legacy" cannot apply. */
-async function freshRun(): Promise<{ runId: string } | { skip: string }> {
-  try {
-    // v1 path keys are explicit: the driver's unversioned rewrite is a major-2
-    // behaviour, and `/runs` answers 404 on a v1 host. The first version of this
-    // file used `/runs` and therefore SOFT-SKIPPED against a host that violates
-    // the rule — passing vacuously, which is the failure this scenario exists to
-    // catch, committed by the scenario itself.
-    const created = await driver.post('/v1/runs', { workflowId: 'conformance-noop', inputs: {} });
-    if (created.status !== 201) return { skip: `POST /v1/runs answered ${created.status} — no run to inspect` };
-    const runId = (created.json as { runId?: unknown } | null)?.runId;
-    if (typeof runId !== 'string') return { skip: 'POST /v1/runs returned no runId' };
-    return { runId };
-  } catch {
-    return { skip: 'POST /v1/runs unreachable' };
-  }
-}
-
-describe('era-key-stamped-v1 (version-negotiation.md §Stamping)', () => {
-  it('a run the host just created carries eventLogSchemaVersion', async () => {
-    const r = await freshRun();
-    if ('skip' in r) return softSkip('blocked', r.skip);
-
-    let snap;
-    try {
-      snap = await driver.get(`/v1/runs/${encodeURIComponent(r.runId)}`);
-    } catch {
-      return softSkip('blocked', 'GET /v1/runs/{runId} unreachable');
-    }
-    if (snap.status !== 200) return softSkip('blocked', `GET /v1/runs/{runId} answered ${snap.status}`);
-
-    const value = (snap.json as Snapshot | null)?.eventLogSchemaVersion;
-    expect(
-      value,
-      req(ID_STAMPED, DOC, 'every persisted run document MUST carry an eventLogSchemaVersion — the field is prose-only (run-snapshot.schema.json requires just runId, workflowId and status), so a snapshot without it validates cleanly and only this check can see its absence'),
-    ).not.toBeUndefined();
-    expect(
-      typeof value === 'number',
-      req(ID_STAMPED, DOC, `eventLogSchemaVersion MUST be a number (got ${JSON.stringify(value)})`),
-    ).toBe(true);
-  });
-
-  it('a freshly created run is not classified legacy by the host\'s own rule', async () => {
-    const r = await freshRun();
-    if ('skip' in r) return softSkip('blocked', r.skip);
-
-    let snap;
-    try {
-      snap = await driver.get(`/v1/runs/${encodeURIComponent(r.runId)}`);
-    } catch {
-      return softSkip('blocked', 'GET /v1/runs/{runId} unreachable');
-    }
-    if (snap.status !== 200) return softSkip('blocked', `GET /v1/runs/{runId} answered ${snap.status}`);
-    const value = (snap.json as Snapshot | null)?.eventLogSchemaVersion;
-    if (value === undefined) {
-      return softSkip('blocked', 'the field is absent — the stamping leg above records that; legacy classification cannot be judged separately from it');
-    }
-
-    // §Legacy detection: "undefined or < 2" is legacy, and a legacy run means
-    // "no event subcollection … Readers MUST fall back to the snapshot". A host
-    // that serves an event log while stamping a legacy value is telling a
-    // conforming client to ignore the log it is serving.
-    expect(
-      typeof value === 'number' && value >= 2,
-      req(ID_NOT_LEGACY, 'spec/v1/version-negotiation.md §Legacy detection', `a run created moments ago MUST NOT be legacy: legacy is "undefined or < 2", and a legacy run is specified to have no event subcollection so readers MUST fall back to the snapshot. Stamping ${JSON.stringify(value)} on a new run instructs a CONFORMING client to ignore the event log this host is serving it — the failure lands on the correct reader and spares the careless one`),
-    ).toBe(true);
-  });
-
-  it('a run the host just created carries engineVersion — the legacy escape cannot reach it', async () => {
-    const r = await freshRun();
-    if ('skip' in r) return softSkip('blocked', r.skip);
-
-    let snap;
-    try {
-      snap = await driver.get(`/v1/runs/${encodeURIComponent(r.runId)}`);
-    } catch {
-      return softSkip('blocked', 'GET /v1/runs/{runId} unreachable');
-    }
-    if (snap.status !== 200) return softSkip('blocked', `GET /v1/runs/{runId} answered ${snap.status}`);
-
-    // §Stamping: "Every persisted run document MUST carry an `engineVersion:
-    // number` field … Servers MAY omit this field on legacy runs that predate
-    // the contract." The escape is scoped to runs that PREDATE the contract, so
-    // it cannot cover a run created seconds ago — which is why this leg creates
-    // one rather than inspecting whatever happens to be in the store.
-    //
-    // Asserted here because nothing else asserts it ON A RUN: version-fold.test.ts
-    // reads engineVersion from the DISCOVERY document, and wasm-pack-load.test.ts
-    // carries it only as a type field. Both mention the identifier, so a grep
-    // suggests coverage that does not exist for this requirement.
-    const value = (snap.json as Snapshot | null)?.engineVersion;
-    expect(
-      value,
-      req(ID_ENGINE, DOC, 'every persisted run document MUST carry engineVersion; the "MAY omit" escape applies only to legacy runs that predate the contract, and this run was created moments ago'),
-    ).not.toBeUndefined();
-    expect(
-      typeof value === 'number',
-      req(ID_ENGINE, DOC, `engineVersion MUST be a number set to the writer engine's CURRENT_ENGINE_VERSION at write time (got ${JSON.stringify(value)})`),
-    ).toBe(true);
-  });
-});

package/src/scenarios/v2-advertised-path-space-served.test.ts

@@ -1,140 +0,0 @@
-/**
- * RFC 0172 §A.1 / `spec/v2/core/versioning.md` §1.2 — a host that advertises
- * major 2 serves the major-2 PATH SPACE, not just the major-2 discovery
- * document (suite 2.0.0, target major 2; unaided).
- *
- * `v2-version-header-honored` checks that `OpenWOP-Version` is honored or
- * refused rather than ignored. It probes `/.well-known/openwop`, because that
- * is the one resource whose representation the header selects. **It therefore
- * cannot see a host that negotiates correctly on the well-known resource and
- * has mounted almost none of the rest of the v2 surface.**
- *
- * That is not hypothetical. A tier-1 host advertising
- * `protocolVersions: ["1.1","2.0"]` was found serving **two of fifteen**
- * top-level segments of the v2 path space: its unversioned mount was a
- * deliberate allowlist (`['/runs','/interrupts']`, chosen over a blanket
- * `/v1`-strip because the host serves a large non-`/v1` surface a blanket
- * rewrite would shadow) and the list was simply incomplete. Every probe used to
- * call the dual stack live — `protocolVersions`, `preferredVersion`, the
- * response header, the two differing representations — hits `/.well-known`, so
- * every one of them passed. `POST /webhooks` under major 2 returned `404` while
- * `POST /v1/webhooks` returned `201`. The host found this itself by applying
- * the artifact rule to a scenario it had first classified as a harness defect.
- *
- * The discriminator is a PAIR, not a single probe, because "this host does not
- * implement webhooks at all" and "this host implements webhooks but did not
- * mount them under major 2" are different facts that a lone `404` cannot
- * separate:
- *
- *   /v1<path> exists  AND  <path> is 404 under major 2  ⇒  the advertisement
- *   overstates: the surface exists and major 2 does not reach it.
- *
- *   both 404  ⇒  the host does not serve that surface in either major. Not this
- *   scenario's business, and recorded as neither pass nor failure.
- *
- * Only parameterless GETs from `spec/v2/path-manifest.json` are probed: they
- * need no fixture, mutate nothing, and a route that is not mounted answers 404
- * regardless of auth, so the check is unaided and safe against a live host.
- *
- * @see spec/v2/core/versioning.md §1.2
- * @see RFCS/0172-v2-versioning-and-release.md §A.1
- */
-
-import { describe, it, expect } from 'vitest';
-import { loadEnv } from '../lib/env.js';
-import { softSkip } from '../lib/soft-skip.js';
-import { req } from '../lib/requirement-ids.js';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { SCHEMAS_DIR } from '../lib/paths.js';
-
-const ID = 'openwop.requirement.0172.advertised-path-space-served';
-const DOC = 'spec/v2/core/versioning.md §1.2';
-
-/** The well-known resource is the one the HEADER selects; it has no /v1 twin to pair against. */
-const NOT_PAIRABLE = new Set(['/.well-known/openwop']);
-
-interface Probe { readonly status: number | null }
-
-async function get(path: string, major2: boolean): Promise<Probe> {
-  const { baseUrl, apiKey } = loadEnv();
-  const headers: Record<string, string> = { Accept: 'application/json' };
-  if (major2) headers['OpenWOP-Version'] = '2.0';
-  if (apiKey) headers['authorization'] = `Bearer ${apiKey}`;
-  try {
-    const res = await fetch(`${baseUrl.replace(/\/$/, '')}${path}`, { headers });
-    return { status: res.status };
-  } catch {
-    return { status: null };
-  }
-}
-
-function parameterlessGets(): string[] {
-  try {
-    const manifest = JSON.parse(
-      readFileSync(join(SCHEMAS_DIR, '..', 'spec', 'v2', 'path-manifest.json'), 'utf8'),
-    ) as { operations?: ReadonlyArray<{ method: string; path: string }> };
-    return (manifest.operations ?? [])
-      .filter((o) => o.method === 'GET' && !o.path.includes('{') && !NOT_PAIRABLE.has(o.path))
-      .map((o) => o.path)
-      .sort();
-  } catch {
-    return [];
-  }
-}
-
-describe('v2-advertised-path-space-served (RFC 0172 §A.1)', () => {
-  it('a host advertising major 2 reaches the surfaces it already serves under /v1', async () => {
-    const { baseUrl } = loadEnv();
-    const bare = await (async () => {
-      try {
-        const res = await fetch(`${baseUrl.replace(/\/$/, '')}/.well-known/openwop`, { headers: { Accept: 'application/json' } });
-        return res.status === 200 ? ((await res.json()) as Record<string, unknown>) : null;
-      } catch {
-        return null;
-      }
-    })();
-    if (!bare) return softSkip('blocked', 'the discovery document is unreadable, so the advertised majors are unknown');
-
-    const versions = Array.isArray(bare['protocolVersions']) ? (bare['protocolVersions'] as unknown[]).map(String) : [];
-    if (!new Set(versions.map((v) => v.split('.')[0])).has('2')) {
-      return softSkip('inapplicable', `the host advertises [${versions.join(', ') || 'no protocolVersions'}] — it does not claim major 2, so there is no path space to hold it to`);
-    }
-
-    const paths = parameterlessGets();
-    if (paths.length === 0) return softSkip('blocked', 'spec/v2/path-manifest.json is unreadable from this layout');
-
-    const overstated: string[] = [];
-    const served: string[] = [];
-    let pairable = 0;
-    for (const path of paths) {
-      const v1 = await get(`/v1${path}`, false);
-      if (v1.status === null) return softSkip('blocked', `the host became unreachable while probing /v1${path}`);
-      // The host does not serve this surface in EITHER major. Legitimate, and a
-      // different question from the one asked here.
-      if (v1.status === 404) continue;
-      pairable += 1;
-
-      const v2 = await get(path, true);
-      if (v2.status === null) return softSkip('blocked', `the host became unreachable while probing ${path}`);
-      // Any status but 404 means the route is MOUNTED — 401/403/422 all answer
-      // "this path exists". Only 404 says major 2 cannot reach it.
-      if (v2.status === 404) overstated.push(`${path} (/v1 → ${v1.status}, major 2 → 404)`);
-      else served.push(path);
-    }
-
-    if (pairable === 0) {
-      return softSkip('inapplicable', 'no parameterless GET in the v2 manifest is served under /v1 either, so there is no pair to compare and the advertisement cannot be checked this way');
-    }
-
-    expect(
-      overstated,
-      req(ID, DOC, `a host advertising major 2 MUST reach, under major 2, the surfaces it already serves under /v1 — advertising the major is a claim about the PATH SPACE and not only about the well-known resource, whose representation the header selects and which therefore passes even when almost nothing else is mounted (${overstated.length} of ${pairable} pairable surface(s) unreachable: ${overstated.slice(0, 6).join('; ')})`),
-    ).toEqual([]);
-
-    expect(
-      served.length,
-      req(ID, DOC, 'at least one non-well-known surface MUST be reachable under major 2, or the advertisement rests entirely on the one resource the header selects'),
-    ).toBeGreaterThan(0);
-  });
-});