@openwop/openwop-conformance 2.0.0-rc.39 → 2.0.0-rc.42

package/README.md

@@ -112,7 +112,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 502 scenario files under `src/scenarios/`.
+The current suite has 503 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -457,7 +457,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 502 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 503 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -46,7 +46,7 @@ import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
 import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
-import { setV2ProfileFloors } from './lib/requirement-registry.js';
+import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
 function parseArgs(argv) {
     let baseUrl;
     let apiKey;
@@ -354,37 +354,8 @@ function claimedProfilesForV2(doc, conformanceRoot) {
  * fail a host for the corpus's own backlog.
  */
 function v2ProfileFloors(conformanceRoot) {
-    const registryPath = v2RegistryPath(conformanceRoot);
-    if (registryPath === null)
-        return {};
-    let known;
-    try {
-        known = new Set(Object.keys(JSON.parse(readFileSync(resolvePath(conformanceRoot, 'scenario-majors.json'), 'utf8')).majors));
-    }
-    catch {
-        known = new Set();
-    }
-    let registry;
-    try {
-        registry = JSON.parse(readFileSync(registryPath, 'utf8'));
-    }
-    catch {
-        return {};
-    }
-    const out = {};
-    for (const p of registry.profiles ?? []) {
-        if (typeof p.id !== 'string')
-            continue;
-        const raw = Array.isArray(p.floorScenarios) ? p.floorScenarios.map(String) : [];
-        const files = [];
-        for (const entry of raw) {
-            const name = entry.startsWith('planned:') ? `v2-${entry.slice('planned:'.length)}.test.ts` : entry.endsWith('.test.ts') ? entry : `${entry}.test.ts`;
-            if (known.size === 0 || known.has(name))
-                files.push(name);
-        }
-        out[p.id] = files;
-    }
-    return out;
+    // One derivation, shared with the ledger's floor-file set (requirement-registry.ts).
+    return v2ProfileFloorFiles(conformanceRoot);
 }
 /**
  * Reduce a vitest JSON report into a per-scenario-file terminal state, keyed by

package/dist/lib/requirement-registry.js

@@ -21,6 +21,9 @@
  * resolves an unrecorded requirement to `blocked`.
  */
 import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
+import { createRequire } from 'node:module';
+import { dirname, resolve as resolvePath } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
 /** `runs-lifecycle.test.ts` → `openwop.floor.runs-lifecycle`. */
 export function requirementIdForScenario(scenarioFile) {
     return `openwop.floor.${scenarioFile.replace(/\.test\.ts$/, '')}`;
@@ -128,3 +131,59 @@ export function allRequirements() {
     }
     return [...ids].sort();
 }
+/**
+ * The MAJOR-2 floors, derived from `spec/v2/profiles.json` (itself generated
+ * from `spec/v2/declaration.json`), keyed by profile id and resolved to
+ * scenario file names. A `planned:<stem>` entry names `v2-<stem>.test.ts`; an
+ * entry is kept only if `scenario-majors.json` knows the file.
+ *
+ * This function exists in ONE place on purpose. Until 2026-09-05 the CLI
+ * derived these floors privately for `--certify` while the ledger decided
+ * "is this file a floor?" from PROFILE_FLOOR_SCENARIOS — the v1 hand table,
+ * which knows no v2 file. So a v2 floor file was MINTED as
+ * `openwop.scenario.v2-…` and LOOKED UP at certify time as
+ * `openwop.floor.v2-…`: 101 executed-pass rows, `witnessCount: 0` on both
+ * claimed profiles, and `REJECTING — openwop-discovery-core: unclassified` on
+ * a tier-1 host's first production bundle. Two sources of the same fact, one
+ * of them stale, and the join between them silent.
+ */
+export function v2ProfileFloorFiles(conformanceRoot) {
+    const candidates = [];
+    try {
+        const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
+        candidates.push(resolvePath(dirname(req.resolve('@openwop/spec-artifacts/package.json')), 'spec', 'v2', 'profiles.json'));
+    }
+    catch { /* not installed as a package; the repo-layout candidates below */ }
+    candidates.push(resolvePath(conformanceRoot, 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'));
+    const registryPath = candidates.find((c) => existsSync(c));
+    if (registryPath === undefined)
+        return {};
+    let known;
+    try {
+        known = new Set(Object.keys(JSON.parse(readFileSync(resolvePath(conformanceRoot, 'scenario-majors.json'), 'utf8')).majors));
+    }
+    catch {
+        known = new Set();
+    }
+    let registry;
+    try {
+        registry = JSON.parse(readFileSync(registryPath, 'utf8'));
+    }
+    catch {
+        return {};
+    }
+    const out = {};
+    for (const p of registry.profiles ?? []) {
+        if (typeof p.id !== 'string')
+            continue;
+        const raw = Array.isArray(p.floorScenarios) ? p.floorScenarios.map(String) : [];
+        const files = [];
+        for (const entry of raw) {
+            const name = entry.startsWith('planned:') ? `v2-${entry.slice('planned:'.length)}.test.ts` : entry.endsWith('.test.ts') ? entry : `${entry}.test.ts`;
+            if (known.size === 0 || known.has(name))
+                files.push(name);
+        }
+        out[p.id] = files;
+    }
+    return out;
+}

package/dist/lib/scenario-disposition.js

@@ -27,6 +27,9 @@
  */
 import { scenarioFileOfItId } from './requirement-ids.js';
 import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
+import { targetMajor } from './seams.js';
+import { PKG_ROOT_PATH } from './paths.js';
+import { v2ProfileFloorFiles } from './requirement-registry.js';
 import { requirementIdForScenario, requirementIdForPrefix, requirementsFor } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
@@ -41,6 +44,16 @@ export function floorScenarioFiles() {
             for (const f of c.required)
                 out.add(f);
     }
+    // At target major 2 the floors come from the declaration, not the v1 hand
+    // table. The ledger and --certify MUST agree on this set, or a floor file is
+    // minted `openwop.scenario.*` and looked up as `openwop.floor.*` — which is
+    // exactly what refused a tier-1 host's first production bundle over 101
+    // executed-pass rows (see v2ProfileFloorFiles).
+    if (targetMajor() === 2) {
+        for (const files of Object.values(v2ProfileFloorFiles(PKG_ROOT_PATH)))
+            for (const f of files)
+                out.add(f);
+    }
     return out;
 }
 /** The requirement id a scenario FILE records under: the §A floor id when the

package/dist/lib/seams.js

@@ -0,0 +1,42 @@
+/**
+ * Suite 2.0.0 — the seams profile (RFC 0168 §C; `openwop-conformance-seams-v2`).
+ *
+ * v1 scenarios reach the host-sample seams at `/v1/host/sample/…`,
+ * `/v1/host/workspace/files…` and `/v1/packs-test/…`. In v2 those operations
+ * leave the canonical API for `api/seams-v2.yaml` under `/conformance/seams/…`
+ * (RFC 0168 §C.2). Under target major 2 the driver rewrites the v1 seam path
+ * to its v2 address, so the 165 scenarios that name a seam keep working
+ * without a sweep; the sweep to `seamPath()` is the P3-F polish.
+ *
+ * How a v2 host advertises the profile: RFC 0168 §C.1 forbids a `testSeams`
+ * capability flag and RFC 0169 §C.1 removes the root `profiles[]`; the
+ * reconciliation (recorded against RFC 0168 at its flip) is the
+ * `conformance` METADATA key (RFC 0169 §A.1a): `conformance.seamsProfile:
+ * "openwop-conformance-seams-v2"`. Metadata, not a capability family.
+ */
+export const SEAMS_PROFILE_ID = 'openwop-conformance-seams-v2';
+export const SEAMS_PREFIX = '/conformance/seams';
+const V1_SEAM_PREFIXES = [
+    [/^\/v1\/host\/sample\//, `${SEAMS_PREFIX}/sample/`],
+    [/^\/v1\/host\/workspace\/files/, `${SEAMS_PREFIX}/workspace/files`],
+    [/^\/v1\/packs-test\//, `${SEAMS_PREFIX}/packs-test/`],
+];
+/** The v2 address of a v1 seam path; a non-seam path is returned unchanged. */
+export function seamPath(v1Path) {
+    for (const [re, to] of V1_SEAM_PREFIXES)
+        if (re.test(v1Path))
+            return v1Path.replace(re, to);
+    return v1Path;
+}
+export function isSeamPath(path) {
+    return V1_SEAM_PREFIXES.some(([re]) => re.test(path)) || path.startsWith(`${SEAMS_PREFIX}/`);
+}
+/** Whether a (v2) discovery document advertises the seams profile. */
+export function seamsProfileAdvertised(doc) {
+    const conf = doc?.['conformance'];
+    return typeof conf === 'object' && conf !== null && conf['seamsProfile'] === SEAMS_PROFILE_ID;
+}
+/** The target major the runner selected (RFC 0168 §D.3); 1 when unset. */
+export function targetMajor() {
+    return process.env['OPENWOP_TARGET_MAJOR'] === '2' ? 2 : 1;
+}

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.39",
-  "stampSha256": "48fe38e1460f068bcfbfd25df16894cca8ad480378f66bc1c8ef154e9c6c412c"
+  "version": "2.0.0-rc.42",
+  "stampSha256": "092c09c450a58ba8eaebbfb46bfdb5a957c69c1ff4cbe8e3fbc044cbaeccfbbf"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.39",
+  "version": "2.0.0-rc.42",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.39"
+    "@openwop/spec-artifacts": "2.0.0-rc.42"
   }
 }

package/requirements.json

@@ -2,10 +2,10 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 549,
-    "tests": 2125,
+    "files": 550,
+    "tests": 2126,
     "withStableId": 2125,
-    "interpolatedTitles": 0,
+    "interpolatedTitles": 1,
     "explicitIds": 2057
   },
   "records": [
@@ -27128,6 +27128,39 @@
         }
       ]
     },
+    {
+      "id": null,
+      "file": "v2-malformed-body-envelope.test.ts",
+      "line": 53,
+      "title": null,
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md",
+          "requirement": "the envelope's `error` MUST be the registered code for a malformed request body, validation_error"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-manifest-ceiling-refused.an-engines-openwop-range-with-no-upper-bound-1-0-0-reads-2-0-0-and-is-refused-at",
       "file": "v2-manifest-ceiling-refused.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 502,
+    "files": 503,
     "v1": 445,
-    "v2": 58
+    "v2": 59
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1315,6 +1315,9 @@
     "v2-legacy-profiles-absent.test.ts": [
       2
     ],
+    "v2-malformed-body-envelope.test.ts": [
+      2
+    ],
     "v2-manifest-ceiling-refused.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.39",
+  "version": "2.0.0-rc.42",
   "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -9,9 +9,9 @@
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "23904b23283a4ee111c5289eff8902bf22319dfd804310e47a9f2928ef669aac",
-    "api/v2/asyncapi.yaml": "40b9caf405de92acdfb57952809b77585f61a8696ef369afcdb675e6cad5b4ad",
-    "api/v2/openapi.yaml": "348a67f3bc5813f0ec2553338fc40829695b5aad2dc512a21ac0dca048ec15a7",
+    "api/seams-v2.yaml": "d32be36aabd37c5e33ebdcb2e88949160e47c5a97b3f21442e9b6f20dde20fe1",
+    "api/v2/asyncapi.yaml": "5ada903927b53a4c1db4c5210ef9d4acd1c11cb5c7cc08989ce43d04c7764f35",
+    "api/v2/openapi.yaml": "f0a862ea9df59a8cbe45ff818eacce4dd95f0d6f30d38eacd081d3357933f788",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "5a18865afd4cce904be3cf41f9f3d3f408806a7310015f91fe8b740db4050817",
+    "spec/v1/core-standard-manifest.json": "56cf132dafcb6e7d9eaa9346d9b0cbc94e0aa06833ca55326a72d6a4ae880365",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -230,7 +230,7 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "1f0ee40491131cf561ef19a0394c47ba476b4567514fe16befb6cada4a10a5a4",
-    "spec/v2/release.json": "1b7a260912de2445ebf11ec2a88be4e16f0ca19b64a297ced18dce1088fe1d95"
+    "spec/v2/release.json": "10c2702da9cc0a975b86d1a25e87512a4c7bd57a3e9a1699d326e0fb3cb07426"
   },
-  "corpusCommit": "29863c56a13b476152ced906d14396ce143ecbe9"
+  "corpusCommit": "f90a4aaf3cb7b92d9c574572d7af3c85e4a23728"
 }

package/src/cli.ts

@@ -54,7 +54,7 @@ import {
   type DiscoveryPayload,
   PROFILE_FLOOR_SCENARIOS,
 } from './lib/profiles.js';
-import { setV2ProfileFloors } from './lib/requirement-registry.js';
+import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
 
 interface ParsedArgs {
   readonly baseUrl: string | undefined;
@@ -377,35 +377,10 @@ function claimedProfilesForV2(doc: DiscoveryPayload, conformanceRoot: string): s
  * fail a host for the corpus's own backlog.
  */
 function v2ProfileFloors(conformanceRoot: string): Record<string, readonly string[]> {
-  const registryPath = v2RegistryPath(conformanceRoot);
-  if (registryPath === null) return {};
-  let known: Set<string>;
-  try {
-    known = new Set(Object.keys((JSON.parse(readFileSync(resolvePath(conformanceRoot, 'scenario-majors.json'), 'utf8')) as { majors: Record<string, number[]> }).majors));
-  } catch {
-    known = new Set();
-  }
-  let registry: { profiles?: Array<{ id?: unknown; floorScenarios?: unknown }> };
-  try {
-    registry = JSON.parse(readFileSync(registryPath, 'utf8'));
-  } catch {
-    return {};
-  }
-  const out: Record<string, readonly string[]> = {};
-  for (const p of registry.profiles ?? []) {
-    if (typeof p.id !== 'string') continue;
-    const raw = Array.isArray(p.floorScenarios) ? (p.floorScenarios as unknown[]).map(String) : [];
-    const files: string[] = [];
-    for (const entry of raw) {
-      const name = entry.startsWith('planned:') ? `v2-${entry.slice('planned:'.length)}.test.ts` : entry.endsWith('.test.ts') ? entry : `${entry}.test.ts`;
-      if (known.size === 0 || known.has(name)) files.push(name);
-    }
-    out[p.id] = files;
-  }
-  return out;
+  // One derivation, shared with the ledger's floor-file set (requirement-registry.ts).
+  return v2ProfileFloorFiles(conformanceRoot);
 }
 
-/** A single scenario test file's terminal state, derived from the vitest JSON report. */
 type ScenarioState = 'passed' | 'failed' | 'skipped';
 
 /** The subset of vitest's JSON reporter output we read. */

package/src/lib/fixtures.ts

@@ -41,6 +41,7 @@
  * @see RFCS/0003-fixture-gating.md
  */
 
+import { softSkip } from './soft-skip.js';
 import type { DiscoveryPayload } from './profiles.js';
 
 let _advertisedFixtures: ReadonlySet<string> | null = null;
@@ -76,7 +77,29 @@ function loadOptedOutPredicate(): (id: string) => boolean {
  * filtered out of the cache before storage so downstream lookups can
  * stay a single sync set-membership test.
  */
+let _discoveryUnreadable: string | null = null;
+
+/**
+ * Suite init could not READ the discovery document. This is not "the host
+ * advertises no fixtures" and MUST NOT be recorded as such: with 311
+ * fixture-gated sites, an empty cache turns an entire lane into `inapplicable`
+ * rows that read exactly like a host that advertises nothing. Measured
+ * 2026-09-05: all four workers hit the 5 s init abort against a host that
+ * answers `/.well-known/openwop` in 120–200 ms (a Cloud Run cold start), and
+ * every fixture-gated scenario skipped as "not advertised". The cache stays
+ * null; every gate that consults it records `blocked` with this reason.
+ */
+export function setDiscoveryUnreadable(reason: string): void {
+  _advertisedFixtures = null;
+  _discoveryUnreadable = reason;
+}
+
+export function discoveryUnreadableReason(): string | null {
+  return _discoveryUnreadable;
+}
+
 export function setAdvertisedFixtures(c: DiscoveryPayload | null | undefined): void {
+  _discoveryUnreadable = null;
   if (c == null || !Array.isArray(c.fixtures)) {
     _advertisedFixtures = new Set();
     return;
@@ -103,6 +126,13 @@ export function setAdvertisedFixtures(c: DiscoveryPayload | null | undefined): v
  *   );
  */
 export function isFixtureAdvertised(id: string): boolean {
+  if (_advertisedFixtures === null && _discoveryUnreadable !== null) {
+    // Evidence went unread, on the suite's side. `blocked` outranks the
+    // `inapplicable` the caller is about to record (soft-skip.ts RANK), so the
+    // file resolves to the honest word instead of the vacuous one.
+    softSkip('blocked', `suite init could not read /.well-known/openwop (${_discoveryUnreadable}) — fixture ${id} is UNKNOWN, not unadvertised`);
+    return false;
+  }
   return _advertisedFixtures?.has(id) ?? false;
 }
 
@@ -127,4 +157,5 @@ export function isFixtureCacheReady(): boolean {
 /** Test-only: reset the module-level cache. */
 export function __resetForTests(): void {
   _advertisedFixtures = null;
+  _discoveryUnreadable = null;
 }

package/src/lib/requirement-registry.ts

@@ -22,6 +22,9 @@
  */
 
 import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
+import { createRequire } from 'node:module';
+import { dirname, resolve as resolvePath } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
 
 /** `runs-lifecycle.test.ts` → `openwop.floor.runs-lifecycle`. */
 export function requirementIdForScenario(scenarioFile: string): string {
@@ -124,3 +127,57 @@ export function allRequirements(): readonly string[] {
   }
   return [...ids].sort();
 }
+
+/**
+ * The MAJOR-2 floors, derived from `spec/v2/profiles.json` (itself generated
+ * from `spec/v2/declaration.json`), keyed by profile id and resolved to
+ * scenario file names. A `planned:<stem>` entry names `v2-<stem>.test.ts`; an
+ * entry is kept only if `scenario-majors.json` knows the file.
+ *
+ * This function exists in ONE place on purpose. Until 2026-09-05 the CLI
+ * derived these floors privately for `--certify` while the ledger decided
+ * "is this file a floor?" from PROFILE_FLOOR_SCENARIOS — the v1 hand table,
+ * which knows no v2 file. So a v2 floor file was MINTED as
+ * `openwop.scenario.v2-…` and LOOKED UP at certify time as
+ * `openwop.floor.v2-…`: 101 executed-pass rows, `witnessCount: 0` on both
+ * claimed profiles, and `REJECTING — openwop-discovery-core: unclassified` on
+ * a tier-1 host's first production bundle. Two sources of the same fact, one
+ * of them stale, and the join between them silent.
+ */
+export function v2ProfileFloorFiles(conformanceRoot: string): Record<string, readonly string[]> {
+  const candidates: string[] = [];
+  try {
+    const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
+    candidates.push(resolvePath(dirname(req.resolve('@openwop/spec-artifacts/package.json')), 'spec', 'v2', 'profiles.json'));
+  } catch { /* not installed as a package; the repo-layout candidates below */ }
+  candidates.push(
+    resolvePath(conformanceRoot, 'spec', 'v2', 'profiles.json'),
+    resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'),
+  );
+  const registryPath = candidates.find((c) => existsSync(c));
+  if (registryPath === undefined) return {};
+  let known: Set<string>;
+  try {
+    known = new Set(Object.keys((JSON.parse(readFileSync(resolvePath(conformanceRoot, 'scenario-majors.json'), 'utf8')) as { majors: Record<string, number[]> }).majors));
+  } catch {
+    known = new Set();
+  }
+  let registry: { profiles?: Array<{ id?: unknown; floorScenarios?: unknown }> };
+  try {
+    registry = JSON.parse(readFileSync(registryPath, 'utf8'));
+  } catch {
+    return {};
+  }
+  const out: Record<string, readonly string[]> = {};
+  for (const p of registry.profiles ?? []) {
+    if (typeof p.id !== 'string') continue;
+    const raw = Array.isArray(p.floorScenarios) ? (p.floorScenarios as unknown[]).map(String) : [];
+    const files: string[] = [];
+    for (const entry of raw) {
+      const name = entry.startsWith('planned:') ? `v2-${entry.slice('planned:'.length)}.test.ts` : entry.endsWith('.test.ts') ? entry : `${entry}.test.ts`;
+      if (known.size === 0 || known.has(name)) files.push(name);
+    }
+    out[p.id] = files;
+  }
+  return out;
+}

package/src/lib/scenario-disposition.ts

@@ -28,6 +28,9 @@
 
 import { scenarioFileOfItId } from './requirement-ids.js';
 import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
+import { targetMajor } from './seams.js';
+import { PKG_ROOT_PATH } from './paths.js';
+import { v2ProfileFloorFiles } from './requirement-registry.js';
 import { requirementIdForScenario, requirementIdForPrefix, requirementsFor } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
@@ -40,6 +43,14 @@ export function floorScenarioFiles(): ReadonlySet<string> {
     for (const f of floor.required) out.add(f);
     for (const c of floor.conditional ?? []) for (const f of c.required) out.add(f);
   }
+  // At target major 2 the floors come from the declaration, not the v1 hand
+  // table. The ledger and --certify MUST agree on this set, or a floor file is
+  // minted `openwop.scenario.*` and looked up as `openwop.floor.*` — which is
+  // exactly what refused a tier-1 host's first production bundle over 101
+  // executed-pass rows (see v2ProfileFloorFiles).
+  if (targetMajor() === 2) {
+    for (const files of Object.values(v2ProfileFloorFiles(PKG_ROOT_PATH))) for (const f of files) out.add(f);
+  }
   return out;
 }
 

package/src/scenarios/v2-malformed-body-envelope.test.ts

@@ -0,0 +1,79 @@
+/**
+ * `spec/v2/core/versioning.md` §1.4 + `errors.md` — a malformed JSON body on a
+ * major-2 POST is answered by the HOST: `400`, the error envelope, and the
+ * `OpenWOP-Version` header (suite 2.0.0, target major 2; unaided; creates
+ * nothing).
+ *
+ * §1.4: "A response on any path MUST carry `OpenWOP-Version`". The response
+ * most likely to escape that rule is the one a framework produces before the
+ * host's own middleware runs. Measured on a tier-2 host's public origin on
+ * 2026-09-05: `POST /runs` with body `{` answered `400 text/html` with no
+ * header under BOTH majors — Express's JSON parser was mounted before
+ * negotiation, and its error left the middleware chain for the default HTML
+ * handler. Every well-formed request on that host carried the header; only
+ * the malformed one did not, which is exactly the request a scenario never
+ * sends by accident. The host suggested this probe: "`POST /runs` with `{` is
+ * cheaper than any run."
+ *
+ * The same probe distinguishes a host from the hosting layer in front of it: a
+ * fallback that answers `200 text/html` to everything fails here too.
+ *
+ * @see spec/v2/core/versioning.md §1.4
+ * @see spec/v2/core/errors.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { loadEnv } from '../lib/env.js';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0172.malformed-body-envelope';
+const DOC = 'spec/v2/core/versioning.md §1.4';
+
+interface Answer { readonly status: number; readonly version: string | null; readonly contentType: string; readonly body: unknown; readonly text: string }
+
+async function postMalformed(path: string): Promise<Answer | null> {
+  const { baseUrl, apiKey } = loadEnv();
+  const headers: Record<string, string> = { 'Content-Type': 'application/json', Accept: 'application/json', 'OpenWOP-Version': '2.0' };
+  if (apiKey) headers['authorization'] = `Bearer ${apiKey}`;
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/$/, '')}${path}`, { method: 'POST', headers, body: '{' });
+    const text = await res.text();
+    let body: unknown = null;
+    try { body = JSON.parse(text); } catch { body = null; }
+    return { status: res.status, version: res.headers.get('openwop-version'), contentType: res.headers.get('content-type') ?? '', body, text };
+  } catch {
+    return null;
+  }
+}
+
+describe('v2 malformed-body-envelope (versioning.md §1.4; errors.md)', () => {
+  for (const path of ['/runs', '/webhooks']) {
+    it(`POST ${path} with a malformed JSON body is answered by the host: 400, the error envelope, OpenWOP-Version`, async () => {
+      try { if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable'); } catch { return softSkip('blocked', 'v2 discovery unreachable'); }
+      const a = await postMalformed(path);
+      if (a === null) return softSkip('blocked', `POST ${path} unreachable (fetch failed)`);
+      if (a.status === 404 && a.version !== null) return softSkip('inapplicable', `${path} is not mounted on this host (404 with the header — a host answer, not a fallback)`);
+
+      expect(
+        a.version,
+        req(ID, DOC, `POST ${path} with body '{': the response MUST carry OpenWOP-Version — a response without it did not come from the host's negotiation layer (a framework parser or a hosting fallback answered instead). Got status ${a.status}, content-type ${JSON.stringify(a.contentType)}`),
+      ).not.toBeNull();
+      expect(
+        a.status,
+        req(ID, 'spec/v2/core/errors.md', `a malformed JSON body MUST be refused with 400 validation_error, not accepted and not passed to a default handler (got ${a.status})`),
+      ).toBe(400);
+      expect(
+        a.body !== null && typeof a.body === 'object' && !/text\/html/i.test(a.contentType),
+        req(ID, 'spec/v2/core/errors.md', `the 400 MUST be the JSON error envelope, not a framework's HTML error page (content-type ${JSON.stringify(a.contentType)}, body starts ${JSON.stringify(a.text.slice(0, 40))})`),
+      ).toBe(true);
+      const r = v2Validator('error-envelope')(a.body);
+      expect(r.ok, req(ID, 'spec/v2/core/errors.md', `the body MUST validate against error-envelope.schema.json (${r.errors})`)).toBe(true);
+      expect(
+        (a.body as { error?: unknown }).error,
+        req(ID, 'spec/v2/core/errors.md', 'the envelope\'s `error` MUST be the registered code for a malformed request body, validation_error'),
+      ).toBe('validation_error');
+    });
+  }
+});

package/src/setup.ts

@@ -25,7 +25,7 @@
  * `it` here; vitest treats setupFiles differently from scenario files.
  */
 
-import { setAdvertisedFixtures } from './lib/fixtures.js';
+import { setAdvertisedFixtures, setDiscoveryUnreadable } from './lib/fixtures.js';
 import { setMultiAgentCapabilities } from './lib/multi-agent-capabilities.js';
 import { OtelCollector, setCollector } from './lib/otel-collector.js';
 import { McpFakeServer, setMcpFakeServer } from './lib/mcp-fake-server.js';
@@ -43,13 +43,15 @@ import type { DiscoveryPayload } from './lib/profiles.js';
 import { targetMajor } from './lib/seams.js';
 import { softSkip } from './lib/soft-skip.js';
 
-const SUITE_INIT_TIMEOUT_MS = 5_000;
+// 20 s, not 5: a Cloud Run cold start routinely exceeds 5 s, and a discovery
+// fetch that aborted at init used to turn every fixture-gated scenario into a
+// vacuous `inapplicable`. Measured 2026-09-05 on a host answering in 200 ms.
+const SUITE_INIT_TIMEOUT_MS = 20_000;
+const SUITE_INIT_ATTEMPTS = 2;
 
 async function loadHostFixtures(): Promise<void> {
   const baseUrl = process.env.OPENWOP_BASE_URL?.trim();
   if (!baseUrl) {
-    // Offline / fixture-stub-only run. No host to ask; treat as "host
-    // advertises no fixtures" so all fixture-dependent scenarios skip.
     setAdvertisedFixtures(null);
     setMultiAgentCapabilities(null);
     return;
@@ -57,39 +59,36 @@ async function loadHostFixtures(): Promise<void> {
 
   const normalizedBase = baseUrl.replace(/\/$/, '');
   const url = `${normalizedBase}/.well-known/openwop`;
+  // The representation the header selects is the one whose fixtures[] this
+  // lane is held to (versioning.md §5): read it under the lane's major.
+  const headers: Record<string, string> = { Accept: 'application/json' };
+  if (targetMajor() === 2) headers['OpenWOP-Version'] = '2.0';
 
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), SUITE_INIT_TIMEOUT_MS);
-  try {
-    const res = await fetch(url, {
-      method: 'GET',
-      headers: { Accept: 'application/json' },
-      signal: controller.signal,
-    });
-    if (!res.ok) {
-      // eslint-disable-next-line no-console
-      console.warn(
-        `[openwop-conformance setup] discovery fetch returned ${res.status}; ` +
-          `treating host as advertising no fixtures. Fixture-dependent scenarios will skip.`,
-      );
-      setAdvertisedFixtures(null);
-    setMultiAgentCapabilities(null);
+  let lastFailure = 'unknown';
+  for (let attempt = 1; attempt <= SUITE_INIT_ATTEMPTS; attempt += 1) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), SUITE_INIT_TIMEOUT_MS);
+    try {
+      const res = await fetch(url, { method: 'GET', headers, signal: controller.signal });
+      if (!res.ok) {
+        lastFailure = `HTTP ${res.status} on attempt ${attempt}`;
+        continue;
+      }
+      const body = (await res.json()) as DiscoveryPayload;
+      setAdvertisedFixtures(body);
+      setMultiAgentCapabilities(body);
       return;
+    } catch (err) {
+      lastFailure = `${(err as Error).message ?? 'unknown'} on attempt ${attempt}`;
+    } finally {
+      clearTimeout(timer);
     }
-    const body = (await res.json()) as DiscoveryPayload;
-    setAdvertisedFixtures(body);
-    setMultiAgentCapabilities(body);
-  } catch (err) {
-    // eslint-disable-next-line no-console
-    console.warn(
-      `[openwop-conformance setup] discovery fetch failed (${(err as Error).message ?? 'unknown'}); ` +
-        `treating host as advertising no fixtures. Fixture-dependent scenarios will skip.`,
-    );
-    setAdvertisedFixtures(null);
-    setMultiAgentCapabilities(null);
-  } finally {
-    clearTimeout(timer);
   }
+  // Not "the host advertises no fixtures". The document went UNREAD, and every
+  // fixture gate will say so as `blocked` rather than `inapplicable`.
+  console.warn(`[openwop-conformance setup] discovery unreadable after ${SUITE_INIT_ATTEMPTS} attempt(s) (${lastFailure}); fixture-gated scenarios will record blocked, not inapplicable.`);
+  setDiscoveryUnreadable(lastFailure);
+  setMultiAgentCapabilities(null);
 }
 
 /**