@openwop/openwop-conformance 2.0.0-rc.8 → 2.0.0

package/src/scenarios/v2-chain-pin-exact.test.ts

@@ -93,7 +93,7 @@ async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | nul
   }
   if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
   if (!(await gateFamily('workflowChainPacks'))) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise the workflowChainPacks family (RFC 0169 §A.2)' };
-  if (!seamsProfileAdvertised(doc)) return { kind: 'blocked', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only register path the suite can drive (RFC 0168 §C.1)' };
+  if (!seamsProfileAdvertised(doc)) return { kind: 'inapplicable', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only register path the suite can drive (RFC 0168 §C.1)' };
   if (!v2Validator('workflow-chain-pack-manifest')(chainPack('core.openwop.pin-probe', 'core.ai.callPrompt@1.0.0')).ok) return { kind: 'blocked', reason: SCHEMA_GAP };
   return null;
 }

package/src/scenarios/v2-coherence-not-in-bundle.test.ts

@@ -58,8 +58,17 @@ function bundleWith(rows: BundleV3Requirement[]): BundleV3 {
 
 describe('v2-coherence-not-in-bundle (RFC 0168 §D.1)', () => {
   it('every corpus-ledger id has a scenario in src/coherence and none in src/scenarios — the two id sets are disjoint by construction', () => {
-    if (!existsSync(LEDGER)) return softSkip('blocked', 'evidence/corpus-ledger.json is absent from this layout — the corpus id set cannot be read');
-    if (SCENARIOS_DIR === null || COHERENCE_DIR === null || !existsSync(COHERENCE_DIR)) return softSkip('blocked', 'src/scenarios or src/coherence is absent from this layout');
+    // rc.57: `inapplicable`, not `blocked`. The subject of this scenario is the
+    // CORPUS — it reads evidence/corpus-ledger.json and the two source
+    // directories and asserts nothing about a host. RFC 0148 §A defines
+    // `blocked` over ADVERTISED behaviour a missing dependency prevented
+    // exercising; there is none here, and `blocked` denied certification
+    // bundle-wide (RFC 0168 §E.1) to every host running the published tarball,
+    // which ships neither the ledger nor src/coherence. Same reasoning as
+    // lib/spec-coherence.ts for the v1 corpus scenarios; the reference host
+    // carried this row as one of its "16 blocked" since rc.16.
+    if (!existsSync(LEDGER)) return softSkip('inapplicable', 'inapplicable to any host: evidence/corpus-ledger.json is absent from this layout — the subject of this scenario is the corpus, which the published tarball does not ship; it runs in a spec checkout (scripts/check-spec-coherence.mjs) and needs no host');
+    if (SCENARIOS_DIR === null || COHERENCE_DIR === null || !existsSync(COHERENCE_DIR)) return softSkip('inapplicable', 'inapplicable to any host: src/scenarios or src/coherence is absent from this layout — the subject of this scenario is the corpus, which the published tarball does not ship; it runs in a spec checkout and needs no host');
     const ledger = JSON.parse(readFileSync(LEDGER, 'utf8')) as { requirements: Record<string, unknown> };
     const ids = Object.keys(ledger.requirements);
     expect(ids.length, req('openwop.requirement.0168.coherence-not-in-bundle.disjoint-by-construction', SECTION, 'the corpus ledger MUST carry at least one requirement id')).toBeGreaterThan(0);

package/src/scenarios/v2-created-run-readable.test.ts

@@ -0,0 +1,98 @@
+/**
+ * `spec/v2/core/runs.md` §Create + `versioning.md` §1.2 — a run created at a
+ * base is readable at that base by the id the base returned, and the links in
+ * the create response stay on that base (suite 2.0.0, target major 2; unaided;
+ * creates one run).
+ *
+ * This is the assertion the suite deferred to a soft-skip. `v2-id-grammar`
+ * reads the run it just created and, on a non-200, records `blocked` — the
+ * honest word for "the host did not let me look". It is the wrong word when
+ * the host DID answer and the answer was `404 No route matches this request`,
+ * because that is not evidence going unread; it is a routing hole, and a
+ * `blocked` row over a routing hole is a vacuous pass one step removed.
+ *
+ * Measured 2026-09-05 on a tier-1 host through its public origin: a run
+ * created at `https://app.openwop.dev` under major 2 could not be read,
+ * polled, cancelled or streamed at `https://app.openwop.dev` — the hosting
+ * layer decoded the tenant-bound id's `%2F` to `/` before forwarding, and the
+ * backend correctly had no route for a literal slash. One hop behind, the
+ * direct service URL answered every read with 200. Every bound id was
+ * unreachable through the front door, and every bound-id scenario recorded
+ * `blocked`. The same create response linked `eventsUrl` and `statusUrl` to
+ * `http://<the direct service host>/…` — a client that follows them leaves the
+ * origin it discovered on and downgrades to plain http.
+ *
+ * Two hard assertions, then: the read-back MUST be 200 at the same base, and
+ * the links MUST resolve under the request's origin without a scheme
+ * downgrade — a relative path satisfies both.
+ *
+ * @see spec/v2/core/runs.md §Create
+ * @see spec/v2/core/versioning.md §1.2
+ * @see spec/v2/core/identity.md §5
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { loadEnv } from '../lib/env.js';
+import { v2Discovery } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0172.created-run-readable';
+const DOC = 'spec/v2/core/runs.md §Create';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+const RUN_ID = /^[A-Za-z0-9._~-]{1,128}\/[A-Za-z0-9._~-]{16,128}$/;
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+/** A link is on-base when it is relative, or absolute under the request origin with the same scheme. */
+function linkOnBase(link: unknown, baseUrl: string): { ok: boolean; why: string } {
+  if (typeof link !== 'string' || link.length === 0) return { ok: false, why: 'not a non-empty string' };
+  if (link.startsWith('/')) return { ok: true, why: 'relative' };
+  let l: URL; let b: URL;
+  try { l = new URL(link); b = new URL(baseUrl); } catch { return { ok: false, why: 'not a URL' }; }
+  if (l.protocol === 'http:' && b.protocol === 'https:') return { ok: false, why: `scheme downgrade ${b.protocol} → ${l.protocol}` };
+  if (l.origin !== b.origin) return { ok: false, why: `origin ${l.origin} is not the request origin ${b.origin}` };
+  return { ok: true, why: 'same-origin absolute' };
+}
+
+describe('v2 created-run-readable (runs.md §Create)', () => {
+  it('a run created at this base is readable and pollable at this base by the id it returned, and its links stay on this base', async () => {
+    try { if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable'); } catch { return softSkip('blocked', 'v2 discovery unreachable'); }
+    const { baseUrl } = loadEnv();
+    const created = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }));
+    if (created === null) return softSkip('blocked', 'POST /runs unreachable (fetch failed)');
+    if (created.status === 429) return softSkip('blocked', 'POST /runs answered 429 — the run budget, not the wire');
+    const body = (created.json ?? {}) as { runId?: unknown; eventsUrl?: unknown; statusUrl?: unknown };
+    if (created.status !== 201 || typeof body.runId !== 'string') return softSkip('blocked', `POST /runs {workflowId: ${NOOP_WORKFLOW_ID}} answered ${created.status} ${readErrorCode(created.json) ?? ''} — the smallest valid create was refused (fixture not seeded?)`.trim());
+    const runId = body.runId;
+    expect(RUN_ID.test(runId), req(ID, 'spec/v2/core/identity.md §5', `the created runId MUST be tenant-bound (got ${runId})`)).toBe(true);
+
+    // HARD, not soft: the base that minted the id MUST resolve it. A 404 here is
+    // not evidence going unread; it is the front door not routing its own ids.
+    const read = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
+    expect(
+      read?.status ?? null,
+      req(ID, DOC, `GET /runs/{runId} at the base that created the run MUST answer 200 by the id it returned — got ${read?.status ?? 'no response'} ${readErrorCode(read?.json) ?? ''}. A 404 "No route matches" for a tenant-bound id is a hosting layer decoding %2F to / before the backend sees the path: every bound id is unreachable through this base`.trim()),
+    ).toBe(200);
+    const poll = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`));
+    expect(
+      poll?.status ?? null,
+      req(ID, 'spec/v2/core/events.md §Poll', `GET /runs/{runId}/events/poll at the base that created the run MUST answer 200 — got ${poll?.status ?? 'no response'} ${readErrorCode(poll?.json) ?? ''}`.trim()),
+    ).toBe(200);
+
+    // The links in the create response MUST keep the client on this base.
+    const ev = linkOnBase(body.eventsUrl, baseUrl);
+    expect(
+      ev.ok,
+      req(ID, DOC, `eventsUrl MUST resolve under the origin the create was made to, without a scheme downgrade — a relative path satisfies both (got ${JSON.stringify(body.eventsUrl)}: ${ev.why}). A link to a different host leaves the origin the client discovered on; http on an https origin is a downgrade`),
+    ).toBe(true);
+    if (body.statusUrl !== undefined) {
+      const st = linkOnBase(body.statusUrl, baseUrl);
+      expect(st.ok, req(ID, DOC, `statusUrl, when present, MUST resolve under the request origin without a scheme downgrade (got ${JSON.stringify(body.statusUrl)}: ${st.why})`)).toBe(true);
+    }
+  });
+});

package/src/scenarios/v2-dual-stack-negotiation.test.ts

@@ -76,7 +76,35 @@ describe('v2 dual-stack-negotiation (RFC 0172 §A.3–§A.4 — gated on two maj
     const read = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`, { headers: { 'OpenWOP-Version': '2.0' } }));
     if (read === null) return softSkip('blocked', 'GET /runs/{runId} unreachable (fetch failed)');
     expect(read.status, req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', 'the overlap: a run created through /v1/runs MUST be readable through GET /runs/{runId} with OpenWOP-Version: 2.0')).toBe(200);
-    expect((read.json as { runId?: unknown } | undefined)?.runId, req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', 'the v2 read MUST name the same run')).toBe(runId);
+    // The v2 read MUST name the same run BY ITS TENANT-BOUND PROJECTION.
+    //
+    // This assertion has been wrong twice, in opposite directions, and the pair
+    // is the point:
+    //
+    //   until 2026-09-04  `.toBe(runId)` — byte-equality with the v1 id, cited to
+    //                     versioning.md §5, which said nothing about identifiers.
+    //                     TIGHTER than its prose: it failed a host that had
+    //                     implemented identity.md §5 faithfully.
+    //   rc.28             accepted the bare v1 id OR its projection. LOOSER than
+    //                     its prose: `run-snapshot.schema.json` binds `runId` to
+    //                     `ids.schema.json#/$defs/runId`, whose pattern REQUIRES
+    //                     the `/`. rc.28 passed a response the v2 contract
+    //                     rejects — the same defect it was written to fix,
+    //                     committed in the act of fixing it.
+    //
+    // §5 now states the rule outright, and the reason it is a MUST is not
+    // stylistic: `identity.md` §5 requires a host to refuse a tenant-bound id
+    // whose tenant segment is not the caller's (`403 id_tenant_mismatch`). A
+    // bare id HAS no tenant segment, so that mandatory check cannot run on it.
+    // A legacy unprefixed form would be a class of ids — precisely the ones
+    // carried over from v1 — exempt from major 2's tenant isolation.
+    //
+    // So: the projection, and only the projection. A bare id here is a finding.
+    const readId = (read.json as { runId?: unknown } | undefined)?.runId;
+    expect(
+      readId,
+      req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', `a run minted under major 1 MUST be named by its tenant-bound projection <tenantId>/${'${the v1 id}'} when read under major 2 — the bare id is not merely unconventional, it carries no tenant segment for the mandatory 403 id_tenant_mismatch check to read (identity.md §5), and ids.schema.json#/$defs/runId has no legacy branch. Got ${JSON.stringify(readId)} for a run created as ${JSON.stringify(runId)}`),
+    ).toMatch(new RegExp(`^[A-Za-z0-9._~-]{1,128}/${runId.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`));
     expect(major(read), req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §1.4', 'the v2 read MUST report the 2.x contract that produced it')).toBe('2');
   });
 

package/src/scenarios/v2-effect-identity-business-key.test.ts

@@ -97,7 +97,7 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
     const doc = await discovery();
     if (!doc) return softSkip('blocked', 'discovery unreachable');
     if (!(await gateFamily('idempotency'))) return softSkip('inapplicable', 'idempotency family not advertised — no Layer-2 obligation (gate recorded under openwop.family.idempotency)');
-    if (!seamsProfileAdvertised(doc)) return softSkip('blocked', 'the retry leg is driven through the suite fixture provider (RFC 0173 §D.2 G4) under the seams profile — seams profile not advertised');
+    if (!seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'the retry leg is driven through the suite fixture provider (RFC 0173 §D.2 G4) under the seams profile — seams profile not advertised');
     // The seam is catalogued (api/seams-v2.yaml `forceEffectTransportRetry`). An
     // unreachable providerUrl forces the transport retry; the witness is the
     // host's own Layer-2 ledger (RFC 0173 §C.2), where every attempt of one

package/src/scenarios/v2-effect-seam-manifest.test.ts

@@ -12,11 +12,14 @@
  *   1. the manifest validates; every row is guarded; at least one row exists
  *      for every `kind` the host declares (the manifest is the host's own
  *      enumeration — RFC 0140 G7 answered by making the host list it);
- *   2. the facet constant equals the served address;
- *   3. driving one seam of each kind through the suite's receiver and
- *      observing no re-fire needs a seam that fires a named manifest row inside
- *      a run — none is catalogued (`host-sample-test-seams.md`,
- *      `api/seams-v2.yaml`), so that leg records `blocked` naming it.
+ *   2. the facet constant equals the served address.
+ *
+ * Both legs are unaided (a `GET` and a schema), which is what lets this file sit
+ * on the `openwop-core-standard` floor as the `replay` family's witness. The
+ * seam-driven no-re-fire leg lived here until rc.45 and moved to
+ * `v2-effect-seam-no-refire` (seams-v2 floor): a file's disposition is
+ * worst-first, so one seam-gated leg made the whole manifest witness read
+ * `blocked` on any host without the seams surface.
  *
  * Completeness of the manifest (a seam outside it) is negative-existence and is
  * not asserted here (RFC 0173 falsifiability table, §C.1 row).
@@ -26,16 +29,15 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { driver } from '../lib/driver.js';
 import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
-import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const MANIFEST_PATH = '/host/effect-seams';
-const KINDS = ['http', 'queue', 'storage', 'provider-sdk', 'webhook-fanout'] as const;
+const KINDS = ['http', 'smtp', 'queue', 'storage', 'provider-sdk', 'webhook-fanout', 'other'] as const;
 
-interface SeamRow { seam?: unknown; kind?: unknown; guarded?: unknown; guardedBy?: unknown; branchReFires?: unknown }
+interface SeamRow { seam?: unknown; kind?: unknown; guarded?: unknown; guardedBy?: unknown; branchReFires?: unknown; note?: unknown }
 interface Manifest { manifestVersion?: unknown; seams?: SeamRow[] }
 
 async function discovery(): Promise<Record<string, unknown> | null> {
@@ -82,6 +84,16 @@ describe('RFC 0173 §C.1 — effect-seam-manifest (gated on replay)', () => {
         (KINDS as readonly string[]).includes(String(row.kind)),
         req('openwop.requirement.0173.effect-seam-manifest', 'effect-seam-manifest.schema.json seams[].kind', `kind MUST be one of ${KINDS.join(' | ')} — seam ${String(row.seam)} declares ${String(row.kind)}`),
       ).toBe(true);
+      // `other` is the escape for a mechanism the enum does not name, and the
+      // note is what keeps it from being a place to hide a seam: a row that
+      // cannot say WHICH mechanism it is has not been enumerated, it has been
+      // labelled. Suite 2.0.0-rc.61, replay.md §The effect-seam manifest.
+      if (String(row.kind) === 'other') {
+        expect(
+          typeof row.note === 'string' && row.note.trim().length > 0,
+          req('openwop.requirement.0173.effect-seam-manifest', 'replay.md §The effect-seam manifest', `a kind: other row MUST carry a note naming the mechanism (raw TCP, gRPC, a filesystem write, a device SDK) — seam ${String(row.seam)} declares other with no note`),
+        ).toBe(true);
+      }
     }
     // One row per kind the host declares: the set of kinds the manifest names is
     // the host's declaration, and each named kind is backed by at least one row.
@@ -114,50 +126,4 @@ describe('RFC 0173 §C.1 — effect-seam-manifest (gated on replay)', () => {
     ).toBe(MANIFEST_PATH);
   });
 
-  it('driving one seam of each kind observes no re-fire on replay', async () => {
-    const doc = await discovery();
-    if (!doc) return softSkip('blocked', 'discovery unreachable');
-    const replay = await gateFamily('replay');
-    if (!replay) return softSkip('inapplicable', 'replay family not advertised (gate recorded under openwop.family.replay)');
-    if (!seamsProfileAdvertised(doc)) {
-      return softSkip('blocked', `the no-re-fire leg is seam-gated (RFC 0173 falsifiability §B replay row is witnessable-gated only through a seam that fires a named manifest row inside a run) — seams profile not advertised (conformance.seamsProfile)`);
-    }
-    // The seam is catalogued (api/seams-v2.yaml `fireEffectSeam`). The witness is
-    // the host's own Layer-2 ledger, not an externally reachable receiver: fire a
-    // guarded row that states `branchReFires: false`, fork the run in `replay`
-    // mode, and read GET /runs/{runId}/effects on the fork. Suppression means the
-    // fork issues no further attempt for that seam, so its effect ledger cannot
-    // grow past the parent's.
-    const manifest = await driver.get(MANIFEST_PATH);
-    const seamRows: SeamRow[] = manifest.status === 200 && manifest.json && typeof manifest.json === 'object'
-      ? ((manifest.json as Manifest).seams ?? []) : [];
-    const target = seamRows.find((r) => r.guarded === true && r.branchReFires === false);
-    if (!target) return softSkip('inapplicable', `no manifest row is both guarded and branchReFires: false — nothing to witness suppression on (${seamRows.length} row(s) at ${MANIFEST_PATH})`);
-    const fired = await driver.post(`${SEAMS_PREFIX}/sample/effect-seams/fire`, { seam: String(target.seam) });
-    if (fired.status === 404 || fired.status === 403 || fired.status === 405) {
-      return softSkip('blocked', `the host advertises the seams profile but does not serve ${SEAMS_PREFIX}/sample/effect-seams/fire (answered ${fired.status}) — the no-re-fire leg cannot be driven`);
-    }
-    const firedBody = fired.json as { runId?: unknown } | null;
-    if (fired.status !== 201 || typeof firedBody?.runId !== 'string') {
-      return softSkip('blocked', `${SEAMS_PREFIX}/sample/effect-seams/fire answered ${fired.status} without { runId } — the seam contract in api/seams-v2.yaml is 201 { runId }`);
-    }
-    const parentId = firedBody.runId;
-    const parentEffects = await driver.get(`/runs/${parentId}/effects`);
-    if (parentEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${parentEffects.status} on the fired run — the ledger is the witness for suppression (RFC 0173 §C.2)`);
-    const countOf = (r: OpenWOPResponse): number => {
-      const b = r.json as { effects?: unknown } | null;
-      return Array.isArray(b?.effects) ? (b.effects as unknown[]).length : 0;
-    };
-    const forked = await driver.post(`/runs/${parentId}:fork`, { mode: 'replay' });
-    const forkBody = forked.json as { runId?: unknown } | null;
-    if (forked.status !== 201 || typeof forkBody?.runId !== 'string') {
-      return softSkip('blocked', `POST /runs/{runId}:fork mode replay answered ${forked.status} on the fired run — suppression is witnessed on the fork`);
-    }
-    const forkEffects = await driver.get(`/runs/${String(forkBody.runId)}/effects`);
-    if (forkEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${forkEffects.status} on the replay fork`);
-    expect(
-      countOf(forkEffects),
-      req('openwop.requirement.0173.effect-seam-manifest.no-re-fire', 'spec/v2/core/replay.md §The effect-seam manifest', `seam ${String(target.seam)} states branchReFires: false, so a replay fork MUST NOT issue a further attempt through it — the fork's effect ledger (${countOf(forkEffects)}) cannot exceed the parent's (${countOf(parentEffects)})`),
-    ).toBeLessThanOrEqual(countOf(parentEffects));
-  });
 });

package/src/scenarios/v2-effect-seam-no-refire.test.ts

@@ -0,0 +1,104 @@
+/**
+ * RFC 0173 §C.2 — `effect-seam-no-refire` (suite 2.0.0, target major 2; gated
+ * on `replay`, driven through the seams profile).
+ *
+ * A guarded manifest row that states `branchReFires: false` MUST NOT be fired
+ * again by a replay fork: the fork's Layer-2 effect ledger cannot grow past the
+ * parent's for that seam. The witness is the host's own ledger, reached by
+ * firing a named manifest row inside a run through the catalogued seam
+ * (`api/seams-v2.yaml` `fireEffectSeam`), forking in `replay` mode, and reading
+ * `GET /runs/{runId}/effects` on both.
+ *
+ * This leg lived in `v2-effect-seam-manifest` until rc.45. It is the one leg of
+ * that file that needs the seam, and a file's disposition is worst-first — so
+ * on a host without the seams surface the whole manifest file recorded
+ * `blocked`, and the manifest witness (unaided, a `GET` and a schema) could not
+ * sit on the `openwop-core-standard` floor without dragging a seam gate onto
+ * it. Split, the manifest file is a core-standard floor witness for the
+ * `replay` family and this file is a seams-v2 floor witness; each records its
+ * own truth.
+ *
+ * @see spec/v2/core/replay.md §The effect-seam manifest
+ * @see spec/v2/core/security-defaults.md §Replay suppression
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const MANIFEST_PATH = '/host/effect-seams';
+
+interface SeamRow { seam?: unknown; kind?: unknown; guarded?: unknown; guardedBy?: unknown; branchReFires?: unknown }
+interface Manifest { manifestVersion?: unknown; seams?: SeamRow[] }
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+describe('RFC 0173 §C.2 — effect-seam-no-refire (gated on replay, seam-driven)', () => {
+  it('driving one seam of each kind observes no re-fire on replay', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const replay = await gateFamily('replay');
+    if (!replay) return softSkip('inapplicable', 'replay family not advertised (gate recorded under openwop.family.replay)');
+    if (!seamsProfileAdvertised(doc)) {
+      return softSkip('inapplicable', `the no-re-fire leg is seam-gated (RFC 0173 falsifiability §B replay row is witnessable-gated only through a seam that fires a named manifest row inside a run) — seams profile not advertised (conformance.seamsProfile)`);
+    }
+    // The seam is catalogued (api/seams-v2.yaml `fireEffectSeam`). The witness is
+    // the host's own Layer-2 ledger, not an externally reachable receiver: fire a
+    // guarded row that states `branchReFires: false`, fork the run in `replay`
+    // mode, and read GET /runs/{runId}/effects on the fork. Suppression means the
+    // fork issues no further attempt for that seam, so its effect ledger cannot
+    // grow past the parent's.
+    const manifest = await driver.get(MANIFEST_PATH);
+    const seamRows: SeamRow[] = manifest.status === 200 && manifest.json && typeof manifest.json === 'object'
+      ? ((manifest.json as Manifest).seams ?? []) : [];
+    const target = seamRows.find((r) => r.guarded === true && r.branchReFires === false);
+    if (!target) return softSkip('inapplicable', `no manifest row is both guarded and branchReFires: false — nothing to witness suppression on (${seamRows.length} row(s) at ${MANIFEST_PATH})`);
+    const fired = await driver.post(`${SEAMS_PREFIX}/sample/effect-seams/fire`, { seam: String(target.seam) });
+    if (fired.status === 404 || fired.status === 403 || fired.status === 405) {
+      return softSkip('blocked', `the host advertises the seams profile but does not serve ${SEAMS_PREFIX}/sample/effect-seams/fire (answered ${fired.status}) — the no-re-fire leg cannot be driven`);
+    }
+    const firedBody = fired.json as { runId?: unknown } | null;
+    if (fired.status !== 201 || typeof firedBody?.runId !== 'string') {
+      return softSkip('blocked', `${SEAMS_PREFIX}/sample/effect-seams/fire answered ${fired.status} without { runId } — the seam contract in api/seams-v2.yaml is 201 { runId }`);
+    }
+    const parentId = firedBody.runId;
+    const parentEffects = await driver.get(`/runs/${encodeURIComponent(parentId)}/effects`);
+    if (parentEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${parentEffects.status} on the fired run — the ledger is the witness for suppression (RFC 0173 §C.2)`);
+    const countOf = (r: OpenWOPResponse): number => {
+      const b = r.json as { effects?: unknown } | null;
+      return Array.isArray(b?.effects) ? (b.effects as unknown[]).length : 0;
+    };
+    // The suppression witness is a COMPARISON, and a comparison against an
+    // empty source measures nothing. Until rc.64 this leg asserted only
+    // `fork <= parent`, so a host whose ledger recorded no attempt for the
+    // fired seam read 0 on both sides and PASSED — certifying suppression it
+    // had not observed. A tier-1 host found it the honest way: it was building
+    // an escapes-only ledger, worked out that both reads would be empty, and
+    // refused to ship the projection that would have gone green.
+    //
+    // `blocked`, not `inapplicable`: this host advertises the seams profile,
+    // mounts the seam, and the seam reported firing — the obligation is taken
+    // on and the declared witness (RFC 0173 §C.2) produced nothing, so the
+    // suite could not measure it. `inapplicable` is for an obligation the host
+    // never took on (lib/seams.ts).
+    if (countOf(parentEffects) === 0) {
+      return softSkip('blocked', `the fired run's effect ledger is empty at GET /runs/{runId}/effects, so a fork that also reads empty would compare 0 against 0 and witness nothing — suppression is observable only against a source attempt the host recorded (RFC 0173 §C.2). A host whose ledger records escapes only, or nothing for this seam, cannot witness this obligation.`);
+    }
+    const forked = await driver.post(`/runs/${encodeURIComponent(parentId)}:fork`, { mode: 'replay' });
+    const forkBody = forked.json as { runId?: unknown } | null;
+    if (forked.status !== 201 || typeof forkBody?.runId !== 'string') {
+      return softSkip('blocked', `POST /runs/{runId}:fork mode replay answered ${forked.status} on the fired run — suppression is witnessed on the fork`);
+    }
+    const forkEffects = await driver.get(`/runs/${encodeURIComponent(String(forkBody.runId))}/effects`);
+    if (forkEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${forkEffects.status} on the replay fork`);
+    expect(
+      countOf(forkEffects),
+      req('openwop.requirement.0173.effect-seam-no-refire', 'spec/v2/core/replay.md §The effect-seam manifest', `seam ${String(target.seam)} states branchReFires: false, so a replay fork MUST NOT issue a further attempt through it — the fork's effect ledger (${countOf(forkEffects)}) cannot exceed the parent's (${countOf(parentEffects)})`),
+    ).toBeLessThanOrEqual(countOf(parentEffects));
+  });
+});

package/src/scenarios/v2-era-2-append-vocabulary.test.ts

@@ -60,7 +60,21 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
     if (before === null || before.status !== 200) {
       return softSkip('blocked', `GET /runs/${runId}/events/poll answered ${before?.status ?? 'no response'} on the seeded era-2 run — the log cannot be read back`);
     }
-    const seedCount = eventsOf(before).length;
+    // rc.58: `eventsOf` reads `.events` off a JSON body; `before` is the
+    // RESPONSE. Passing the response read `events` off an object that never
+    // has one, so this leg recorded "reads back empty (0 events)" on every host
+    // — including one whose poll returned both seeded rows — and the writer
+    // rule was unwitnessable. Every other caller passes `.json`.
+    const seedCount = eventsOf(before.json).length;
+    // The seam returning ok is a WRAPPER claim; the readable log is the artifact.
+    // A seam that reports success and seeds nothing leaves no era-2 log to append
+    // to, so there is nothing here to witness the writer rule with — that is
+    // `blocked`, not a writer-rule failure. Asserting against an empty log would
+    // charge this requirement for a seam defect, which is the misattribution the
+    // suite exists to avoid.
+    if (seedCount === 0) {
+      return softSkip('blocked', `seedEra2Log reported success but the log reads back empty (0 events) — the seam's return value is not evidence that a log exists, and without a seeded era-2 log the writer rule is unwitnessed here`);
+    }
 
     // One canonical mutation so the HOST's own writer appends. Cancel is the
     // universally available terminal transition; a host that refuses it on a
@@ -84,7 +98,7 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
       return softSkip('blocked', `the era-2 read failed with ${after.status} after the host's own append — the assertion above already recorded the refusal`);
     }
 
-    const rows = eventsOf(after) as ReadEvent[];
+    const rows = eventsOf(after.json) as ReadEvent[];
     expect(
       rows.length,
       req(ID, DOC, `the append MUST be visible in the log (seeded ${seedCount}, read ${rows.length} after cancel)`),

package/src/scenarios/v2-interrupt-token-scheme.test.ts

@@ -40,7 +40,7 @@ describe('v2 interrupt-token-scheme (RFC 0170 §E.1)', () => {
     if (res === null) return softSkip('blocked', 'GET /interrupts/{token} unreachable (fetch failed)');
     expect([401, 404].includes(res.status), req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', DOC, `a token outside the ow2.<alg>.<kid>.<payload>.<mac> grammar MUST NOT resolve — 401 interrupt_token_invalid (or 404 not_found where the signed-token surface is not mounted); got ${res.status}`)).toBe(true);
     const code = readErrorCode(res.json);
-    expect(res.status === 401 ? code === 'interrupt_token_invalid' : code === 'not_found', req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', 'spec/v2/core/interrupt.md §Tokens', `the refusal MUST carry its registered code (401 → interrupt_token_invalid, 404 → not_found); got ${String(code)}`)).toBe(true);
+    expect(res.status === 401 ? code === 'interrupt_token_invalid' : (code === 'not_found' || code === 'interrupt_not_found'), req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', 'spec/v2/core/interrupt.md §Tokens', `the refusal MUST carry a registered code (401 → interrupt_token_invalid; 404 → not_found OR the more precise interrupt_not_found, both registered in spec/v2/errors.json for this state — a scenario narrower than its own registry fails the host that answers more precisely); got ${String(code)}`)).toBe(true);
   });
 
   it('a well-formed token under a kid the host does not hold is 401 interrupt_token_invalid', async () => {

package/src/scenarios/v2-malformed-body-envelope.test.ts

@@ -0,0 +1,79 @@
+/**
+ * `spec/v2/core/versioning.md` §1.4 + `errors.md` — a malformed JSON body on a
+ * major-2 POST is answered by the HOST: `400`, the error envelope, and the
+ * `OpenWOP-Version` header (suite 2.0.0, target major 2; unaided; creates
+ * nothing).
+ *
+ * §1.4: "A response on any path MUST carry `OpenWOP-Version`". The response
+ * most likely to escape that rule is the one a framework produces before the
+ * host's own middleware runs. Measured on a tier-2 host's public origin on
+ * 2026-09-05: `POST /runs` with body `{` answered `400 text/html` with no
+ * header under BOTH majors — Express's JSON parser was mounted before
+ * negotiation, and its error left the middleware chain for the default HTML
+ * handler. Every well-formed request on that host carried the header; only
+ * the malformed one did not, which is exactly the request a scenario never
+ * sends by accident. The host suggested this probe: "`POST /runs` with `{` is
+ * cheaper than any run."
+ *
+ * The same probe distinguishes a host from the hosting layer in front of it: a
+ * fallback that answers `200 text/html` to everything fails here too.
+ *
+ * @see spec/v2/core/versioning.md §1.4
+ * @see spec/v2/core/errors.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { loadEnv } from '../lib/env.js';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0172.malformed-body-envelope';
+const DOC = 'spec/v2/core/versioning.md §1.4';
+
+interface Answer { readonly status: number; readonly version: string | null; readonly contentType: string; readonly body: unknown; readonly text: string }
+
+async function postMalformed(path: string): Promise<Answer | null> {
+  const { baseUrl, apiKey } = loadEnv();
+  const headers: Record<string, string> = { 'Content-Type': 'application/json', Accept: 'application/json', 'OpenWOP-Version': '2.0' };
+  if (apiKey) headers['authorization'] = `Bearer ${apiKey}`;
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/$/, '')}${path}`, { method: 'POST', headers, body: '{' });
+    const text = await res.text();
+    let body: unknown = null;
+    try { body = JSON.parse(text); } catch { body = null; }
+    return { status: res.status, version: res.headers.get('openwop-version'), contentType: res.headers.get('content-type') ?? '', body, text };
+  } catch {
+    return null;
+  }
+}
+
+describe('v2 malformed-body-envelope (versioning.md §1.4; errors.md)', () => {
+  for (const path of ['/runs', '/webhooks']) {
+    it(`POST ${path} with a malformed JSON body is answered by the host: 400, the error envelope, OpenWOP-Version`, async () => {
+      try { if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable'); } catch { return softSkip('blocked', 'v2 discovery unreachable'); }
+      const a = await postMalformed(path);
+      if (a === null) return softSkip('blocked', `POST ${path} unreachable (fetch failed)`);
+      if (a.status === 404 && a.version !== null) return softSkip('inapplicable', `${path} is not mounted on this host (404 with the header — a host answer, not a fallback)`);
+
+      expect(
+        a.version,
+        req(ID, DOC, `POST ${path} with body '{': the response MUST carry OpenWOP-Version — a response without it did not come from the host's negotiation layer (a framework parser or a hosting fallback answered instead). Got status ${a.status}, content-type ${JSON.stringify(a.contentType)}`),
+      ).not.toBeNull();
+      expect(
+        a.status,
+        req(ID, 'spec/v2/core/errors.md', `a malformed JSON body MUST be refused with 400 validation_error, not accepted and not passed to a default handler (got ${a.status})`),
+      ).toBe(400);
+      expect(
+        a.body !== null && typeof a.body === 'object' && !/text\/html/i.test(a.contentType),
+        req(ID, 'spec/v2/core/errors.md', `the 400 MUST be the JSON error envelope, not a framework's HTML error page (content-type ${JSON.stringify(a.contentType)}, body starts ${JSON.stringify(a.text.slice(0, 40))})`),
+      ).toBe(true);
+      const r = v2Validator('error-envelope')(a.body);
+      expect(r.ok, req(ID, 'spec/v2/core/errors.md', `the body MUST validate against error-envelope.schema.json (${r.errors})`)).toBe(true);
+      expect(
+        (a.body as { error?: unknown }).error,
+        req(ID, 'spec/v2/core/errors.md', 'the envelope\'s `error` MUST be the registered code for a malformed request body, validation_error'),
+      ).toBe('validation_error');
+    });
+  }
+});

package/src/scenarios/v2-manifest-ceiling-refused.test.ts

@@ -97,7 +97,7 @@ async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | nul
   }
   if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
   if (!(await gateFamily('packs'))) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise the packs family (RFC 0169 §A.2)' };
-  if (!seamsProfileAdvertised(doc)) return { kind: 'blocked', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only install path the suite can drive (RFC 0168 §C.1)' };
+  if (!seamsProfileAdvertised(doc)) return { kind: 'inapplicable', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only install path the suite can drive (RFC 0168 §C.1)' };
   return null;
 }
 

package/src/scenarios/v2-manifest-hatch-carried.test.ts

@@ -77,7 +77,7 @@ async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | nul
   }
   if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
   if (!(await gateFamily('packs'))) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise the packs family (RFC 0169 §A.2)' };
-  if (!seamsProfileAdvertised(doc)) return { kind: 'blocked', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only install path the suite can drive (RFC 0168 §C.1)' };
+  if (!seamsProfileAdvertised(doc)) return { kind: 'inapplicable', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only install path the suite can drive (RFC 0168 §C.1)' };
   return null;
 }
 

package/src/scenarios/v2-minimum-version-refused.test.ts

@@ -88,7 +88,7 @@ describe('RFC 0175 §D.2 — minimum-version-refused (gated on a2a/mcp + seams)'
     if (!doc) return softSkip('blocked', 'discovery unreachable');
     const facet = await familyAdvertised('a2a');
     if (!facet) return softSkip('inapplicable', 'a2a facet not advertised — no floor to enforce');
-    if (!seamsProfileAdvertised(doc)) return softSkip('blocked', 'the below-floor exchange is driven through the seams profile — conformance.seamsProfile is not openwop-conformance-seams-v2');
+    if (!seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'the below-floor exchange is driven through the seams profile — conformance.seamsProfile is not openwop-conformance-seams-v2');
     const floor = String(facet['minimumVersion']);
     if (!a2aBelow(A2A_LOWEST, floor)) {
       return softSkip('blocked', `the advertised a2a.minimumVersion (${floor}) is at or below the lowest version the suite peer can offer (${A2A_LOWEST}) — nothing below the floor can be offered; a peer speaking a lower A2A revision is needed`);

package/src/scenarios/v2-mrtr-rounds-ceiling.test.ts

@@ -63,7 +63,7 @@ describe('RFC 0175 §E.1 — mrtr-rounds-ceiling (gated on mcp + mrtr)', () => {
     if (!facet) return softSkip('inapplicable', 'mcp facet not advertised — no MRTR ceiling');
     const maxRounds = maxRoundsOf(facet);
     if (!Number.isInteger(maxRounds)) return softSkip('inapplicable', 'mcp.mrtr.maxRounds not advertised — no ceiling to exceed');
-    if (!seamsProfileAdvertised(doc)) return softSkip('blocked', 'the rounds are driven through the seams profile (§23 invoke seam) — conformance.seamsProfile is not openwop-conformance-seams-v2');
+    if (!seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'the rounds are driven through the seams profile (§23 invoke seam) — conformance.seamsProfile is not openwop-conformance-seams-v2');
     const server = getMcpFakeServer();
     if (server === null) return softSkip('blocked', 'the suite MCP fake server (OPENWOP_MCP_FAKE_SERVER=true) is not started in this run');
     server.reset();

package/src/scenarios/v2-negotiation-authenticated.test.ts

@@ -88,7 +88,7 @@ describe('RFC 0175 §D.1 — negotiation-authenticated (gated on a2a/mcp + seams
     if (!doc) return softSkip('blocked', 'discovery unreachable');
     const facet = await familyAdvertised('a2a');
     if (!facet) return softSkip('inapplicable', 'a2a facet not advertised — no negotiation to authenticate');
-    if (!seamsProfileAdvertised(doc)) return softSkip('blocked', 'the unauthenticated exchange is driven through the seams profile — conformance.seamsProfile is not openwop-conformance-seams-v2');
+    if (!seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'the unauthenticated exchange is driven through the seams profile — conformance.seamsProfile is not openwop-conformance-seams-v2');
     const preferred = String(facet['preferredVersion']);
     if (preferred === A2A_LOWER) return softSkip('blocked', `a2a.preferredVersion is ${preferred}, the lowest version the suite peer can offer — no lower version can be offered`);
     const peer = new A2AFakePeer({ protocolVersions: ['0.3'] });

package/src/scenarios/v2-negotiation-decided-emitted.test.ts

@@ -88,7 +88,7 @@ async function leg(protocol: 'a2a' | 'mcp', id: string): Promise<void> {
   if (!doc) return softSkip('blocked', 'discovery unreachable');
   const facet = await familyAdvertised(protocol);
   if (!facet) return softSkip('inapplicable', `${protocol} facet not advertised — no negotiation to audit`);
-  if (!seamsProfileAdvertised(doc)) return softSkip('blocked', `the exchange is driven through the seams profile (RFC 0175 §D.3) — conformance.seamsProfile is not openwop-conformance-seams-v2`);
+  if (!seamsProfileAdvertised(doc)) return softSkip('inapplicable', `the exchange is driven through the seams profile (RFC 0175 §D.3) — conformance.seamsProfile is not openwop-conformance-seams-v2`);
   const peer = protocol === 'a2a' ? getA2AFakePeer() : getMcpFakeServer();
   if (peer === null) return softSkip('blocked', `the suite ${protocol === 'a2a' ? 'A2A fake peer (OPENWOP_A2A_FAKE_PEER=true)' : 'MCP fake server (OPENWOP_MCP_FAKE_SERVER=true)'} is not started in this run`);
   peer.reset();

package/src/scenarios/v2-pack-isolation.test.ts

@@ -54,7 +54,7 @@ async function gated(): Promise<Record<string, unknown> | null> {
 /** Drive one misbehaving typeId through the sandbox seam; null (reason recorded) when the seam is absent. */
 async function invoke(typeId: string, extra: Record<string, unknown> = {}): Promise<InvokeResult | null> {
   const doc = await discovery();
-  if (!doc || !seamsProfileAdvertised(doc)) { softSkip('blocked', `the ${typeId} leg is seam-driven — seams profile (conformance.seamsProfile = openwop-conformance-seams-v2) not advertised`); return null; }
+  if (!doc || !seamsProfileAdvertised(doc)) { softSkip('inapplicable', `the ${typeId} leg is seam-driven — seams profile (conformance.seamsProfile = openwop-conformance-seams-v2) not advertised`); return null; }
   const res = await driver.post(INVOKE, { typeId, ...extra });
   if (res.status === 404 || res.status === 403 || res.status === 405) { seamAbsent(`host advertises packs + sandbox but ${INVOKE} answered ${res.status} — the ${typeId} leg is unobservable (host-sample-test-seams.md §8)`); return null; }
   expect(res.status, req('openwop.requirement.0173.pack-isolation.seam', 'host-sample-test-seams.md §8', `${INVOKE} MUST answer 200 { result } | 200 { error } for ${typeId}`)).toBe(200);

package/src/scenarios/v2-peer-dependency-declared.test.ts

@@ -96,7 +96,7 @@ async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | nul
   }
   if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
   if (!(await gateFamily('packs'))) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise the packs family (RFC 0169 §A.2)' };
-  if (!seamsProfileAdvertised(doc)) return { kind: 'blocked', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only install path the suite can drive (RFC 0168 §C.1)' };
+  if (!seamsProfileAdvertised(doc)) return { kind: 'inapplicable', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only install path the suite can drive (RFC 0168 §C.1)' };
   return null;
 }