@openwop/openwop-conformance 2.0.7 → 2.0.8

package/CHANGELOG.md

@@ -1,5 +1,76 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.0.8] — 2026-09-07 — the verifier asked a v1 question about v2 hosts
+
+No host behaviour changes and no wire changes. One defect in the suite's own
+verifier, which had been refusing correct bundles from correct hosts.
+
+**`profileDerivable` now takes the target major, and major 2 derives from
+`spec/v2/profiles.json`.** There were two implementations of "does this
+document derive this profile", and only one of them knew that major 2 exists.
+The EMITTER branched on the target major and, at 2, read the v2 registry: every
+listed family present as a record, every listed metadata key present
+(RFC 0169 §C.1). The VERIFIER called `profileDerivable`, which is the v1
+catalog — `isCore` wants a scalar `protocolVersion` whose major is `1`, plus
+`supportedEnvelopes`, `schemaVersions` and three `limits` integers. A v2
+declaration has none of those. So the verifier's answer for every real v2 host
+was `false`, and a bundle correctly claiming `openwop-discovery-core` was
+refused with `profile-not-derivable`: *"the host does not advertise it"*, about
+a host that advertised exactly it.
+
+Both derivations now live in `lib/v2-profiles.ts` and both callers use it, so
+they cannot drift apart again. That is the point of the module boundary, not
+tidiness.
+
+**Reported by `myndhyve-1`, corroborated by `openwop-app-1`.** Two independent
+hosts, three suite versions, and the diagnosis was settled across them before a
+line was written here. Neither host had anything to fix.
+
+**The trigger was ours, and it was an honesty fix.** This defect is older than
+the reports — it has been wrong since major 2 existed — but it was
+*unreachable* until 2.0.5 taught the bundle to carry `discovery.document`.
+Before that the verifier had nothing to derive from and skipped the check
+entirely. In `myndhyve-1`'s words, which are better than the ones this entry
+started with: **"the defect did not become reachable when a host got healthier;
+it became reachable when the bundle got more honest."** A reader who thinks
+this tracks host health will draw the wrong conclusion about who is exposed.
+The population is *every host cutting on 2.0.5 or later that claims a v2
+profile* — not hosts whose floors went green.
+
+**An unreadable registry is a gap, not a refusal.** `v2ProfileIds` returns
+`null`, not `[]`, when `spec/v2/profiles.json` cannot be read, and the v3
+verifier records `derivabilityChecked: false` instead of rejecting. `[]` would
+have made every profile underivable and refused the bundle — converting a fact
+about *this install's layout* into a verdict about the *host*, which
+`conformance.md` §"Whose fact is the reason?" (2.0.7) forbids by name.
+
+**The test that certified the bug.** `certification-bundle-v3.test.ts` had one
+row exercising derivability at major 2, and its fixture was a *v1-shaped*
+document (`protocolVersion: '1.11'`, `supportedEnvelopes`, `limits`) inside a
+`targetMajor: 2` bundle. It passed, and it made the v1-predicate verifier look
+correct while that verifier refused every real host. The fixture is now major-2
+shaped, and three added rows pin the dispatch in both directions: a v2
+declaration derives at major 2 and not at major 1, a v1 payload the reverse.
+Disabling the dispatch turns three of them red.
+
+**Not changed, and deliberately.** `isCore` stays exactly as it is and stays
+v1-only. `certification-bundle-verify.ts` and `verifyBundleProfile` are
+bundle-format-v2 readers over v1-era evidence with no target major to read;
+they take the default and are untouched. And the `if (!p.certified) continue;`
+guard stays: RFC 0148 §B(1) binds the *certification*, not the listing, so a
+profile a bundle names without certifying makes no claim for derivability to
+falsify. An earlier plan for this release said the guard would be made loud
+anyway; writing it showed the change has no consumer — it would have added a
+verdict field nobody reads, on a hypothesis no measured bundle isolates.
+Reasoning is not a measurement, and inventing surface to dress it as one is the
+opposite of what this thread has been about.
+
+**`v2RegistryPath` is collapsed onto `SPEC_V2_DIR`.** The old copy in `cli.ts`
+resolved the peer through Node's resolver *and then kept three guessed
+directory candidates underneath it*, beneath a docblock stating that it
+resolved "instead of guessing directory shapes". The guesses were the half of
+that fix that never landed.
+
 ## [2.0.7] — 2026-09-06 — three claims of coverage that were not coverage
 
 No host behaviour changes. One gate changes disposition, and the two prose

package/dist/cli.js

@@ -34,7 +34,6 @@
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath, join } from 'node:path';
-import { createRequire } from 'node:module';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -47,6 +46,7 @@ import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/cer
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
 import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
+import { v2ProfileIds } from './lib/v2-profiles.js';
 function parseArgs(argv) {
     let baseUrl;
     let apiKey;
@@ -297,54 +297,22 @@ function claimedProfilesFor(doc) {
  * metadata key present. The v1 derivation cannot stand in — `isCore` wants a
  * root `protocolVersion` plus `supportedEnvelopes`/`schemaVersions`/`limits`,
  * shapes a closed v2 root does not have — so a major-2 run claimed NOTHING and
- * no v2 host could ever certify. Falls back to the empty set only when the
- * registry is genuinely absent from the layout, and says so.
+ * no v2 host could ever certify.
+ *
+ * The derivation itself now lives in `lib/v2-profiles.ts`, because the VERIFIER
+ * needs the same answer and had been computing a different one: it asked the v1
+ * predicates about v2 documents and refused every real major-2 bundle. Emitter
+ * and verifier share one function so they cannot drift apart again. All this
+ * wrapper adds is the operator-facing warning — a CLI concern, not a
+ * derivation one.
  */
-function v2RegistryPath(conformanceRoot) {
-    const candidates = [];
-    try {
-        const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
-        candidates.push(resolvePath(dirname(req.resolve('@openwop/spec-artifacts/package.json')), 'spec', 'v2', 'profiles.json'));
-    }
-    catch { /* not installed as a package; the repo-layout candidates below */ }
-    candidates.push(resolvePath(conformanceRoot, 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec-artifacts', 'spec', 'v2', 'profiles.json'));
-    return candidates.find((c) => existsSync(c)) ?? null;
-}
-function claimedProfilesForV2(doc, conformanceRoot) {
-    // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
-    // this package — instead of guessing directory shapes. Hand-rolled candidates
-    // found the registry in a repo checkout and missed it in every published
-    // install, where npm hoists the peer to a SIBLING package dir: the probe that
-    // walked one level up landed on the `@openwop/` scope directory, not a
-    // package, so a real host run silently claimed nothing.
-    const found = v2RegistryPath(conformanceRoot);
-    if (found === null) {
-        process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
+function claimedProfilesForV2(doc) {
+    const ids = v2ProfileIds(doc);
+    if (ids === null) {
+        process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found or unreadable in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
         return [];
     }
-    let registry;
-    try {
-        registry = JSON.parse(readFileSync(found, 'utf8'));
-    }
-    catch {
-        process.stderr.write(`openwop-conformance --certify: ${found} is unreadable; claimedProfiles is empty.\n`);
-        return [];
-    }
-    const root = doc;
-    const isRecord = (k) => {
-        const v = root[k];
-        return typeof v === 'object' && v !== null && !Array.isArray(v);
-    };
-    const out = [];
-    for (const p of registry.profiles ?? []) {
-        if (typeof p.id !== 'string')
-            continue;
-        const families = Array.isArray(p.predicate?.families) ? p.predicate.families.map(String) : [];
-        const metadata = Array.isArray(p.predicate?.metadata) ? p.predicate.metadata.map(String) : [];
-        if (families.every(isRecord) && metadata.every((k) => root[k] !== undefined))
-            out.push(p.id);
-    }
-    return out;
+    return [...ids];
 }
 /**
  * `spec/v2/profiles.json` `floorScenarios` → scenario file names. A
@@ -474,7 +442,7 @@ async function runCertify(args, baseUrl, apiKey) {
     }
     const sha256 = createHash('sha256').update(canonicalJSON(document)).digest('hex');
     // (b) Derive claimedProfiles from the captured document.
-    const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document, conformanceRoot) : claimedProfilesFor(document);
+    const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document) : claimedProfilesFor(document);
     // Major-2 floors come from spec/v2/profiles.json. Without this the derivation
     // measures a v2 host against v1 scenario files a major-2 run never executes,
     // and refuses certification for not running them.

package/dist/lib/certification-bundle-v3.js

@@ -19,6 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from 'node:crypto';
 import { profileDerivable } from './profiles.js';
+import { v2RegistryAvailable } from './v2-profiles.js';
 export const SIGNATURE_OVER = ['witnessSha256', 'host.build', 'suite.version', 'discovery.sha256'];
 /** Deterministic JSON: keys sorted at every level, no whitespace. */
 export function canonicalJSON(value) {
@@ -143,12 +144,35 @@ export function verifyBundleV3(bundle, opts = {}) {
             rejections.push({ kind: 'discovery-digest', detail: `discovery.document hashes to ${digest.slice(0, 12)} but discovery.sha256 is ${String(bundle.discovery?.sha256).slice(0, 12)} — the captured document is not the one the signature attests to` });
         }
         else {
-            derivabilityChecked = true;
-            for (const p of bundle.claimedProfiles ?? []) {
-                if (!p.certified)
-                    continue;
-                if (!profileDerivable(document, p.id)) {
-                    rejections.push({ kind: 'profile-not-derivable', profile: p.id, detail: `${p.id} is marked certified, but the captured discovery document does not derive it (RFC 0148 §B(1)) — evidence cannot certify a profile the host does not advertise` });
+            // WHICH catalog decides derivability is the bundle's own `targetMajor`,
+            // not this verifier's assumption. Reading the old code: it always asked
+            // the v1 predicates, which require a scalar `protocolVersion` of major 1
+            // plus `supportedEnvelopes`/`schemaVersions`/`limits`. A v2 declaration
+            // (RFC 0169 §C.1) carries `protocolVersions`/`preferredVersion` and
+            // family records instead, so the answer for every real major-2 host was
+            // `false` and this loop rejected `openwop-discovery-core` as "not
+            // advertised" on a document that advertises it. Two hosts hit it the
+            // moment their bundles began carrying `discovery.document` in 2.0.5.
+            const targetMajor = bundle.suite?.targetMajor === 2 ? 2 : 1;
+            // A major-2 bundle needs the v2 registry to decide anything. Its absence
+            // is a fact about THIS INSTALL's layout, not about the host, so it is
+            // recorded as the gap v3 already has a flag for rather than spent as a
+            // rejection (`conformance.md` §"Whose fact is the reason?"). Refusing a
+            // host because our own corpus file is missing is the substitution that
+            // rule exists to forbid.
+            if (targetMajor === 2 && !v2RegistryAvailable()) {
+                derivabilityChecked = false;
+            }
+            else {
+                derivabilityChecked = true;
+                for (const p of bundle.claimedProfiles ?? []) {
+                    // §B(1) binds the CERTIFICATION, not the listing: a profile a bundle
+                    // names without certifying makes no claim for derivability to falsify.
+                    if (!p.certified)
+                        continue;
+                    if (!profileDerivable(document, p.id, targetMajor)) {
+                        rejections.push({ kind: 'profile-not-derivable', profile: p.id, detail: `${p.id} is marked certified, but the captured discovery document does not derive it at major ${targetMajor} (RFC 0148 §B(1)) — evidence cannot certify a profile the host does not advertise` });
+                    }
                 }
             }
         }

package/dist/lib/profiles.js

@@ -14,7 +14,13 @@
  *
  * **Derivation is deterministic and pure.** Same payload, same profile
  * set. No time-of-day, host-specific state, or hidden inputs.
+ *
+ * Major 2 derives from `spec/v2/profiles.json` instead; `profileDerivable`
+ * dispatches on the target major and `./v2-profiles.js` holds that half. The
+ * import is one-way at runtime — v2-profiles takes only the `DiscoveryPayload`
+ * TYPE from here, which erases at compile time.
  */
+import { v2ProfileDerivable } from './v2-profiles.js';
 /**
  * Closed v1.x catalog. Adding a profile requires an RFC per
  * `RFCS/0001-rfc-process.md`.
@@ -583,8 +589,28 @@ export const PROFILE_FLOOR_SCENARIOS = {
         ],
     },
 };
-/** Is `profile` derivable from a discovery document? Maps a profile name to its predicate (RFC 0089 §B(1)). */
-export function profileDerivable(c, profile) {
+/**
+ * Is `profile` derivable from a discovery document? Maps a profile name to its
+ * predicate (RFC 0089 §B(1)).
+ *
+ * `targetMajor` selects WHICH catalog answers. The v1 catalog below is a set of
+ * predicates over a v1 discovery payload — `isCore` alone requires a scalar
+ * `protocolVersion` with major `1`, `supportedEnvelopes`, `schemaVersions` and
+ * three `limits` integers. A v2 declaration has none of them (RFC 0169 §C.1
+ * restructured the root), so asking these predicates about a v2 document does
+ * not return an unknown: it returns `false`, confidently, for a host that
+ * advertises the profile. Major 2 delegates to the registry-driven derivation
+ * the emitter already used.
+ *
+ * The default is `1` so every v1-era call site — `verifyBundleProfile` below,
+ * the bundle-format-v2 verifier — keeps the behaviour it was written against.
+ * A v2 caller opts in explicitly; the v3 verifier reads the major off
+ * `bundle.suite.targetMajor` rather than a flag of its own, so verification
+ * stays self-contained in the bundle.
+ */
+export function profileDerivable(c, profile, targetMajor = 1) {
+    if (targetMajor === 2)
+        return v2ProfileDerivable(c, profile);
     if (profile === 'openwop-core-standard')
         return isCoreStandard(c);
     if (profile === 'openwop-agent-platform')

package/dist/lib/v2-profiles.js

@@ -0,0 +1,106 @@
+/**
+ * The major-2 profile derivation: `spec/v2/profiles.json` as a predicate over a
+ * DECLARATION (RFC 0169 §C.1).
+ *
+ * ## Why this is its own module
+ *
+ * There were two implementations of "does this document derive this profile",
+ * and only one of them knew that major 2 exists.
+ *
+ * The EMITTER (`cli.ts`) branched on the target major and, at 2, read this
+ * registry. The VERIFIER (`certification-bundle-v3.ts`) called
+ * `profiles.profileDerivable`, which is the v1 catalog: `isCore` wants a scalar
+ * `protocolVersion` whose major is `1`, plus `supportedEnvelopes`,
+ * `schemaVersions` and `limits.clarificationRounds`. A v2 declaration has none
+ * of those — RFC 0169 restructured the root into `protocolVersions` /
+ * `preferredVersion` and family records — so the verifier's answer for every
+ * real v2 host was `false`, and a bundle that correctly claimed
+ * `openwop-discovery-core` was refused with `profile-not-derivable`: "the host
+ * does not advertise it", about a host that advertised exactly it.
+ *
+ * The emitter and the verifier now call THIS function, so they cannot disagree
+ * again. That is the point of the module boundary — not tidiness.
+ *
+ * ## Unevaluable is not false
+ *
+ * `v2ProfileIds` returns `null`, not `[]`, when the registry cannot be read.
+ * The distinction is load-bearing. `[]` would make every certified profile
+ * underivable and reject the bundle — converting a fact about the SUITE'S
+ * layout (the corpus file is missing from this install) into a verdict about
+ * the HOST (it does not advertise what it advertises). `conformance.md`
+ * §"Whose fact is the reason?" forbids exactly that substitution: where the
+ * predicate is a fact about the suite, the row records the gap rather than
+ * spending the host's evidence. Here the gap is `derivabilityChecked: false`,
+ * the flag v3 already carries for a bundle that shipped no document.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { SPEC_V2_DIR } from './paths.js';
+/**
+ * Path to `spec/v2/profiles.json`, or null when this layout has no v2 corpus.
+ *
+ * Anchored on `SPEC_V2_DIR` — one resolver, already correct for all three
+ * layouts (env override, repo checkout, published install with the
+ * `@openwop/spec-artifacts` peer). The shape this replaces resolved the peer
+ * through Node AND kept three guessed directory candidates underneath it,
+ * under a docblock that said it resolved "instead of guessing directory
+ * shapes". The guesses were the half of that fix that never landed.
+ */
+export function v2RegistryPath() {
+    if (SPEC_V2_DIR === null)
+        return null;
+    const path = join(SPEC_V2_DIR, 'profiles.json');
+    return existsSync(path) ? path : null;
+}
+function readRegistry() {
+    const found = v2RegistryPath();
+    if (found === null)
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(found, 'utf8'));
+        return parsed.profiles ?? [];
+    }
+    catch {
+        return null;
+    }
+}
+/** True when the registry is present AND parseable, so derivability can be decided at all. */
+export function v2RegistryAvailable() {
+    return readRegistry() !== null;
+}
+/**
+ * Every profile the declaration derives at major 2, or `null` when the registry
+ * is unavailable (see the module docblock — `null` is not `[]`).
+ *
+ * The predicate is the registry's own: every listed family present as a record,
+ * every listed metadata key present at the root. Nothing here is hand-written
+ * per profile, so adding a v2 profile is a corpus edit and not a code edit.
+ */
+export function v2ProfileIds(doc) {
+    const profiles = readRegistry();
+    if (profiles === null)
+        return null;
+    const root = doc;
+    const isRecord = (k) => {
+        const v = root[k];
+        return typeof v === 'object' && v !== null && !Array.isArray(v);
+    };
+    const out = [];
+    for (const p of profiles) {
+        if (typeof p.id !== 'string')
+            continue;
+        const families = Array.isArray(p.predicate?.families) ? p.predicate.families.map(String) : [];
+        const metadata = Array.isArray(p.predicate?.metadata) ? p.predicate.metadata.map(String) : [];
+        if (families.every(isRecord) && metadata.every((k) => root[k] !== undefined))
+            out.push(p.id);
+    }
+    return out;
+}
+/**
+ * Is `profile` derivable from `doc` at major 2? False when the registry is
+ * unavailable — callers that must distinguish "not derivable" from "could not
+ * be decided" check {@link v2RegistryAvailable} first, as the v3 verifier does.
+ */
+export function v2ProfileDerivable(doc, profile) {
+    return v2ProfileIds(doc)?.includes(profile) ?? false;
+}

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.7",
-  "stampSha256": "1d8f7916c3c32af8dfffdd419b773358b812ff5954829b87bff576eb3f0dc669"
+  "version": "2.0.8",
+  "stampSha256": "3c52e6a451f700ac99aac8aea616d1cf5d26124902b07c9bf00dff039fff2eb0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.7"
+    "@openwop/spec-artifacts": "2.0.8"
   }
 }

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.7",
-  "corpusTag": "v2.0.7",
+  "version": "2.0.8",
+  "corpusTag": "v2.0.8",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "0d18b9414567efb5662f0a8bc06725d0e038aab14f327db7a1b8ebe3b9f4cbb9",
-    "api/v2/asyncapi.yaml": "25196e36b92b0dab97904b1f3461826d2066e579963c26c7e6168d2e5688bdfe",
-    "api/v2/openapi.yaml": "e48e5669918ddda197a17508eca24ea42e834a62b309091c87d063cb52b1b2cb",
+    "api/seams-v2.yaml": "86cac3079b27351e7f5e30f63393a25501584b8a38c893d1d7a65802c18fbb24",
+    "api/v2/asyncapi.yaml": "b1b44dac3dd253509b036aaa30cafdac500311ef0f5045646651ddff184fe379",
+    "api/v2/openapi.yaml": "516bf500bb740400b679550439b69996a46d07062c8137fdd95c60c9e81bffb2",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "0484560c0bb72e5da9fa393b0723961e1cb7837eaf90c035ff37b7e7fdad6476",
+    "spec/v1/core-standard-manifest.json": "c118d81c173a26a9349dba9a9958c310c658f798564540c26c3e614a3fdd3514",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -268,8 +268,8 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "2937de1d170c218e4d336088035c2a4fe6b7e951b6c6bd8bd375f0580ae07a53",
+    "spec/v2/release.json": "5bf850da0ebcc8aaedbc9ded9064a760d4de798061ebeff0d8b890d78dc1d13a",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "8f8818dd663240bdd1ea074a25fd9354d0fde2c3"
+  "corpusCommit": "949920131eb3c035a14d6fb1d3e60163949803bb"
 }

package/src/cli.ts

@@ -35,7 +35,6 @@
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath, join } from 'node:path';
-import { createRequire } from 'node:module';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -55,6 +54,7 @@ import {
   PROFILE_FLOOR_SCENARIOS,
 } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
+import { v2ProfileIds } from './lib/v2-profiles.js';
 
 interface ParsedArgs {
   readonly baseUrl: string | undefined;
@@ -318,55 +318,22 @@ function claimedProfilesFor(doc: DiscoveryPayload): string[] {
  * metadata key present. The v1 derivation cannot stand in — `isCore` wants a
  * root `protocolVersion` plus `supportedEnvelopes`/`schemaVersions`/`limits`,
  * shapes a closed v2 root does not have — so a major-2 run claimed NOTHING and
- * no v2 host could ever certify. Falls back to the empty set only when the
- * registry is genuinely absent from the layout, and says so.
+ * no v2 host could ever certify.
+ *
+ * The derivation itself now lives in `lib/v2-profiles.ts`, because the VERIFIER
+ * needs the same answer and had been computing a different one: it asked the v1
+ * predicates about v2 documents and refused every real major-2 bundle. Emitter
+ * and verifier share one function so they cannot drift apart again. All this
+ * wrapper adds is the operator-facing warning — a CLI concern, not a
+ * derivation one.
  */
-function v2RegistryPath(conformanceRoot: string): string | null {
-  const candidates: string[] = [];
-  try {
-    const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
-    candidates.push(resolvePath(dirname(req.resolve('@openwop/spec-artifacts/package.json')), 'spec', 'v2', 'profiles.json'));
-  } catch { /* not installed as a package; the repo-layout candidates below */ }
-  candidates.push(
-    resolvePath(conformanceRoot, 'spec', 'v2', 'profiles.json'),
-    resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'),
-    resolvePath(conformanceRoot, '..', 'spec-artifacts', 'spec', 'v2', 'profiles.json'),
-  );
-  return candidates.find((c) => existsSync(c)) ?? null;
-}
-
-function claimedProfilesForV2(doc: DiscoveryPayload, conformanceRoot: string): string[] {
-  // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
-  // this package — instead of guessing directory shapes. Hand-rolled candidates
-  // found the registry in a repo checkout and missed it in every published
-  // install, where npm hoists the peer to a SIBLING package dir: the probe that
-  // walked one level up landed on the `@openwop/` scope directory, not a
-  // package, so a real host run silently claimed nothing.
-  const found = v2RegistryPath(conformanceRoot);
-  if (found === null) {
-    process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
+function claimedProfilesForV2(doc: DiscoveryPayload): string[] {
+  const ids = v2ProfileIds(doc);
+  if (ids === null) {
+    process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found or unreadable in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
     return [];
   }
-  let registry: { profiles?: Array<{ id?: unknown; predicate?: { families?: unknown; metadata?: unknown } }> };
-  try {
-    registry = JSON.parse(readFileSync(found, 'utf8'));
-  } catch {
-    process.stderr.write(`openwop-conformance --certify: ${found} is unreadable; claimedProfiles is empty.\n`);
-    return [];
-  }
-  const root = doc as unknown as Record<string, unknown>;
-  const isRecord = (k: string): boolean => {
-    const v = root[k];
-    return typeof v === 'object' && v !== null && !Array.isArray(v);
-  };
-  const out: string[] = [];
-  for (const p of registry.profiles ?? []) {
-    if (typeof p.id !== 'string') continue;
-    const families = Array.isArray(p.predicate?.families) ? (p.predicate.families as unknown[]).map(String) : [];
-    const metadata = Array.isArray(p.predicate?.metadata) ? (p.predicate.metadata as unknown[]).map(String) : [];
-    if (families.every(isRecord) && metadata.every((k) => root[k] !== undefined)) out.push(p.id);
-  }
-  return out;
+  return [...ids];
 }
 
 /**
@@ -500,7 +467,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
   const sha256 = createHash('sha256').update(canonicalJSON(document)).digest('hex');
 
   // (b) Derive claimedProfiles from the captured document.
-  const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document, conformanceRoot) : claimedProfilesFor(document);
+  const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document) : claimedProfilesFor(document);
   // Major-2 floors come from spec/v2/profiles.json. Without this the derivation
   // measures a v2 host against v1 scenario files a major-2 run never executes,
   // and refuses certification for not running them.

package/src/lib/certification-bundle-v3.ts

@@ -19,6 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify, type KeyObject } from 'node:crypto';
 import { profileDerivable, type DiscoveryPayload } from './profiles.js';
+import { v2RegistryAvailable } from './v2-profiles.js';
 
 export type BundleV3Result = 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
 
@@ -201,11 +202,33 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
     if (digest !== bundle.discovery?.sha256) {
       rejections.push({ kind: 'discovery-digest', detail: `discovery.document hashes to ${digest.slice(0, 12)} but discovery.sha256 is ${String(bundle.discovery?.sha256).slice(0, 12)} — the captured document is not the one the signature attests to` });
     } else {
-      derivabilityChecked = true;
-      for (const p of bundle.claimedProfiles ?? []) {
-        if (!p.certified) continue;
-        if (!profileDerivable(document as DiscoveryPayload, p.id)) {
-          rejections.push({ kind: 'profile-not-derivable', profile: p.id, detail: `${p.id} is marked certified, but the captured discovery document does not derive it (RFC 0148 §B(1)) — evidence cannot certify a profile the host does not advertise` });
+      // WHICH catalog decides derivability is the bundle's own `targetMajor`,
+      // not this verifier's assumption. Reading the old code: it always asked
+      // the v1 predicates, which require a scalar `protocolVersion` of major 1
+      // plus `supportedEnvelopes`/`schemaVersions`/`limits`. A v2 declaration
+      // (RFC 0169 §C.1) carries `protocolVersions`/`preferredVersion` and
+      // family records instead, so the answer for every real major-2 host was
+      // `false` and this loop rejected `openwop-discovery-core` as "not
+      // advertised" on a document that advertises it. Two hosts hit it the
+      // moment their bundles began carrying `discovery.document` in 2.0.5.
+      const targetMajor = bundle.suite?.targetMajor === 2 ? 2 : 1;
+      // A major-2 bundle needs the v2 registry to decide anything. Its absence
+      // is a fact about THIS INSTALL's layout, not about the host, so it is
+      // recorded as the gap v3 already has a flag for rather than spent as a
+      // rejection (`conformance.md` §"Whose fact is the reason?"). Refusing a
+      // host because our own corpus file is missing is the substitution that
+      // rule exists to forbid.
+      if (targetMajor === 2 && !v2RegistryAvailable()) {
+        derivabilityChecked = false;
+      } else {
+        derivabilityChecked = true;
+        for (const p of bundle.claimedProfiles ?? []) {
+          // §B(1) binds the CERTIFICATION, not the listing: a profile a bundle
+          // names without certifying makes no claim for derivability to falsify.
+          if (!p.certified) continue;
+          if (!profileDerivable(document as DiscoveryPayload, p.id, targetMajor)) {
+            rejections.push({ kind: 'profile-not-derivable', profile: p.id, detail: `${p.id} is marked certified, but the captured discovery document does not derive it at major ${targetMajor} (RFC 0148 §B(1)) — evidence cannot certify a profile the host does not advertise` });
+          }
         }
       }
     }

package/src/lib/profiles.ts

@@ -14,8 +14,15 @@
  *
  * **Derivation is deterministic and pure.** Same payload, same profile
  * set. No time-of-day, host-specific state, or hidden inputs.
+ *
+ * Major 2 derives from `spec/v2/profiles.json` instead; `profileDerivable`
+ * dispatches on the target major and `./v2-profiles.js` holds that half. The
+ * import is one-way at runtime — v2-profiles takes only the `DiscoveryPayload`
+ * TYPE from here, which erases at compile time.
  */
 
+import { v2ProfileDerivable } from './v2-profiles.js';
+
 /**
  * Closed v1.x catalog. Adding a profile requires an RFC per
  * `RFCS/0001-rfc-process.md`.
@@ -664,8 +671,27 @@ export const PROFILE_FLOOR_SCENARIOS: Readonly<Record<string, ProfileFloor>> = {
   },
 };
 
-/** Is `profile` derivable from a discovery document? Maps a profile name to its predicate (RFC 0089 §B(1)). */
-export function profileDerivable(c: DiscoveryPayload, profile: string): boolean {
+/**
+ * Is `profile` derivable from a discovery document? Maps a profile name to its
+ * predicate (RFC 0089 §B(1)).
+ *
+ * `targetMajor` selects WHICH catalog answers. The v1 catalog below is a set of
+ * predicates over a v1 discovery payload — `isCore` alone requires a scalar
+ * `protocolVersion` with major `1`, `supportedEnvelopes`, `schemaVersions` and
+ * three `limits` integers. A v2 declaration has none of them (RFC 0169 §C.1
+ * restructured the root), so asking these predicates about a v2 document does
+ * not return an unknown: it returns `false`, confidently, for a host that
+ * advertises the profile. Major 2 delegates to the registry-driven derivation
+ * the emitter already used.
+ *
+ * The default is `1` so every v1-era call site — `verifyBundleProfile` below,
+ * the bundle-format-v2 verifier — keeps the behaviour it was written against.
+ * A v2 caller opts in explicitly; the v3 verifier reads the major off
+ * `bundle.suite.targetMajor` rather than a flag of its own, so verification
+ * stays self-contained in the bundle.
+ */
+export function profileDerivable(c: DiscoveryPayload, profile: string, targetMajor: 1 | 2 = 1): boolean {
+  if (targetMajor === 2) return v2ProfileDerivable(c, profile);
   if (profile === 'openwop-core-standard') return isCoreStandard(c);
   if (profile === 'openwop-agent-platform') return agentPlatformStatus(c) !== 'none';
   if ((PROFILE_NAMES as readonly string[]).includes(profile)) {

package/src/lib/v2-profiles.ts

@@ -0,0 +1,112 @@
+/**
+ * The major-2 profile derivation: `spec/v2/profiles.json` as a predicate over a
+ * DECLARATION (RFC 0169 §C.1).
+ *
+ * ## Why this is its own module
+ *
+ * There were two implementations of "does this document derive this profile",
+ * and only one of them knew that major 2 exists.
+ *
+ * The EMITTER (`cli.ts`) branched on the target major and, at 2, read this
+ * registry. The VERIFIER (`certification-bundle-v3.ts`) called
+ * `profiles.profileDerivable`, which is the v1 catalog: `isCore` wants a scalar
+ * `protocolVersion` whose major is `1`, plus `supportedEnvelopes`,
+ * `schemaVersions` and `limits.clarificationRounds`. A v2 declaration has none
+ * of those — RFC 0169 restructured the root into `protocolVersions` /
+ * `preferredVersion` and family records — so the verifier's answer for every
+ * real v2 host was `false`, and a bundle that correctly claimed
+ * `openwop-discovery-core` was refused with `profile-not-derivable`: "the host
+ * does not advertise it", about a host that advertised exactly it.
+ *
+ * The emitter and the verifier now call THIS function, so they cannot disagree
+ * again. That is the point of the module boundary — not tidiness.
+ *
+ * ## Unevaluable is not false
+ *
+ * `v2ProfileIds` returns `null`, not `[]`, when the registry cannot be read.
+ * The distinction is load-bearing. `[]` would make every certified profile
+ * underivable and reject the bundle — converting a fact about the SUITE'S
+ * layout (the corpus file is missing from this install) into a verdict about
+ * the HOST (it does not advertise what it advertises). `conformance.md`
+ * §"Whose fact is the reason?" forbids exactly that substitution: where the
+ * predicate is a fact about the suite, the row records the gap rather than
+ * spending the host's evidence. Here the gap is `derivabilityChecked: false`,
+ * the flag v3 already carries for a bundle that shipped no document.
+ */
+
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { SPEC_V2_DIR } from './paths.js';
+import type { DiscoveryPayload } from './profiles.js';
+
+interface V2RegistryEntry {
+  readonly id?: unknown;
+  readonly predicate?: { readonly families?: unknown; readonly metadata?: unknown };
+}
+
+/**
+ * Path to `spec/v2/profiles.json`, or null when this layout has no v2 corpus.
+ *
+ * Anchored on `SPEC_V2_DIR` — one resolver, already correct for all three
+ * layouts (env override, repo checkout, published install with the
+ * `@openwop/spec-artifacts` peer). The shape this replaces resolved the peer
+ * through Node AND kept three guessed directory candidates underneath it,
+ * under a docblock that said it resolved "instead of guessing directory
+ * shapes". The guesses were the half of that fix that never landed.
+ */
+export function v2RegistryPath(): string | null {
+  if (SPEC_V2_DIR === null) return null;
+  const path = join(SPEC_V2_DIR, 'profiles.json');
+  return existsSync(path) ? path : null;
+}
+
+function readRegistry(): readonly V2RegistryEntry[] | null {
+  const found = v2RegistryPath();
+  if (found === null) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(found, 'utf8')) as { profiles?: V2RegistryEntry[] };
+    return parsed.profiles ?? [];
+  } catch {
+    return null;
+  }
+}
+
+/** True when the registry is present AND parseable, so derivability can be decided at all. */
+export function v2RegistryAvailable(): boolean {
+  return readRegistry() !== null;
+}
+
+/**
+ * Every profile the declaration derives at major 2, or `null` when the registry
+ * is unavailable (see the module docblock — `null` is not `[]`).
+ *
+ * The predicate is the registry's own: every listed family present as a record,
+ * every listed metadata key present at the root. Nothing here is hand-written
+ * per profile, so adding a v2 profile is a corpus edit and not a code edit.
+ */
+export function v2ProfileIds(doc: DiscoveryPayload): readonly string[] | null {
+  const profiles = readRegistry();
+  if (profiles === null) return null;
+  const root = doc as unknown as Record<string, unknown>;
+  const isRecord = (k: string): boolean => {
+    const v = root[k];
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+  };
+  const out: string[] = [];
+  for (const p of profiles) {
+    if (typeof p.id !== 'string') continue;
+    const families = Array.isArray(p.predicate?.families) ? (p.predicate.families as unknown[]).map(String) : [];
+    const metadata = Array.isArray(p.predicate?.metadata) ? (p.predicate.metadata as unknown[]).map(String) : [];
+    if (families.every(isRecord) && metadata.every((k) => root[k] !== undefined)) out.push(p.id);
+  }
+  return out;
+}
+
+/**
+ * Is `profile` derivable from `doc` at major 2? False when the registry is
+ * unavailable — callers that must distinguish "not derivable" from "could not
+ * be decided" check {@link v2RegistryAvailable} first, as the v3 verifier does.
+ */
+export function v2ProfileDerivable(doc: DiscoveryPayload, profile: string): boolean {
+  return v2ProfileIds(doc)?.includes(profile) ?? false;
+}