@openwop/openwop-conformance 2.0.7 → 2.0.9

package/CHANGELOG.md

@@ -1,5 +1,106 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.0.9] — 2026-09-09 — the rule this suite measures now says what it measures
+
+No scenario logic changes, no assertion changes, and no host disposition
+changes. `v2-advertised-path-space-served` behaves exactly as it did in 2.0.8.
+What changed is the corpus prose the scenario cites, and this suite ships that
+corpus as its pinned `@openwop/spec-artifacts` peer — so the version moves with
+it.
+
+**`versioning.md` §1.2 quantified wider than this suite has ever measured.** The
+MUST read *"every operation it serves under the other"*, unqualified. This
+scenario has always built its probe set from `spec/v2/path-manifest.json`
+(`parameterlessGets()`), so it measured manifest operations and reported a
+claim about everything a host serves. §1.2 is now scoped to operations **named
+in the manifest** — which is what the instrument does, and what
+`conformance.md` §"Test seams" requires, since that document forbids the
+manifest to name seam operations while the seams profile mounts them.
+
+The narrowing keeps the case the rule exists for: the motivating defect was
+`POST /webhooks` answering `404` under major 2 while `POST /v1/webhooks`
+answered `201`, and `webhooks` is a manifest operation.
+
+**The docblock now states what stays unmeasured.** Non-GET and parameterised
+manifest operations are bound by the prose and probed by nothing here. The
+`POST /webhooks` defect was found by hand, not by this file.
+
+Raised by a tier-2 host asking whether four proprietary `/v1` roots
+(`packs`, `canvas-types`, `_internal`, `packs-test`) were bound. They were not
+— but only because of what the instrument samples, not because the prose said
+so.
+
+## [2.0.8] — 2026-09-07 — the verifier asked a v1 question about v2 hosts
+
+No host behaviour changes and no wire changes. One defect in the suite's own
+verifier, which had been refusing correct bundles from correct hosts.
+
+**`profileDerivable` now takes the target major, and major 2 derives from
+`spec/v2/profiles.json`.** There were two implementations of "does this
+document derive this profile", and only one of them knew that major 2 exists.
+The EMITTER branched on the target major and, at 2, read the v2 registry: every
+listed family present as a record, every listed metadata key present
+(RFC 0169 §C.1). The VERIFIER called `profileDerivable`, which is the v1
+catalog — `isCore` wants a scalar `protocolVersion` whose major is `1`, plus
+`supportedEnvelopes`, `schemaVersions` and three `limits` integers. A v2
+declaration has none of those. So the verifier's answer for every real v2 host
+was `false`, and a bundle correctly claiming `openwop-discovery-core` was
+refused with `profile-not-derivable`: *"the host does not advertise it"*, about
+a host that advertised exactly it.
+
+Both derivations now live in `lib/v2-profiles.ts` and both callers use it, so
+they cannot drift apart again. That is the point of the module boundary, not
+tidiness.
+
+**Reported by `myndhyve-1`, corroborated by `openwop-app-1`.** Two independent
+hosts, three suite versions, and the diagnosis was settled across them before a
+line was written here. Neither host had anything to fix.
+
+**The trigger was ours, and it was an honesty fix.** This defect is older than
+the reports — it has been wrong since major 2 existed — but it was
+*unreachable* until 2.0.5 taught the bundle to carry `discovery.document`.
+Before that the verifier had nothing to derive from and skipped the check
+entirely. In `myndhyve-1`'s words, which are better than the ones this entry
+started with: **"the defect did not become reachable when a host got healthier;
+it became reachable when the bundle got more honest."** A reader who thinks
+this tracks host health will draw the wrong conclusion about who is exposed.
+The population is *every host cutting on 2.0.5 or later that claims a v2
+profile* — not hosts whose floors went green.
+
+**An unreadable registry is a gap, not a refusal.** `v2ProfileIds` returns
+`null`, not `[]`, when `spec/v2/profiles.json` cannot be read, and the v3
+verifier records `derivabilityChecked: false` instead of rejecting. `[]` would
+have made every profile underivable and refused the bundle — converting a fact
+about *this install's layout* into a verdict about the *host*, which
+`conformance.md` §"Whose fact is the reason?" (2.0.7) forbids by name.
+
+**The test that certified the bug.** `certification-bundle-v3.test.ts` had one
+row exercising derivability at major 2, and its fixture was a *v1-shaped*
+document (`protocolVersion: '1.11'`, `supportedEnvelopes`, `limits`) inside a
+`targetMajor: 2` bundle. It passed, and it made the v1-predicate verifier look
+correct while that verifier refused every real host. The fixture is now major-2
+shaped, and three added rows pin the dispatch in both directions: a v2
+declaration derives at major 2 and not at major 1, a v1 payload the reverse.
+Disabling the dispatch turns three of them red.
+
+**Not changed, and deliberately.** `isCore` stays exactly as it is and stays
+v1-only. `certification-bundle-verify.ts` and `verifyBundleProfile` are
+bundle-format-v2 readers over v1-era evidence with no target major to read;
+they take the default and are untouched. And the `if (!p.certified) continue;`
+guard stays: RFC 0148 §B(1) binds the *certification*, not the listing, so a
+profile a bundle names without certifying makes no claim for derivability to
+falsify. An earlier plan for this release said the guard would be made loud
+anyway; writing it showed the change has no consumer — it would have added a
+verdict field nobody reads, on a hypothesis no measured bundle isolates.
+Reasoning is not a measurement, and inventing surface to dress it as one is the
+opposite of what this thread has been about.
+
+**`v2RegistryPath` is collapsed onto `SPEC_V2_DIR`.** The old copy in `cli.ts`
+resolved the peer through Node's resolver *and then kept three guessed
+directory candidates underneath it*, beneath a docblock stating that it
+resolved "instead of guessing directory shapes". The guesses were the half of
+that fix that never landed.
+
 ## [2.0.7] — 2026-09-06 — three claims of coverage that were not coverage
 
 No host behaviour changes. One gate changes disposition, and the two prose

package/dist/cli.js

@@ -34,7 +34,6 @@
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath, join } from 'node:path';
-import { createRequire } from 'node:module';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -47,6 +46,7 @@ import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/cer
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
 import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
+import { v2ProfileIds } from './lib/v2-profiles.js';
 function parseArgs(argv) {
     let baseUrl;
     let apiKey;
@@ -297,54 +297,22 @@ function claimedProfilesFor(doc) {
  * metadata key present. The v1 derivation cannot stand in — `isCore` wants a
  * root `protocolVersion` plus `supportedEnvelopes`/`schemaVersions`/`limits`,
  * shapes a closed v2 root does not have — so a major-2 run claimed NOTHING and
- * no v2 host could ever certify. Falls back to the empty set only when the
- * registry is genuinely absent from the layout, and says so.
+ * no v2 host could ever certify.
+ *
+ * The derivation itself now lives in `lib/v2-profiles.ts`, because the VERIFIER
+ * needs the same answer and had been computing a different one: it asked the v1
+ * predicates about v2 documents and refused every real major-2 bundle. Emitter
+ * and verifier share one function so they cannot drift apart again. All this
+ * wrapper adds is the operator-facing warning — a CLI concern, not a
+ * derivation one.
  */
-function v2RegistryPath(conformanceRoot) {
-    const candidates = [];
-    try {
-        const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
-        candidates.push(resolvePath(dirname(req.resolve('@openwop/spec-artifacts/package.json')), 'spec', 'v2', 'profiles.json'));
-    }
-    catch { /* not installed as a package; the repo-layout candidates below */ }
-    candidates.push(resolvePath(conformanceRoot, 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'), resolvePath(conformanceRoot, '..', 'spec-artifacts', 'spec', 'v2', 'profiles.json'));
-    return candidates.find((c) => existsSync(c)) ?? null;
-}
-function claimedProfilesForV2(doc, conformanceRoot) {
-    // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
-    // this package — instead of guessing directory shapes. Hand-rolled candidates
-    // found the registry in a repo checkout and missed it in every published
-    // install, where npm hoists the peer to a SIBLING package dir: the probe that
-    // walked one level up landed on the `@openwop/` scope directory, not a
-    // package, so a real host run silently claimed nothing.
-    const found = v2RegistryPath(conformanceRoot);
-    if (found === null) {
-        process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
+function claimedProfilesForV2(doc) {
+    const ids = v2ProfileIds(doc);
+    if (ids === null) {
+        process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found or unreadable in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
         return [];
     }
-    let registry;
-    try {
-        registry = JSON.parse(readFileSync(found, 'utf8'));
-    }
-    catch {
-        process.stderr.write(`openwop-conformance --certify: ${found} is unreadable; claimedProfiles is empty.\n`);
-        return [];
-    }
-    const root = doc;
-    const isRecord = (k) => {
-        const v = root[k];
-        return typeof v === 'object' && v !== null && !Array.isArray(v);
-    };
-    const out = [];
-    for (const p of registry.profiles ?? []) {
-        if (typeof p.id !== 'string')
-            continue;
-        const families = Array.isArray(p.predicate?.families) ? p.predicate.families.map(String) : [];
-        const metadata = Array.isArray(p.predicate?.metadata) ? p.predicate.metadata.map(String) : [];
-        if (families.every(isRecord) && metadata.every((k) => root[k] !== undefined))
-            out.push(p.id);
-    }
-    return out;
+    return [...ids];
 }
 /**
  * `spec/v2/profiles.json` `floorScenarios` → scenario file names. A
@@ -474,7 +442,7 @@ async function runCertify(args, baseUrl, apiKey) {
     }
     const sha256 = createHash('sha256').update(canonicalJSON(document)).digest('hex');
     // (b) Derive claimedProfiles from the captured document.
-    const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document, conformanceRoot) : claimedProfilesFor(document);
+    const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document) : claimedProfilesFor(document);
     // Major-2 floors come from spec/v2/profiles.json. Without this the derivation
     // measures a v2 host against v1 scenario files a major-2 run never executes,
     // and refuses certification for not running them.

package/dist/lib/certification-bundle-v3.js

@@ -19,6 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from 'node:crypto';
 import { profileDerivable } from './profiles.js';
+import { v2RegistryAvailable } from './v2-profiles.js';
 export const SIGNATURE_OVER = ['witnessSha256', 'host.build', 'suite.version', 'discovery.sha256'];
 /** Deterministic JSON: keys sorted at every level, no whitespace. */
 export function canonicalJSON(value) {
@@ -143,12 +144,35 @@ export function verifyBundleV3(bundle, opts = {}) {
             rejections.push({ kind: 'discovery-digest', detail: `discovery.document hashes to ${digest.slice(0, 12)} but discovery.sha256 is ${String(bundle.discovery?.sha256).slice(0, 12)} — the captured document is not the one the signature attests to` });
         }
         else {
-            derivabilityChecked = true;
-            for (const p of bundle.claimedProfiles ?? []) {
-                if (!p.certified)
-                    continue;
-                if (!profileDerivable(document, p.id)) {
-                    rejections.push({ kind: 'profile-not-derivable', profile: p.id, detail: `${p.id} is marked certified, but the captured discovery document does not derive it (RFC 0148 §B(1)) — evidence cannot certify a profile the host does not advertise` });
+            // WHICH catalog decides derivability is the bundle's own `targetMajor`,
+            // not this verifier's assumption. Reading the old code: it always asked
+            // the v1 predicates, which require a scalar `protocolVersion` of major 1
+            // plus `supportedEnvelopes`/`schemaVersions`/`limits`. A v2 declaration
+            // (RFC 0169 §C.1) carries `protocolVersions`/`preferredVersion` and
+            // family records instead, so the answer for every real major-2 host was
+            // `false` and this loop rejected `openwop-discovery-core` as "not
+            // advertised" on a document that advertises it. Two hosts hit it the
+            // moment their bundles began carrying `discovery.document` in 2.0.5.
+            const targetMajor = bundle.suite?.targetMajor === 2 ? 2 : 1;
+            // A major-2 bundle needs the v2 registry to decide anything. Its absence
+            // is a fact about THIS INSTALL's layout, not about the host, so it is
+            // recorded as the gap v3 already has a flag for rather than spent as a
+            // rejection (`conformance.md` §"Whose fact is the reason?"). Refusing a
+            // host because our own corpus file is missing is the substitution that
+            // rule exists to forbid.
+            if (targetMajor === 2 && !v2RegistryAvailable()) {
+                derivabilityChecked = false;
+            }
+            else {
+                derivabilityChecked = true;
+                for (const p of bundle.claimedProfiles ?? []) {
+                    // §B(1) binds the CERTIFICATION, not the listing: a profile a bundle
+                    // names without certifying makes no claim for derivability to falsify.
+                    if (!p.certified)
+                        continue;
+                    if (!profileDerivable(document, p.id, targetMajor)) {
+                        rejections.push({ kind: 'profile-not-derivable', profile: p.id, detail: `${p.id} is marked certified, but the captured discovery document does not derive it at major ${targetMajor} (RFC 0148 §B(1)) — evidence cannot certify a profile the host does not advertise` });
+                    }
                 }
             }
         }

package/dist/lib/profiles.js

@@ -14,7 +14,13 @@
  *
  * **Derivation is deterministic and pure.** Same payload, same profile
  * set. No time-of-day, host-specific state, or hidden inputs.
+ *
+ * Major 2 derives from `spec/v2/profiles.json` instead; `profileDerivable`
+ * dispatches on the target major and `./v2-profiles.js` holds that half. The
+ * import is one-way at runtime — v2-profiles takes only the `DiscoveryPayload`
+ * TYPE from here, which erases at compile time.
  */
+import { v2ProfileDerivable } from './v2-profiles.js';
 /**
  * Closed v1.x catalog. Adding a profile requires an RFC per
  * `RFCS/0001-rfc-process.md`.
@@ -583,8 +589,28 @@ export const PROFILE_FLOOR_SCENARIOS = {
         ],
     },
 };
-/** Is `profile` derivable from a discovery document? Maps a profile name to its predicate (RFC 0089 §B(1)). */
-export function profileDerivable(c, profile) {
+/**
+ * Is `profile` derivable from a discovery document? Maps a profile name to its
+ * predicate (RFC 0089 §B(1)).
+ *
+ * `targetMajor` selects WHICH catalog answers. The v1 catalog below is a set of
+ * predicates over a v1 discovery payload — `isCore` alone requires a scalar
+ * `protocolVersion` with major `1`, `supportedEnvelopes`, `schemaVersions` and
+ * three `limits` integers. A v2 declaration has none of them (RFC 0169 §C.1
+ * restructured the root), so asking these predicates about a v2 document does
+ * not return an unknown: it returns `false`, confidently, for a host that
+ * advertises the profile. Major 2 delegates to the registry-driven derivation
+ * the emitter already used.
+ *
+ * The default is `1` so every v1-era call site — `verifyBundleProfile` below,
+ * the bundle-format-v2 verifier — keeps the behaviour it was written against.
+ * A v2 caller opts in explicitly; the v3 verifier reads the major off
+ * `bundle.suite.targetMajor` rather than a flag of its own, so verification
+ * stays self-contained in the bundle.
+ */
+export function profileDerivable(c, profile, targetMajor = 1) {
+    if (targetMajor === 2)
+        return v2ProfileDerivable(c, profile);
     if (profile === 'openwop-core-standard')
         return isCoreStandard(c);
     if (profile === 'openwop-agent-platform')

package/dist/lib/v2-profiles.js

@@ -0,0 +1,106 @@
+/**
+ * The major-2 profile derivation: `spec/v2/profiles.json` as a predicate over a
+ * DECLARATION (RFC 0169 §C.1).
+ *
+ * ## Why this is its own module
+ *
+ * There were two implementations of "does this document derive this profile",
+ * and only one of them knew that major 2 exists.
+ *
+ * The EMITTER (`cli.ts`) branched on the target major and, at 2, read this
+ * registry. The VERIFIER (`certification-bundle-v3.ts`) called
+ * `profiles.profileDerivable`, which is the v1 catalog: `isCore` wants a scalar
+ * `protocolVersion` whose major is `1`, plus `supportedEnvelopes`,
+ * `schemaVersions` and `limits.clarificationRounds`. A v2 declaration has none
+ * of those — RFC 0169 restructured the root into `protocolVersions` /
+ * `preferredVersion` and family records — so the verifier's answer for every
+ * real v2 host was `false`, and a bundle that correctly claimed
+ * `openwop-discovery-core` was refused with `profile-not-derivable`: "the host
+ * does not advertise it", about a host that advertised exactly it.
+ *
+ * The emitter and the verifier now call THIS function, so they cannot disagree
+ * again. That is the point of the module boundary — not tidiness.
+ *
+ * ## Unevaluable is not false
+ *
+ * `v2ProfileIds` returns `null`, not `[]`, when the registry cannot be read.
+ * The distinction is load-bearing. `[]` would make every certified profile
+ * underivable and reject the bundle — converting a fact about the SUITE'S
+ * layout (the corpus file is missing from this install) into a verdict about
+ * the HOST (it does not advertise what it advertises). `conformance.md`
+ * §"Whose fact is the reason?" forbids exactly that substitution: where the
+ * predicate is a fact about the suite, the row records the gap rather than
+ * spending the host's evidence. Here the gap is `derivabilityChecked: false`,
+ * the flag v3 already carries for a bundle that shipped no document.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { SPEC_V2_DIR } from './paths.js';
+/**
+ * Path to `spec/v2/profiles.json`, or null when this layout has no v2 corpus.
+ *
+ * Anchored on `SPEC_V2_DIR` — one resolver, already correct for all three
+ * layouts (env override, repo checkout, published install with the
+ * `@openwop/spec-artifacts` peer). The shape this replaces resolved the peer
+ * through Node AND kept three guessed directory candidates underneath it,
+ * under a docblock that said it resolved "instead of guessing directory
+ * shapes". The guesses were the half of that fix that never landed.
+ */
+export function v2RegistryPath() {
+    if (SPEC_V2_DIR === null)
+        return null;
+    const path = join(SPEC_V2_DIR, 'profiles.json');
+    return existsSync(path) ? path : null;
+}
+function readRegistry() {
+    const found = v2RegistryPath();
+    if (found === null)
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(found, 'utf8'));
+        return parsed.profiles ?? [];
+    }
+    catch {
+        return null;
+    }
+}
+/** True when the registry is present AND parseable, so derivability can be decided at all. */
+export function v2RegistryAvailable() {
+    return readRegistry() !== null;
+}
+/**
+ * Every profile the declaration derives at major 2, or `null` when the registry
+ * is unavailable (see the module docblock — `null` is not `[]`).
+ *
+ * The predicate is the registry's own: every listed family present as a record,
+ * every listed metadata key present at the root. Nothing here is hand-written
+ * per profile, so adding a v2 profile is a corpus edit and not a code edit.
+ */
+export function v2ProfileIds(doc) {
+    const profiles = readRegistry();
+    if (profiles === null)
+        return null;
+    const root = doc;
+    const isRecord = (k) => {
+        const v = root[k];
+        return typeof v === 'object' && v !== null && !Array.isArray(v);
+    };
+    const out = [];
+    for (const p of profiles) {
+        if (typeof p.id !== 'string')
+            continue;
+        const families = Array.isArray(p.predicate?.families) ? p.predicate.families.map(String) : [];
+        const metadata = Array.isArray(p.predicate?.metadata) ? p.predicate.metadata.map(String) : [];
+        if (families.every(isRecord) && metadata.every((k) => root[k] !== undefined))
+            out.push(p.id);
+    }
+    return out;
+}
+/**
+ * Is `profile` derivable from `doc` at major 2? False when the registry is
+ * unavailable — callers that must distinguish "not derivable" from "could not
+ * be decided" check {@link v2RegistryAvailable} first, as the v3 verifier does.
+ */
+export function v2ProfileDerivable(doc, profile) {
+    return v2ProfileIds(doc)?.includes(profile) ?? false;
+}

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.7",
-  "stampSha256": "1d8f7916c3c32af8dfffdd419b773358b812ff5954829b87bff576eb3f0dc669"
+  "version": "2.0.9",
+  "stampSha256": "2a7043538bf6c7ce6a3d5ad9836279f5754d9daa969e9dc0307d6c656fdfaf44"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.7",
+  "version": "2.0.9",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.7"
+    "@openwop/spec-artifacts": "2.0.9"
   }
 }

package/requirements.json

@@ -25811,7 +25811,7 @@
     {
       "id": "openwop.it.v2-advertised-path-space-served.a-host-advertising-major-2-reaches-the-surfaces-it-already-serves-under-v1",
       "file": "v2-advertised-path-space-served.test.ts",
-      "line": 107,
+      "line": 122,
       "title": "a host advertising major 2 reaches the surfaces it already serves under /v1",
       "explicitId": "openwop.requirement.0172.advertised-path-space-served",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.7",
-  "corpusTag": "v2.0.7",
+  "version": "2.0.9",
+  "corpusTag": "v2.0.9",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "0d18b9414567efb5662f0a8bc06725d0e038aab14f327db7a1b8ebe3b9f4cbb9",
-    "api/v2/asyncapi.yaml": "25196e36b92b0dab97904b1f3461826d2066e579963c26c7e6168d2e5688bdfe",
-    "api/v2/openapi.yaml": "e48e5669918ddda197a17508eca24ea42e834a62b309091c87d063cb52b1b2cb",
+    "api/seams-v2.yaml": "85832b378ab3396f031b1503d17a7d252dd2f9bbf753324e05601cf8d50c6b96",
+    "api/v2/asyncapi.yaml": "029fccaec2975cf943e11465a9ea98149096d061da2893c438337906e647dc92",
+    "api/v2/openapi.yaml": "a406c3723d88f520c387d5e47ff9cabb32ac0cac7b1825c8c768ab6ec0cf27bb",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "0484560c0bb72e5da9fa393b0723961e1cb7837eaf90c035ff37b7e7fdad6476",
+    "spec/v1/core-standard-manifest.json": "63799de159579793a95daae66accdc4aa7149eb96994235b0841c0d2ffa132bc",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -211,27 +211,27 @@
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
     "spec/v1/spec-gaps.json": "6cc9962c6b969f632e07a78b52a4f61447ff579e2990cbae989866f584a86042",
-    "spec/v2/README.md": "f56bd8d58be4ac04543c9f7b2fe92b294738d6121a4f21cbd1ce751e72b94c83",
-    "spec/v2/core/capabilities.md": "0f222434bbe58c881362a626ab9db6bce0ae2e54cb858e3d71b662dd1fc13150",
-    "spec/v2/core/conformance.md": "6dda58339117819b77710cd53d25f34cc9e602a35a7958d1afc4e3d4b6b7de23",
-    "spec/v2/core/connection-packs.md": "34e519dbe5b091c9758729787d398b35b1dc41f1e01ebd028e7e6b838ce2f6ee",
-    "spec/v2/core/errors.md": "671895de1b7c987a1dfd53fe0a814159efadae0ffd4c8c06bf1749d345270580",
-    "spec/v2/core/events.md": "7b9207079cede7ec335126b98bcb95d655ae3b7322b18febd1b4df51750b0a33",
-    "spec/v2/core/form-content-packs.md": "976f6e9b05a015f3bfe0748bc4f8bb11bbbd71460d12769f900bcde006b7cbb1",
-    "spec/v2/core/headers.md": "b7fc4f77904653ad47360b20302e3f406973821fb6d74ac86d6e81b674f52c4a",
-    "spec/v2/core/idempotency.md": "0ab68c1e41e81005b560421a3d22f985dda2f7537b2369bff67e40b79c8a581f",
-    "spec/v2/core/identity.md": "e3fa8d2d87c1dec2673e4bf4aec5f2257c684eaf64161c1a1016a634a87509c2",
-    "spec/v2/core/interop.md": "f701fddf15343d878faea31401e25e6ffb3672c2c8a87f30adc13b1e3c5c300c",
-    "spec/v2/core/interrupt.md": "4bd345bccdb8e2762ca95833cc67086158640c27ffa5ef84915a4ab3de348440",
-    "spec/v2/core/overview.md": "8ece6667535d24ed4013a046cb11e1a649f70e39625fc55e09ceb2c02505ed9c",
-    "spec/v2/core/packs.md": "90f32947816b4ec2b045b063ad2914126c73353883514a270ad200205dc8e51b",
-    "spec/v2/core/persistence.md": "e9830ae228bcbc33f03d81a5f2b51e031466feb84387971dd3459bf5e1687701",
-    "spec/v2/core/replay.md": "19b2fcbda4693895d39b99593f498b76376d77472a813bba6c22fca02e106332",
-    "spec/v2/core/runs.md": "f5f24df6da76b1d6e2cf655af3bbe3340195c36ec8d9ce0ca6e357385b1a8771",
-    "spec/v2/core/security-defaults.md": "53a1bc549aaa356a4fcb56cdb1c4f5880d3fb65d5d49dd570a413bb29aff82e5",
-    "spec/v2/core/versioning.md": "2eb4e8e5a1208a026a3d497d1e0fb76a4f7cb97e514d6f41f45dd66b89405abb",
-    "spec/v2/core/webhooks.md": "1d2719335f8fb46cd31dbb836b44ea7d78ed54f98ea181927502814603c5b935",
-    "spec/v2/core/workflow-chain-packs.md": "99ad4aeeeeb05521720dc2ae18ae63e6d604361780ed1b76778ca6d44da70eed",
+    "spec/v2/README.md": "453b56e0f9dd84889e90f3e25efda53e550275a112bc72a970252e00335b408b",
+    "spec/v2/core/capabilities.md": "3ea74e9cfbca23723e4fadac7d53a44f59940dfe9942e086533103e3677507df",
+    "spec/v2/core/conformance.md": "3cae1183d3155572004f192d0c64b921151f4f9905ce2a6a3e29f475334de688",
+    "spec/v2/core/connection-packs.md": "460019f7bc9b5c7473eaa5e2825d8e28ff2941306fbd7ba5dfe4c9e174fcbe64",
+    "spec/v2/core/errors.md": "acb7a04a0c4ac136eb8dcd8549e8bc6da19a80753bf81d903202c7008cb8802f",
+    "spec/v2/core/events.md": "ceee1671e7b585026be61ffa210759157b292d3b56c352bef5d0de98a3db9983",
+    "spec/v2/core/form-content-packs.md": "de63b1bb72bfde0c31aeb31d1f09d8f9297550604c771fd65f26d7459eac7be0",
+    "spec/v2/core/headers.md": "18c09184e5b64c5f28e4aa8c028b13da074bd9a4ca8e6ae56290faa402c277c0",
+    "spec/v2/core/idempotency.md": "9452888f1ed70ffafc4a4f6c770511b3d4e7277009d39b8b8bbca26f5a3c0a32",
+    "spec/v2/core/identity.md": "3ba7016e9f78aac6f6ec5be8a2c577c0309e3e62e2ceb6070c2eabbfc7d1b507",
+    "spec/v2/core/interop.md": "e5c166cd94050539a694cce01d4b733bd8bfbbf4d30584d6cd8ee1a85009afc5",
+    "spec/v2/core/interrupt.md": "a320811c337cb498207cfdc87e24bea8715689101be299f4eb2ae1ea54e6f202",
+    "spec/v2/core/overview.md": "6c3d32ded128237ddb9af12bcfaac4079162464906519d0f2861bba6c675ae18",
+    "spec/v2/core/packs.md": "1c6bad59fd77a90bed9c904c7d59f1649dd21cf70986962194b10650533a46b5",
+    "spec/v2/core/persistence.md": "8e4af460d7390945ffd88731edf69f95a462f55d6569a7d375bf802ca8ddff95",
+    "spec/v2/core/replay.md": "5647bc44e994d9fcb2d2fc8acbb6c0f66e1262228b7efc5a1035eb1d3b38a23f",
+    "spec/v2/core/runs.md": "ceae2f80fc915c12a22682205e2bec797d311b53dc8883000a4f02d002192778",
+    "spec/v2/core/security-defaults.md": "0837314be15d4278f1a835b97f101ba794a025952ad39fd408c6e319756ebf71",
+    "spec/v2/core/versioning.md": "d9506ec2e009a84c1ac02924af2867cf2d6b90c872902fe1b0979a8908e494d0",
+    "spec/v2/core/webhooks.md": "9a946db3a17f72adba8ad493dc004c856237681f823303599dd45c83b522226b",
+    "spec/v2/core/workflow-chain-packs.md": "e0e78926ebb6aa217cf35191d401a51903610469c5d0c464307888fb89e69037",
     "spec/v2/declaration.json": "bd8a1dcee899a4478ac96b52da6ee07e1cb5fce4465939ac32e19e52f4d5c6b2",
     "spec/v2/declaration.schema.json": "eac5f8080bd572f147bd57d0c4ac8ad73b14536d9236222490ae29a33b21e184",
     "spec/v2/errors.json": "f179414a92f30b5dadf26e9e57699649a67324bd7186d5287647d17605d137d3",
@@ -268,8 +268,8 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "2937de1d170c218e4d336088035c2a4fe6b7e951b6c6bd8bd375f0580ae07a53",
+    "spec/v2/release.json": "14eb79136a01caa739684a20dbe15384c2f5420b30f942e6e328e8c66c446745",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "8f8818dd663240bdd1ea074a25fd9354d0fde2c3"
+  "corpusCommit": "e84395f18a99d9266ba94e9eddb23a7e73ef5c33"
 }

package/src/cli.ts

@@ -35,7 +35,6 @@
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath, join } from 'node:path';
-import { createRequire } from 'node:module';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -55,6 +54,7 @@ import {
   PROFILE_FLOOR_SCENARIOS,
 } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
+import { v2ProfileIds } from './lib/v2-profiles.js';
 
 interface ParsedArgs {
   readonly baseUrl: string | undefined;
@@ -318,55 +318,22 @@ function claimedProfilesFor(doc: DiscoveryPayload): string[] {
  * metadata key present. The v1 derivation cannot stand in — `isCore` wants a
  * root `protocolVersion` plus `supportedEnvelopes`/`schemaVersions`/`limits`,
  * shapes a closed v2 root does not have — so a major-2 run claimed NOTHING and
- * no v2 host could ever certify. Falls back to the empty set only when the
- * registry is genuinely absent from the layout, and says so.
+ * no v2 host could ever certify.
+ *
+ * The derivation itself now lives in `lib/v2-profiles.ts`, because the VERIFIER
+ * needs the same answer and had been computing a different one: it asked the v1
+ * predicates about v2 documents and refused every real major-2 bundle. Emitter
+ * and verifier share one function so they cannot drift apart again. All this
+ * wrapper adds is the operator-facing warning — a CLI concern, not a
+ * derivation one.
  */
-function v2RegistryPath(conformanceRoot: string): string | null {
-  const candidates: string[] = [];
-  try {
-    const req = createRequire(resolvePath(conformanceRoot, 'package.json'));
-    candidates.push(resolvePath(dirname(req.resolve('@openwop/spec-artifacts/package.json')), 'spec', 'v2', 'profiles.json'));
-  } catch { /* not installed as a package; the repo-layout candidates below */ }
-  candidates.push(
-    resolvePath(conformanceRoot, 'spec', 'v2', 'profiles.json'),
-    resolvePath(conformanceRoot, '..', 'spec', 'v2', 'profiles.json'),
-    resolvePath(conformanceRoot, '..', 'spec-artifacts', 'spec', 'v2', 'profiles.json'),
-  );
-  return candidates.find((c) => existsSync(c)) ?? null;
-}
-
-function claimedProfilesForV2(doc: DiscoveryPayload, conformanceRoot: string): string[] {
-  // Resolve the peer the way `lib/paths.ts` does — through Node's resolver from
-  // this package — instead of guessing directory shapes. Hand-rolled candidates
-  // found the registry in a repo checkout and missed it in every published
-  // install, where npm hoists the peer to a SIBLING package dir: the probe that
-  // walked one level up landed on the `@openwop/` scope directory, not a
-  // package, so a real host run silently claimed nothing.
-  const found = v2RegistryPath(conformanceRoot);
-  if (found === null) {
-    process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
+function claimedProfilesForV2(doc: DiscoveryPayload): string[] {
+  const ids = v2ProfileIds(doc);
+  if (ids === null) {
+    process.stderr.write('openwop-conformance --certify: spec/v2/profiles.json not found or unreadable in this layout; claimedProfiles is empty (RFC 0169 §C.1).\n');
     return [];
   }
-  let registry: { profiles?: Array<{ id?: unknown; predicate?: { families?: unknown; metadata?: unknown } }> };
-  try {
-    registry = JSON.parse(readFileSync(found, 'utf8'));
-  } catch {
-    process.stderr.write(`openwop-conformance --certify: ${found} is unreadable; claimedProfiles is empty.\n`);
-    return [];
-  }
-  const root = doc as unknown as Record<string, unknown>;
-  const isRecord = (k: string): boolean => {
-    const v = root[k];
-    return typeof v === 'object' && v !== null && !Array.isArray(v);
-  };
-  const out: string[] = [];
-  for (const p of registry.profiles ?? []) {
-    if (typeof p.id !== 'string') continue;
-    const families = Array.isArray(p.predicate?.families) ? (p.predicate.families as unknown[]).map(String) : [];
-    const metadata = Array.isArray(p.predicate?.metadata) ? (p.predicate.metadata as unknown[]).map(String) : [];
-    if (families.every(isRecord) && metadata.every((k) => root[k] !== undefined)) out.push(p.id);
-  }
-  return out;
+  return [...ids];
 }
 
 /**
@@ -500,7 +467,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
   const sha256 = createHash('sha256').update(canonicalJSON(document)).digest('hex');
 
   // (b) Derive claimedProfiles from the captured document.
-  const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document, conformanceRoot) : claimedProfilesFor(document);
+  const claimedProfiles = target.major === 2 ? claimedProfilesForV2(document) : claimedProfilesFor(document);
   // Major-2 floors come from spec/v2/profiles.json. Without this the derivation
   // measures a v2 host against v1 scenario files a major-2 run never executes,
   // and refuses certification for not running them.

package/src/lib/certification-bundle-v3.ts

@@ -19,6 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify, type KeyObject } from 'node:crypto';
 import { profileDerivable, type DiscoveryPayload } from './profiles.js';
+import { v2RegistryAvailable } from './v2-profiles.js';
 
 export type BundleV3Result = 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
 
@@ -201,11 +202,33 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
     if (digest !== bundle.discovery?.sha256) {
       rejections.push({ kind: 'discovery-digest', detail: `discovery.document hashes to ${digest.slice(0, 12)} but discovery.sha256 is ${String(bundle.discovery?.sha256).slice(0, 12)} — the captured document is not the one the signature attests to` });
     } else {
-      derivabilityChecked = true;
-      for (const p of bundle.claimedProfiles ?? []) {
-        if (!p.certified) continue;
-        if (!profileDerivable(document as DiscoveryPayload, p.id)) {
-          rejections.push({ kind: 'profile-not-derivable', profile: p.id, detail: `${p.id} is marked certified, but the captured discovery document does not derive it (RFC 0148 §B(1)) — evidence cannot certify a profile the host does not advertise` });
+      // WHICH catalog decides derivability is the bundle's own `targetMajor`,
+      // not this verifier's assumption. Reading the old code: it always asked
+      // the v1 predicates, which require a scalar `protocolVersion` of major 1
+      // plus `supportedEnvelopes`/`schemaVersions`/`limits`. A v2 declaration
+      // (RFC 0169 §C.1) carries `protocolVersions`/`preferredVersion` and
+      // family records instead, so the answer for every real major-2 host was
+      // `false` and this loop rejected `openwop-discovery-core` as "not
+      // advertised" on a document that advertises it. Two hosts hit it the
+      // moment their bundles began carrying `discovery.document` in 2.0.5.
+      const targetMajor = bundle.suite?.targetMajor === 2 ? 2 : 1;
+      // A major-2 bundle needs the v2 registry to decide anything. Its absence
+      // is a fact about THIS INSTALL's layout, not about the host, so it is
+      // recorded as the gap v3 already has a flag for rather than spent as a
+      // rejection (`conformance.md` §"Whose fact is the reason?"). Refusing a
+      // host because our own corpus file is missing is the substitution that
+      // rule exists to forbid.
+      if (targetMajor === 2 && !v2RegistryAvailable()) {
+        derivabilityChecked = false;
+      } else {
+        derivabilityChecked = true;
+        for (const p of bundle.claimedProfiles ?? []) {
+          // §B(1) binds the CERTIFICATION, not the listing: a profile a bundle
+          // names without certifying makes no claim for derivability to falsify.
+          if (!p.certified) continue;
+          if (!profileDerivable(document as DiscoveryPayload, p.id, targetMajor)) {
+            rejections.push({ kind: 'profile-not-derivable', profile: p.id, detail: `${p.id} is marked certified, but the captured discovery document does not derive it at major ${targetMajor} (RFC 0148 §B(1)) — evidence cannot certify a profile the host does not advertise` });
+          }
         }
       }
     }

package/src/lib/profiles.ts

@@ -14,8 +14,15 @@
  *
  * **Derivation is deterministic and pure.** Same payload, same profile
  * set. No time-of-day, host-specific state, or hidden inputs.
+ *
+ * Major 2 derives from `spec/v2/profiles.json` instead; `profileDerivable`
+ * dispatches on the target major and `./v2-profiles.js` holds that half. The
+ * import is one-way at runtime — v2-profiles takes only the `DiscoveryPayload`
+ * TYPE from here, which erases at compile time.
  */
 
+import { v2ProfileDerivable } from './v2-profiles.js';
+
 /**
  * Closed v1.x catalog. Adding a profile requires an RFC per
  * `RFCS/0001-rfc-process.md`.
@@ -664,8 +671,27 @@ export const PROFILE_FLOOR_SCENARIOS: Readonly<Record<string, ProfileFloor>> = {
   },
 };
 
-/** Is `profile` derivable from a discovery document? Maps a profile name to its predicate (RFC 0089 §B(1)). */
-export function profileDerivable(c: DiscoveryPayload, profile: string): boolean {
+/**
+ * Is `profile` derivable from a discovery document? Maps a profile name to its
+ * predicate (RFC 0089 §B(1)).
+ *
+ * `targetMajor` selects WHICH catalog answers. The v1 catalog below is a set of
+ * predicates over a v1 discovery payload — `isCore` alone requires a scalar
+ * `protocolVersion` with major `1`, `supportedEnvelopes`, `schemaVersions` and
+ * three `limits` integers. A v2 declaration has none of them (RFC 0169 §C.1
+ * restructured the root), so asking these predicates about a v2 document does
+ * not return an unknown: it returns `false`, confidently, for a host that
+ * advertises the profile. Major 2 delegates to the registry-driven derivation
+ * the emitter already used.
+ *
+ * The default is `1` so every v1-era call site — `verifyBundleProfile` below,
+ * the bundle-format-v2 verifier — keeps the behaviour it was written against.
+ * A v2 caller opts in explicitly; the v3 verifier reads the major off
+ * `bundle.suite.targetMajor` rather than a flag of its own, so verification
+ * stays self-contained in the bundle.
+ */
+export function profileDerivable(c: DiscoveryPayload, profile: string, targetMajor: 1 | 2 = 1): boolean {
+  if (targetMajor === 2) return v2ProfileDerivable(c, profile);
   if (profile === 'openwop-core-standard') return isCoreStandard(c);
   if (profile === 'openwop-agent-platform') return agentPlatformStatus(c) !== 'none';
   if ((PROFILE_NAMES as readonly string[]).includes(profile)) {

package/src/lib/v2-profiles.ts

@@ -0,0 +1,112 @@
+/**
+ * The major-2 profile derivation: `spec/v2/profiles.json` as a predicate over a
+ * DECLARATION (RFC 0169 §C.1).
+ *
+ * ## Why this is its own module
+ *
+ * There were two implementations of "does this document derive this profile",
+ * and only one of them knew that major 2 exists.
+ *
+ * The EMITTER (`cli.ts`) branched on the target major and, at 2, read this
+ * registry. The VERIFIER (`certification-bundle-v3.ts`) called
+ * `profiles.profileDerivable`, which is the v1 catalog: `isCore` wants a scalar
+ * `protocolVersion` whose major is `1`, plus `supportedEnvelopes`,
+ * `schemaVersions` and `limits.clarificationRounds`. A v2 declaration has none
+ * of those — RFC 0169 restructured the root into `protocolVersions` /
+ * `preferredVersion` and family records — so the verifier's answer for every
+ * real v2 host was `false`, and a bundle that correctly claimed
+ * `openwop-discovery-core` was refused with `profile-not-derivable`: "the host
+ * does not advertise it", about a host that advertised exactly it.
+ *
+ * The emitter and the verifier now call THIS function, so they cannot disagree
+ * again. That is the point of the module boundary — not tidiness.
+ *
+ * ## Unevaluable is not false
+ *
+ * `v2ProfileIds` returns `null`, not `[]`, when the registry cannot be read.
+ * The distinction is load-bearing. `[]` would make every certified profile
+ * underivable and reject the bundle — converting a fact about the SUITE'S
+ * layout (the corpus file is missing from this install) into a verdict about
+ * the HOST (it does not advertise what it advertises). `conformance.md`
+ * §"Whose fact is the reason?" forbids exactly that substitution: where the
+ * predicate is a fact about the suite, the row records the gap rather than
+ * spending the host's evidence. Here the gap is `derivabilityChecked: false`,
+ * the flag v3 already carries for a bundle that shipped no document.
+ */
+
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { SPEC_V2_DIR } from './paths.js';
+import type { DiscoveryPayload } from './profiles.js';
+
+interface V2RegistryEntry {
+  readonly id?: unknown;
+  readonly predicate?: { readonly families?: unknown; readonly metadata?: unknown };
+}
+
+/**
+ * Path to `spec/v2/profiles.json`, or null when this layout has no v2 corpus.
+ *
+ * Anchored on `SPEC_V2_DIR` — one resolver, already correct for all three
+ * layouts (env override, repo checkout, published install with the
+ * `@openwop/spec-artifacts` peer). The shape this replaces resolved the peer
+ * through Node AND kept three guessed directory candidates underneath it,
+ * under a docblock that said it resolved "instead of guessing directory
+ * shapes". The guesses were the half of that fix that never landed.
+ */
+export function v2RegistryPath(): string | null {
+  if (SPEC_V2_DIR === null) return null;
+  const path = join(SPEC_V2_DIR, 'profiles.json');
+  return existsSync(path) ? path : null;
+}
+
+function readRegistry(): readonly V2RegistryEntry[] | null {
+  const found = v2RegistryPath();
+  if (found === null) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(found, 'utf8')) as { profiles?: V2RegistryEntry[] };
+    return parsed.profiles ?? [];
+  } catch {
+    return null;
+  }
+}
+
+/** True when the registry is present AND parseable, so derivability can be decided at all. */
+export function v2RegistryAvailable(): boolean {
+  return readRegistry() !== null;
+}
+
+/**
+ * Every profile the declaration derives at major 2, or `null` when the registry
+ * is unavailable (see the module docblock — `null` is not `[]`).
+ *
+ * The predicate is the registry's own: every listed family present as a record,
+ * every listed metadata key present at the root. Nothing here is hand-written
+ * per profile, so adding a v2 profile is a corpus edit and not a code edit.
+ */
+export function v2ProfileIds(doc: DiscoveryPayload): readonly string[] | null {
+  const profiles = readRegistry();
+  if (profiles === null) return null;
+  const root = doc as unknown as Record<string, unknown>;
+  const isRecord = (k: string): boolean => {
+    const v = root[k];
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+  };
+  const out: string[] = [];
+  for (const p of profiles) {
+    if (typeof p.id !== 'string') continue;
+    const families = Array.isArray(p.predicate?.families) ? (p.predicate.families as unknown[]).map(String) : [];
+    const metadata = Array.isArray(p.predicate?.metadata) ? (p.predicate.metadata as unknown[]).map(String) : [];
+    if (families.every(isRecord) && metadata.every((k) => root[k] !== undefined)) out.push(p.id);
+  }
+  return out;
+}
+
+/**
+ * Is `profile` derivable from `doc` at major 2? False when the registry is
+ * unavailable — callers that must distinguish "not derivable" from "could not
+ * be decided" check {@link v2RegistryAvailable} first, as the v3 verifier does.
+ */
+export function v2ProfileDerivable(doc: DiscoveryPayload, profile: string): boolean {
+  return v2ProfileIds(doc)?.includes(profile) ?? false;
+}

package/src/scenarios/v2-advertised-path-space-served.test.ts

@@ -36,6 +36,21 @@
  * need no fixture, mutate nothing, and a route that is not mounted answers 404
  * regardless of auth, so the check is unaided and safe against a live host.
  *
+ * The manifest scoping is the RULE's scope, not just this instrument's budget.
+ * `versioning.md` §1.2 binds "every operation named in
+ * `spec/v2/path-manifest.json` that it serves under the other" — surfaces the
+ * manifest does not name are outside the paragraph. That qualifier was added
+ * after a tier-2 host asked whether its four proprietary `/v1` roots were
+ * bound: the older unqualified wording said "every operation it serves", which
+ * this scenario has never measured and which `conformance.md` §"Test seams"
+ * contradicts by requiring the manifest to omit seam operations. Stating the
+ * scope in both places is deliberate — a rule whose prose quantifies wider than
+ * its only instrument reports a general claim from a sampled one.
+ *
+ * What remains UNMEASURED even so: non-GET and parameterised manifest
+ * operations. The prose binds them; nothing here probes them. The motivating
+ * defect was `POST /webhooks`, found by hand, not by this file.
+ *
  * @see spec/v2/core/versioning.md §1.2
  * @see RFCS/0172-v2-versioning-and-release.md §A.1
  */