@openwop/openwop-conformance 2.31.1 → 2.33.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.33.0] — 2026-09-21 — a declared relaxation denied nothing, an undeclared one was invisible, and two fakes made both unavoidable
+
+Step 2 of closing `docs/KNOWN-LIMITS.md` §"The reference host's certified bundles were cut under an undeclared relaxation". Three suite defects, all the corpus's.
+
+- **A host advertising `a2a` or `mcp` could not be cut relaxation-free.** The A2A fake peer and MCP fake server advertised `http://127.0.0.1:<port>` and nothing else; only the webhook receiver had a public front. So such a host could be measured ONLY with its egress guard relaxed, and a relaxed guard cannot certify — the rule made a host implementing *more* of the protocol *less* able to certify. The two production hosts cut cleanly only because they advertise neither family. New `OPENWOP_A2A_FAKE_PEER_URL` / `OPENWOP_MCP_FAKE_SERVER_URL`, validated by the same rule as `OPENWOP_WEBHOOK_RECEIVER_URL` (now `resolvePublicFront(envName, …)`; `resolveRegistrationUrl` is a wrapper). `hostFacingEndpoint()` is what is handed to the host — every invoke seam's `peerUrl` / `serverUrl`, and the AgentCard's `url` fields — while the suite's own requests to its own fake keep using the loopback `endpoint()`. Twelve scenario files updated.
+- **A DECLARED relaxation denied nothing on any real host.** `verifyBundleV3` matched a relaxed obligation to a profile by testing whether the profile **id** contained the family name; the emitter tested whether it contained the **whole obligation string** — two different rules under a comment saying they matched. No real v2 profile id contains a family name, so `webhooks.egress-guard` denied neither `openwop-core-standard` nor anything else. `v2-relaxation-recorded` stayed green because its fixture profile was called `openwop-webhooks`, the one id the rule could match. New `profilesRelaxedBy()` in `lib/v2-profiles.ts` reads ownership from where it was always stated — a profile's `predicate.families` in `spec/v2/profiles.json` — and is the ONE function both the emitter and the verifier call. The id-named arm is kept, so nothing denied today is un-denied. New leg `openwop.requirement.0173.relaxation-recorded.owned-by-registry` asserts against the real `openwop-core-standard`. **Sabotage-proven: restoring the old rule leaves the old leg green and reddens only the new one** — which is the blindness, reproduced.
+- **NEW `v2-webhook-egress-refusal.test.ts` — the egress guard's refusal, at major 2, for the first time.** `webhooks.md` §SSRF is a plain MUST with a registered code, and no major-2 row asserted it: `http-client-ssrf` and `webhook-negative` never left the major-1 lane, so a v2 bundle could certify `openwop-core-standard` on a host whose guard refused nothing. Eight registration probes, one per class the sentence names (non-`https`, IPv4 and IPv6 loopback, `localhost`, two RFC 1918 ranges, link-local / cloud metadata, IPv6 ULA); each MUST answer `400 webhook_url_rejected`. Registration-time only — no probe is a destination the suite owns, nothing is delivered, an accepted registration is deleted at once. New id `openwop.requirement.0171.webhook-egress-refused`.
+- **An UNDECLARED relaxation is now detectable, and denied.** This README said the suite "cannot detect an undeclared one". For the egress guard that was never true: a host that accepts `https://127.0.0.1/…` has shown on the wire that its guard is open. Three outcomes — all refused → `executed-pass`; accepted with a `webhooks.*` relaxation DECLARED → `inapplicable`, the declaration quoted, the owning profile denied by the declaration; accepted with NOTHING declared → `executed-fail`, which `profilesDeniedByObservedRelaxation()` turns into a denial of every profile built on `webhooks` in both the emitter (`certified: false`) and `--verify` (new rejection `undeclared-relaxation-observed`, scoped to the profile). Declaring nothing is no longer a way around the rule.
+- **Measured on the v2 reference host in all three postures:** guarded → pass (8/8 refused, right code); `OPENWOP_WEBHOOK_ALLOW_PRIVATE=1` with nothing declared → **fail, "ACCEPTED 8 of 8"** — that flag opens the scheme check and the metadata address too, not only loopback; same flag with the relaxation declared → `inapplicable`. The first attempt at that measurement reported pass/pass/pass, because the harness had not killed the first host and all three runs hit the guarded one; it now refuses to measure while the port is held.
+- `coverage.md`: new row; and the `v2-durability-recovery` row is corrected — it still said `duplicate-delivery` was "counted per effect identity" and that the log was read from `/events`, both wrong since 2.32.0.
+- **Expect this release to un-certify a loopback cut.** That is its purpose. A host cut through public fronts (both production hosts) is unaffected.
+- Suite pinned to corpus `2.33.0`.
+
+## [2.32.0] — 2026-09-20 — every published v2 pack failed the corpus schema, and two kill rows that mandated a fast bound
+
+- **`v2-one-signing-scheme` now covers every bare `*-pack-manifest`, enumerated rather than listed** (openwop#1367). It pinned one file — `registry-version-manifest` — while six bare manifests kept the v1 `{ publicKeyRef, signatureRef, method }` block, closed, and `connection-pack-manifest` had no `signing` seat at all. Measured against the published v2 registry: **0 of 190** `pack.json` documents validated. New id `openwop.requirement.0177.one-signing-scheme.bare-manifests`. Sabotage-proven: fails on the 2.31.1 `node-pack-manifest`.
+- **`openwop.requirement.0177.chain-fragment-config-open`** — `FragmentNode.config` is open exactly as the `WorkflowNode.config` it expands into. The v1→v2 seed closed it because it documents one key (`subChainRef`); 73 of 81 published chain packs failed on `config must NOT have additional properties`. With both corrections: **185 of 190** validate; the remaining five fail on constraints identical in v1 (registry data, not schema).
+- **`v2-durability-recovery`: both kill rows observe until the host's DECLARED recovery bound elapses.** They read the log once, the instant discovery answered again — demanding resumption within ~0 ms of the listener returning, a fast bound RFC 0158 rejects. A host whose sweeper first ticks 5 s after boot against a derived 65 s bound failed, then resumed correctly ten seconds later. The bound (`GET /host/durability/bound`) is a ceiling for waiting only; 60 s fallback when unserved; the governing per-class figure is read off the seam's own response (`recoveryBoundMs`) when the host names one. The observation ceiling is 240 s by default and **operator-raisable** (`OPENWOP_DURABILITY_OBSERVATION_CEILING_MS`): a fixed ceiling would have moved the single read's defect from 0 s to 240 s and made a §B.6-conformant 12.5-minute leased-class bound uncertifiable. A declared bound over the ceiling records `blocked` with that precondition named, not fail. The row detail records the observed kill → resumption interval.
+- **`kill-during-execution` asserts both clauses of §E item 11.** `status !== 'completed' || starts > 1` held forever for a run that was never resumed, so the row passed on a host that lost the work. Now: never observable as completed un-re-executed (latched across every observation) **and** resumed within the bound.
+- **A resumption signal is a further `run.started` or the registry's own recovery event** (`workflow.restored`, `run.restored-from-snapshot`) — item 11's "equivalent progress-past-the-pre-kill-point signal", named.
+- **`duplicate-delivery` counts the effect where it lands.** It counted rows per identity on `GET /runs/{id}/effects` — and a ledger keyed on effect identity admits at most one row per identity *by construction*, so the assertion held whatever the effect did. openwop-app sabotage-tested it before building to it: dedup claim forced to always win, then the effect emitted **twice per fire**; the per-identity count stayed 1 and the row stayed green. §C asks for invocation counts; the projection exposes identities. The scenario now starts its own receiver, passes `effectUrl` to the seam, and asserts **exactly one arrival**; the seam MUST stage work performing exactly one outbound effect addressed there and deliver it twice. The ledger read stays as a labelled consistency check. It also sends no `workflowId` (`conformance-noop` records no effect, so the row could only record `blocked`). Receiver reachability is a declared operator precondition, as for the webhook rows.
+- **The run log is read from `GET /runs/{runId}/events/poll`, not `/events`.** At major 2 `/events` is `streamRunEvents`, SSE only; `pollRunEvents` is the JSON read. The scenario parsed the stream path as JSON, so on a host serving exactly what the OpenAPI states the read came back null and **`poison-exhaustion` resolved `executed-pass` with `partial-witness: blocked`** — its load-bearing clause never ran. Measured on the v2 reference host; openwop-app content-negotiates the stream path, which is why it never showed there. An unreadable log on a kill row is now `blocked`, never "nothing resumed".
+- Four of the five durability defects were found by the openwop-app host reading the scenario against its own mechanism **before building the seam**; the fifth by the v2 reference host's first run. No host had witnessed the seam rows, so no bundle's seam rows are invalidated — but the reference host's committed `poison-exhaustion` pass was vacuous and is superseded by its next cut.
+- **`--certify` no longer hands the bundle signing key to the vitest child.** The child's environment was `{ ...process.env }`, so `OPENWOP_BUNDLE_SIGNING_KEY` — the PKCS8 PEM — went with it, though only the parent signs. Reported by a host operator mid-cut: on macOS `npm exec` rewrites `process.title` and a process listing spills into the child's environ, so `ps` printed the signing key in full into a terminal and transcript. New `src/lib/child-env.ts`; both spawn sites use it, and a self-test asserts on `cli.ts`'s source that no child environment is a bare spread of `process.env`. The key **id** is not secret and stays. **If you listed processes during a `--certify` on ≤ 2.31.1, treat that key as seen and rotate it.**
+- Suite pinned to corpus `2.32.0`.
+
 ## [2.31.1] — 2026-09-20 — major-correct shared polling
 
 - Fixed the shared run polling helper to use `/runs/{runId}` in the major-2 lane and retain `/v1/runs/{runId}` only in the major-1 lane. The old helper combined a `/v1` path with `OpenWOP-Version: 2`, so a conforming host correctly answered `protocol_version_mismatch`; `v2-durability-recovery` then misreported an unreachable run even though it had already failed terminally.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.31.1 @openwop/spec-artifacts@2.31.1
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.33.0 @openwop/spec-artifacts@2.33.0
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -99,7 +99,7 @@ Run `npm run test` for normal CI cadence; `npm run test:strict` when claiming fu
 
 | Variable                                  | Effect                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `OPENWOP_HOST_RELAXATIONS`                | Sets `host.relaxations[]` in the bundle. **It relaxes nothing in the suite** — it is your declaration that the HOST runs relaxed, and the suite cannot detect an undeclared one. A profile carrying a relaxation **cannot certify** (`security-defaults.md` §Relaxations, RFC 0173 §A.2), and since 2.6.0 the emitter enforces that rather than writing `certified: true` and leaving the contradiction to `--verify`. JSON array of `{obligation, durability, reason}`; `durability` is `session \| deployment \| persisted` — **not** `permanent`. Unparseable JSON exits 2; a wrong enum value exits 2 later, at schema validation. |
+| `OPENWOP_HOST_RELAXATIONS`                | Sets `host.relaxations[]` in the bundle. **It relaxes nothing in the suite** — it is your declaration that the HOST runs relaxed, and the suite cannot detect an undeclared one **in general**. It can detect ONE: since 2.33.0 `v2-webhook-egress-refusal` registers eight destinations `webhooks.md` §SSRF says a host MUST refuse, and a host that accepts one with no `webhooks.*` relaxation declared here records `executed-fail` — which the emitter and `--verify` read as an observed undeclared relaxation, denying every profile built on `webhooks`. An obligation is `<family>.<name>`; it denies each profile whose `spec/v2/profiles.json` predicate lists that family (so `webhooks.egress-guard` denies `openwop-core-standard`). Until 2.33.0 the match was on the profile *id*, which contains no family name, so a declared relaxation denied nothing on any real host. A profile carrying a relaxation **cannot certify** (`security-defaults.md` §Relaxations, RFC 0173 §A.2), and since 2.6.0 the emitter enforces that rather than writing `certified: true` and leaving the contradiction to `--verify`. JSON array of `{obligation, durability, reason}`; `durability` is `session \| deployment \| persisted` — **not** `permanent`. Unparseable JSON exits 2; a wrong enum value exits 2 later, at schema validation. |
 | `OPENWOP_TARGET_MAJOR`                    | Selects the scenario lane. **Only the literal `"2"` selects major 2** — unlike `--target-major`, which validates and exits 2 on a bad value, the env var falls back to major 1 for `"1"`, `"3"`, `"two"` or empty. The runner and every vitest worker MUST see the same value: when they disagreed, the worker minted `openwop.floor.*` while the runner looked up `openwop.scenario.*`, producing a vacuous-pass emitter defect and **no bundle at all**. Prefer `--target-major`; set this only when driving `vitest` directly. |
 | `OPENWOP_REQUIRE_BEHAVIOR=true`           | Capability-gated scenarios (audit-log integrity, rate-limit envelope, multi-region idempotency, `configurableSchema`, webhook sig versioning, etc.) FAIL instead of skipping when the host doesn't advertise the profile. Lets a host claim "full coverage" mechanically. See [`coverage.md`](./coverage.md) §"Capability-gated scenarios".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `OPENWOP_TEST_PUBLIC_REGISTRY=true`       | Runs `registry-public.test.ts` against the hosted registry at `packs.openwop.dev`. Skipped by default so the suite doesn't depend on outbound connectivity.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
@@ -113,6 +113,7 @@ Run `npm run test` for normal CI cadence; `npm run test:strict` when claiming fu
 | `OPENWOP_MCP_FAKE_SERVER=true`            | Boots the synthetic MCP peer for `mcp-tool-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `OPENWOP_MCP_REAL_SERVER_URL=<base-url>`  | Points the MCP wire-shape probe at a real MCP server. The probe POSTs JSON-RPC and reads a single-JSON response — matches MCP's `streamable-http` transport in single-response mode. **Does NOT support** stdio transport (which is what most `modelcontextprotocol/servers` references default to) or SSE-streamed responses; an operator collecting interop evidence today runs a custom `StreamableHTTPServerTransport`-style server that returns a single JSON body per request. Adding SSE-frame parsing is tracked in `docs/PROTOCOL-GAP-CLOSURE-PLAN.md` Track 6. Assertions relax to shape-only. When both this and `OPENWOP_MCP_FAKE_SERVER` are set, the real URL wins. Phase 3 T3.4 interop-evidence path.                                                                                                               |
 | `OPENWOP_A2A_FAKE_PEER=true`              | Boots the synthetic A2A peer for `a2a-task-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `OPENWOP_A2A_FAKE_PEER_URL=<https-url>` / `OPENWOP_MCP_FAKE_SERVER_URL=<https-url>` | **The public front for each fake — the route to an A2A / MCP witness that relaxes nothing** (2.33.0). Same rule and the same loud validation as `OPENWOP_WEBHOOK_RECEIVER_URL`: `https:`, publicly resolvable. The fake still LISTENS on loopback; pin it with the matching `_PORT` so the tunnel has a fixed port to forward to. When set, the URL handed to the host under test — the `peerUrl` / `serverUrl` of every invoke seam, and the `url` fields of the A2A AgentCard — is the front; the suite's own requests to its own fake stay local. Until 2.33.0 neither fake had a front, so a host advertising `a2a` or `mcp` could be measured ONLY with its egress guard relaxed, and a relaxed guard cannot certify: the rule made a host implementing more of the protocol less able to certify. |
 | `OPENWOP_A2A_REAL_PEER_URL=<base-url>`    | Points the A2A AgentCard + task-lifecycle probe at a real reference A2A peer. Drift-point subtests (AUTH_REQUIRED / REJECTED) stay fake-peer-only — real peers don't expose a state-forcing API. Phase 3 T3.4 interop-evidence path.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `OPENWOP_FORCE_RATE_LIMIT=true`           | Signals the host (test-only key) to fabricate a 429 so `rate-limit-envelope.test.ts` can exercise envelope shape deterministically.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `OPENWOP_TEST_PROMPT_PACK_INSTALLED=true` | Promotes the `prompt-pack-install.test.ts` existence claim from soft-skip to hard assertion (RFC 0028 §B). Set when the target host is known to have at least one prompt pack installed at boot — RFC 0028 §B does NOT require any host with `endpointsSupported: true` to have packs installed, so the suite stays conformant against a fresh production host with no pack subscriptions when the flag is unset. The in-tree workflow-engine sample auto-installs `vendor.openwop.prompt-sample` via `promptPackLoader.ts`, so operators running against it should set the flag.                                                                                                                                                                                                                                                   |
@@ -132,7 +133,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 523 scenario files under `src/scenarios/`.
+The current suite has 524 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -477,7 +478,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 523 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 524 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/coverage.md

@@ -144,7 +144,8 @@ The scenario groups in the table below (one row per group; count the rows — th
 | `tool-session-lifecycle.test.ts`                                                                                                                                                                                                                        | `capabilities.toolCatalog.sessionLifecycle` (RFC 0078 §D, `tool-catalog.md`)                                                                                                                                                                                                                                            | A (the §D bracket via `POST /v1/host/sample/tools/session-run` + the test event-log seam: `tool.session.opened` before the first RFC 0064 call event → `tool.session.closed` after the last, one shared `sessionId`, each carrying a `toolId`, `closed.outcome` ∈ {completed,failed,aborted,expired}, both content-free)                                                                                                                                                                                                                                                                                                                                                                            | `host-pending`                                                                                                                   | `behaviorGate('openwop-tool-session-lifecycle', …)`. Seam-gated; soft-skips on 404. **Part of the RFC 0078 → Accepted bar.** First adopter: MyndHyve `toolCatalog`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `egress-audience-binding.test.ts`                                                                                                                                                                                                                       | `capabilities.httpClient.egressPolicy.supported` (RFC 0079 §C, `host-capabilities.md`) + `SECURITY/invariants.yaml` `egress-credential-audience-bound`                                                                                                                                                                  | A (KEYSTONE — the §C confused-deputy MUST via `POST /v1/host/sample/egress/decide`: an out-of-audience egress is `denied`/`downgraded` with `reason:"out-of-audience"` and the credential is NOT attached (`credentialAttached !== true`); a provenance-unevaluable egress fails closed `denied`+`reason:"provenance-unevaluable"`; decision/reason ∈ the closed enums)                                                                                                                                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-egress-audience-binding', …)`. Seam-gated; soft-skips on 404. **This is the RFC 0079 → Accepted bar** (the `egress-credential-audience-bound` invariant graduates reference-impl → protocol tier when this passes against a host). First adopter: MyndHyve `httpClient.egressPolicy`.                                                                                                                                                                                                                                                                                                                            |
 | `egress-decision-content-free.test.ts`                                                                                                                                                                                                                  | `capabilities.httpClient.egressPolicy.supported` (RFC 0079 §F / SR-1)                                                                                                                                                                                                                                                   | A (the secret non-leak — a `canary` credential's sentinel never surfaces in the decision (`canaryLeaked !== true`), the `egress.decided` payload carries no forbidden content key, and `reason` stays in the CLOSED vocabulary so no blocked destination spills into a free-form field)                                                                                                                                                                                                                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-egress-decision-content-free', …)`. Seam-gated; soft-skips on 404. **Part of the RFC 0079 → Accepted bar.** First adopter: MyndHyve `httpClient.egressPolicy`.                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| `v2-durability-recovery.test.ts` | the RFC 0158 host-extension durability seam `POST /host/durability/kill` (non-normative; §E mints no capability field, so seam PRESENCE is how a host says it claims a rung) | A (all five `durable-single-instance` rows: `kill-after-accept` as a HOLD-DISPATCH exercise, `kill-during-execution` asserting that work executing at a real process death is never observable as completed without re-execution, `duplicate-delivery` counted PER EFFECT IDENTITY rather than by end state, `bound-is-derived` as an explicitly-labelled paper check, and `poison-exhaustion` ported from the major-1 scenario — at major 2 it reads the canonical `GET /runs/{runId}/events`, so unlike its v1 twin it needs NO seam and can never record `blocked` for want of one a host did not wire) | `host-pending` | **Disposition rule, and it protects fleet certification:** no seam route at all ⇒ `inapplicable` (the host claims no rung); seam present but an operator precondition unmet — a restart supervisor, which a black-box suite cannot supply — ⇒ `blocked` with the precondition NAMED. Collapsing the two would deny certification to every host the day these rows entered the lane. `peer-resume` is deliberately NOT written: §E makes it bundle-witnessed, so a scenario could only ever record `blocked`. **This is the RFC 0158 → Accepted bar, and it is now complete at major 2** — before the port, a major-2 bundle could carry at most four of the five rows and the rung was unwitnessable no matter what a host did, and its witness is openwop-app, which the RFC records as having observed `kill-during-execution` across a real `SIGKILL`. |
+| `v2-webhook-egress-refusal.test.ts` | the `webhooks` family (capability-gated) | A (`webhooks.md` §SSRF at MAJOR 2 — eight registration probes, one per class the sentence names: non-`https`, IPv4/IPv6 loopback, `localhost`, two RFC 1918 ranges, link-local / cloud metadata, IPv6 ULA; each MUST answer `400 webhook_url_rejected`. Until 2.33.0 no major-2 row asserted the guard refuses anything — the refusal scenarios were major-1 only. THREE OUTCOMES: all refused → `executed-pass`; a probe accepted with a `webhooks.*` relaxation DECLARED in `OPENWOP_HOST_RELAXATIONS` → `inapplicable`, and the declared relaxation denies the owning profile; a probe accepted with NOTHING declared → `executed-fail`, which the emitter and verifier read as an OBSERVED undeclared relaxation and deny every profile built on `webhooks` (`undeclared-relaxation-observed`). Registration-time only: no probe is a destination the suite owns, nothing is delivered, an accepted registration is deleted at once) |
+| `v2-durability-recovery.test.ts` | the RFC 0158 host-extension durability seam `POST /host/durability/kill` (non-normative; §E mints no capability field, so seam PRESENCE is how a host says it claims a rung) | A (all five `durable-single-instance` rows: `kill-after-accept` as a HOLD-DISPATCH exercise, `kill-during-execution` asserting that work executing at a real process death is never observable as completed without re-execution, `duplicate-delivery` counted AT THE EFFECT'S DESTINATION — a receiver the suite owns, `effectUrl` — because a ledger keyed on effect identity admits one row per identity by construction and cannot show a double-fire (2.32.0), `bound-is-derived` as an explicitly-labelled paper check, and `poison-exhaustion` ported from the major-1 scenario — at major 2 it reads the canonical JSON log read `GET /runs/{runId}/events/poll` (NOT `/events`, which is SSE-only at major 2 — reading it as JSON made this row pass vacuously on a host serving exactly the OpenAPI; 2.32.0), so unlike its v1 twin it needs NO seam and can never record `blocked` for want of one a host did not wire) | `host-pending` | **Disposition rule, and it protects fleet certification:** no seam route at all ⇒ `inapplicable` (the host claims no rung); seam present but an operator precondition unmet — a restart supervisor, which a black-box suite cannot supply — ⇒ `blocked` with the precondition NAMED. Collapsing the two would deny certification to every host the day these rows entered the lane. `peer-resume` is deliberately NOT written: §E makes it bundle-witnessed, so a scenario could only ever record `blocked`. **This is the RFC 0158 → Accepted bar, and it is now complete at major 2** — before the port, a major-2 bundle could carry at most four of the five rows and the rung was unwitnessable no matter what a host did, and its witness is openwop-app, which the RFC records as having observed `kill-during-execution` across a real `SIGKILL`. |
 | `memory-degraded-projection.test.ts`                                                                                                                                                                                                                    | `capabilities.agents.manifestRuntime.supported` + `capabilities.memory.supported` (RFC 0080 §C, `agent-memory.md`)                                                                                                                                                                                                      | A (the §C iff-contract on the NORMATIVE `GET /v1/agents`: a degraded entry MUST carry `memoryDegraded:true` + a non-empty, unique `degradedMemoryDimensions[]` drawn from the closed §A-name enum [read/write/search/long-term-durability/compaction/attribution/replay-snapshot/retention]; a non-degraded entry MUST NOT carry a non-empty list; the inventory is non-empty; the degraded branch runs non-vacuously when `OPENWOP_DEGRADED_AGENT_ID` names a known-degraded agent)                                                                                                                                                                                                                | `host-pending`                                                                                                                   | `behaviorGate('openwop-memory-degraded', …)`. Black-box on the normative path (no POST seam); soft-skips on 404 / when the host computes no degradation. **This is the RFC 0080 → Accepted bar.** First adopter: MyndHyve `memory`.                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `budget-enforcement.test.ts`                                                                                                                                                                                                                            | `capabilities.budget.supported` (RFC 0084 §C/§D, `budget-policy.md`) + `SECURITY/invariants.yaml` `budget-no-pricing-leak`                                                                                                                                                                                              | A (the §C/§D enforcement via `POST /v1/host/sample/budget/run` + the test event-log seam: a `hard-cost-exhaust` run emits the strict-ordered `budget.reserved → budget.consumed → budget.threshold.crossed{percent} → budget.exhausted → cap.breached{kind:"budget-cost"} → run.failed{error:"budget_exhausted"}` chain; a `model-denied` run is refused `budget_model_denied` BEFORE the provider call (fail-closed); an `advisory` host emits the `budget.*` events without stopping; every `budget.*` payload content-free — no pricing/rate)                                                                                                                                                    | `host-pending`                                                                                                                   | `behaviorGate('openwop-budget-enforcement', …)`. Seam-gated; soft-skips on 404. **This is the RFC 0084 → Accepted bar.** First adopter: MyndHyve `budget`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `agent-platform-aggregate-evidence.test.ts`                                                                                                                                                                                                             | `openwop-agent-platform` claim — live discovery `profiles[]` includes it (RFC 0085 §C, `agent-platform-profile.md`)                                                                                                                                                                                                     | A (the §C/§D honest-advertisement on live `/.well-known/openwop`: a host claiming `openwop-agent-platform` MUST satisfy the §B floor predicate (`isAgentPlatformPartial` → `partial`/`full`, never `none`), the claim backed by per-capability evidence not the profile string; `OPENWOP_AGENT_PLATFORM_TIER=full` forces the full-predicate bar — all governance terms + tenant installScope + all 16 §D terms)                                                                                                                                                                                                                                                                                    | `host-pending`                                                                                                                   | `behaviorGate('openwop-agent-platform', …)`. Black-box on the discovery doc (no POST seam); soft-skips until a host claims the profile. **This is the RFC 0085 → Accepted bar.** First adopter: MyndHyve (after the memory batch surfaces the floor's `memory.supported`).                                                                                                                                                                                                                                                                                                                                                              |

package/dist/cli.js

@@ -46,7 +46,8 @@ import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/cer
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
 import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
-import { v2ProfileIds } from './lib/v2-profiles.js';
+import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2ProfileIds } from './lib/v2-profiles.js';
+import { childEnv } from './lib/child-env.js';
 function parseArgs(argv) {
     let baseUrl;
     let apiKey;
@@ -493,7 +494,7 @@ async function runCertify(args, baseUrl, apiKey) {
     // (and assertion count) here; the runner reads it after the run so bundle v2
     // rows come from what scenarios RECORDED, not from per-file pass/fail/skip.
     const ledgerFile = join(reportDir, 'requirement-ledger.jsonl');
-    const env = { ...process.env };
+    const env = childEnv(process.env);
     env.OPENWOP_BASE_URL = baseUrl;
     env.OPENWOP_API_KEY = apiKey;
     env.OPENWOP_LEDGER_PATH = ledgerFile;
@@ -664,7 +665,9 @@ async function runCertify(args, baseUrl, apiKey) {
         // belongs to. Matched the same way the verifier matches it, so the emitter
         // and `verifyBundleV3` cannot disagree about the same bundle.
         const relaxedObligations = new Set((relaxations ?? []).map((r) => r.obligation));
-        const relaxedProfile = (p) => [...relaxedObligations].some((o) => p.includes(o));
+        const relaxedProfileIds = profilesRelaxedBy([...relaxedObligations], claimedProfiles);
+        const observedRelaxed = profilesDeniedByObservedRelaxation(rows3, claimedProfiles).profiles;
+        const relaxedProfile = (p) => relaxedProfileIds.has(p) || observedRelaxed.has(p);
         const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !relaxedProfile(p) && (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
         const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
         const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')) : undefined;
@@ -924,7 +927,7 @@ async function main() {
     }
     // Env vars OVERRIDE flags only when the flag was unset (consistent
     // with the rest of the harness — env wins on the absence of CLI input).
-    const env = { ...process.env };
+    const env = childEnv(process.env);
     if (args.baseUrl)
         env.OPENWOP_BASE_URL = args.baseUrl;
     if (args.apiKey)

package/dist/lib/certification-bundle-v3.js

@@ -19,7 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from 'node:crypto';
 import { profileDerivable } from './profiles.js';
-import { v2RegistryAvailable } from './v2-profiles.js';
+import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 export const SIGNATURE_OVER = ['witnessSha256', 'host.build', 'suite.version', 'discovery.sha256'];
 /** Deterministic JSON: keys sorted at every level, no whitespace. */
 export function canonicalJSON(value) {
@@ -118,9 +118,19 @@ export function verifyBundleV3(bundle, opts = {}) {
     }
     // Relaxations: a relaxed obligation's profile cannot certify (RFC 0173 §A.2).
     const relaxed = new Set((bundle.host?.relaxations ?? []).map((r) => r.obligation.split('.')[0]));
+    // Ownership comes from the profile registry, not from the profile's name — see profilesRelaxedBy.
+    const relaxedProfiles = profilesRelaxedBy((bundle.host?.relaxations ?? []).map((r) => r.obligation), (bundle.claimedProfiles ?? []).map((p) => p.id));
+    // An OBSERVED relaxation nobody declared: the bundle's own results show the
+    // host accepting a destination its egress guard MUST refuse. Same denial as a
+    // declared one, so declaring nothing is not a way around the rule.
+    const observed = profilesDeniedByObservedRelaxation(bundle.results?.requirements ?? [], (bundle.claimedProfiles ?? []).map((p) => p.id));
+    for (const p of bundle.claimedProfiles ?? []) {
+        if (p.certified && observed.profiles.has(p.id) && !relaxedProfiles.has(p.id))
+            rejections.push({ kind: 'undeclared-relaxation-observed', profile: p.id, detail: `${p.id} is marked certified, but this bundle's own results show the host running relaxed on ${observed.obligations.join(', ')} with no host.relaxations[] entry recording it (security-defaults.md §Relaxations: every relaxation a host runs under MUST be recorded, and its profile MUST NOT certify)` });
+    }
     const certifiedProfiles = [];
     for (const p of bundle.claimedProfiles ?? []) {
-        if (p.certified && relaxed.size > 0 && [...relaxed].some((o) => p.id.includes(o)))
+        if (p.certified && relaxedProfiles.has(p.id))
             rejections.push({ kind: 'relaxed-profile-certified', profile: p.id, detail: `${p.id} is marked certified while a relaxation on ${[...relaxed].join(', ')} is recorded (RFC 0173 §A.2)` });
         else if (p.certified)
             certifiedProfiles.push(p.id);

package/dist/lib/child-env.js

@@ -0,0 +1,29 @@
+/**
+ * The environment handed to the vitest child the CLI spawns.
+ *
+ * `{ ...process.env }` handed the child EVERYTHING the operator exported,
+ * including `OPENWOP_BUNDLE_SIGNING_KEY` — the PKCS8 PEM of the key that signs
+ * the certification bundle. Nothing in the child reads it: the signer runs in
+ * the PARENT, after the run (`cli.ts` `--certify`). It was there only because
+ * nothing took it out.
+ *
+ * Why that is a leak and not a tidiness point. Measured by a host operator
+ * during a production cut (2026-09-20): on macOS `npm exec` rewrites
+ * `process.title`, and a process listing (`ps`, `pgrep -fl`) then spills into
+ * the child's environ — so listing processes mid-cut printed the signing key,
+ * in full, into the operator's terminal and transcript. Same-uid or root only,
+ * but that is exactly who is looking at the terminal. A scenario, a reporter, a
+ * vitest plugin or a crash dump in the child had the same access for no reason.
+ *
+ * The rule: material only the parent uses never enters the child. The key IDS
+ * are not secret and stay (a scenario may legitimately name the key it expects).
+ */
+export const PARENT_ONLY_ENV = [
+    'OPENWOP_BUNDLE_SIGNING_KEY',
+];
+export function childEnv(parent) {
+    const env = { ...parent };
+    for (const name of PARENT_ONLY_ENV)
+        delete env[name];
+    return env;
+}

package/dist/lib/v2-profiles.js

@@ -104,3 +104,69 @@ export function v2ProfileIds(doc) {
 export function v2ProfileDerivable(doc, profile) {
     return v2ProfileIds(doc)?.includes(profile) ?? false;
 }
+/**
+ * Which of `profileIds` a relaxed obligation denies (RFC 0173 §A.2;
+ * `security-defaults.md` §Relaxations: "a bundle that records a relaxation MUST
+ * NOT certify the profile the relaxed obligation belongs to").
+ *
+ * An obligation is `<family>.<name>`. A profile OWNS a family when its registry
+ * predicate lists it — `openwop-core-standard` is built on `interrupt`, `replay`,
+ * `webhooks`, `idempotency`, `eventLog`, so a relaxation on any of those denies
+ * it. That ownership was always stated in `spec/v2/profiles.json`; nothing read
+ * it. Until 2.33.0 the verifier tested whether the profile ID contained the
+ * family name, and the emitter tested whether it contained the WHOLE obligation
+ * string — two different rules under a comment saying they matched — and since
+ * no real v2 profile id contains a family name, a declared relaxation denied
+ * nothing on any real host. The one scenario pinning the rule used a fixture
+ * profile called `openwop-webhooks`, which is why it stayed green.
+ *
+ * The id-substring rule is KEPT as a second arm, not replaced: it is how a
+ * non-registry profile id (a v1 alias, a fixture) names its family, and
+ * dropping it would un-deny something that is denied today. When the registry
+ * is unavailable only that arm can run; the caller already records that layout
+ * as `derivabilityChecked: false`.
+ *
+ * ONE function, called by the emitter and the verifier, so the file and the
+ * verdict on the file cannot disagree again.
+ */
+export function profilesRelaxedBy(obligations, profileIds) {
+    const families = new Set(obligations.map((o) => o.split('.')[0] ?? '').filter((f) => f.length > 0));
+    const out = new Set();
+    if (families.size === 0)
+        return out;
+    const registry = readRegistry();
+    const owned = new Map();
+    for (const p of registry ?? []) {
+        if (typeof p.id === 'string')
+            owned.set(p.id, Array.isArray(p.predicate?.families) ? p.predicate.families.map(String) : []);
+    }
+    for (const id of profileIds) {
+        const ownsOne = (owned.get(id) ?? []).some((f) => families.has(f));
+        const namesOne = [...families].some((f) => id.includes(f));
+        if (ownsOne || namesOne)
+            out.add(id);
+    }
+    return out;
+}
+/**
+ * The requirement whose FAILURE is an observed, undeclared relaxation.
+ *
+ * `conformance/README.md` said of `OPENWOP_HOST_RELAXATIONS` that "the suite
+ * cannot detect an undeclared one". For the egress guard that was never true:
+ * a host that ACCEPTS `https://127.0.0.1/…` as a webhook destination has shown
+ * on the wire that its guard is open (`webhooks.md`: "a host MUST reject (400
+ * webhook_url_rejected) … RFC 1918 and loopback and link-local ranges").
+ * `v2-webhook-egress-refusal` records that as `executed-fail` on this id unless
+ * the operator DECLARED the relaxation — in which case {@link profilesRelaxedBy}
+ * already denies the profile. Either way a profile built on `webhooks` does not
+ * certify on a host whose guard is open; this closes the path where it did,
+ * silently, because nobody declared anything.
+ */
+export const UNDECLARED_RELAXATION_WITNESSES = [
+    { requirementId: 'openwop.requirement.0171.webhook-egress-refused', obligation: 'webhooks.egress-guard' },
+];
+/** Profiles that MUST NOT certify because a row above is `executed-fail` in this bundle's own results. */
+export function profilesDeniedByObservedRelaxation(rows, profileIds) {
+    const obligations = UNDECLARED_RELAXATION_WITNESSES.filter((w) => rows.some((r) => r.id === w.requirementId && r.result === 'executed-fail')).map((w) => w.obligation);
+    return { profiles: profilesRelaxedBy(obligations, profileIds), obligations };
+}

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.31.1",
-  "stampSha256": "7d8c030abbf9fd38c0f527eaa57d0d1621bdbf1c94463854c33c2399e52866f9"
+  "version": "2.33.0",
+  "stampSha256": "e4dbaa49468204c51012de2eb0d2f121b9805804a77c6d108a0bafb707a86bf4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.31.1",
+  "version": "2.33.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.31.1"
+    "@openwop/spec-artifacts": "2.33.0"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 581,
-    "tests": 2205,
-    "withStableId": 2205,
+    "files": 582,
+    "tests": 2209,
+    "withStableId": 2209,
     "interpolatedTitles": 0,
-    "explicitIds": 2159
+    "explicitIds": 2163
   },
   "records": [
     {
@@ -26650,7 +26650,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.accepted-work-survives-a-kill-before-dispatch-and-dispatches-on-resume",
       "file": "v2-durability-recovery.test.ts",
-      "line": 129,
+      "line": 262,
       "title": "accepted work survives a kill before dispatch and dispatches on resume",
       "explicitId": "openwop.requirement.0158.kill-after-accept",
       "citations": [
@@ -26664,10 +26664,15 @@
     {
       "id": "openwop.it.v2-durability-recovery.work-executing-at-a-real-process-death-is-never-reported-complete-and-resumes",
       "file": "v2-durability-recovery.test.ts",
-      "line": 165,
+      "line": 307,
       "title": "work executing at a real process death is never reported complete, and resumes",
       "explicitId": "openwop.requirement.0158.kill-during-execution",
       "citations": [
+        {
+          "section": "RFC 0158 §B.4 / §E item 11",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "RFC 0158 §B.4 / §E item 11",
           "requirement": null,
@@ -26678,10 +26683,15 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-same-accepted-work-delivered-twice-fires-each-effect-exactly-once",
       "file": "v2-durability-recovery.test.ts",
-      "line": 199,
+      "line": 354,
       "title": "the same accepted work delivered twice fires each effect exactly once",
       "explicitId": "openwop.requirement.0158.duplicate-delivery",
       "citations": [
+        {
+          "section": "RFC 0158 §C",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "RFC 0158 §C",
           "requirement": null,
@@ -26692,7 +26702,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-declared-recovery-bound-is-derived-from-the-mechanism-that-enforces-it",
       "file": "v2-durability-recovery.test.ts",
-      "line": 238,
+      "line": 428,
       "title": "the declared recovery bound is derived from the mechanism that enforces it",
       "explicitId": "openwop.requirement.0158.bound-is-derived",
       "citations": [
@@ -26706,7 +26716,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.deterministically-failing-work-reaches-a-terminal-state-and-stops-being-retried",
       "file": "v2-durability-recovery.test.ts",
-      "line": 268,
+      "line": 458,
       "title": "deterministically failing work reaches a terminal state and stops being retried",
       "explicitId": "openwop.requirement.0158.poison-exhaustion",
       "citations": [
@@ -28377,7 +28387,7 @@
     {
       "id": "openwop.it.v2-relaxation-recorded.a-bundle-recording-a-relaxation-cannot-certify-the-relaxed-profile",
       "file": "v2-relaxation-recorded.test.ts",
-      "line": 68,
+      "line": 70,
       "title": "a bundle recording a relaxation cannot certify the relaxed profile",
       "explicitId": "openwop.requirement.0173.relaxation-recorded",
       "citations": [
@@ -28411,10 +28421,35 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-relaxation-recorded.a-relaxation-denies-the-real-profile-that-owns-its-family-not-only-one-named-aft",
+      "file": "v2-relaxation-recorded.test.ts",
+      "line": 118,
+      "title": "a relaxation denies the REAL profile that owns its family, not only one named after it",
+      "explicitId": "openwop.requirement.0173.relaxation-recorded.owned-by-registry",
+      "citations": [
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "control: with no relaxation recorded, the real profile certifies — so the rejection below is the relaxation's"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "a relaxation on `webhooks.*` MUST deny `openwop-core-standard`, whose registry predicate is built on the `webhooks` family — ownership is read from spec/v2/profiles.json, never from the spelling of the profile id"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "the owning profile is not certified, and a profile that does not own the family still is"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "a relaxation on a family outside every claimed profile's predicate is scoped to nothing claimed — it does not poison an unrelated profile"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-relaxation-recorded.durability-is-a-closed-set-session-deployment-persisted",
       "file": "v2-relaxation-recorded.test.ts",
-      "line": 108,
+      "line": 143,
       "title": "durability is a closed set: session | deployment | persisted",
       "explicitId": "openwop.requirement.0173.relaxation-recorded.durability-closed",
       "citations": [
@@ -29553,6 +29588,25 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-webhook-egress-refusal.a-webhook-registration-naming-a-destination-the-guard-must-refuse-is-refused-400",
+      "file": "v2-webhook-egress-refusal.test.ts",
+      "line": 82,
+      "title": "a webhook registration naming a destination the guard MUST refuse is refused 400 webhook_url_rejected",
+      "explicitId": "openwop.requirement.0171.webhook-egress-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/webhooks.md §SSRF",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §SSRF",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-well-known-one-resource.a-header-less-get-and-an-openwop-version-2-0-get-are-two-representations-of-one",
       "file": "v2-well-known-one-resource.test.ts",
@@ -36398,7 +36452,7 @@
     {
       "id": "openwop.it.v2-one-signing-scheme.registry-version-manifest-signing-has-exactly-one-scheme-ed25519-canonical-json",
       "file": "v2-one-signing-scheme.test.ts",
-      "line": 37,
+      "line": 42,
       "title": "registry-version-manifest signing has exactly one scheme, ed25519-canonical-json, and no method / publicKeyRef",
       "explicitId": "openwop.requirement.0177.one-signing-scheme",
       "citations": [
@@ -36428,6 +36482,70 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-one-signing-scheme.every-bare-pack-manifest-carries-the-same-closed-keyid-scheme-signing-block-and",
+      "file": "v2-one-signing-scheme.test.ts",
+      "line": 62,
+      "title": "every bare *-pack-manifest carries the same closed { keyId, scheme } signing block, and none keeps the v1 one",
+      "explicitId": "openwop.requirement.0177.one-signing-scheme.bare-manifests",
+      "citations": [
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": "schemas/v2/ MUST hold the bare pack-manifest schemas this rule covers"
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-one-signing-scheme.fragmentnode-config-is-open-exactly-as-the-workflownode-config-it-expands-into-a",
+      "file": "v2-one-signing-scheme.test.ts",
+      "line": 90,
+      "title": "FragmentNode.config is open exactly as the WorkflowNode.config it expands into, and keeps its documented subChainRef key",
+      "explicitId": "openwop.requirement.0177.chain-fragment-config-open",
+      "citations": [
+        {
+          "section": "spec/v2/core/workflow-chain-packs.md §Parameter substitution",
+          "requirement": "WorkflowNode.config is a free-form map validated against the typeId's own config schema — the premise this rule compares against"
+        },
+        {
+          "section": "spec/v2/core/workflow-chain-packs.md §Parameter substitution",
+          "requirement": "FragmentNode.config MUST be open: a fragment node expands into a WorkflowNode, so a config the expanded node may carry MUST be expressible in the fragment"
+        },
+        {
+          "section": "spec/v2/core/workflow-chain-packs.md §Parameter substitution",
+          "requirement": "opening the map MUST NOT drop the documented `subChainRef` key (RFC 0133)"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-path-parity.the-corpus-gate-script-exits-0",
       "file": "v2-path-parity.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 523,
+    "files": 524,
     "v1": 445,
-    "v2": 80
+    "v2": 81
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1463,6 +1463,9 @@
     "v2-webhook-durable-delivery.test.ts": [
       2
     ],
+    "v2-webhook-egress-refusal.test.ts": [
+      2
+    ],
     "v2-well-known-one-resource.test.ts": [
       2
     ],