@openwop/openwop-conformance 2.31.1 → 2.33.0

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.31.1",
-  "corpusTag": "v2.31.0",
+  "version": "2.33.0",
+  "corpusTag": "v2.33.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "dfecf104a518efca7b9b915578c4198c6a9e1f8965d8e84fc300bbbafc5503e7",
-    "api/v2/asyncapi.yaml": "577bd2252f10d8c3dceaac0dc7855925cc466e06fd6bf1613b8e451869fcdc54",
-    "api/v2/openapi.yaml": "82b884b23460438059a5b38b47b5f3e883d03365013ed8c2632b664417c0f699",
+    "api/seams-v2.yaml": "975b6cd87fa679857df9fcdc60b6a2bed98510b831e82a5eff5a114e3b263f6e",
+    "api/v2/asyncapi.yaml": "96ba13176119bbf54a94bd41d789ebaa919f67c81d529bdc3c66ffb3f419ee36",
+    "api/v2/openapi.yaml": "428ab881d0a8d08d388dd89d4b4457f3454cd0433b665674180d3e85821b978d",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -112,19 +112,19 @@
     "schemas/v2/ai-envelope.schema.json": "0dc7dfbf032a37239ffd81fc2d67f999a40782ff5074866a56e414164cdee809",
     "schemas/v2/annotation-create.schema.json": "ec32c22a243b343eeb6956a23be2d76ba5b50c8018ec3ec9d6efa5a1d9b0c792",
     "schemas/v2/annotation.schema.json": "eb4813cdaa8e325412cfcaeeee5c8a28f3751c946dec64e546c7ba0ad3aad8d4",
-    "schemas/v2/artifact-type-pack-manifest.schema.json": "85630d1b760d0b41cf5a6fad2acfada39abaf7f0befd95cc4334e1e883e9615d",
+    "schemas/v2/artifact-type-pack-manifest.schema.json": "f77d8dcc3112afec8b2a8e67e56752d5811deb2c2455b0d6d4c6489eb4c4a829",
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "e62d44f23c21c8f64b273fcdb083636e801c0de976cbd1f93333f99928dd1025",
     "schemas/v2/certification-bundle.schema.json": "ab9204e37f9e0bba79857275cd38be2da98e54d26b4ecb97469829efe6ebea28",
     "schemas/v2/channel-presence-payload.schema.json": "1c20ad810cb311d47aa0b95d928490826b2468fd161f884cd29e867053e6782f",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
-    "schemas/v2/chat-card-pack-manifest.schema.json": "8df0d9d273ae22efc6876d5586833f1d4c2e551edc3ac6cf6e8f0719329f03dd",
+    "schemas/v2/chat-card-pack-manifest.schema.json": "f7cf09b30d3e1d2251620d84ea9f65541438d015ab44aec10d1dcfe68d8bd496",
     "schemas/v2/compact-tool-descriptor.schema.json": "b5c418d72082d5b713bf318212a83397e5be98e56d25ca056302b41b8dd8273b",
     "schemas/v2/compensation-policy.schema.json": "b3c1142637f5bf980f2b0bb67adb47e8cb7abb99a0405a4b6816ccf5d9c089d6",
     "schemas/v2/compensation-projection.schema.json": "f46977c7076347b5473faa8c4bbe73d8321c33b33c98fff2f26ee7cbada4ed98",
     "schemas/v2/configurable.schema.json": "33a6884047e2490f723733bf8b74d3b9164e00374cfea6dc3eac5a70dc368861",
-    "schemas/v2/connection-pack-manifest.schema.json": "7410a3011b28829b286e3ff764bdb283854dca69ea4b71a8441f8c1c4f1cc948",
+    "schemas/v2/connection-pack-manifest.schema.json": "4300e815cf376959f8250ed25ba0545ae8bd525e449c6442326934f451070cc9",
     "schemas/v2/conversation-event.schema.json": "e87b7fb36ab4ca0afe9f77993654065b28b67e5f24b20175907f90e238942025",
     "schemas/v2/conversation-turn.schema.json": "a15b43dc15dbcc6aaf216bfab7424c540b514d7e40e661a732384aad45387006",
     "schemas/v2/credential-provenance.schema.json": "f86b09e94b1c524dec7d1c6353965665ae8891e9517faef6e742d639c5578c99",
@@ -144,7 +144,7 @@
     "schemas/v2/error-envelope.schema.json": "bb3e6c487dafa951a56ff224a7c029c462f0f1b754a7f51f6729609b4f43a438",
     "schemas/v2/eval-summary.schema.json": "9d31025752d0f67ad3b8a32e82a5314972c530ef9f780dd82e484ae8c5131198",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
-    "schemas/v2/form-content-pack-manifest.schema.json": "461529e4287ec3b15a9fbcde57226a1c6f17ea3ae71b33b418e6f595ff0619fe",
+    "schemas/v2/form-content-pack-manifest.schema.json": "8ec157cf51241d4df800398e811d2c35addd076b929c58be3ce3dcd671c67641",
     "schemas/v2/frontend-plugin-manifest.schema.json": "fed6b8ddb3056c53b1bfc91525410a4445a3c37a8bf9eb9f6f9964ffea26d993",
     "schemas/v2/goal.schema.json": "146c4182e36d3538778f947e668a92cdb69ec42ee0820104b00063b035e342d7",
     "schemas/v2/heartbeat-evaluated.schema.json": "4086b1ba1d0547c08b038dfb263ac89416a3e406430db1250156fb2f9b74f8d6",
@@ -156,12 +156,12 @@
     "schemas/v2/localized-content-section.schema.json": "29c7bad0ad9ebc6c45211282e8afb3fdb35a4ca075ce0404b6e2c29f35fa5313",
     "schemas/v2/memory-entry.schema.json": "290576ae84f4fef4cdf975932b87963283b11c50ea3d2654b32cd96aa6537c3d",
     "schemas/v2/memory-list-options.schema.json": "f66703bccb68efb28391c273abb66aa117ee5b5ce475c477846ed700c336afcd",
-    "schemas/v2/node-pack-manifest.schema.json": "0da826ca63a29026f7a9551748048104910e0d9962db6bad2b50b97a24a9ea30",
+    "schemas/v2/node-pack-manifest.schema.json": "47d122f7d4711eaa13464c5487c26ed36103b7c85adf1987004bf2d6842d663b",
     "schemas/v2/orchestrator-decision.schema.json": "2da17538e84cfbe70151eb118f1ccf670cff58b8697148e394074d32ac4af6b4",
     "schemas/v2/org-chart-responsibility-view.schema.json": "8a2565e4cdc6737a3946a70799f93642808b92f9c8d56dcdff3a0782053b89a1",
     "schemas/v2/pack-lockfile.schema.json": "2685417702c105146b780cd99154296a46578fbb10d81c8c713348ee26fea898",
     "schemas/v2/prompt-kind.schema.json": "67251c937a5a91fb97c0422050e808dc0c162a9b8561366814cf87b0a7f62e00",
-    "schemas/v2/prompt-pack-manifest.schema.json": "8e77d23840250640d26f2f99c1c5902e79bf4a6974cae2d6c6637176236bddb9",
+    "schemas/v2/prompt-pack-manifest.schema.json": "4b1e510341cc6ba167b007ecae38ce0d71d5b89c751671777c5457da926e9744",
     "schemas/v2/prompt-ref.schema.json": "11538fa36a7a652c93100cac4f1857eb4130137b546e3d94890618636d44b729",
     "schemas/v2/prompt-template.schema.json": "494fc83028cb3af5dbb8a943d0e83b2348f7775e9fa02369162bcb58a6f81559",
     "schemas/v2/proposal.schema.json": "cb5ea4fcb54be94fd2a92cf2799357dc73335181a89f5766f432d69e21cc3a80",
@@ -189,7 +189,7 @@
     "schemas/v2/ui-plugin-message.schema.json": "879d65867c01656b3962d64283e66364dcb8f626ad26c5fcf2d2d55a79ae0ce9",
     "schemas/v2/webhook-dead-letter-page.schema.json": "543f5ccc26d8f777684a037172ab7b9fdf70735e5394eeb42e5fa6569503f528",
     "schemas/v2/webhook-delivery.schema.json": "4e8ab3b722ad1731adf0548c1217f0de62da40de14e8abf77533aee4ace4c079",
-    "schemas/v2/workflow-chain-pack-manifest.schema.json": "b61cc945b4df1c7093a1058fa71ee59ef10bacb3433ae4d7ae7536136e616cc2",
+    "schemas/v2/workflow-chain-pack-manifest.schema.json": "58fa5b67c6e3a320f77aa1eb5d5fa7c6c9b3356afe8b75ad74a7cf082496e04b",
     "schemas/v2/workflow-definition.schema.json": "9aafddec32b84eb6aec3185be024850f1b9444c6193568771b0b636595fef136",
     "schemas/v2/workload-identity.schema.json": "1f589debfac6d70e0908da511550ec69a27b4bcc8314551cd843b6d923605efc",
     "schemas/v2/workspace-file-create.schema.json": "b6b5260857318c3b67de0231ed15e3a746f525880a763e7b36a7854178dd10d0",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "0640fb5fdced5af7a5e2ae2108c69da13d79bd3c5373128ee5039e9cd1af0e43",
+    "spec/v1/core-standard-manifest.json": "9f5d065a0a84cf4745f53957f395b1e868453f910531e030f2da4039ee2c9140",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -228,7 +228,7 @@
     "spec/v2/core/interop.md": "6bd581556b9ab1a1509c01b9a1ec2bcb9e4a8300e68fb01570704417e70f20b9",
     "spec/v2/core/interrupt.md": "3a926d84b942d4ee7daccc4443c93dc29f6a69f2936ba813182f2c1336db2cbb",
     "spec/v2/core/overview.md": "7dc00ace32d4e4ce929a383651f0029fc4b7091ec87487b1bf26ead1be209e0e",
-    "spec/v2/core/packs.md": "cc06de2d49dd08410eececd5c279996ec839680553b332b4f33d6b31989b5757",
+    "spec/v2/core/packs.md": "1c0919059760f9a3940a93264a76b7e30f9a0f6f27ff19753cc88f15753d8088",
     "spec/v2/core/persistence.md": "9e241f84259e38848f4a2ad1c21debb0dffd5f8aafbad26408aa6cc8969bf93b",
     "spec/v2/core/replay.md": "b980a66e2543107240e3dc4f58131b9f4ff52478737e79ade6d5777b26ad1119",
     "spec/v2/core/runs.md": "136319842bacbbb300178980e4b83444917d5b193cc5fdd92e39a4902ba8d3c0",
@@ -274,13 +274,13 @@
     "spec/v2/facets/schemaVersions.schema.json": "890d3416c4b66511d51f329abc68e6f467f4338f16807e489fe682999b2b56b9",
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
     "spec/v2/facets/webhooks.schema.json": "4bf3f8eb3161a43910efac4c44ccaf9567060c9da52d4cf09bcf3888d1b92192",
-    "spec/v2/facets/workflowChainPacks.schema.json": "cd30907ac92396866a524e4db8d8c1537e3818cfff455d780efd72bcd0ebdac1",
+    "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
     "spec/v2/id-field-bindings.json": "e73c06f3055ad30173507ac817a458b96362c8f26209ba105c53653292cf63d3",
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "92131d62a7fcd12445d7e04eb588e2297f839b7e5e2a87f89ae9e61593f837cd",
+    "spec/v2/release.json": "94a3ea302324d9f7df87ce62a186b0b98936de6ce5ac5ec01a3fb3208c38efc3",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "691974ccf758a6ea42dad8c38ab6b5570e8f89f2"
+  "corpusCommit": "e9825b0da6ca8e2dbc76353e52aea73a56473393"
 }

package/src/cli.ts

@@ -54,7 +54,8 @@ import {
   PROFILE_FLOOR_SCENARIOS,
 } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
-import { v2ProfileIds } from './lib/v2-profiles.js';
+import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2ProfileIds } from './lib/v2-profiles.js';
+import { childEnv } from './lib/child-env.js';
 
 interface ParsedArgs {
   readonly baseUrl: string | undefined;
@@ -525,7 +526,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
   // (and assertion count) here; the runner reads it after the run so bundle v2
   // rows come from what scenarios RECORDED, not from per-file pass/fail/skip.
   const ledgerFile = join(reportDir, 'requirement-ledger.jsonl');
-  const env: NodeJS.ProcessEnv = { ...process.env };
+  const env: NodeJS.ProcessEnv = childEnv(process.env);
   env.OPENWOP_BASE_URL = baseUrl;
   env.OPENWOP_API_KEY = apiKey;
   env.OPENWOP_LEDGER_PATH = ledgerFile;
@@ -693,7 +694,9 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     // belongs to. Matched the same way the verifier matches it, so the emitter
     // and `verifyBundleV3` cannot disagree about the same bundle.
     const relaxedObligations = new Set((relaxations ?? []).map((r) => r.obligation));
-    const relaxedProfile = (p: string): boolean => [...relaxedObligations].some((o) => p.includes(o));
+    const relaxedProfileIds = profilesRelaxedBy([...relaxedObligations], claimedProfiles);
+    const observedRelaxed = profilesDeniedByObservedRelaxation(rows3, claimedProfiles).profiles;
+    const relaxedProfile = (p: string): boolean => relaxedProfileIds.has(p) || observedRelaxed.has(p);
     const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !relaxedProfile(p) && (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
     const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
     const lock = existsSync(lockPath) ? (JSON.parse(readFileSync(lockPath, 'utf8')) as { version: string; stampSha256: string }) : undefined;
@@ -973,7 +976,7 @@ async function main(): Promise<never> {
 
   // Env vars OVERRIDE flags only when the flag was unset (consistent
   // with the rest of the harness — env wins on the absence of CLI input).
-  const env: NodeJS.ProcessEnv = { ...process.env };
+  const env: NodeJS.ProcessEnv = childEnv(process.env);
   if (args.baseUrl) env.OPENWOP_BASE_URL = args.baseUrl;
   if (args.apiKey) env.OPENWOP_API_KEY = args.apiKey;
   if (args.impl) env.OPENWOP_IMPLEMENTATION_NAME = args.impl;

package/src/lib/a2a-fake-peer.ts

@@ -38,6 +38,7 @@
  * @see https://a2a-protocol.org/v0.3.0/specification
  */
 
+import { resolvePublicFront } from './webhook-receiver.js';
 import { createServer, type Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 
@@ -198,6 +199,18 @@ export class A2AFakePeer {
     return `http://127.0.0.1:${this._boundPort}`;
   }
 
+  /**
+   * The address to hand THE HOST UNDER TEST — `OPENWOP_A2A_FAKE_PEER_URL` when the operator fronts
+   * this peer publicly (https, publicly resolvable; validated loudly, same rule
+   * as the webhook receiver), else `endpoint()`. The suite's own requests to its
+   * own fake keep using `endpoint()`: they need no tunnel and must not depend on
+   * one. Pin the listener with the matching `_PORT` variable so the front has a
+   * fixed port to forward to.
+   */
+  hostFacingEndpoint(): string {
+    return resolvePublicFront('OPENWOP_A2A_FAKE_PEER_URL', this.endpoint()).url;
+  }
+
   reset(): void {
     this._tasks.clear();
     this._invocations.length = 0;
@@ -293,7 +306,7 @@ export class A2AFakePeer {
       description: 'Synthetic A2A peer for openwop conformance suite (dual-era: 1.0 + 0.3-legacy)',
       version: '1.1.0',
       supportedInterfaces: [...this._protocolVersions].sort((a, b) => (a === '1.0' ? -1 : b === '1.0' ? 1 : 0)).map((v) => ({
-        url: `${this.endpoint()}/a2a/jsonrpc`,
+        url: `${this.hostFacingEndpoint()}/a2a/jsonrpc`,
         protocolBinding: 'JSONRPC',
         protocolVersion: v,
       })),
@@ -310,13 +323,13 @@ export class A2AFakePeer {
       protocolVersion: '0.3.0',
       name: 'openwop-conformance-fake-a2a',
       description: 'Synthetic A2A peer for openwop conformance suite',
-      url: `${this.endpoint()}/a2a/jsonrpc`,
+      url: `${this.hostFacingEndpoint()}/a2a/jsonrpc`,
       version: '1.0.0',
       capabilities: { streaming: false, pushNotifications: false },
       skills: [{ id: 'echo', name: 'echo', description: 'Returns input verbatim', tags: ['echo'] }],
       defaultInputModes: ['text'],
       defaultOutputModes: ['text'],
-      additionalInterfaces: [{ url: `${this.endpoint()}/a2a/jsonrpc`, transport: 'JSONRPC' }],
+      additionalInterfaces: [{ url: `${this.hostFacingEndpoint()}/a2a/jsonrpc`, transport: 'JSONRPC' }],
     };
   }
 

package/src/lib/certification-bundle-v3.ts

@@ -19,7 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify, type KeyObject } from 'node:crypto';
 import { profileDerivable, type DiscoveryPayload } from './profiles.js';
-import { v2RegistryAvailable } from './v2-profiles.js';
+import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 
 export type BundleV3Result = 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
 
@@ -179,9 +179,18 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
   }
   // Relaxations: a relaxed obligation's profile cannot certify (RFC 0173 §A.2).
   const relaxed = new Set((bundle.host?.relaxations ?? []).map((r) => r.obligation.split('.')[0]));
+  // Ownership comes from the profile registry, not from the profile's name — see profilesRelaxedBy.
+  const relaxedProfiles = profilesRelaxedBy((bundle.host?.relaxations ?? []).map((r) => r.obligation), (bundle.claimedProfiles ?? []).map((p) => p.id));
+  // An OBSERVED relaxation nobody declared: the bundle's own results show the
+  // host accepting a destination its egress guard MUST refuse. Same denial as a
+  // declared one, so declaring nothing is not a way around the rule.
+  const observed = profilesDeniedByObservedRelaxation(bundle.results?.requirements ?? [], (bundle.claimedProfiles ?? []).map((p) => p.id));
+  for (const p of bundle.claimedProfiles ?? []) {
+    if (p.certified && observed.profiles.has(p.id) && !relaxedProfiles.has(p.id)) rejections.push({ kind: 'undeclared-relaxation-observed', profile: p.id, detail: `${p.id} is marked certified, but this bundle's own results show the host running relaxed on ${observed.obligations.join(', ')} with no host.relaxations[] entry recording it (security-defaults.md §Relaxations: every relaxation a host runs under MUST be recorded, and its profile MUST NOT certify)` });
+  }
   const certifiedProfiles: string[] = [];
   for (const p of bundle.claimedProfiles ?? []) {
-    if (p.certified && relaxed.size > 0 && [...relaxed].some((o) => p.id.includes(o))) rejections.push({ kind: 'relaxed-profile-certified', profile: p.id, detail: `${p.id} is marked certified while a relaxation on ${[...relaxed].join(', ')} is recorded (RFC 0173 §A.2)` });
+    if (p.certified && relaxedProfiles.has(p.id)) rejections.push({ kind: 'relaxed-profile-certified', profile: p.id, detail: `${p.id} is marked certified while a relaxation on ${[...relaxed].join(', ')} is recorded (RFC 0173 §A.2)` });
     else if (p.certified) certifiedProfiles.push(p.id);
   }
   if (expected.blocked > 0 && certifiedProfiles.length > 0) rejections.push({ kind: 'blocked-certified', detail: `${expected.blocked} blocked row(s): a bundle with blocked > 0 does not certify (RFC 0168 §E.1)` });

package/src/lib/child-env.ts

@@ -0,0 +1,29 @@
+/**
+ * The environment handed to the vitest child the CLI spawns.
+ *
+ * `{ ...process.env }` handed the child EVERYTHING the operator exported,
+ * including `OPENWOP_BUNDLE_SIGNING_KEY` — the PKCS8 PEM of the key that signs
+ * the certification bundle. Nothing in the child reads it: the signer runs in
+ * the PARENT, after the run (`cli.ts` `--certify`). It was there only because
+ * nothing took it out.
+ *
+ * Why that is a leak and not a tidiness point. Measured by a host operator
+ * during a production cut (2026-09-20): on macOS `npm exec` rewrites
+ * `process.title`, and a process listing (`ps`, `pgrep -fl`) then spills into
+ * the child's environ — so listing processes mid-cut printed the signing key,
+ * in full, into the operator's terminal and transcript. Same-uid or root only,
+ * but that is exactly who is looking at the terminal. A scenario, a reporter, a
+ * vitest plugin or a crash dump in the child had the same access for no reason.
+ *
+ * The rule: material only the parent uses never enters the child. The key IDS
+ * are not secret and stay (a scenario may legitimately name the key it expects).
+ */
+export const PARENT_ONLY_ENV: readonly string[] = [
+  'OPENWOP_BUNDLE_SIGNING_KEY',
+];
+
+export function childEnv(parent: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { ...parent };
+  for (const name of PARENT_ONLY_ENV) delete env[name];
+  return env;
+}

package/src/lib/mcp-fake-server.ts

@@ -34,6 +34,7 @@
  * @see SECURITY/threat-model-prompt-injection.md §"UNTRUSTED marker"
  */
 
+import { resolvePublicFront } from './webhook-receiver.js';
 import { createServer, type Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 
@@ -149,6 +150,18 @@ export class McpFakeServer {
     return `http://127.0.0.1:${this._boundPort}`;
   }
 
+  /**
+   * The address to hand THE HOST UNDER TEST — `OPENWOP_MCP_FAKE_SERVER_URL` when the operator fronts
+   * this server publicly (https, publicly resolvable; validated loudly, same rule
+   * as the webhook receiver), else `endpoint()`. The suite's own requests to its
+   * own fake keep using `endpoint()`: they need no tunnel and must not depend on
+   * one. Pin the listener with the matching `_PORT` variable so the front has a
+   * fixed port to forward to.
+   */
+  hostFacingEndpoint(): string {
+    return resolvePublicFront('OPENWOP_MCP_FAKE_SERVER_URL', this.endpoint()).url;
+  }
+
   invocations(): readonly McpInvocation[] {
     return this._invocations;
   }

package/src/lib/v2-profiles.ts

@@ -110,3 +110,69 @@ export function v2ProfileIds(doc: DiscoveryPayload): readonly string[] | null {
 export function v2ProfileDerivable(doc: DiscoveryPayload, profile: string): boolean {
   return v2ProfileIds(doc)?.includes(profile) ?? false;
 }
+
+/**
+ * Which of `profileIds` a relaxed obligation denies (RFC 0173 §A.2;
+ * `security-defaults.md` §Relaxations: "a bundle that records a relaxation MUST
+ * NOT certify the profile the relaxed obligation belongs to").
+ *
+ * An obligation is `<family>.<name>`. A profile OWNS a family when its registry
+ * predicate lists it — `openwop-core-standard` is built on `interrupt`, `replay`,
+ * `webhooks`, `idempotency`, `eventLog`, so a relaxation on any of those denies
+ * it. That ownership was always stated in `spec/v2/profiles.json`; nothing read
+ * it. Until 2.33.0 the verifier tested whether the profile ID contained the
+ * family name, and the emitter tested whether it contained the WHOLE obligation
+ * string — two different rules under a comment saying they matched — and since
+ * no real v2 profile id contains a family name, a declared relaxation denied
+ * nothing on any real host. The one scenario pinning the rule used a fixture
+ * profile called `openwop-webhooks`, which is why it stayed green.
+ *
+ * The id-substring rule is KEPT as a second arm, not replaced: it is how a
+ * non-registry profile id (a v1 alias, a fixture) names its family, and
+ * dropping it would un-deny something that is denied today. When the registry
+ * is unavailable only that arm can run; the caller already records that layout
+ * as `derivabilityChecked: false`.
+ *
+ * ONE function, called by the emitter and the verifier, so the file and the
+ * verdict on the file cannot disagree again.
+ */
+export function profilesRelaxedBy(obligations: readonly string[], profileIds: readonly string[]): ReadonlySet<string> {
+  const families = new Set(obligations.map((o) => o.split('.')[0] ?? '').filter((f) => f.length > 0));
+  const out = new Set<string>();
+  if (families.size === 0) return out;
+  const registry = readRegistry();
+  const owned = new Map<string, readonly string[]>();
+  for (const p of registry ?? []) {
+    if (typeof p.id === 'string') owned.set(p.id, Array.isArray(p.predicate?.families) ? (p.predicate.families as unknown[]).map(String) : []);
+  }
+  for (const id of profileIds) {
+    const ownsOne = (owned.get(id) ?? []).some((f) => families.has(f));
+    const namesOne = [...families].some((f) => id.includes(f));
+    if (ownsOne || namesOne) out.add(id);
+  }
+  return out;
+}
+
+/**
+ * The requirement whose FAILURE is an observed, undeclared relaxation.
+ *
+ * `conformance/README.md` said of `OPENWOP_HOST_RELAXATIONS` that "the suite
+ * cannot detect an undeclared one". For the egress guard that was never true:
+ * a host that ACCEPTS `https://127.0.0.1/…` as a webhook destination has shown
+ * on the wire that its guard is open (`webhooks.md`: "a host MUST reject (400
+ * webhook_url_rejected) … RFC 1918 and loopback and link-local ranges").
+ * `v2-webhook-egress-refusal` records that as `executed-fail` on this id unless
+ * the operator DECLARED the relaxation — in which case {@link profilesRelaxedBy}
+ * already denies the profile. Either way a profile built on `webhooks` does not
+ * certify on a host whose guard is open; this closes the path where it did,
+ * silently, because nobody declared anything.
+ */
+export const UNDECLARED_RELAXATION_WITNESSES: ReadonlyArray<{ readonly requirementId: string; readonly obligation: string }> = [
+  { requirementId: 'openwop.requirement.0171.webhook-egress-refused', obligation: 'webhooks.egress-guard' },
+];
+
+/** Profiles that MUST NOT certify because a row above is `executed-fail` in this bundle's own results. */
+export function profilesDeniedByObservedRelaxation(rows: ReadonlyArray<{ readonly id: string; readonly result: string }>, profileIds: readonly string[]): { readonly profiles: ReadonlySet<string>; readonly obligations: readonly string[] } {
+  const obligations = UNDECLARED_RELAXATION_WITNESSES.filter((w) => rows.some((r) => r.id === w.requirementId && r.result === 'executed-fail')).map((w) => w.obligation);
+  return { profiles: profilesRelaxedBy(obligations, profileIds), obligations };
+}

package/src/lib/webhook-receiver.ts

@@ -235,7 +235,26 @@ export async function discoverOwnedTenant(
  * "the host could not be exercised".
  */
 export function resolveRegistrationUrl(localUrl: string): { url: string; tunnelled: boolean } {
-  const raw = process.env.OPENWOP_WEBHOOK_RECEIVER_URL?.trim();
+  return resolvePublicFront('OPENWOP_WEBHOOK_RECEIVER_URL', localUrl);
+}
+
+/**
+ * The same rule, for ANY suite fixture the host under test must reach — the
+ * webhook receiver, the A2A fake peer, the MCP fake server. `envName` names the
+ * operator's public front for that one fixture; unset means the local address.
+ *
+ * Generalised in 2.33.0. Until then only the webhook receiver had a front, so a
+ * host that advertised `a2a` or `mcp` could be measured ONLY with its egress
+ * guard relaxed — those fakes advertised `http://127.0.0.1:<port>` and nothing
+ * else — and a relaxed guard is a relaxation the bundle must declare and cannot
+ * certify under (`security-defaults.md` §Relaxations). The two production hosts
+ * cut relaxation-free only because they advertise neither family. The rule made
+ * a host that implements MORE of the protocol LESS able to certify; found when
+ * the steward's own reference host turned out to be certifying under an
+ * undeclared one.
+ */
+export function resolvePublicFront(envName: string, localUrl: string): { url: string; tunnelled: boolean } {
+  const raw = process.env[envName]?.trim();
   if (!raw) return { url: localUrl, tunnelled: false };
 
   let parsed: URL;
@@ -243,7 +262,7 @@ export function resolveRegistrationUrl(localUrl: string): { url: string; tunnell
     parsed = new URL(raw);
   } catch {
     throw new Error(
-      `OPENWOP_WEBHOOK_RECEIVER_URL is not a valid URL: ${JSON.stringify(raw)}`,
+      `${envName} is not a valid URL: ${JSON.stringify(raw)}`,
     );
   }
 
@@ -252,7 +271,7 @@ export function resolveRegistrationUrl(localUrl: string): { url: string; tunnell
   // ALLOW_PRIVATE flag insufficient in the first place.
   if (parsed.protocol !== 'https:') {
     throw new Error(
-      `OPENWOP_WEBHOOK_RECEIVER_URL MUST be https: (got ${parsed.protocol}). ` +
+      `${envName} MUST be https: (got ${parsed.protocol}). ` +
         'A plain-http front cannot clear the scheme gate, so it cannot witness this scenario.',
     );
   }
@@ -272,13 +291,13 @@ export function resolveRegistrationUrl(localUrl: string): { url: string; tunnell
     /^(fc|fd)/.test(host);
   if (isLoopback || isPrivate) {
     throw new Error(
-      `OPENWOP_WEBHOOK_RECEIVER_URL MUST be a publicly-resolvable host (got ${parsed.hostname}). ` +
+      `${envName} MUST be a publicly-resolvable host (got ${parsed.hostname}). ` +
         'It is the PUBLIC front for the local receiver — a tunnel or TLS-terminating proxy — ' +
         'not the receiver address itself.',
     );
   }
 
-  return { url: raw, tunnelled: true };
+  return { url: envName === 'OPENWOP_WEBHOOK_RECEIVER_URL' ? raw : raw.replace(/\/+$/, ''), tunnelled: true };
 }
 
 /**

package/src/scenarios/a2a-1-0-agent-card.test.ts

@@ -62,7 +62,7 @@ describe('RFC 0152 — the suite peer speaks A2A 1.0 (dual-era A2AFakePeer)', ()
     expect(ifaces.map((i) => i.protocolVersion)).toEqual(['1.0', '0.3']);
     for (const i of ifaces) {
       expect(i.protocolBinding).toBe('JSONRPC');
-      expect(i.url.startsWith(peer.endpoint())).toBe(true);
+      expect(i.url.startsWith(peer.hostFacingEndpoint())).toBe(true);
     }
     expect(card['url'], req('openwop.it.a2a-1-0-agent-card.the-agent-card-is-1-0-shaped-supportedinterfaces-no-top-level-url-protocolversio', 'RFC 0152 §A/§B/§C/§D', '1.0 removed top-level url')).toBeUndefined();
     expect(card['protocolVersion'], req('openwop.it.a2a-1-0-agent-card.the-agent-card-is-1-0-shaped-supportedinterfaces-no-top-level-url-protocolversio', 'RFC 0152 §A/§B/§C/§D', '1.0 removed top-level protocolVersion (it is per interface)')).toBeUndefined();

package/src/scenarios/a2a-peer-authority.test.ts

@@ -64,7 +64,7 @@ describe('RFC 0152 §E — a2a-peer-no-authority-escalation (host as A2A client,
     peer.reset();
     peer.setNextPeerAssertsAuthority(true);
     const drive = await driver.post('/v1/host/sample/a2a/invoke', {
-      peerUrl: peer.endpoint(),
+      peerUrl: peer.hostFacingEndpoint(),
       scenario: 'peer-asserts-authority',
     });
     if (drive.status === 404 || drive.status === 403) {

package/src/scenarios/a2a-task-roundtrip.test.ts

@@ -66,7 +66,7 @@ function probePeer(): { url: string; isReal: boolean } | null {
   const real = process.env.OPENWOP_A2A_REAL_PEER_URL;
   if (real && real.length > 0) return { url: real.replace(/\/$/, ''), isReal: true };
   const fake = getA2AFakePeer();
-  if (fake) return { url: fake.endpoint(), isReal: false };
+  if (fake) return { url: fake.hostFacingEndpoint(), isReal: false };
   return null;
 }
 

package/src/scenarios/a2a-version-negotiation.test.ts

@@ -78,7 +78,7 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     const peer = getA2AFakePeer();
     if (peer === null) return softSkip('blocked', 'precondition not met — `peer === null` returned early (no fake peer wired in this run) (seam, prior step, or fixture unavailable)'); // no fake peer wired in this run
     peer.reset();
-    const drive = await driver.post('/v1/host/sample/a2a/invoke', { peerUrl: peer.endpoint() });
+    const drive = await driver.post('/v1/host/sample/a2a/invoke', { peerUrl: peer.hostFacingEndpoint() });
     if (drive.status === 404 || drive.status === 403) {
       // Seam absent. RFC 0148 §A: unobservable resolves to `blocked`, not a pass.
       expect(
@@ -114,7 +114,7 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     const preferred = caps?.preferredVersion;
     peer.reset();
     const drive = await driver.post('/v1/host/sample/a2a/invoke', {
-      peerUrl: peer.endpoint(),
+      peerUrl: peer.hostFacingEndpoint(),
       authenticated: true,
       peerOffersOnly: '0.3',
     });
@@ -151,7 +151,7 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     const peer = getA2AFakePeer();
     if (peer === null) return softSkip('blocked', 'precondition not met — `peer === null` returned early (seam, prior step, or fixture unavailable)');
     const drive = await driver.post('/v1/host/sample/a2a/invoke', {
-      peerUrl: peer.endpoint(),
+      peerUrl: peer.hostFacingEndpoint(),
       requestVersion: '99.0',
     });
     if (drive.status === 404 || drive.status === 403) return softSkip('blocked', 'precondition not met — `drive.status === 404 || drive.status === 403` returned early (seam, prior step, or fixture unavailable)');

package/src/scenarios/mcp-extension-opacity.test.ts

@@ -47,7 +47,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §D — mcp-extension-o
     if (server === null) return softSkip('blocked', 'the suite MCP fake server is not started in this run — the host-as-client leg cannot be driven');
     server.reset();
     server.setNextResultAssertsAuthority(true);
-    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint(), tool: 'echo', arguments: { text: 'opaque' }, scenario: 'extension-asserts-authority' });
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.hostFacingEndpoint(), tool: 'echo', arguments: { text: 'opaque' }, scenario: 'extension-asserts-authority' });
     if (drive.status === 404 || drive.status === 403) {
       // Advertised mcp-2026-07-28 but the invoke seam answered {drive.status}: not observable here.
       // Default mode records `blocked` (RFC 0148 §A); OPENWOP_REQUIRE_BEHAVIOR=true fails

package/src/scenarios/mcp-mrtr-roundtrip.test.ts

@@ -58,7 +58,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §C — mcp-mrtr-roundt
     if (server === null) return softSkip('blocked', 'the suite MCP fake server is not started in this run — the client half cannot be driven');
     server.reset();
     const drive = await driver.post('/v1/host/sample/mcp/invoke', {
-      serverUrl: server.endpoint(),
+      serverUrl: server.hostFacingEndpoint(),
       tool: 'needs_input',
       clientCapabilities: { elicitation: {} },
       elicitationAnswer: { name: 'Ada' },

package/src/scenarios/mcp-tool-roundtrip.test.ts

@@ -179,7 +179,7 @@ function probeEndpoint(): { url: string; isReal: boolean } | null {
   const real = process.env.OPENWOP_MCP_REAL_SERVER_URL;
   if (real && real.length > 0) return { url: real.replace(/\/$/, ''), isReal: true };
   const fake = getMcpFakeServer();
-  if (fake) return { url: fake.endpoint(), isReal: false };
+  if (fake) return { url: fake.hostFacingEndpoint(), isReal: false };
   return null;
 }
 

package/src/scenarios/mcp-version-negotiation.test.ts

@@ -86,7 +86,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
     const server = getMcpFakeServer();
     if (server === null) return softSkip('blocked', 'precondition not met — `server === null` returned early (seam, prior step, or fixture unavailable)');
     server.reset();
-    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint() });
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.hostFacingEndpoint() });
     if (drive.status === 404 || drive.status === 403) {
       expect(
         drive.status,
@@ -125,7 +125,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
     if (server === null) return softSkip('blocked', 'precondition not met — `server === null` returned early (seam, prior step, or fixture unavailable)');
     const caps = await mcp();
     server.reset();
-    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint() });
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.hostFacingEndpoint() });
     if (drive.status === 404 || drive.status === 403) return seamAbsent(`host advertises mcp version negotiation but the invoke seam /v1/host/sample/mcp/invoke answered ${drive.status} — the host-as-client legs are unobservable (host-sample-test-seams.md)`);
     // it never advertised has made its own discovery document unreliable, which
     // is worse than advertising nothing — a consumer that read it made a
@@ -148,7 +148,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
     const server = getMcpFakeServer();
     if (server === null) return softSkip('blocked', 'precondition not met — `server === null` returned early (seam, prior step, or fixture unavailable)');
     const drive = await driver.post('/v1/host/sample/mcp/invoke', {
-      serverUrl: server.endpoint(),
+      serverUrl: server.hostFacingEndpoint(),
       requestVersion: '1999-01-01',
     });
     if (drive.status === 404 || drive.status === 403) return seamAbsent(`host advertises mcp version negotiation but the invoke seam /v1/host/sample/mcp/invoke answered ${drive.status} — the host-as-client legs are unobservable (host-sample-test-seams.md)`);