@openwop/openwop-conformance 2.32.0 → 2.33.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.33.0] — 2026-09-21 — a declared relaxation denied nothing, an undeclared one was invisible, and two fakes made both unavoidable
+
+Step 2 of closing `docs/KNOWN-LIMITS.md` §"The reference host's certified bundles were cut under an undeclared relaxation". Three suite defects, all the corpus's.
+
+- **A host advertising `a2a` or `mcp` could not be cut relaxation-free.** The A2A fake peer and MCP fake server advertised `http://127.0.0.1:<port>` and nothing else; only the webhook receiver had a public front. So such a host could be measured ONLY with its egress guard relaxed, and a relaxed guard cannot certify — the rule made a host implementing *more* of the protocol *less* able to certify. The two production hosts cut cleanly only because they advertise neither family. New `OPENWOP_A2A_FAKE_PEER_URL` / `OPENWOP_MCP_FAKE_SERVER_URL`, validated by the same rule as `OPENWOP_WEBHOOK_RECEIVER_URL` (now `resolvePublicFront(envName, …)`; `resolveRegistrationUrl` is a wrapper). `hostFacingEndpoint()` is what is handed to the host — every invoke seam's `peerUrl` / `serverUrl`, and the AgentCard's `url` fields — while the suite's own requests to its own fake keep using the loopback `endpoint()`. Twelve scenario files updated.
+- **A DECLARED relaxation denied nothing on any real host.** `verifyBundleV3` matched a relaxed obligation to a profile by testing whether the profile **id** contained the family name; the emitter tested whether it contained the **whole obligation string** — two different rules under a comment saying they matched. No real v2 profile id contains a family name, so `webhooks.egress-guard` denied neither `openwop-core-standard` nor anything else. `v2-relaxation-recorded` stayed green because its fixture profile was called `openwop-webhooks`, the one id the rule could match. New `profilesRelaxedBy()` in `lib/v2-profiles.ts` reads ownership from where it was always stated — a profile's `predicate.families` in `spec/v2/profiles.json` — and is the ONE function both the emitter and the verifier call. The id-named arm is kept, so nothing denied today is un-denied. New leg `openwop.requirement.0173.relaxation-recorded.owned-by-registry` asserts against the real `openwop-core-standard`. **Sabotage-proven: restoring the old rule leaves the old leg green and reddens only the new one** — which is the blindness, reproduced.
+- **NEW `v2-webhook-egress-refusal.test.ts` — the egress guard's refusal, at major 2, for the first time.** `webhooks.md` §SSRF is a plain MUST with a registered code, and no major-2 row asserted it: `http-client-ssrf` and `webhook-negative` never left the major-1 lane, so a v2 bundle could certify `openwop-core-standard` on a host whose guard refused nothing. Eight registration probes, one per class the sentence names (non-`https`, IPv4 and IPv6 loopback, `localhost`, two RFC 1918 ranges, link-local / cloud metadata, IPv6 ULA); each MUST answer `400 webhook_url_rejected`. Registration-time only — no probe is a destination the suite owns, nothing is delivered, an accepted registration is deleted at once. New id `openwop.requirement.0171.webhook-egress-refused`.
+- **An UNDECLARED relaxation is now detectable, and denied.** This README said the suite "cannot detect an undeclared one". For the egress guard that was never true: a host that accepts `https://127.0.0.1/…` has shown on the wire that its guard is open. Three outcomes — all refused → `executed-pass`; accepted with a `webhooks.*` relaxation DECLARED → `inapplicable`, the declaration quoted, the owning profile denied by the declaration; accepted with NOTHING declared → `executed-fail`, which `profilesDeniedByObservedRelaxation()` turns into a denial of every profile built on `webhooks` in both the emitter (`certified: false`) and `--verify` (new rejection `undeclared-relaxation-observed`, scoped to the profile). Declaring nothing is no longer a way around the rule.
+- **Measured on the v2 reference host in all three postures:** guarded → pass (8/8 refused, right code); `OPENWOP_WEBHOOK_ALLOW_PRIVATE=1` with nothing declared → **fail, "ACCEPTED 8 of 8"** — that flag opens the scheme check and the metadata address too, not only loopback; same flag with the relaxation declared → `inapplicable`. The first attempt at that measurement reported pass/pass/pass, because the harness had not killed the first host and all three runs hit the guarded one; it now refuses to measure while the port is held.
+- `coverage.md`: new row; and the `v2-durability-recovery` row is corrected — it still said `duplicate-delivery` was "counted per effect identity" and that the log was read from `/events`, both wrong since 2.32.0.
+- **Expect this release to un-certify a loopback cut.** That is its purpose. A host cut through public fronts (both production hosts) is unaffected.
+- Suite pinned to corpus `2.33.0`.
+
 ## [2.32.0] — 2026-09-20 — every published v2 pack failed the corpus schema, and two kill rows that mandated a fast bound
 
 - **`v2-one-signing-scheme` now covers every bare `*-pack-manifest`, enumerated rather than listed** (openwop#1367). It pinned one file — `registry-version-manifest` — while six bare manifests kept the v1 `{ publicKeyRef, signatureRef, method }` block, closed, and `connection-pack-manifest` had no `signing` seat at all. Measured against the published v2 registry: **0 of 190** `pack.json` documents validated. New id `openwop.requirement.0177.one-signing-scheme.bare-manifests`. Sabotage-proven: fails on the 2.31.1 `node-pack-manifest`.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.32.0 @openwop/spec-artifacts@2.32.0
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.33.0 @openwop/spec-artifacts@2.33.0
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -99,7 +99,7 @@ Run `npm run test` for normal CI cadence; `npm run test:strict` when claiming fu
 
 | Variable                                  | Effect                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `OPENWOP_HOST_RELAXATIONS`                | Sets `host.relaxations[]` in the bundle. **It relaxes nothing in the suite** — it is your declaration that the HOST runs relaxed, and the suite cannot detect an undeclared one. A profile carrying a relaxation **cannot certify** (`security-defaults.md` §Relaxations, RFC 0173 §A.2), and since 2.6.0 the emitter enforces that rather than writing `certified: true` and leaving the contradiction to `--verify`. JSON array of `{obligation, durability, reason}`; `durability` is `session \| deployment \| persisted` — **not** `permanent`. Unparseable JSON exits 2; a wrong enum value exits 2 later, at schema validation. |
+| `OPENWOP_HOST_RELAXATIONS`                | Sets `host.relaxations[]` in the bundle. **It relaxes nothing in the suite** — it is your declaration that the HOST runs relaxed, and the suite cannot detect an undeclared one **in general**. It can detect ONE: since 2.33.0 `v2-webhook-egress-refusal` registers eight destinations `webhooks.md` §SSRF says a host MUST refuse, and a host that accepts one with no `webhooks.*` relaxation declared here records `executed-fail` — which the emitter and `--verify` read as an observed undeclared relaxation, denying every profile built on `webhooks`. An obligation is `<family>.<name>`; it denies each profile whose `spec/v2/profiles.json` predicate lists that family (so `webhooks.egress-guard` denies `openwop-core-standard`). Until 2.33.0 the match was on the profile *id*, which contains no family name, so a declared relaxation denied nothing on any real host. A profile carrying a relaxation **cannot certify** (`security-defaults.md` §Relaxations, RFC 0173 §A.2), and since 2.6.0 the emitter enforces that rather than writing `certified: true` and leaving the contradiction to `--verify`. JSON array of `{obligation, durability, reason}`; `durability` is `session \| deployment \| persisted` — **not** `permanent`. Unparseable JSON exits 2; a wrong enum value exits 2 later, at schema validation. |
 | `OPENWOP_TARGET_MAJOR`                    | Selects the scenario lane. **Only the literal `"2"` selects major 2** — unlike `--target-major`, which validates and exits 2 on a bad value, the env var falls back to major 1 for `"1"`, `"3"`, `"two"` or empty. The runner and every vitest worker MUST see the same value: when they disagreed, the worker minted `openwop.floor.*` while the runner looked up `openwop.scenario.*`, producing a vacuous-pass emitter defect and **no bundle at all**. Prefer `--target-major`; set this only when driving `vitest` directly. |
 | `OPENWOP_REQUIRE_BEHAVIOR=true`           | Capability-gated scenarios (audit-log integrity, rate-limit envelope, multi-region idempotency, `configurableSchema`, webhook sig versioning, etc.) FAIL instead of skipping when the host doesn't advertise the profile. Lets a host claim "full coverage" mechanically. See [`coverage.md`](./coverage.md) §"Capability-gated scenarios".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `OPENWOP_TEST_PUBLIC_REGISTRY=true`       | Runs `registry-public.test.ts` against the hosted registry at `packs.openwop.dev`. Skipped by default so the suite doesn't depend on outbound connectivity.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
@@ -113,6 +113,7 @@ Run `npm run test` for normal CI cadence; `npm run test:strict` when claiming fu
 | `OPENWOP_MCP_FAKE_SERVER=true`            | Boots the synthetic MCP peer for `mcp-tool-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `OPENWOP_MCP_REAL_SERVER_URL=<base-url>`  | Points the MCP wire-shape probe at a real MCP server. The probe POSTs JSON-RPC and reads a single-JSON response — matches MCP's `streamable-http` transport in single-response mode. **Does NOT support** stdio transport (which is what most `modelcontextprotocol/servers` references default to) or SSE-streamed responses; an operator collecting interop evidence today runs a custom `StreamableHTTPServerTransport`-style server that returns a single JSON body per request. Adding SSE-frame parsing is tracked in `docs/PROTOCOL-GAP-CLOSURE-PLAN.md` Track 6. Assertions relax to shape-only. When both this and `OPENWOP_MCP_FAKE_SERVER` are set, the real URL wins. Phase 3 T3.4 interop-evidence path.                                                                                                               |
 | `OPENWOP_A2A_FAKE_PEER=true`              | Boots the synthetic A2A peer for `a2a-task-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `OPENWOP_A2A_FAKE_PEER_URL=<https-url>` / `OPENWOP_MCP_FAKE_SERVER_URL=<https-url>` | **The public front for each fake — the route to an A2A / MCP witness that relaxes nothing** (2.33.0). Same rule and the same loud validation as `OPENWOP_WEBHOOK_RECEIVER_URL`: `https:`, publicly resolvable. The fake still LISTENS on loopback; pin it with the matching `_PORT` so the tunnel has a fixed port to forward to. When set, the URL handed to the host under test — the `peerUrl` / `serverUrl` of every invoke seam, and the `url` fields of the A2A AgentCard — is the front; the suite's own requests to its own fake stay local. Until 2.33.0 neither fake had a front, so a host advertising `a2a` or `mcp` could be measured ONLY with its egress guard relaxed, and a relaxed guard cannot certify: the rule made a host implementing more of the protocol less able to certify. |
 | `OPENWOP_A2A_REAL_PEER_URL=<base-url>`    | Points the A2A AgentCard + task-lifecycle probe at a real reference A2A peer. Drift-point subtests (AUTH_REQUIRED / REJECTED) stay fake-peer-only — real peers don't expose a state-forcing API. Phase 3 T3.4 interop-evidence path.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `OPENWOP_FORCE_RATE_LIMIT=true`           | Signals the host (test-only key) to fabricate a 429 so `rate-limit-envelope.test.ts` can exercise envelope shape deterministically.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `OPENWOP_TEST_PROMPT_PACK_INSTALLED=true` | Promotes the `prompt-pack-install.test.ts` existence claim from soft-skip to hard assertion (RFC 0028 §B). Set when the target host is known to have at least one prompt pack installed at boot — RFC 0028 §B does NOT require any host with `endpointsSupported: true` to have packs installed, so the suite stays conformant against a fresh production host with no pack subscriptions when the flag is unset. The in-tree workflow-engine sample auto-installs `vendor.openwop.prompt-sample` via `promptPackLoader.ts`, so operators running against it should set the flag.                                                                                                                                                                                                                                                   |
@@ -132,7 +133,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 523 scenario files under `src/scenarios/`.
+The current suite has 524 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -477,7 +478,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 523 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 524 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/coverage.md

@@ -144,7 +144,8 @@ The scenario groups in the table below (one row per group; count the rows — th
 | `tool-session-lifecycle.test.ts`                                                                                                                                                                                                                        | `capabilities.toolCatalog.sessionLifecycle` (RFC 0078 §D, `tool-catalog.md`)                                                                                                                                                                                                                                            | A (the §D bracket via `POST /v1/host/sample/tools/session-run` + the test event-log seam: `tool.session.opened` before the first RFC 0064 call event → `tool.session.closed` after the last, one shared `sessionId`, each carrying a `toolId`, `closed.outcome` ∈ {completed,failed,aborted,expired}, both content-free)                                                                                                                                                                                                                                                                                                                                                                            | `host-pending`                                                                                                                   | `behaviorGate('openwop-tool-session-lifecycle', …)`. Seam-gated; soft-skips on 404. **Part of the RFC 0078 → Accepted bar.** First adopter: MyndHyve `toolCatalog`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `egress-audience-binding.test.ts`                                                                                                                                                                                                                       | `capabilities.httpClient.egressPolicy.supported` (RFC 0079 §C, `host-capabilities.md`) + `SECURITY/invariants.yaml` `egress-credential-audience-bound`                                                                                                                                                                  | A (KEYSTONE — the §C confused-deputy MUST via `POST /v1/host/sample/egress/decide`: an out-of-audience egress is `denied`/`downgraded` with `reason:"out-of-audience"` and the credential is NOT attached (`credentialAttached !== true`); a provenance-unevaluable egress fails closed `denied`+`reason:"provenance-unevaluable"`; decision/reason ∈ the closed enums)                                                                                                                                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-egress-audience-binding', …)`. Seam-gated; soft-skips on 404. **This is the RFC 0079 → Accepted bar** (the `egress-credential-audience-bound` invariant graduates reference-impl → protocol tier when this passes against a host). First adopter: MyndHyve `httpClient.egressPolicy`.                                                                                                                                                                                                                                                                                                                            |
 | `egress-decision-content-free.test.ts`                                                                                                                                                                                                                  | `capabilities.httpClient.egressPolicy.supported` (RFC 0079 §F / SR-1)                                                                                                                                                                                                                                                   | A (the secret non-leak — a `canary` credential's sentinel never surfaces in the decision (`canaryLeaked !== true`), the `egress.decided` payload carries no forbidden content key, and `reason` stays in the CLOSED vocabulary so no blocked destination spills into a free-form field)                                                                                                                                                                                                                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-egress-decision-content-free', …)`. Seam-gated; soft-skips on 404. **Part of the RFC 0079 → Accepted bar.** First adopter: MyndHyve `httpClient.egressPolicy`.                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| `v2-durability-recovery.test.ts` | the RFC 0158 host-extension durability seam `POST /host/durability/kill` (non-normative; §E mints no capability field, so seam PRESENCE is how a host says it claims a rung) | A (all five `durable-single-instance` rows: `kill-after-accept` as a HOLD-DISPATCH exercise, `kill-during-execution` asserting that work executing at a real process death is never observable as completed without re-execution, `duplicate-delivery` counted PER EFFECT IDENTITY rather than by end state, `bound-is-derived` as an explicitly-labelled paper check, and `poison-exhaustion` ported from the major-1 scenario — at major 2 it reads the canonical `GET /runs/{runId}/events`, so unlike its v1 twin it needs NO seam and can never record `blocked` for want of one a host did not wire) | `host-pending` | **Disposition rule, and it protects fleet certification:** no seam route at all ⇒ `inapplicable` (the host claims no rung); seam present but an operator precondition unmet — a restart supervisor, which a black-box suite cannot supply — ⇒ `blocked` with the precondition NAMED. Collapsing the two would deny certification to every host the day these rows entered the lane. `peer-resume` is deliberately NOT written: §E makes it bundle-witnessed, so a scenario could only ever record `blocked`. **This is the RFC 0158 → Accepted bar, and it is now complete at major 2** — before the port, a major-2 bundle could carry at most four of the five rows and the rung was unwitnessable no matter what a host did, and its witness is openwop-app, which the RFC records as having observed `kill-during-execution` across a real `SIGKILL`. |
+| `v2-webhook-egress-refusal.test.ts` | the `webhooks` family (capability-gated) | A (`webhooks.md` §SSRF at MAJOR 2 — eight registration probes, one per class the sentence names: non-`https`, IPv4/IPv6 loopback, `localhost`, two RFC 1918 ranges, link-local / cloud metadata, IPv6 ULA; each MUST answer `400 webhook_url_rejected`. Until 2.33.0 no major-2 row asserted the guard refuses anything — the refusal scenarios were major-1 only. THREE OUTCOMES: all refused → `executed-pass`; a probe accepted with a `webhooks.*` relaxation DECLARED in `OPENWOP_HOST_RELAXATIONS` → `inapplicable`, and the declared relaxation denies the owning profile; a probe accepted with NOTHING declared → `executed-fail`, which the emitter and verifier read as an OBSERVED undeclared relaxation and deny every profile built on `webhooks` (`undeclared-relaxation-observed`). Registration-time only: no probe is a destination the suite owns, nothing is delivered, an accepted registration is deleted at once) |
+| `v2-durability-recovery.test.ts` | the RFC 0158 host-extension durability seam `POST /host/durability/kill` (non-normative; §E mints no capability field, so seam PRESENCE is how a host says it claims a rung) | A (all five `durable-single-instance` rows: `kill-after-accept` as a HOLD-DISPATCH exercise, `kill-during-execution` asserting that work executing at a real process death is never observable as completed without re-execution, `duplicate-delivery` counted AT THE EFFECT'S DESTINATION — a receiver the suite owns, `effectUrl` — because a ledger keyed on effect identity admits one row per identity by construction and cannot show a double-fire (2.32.0), `bound-is-derived` as an explicitly-labelled paper check, and `poison-exhaustion` ported from the major-1 scenario — at major 2 it reads the canonical JSON log read `GET /runs/{runId}/events/poll` (NOT `/events`, which is SSE-only at major 2 — reading it as JSON made this row pass vacuously on a host serving exactly the OpenAPI; 2.32.0), so unlike its v1 twin it needs NO seam and can never record `blocked` for want of one a host did not wire) | `host-pending` | **Disposition rule, and it protects fleet certification:** no seam route at all ⇒ `inapplicable` (the host claims no rung); seam present but an operator precondition unmet — a restart supervisor, which a black-box suite cannot supply — ⇒ `blocked` with the precondition NAMED. Collapsing the two would deny certification to every host the day these rows entered the lane. `peer-resume` is deliberately NOT written: §E makes it bundle-witnessed, so a scenario could only ever record `blocked`. **This is the RFC 0158 → Accepted bar, and it is now complete at major 2** — before the port, a major-2 bundle could carry at most four of the five rows and the rung was unwitnessable no matter what a host did, and its witness is openwop-app, which the RFC records as having observed `kill-during-execution` across a real `SIGKILL`. |
 | `memory-degraded-projection.test.ts`                                                                                                                                                                                                                    | `capabilities.agents.manifestRuntime.supported` + `capabilities.memory.supported` (RFC 0080 §C, `agent-memory.md`)                                                                                                                                                                                                      | A (the §C iff-contract on the NORMATIVE `GET /v1/agents`: a degraded entry MUST carry `memoryDegraded:true` + a non-empty, unique `degradedMemoryDimensions[]` drawn from the closed §A-name enum [read/write/search/long-term-durability/compaction/attribution/replay-snapshot/retention]; a non-degraded entry MUST NOT carry a non-empty list; the inventory is non-empty; the degraded branch runs non-vacuously when `OPENWOP_DEGRADED_AGENT_ID` names a known-degraded agent)                                                                                                                                                                                                                | `host-pending`                                                                                                                   | `behaviorGate('openwop-memory-degraded', …)`. Black-box on the normative path (no POST seam); soft-skips on 404 / when the host computes no degradation. **This is the RFC 0080 → Accepted bar.** First adopter: MyndHyve `memory`.                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `budget-enforcement.test.ts`                                                                                                                                                                                                                            | `capabilities.budget.supported` (RFC 0084 §C/§D, `budget-policy.md`) + `SECURITY/invariants.yaml` `budget-no-pricing-leak`                                                                                                                                                                                              | A (the §C/§D enforcement via `POST /v1/host/sample/budget/run` + the test event-log seam: a `hard-cost-exhaust` run emits the strict-ordered `budget.reserved → budget.consumed → budget.threshold.crossed{percent} → budget.exhausted → cap.breached{kind:"budget-cost"} → run.failed{error:"budget_exhausted"}` chain; a `model-denied` run is refused `budget_model_denied` BEFORE the provider call (fail-closed); an `advisory` host emits the `budget.*` events without stopping; every `budget.*` payload content-free — no pricing/rate)                                                                                                                                                    | `host-pending`                                                                                                                   | `behaviorGate('openwop-budget-enforcement', …)`. Seam-gated; soft-skips on 404. **This is the RFC 0084 → Accepted bar.** First adopter: MyndHyve `budget`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `agent-platform-aggregate-evidence.test.ts`                                                                                                                                                                                                             | `openwop-agent-platform` claim — live discovery `profiles[]` includes it (RFC 0085 §C, `agent-platform-profile.md`)                                                                                                                                                                                                     | A (the §C/§D honest-advertisement on live `/.well-known/openwop`: a host claiming `openwop-agent-platform` MUST satisfy the §B floor predicate (`isAgentPlatformPartial` → `partial`/`full`, never `none`), the claim backed by per-capability evidence not the profile string; `OPENWOP_AGENT_PLATFORM_TIER=full` forces the full-predicate bar — all governance terms + tenant installScope + all 16 §D terms)                                                                                                                                                                                                                                                                                    | `host-pending`                                                                                                                   | `behaviorGate('openwop-agent-platform', …)`. Black-box on the discovery doc (no POST seam); soft-skips until a host claims the profile. **This is the RFC 0085 → Accepted bar.** First adopter: MyndHyve (after the memory batch surfaces the floor's `memory.supported`).                                                                                                                                                                                                                                                                                                                                                              |

package/dist/cli.js

@@ -46,7 +46,7 @@ import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/cer
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
 import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
-import { v2ProfileIds } from './lib/v2-profiles.js';
+import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2ProfileIds } from './lib/v2-profiles.js';
 import { childEnv } from './lib/child-env.js';
 function parseArgs(argv) {
     let baseUrl;
@@ -665,7 +665,9 @@ async function runCertify(args, baseUrl, apiKey) {
         // belongs to. Matched the same way the verifier matches it, so the emitter
         // and `verifyBundleV3` cannot disagree about the same bundle.
         const relaxedObligations = new Set((relaxations ?? []).map((r) => r.obligation));
-        const relaxedProfile = (p) => [...relaxedObligations].some((o) => p.includes(o));
+        const relaxedProfileIds = profilesRelaxedBy([...relaxedObligations], claimedProfiles);
+        const observedRelaxed = profilesDeniedByObservedRelaxation(rows3, claimedProfiles).profiles;
+        const relaxedProfile = (p) => relaxedProfileIds.has(p) || observedRelaxed.has(p);
         const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !relaxedProfile(p) && (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
         const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
         const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')) : undefined;

package/dist/lib/certification-bundle-v3.js

@@ -19,7 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from 'node:crypto';
 import { profileDerivable } from './profiles.js';
-import { v2RegistryAvailable } from './v2-profiles.js';
+import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 export const SIGNATURE_OVER = ['witnessSha256', 'host.build', 'suite.version', 'discovery.sha256'];
 /** Deterministic JSON: keys sorted at every level, no whitespace. */
 export function canonicalJSON(value) {
@@ -118,9 +118,19 @@ export function verifyBundleV3(bundle, opts = {}) {
     }
     // Relaxations: a relaxed obligation's profile cannot certify (RFC 0173 §A.2).
     const relaxed = new Set((bundle.host?.relaxations ?? []).map((r) => r.obligation.split('.')[0]));
+    // Ownership comes from the profile registry, not from the profile's name — see profilesRelaxedBy.
+    const relaxedProfiles = profilesRelaxedBy((bundle.host?.relaxations ?? []).map((r) => r.obligation), (bundle.claimedProfiles ?? []).map((p) => p.id));
+    // An OBSERVED relaxation nobody declared: the bundle's own results show the
+    // host accepting a destination its egress guard MUST refuse. Same denial as a
+    // declared one, so declaring nothing is not a way around the rule.
+    const observed = profilesDeniedByObservedRelaxation(bundle.results?.requirements ?? [], (bundle.claimedProfiles ?? []).map((p) => p.id));
+    for (const p of bundle.claimedProfiles ?? []) {
+        if (p.certified && observed.profiles.has(p.id) && !relaxedProfiles.has(p.id))
+            rejections.push({ kind: 'undeclared-relaxation-observed', profile: p.id, detail: `${p.id} is marked certified, but this bundle's own results show the host running relaxed on ${observed.obligations.join(', ')} with no host.relaxations[] entry recording it (security-defaults.md §Relaxations: every relaxation a host runs under MUST be recorded, and its profile MUST NOT certify)` });
+    }
     const certifiedProfiles = [];
     for (const p of bundle.claimedProfiles ?? []) {
-        if (p.certified && relaxed.size > 0 && [...relaxed].some((o) => p.id.includes(o)))
+        if (p.certified && relaxedProfiles.has(p.id))
             rejections.push({ kind: 'relaxed-profile-certified', profile: p.id, detail: `${p.id} is marked certified while a relaxation on ${[...relaxed].join(', ')} is recorded (RFC 0173 §A.2)` });
         else if (p.certified)
             certifiedProfiles.push(p.id);

package/dist/lib/v2-profiles.js

@@ -104,3 +104,69 @@ export function v2ProfileIds(doc) {
 export function v2ProfileDerivable(doc, profile) {
     return v2ProfileIds(doc)?.includes(profile) ?? false;
 }
+/**
+ * Which of `profileIds` a relaxed obligation denies (RFC 0173 §A.2;
+ * `security-defaults.md` §Relaxations: "a bundle that records a relaxation MUST
+ * NOT certify the profile the relaxed obligation belongs to").
+ *
+ * An obligation is `<family>.<name>`. A profile OWNS a family when its registry
+ * predicate lists it — `openwop-core-standard` is built on `interrupt`, `replay`,
+ * `webhooks`, `idempotency`, `eventLog`, so a relaxation on any of those denies
+ * it. That ownership was always stated in `spec/v2/profiles.json`; nothing read
+ * it. Until 2.33.0 the verifier tested whether the profile ID contained the
+ * family name, and the emitter tested whether it contained the WHOLE obligation
+ * string — two different rules under a comment saying they matched — and since
+ * no real v2 profile id contains a family name, a declared relaxation denied
+ * nothing on any real host. The one scenario pinning the rule used a fixture
+ * profile called `openwop-webhooks`, which is why it stayed green.
+ *
+ * The id-substring rule is KEPT as a second arm, not replaced: it is how a
+ * non-registry profile id (a v1 alias, a fixture) names its family, and
+ * dropping it would un-deny something that is denied today. When the registry
+ * is unavailable only that arm can run; the caller already records that layout
+ * as `derivabilityChecked: false`.
+ *
+ * ONE function, called by the emitter and the verifier, so the file and the
+ * verdict on the file cannot disagree again.
+ */
+export function profilesRelaxedBy(obligations, profileIds) {
+    const families = new Set(obligations.map((o) => o.split('.')[0] ?? '').filter((f) => f.length > 0));
+    const out = new Set();
+    if (families.size === 0)
+        return out;
+    const registry = readRegistry();
+    const owned = new Map();
+    for (const p of registry ?? []) {
+        if (typeof p.id === 'string')
+            owned.set(p.id, Array.isArray(p.predicate?.families) ? p.predicate.families.map(String) : []);
+    }
+    for (const id of profileIds) {
+        const ownsOne = (owned.get(id) ?? []).some((f) => families.has(f));
+        const namesOne = [...families].some((f) => id.includes(f));
+        if (ownsOne || namesOne)
+            out.add(id);
+    }
+    return out;
+}
+/**
+ * The requirement whose FAILURE is an observed, undeclared relaxation.
+ *
+ * `conformance/README.md` said of `OPENWOP_HOST_RELAXATIONS` that "the suite
+ * cannot detect an undeclared one". For the egress guard that was never true:
+ * a host that ACCEPTS `https://127.0.0.1/…` as a webhook destination has shown
+ * on the wire that its guard is open (`webhooks.md`: "a host MUST reject (400
+ * webhook_url_rejected) … RFC 1918 and loopback and link-local ranges").
+ * `v2-webhook-egress-refusal` records that as `executed-fail` on this id unless
+ * the operator DECLARED the relaxation — in which case {@link profilesRelaxedBy}
+ * already denies the profile. Either way a profile built on `webhooks` does not
+ * certify on a host whose guard is open; this closes the path where it did,
+ * silently, because nobody declared anything.
+ */
+export const UNDECLARED_RELAXATION_WITNESSES = [
+    { requirementId: 'openwop.requirement.0171.webhook-egress-refused', obligation: 'webhooks.egress-guard' },
+];
+/** Profiles that MUST NOT certify because a row above is `executed-fail` in this bundle's own results. */
+export function profilesDeniedByObservedRelaxation(rows, profileIds) {
+    const obligations = UNDECLARED_RELAXATION_WITNESSES.filter((w) => rows.some((r) => r.id === w.requirementId && r.result === 'executed-fail')).map((w) => w.obligation);
+    return { profiles: profilesRelaxedBy(obligations, profileIds), obligations };
+}

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.32.0",
-  "stampSha256": "09ede2a5f7639c91137ef502d8484ae467f51d0b66f37663081423c8c61f593f"
+  "version": "2.33.0",
+  "stampSha256": "e4dbaa49468204c51012de2eb0d2f121b9805804a77c6d108a0bafb707a86bf4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.32.0",
+  "version": "2.33.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.32.0"
+    "@openwop/spec-artifacts": "2.33.0"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 581,
-    "tests": 2207,
-    "withStableId": 2207,
+    "files": 582,
+    "tests": 2209,
+    "withStableId": 2209,
     "interpolatedTitles": 0,
-    "explicitIds": 2161
+    "explicitIds": 2163
   },
   "records": [
     {
@@ -28387,7 +28387,7 @@
     {
       "id": "openwop.it.v2-relaxation-recorded.a-bundle-recording-a-relaxation-cannot-certify-the-relaxed-profile",
       "file": "v2-relaxation-recorded.test.ts",
-      "line": 68,
+      "line": 70,
       "title": "a bundle recording a relaxation cannot certify the relaxed profile",
       "explicitId": "openwop.requirement.0173.relaxation-recorded",
       "citations": [
@@ -28421,10 +28421,35 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-relaxation-recorded.a-relaxation-denies-the-real-profile-that-owns-its-family-not-only-one-named-aft",
+      "file": "v2-relaxation-recorded.test.ts",
+      "line": 118,
+      "title": "a relaxation denies the REAL profile that owns its family, not only one named after it",
+      "explicitId": "openwop.requirement.0173.relaxation-recorded.owned-by-registry",
+      "citations": [
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "control: with no relaxation recorded, the real profile certifies — so the rejection below is the relaxation's"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "a relaxation on `webhooks.*` MUST deny `openwop-core-standard`, whose registry predicate is built on the `webhooks` family — ownership is read from spec/v2/profiles.json, never from the spelling of the profile id"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "the owning profile is not certified, and a profile that does not own the family still is"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "a relaxation on a family outside every claimed profile's predicate is scoped to nothing claimed — it does not poison an unrelated profile"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-relaxation-recorded.durability-is-a-closed-set-session-deployment-persisted",
       "file": "v2-relaxation-recorded.test.ts",
-      "line": 108,
+      "line": 143,
       "title": "durability is a closed set: session | deployment | persisted",
       "explicitId": "openwop.requirement.0173.relaxation-recorded.durability-closed",
       "citations": [
@@ -29563,6 +29588,25 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-webhook-egress-refusal.a-webhook-registration-naming-a-destination-the-guard-must-refuse-is-refused-400",
+      "file": "v2-webhook-egress-refusal.test.ts",
+      "line": 82,
+      "title": "a webhook registration naming a destination the guard MUST refuse is refused 400 webhook_url_rejected",
+      "explicitId": "openwop.requirement.0171.webhook-egress-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/webhooks.md §SSRF",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §SSRF",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-well-known-one-resource.a-header-less-get-and-an-openwop-version-2-0-get-are-two-representations-of-one",
       "file": "v2-well-known-one-resource.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 523,
+    "files": 524,
     "v1": 445,
-    "v2": 80
+    "v2": 81
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1463,6 +1463,9 @@
     "v2-webhook-durable-delivery.test.ts": [
       2
     ],
+    "v2-webhook-egress-refusal.test.ts": [
+      2
+    ],
     "v2-well-known-one-resource.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.32.0",
-  "corpusTag": "v2.32.0",
+  "version": "2.33.0",
+  "corpusTag": "v2.33.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "a1db4d5558ec828482688ad34db7a749f6f52ef102158d24036819402720a3e9",
-    "api/v2/asyncapi.yaml": "8bfff7d7d9c5ef82196d5b6da1566b36e7070d4996da731c4499fd90b8ee51a7",
-    "api/v2/openapi.yaml": "02338e18f6e0ba029dde8b6dadee126904d2ca97b10a6bdd43c7c1a423ad88d7",
+    "api/seams-v2.yaml": "975b6cd87fa679857df9fcdc60b6a2bed98510b831e82a5eff5a114e3b263f6e",
+    "api/v2/asyncapi.yaml": "96ba13176119bbf54a94bd41d789ebaa919f67c81d529bdc3c66ffb3f419ee36",
+    "api/v2/openapi.yaml": "428ab881d0a8d08d388dd89d4b4457f3454cd0433b665674180d3e85821b978d",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "01ed93af96a8ca6c562b8fa25658ff2e33a793970133c50838d50ac5e362819e",
+    "spec/v1/core-standard-manifest.json": "9f5d065a0a84cf4745f53957f395b1e868453f910531e030f2da4039ee2c9140",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -279,8 +279,8 @@
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "df06e652e6f851338df9b4e0f230bb176511e62691e867f7228d05c4263b1bec",
+    "spec/v2/release.json": "94a3ea302324d9f7df87ce62a186b0b98936de6ce5ac5ec01a3fb3208c38efc3",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "7091dae28be398d49c446f779b4c91755a80a5ff"
+  "corpusCommit": "e9825b0da6ca8e2dbc76353e52aea73a56473393"
 }

package/src/cli.ts

@@ -54,7 +54,7 @@ import {
   PROFILE_FLOOR_SCENARIOS,
 } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
-import { v2ProfileIds } from './lib/v2-profiles.js';
+import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2ProfileIds } from './lib/v2-profiles.js';
 import { childEnv } from './lib/child-env.js';
 
 interface ParsedArgs {
@@ -694,7 +694,9 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     // belongs to. Matched the same way the verifier matches it, so the emitter
     // and `verifyBundleV3` cannot disagree about the same bundle.
     const relaxedObligations = new Set((relaxations ?? []).map((r) => r.obligation));
-    const relaxedProfile = (p: string): boolean => [...relaxedObligations].some((o) => p.includes(o));
+    const relaxedProfileIds = profilesRelaxedBy([...relaxedObligations], claimedProfiles);
+    const observedRelaxed = profilesDeniedByObservedRelaxation(rows3, claimedProfiles).profiles;
+    const relaxedProfile = (p: string): boolean => relaxedProfileIds.has(p) || observedRelaxed.has(p);
     const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !relaxedProfile(p) && (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
     const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
     const lock = existsSync(lockPath) ? (JSON.parse(readFileSync(lockPath, 'utf8')) as { version: string; stampSha256: string }) : undefined;

package/src/lib/a2a-fake-peer.ts

@@ -38,6 +38,7 @@
  * @see https://a2a-protocol.org/v0.3.0/specification
  */
 
+import { resolvePublicFront } from './webhook-receiver.js';
 import { createServer, type Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 
@@ -198,6 +199,18 @@ export class A2AFakePeer {
     return `http://127.0.0.1:${this._boundPort}`;
   }
 
+  /**
+   * The address to hand THE HOST UNDER TEST — `OPENWOP_A2A_FAKE_PEER_URL` when the operator fronts
+   * this peer publicly (https, publicly resolvable; validated loudly, same rule
+   * as the webhook receiver), else `endpoint()`. The suite's own requests to its
+   * own fake keep using `endpoint()`: they need no tunnel and must not depend on
+   * one. Pin the listener with the matching `_PORT` variable so the front has a
+   * fixed port to forward to.
+   */
+  hostFacingEndpoint(): string {
+    return resolvePublicFront('OPENWOP_A2A_FAKE_PEER_URL', this.endpoint()).url;
+  }
+
   reset(): void {
     this._tasks.clear();
     this._invocations.length = 0;
@@ -293,7 +306,7 @@ export class A2AFakePeer {
       description: 'Synthetic A2A peer for openwop conformance suite (dual-era: 1.0 + 0.3-legacy)',
       version: '1.1.0',
       supportedInterfaces: [...this._protocolVersions].sort((a, b) => (a === '1.0' ? -1 : b === '1.0' ? 1 : 0)).map((v) => ({
-        url: `${this.endpoint()}/a2a/jsonrpc`,
+        url: `${this.hostFacingEndpoint()}/a2a/jsonrpc`,
         protocolBinding: 'JSONRPC',
         protocolVersion: v,
       })),
@@ -310,13 +323,13 @@ export class A2AFakePeer {
       protocolVersion: '0.3.0',
       name: 'openwop-conformance-fake-a2a',
       description: 'Synthetic A2A peer for openwop conformance suite',
-      url: `${this.endpoint()}/a2a/jsonrpc`,
+      url: `${this.hostFacingEndpoint()}/a2a/jsonrpc`,
       version: '1.0.0',
       capabilities: { streaming: false, pushNotifications: false },
       skills: [{ id: 'echo', name: 'echo', description: 'Returns input verbatim', tags: ['echo'] }],
       defaultInputModes: ['text'],
       defaultOutputModes: ['text'],
-      additionalInterfaces: [{ url: `${this.endpoint()}/a2a/jsonrpc`, transport: 'JSONRPC' }],
+      additionalInterfaces: [{ url: `${this.hostFacingEndpoint()}/a2a/jsonrpc`, transport: 'JSONRPC' }],
     };
   }
 

package/src/lib/certification-bundle-v3.ts

@@ -19,7 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify, type KeyObject } from 'node:crypto';
 import { profileDerivable, type DiscoveryPayload } from './profiles.js';
-import { v2RegistryAvailable } from './v2-profiles.js';
+import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 
 export type BundleV3Result = 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
 
@@ -179,9 +179,18 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
   }
   // Relaxations: a relaxed obligation's profile cannot certify (RFC 0173 §A.2).
   const relaxed = new Set((bundle.host?.relaxations ?? []).map((r) => r.obligation.split('.')[0]));
+  // Ownership comes from the profile registry, not from the profile's name — see profilesRelaxedBy.
+  const relaxedProfiles = profilesRelaxedBy((bundle.host?.relaxations ?? []).map((r) => r.obligation), (bundle.claimedProfiles ?? []).map((p) => p.id));
+  // An OBSERVED relaxation nobody declared: the bundle's own results show the
+  // host accepting a destination its egress guard MUST refuse. Same denial as a
+  // declared one, so declaring nothing is not a way around the rule.
+  const observed = profilesDeniedByObservedRelaxation(bundle.results?.requirements ?? [], (bundle.claimedProfiles ?? []).map((p) => p.id));
+  for (const p of bundle.claimedProfiles ?? []) {
+    if (p.certified && observed.profiles.has(p.id) && !relaxedProfiles.has(p.id)) rejections.push({ kind: 'undeclared-relaxation-observed', profile: p.id, detail: `${p.id} is marked certified, but this bundle's own results show the host running relaxed on ${observed.obligations.join(', ')} with no host.relaxations[] entry recording it (security-defaults.md §Relaxations: every relaxation a host runs under MUST be recorded, and its profile MUST NOT certify)` });
+  }
   const certifiedProfiles: string[] = [];
   for (const p of bundle.claimedProfiles ?? []) {
-    if (p.certified && relaxed.size > 0 && [...relaxed].some((o) => p.id.includes(o))) rejections.push({ kind: 'relaxed-profile-certified', profile: p.id, detail: `${p.id} is marked certified while a relaxation on ${[...relaxed].join(', ')} is recorded (RFC 0173 §A.2)` });
+    if (p.certified && relaxedProfiles.has(p.id)) rejections.push({ kind: 'relaxed-profile-certified', profile: p.id, detail: `${p.id} is marked certified while a relaxation on ${[...relaxed].join(', ')} is recorded (RFC 0173 §A.2)` });
     else if (p.certified) certifiedProfiles.push(p.id);
   }
   if (expected.blocked > 0 && certifiedProfiles.length > 0) rejections.push({ kind: 'blocked-certified', detail: `${expected.blocked} blocked row(s): a bundle with blocked > 0 does not certify (RFC 0168 §E.1)` });

package/src/lib/mcp-fake-server.ts

@@ -34,6 +34,7 @@
  * @see SECURITY/threat-model-prompt-injection.md §"UNTRUSTED marker"
  */
 
+import { resolvePublicFront } from './webhook-receiver.js';
 import { createServer, type Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 
@@ -149,6 +150,18 @@ export class McpFakeServer {
     return `http://127.0.0.1:${this._boundPort}`;
   }
 
+  /**
+   * The address to hand THE HOST UNDER TEST — `OPENWOP_MCP_FAKE_SERVER_URL` when the operator fronts
+   * this server publicly (https, publicly resolvable; validated loudly, same rule
+   * as the webhook receiver), else `endpoint()`. The suite's own requests to its
+   * own fake keep using `endpoint()`: they need no tunnel and must not depend on
+   * one. Pin the listener with the matching `_PORT` variable so the front has a
+   * fixed port to forward to.
+   */
+  hostFacingEndpoint(): string {
+    return resolvePublicFront('OPENWOP_MCP_FAKE_SERVER_URL', this.endpoint()).url;
+  }
+
   invocations(): readonly McpInvocation[] {
     return this._invocations;
   }

package/src/lib/v2-profiles.ts

@@ -110,3 +110,69 @@ export function v2ProfileIds(doc: DiscoveryPayload): readonly string[] | null {
 export function v2ProfileDerivable(doc: DiscoveryPayload, profile: string): boolean {
   return v2ProfileIds(doc)?.includes(profile) ?? false;
 }
+
+/**
+ * Which of `profileIds` a relaxed obligation denies (RFC 0173 §A.2;
+ * `security-defaults.md` §Relaxations: "a bundle that records a relaxation MUST
+ * NOT certify the profile the relaxed obligation belongs to").
+ *
+ * An obligation is `<family>.<name>`. A profile OWNS a family when its registry
+ * predicate lists it — `openwop-core-standard` is built on `interrupt`, `replay`,
+ * `webhooks`, `idempotency`, `eventLog`, so a relaxation on any of those denies
+ * it. That ownership was always stated in `spec/v2/profiles.json`; nothing read
+ * it. Until 2.33.0 the verifier tested whether the profile ID contained the
+ * family name, and the emitter tested whether it contained the WHOLE obligation
+ * string — two different rules under a comment saying they matched — and since
+ * no real v2 profile id contains a family name, a declared relaxation denied
+ * nothing on any real host. The one scenario pinning the rule used a fixture
+ * profile called `openwop-webhooks`, which is why it stayed green.
+ *
+ * The id-substring rule is KEPT as a second arm, not replaced: it is how a
+ * non-registry profile id (a v1 alias, a fixture) names its family, and
+ * dropping it would un-deny something that is denied today. When the registry
+ * is unavailable only that arm can run; the caller already records that layout
+ * as `derivabilityChecked: false`.
+ *
+ * ONE function, called by the emitter and the verifier, so the file and the
+ * verdict on the file cannot disagree again.
+ */
+export function profilesRelaxedBy(obligations: readonly string[], profileIds: readonly string[]): ReadonlySet<string> {
+  const families = new Set(obligations.map((o) => o.split('.')[0] ?? '').filter((f) => f.length > 0));
+  const out = new Set<string>();
+  if (families.size === 0) return out;
+  const registry = readRegistry();
+  const owned = new Map<string, readonly string[]>();
+  for (const p of registry ?? []) {
+    if (typeof p.id === 'string') owned.set(p.id, Array.isArray(p.predicate?.families) ? (p.predicate.families as unknown[]).map(String) : []);
+  }
+  for (const id of profileIds) {
+    const ownsOne = (owned.get(id) ?? []).some((f) => families.has(f));
+    const namesOne = [...families].some((f) => id.includes(f));
+    if (ownsOne || namesOne) out.add(id);
+  }
+  return out;
+}
+
+/**
+ * The requirement whose FAILURE is an observed, undeclared relaxation.
+ *
+ * `conformance/README.md` said of `OPENWOP_HOST_RELAXATIONS` that "the suite
+ * cannot detect an undeclared one". For the egress guard that was never true:
+ * a host that ACCEPTS `https://127.0.0.1/…` as a webhook destination has shown
+ * on the wire that its guard is open (`webhooks.md`: "a host MUST reject (400
+ * webhook_url_rejected) … RFC 1918 and loopback and link-local ranges").
+ * `v2-webhook-egress-refusal` records that as `executed-fail` on this id unless
+ * the operator DECLARED the relaxation — in which case {@link profilesRelaxedBy}
+ * already denies the profile. Either way a profile built on `webhooks` does not
+ * certify on a host whose guard is open; this closes the path where it did,
+ * silently, because nobody declared anything.
+ */
+export const UNDECLARED_RELAXATION_WITNESSES: ReadonlyArray<{ readonly requirementId: string; readonly obligation: string }> = [
+  { requirementId: 'openwop.requirement.0171.webhook-egress-refused', obligation: 'webhooks.egress-guard' },
+];
+
+/** Profiles that MUST NOT certify because a row above is `executed-fail` in this bundle's own results. */
+export function profilesDeniedByObservedRelaxation(rows: ReadonlyArray<{ readonly id: string; readonly result: string }>, profileIds: readonly string[]): { readonly profiles: ReadonlySet<string>; readonly obligations: readonly string[] } {
+  const obligations = UNDECLARED_RELAXATION_WITNESSES.filter((w) => rows.some((r) => r.id === w.requirementId && r.result === 'executed-fail')).map((w) => w.obligation);
+  return { profiles: profilesRelaxedBy(obligations, profileIds), obligations };
+}

package/src/lib/webhook-receiver.ts

@@ -235,7 +235,26 @@ export async function discoverOwnedTenant(
  * "the host could not be exercised".
  */
 export function resolveRegistrationUrl(localUrl: string): { url: string; tunnelled: boolean } {
-  const raw = process.env.OPENWOP_WEBHOOK_RECEIVER_URL?.trim();
+  return resolvePublicFront('OPENWOP_WEBHOOK_RECEIVER_URL', localUrl);
+}
+
+/**
+ * The same rule, for ANY suite fixture the host under test must reach — the
+ * webhook receiver, the A2A fake peer, the MCP fake server. `envName` names the
+ * operator's public front for that one fixture; unset means the local address.
+ *
+ * Generalised in 2.33.0. Until then only the webhook receiver had a front, so a
+ * host that advertised `a2a` or `mcp` could be measured ONLY with its egress
+ * guard relaxed — those fakes advertised `http://127.0.0.1:<port>` and nothing
+ * else — and a relaxed guard is a relaxation the bundle must declare and cannot
+ * certify under (`security-defaults.md` §Relaxations). The two production hosts
+ * cut relaxation-free only because they advertise neither family. The rule made
+ * a host that implements MORE of the protocol LESS able to certify; found when
+ * the steward's own reference host turned out to be certifying under an
+ * undeclared one.
+ */
+export function resolvePublicFront(envName: string, localUrl: string): { url: string; tunnelled: boolean } {
+  const raw = process.env[envName]?.trim();
   if (!raw) return { url: localUrl, tunnelled: false };
 
   let parsed: URL;
@@ -243,7 +262,7 @@ export function resolveRegistrationUrl(localUrl: string): { url: string; tunnell
     parsed = new URL(raw);
   } catch {
     throw new Error(
-      `OPENWOP_WEBHOOK_RECEIVER_URL is not a valid URL: ${JSON.stringify(raw)}`,
+      `${envName} is not a valid URL: ${JSON.stringify(raw)}`,
     );
   }
 
@@ -252,7 +271,7 @@ export function resolveRegistrationUrl(localUrl: string): { url: string; tunnell
   // ALLOW_PRIVATE flag insufficient in the first place.
   if (parsed.protocol !== 'https:') {
     throw new Error(
-      `OPENWOP_WEBHOOK_RECEIVER_URL MUST be https: (got ${parsed.protocol}). ` +
+      `${envName} MUST be https: (got ${parsed.protocol}). ` +
         'A plain-http front cannot clear the scheme gate, so it cannot witness this scenario.',
     );
   }
@@ -272,13 +291,13 @@ export function resolveRegistrationUrl(localUrl: string): { url: string; tunnell
     /^(fc|fd)/.test(host);
   if (isLoopback || isPrivate) {
     throw new Error(
-      `OPENWOP_WEBHOOK_RECEIVER_URL MUST be a publicly-resolvable host (got ${parsed.hostname}). ` +
+      `${envName} MUST be a publicly-resolvable host (got ${parsed.hostname}). ` +
         'It is the PUBLIC front for the local receiver — a tunnel or TLS-terminating proxy — ' +
         'not the receiver address itself.',
     );
   }
 
-  return { url: raw, tunnelled: true };
+  return { url: envName === 'OPENWOP_WEBHOOK_RECEIVER_URL' ? raw : raw.replace(/\/+$/, ''), tunnelled: true };
 }
 
 /**

package/src/scenarios/a2a-1-0-agent-card.test.ts

@@ -62,7 +62,7 @@ describe('RFC 0152 — the suite peer speaks A2A 1.0 (dual-era A2AFakePeer)', ()
     expect(ifaces.map((i) => i.protocolVersion)).toEqual(['1.0', '0.3']);
     for (const i of ifaces) {
       expect(i.protocolBinding).toBe('JSONRPC');
-      expect(i.url.startsWith(peer.endpoint())).toBe(true);
+      expect(i.url.startsWith(peer.hostFacingEndpoint())).toBe(true);
     }
     expect(card['url'], req('openwop.it.a2a-1-0-agent-card.the-agent-card-is-1-0-shaped-supportedinterfaces-no-top-level-url-protocolversio', 'RFC 0152 §A/§B/§C/§D', '1.0 removed top-level url')).toBeUndefined();
     expect(card['protocolVersion'], req('openwop.it.a2a-1-0-agent-card.the-agent-card-is-1-0-shaped-supportedinterfaces-no-top-level-url-protocolversio', 'RFC 0152 §A/§B/§C/§D', '1.0 removed top-level protocolVersion (it is per interface)')).toBeUndefined();

package/src/scenarios/a2a-peer-authority.test.ts

@@ -64,7 +64,7 @@ describe('RFC 0152 §E — a2a-peer-no-authority-escalation (host as A2A client,
     peer.reset();
     peer.setNextPeerAssertsAuthority(true);
     const drive = await driver.post('/v1/host/sample/a2a/invoke', {
-      peerUrl: peer.endpoint(),
+      peerUrl: peer.hostFacingEndpoint(),
       scenario: 'peer-asserts-authority',
     });
     if (drive.status === 404 || drive.status === 403) {

package/src/scenarios/a2a-task-roundtrip.test.ts

@@ -66,7 +66,7 @@ function probePeer(): { url: string; isReal: boolean } | null {
   const real = process.env.OPENWOP_A2A_REAL_PEER_URL;
   if (real && real.length > 0) return { url: real.replace(/\/$/, ''), isReal: true };
   const fake = getA2AFakePeer();
-  if (fake) return { url: fake.endpoint(), isReal: false };
+  if (fake) return { url: fake.hostFacingEndpoint(), isReal: false };
   return null;
 }
 

package/src/scenarios/a2a-version-negotiation.test.ts

@@ -78,7 +78,7 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     const peer = getA2AFakePeer();
     if (peer === null) return softSkip('blocked', 'precondition not met — `peer === null` returned early (no fake peer wired in this run) (seam, prior step, or fixture unavailable)'); // no fake peer wired in this run
     peer.reset();
-    const drive = await driver.post('/v1/host/sample/a2a/invoke', { peerUrl: peer.endpoint() });
+    const drive = await driver.post('/v1/host/sample/a2a/invoke', { peerUrl: peer.hostFacingEndpoint() });
     if (drive.status === 404 || drive.status === 403) {
       // Seam absent. RFC 0148 §A: unobservable resolves to `blocked`, not a pass.
       expect(
@@ -114,7 +114,7 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     const preferred = caps?.preferredVersion;
     peer.reset();
     const drive = await driver.post('/v1/host/sample/a2a/invoke', {
-      peerUrl: peer.endpoint(),
+      peerUrl: peer.hostFacingEndpoint(),
       authenticated: true,
       peerOffersOnly: '0.3',
     });
@@ -151,7 +151,7 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     const peer = getA2AFakePeer();
     if (peer === null) return softSkip('blocked', 'precondition not met — `peer === null` returned early (seam, prior step, or fixture unavailable)');
     const drive = await driver.post('/v1/host/sample/a2a/invoke', {
-      peerUrl: peer.endpoint(),
+      peerUrl: peer.hostFacingEndpoint(),
       requestVersion: '99.0',
     });
     if (drive.status === 404 || drive.status === 403) return softSkip('blocked', 'precondition not met — `drive.status === 404 || drive.status === 403` returned early (seam, prior step, or fixture unavailable)');

package/src/scenarios/mcp-extension-opacity.test.ts

@@ -47,7 +47,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §D — mcp-extension-o
     if (server === null) return softSkip('blocked', 'the suite MCP fake server is not started in this run — the host-as-client leg cannot be driven');
     server.reset();
     server.setNextResultAssertsAuthority(true);
-    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint(), tool: 'echo', arguments: { text: 'opaque' }, scenario: 'extension-asserts-authority' });
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.hostFacingEndpoint(), tool: 'echo', arguments: { text: 'opaque' }, scenario: 'extension-asserts-authority' });
     if (drive.status === 404 || drive.status === 403) {
       // Advertised mcp-2026-07-28 but the invoke seam answered {drive.status}: not observable here.
       // Default mode records `blocked` (RFC 0148 §A); OPENWOP_REQUIRE_BEHAVIOR=true fails

package/src/scenarios/mcp-mrtr-roundtrip.test.ts

@@ -58,7 +58,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §C — mcp-mrtr-roundt
     if (server === null) return softSkip('blocked', 'the suite MCP fake server is not started in this run — the client half cannot be driven');
     server.reset();
     const drive = await driver.post('/v1/host/sample/mcp/invoke', {
-      serverUrl: server.endpoint(),
+      serverUrl: server.hostFacingEndpoint(),
       tool: 'needs_input',
       clientCapabilities: { elicitation: {} },
       elicitationAnswer: { name: 'Ada' },

package/src/scenarios/mcp-tool-roundtrip.test.ts

@@ -179,7 +179,7 @@ function probeEndpoint(): { url: string; isReal: boolean } | null {
   const real = process.env.OPENWOP_MCP_REAL_SERVER_URL;
   if (real && real.length > 0) return { url: real.replace(/\/$/, ''), isReal: true };
   const fake = getMcpFakeServer();
-  if (fake) return { url: fake.endpoint(), isReal: false };
+  if (fake) return { url: fake.hostFacingEndpoint(), isReal: false };
   return null;
 }
 

package/src/scenarios/mcp-version-negotiation.test.ts

@@ -86,7 +86,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
     const server = getMcpFakeServer();
     if (server === null) return softSkip('blocked', 'precondition not met — `server === null` returned early (seam, prior step, or fixture unavailable)');
     server.reset();
-    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint() });
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.hostFacingEndpoint() });
     if (drive.status === 404 || drive.status === 403) {
       expect(
         drive.status,
@@ -125,7 +125,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
     if (server === null) return softSkip('blocked', 'precondition not met — `server === null` returned early (seam, prior step, or fixture unavailable)');
     const caps = await mcp();
     server.reset();
-    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint() });
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.hostFacingEndpoint() });
     if (drive.status === 404 || drive.status === 403) return seamAbsent(`host advertises mcp version negotiation but the invoke seam /v1/host/sample/mcp/invoke answered ${drive.status} — the host-as-client legs are unobservable (host-sample-test-seams.md)`);
     // it never advertised has made its own discovery document unreliable, which
     // is worse than advertising nothing — a consumer that read it made a
@@ -148,7 +148,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
     const server = getMcpFakeServer();
     if (server === null) return softSkip('blocked', 'precondition not met — `server === null` returned early (seam, prior step, or fixture unavailable)');
     const drive = await driver.post('/v1/host/sample/mcp/invoke', {
-      serverUrl: server.endpoint(),
+      serverUrl: server.hostFacingEndpoint(),
       requestVersion: '1999-01-01',
     });
     if (drive.status === 404 || drive.status === 403) return seamAbsent(`host advertises mcp version negotiation but the invoke seam /v1/host/sample/mcp/invoke answered ${drive.status} — the host-as-client legs are unobservable (host-sample-test-seams.md)`);

package/src/scenarios/v2-minimum-version-refused.test.ts

@@ -96,7 +96,7 @@ describe('RFC 0175 §D.2 — minimum-version-refused (gated on a2a/mcp + seams)'
     const peer = new A2AFakePeer({ protocolVersions: ['0.3'] });
     await peer.start();
     try {
-      const res = await driver.post(`${SEAMS_PREFIX}/sample/a2a/invoke`, { peerUrl: peer.endpoint(), authenticated: true, peerOffersOnly: A2A_LOWEST });
+      const res = await driver.post(`${SEAMS_PREFIX}/sample/a2a/invoke`, { peerUrl: peer.hostFacingEndpoint(), authenticated: true, peerOffersOnly: A2A_LOWEST });
       if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises a2a but ${SEAMS_PREFIX}/sample/a2a/invoke answered ${res.status} (host-sample-test-seams.md §22)`);
       await assertRefused('openwop.requirement.0175.minimum-version-refused', 'a2a', floor, res);
       // The wire leg: the host MUST NOT have spoken the below-floor version to the peer.
@@ -124,7 +124,7 @@ describe('RFC 0175 §D.2 — minimum-version-refused (gated on a2a/mcp + seams)'
     const server = new McpFakeServer({ protocolVersions: ['2025-06-18'] });
     await server.start();
     try {
-      const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, { serverUrl: server.endpoint(), requestVersion: MCP_LOWEST });
+      const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, { serverUrl: server.hostFacingEndpoint(), requestVersion: MCP_LOWEST });
       if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises mcp but ${SEAMS_PREFIX}/sample/mcp/invoke answered ${res.status} (host-sample-test-seams.md §23)`);
       await assertRefused('openwop.requirement.0175.minimum-version-refused.mcp', 'mcp', floor, res);
       for (const c of server.invocations()) {

package/src/scenarios/v2-mrtr-rounds-ceiling.test.ts

@@ -73,7 +73,7 @@ describe('RFC 0175 §E.1 — mrtr-rounds-ceiling (gated on mcp + mrtr)', () => {
     // input_required for `arguments.rounds` retries before completing.
     const rounds = (maxRounds as number) + 1;
     const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, {
-      serverUrl: server.endpoint(),
+      serverUrl: server.hostFacingEndpoint(),
       tool: LOOP_TOOL,
       arguments: { rounds },
       clientCapabilities: { elicitation: {} },

package/src/scenarios/v2-negotiation-authenticated.test.ts

@@ -99,7 +99,7 @@ describe('RFC 0175 §D.1 — negotiation-authenticated (gated on a2a/mcp + seams
     const peer = new A2AFakePeer({ protocolVersions: ['0.3'] });
     await peer.start();
     try {
-      const res = await driver.post(`${SEAMS_PREFIX}/sample/a2a/invoke`, { peerUrl: peer.endpoint(), authenticated: false, peerOffersOnly: A2A_LOWER });
+      const res = await driver.post(`${SEAMS_PREFIX}/sample/a2a/invoke`, { peerUrl: peer.hostFacingEndpoint(), authenticated: false, peerOffersOnly: A2A_LOWER });
       if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises a2a but ${SEAMS_PREFIX}/sample/a2a/invoke answered ${res.status} (host-sample-test-seams.md §22)`);
       const wire = peer.invocations().filter((i) => i.method !== 'GET').map((i) => String(i.headers['a2a-version'] ?? ''));
       await assertNotLowered('openwop.requirement.0175.negotiation-authenticated', preferred, A2A_LOWER, res, wire);
@@ -119,7 +119,7 @@ describe('RFC 0175 §D.1 — negotiation-authenticated (gated on a2a/mcp + seams
     const server = new McpFakeServer({ protocolVersions: ['2025-06-18'] });
     await server.start();
     try {
-      const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, { serverUrl: server.endpoint(), authenticated: false });
+      const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, { serverUrl: server.hostFacingEndpoint(), authenticated: false });
       if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises mcp but ${SEAMS_PREFIX}/sample/mcp/invoke answered ${res.status} (host-sample-test-seams.md §23)`);
       const wire = server.invocations().map((i) => String(i.headers['mcp-protocol-version'] ?? ''));
       await assertNotLowered('openwop.requirement.0175.negotiation-authenticated.mcp', preferred, MCP_LOWER, res, wire);

package/src/scenarios/v2-negotiation-decided-emitted.test.ts

@@ -95,7 +95,7 @@ async function leg(protocol: 'a2a' | 'mcp', id: string): Promise<void> {
   const validate = payloadValidator();
   if (!validate) return softSkip('blocked', 'run-event-payloads.schema.json#/$defs/negotiationDecided not readable from SCHEMAS_DIR');
 
-  const driven = await drive(protocol, peer.endpoint());
+  const driven = await drive(protocol, peer.hostFacingEndpoint());
   if (!driven) return softSkip('blocked', 'invoke seam unavailable (reason recorded above)');
   const runId = driven.body['runId'];
   if (typeof runId !== 'string') {
@@ -117,11 +117,11 @@ async function leg(protocol: 'a2a' | 'mcp', id: string): Promise<void> {
       expect(
         p['peerDigest'],
         req(id, 'interop.md §The audit event', 'peerDigest MUST be the SHA-256 of the peer origin — never the origin in clear (RFC 0175 §D.3)'),
-      ).toBe(originDigest(peer.endpoint()));
+      ).toBe(originDigest(peer.hostFacingEndpoint()));
     }
     for (const v of Object.values(p)) {
       expect(
-        typeof v === 'string' && v.includes(new URL(peer.endpoint()).host),
+        typeof v === 'string' && v.includes(new URL(peer.hostFacingEndpoint()).host),
         req(id, 'interop.md §The audit event', 'the event is content-free: the peer origin MUST NOT appear in clear in any field'),
       ).toBe(false);
     }

package/src/scenarios/v2-relaxation-recorded.test.ts

@@ -28,6 +28,8 @@ import { generateKeyPairSync } from 'node:crypto';
 import { signBundleV3, verifyBundleV3, witnessDigest, type BundleV3, type BundleV3Relaxation } from '../lib/certification-bundle-v3.js';
 import { v2Validator } from '../lib/v2.js';
 import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { v2RegistryAvailable } from '../lib/v2-profiles.js';
 
 const host = generateKeyPairSync('ed25519');
 const hostPem = host.privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
@@ -38,7 +40,7 @@ const ROWS: BundleV3['results']['requirements'] = [
 ];
 
 /** A schema-valid, verifier-clean bundle v3; `relaxations` and the claimed profile vary per leg. */
-function bundle(opts: { relaxations?: BundleV3Relaxation[]; certified: boolean }): BundleV3 {
+function bundle(opts: { relaxations?: BundleV3Relaxation[]; certified: boolean; profileId?: string }): BundleV3 {
   const unsigned: Omit<BundleV3, 'signature'> = {
     bundleVersion: '3',
     generatedAt: '2026-09-03T00:00:00Z',
@@ -52,7 +54,7 @@ function bundle(opts: { relaxations?: BundleV3Relaxation[]; certified: boolean }
     },
     discovery: { url: 'https://fixture.invalid/.well-known/openwop', sha256: 'a'.repeat(64), protocolVersions: ['2.0'], preferredVersion: '2.0' },
     claimedProfiles: [
-      { id: 'openwop-webhooks', evidenceTier: 'self', witnessCount: 1, certified: opts.certified },
+      { id: opts.profileId ?? 'openwop-webhooks', evidenceTier: 'self', witnessCount: 1, certified: opts.certified },
       { id: 'openwop-discovery-core', evidenceTier: 'self', witnessCount: 1, certified: true },
     ],
     results: { totals: { executedPass: ROWS.length, executedFail: 0, skipped: 0, inapplicable: 0, blocked: 0 }, requirements: ROWS },
@@ -105,6 +107,39 @@ describe('RFC 0173 §A.2 — relaxation-recorded (unaided, fixture bundle)', ()
     ).not.toContain('relaxed-profile-certified');
   });
 
+  // Until 2.33.0 every leg above used the FIXTURE profile `openwop-webhooks`, and
+  // the verifier matched a relaxation to a profile by testing whether the profile
+  // ID contained the family name. No real v2 profile id contains one —
+  // `openwop-discovery-core`, `openwop-core-standard`,
+  // `openwop-conformance-seams-v2` — so on every real host a DECLARED relaxation
+  // denied nothing, and this file stayed green because its fixture was the one
+  // id the rule could match. Ownership is what `spec/v2/profiles.json` states:
+  // `openwop-core-standard`'s predicate is built on `webhooks`.
+  it('a relaxation denies the REAL profile that owns its family, not only one named after it', () => {
+    if (!v2RegistryAvailable()) return softSkip('inapplicable', 'spec/v2/profiles.json is absent from this layout — profile ownership cannot be read, so only the id-named arm of the rule can run');
+    const EGRESS: BundleV3Relaxation = { obligation: 'webhooks.egress-guard', durability: 'session', reason: 'conformance cut against loopback fixtures' };
+    const control = verifyBundleV3(bundle({ certified: true, profileId: 'openwop-core-standard' }));
+    expect(
+      control.certifiedProfiles,
+      req('openwop.requirement.0173.relaxation-recorded.owned-by-registry', 'security-defaults.md §Relaxations', 'control: with no relaxation recorded, the real profile certifies — so the rejection below is the relaxation\'s'),
+    ).toContain('openwop-core-standard');
+    const relaxed = verifyBundleV3(bundle({ relaxations: [EGRESS], certified: true, profileId: 'openwop-core-standard' }));
+    expect(
+      relaxed.rejections.find((r) => r.kind === 'relaxed-profile-certified')?.profile,
+      req('openwop.requirement.0173.relaxation-recorded.owned-by-registry', 'security-defaults.md §Relaxations', 'a relaxation on `webhooks.*` MUST deny `openwop-core-standard`, whose registry predicate is built on the `webhooks` family — ownership is read from spec/v2/profiles.json, never from the spelling of the profile id'),
+    ).toBe('openwop-core-standard');
+    expect(
+      relaxed.certifiedProfiles,
+      req('openwop.requirement.0173.relaxation-recorded.owned-by-registry', 'security-defaults.md §Relaxations', 'the owning profile is not certified, and a profile that does not own the family still is'),
+    ).toEqual(['openwop-discovery-core']);
+    // A family no claimed profile owns denies nothing — the relaxation is still recorded, which is the obligation.
+    const unowned = verifyBundleV3(bundle({ relaxations: [{ ...EGRESS, obligation: 'mcp.egress-guard' }], certified: true, profileId: 'openwop-core-standard' }));
+    expect(
+      unowned.certifiedProfiles,
+      req('openwop.requirement.0173.relaxation-recorded.owned-by-registry', 'security-defaults.md §Relaxations', 'a relaxation on a family outside every claimed profile\'s predicate is scoped to nothing claimed — it does not poison an unrelated profile'),
+    ).toContain('openwop-core-standard');
+  });
+
   it('durability is a closed set: session | deployment | persisted', () => {
     const validate = v2Validator('certification-bundle');
     const withDurability = (durability: string): unknown => {

package/src/scenarios/v2-webhook-egress-refusal.test.ts

@@ -0,0 +1,115 @@
+/**
+ * v2-webhook-egress-refusal — the webhook egress guard REFUSES, at major 2.
+ *
+ * `spec/v2/core/webhooks.md` §SSRF: "At registration a host MUST reject (`400
+ * webhook_url_rejected`) non-`https://` URLs, RFC 1918 and loopback and
+ * link-local ranges, IPv6 ULA, cloud metadata hosts, and `localhost`."
+ *
+ * ── Why this file exists ─────────────────────────────────────────────────────
+ * Until 2.33.0 NO major-2 row asserted that sentence. The scenarios that do
+ * (`http-client-ssrf`, `webhook-negative`) are registered at major 1 only, and
+ * the three major-2 files that name `webhook_url_rejected` name it only as the
+ * soft-skip taken when a host refuses the suite's own receiver. So a v2 bundle
+ * could certify `openwop-core-standard` — the profile built on `webhooks` — on a
+ * host whose guard refused nothing at all.
+ *
+ * It was found the expensive way: the steward's own reference host had been
+ * cutting its certified bundles with the guard open (`OPENWOP_WEBHOOK_ALLOW_PRIVATE`,
+ * because every suite fixture was a loopback listener) and recording no
+ * relaxation, which `security-defaults.md` §Relaxations forbids. Nothing in the
+ * suite could see it. `conformance/README.md` even said so: "the suite cannot
+ * detect an undeclared one." For THIS relaxation that was never true — a host
+ * that accepts `https://127.0.0.1/…` has shown on the wire that its guard is open.
+ *
+ * ── The three outcomes ───────────────────────────────────────────────────────
+ *   every probe refused              → executed-pass. The guard holds.
+ *   a probe ACCEPTED, relaxation
+ *     DECLARED (OPENWOP_HOST_RELAXATIONS
+ *     names a `webhooks.*` obligation) → inapplicable, with the declaration
+ *                                        quoted. The bundle carries
+ *                                        `host.relaxations[]` and the owning
+ *                                        profile is denied by that (RFC 0173 §A.2).
+ *   a probe ACCEPTED, nothing declared → executed-FAIL — and the emitter and
+ *                                        verifier deny every profile that owns
+ *                                        `webhooks` (`lib/v2-profiles.ts`
+ *                                        `profilesDeniedByObservedRelaxation`).
+ *
+ * Registration-time only, by design: every probe is a destination the suite
+ * does not own, so nothing is ever delivered and an accepted registration is
+ * deleted at once. Delivery-time re-resolution is a separate MUST that needs a
+ * resolver the suite controls; it is not claimed here.
+ *
+ * @see spec/v2/core/webhooks.md §SSRF
+ * @see spec/v2/core/security-defaults.md §Relaxations
+ */
+
+import { describe, expect, it } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { gateFamily, v2Discovery } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0171.webhook-egress-refused';
+const DOC = 'spec/v2/core/webhooks.md §SSRF';
+const EVENTS = ['run.completed'];
+
+/** One destination per class the sentence names. None is ever contacted. */
+const PROBES: ReadonlyArray<{ readonly url: string; readonly cls: string }> = [
+  { url: 'http://webhook-egress-probe.example.com/hook', cls: 'non-https scheme' },
+  { url: 'https://127.0.0.1/openwop-egress-probe', cls: 'loopback (IPv4)' },
+  { url: 'https://[::1]/openwop-egress-probe', cls: 'loopback (IPv6)' },
+  { url: 'https://localhost/openwop-egress-probe', cls: 'localhost' },
+  { url: 'https://10.255.255.1/openwop-egress-probe', cls: 'RFC 1918 (10/8)' },
+  { url: 'https://192.168.255.1/openwop-egress-probe', cls: 'RFC 1918 (192.168/16)' },
+  { url: 'https://169.254.169.254/latest/meta-data/', cls: 'link-local / cloud metadata' },
+  { url: 'https://[fd00::1]/openwop-egress-probe', cls: 'IPv6 ULA' },
+];
+
+/** The `webhooks.*` obligations the operator declared relaxed, if any. */
+function declaredWebhookRelaxations(): string[] {
+  const raw = process.env['OPENWOP_HOST_RELAXATIONS'];
+  if (!raw) return [];
+  try {
+    const parsed = JSON.parse(raw) as Array<{ obligation?: unknown }>;
+    return (Array.isArray(parsed) ? parsed : []).map((r) => String(r.obligation ?? '')).filter((o) => o.split('.')[0] === 'webhooks');
+  } catch {
+    return []; // the emitter rejects unparseable JSON loudly; this file does not second-guess it
+  }
+}
+
+describe('v2-webhook-egress-refusal (webhooks.md §SSRF — the guard refuses, at major 2)', () => {
+  it('a webhook registration naming a destination the guard MUST refuse is refused 400 webhook_url_rejected', async () => {
+    const doc = await v2Discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable');
+    if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
+
+    const accepted: string[] = [];
+    const wrongCode: string[] = [];
+    for (const probe of PROBES) {
+      const reg = await driver.post('/webhooks', { url: probe.url, events: EVENTS });
+      if (reg.status === 201) {
+        accepted.push(`${probe.cls} (${probe.url})`);
+        const webhookId = (reg.json as { webhookId?: unknown } | null)?.webhookId;
+        if (typeof webhookId === 'string') await driver.delete(`/webhooks/${encodeURIComponent(webhookId)}`);
+      } else if (!(reg.status === 400 && readErrorCode(reg.json) === 'webhook_url_rejected')) {
+        wrongCode.push(`${probe.cls}: ${reg.status} ${String(readErrorCode(reg.json))}`);
+      }
+    }
+
+    if (accepted.length > 0) {
+      const declared = declaredWebhookRelaxations();
+      if (declared.length > 0) {
+        return softSkip('inapplicable', `the egress guard is relaxed and the operator DECLARED it (OPENWOP_HOST_RELAXATIONS: ${declared.join(', ')}) — the host accepted ${accepted.length} of ${PROBES.length} destinations the guard MUST refuse (${accepted.join('; ')}). The refusal cannot be witnessed on a host running relaxed; the bundle carries host.relaxations[] and the profile that owns \`webhooks\` does not certify (security-defaults.md §Relaxations)`);
+      }
+    }
+    expect(
+      accepted,
+      req(ID, DOC, `a host MUST reject (400 webhook_url_rejected) non-https URLs, RFC 1918, loopback, link-local, IPv6 ULA, cloud-metadata hosts and localhost at registration — this host ACCEPTED ${accepted.length} of ${PROBES.length} (${accepted.join('; ')}) and no \`webhooks.*\` relaxation is declared in OPENWOP_HOST_RELAXATIONS. An open guard nobody declared is an UNDECLARED RELAXATION: security-defaults.md §Relaxations requires it in host.relaxations[], and no profile built on \`webhooks\` certifies either way`),
+    ).toEqual([]);
+    expect(
+      wrongCode,
+      req(ID, DOC, `the refusal MUST be 400 webhook_url_rejected (spec/v2/errors.json) — other answers: ${wrongCode.join('; ')}`),
+    ).toEqual([]);
+  }, 60_000);
+});