@openwop/openwop-conformance 2.32.0 → 2.33.1

package/src/lib/certification-bundle-v3.ts

@@ -19,7 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify, type KeyObject } from 'node:crypto';
 import { profileDerivable, type DiscoveryPayload } from './profiles.js';
-import { v2RegistryAvailable } from './v2-profiles.js';
+import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 
 export type BundleV3Result = 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
 
@@ -179,9 +179,18 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
   }
   // Relaxations: a relaxed obligation's profile cannot certify (RFC 0173 §A.2).
   const relaxed = new Set((bundle.host?.relaxations ?? []).map((r) => r.obligation.split('.')[0]));
+  // Ownership comes from the profile registry, not from the profile's name — see profilesRelaxedBy.
+  const relaxedProfiles = profilesRelaxedBy((bundle.host?.relaxations ?? []).map((r) => r.obligation), (bundle.claimedProfiles ?? []).map((p) => p.id));
+  // An OBSERVED relaxation nobody declared: the bundle's own results show the
+  // host accepting a destination its egress guard MUST refuse. Same denial as a
+  // declared one, so declaring nothing is not a way around the rule.
+  const observed = profilesDeniedByObservedRelaxation(bundle.results?.requirements ?? [], (bundle.claimedProfiles ?? []).map((p) => p.id));
+  for (const p of bundle.claimedProfiles ?? []) {
+    if (p.certified && observed.profiles.has(p.id) && !relaxedProfiles.has(p.id)) rejections.push({ kind: 'undeclared-relaxation-observed', profile: p.id, detail: `${p.id} is marked certified, but this bundle's own results show the host running relaxed on ${observed.obligations.join(', ')} with no host.relaxations[] entry recording it (security-defaults.md §Relaxations: every relaxation a host runs under MUST be recorded, and its profile MUST NOT certify)` });
+  }
   const certifiedProfiles: string[] = [];
   for (const p of bundle.claimedProfiles ?? []) {
-    if (p.certified && relaxed.size > 0 && [...relaxed].some((o) => p.id.includes(o))) rejections.push({ kind: 'relaxed-profile-certified', profile: p.id, detail: `${p.id} is marked certified while a relaxation on ${[...relaxed].join(', ')} is recorded (RFC 0173 §A.2)` });
+    if (p.certified && relaxedProfiles.has(p.id)) rejections.push({ kind: 'relaxed-profile-certified', profile: p.id, detail: `${p.id} is marked certified while a relaxation on ${[...relaxed].join(', ')} is recorded (RFC 0173 §A.2)` });
     else if (p.certified) certifiedProfiles.push(p.id);
   }
   if (expected.blocked > 0 && certifiedProfiles.length > 0) rejections.push({ kind: 'blocked-certified', detail: `${expected.blocked} blocked row(s): a bundle with blocked > 0 does not certify (RFC 0168 §E.1)` });

package/src/lib/durability-watch.ts

@@ -0,0 +1,53 @@
+/**
+ * RFC 0158 §E item 11 — watching a run across a real process death.
+ *
+ * Two facts are wanted from one watch: (a) did resumption appear within the
+ * budget, and (b) was the run EVER observable as `completed` without having
+ * been re-executed. (b) is a statement about two pieces of host state — the
+ * status and the log — and they come from two requests, so the ORDER of the
+ * reads decides whether a conclusion is sound.
+ *
+ * Until 2.33.1 each iteration read the LOG, then the STATUS, and latched (b)
+ * when the status said `completed` and the (older) log showed no resumption. A
+ * host that re-dispatched between the two requests therefore read as "completed
+ * un-re-executed" while being neither: the log read predated the re-execution,
+ * the status read followed its completion. The staged work is `conformance-noop`,
+ * which re-executes in milliseconds, so the window is real — per run roughly
+ * (gap between the two requests) / (poll interval), a few percent. Measured on
+ * a tier-1 host: after a genuine SIGKILL and a correct recovery by lease expiry
+ * (727 s, inside a declared 750 s bound), the row failed with the message
+ * "read status completed with 2 run.started" — it printed the re-execution it
+ * was denying, because the message used a LATER read than the latch did. It had
+ * passed on the two previous runs of the same host and code.
+ *
+ * The rule: STATUS FIRST, LOG SECOND. A run's log is append-only, so a log read
+ * taken AFTER a `completed` status can only show MORE than the status implied.
+ * If that later log still shows no resumption, the run really was observable as
+ * completed un-re-executed. If it shows resumption, nothing was wrong. If it is
+ * unreadable, nothing is concluded — an unreadable log is never evidence.
+ *
+ * Readers are injected so the ordering itself is testable without a host.
+ */
+export interface Observation { readonly readable: boolean; readonly runStarted: number; readonly nodeStarted: number; readonly restored: number }
+export interface Watch { readonly resumedAfterMs: number | null; readonly last: Observation; readonly completedUnresumed: boolean; readonly waitedMs: number }
+export interface WatchIo {
+  readStatus(): Promise<string | null>;
+  readLog(): Promise<Observation>;
+  now(): number;
+  sleep(ms: number): Promise<void>;
+}
+
+export async function watchForResumption(io: WatchIo, budgetMs: number, resumed: (o: Observation) => boolean, pollMs = 500): Promise<Watch> {
+  const t0 = io.now();
+  let completedUnresumed = false;
+  for (;;) {
+    const status = await io.readStatus();   // FIRST
+    const last = await io.readLog();        // SECOND — never older than the status it is judged against
+    const waitedMs = io.now() - t0;
+    const isResumed = last.readable && resumed(last);
+    if (status === 'completed' && last.readable && !isResumed) completedUnresumed = true;
+    if (isResumed) return { resumedAfterMs: waitedMs, last, completedUnresumed, waitedMs };
+    if (waitedMs >= budgetMs) return { resumedAfterMs: null, last, completedUnresumed, waitedMs };
+    await io.sleep(pollMs);
+  }
+}

package/src/lib/mcp-fake-server.ts

@@ -34,6 +34,7 @@
  * @see SECURITY/threat-model-prompt-injection.md §"UNTRUSTED marker"
  */
 
+import { resolvePublicFront } from './webhook-receiver.js';
 import { createServer, type Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 
@@ -149,6 +150,18 @@ export class McpFakeServer {
     return `http://127.0.0.1:${this._boundPort}`;
   }
 
+  /**
+   * The address to hand THE HOST UNDER TEST — `OPENWOP_MCP_FAKE_SERVER_URL` when the operator fronts
+   * this server publicly (https, publicly resolvable; validated loudly, same rule
+   * as the webhook receiver), else `endpoint()`. The suite's own requests to its
+   * own fake keep using `endpoint()`: they need no tunnel and must not depend on
+   * one. Pin the listener with the matching `_PORT` variable so the front has a
+   * fixed port to forward to.
+   */
+  hostFacingEndpoint(): string {
+    return resolvePublicFront('OPENWOP_MCP_FAKE_SERVER_URL', this.endpoint()).url;
+  }
+
   invocations(): readonly McpInvocation[] {
     return this._invocations;
   }

package/src/lib/v2-profiles.ts

@@ -110,3 +110,69 @@ export function v2ProfileIds(doc: DiscoveryPayload): readonly string[] | null {
 export function v2ProfileDerivable(doc: DiscoveryPayload, profile: string): boolean {
   return v2ProfileIds(doc)?.includes(profile) ?? false;
 }
+
+/**
+ * Which of `profileIds` a relaxed obligation denies (RFC 0173 §A.2;
+ * `security-defaults.md` §Relaxations: "a bundle that records a relaxation MUST
+ * NOT certify the profile the relaxed obligation belongs to").
+ *
+ * An obligation is `<family>.<name>`. A profile OWNS a family when its registry
+ * predicate lists it — `openwop-core-standard` is built on `interrupt`, `replay`,
+ * `webhooks`, `idempotency`, `eventLog`, so a relaxation on any of those denies
+ * it. That ownership was always stated in `spec/v2/profiles.json`; nothing read
+ * it. Until 2.33.0 the verifier tested whether the profile ID contained the
+ * family name, and the emitter tested whether it contained the WHOLE obligation
+ * string — two different rules under a comment saying they matched — and since
+ * no real v2 profile id contains a family name, a declared relaxation denied
+ * nothing on any real host. The one scenario pinning the rule used a fixture
+ * profile called `openwop-webhooks`, which is why it stayed green.
+ *
+ * The id-substring rule is KEPT as a second arm, not replaced: it is how a
+ * non-registry profile id (a v1 alias, a fixture) names its family, and
+ * dropping it would un-deny something that is denied today. When the registry
+ * is unavailable only that arm can run; the caller already records that layout
+ * as `derivabilityChecked: false`.
+ *
+ * ONE function, called by the emitter and the verifier, so the file and the
+ * verdict on the file cannot disagree again.
+ */
+export function profilesRelaxedBy(obligations: readonly string[], profileIds: readonly string[]): ReadonlySet<string> {
+  const families = new Set(obligations.map((o) => o.split('.')[0] ?? '').filter((f) => f.length > 0));
+  const out = new Set<string>();
+  if (families.size === 0) return out;
+  const registry = readRegistry();
+  const owned = new Map<string, readonly string[]>();
+  for (const p of registry ?? []) {
+    if (typeof p.id === 'string') owned.set(p.id, Array.isArray(p.predicate?.families) ? (p.predicate.families as unknown[]).map(String) : []);
+  }
+  for (const id of profileIds) {
+    const ownsOne = (owned.get(id) ?? []).some((f) => families.has(f));
+    const namesOne = [...families].some((f) => id.includes(f));
+    if (ownsOne || namesOne) out.add(id);
+  }
+  return out;
+}
+
+/**
+ * The requirement whose FAILURE is an observed, undeclared relaxation.
+ *
+ * `conformance/README.md` said of `OPENWOP_HOST_RELAXATIONS` that "the suite
+ * cannot detect an undeclared one". For the egress guard that was never true:
+ * a host that ACCEPTS `https://127.0.0.1/…` as a webhook destination has shown
+ * on the wire that its guard is open (`webhooks.md`: "a host MUST reject (400
+ * webhook_url_rejected) … RFC 1918 and loopback and link-local ranges").
+ * `v2-webhook-egress-refusal` records that as `executed-fail` on this id unless
+ * the operator DECLARED the relaxation — in which case {@link profilesRelaxedBy}
+ * already denies the profile. Either way a profile built on `webhooks` does not
+ * certify on a host whose guard is open; this closes the path where it did,
+ * silently, because nobody declared anything.
+ */
+export const UNDECLARED_RELAXATION_WITNESSES: ReadonlyArray<{ readonly requirementId: string; readonly obligation: string }> = [
+  { requirementId: 'openwop.requirement.0171.webhook-egress-refused', obligation: 'webhooks.egress-guard' },
+];
+
+/** Profiles that MUST NOT certify because a row above is `executed-fail` in this bundle's own results. */
+export function profilesDeniedByObservedRelaxation(rows: ReadonlyArray<{ readonly id: string; readonly result: string }>, profileIds: readonly string[]): { readonly profiles: ReadonlySet<string>; readonly obligations: readonly string[] } {
+  const obligations = UNDECLARED_RELAXATION_WITNESSES.filter((w) => rows.some((r) => r.id === w.requirementId && r.result === 'executed-fail')).map((w) => w.obligation);
+  return { profiles: profilesRelaxedBy(obligations, profileIds), obligations };
+}

package/src/lib/webhook-receiver.ts

@@ -235,7 +235,26 @@ export async function discoverOwnedTenant(
  * "the host could not be exercised".
  */
 export function resolveRegistrationUrl(localUrl: string): { url: string; tunnelled: boolean } {
-  const raw = process.env.OPENWOP_WEBHOOK_RECEIVER_URL?.trim();
+  return resolvePublicFront('OPENWOP_WEBHOOK_RECEIVER_URL', localUrl);
+}
+
+/**
+ * The same rule, for ANY suite fixture the host under test must reach — the
+ * webhook receiver, the A2A fake peer, the MCP fake server. `envName` names the
+ * operator's public front for that one fixture; unset means the local address.
+ *
+ * Generalised in 2.33.0. Until then only the webhook receiver had a front, so a
+ * host that advertised `a2a` or `mcp` could be measured ONLY with its egress
+ * guard relaxed — those fakes advertised `http://127.0.0.1:<port>` and nothing
+ * else — and a relaxed guard is a relaxation the bundle must declare and cannot
+ * certify under (`security-defaults.md` §Relaxations). The two production hosts
+ * cut relaxation-free only because they advertise neither family. The rule made
+ * a host that implements MORE of the protocol LESS able to certify; found when
+ * the steward's own reference host turned out to be certifying under an
+ * undeclared one.
+ */
+export function resolvePublicFront(envName: string, localUrl: string): { url: string; tunnelled: boolean } {
+  const raw = process.env[envName]?.trim();
   if (!raw) return { url: localUrl, tunnelled: false };
 
   let parsed: URL;
@@ -243,7 +262,7 @@ export function resolveRegistrationUrl(localUrl: string): { url: string; tunnell
     parsed = new URL(raw);
   } catch {
     throw new Error(
-      `OPENWOP_WEBHOOK_RECEIVER_URL is not a valid URL: ${JSON.stringify(raw)}`,
+      `${envName} is not a valid URL: ${JSON.stringify(raw)}`,
     );
   }
 
@@ -252,7 +271,7 @@ export function resolveRegistrationUrl(localUrl: string): { url: string; tunnell
   // ALLOW_PRIVATE flag insufficient in the first place.
   if (parsed.protocol !== 'https:') {
     throw new Error(
-      `OPENWOP_WEBHOOK_RECEIVER_URL MUST be https: (got ${parsed.protocol}). ` +
+      `${envName} MUST be https: (got ${parsed.protocol}). ` +
         'A plain-http front cannot clear the scheme gate, so it cannot witness this scenario.',
     );
   }
@@ -272,13 +291,13 @@ export function resolveRegistrationUrl(localUrl: string): { url: string; tunnell
     /^(fc|fd)/.test(host);
   if (isLoopback || isPrivate) {
     throw new Error(
-      `OPENWOP_WEBHOOK_RECEIVER_URL MUST be a publicly-resolvable host (got ${parsed.hostname}). ` +
+      `${envName} MUST be a publicly-resolvable host (got ${parsed.hostname}). ` +
         'It is the PUBLIC front for the local receiver — a tunnel or TLS-terminating proxy — ' +
         'not the receiver address itself.',
     );
   }
 
-  return { url: raw, tunnelled: true };
+  return { url: envName === 'OPENWOP_WEBHOOK_RECEIVER_URL' ? raw : raw.replace(/\/+$/, ''), tunnelled: true };
 }
 
 /**

package/src/scenarios/a2a-1-0-agent-card.test.ts

@@ -62,7 +62,7 @@ describe('RFC 0152 — the suite peer speaks A2A 1.0 (dual-era A2AFakePeer)', ()
     expect(ifaces.map((i) => i.protocolVersion)).toEqual(['1.0', '0.3']);
     for (const i of ifaces) {
       expect(i.protocolBinding).toBe('JSONRPC');
-      expect(i.url.startsWith(peer.endpoint())).toBe(true);
+      expect(i.url.startsWith(peer.hostFacingEndpoint())).toBe(true);
     }
     expect(card['url'], req('openwop.it.a2a-1-0-agent-card.the-agent-card-is-1-0-shaped-supportedinterfaces-no-top-level-url-protocolversio', 'RFC 0152 §A/§B/§C/§D', '1.0 removed top-level url')).toBeUndefined();
     expect(card['protocolVersion'], req('openwop.it.a2a-1-0-agent-card.the-agent-card-is-1-0-shaped-supportedinterfaces-no-top-level-url-protocolversio', 'RFC 0152 §A/§B/§C/§D', '1.0 removed top-level protocolVersion (it is per interface)')).toBeUndefined();

package/src/scenarios/a2a-peer-authority.test.ts

@@ -64,7 +64,7 @@ describe('RFC 0152 §E — a2a-peer-no-authority-escalation (host as A2A client,
     peer.reset();
     peer.setNextPeerAssertsAuthority(true);
     const drive = await driver.post('/v1/host/sample/a2a/invoke', {
-      peerUrl: peer.endpoint(),
+      peerUrl: peer.hostFacingEndpoint(),
       scenario: 'peer-asserts-authority',
     });
     if (drive.status === 404 || drive.status === 403) {

package/src/scenarios/a2a-task-roundtrip.test.ts

@@ -66,7 +66,7 @@ function probePeer(): { url: string; isReal: boolean } | null {
   const real = process.env.OPENWOP_A2A_REAL_PEER_URL;
   if (real && real.length > 0) return { url: real.replace(/\/$/, ''), isReal: true };
   const fake = getA2AFakePeer();
-  if (fake) return { url: fake.endpoint(), isReal: false };
+  if (fake) return { url: fake.hostFacingEndpoint(), isReal: false };
   return null;
 }
 

package/src/scenarios/a2a-version-negotiation.test.ts

@@ -78,7 +78,7 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     const peer = getA2AFakePeer();
     if (peer === null) return softSkip('blocked', 'precondition not met — `peer === null` returned early (no fake peer wired in this run) (seam, prior step, or fixture unavailable)'); // no fake peer wired in this run
     peer.reset();
-    const drive = await driver.post('/v1/host/sample/a2a/invoke', { peerUrl: peer.endpoint() });
+    const drive = await driver.post('/v1/host/sample/a2a/invoke', { peerUrl: peer.hostFacingEndpoint() });
     if (drive.status === 404 || drive.status === 403) {
       // Seam absent. RFC 0148 §A: unobservable resolves to `blocked`, not a pass.
       expect(
@@ -114,7 +114,7 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     const preferred = caps?.preferredVersion;
     peer.reset();
     const drive = await driver.post('/v1/host/sample/a2a/invoke', {
-      peerUrl: peer.endpoint(),
+      peerUrl: peer.hostFacingEndpoint(),
       authenticated: true,
       peerOffersOnly: '0.3',
     });
@@ -151,7 +151,7 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     const peer = getA2AFakePeer();
     if (peer === null) return softSkip('blocked', 'precondition not met — `peer === null` returned early (seam, prior step, or fixture unavailable)');
     const drive = await driver.post('/v1/host/sample/a2a/invoke', {
-      peerUrl: peer.endpoint(),
+      peerUrl: peer.hostFacingEndpoint(),
       requestVersion: '99.0',
     });
     if (drive.status === 404 || drive.status === 403) return softSkip('blocked', 'precondition not met — `drive.status === 404 || drive.status === 403` returned early (seam, prior step, or fixture unavailable)');

package/src/scenarios/mcp-extension-opacity.test.ts

@@ -47,7 +47,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §D — mcp-extension-o
     if (server === null) return softSkip('blocked', 'the suite MCP fake server is not started in this run — the host-as-client leg cannot be driven');
     server.reset();
     server.setNextResultAssertsAuthority(true);
-    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint(), tool: 'echo', arguments: { text: 'opaque' }, scenario: 'extension-asserts-authority' });
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.hostFacingEndpoint(), tool: 'echo', arguments: { text: 'opaque' }, scenario: 'extension-asserts-authority' });
     if (drive.status === 404 || drive.status === 403) {
       // Advertised mcp-2026-07-28 but the invoke seam answered {drive.status}: not observable here.
       // Default mode records `blocked` (RFC 0148 §A); OPENWOP_REQUIRE_BEHAVIOR=true fails

package/src/scenarios/mcp-mrtr-roundtrip.test.ts

@@ -58,7 +58,7 @@ describe.skipIf(!process.env.OPENWOP_BASE_URL)('RFC 0153 §C — mcp-mrtr-roundt
     if (server === null) return softSkip('blocked', 'the suite MCP fake server is not started in this run — the client half cannot be driven');
     server.reset();
     const drive = await driver.post('/v1/host/sample/mcp/invoke', {
-      serverUrl: server.endpoint(),
+      serverUrl: server.hostFacingEndpoint(),
       tool: 'needs_input',
       clientCapabilities: { elicitation: {} },
       elicitationAnswer: { name: 'Ada' },

package/src/scenarios/mcp-tool-roundtrip.test.ts

@@ -179,7 +179,7 @@ function probeEndpoint(): { url: string; isReal: boolean } | null {
   const real = process.env.OPENWOP_MCP_REAL_SERVER_URL;
   if (real && real.length > 0) return { url: real.replace(/\/$/, ''), isReal: true };
   const fake = getMcpFakeServer();
-  if (fake) return { url: fake.endpoint(), isReal: false };
+  if (fake) return { url: fake.hostFacingEndpoint(), isReal: false };
   return null;
 }
 

package/src/scenarios/mcp-version-negotiation.test.ts

@@ -86,7 +86,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
     const server = getMcpFakeServer();
     if (server === null) return softSkip('blocked', 'precondition not met — `server === null` returned early (seam, prior step, or fixture unavailable)');
     server.reset();
-    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint() });
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.hostFacingEndpoint() });
     if (drive.status === 404 || drive.status === 403) {
       expect(
         drive.status,
@@ -125,7 +125,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
     if (server === null) return softSkip('blocked', 'precondition not met — `server === null` returned early (seam, prior step, or fixture unavailable)');
     const caps = await mcp();
     server.reset();
-    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.endpoint() });
+    const drive = await driver.post('/v1/host/sample/mcp/invoke', { serverUrl: server.hostFacingEndpoint() });
     if (drive.status === 404 || drive.status === 403) return seamAbsent(`host advertises mcp version negotiation but the invoke seam /v1/host/sample/mcp/invoke answered ${drive.status} — the host-as-client legs are unobservable (host-sample-test-seams.md)`);
     // it never advertised has made its own discovery document unreliable, which
     // is worse than advertising nothing — a consumer that read it made a
@@ -148,7 +148,7 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
     const server = getMcpFakeServer();
     if (server === null) return softSkip('blocked', 'precondition not met — `server === null` returned early (seam, prior step, or fixture unavailable)');
     const drive = await driver.post('/v1/host/sample/mcp/invoke', {
-      serverUrl: server.endpoint(),
+      serverUrl: server.hostFacingEndpoint(),
       requestVersion: '1999-01-01',
     });
     if (drive.status === 404 || drive.status === 403) return seamAbsent(`host advertises mcp version negotiation but the invoke seam /v1/host/sample/mcp/invoke answered ${drive.status} — the host-as-client legs are unobservable (host-sample-test-seams.md)`);

package/src/scenarios/v2-durability-recovery.test.ts

@@ -73,6 +73,7 @@ import { softSkip } from '../lib/soft-skip.js';
 import { pollUntilTerminal, scaledTimeoutMs } from '../lib/polling.js';
 import { req } from '../lib/requirement-ids.js';
 import { receiverBinding, resolveRegistrationUrl } from '../lib/webhook-receiver.js';
+import { watchForResumption, type Observation, type Watch } from '../lib/durability-watch.js';
 
 const FIXTURE = 'conformance-noop';
 const FAILURE_FIXTURE = 'conformance-failure';
@@ -156,7 +157,6 @@ async function waitBack(deadlineMs: number): Promise<number | null> {
  * minted for it is not failed for declining to re-emit `run.started`.
  */
 const RESTORED_TYPES = new Set(['workflow.restored', 'run.restored-from-snapshot']);
-interface Observation { readable: boolean; runStarted: number; nodeStarted: number; restored: number }
 async function observe(runId: string): Promise<Observation> {
   const events = await runEvents(runId);
   if (events === null) return { readable: false, runStarted: 0, nodeStarted: 0, restored: 0 };
@@ -214,26 +214,18 @@ async function declaredBoundMs(fired: unknown): Promise<{ ms: number; declared:
     : { ms: UNDECLARED_BOUND_FALLBACK_MS, declared: false };
 }
 
-interface Watch { resumedAfterMs: number | null; last: Observation; completedUnresumed: boolean; waitedMs: number }
 /**
- * Observe `runId` from the moment the service answers again until `resumed`
- * holds or `budgetMs` elapses. `completedUnresumed` latches if ANY observation
- * shows the run `completed` while `resumed` is still false — the item-11 defect
- * is a state a later observation can paper over, so it is checked at every read.
+ * Observe `runId` until `resumed` holds or `budgetMs` elapses. The loop itself —
+ * and the reason the STATUS is read before the LOG — lives in
+ * `lib/durability-watch.ts`, where the ordering is unit-tested without a host.
  */
-async function watchForResumption(runId: string, budgetMs: number, resumed: (o: Observation) => boolean): Promise<Watch> {
-  const t0 = Date.now();
-  let last: Observation = { readable: false, runStarted: 0, nodeStarted: 0, restored: 0 };
-  let completedUnresumed = false;
-  for (;;) {
-    last = await observe(runId);
-    const waitedMs = Date.now() - t0;
-    if (last.readable && resumed(last)) return { resumedAfterMs: waitedMs, last, completedUnresumed, waitedMs };
-    const snap = await driver.get(`/runs/${encodeURIComponent(runId)}`);
-    if ((snap.json as { status?: unknown } | null)?.status === 'completed' && !(last.readable && resumed(last))) completedUnresumed = true;
-    if (waitedMs >= budgetMs) return { resumedAfterMs: null, last, completedUnresumed, waitedMs };
-    await new Promise((r) => setTimeout(r, 500));
-  }
+function watch(runId: string, budgetMs: number, resumed: (o: Observation) => boolean): Promise<Watch> {
+  return watchForResumption({
+    readStatus: async () => { const snap = await driver.get(`/runs/${encodeURIComponent(runId)}`); const st = (snap.json as { status?: unknown } | null)?.status; return typeof st === 'string' ? st : null; },
+    readLog: () => observe(runId),
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+  }, budgetMs, resumed);
 }
 
 /**
@@ -293,7 +285,7 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
     // host's OWN declared bound elapses, never once at the instant of return.
     const bound = await declaredBoundMs(fired.json);
     const budget = Math.min(bound.ms, OBSERVATION_CEILING_MS);
-    const w = await watchForResumption(runId, budget, (o) => o.runStarted >= 1 || o.nodeStarted >= 1 || o.restored >= 1);
+    const w = await watch(runId, budget, (o) => o.runStarted >= 1 || o.nodeStarted >= 1 || o.restored >= 1);
     if (!w.last.readable) return softSkip('blocked', 'GET /runs/{runId}/events/poll did not answer after the restart — resumption is unobservable, and an unreadable log must not read as "nothing resumed"');
     if (w.resumedAfterMs === null && bound.ms > OBSERVATION_CEILING_MS) {
       return softSkip('blocked', `no dispatch observed in ${w.waitedMs}ms, but the host declares a ${bound.ms}ms recovery bound and this run observes for at most ${OBSERVATION_CEILING_MS}ms — a bound longer than the observation ceiling is conformant (§B.6) and is neither witnessed nor refuted here; the operator precondition for this row is OPENWOP_DURABILITY_OBSERVATION_CEILING_MS >= the declared bound`);
@@ -336,7 +328,7 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
     // further one, or the registry's own recovery event.
     const bound = await declaredBoundMs(fired.json);
     const budget = Math.min(bound.ms, OBSERVATION_CEILING_MS);
-    const w = await watchForResumption(runId, budget, (o) => o.runStarted > 1 || o.restored >= 1);
+    const w = await watch(runId, budget, (o) => o.runStarted > 1 || o.restored >= 1);
     if (!w.last.readable) return softSkip('blocked', 'GET /runs/{runId}/events/poll did not answer after the restart — resumption is unobservable, and an unreadable log must not read as "nothing resumed"');
     expect(
       w.completedUnresumed,

package/src/scenarios/v2-minimum-version-refused.test.ts

@@ -96,7 +96,7 @@ describe('RFC 0175 §D.2 — minimum-version-refused (gated on a2a/mcp + seams)'
     const peer = new A2AFakePeer({ protocolVersions: ['0.3'] });
     await peer.start();
     try {
-      const res = await driver.post(`${SEAMS_PREFIX}/sample/a2a/invoke`, { peerUrl: peer.endpoint(), authenticated: true, peerOffersOnly: A2A_LOWEST });
+      const res = await driver.post(`${SEAMS_PREFIX}/sample/a2a/invoke`, { peerUrl: peer.hostFacingEndpoint(), authenticated: true, peerOffersOnly: A2A_LOWEST });
       if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises a2a but ${SEAMS_PREFIX}/sample/a2a/invoke answered ${res.status} (host-sample-test-seams.md §22)`);
       await assertRefused('openwop.requirement.0175.minimum-version-refused', 'a2a', floor, res);
       // The wire leg: the host MUST NOT have spoken the below-floor version to the peer.
@@ -124,7 +124,7 @@ describe('RFC 0175 §D.2 — minimum-version-refused (gated on a2a/mcp + seams)'
     const server = new McpFakeServer({ protocolVersions: ['2025-06-18'] });
     await server.start();
     try {
-      const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, { serverUrl: server.endpoint(), requestVersion: MCP_LOWEST });
+      const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, { serverUrl: server.hostFacingEndpoint(), requestVersion: MCP_LOWEST });
       if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises mcp but ${SEAMS_PREFIX}/sample/mcp/invoke answered ${res.status} (host-sample-test-seams.md §23)`);
       await assertRefused('openwop.requirement.0175.minimum-version-refused.mcp', 'mcp', floor, res);
       for (const c of server.invocations()) {

package/src/scenarios/v2-mrtr-rounds-ceiling.test.ts

@@ -73,7 +73,7 @@ describe('RFC 0175 §E.1 — mrtr-rounds-ceiling (gated on mcp + mrtr)', () => {
     // input_required for `arguments.rounds` retries before completing.
     const rounds = (maxRounds as number) + 1;
     const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, {
-      serverUrl: server.endpoint(),
+      serverUrl: server.hostFacingEndpoint(),
       tool: LOOP_TOOL,
       arguments: { rounds },
       clientCapabilities: { elicitation: {} },

package/src/scenarios/v2-negotiation-authenticated.test.ts

@@ -99,7 +99,7 @@ describe('RFC 0175 §D.1 — negotiation-authenticated (gated on a2a/mcp + seams
     const peer = new A2AFakePeer({ protocolVersions: ['0.3'] });
     await peer.start();
     try {
-      const res = await driver.post(`${SEAMS_PREFIX}/sample/a2a/invoke`, { peerUrl: peer.endpoint(), authenticated: false, peerOffersOnly: A2A_LOWER });
+      const res = await driver.post(`${SEAMS_PREFIX}/sample/a2a/invoke`, { peerUrl: peer.hostFacingEndpoint(), authenticated: false, peerOffersOnly: A2A_LOWER });
       if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises a2a but ${SEAMS_PREFIX}/sample/a2a/invoke answered ${res.status} (host-sample-test-seams.md §22)`);
       const wire = peer.invocations().filter((i) => i.method !== 'GET').map((i) => String(i.headers['a2a-version'] ?? ''));
       await assertNotLowered('openwop.requirement.0175.negotiation-authenticated', preferred, A2A_LOWER, res, wire);
@@ -119,7 +119,7 @@ describe('RFC 0175 §D.1 — negotiation-authenticated (gated on a2a/mcp + seams
     const server = new McpFakeServer({ protocolVersions: ['2025-06-18'] });
     await server.start();
     try {
-      const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, { serverUrl: server.endpoint(), authenticated: false });
+      const res = await driver.post(`${SEAMS_PREFIX}/sample/mcp/invoke`, { serverUrl: server.hostFacingEndpoint(), authenticated: false });
       if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises mcp but ${SEAMS_PREFIX}/sample/mcp/invoke answered ${res.status} (host-sample-test-seams.md §23)`);
       const wire = server.invocations().map((i) => String(i.headers['mcp-protocol-version'] ?? ''));
       await assertNotLowered('openwop.requirement.0175.negotiation-authenticated.mcp', preferred, MCP_LOWER, res, wire);

package/src/scenarios/v2-negotiation-decided-emitted.test.ts

@@ -95,7 +95,7 @@ async function leg(protocol: 'a2a' | 'mcp', id: string): Promise<void> {
   const validate = payloadValidator();
   if (!validate) return softSkip('blocked', 'run-event-payloads.schema.json#/$defs/negotiationDecided not readable from SCHEMAS_DIR');
 
-  const driven = await drive(protocol, peer.endpoint());
+  const driven = await drive(protocol, peer.hostFacingEndpoint());
   if (!driven) return softSkip('blocked', 'invoke seam unavailable (reason recorded above)');
   const runId = driven.body['runId'];
   if (typeof runId !== 'string') {
@@ -117,11 +117,11 @@ async function leg(protocol: 'a2a' | 'mcp', id: string): Promise<void> {
       expect(
         p['peerDigest'],
         req(id, 'interop.md §The audit event', 'peerDigest MUST be the SHA-256 of the peer origin — never the origin in clear (RFC 0175 §D.3)'),
-      ).toBe(originDigest(peer.endpoint()));
+      ).toBe(originDigest(peer.hostFacingEndpoint()));
     }
     for (const v of Object.values(p)) {
       expect(
-        typeof v === 'string' && v.includes(new URL(peer.endpoint()).host),
+        typeof v === 'string' && v.includes(new URL(peer.hostFacingEndpoint()).host),
         req(id, 'interop.md §The audit event', 'the event is content-free: the peer origin MUST NOT appear in clear in any field'),
       ).toBe(false);
     }

package/src/scenarios/v2-relaxation-recorded.test.ts

@@ -28,6 +28,8 @@ import { generateKeyPairSync } from 'node:crypto';
 import { signBundleV3, verifyBundleV3, witnessDigest, type BundleV3, type BundleV3Relaxation } from '../lib/certification-bundle-v3.js';
 import { v2Validator } from '../lib/v2.js';
 import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { v2RegistryAvailable } from '../lib/v2-profiles.js';
 
 const host = generateKeyPairSync('ed25519');
 const hostPem = host.privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
@@ -38,7 +40,7 @@ const ROWS: BundleV3['results']['requirements'] = [
 ];
 
 /** A schema-valid, verifier-clean bundle v3; `relaxations` and the claimed profile vary per leg. */
-function bundle(opts: { relaxations?: BundleV3Relaxation[]; certified: boolean }): BundleV3 {
+function bundle(opts: { relaxations?: BundleV3Relaxation[]; certified: boolean; profileId?: string }): BundleV3 {
   const unsigned: Omit<BundleV3, 'signature'> = {
     bundleVersion: '3',
     generatedAt: '2026-09-03T00:00:00Z',
@@ -52,7 +54,7 @@ function bundle(opts: { relaxations?: BundleV3Relaxation[]; certified: boolean }
     },
     discovery: { url: 'https://fixture.invalid/.well-known/openwop', sha256: 'a'.repeat(64), protocolVersions: ['2.0'], preferredVersion: '2.0' },
     claimedProfiles: [
-      { id: 'openwop-webhooks', evidenceTier: 'self', witnessCount: 1, certified: opts.certified },
+      { id: opts.profileId ?? 'openwop-webhooks', evidenceTier: 'self', witnessCount: 1, certified: opts.certified },
       { id: 'openwop-discovery-core', evidenceTier: 'self', witnessCount: 1, certified: true },
     ],
     results: { totals: { executedPass: ROWS.length, executedFail: 0, skipped: 0, inapplicable: 0, blocked: 0 }, requirements: ROWS },
@@ -105,6 +107,39 @@ describe('RFC 0173 §A.2 — relaxation-recorded (unaided, fixture bundle)', ()
     ).not.toContain('relaxed-profile-certified');
   });
 
+  // Until 2.33.0 every leg above used the FIXTURE profile `openwop-webhooks`, and
+  // the verifier matched a relaxation to a profile by testing whether the profile
+  // ID contained the family name. No real v2 profile id contains one —
+  // `openwop-discovery-core`, `openwop-core-standard`,
+  // `openwop-conformance-seams-v2` — so on every real host a DECLARED relaxation
+  // denied nothing, and this file stayed green because its fixture was the one
+  // id the rule could match. Ownership is what `spec/v2/profiles.json` states:
+  // `openwop-core-standard`'s predicate is built on `webhooks`.
+  it('a relaxation denies the REAL profile that owns its family, not only one named after it', () => {
+    if (!v2RegistryAvailable()) return softSkip('inapplicable', 'spec/v2/profiles.json is absent from this layout — profile ownership cannot be read, so only the id-named arm of the rule can run');
+    const EGRESS: BundleV3Relaxation = { obligation: 'webhooks.egress-guard', durability: 'session', reason: 'conformance cut against loopback fixtures' };
+    const control = verifyBundleV3(bundle({ certified: true, profileId: 'openwop-core-standard' }));
+    expect(
+      control.certifiedProfiles,
+      req('openwop.requirement.0173.relaxation-recorded.owned-by-registry', 'security-defaults.md §Relaxations', 'control: with no relaxation recorded, the real profile certifies — so the rejection below is the relaxation\'s'),
+    ).toContain('openwop-core-standard');
+    const relaxed = verifyBundleV3(bundle({ relaxations: [EGRESS], certified: true, profileId: 'openwop-core-standard' }));
+    expect(
+      relaxed.rejections.find((r) => r.kind === 'relaxed-profile-certified')?.profile,
+      req('openwop.requirement.0173.relaxation-recorded.owned-by-registry', 'security-defaults.md §Relaxations', 'a relaxation on `webhooks.*` MUST deny `openwop-core-standard`, whose registry predicate is built on the `webhooks` family — ownership is read from spec/v2/profiles.json, never from the spelling of the profile id'),
+    ).toBe('openwop-core-standard');
+    expect(
+      relaxed.certifiedProfiles,
+      req('openwop.requirement.0173.relaxation-recorded.owned-by-registry', 'security-defaults.md §Relaxations', 'the owning profile is not certified, and a profile that does not own the family still is'),
+    ).toEqual(['openwop-discovery-core']);
+    // A family no claimed profile owns denies nothing — the relaxation is still recorded, which is the obligation.
+    const unowned = verifyBundleV3(bundle({ relaxations: [{ ...EGRESS, obligation: 'mcp.egress-guard' }], certified: true, profileId: 'openwop-core-standard' }));
+    expect(
+      unowned.certifiedProfiles,
+      req('openwop.requirement.0173.relaxation-recorded.owned-by-registry', 'security-defaults.md §Relaxations', 'a relaxation on a family outside every claimed profile\'s predicate is scoped to nothing claimed — it does not poison an unrelated profile'),
+    ).toContain('openwop-core-standard');
+  });
+
   it('durability is a closed set: session | deployment | persisted', () => {
     const validate = v2Validator('certification-bundle');
     const withDurability = (durability: string): unknown => {