@openwop/openwop-conformance 2.33.2 → 2.34.1

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.33.2",
-  "corpusTag": "v2.33.0",
+  "version": "2.34.1",
+  "corpusTag": "v2.34.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "975b6cd87fa679857df9fcdc60b6a2bed98510b831e82a5eff5a114e3b263f6e",
-    "api/v2/asyncapi.yaml": "96ba13176119bbf54a94bd41d789ebaa919f67c81d529bdc3c66ffb3f419ee36",
-    "api/v2/openapi.yaml": "428ab881d0a8d08d388dd89d4b4457f3454cd0433b665674180d3e85821b978d",
+    "api/seams-v2.yaml": "d26d906b044e53fbb6ba742be90c853b9dcf14af4005bb6376e354d618fbdd5a",
+    "api/v2/asyncapi.yaml": "eda3679b6902a3ab931e2dab55a04f6b6bb2b9b664748de38d8a104e53e93c76",
+    "api/v2/openapi.yaml": "313fc72043a3730fbb98fdf47f4539773564bf9c5bed54f1f180efb50cf57410",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -116,7 +116,7 @@
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "e62d44f23c21c8f64b273fcdb083636e801c0de976cbd1f93333f99928dd1025",
-    "schemas/v2/certification-bundle.schema.json": "ab9204e37f9e0bba79857275cd38be2da98e54d26b4ecb97469829efe6ebea28",
+    "schemas/v2/certification-bundle.schema.json": "46a5a07670f2457bf1b7af8f6df1f4f76edb3ff7e64d1b6ed85738270c95668e",
     "schemas/v2/channel-presence-payload.schema.json": "1c20ad810cb311d47aa0b95d928490826b2468fd161f884cd29e867053e6782f",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "f7cf09b30d3e1d2251620d84ea9f65541438d015ab44aec10d1dcfe68d8bd496",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "65a8576c2e5ea9deb9d463be5b02a8bfb0e125a8dcbe3fe2cf286a4fd6d5d53e",
+    "spec/v1/core-standard-manifest.json": "0c1aaddf25eefbbe473d543067838a4a8eed8d3e5c00b55ce0ca98eabbc1ce66",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -215,7 +215,7 @@
     "spec/v1/spec-gaps.json": "eb3bfcb9c7d05c9a6845d4a40ec9493cfaa5a671932daf1af561310136fdabe8",
     "spec/v2/README.md": "8dbfc17b10f373dba95bdd2e8fec0580f35b380a834d304be3e24e7498170185",
     "spec/v2/core/capabilities.md": "4c4e5577caf4ae20c84fe59d580de4c6599e76783471d3b59f9730fc3807de71",
-    "spec/v2/core/conformance.md": "a451c0a2ba79d93c55e540ccef480eba7de9602d59bbb03eead05daafde0beac",
+    "spec/v2/core/conformance.md": "e5cb403f6ea6633eebc8ee4fa7bde5bf023bf4aee7c959b849e7105d37ab1f8b",
     "spec/v2/core/connection-packs.md": "466bdb9dde79d85615ad8281dacfb7bf923ca22d7fb3ed219749e59574c753ed",
     "spec/v2/core/conversation.md": "e425887c4ba199b8cdc5c99e792689f7bd7d46de492f28670de2e402fa6d9506",
     "spec/v2/core/errors.md": "0dff4a0ae102a86f6a17a9a3b16a203292588a0f422ed19d1c0d9213995aa01d",
@@ -229,7 +229,7 @@
     "spec/v2/core/interrupt.md": "3a926d84b942d4ee7daccc4443c93dc29f6a69f2936ba813182f2c1336db2cbb",
     "spec/v2/core/overview.md": "7dc00ace32d4e4ce929a383651f0029fc4b7091ec87487b1bf26ead1be209e0e",
     "spec/v2/core/packs.md": "1c0919059760f9a3940a93264a76b7e30f9a0f6f27ff19753cc88f15753d8088",
-    "spec/v2/core/persistence.md": "9e241f84259e38848f4a2ad1c21debb0dffd5f8aafbad26408aa6cc8969bf93b",
+    "spec/v2/core/persistence.md": "9785e536362ec2000dab7fee9847543240d40a907745efc70cf2c8b4c1b8344e",
     "spec/v2/core/replay.md": "b980a66e2543107240e3dc4f58131b9f4ff52478737e79ade6d5777b26ad1119",
     "spec/v2/core/runs.md": "136319842bacbbb300178980e4b83444917d5b193cc5fdd92e39a4902ba8d3c0",
     "spec/v2/core/security-defaults.md": "2a54ceaa4cef02c26ee0fbcf44f822ceeea79537c7d5a51ed300f21aa4fea576",
@@ -279,8 +279,8 @@
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "94a3ea302324d9f7df87ce62a186b0b98936de6ce5ac5ec01a3fb3208c38efc3",
+    "spec/v2/release.json": "eaf652e3a01f02a1d9c4eee7d7ea2c2a0396fe5694b5dce4cb01ca2af2891cc5",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "65e40d60fbf43b1a0cd95a58e63d7464ed944ddb"
+  "corpusCommit": "ffc0f6bf6bfe378c1e69f94386373687b15cfdb6"
 }

package/src/cli.ts

@@ -42,6 +42,7 @@ import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { SCHEMAS_DIR } from './lib/paths.js';
 import { readLedgerFile } from './lib/requirement-ledger.js';
+import { deriveRung, emittedByNewerSuite, type RowEvidence } from './lib/durability-evidence.js';
 import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest, type BundleV3, type BundleV3Requirement } from './lib/certification-bundle-v3.js';
@@ -658,7 +659,13 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       process.stderr.write('openwop-conformance --certify: a v3 bundle needs --host-build <kind>:<id> (or OPENWOP_HOST_BUILD), --signing-key <pem> (or OPENWOP_BUNDLE_SIGNING_KEY) and --signing-key-id (or OPENWOP_BUNDLE_SIGNING_KEY_ID) — an unsigned bundle does not exist in v3 (RFC 0168 §E.2).\n');
       process.exit(2);
     }
-    const rows3: BundleV3Requirement[] = derived.requirements.map((r) => ({ id: r.requirementId, scenario: r.scenarioId, result: r.disposition as BundleV3Requirement['result'], ...(r.assertionCount === undefined ? {} : { assertions: r.assertionCount }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+    const evidenceById = new Map<string, RowEvidence>();
+    for (const e of ledgerEntries) if (e.evidence !== undefined && e.disposition === 'executed-pass') evidenceById.set(e.requirementId, e.evidence);
+    const rows3: BundleV3Requirement[] = derived.requirements.map((r) => ({ id: r.requirementId, scenario: r.scenarioId, result: r.disposition as BundleV3Requirement['result'], ...(r.assertionCount === undefined ? {} : { assertions: r.assertionCount }), ...(r.detail === undefined ? {} : { detail: r.detail }),
+      // RFC 0158 §E: structured evidence rides on the ROW, so the witness digest —
+      // and through it the signature — covers it. Lifted from the raw ledger by
+      // requirement id, and only onto a row that is itself `executed-pass`.
+      ...(r.disposition === 'executed-pass' && evidenceById.has(r.requirementId) ? { evidence: evidenceById.get(r.requirementId) as RowEvidence } : {}) }));
     const totals3 = derived.totals;
     const doc3 = document as Record<string, unknown>;
     const protocolVersions = Array.isArray(doc3['protocolVersions']) ? (doc3['protocolVersions'] as string[]) : [String(doc3['protocolVersion'] ?? '')];
@@ -701,6 +708,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
     const lock = existsSync(lockPath) ? (JSON.parse(readFileSync(lockPath, 'utf8')) as { version: string; stampSha256: string }) : undefined;
     const nonPass = rows3.filter((r) => r.result !== 'executed-pass');
+    const rung3 = deriveRung(rows3);
+    if (rows3.some((r) => r.id.startsWith('openwop.requirement.0158.') && r.result === 'executed-pass' && r.id !== 'openwop.requirement.0158.poison-exhaustion')) {
+      process.stderr.write(`openwop-conformance --certify: RFC 0158 rung — ${rung3.rung ?? 'NONE'} (${rung3.why})\n`);
+    }
     const unsigned: Omit<BundleV3, 'signature'> = {
       bundleVersion: '3',
       generatedAt: new Date().toISOString(),
@@ -716,6 +727,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       witnessSha256: witnessDigest(rows3),
       assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
       ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
+      // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
+      // re-derives the same answer from the same signed rows, so an emitter that
+      // claimed more would be writing a bundle its own `--verify` rejects.
+      ...(rung3.rung === null ? {} : { durability: { rung: rung3.rung } }),
     };
     const signature = signBundleV3(unsigned, signingKeyPem, keyId);
     const v3: BundleV3 = { ...unsigned, signature };
@@ -942,6 +957,8 @@ async function main(): Promise<never> {
       `suite:     ${bundle.suite?.version ?? '?'} (this CLI is ${suiteVersion()})`,
       `totals:    executedPass=${t.executedPass ?? '?'} executedFail=${t.executedFail ?? '?'} blocked=${t.blocked ?? '?'} inapplicable=${t.inapplicable ?? '?'} skipped=${t.skipped ?? '?'}`,
       `certified: ${verdict.certifiedProfiles.length > 0 ? verdict.certifiedProfiles.join(', ') : '(none)'}`,
+      // RFC 0158 §D/§E: the rung is a CLAIM; a claim the signed rows do not support is a rejection below.
+      `rung:      ${bundle.durability?.rung ?? '(none claimed)'}`,
       '',
       'What this command does NOT do:',
       '  · It does not re-run anything. A host that measured itself wrongly, and signed',
@@ -952,6 +969,11 @@ async function main(): Promise<never> {
       '    an older bundle measured less, and whose fact that is belongs to its emitter.',
       '',
     ];
+    if (emittedByNewerSuite(bundle.suite?.version, suiteVersion())) {
+      out.push(`NOTE \u2014 this bundle was emitted by suite ${String(bundle.suite?.version)}, NEWER than this verifier (${suiteVersion()}).`,
+        '  A newer suite may digest row members this verifier does not know. If a `witness-digest`',
+        '  rejection follows, upgrade the verifier before reading it as tampering.', '');
+    }
     if (verdict.rejections.length > 0) {
       out.push(`REJECTED \u2014 ${verdict.rejections.length} problem(s):`);
       for (const r of verdict.rejections) out.push(`  [${r.kind}]${r.profile ? ` (${r.profile})` : ''} ${r.detail}`);

package/src/lib/certification-bundle-v3.ts

@@ -19,6 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify, type KeyObject } from 'node:crypto';
 import { profileDerivable, type DiscoveryPayload } from './profiles.js';
+import { checkRungClaim, type DurabilityRung, type RowEvidence } from './durability-evidence.js';
 import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 
 export type BundleV3Result = 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
@@ -29,6 +30,8 @@ export interface BundleV3Requirement {
   readonly result: BundleV3Result;
   readonly assertions?: number;
   readonly detail?: string;
+  /** RFC 0158 §E — structured evidence. Inside the witness digest, hence inside the signature. */
+  readonly evidence?: RowEvidence;
 }
 export interface BundleV3Profile {
   readonly id: string;
@@ -67,6 +70,8 @@ export interface BundleV3 {
   witnessSha256: string;
   assertionCount: number;
   detail?: { nonPass: { id: string; result: string; reason: string }[] };
+  /** RFC 0158 §D — a CLAIM, outside the signature and never trusted: the verifier re-derives it from the signed rows. */
+  durability?: { rung: DurabilityRung };
   signature: BundleV3Signature;
   verifierSignature?: { alg: 'ed25519'; keyId: string; sig: string };
 }
@@ -84,7 +89,9 @@ export function canonicalJSON(value: unknown): string {
 
 /** RFC 0148 §C — the digest over the reporter record (the requirement rows). */
 export function witnessDigest(rows: readonly BundleV3Requirement[]): string {
-  const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+  const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
+    // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
+    ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
   return createHash('sha256').update(canonicalJSON(canonicalRows), 'utf8').digest('hex');
 }
 
@@ -181,6 +188,11 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
   const relaxed = new Set((bundle.host?.relaxations ?? []).map((r) => r.obligation.split('.')[0]));
   // Ownership comes from the profile registry, not from the profile's name — see profilesRelaxedBy.
   const relaxedProfiles = profilesRelaxedBy((bundle.host?.relaxations ?? []).map((r) => r.obligation), (bundle.claimedProfiles ?? []).map((p) => p.id));
+  // RFC 0158 §D: a rung is CLAIMED at the top level, outside the signature, and
+  // is therefore only ever as good as its re-derivation from the signed rows.
+  const rung = checkRungClaim(bundle.durability?.rung, rows);
+  if (!rung.ok) rejections.push({ kind: 'rung-not-derivable', detail: rung.detail });
+
   // An OBSERVED relaxation nobody declared: the bundle's own results show the
   // host accepting a destination its egress guard MUST refuse. Same denial as a
   // declared one, so declaring nothing is not a way around the rule.

package/src/lib/durability-evidence.ts

@@ -0,0 +1,175 @@
+/**
+ * RFC 0158 §E — the rung and the recovery bound, IN THE BUNDLE.
+ *
+ * §E.10 mints no discovery capability: "a qualification ladder is evidence about
+ * behaviour that already exists, so the useful place for a rung and a recovery
+ * bound is the host's conformance evidence bundle — where a claim without
+ * evidence is already a defect." Until 2.34.0 that sentence had nothing behind
+ * it. `certification-bundle.schema.json` had no seat for a rung, a bound or its
+ * terms; a bundle showed five pass/fail rows, and a reader could neither tell
+ * which rung was claimed nor recompute the bound. The terms lived only on a
+ * non-normative seam route. Found by READING acceptance criterion 1 at the
+ * moment of flipping the RFC, with every row already green.
+ *
+ * ── Why the evidence rides on ROWS ───────────────────────────────────────────
+ * The attestation covers exactly `{ witnessSha256, host.build, suite.version,
+ * discovery.sha256 }` (`conformance.md` §Bundle v3), and `witnessSha256` digests
+ * the requirement rows. A top-level block would therefore be UNSIGNED — a bound
+ * or a rung editable after signing on a bundle that still verifies. Evidence
+ * carried on a row is inside the witness digest, and so inside the signature.
+ * It enters the digest ONLY WHEN PRESENT, so every bundle cut before 2.34.0
+ * digests byte-identically and still verifies (pinned against the three
+ * committed bundles in `durability-evidence.test.ts`).
+ *
+ * ── Why the rung claim is NOT trusted ────────────────────────────────────────
+ * `durability.rung` sits at the top level, outside the signature, and that is
+ * sound for the same reason `claimedProfiles[].certified` is: the verifier
+ * RE-DERIVES it from signed rows and rejects a claim it cannot derive. §D: "a
+ * host MAY claim a rung only with the evidence named for it."
+ *
+ * ── Why a kill row names its recovery CLASS ──────────────────────────────────
+ * Unresolved Question 1 resolved PER WORK CLASS, not a scalar. A host with an
+ * outbox lane (65 s) and a dispatch lease (750 s) has two bounds, so each kill
+ * row records `{ class, boundMs, observedMs }`: the class MUST name a declared
+ * entry, `boundMs` MUST equal that entry's `bound`, and `observedMs` MUST NOT
+ * exceed it.
+ *
+ * WHAT THAT CATCHES, and what it cannot. It refuses an undeclared class, a bound
+ * label that disagrees with its class, and a resumption outside the bound. It
+ * does NOT catch a host that names the WRONG DECLARED class while resuming
+ * inside that class's (longer) bound — which a tier-1 host actually shipped: the
+ * seam killed before the execution claim was held, the 65 s lane rescued the run
+ * in 11.6 s, and the exercise was labelled leased / 750 s, every row green. No
+ * arithmetic separates that from a fast leased recovery. What the evidence
+ * changes is that it becomes VISIBLE — 11.6 s recorded against a class whose own
+ * terms say 720 s of lease — where before nothing was recorded at all. Killing
+ * only once the claim is held stays the HOST's obligation (§E).
+ *
+ * `class` is an OPAQUE host-chosen string, never an enum: "leased" / "unleased"
+ * name one host's mechanisms and boot re-entry is another's. An enum would
+ * select for an architecture, which this RFC refuses to do everywhere else.
+ * There is NO scalar "overall bound": that is UQ1's lie by aggregation with a
+ * friendlier name, and a reader would use it.
+ *
+ * What this block proves: ARITHMETIC (Σ terms = bound) and, through the kill
+ * rows' `observedMs`, that the mechanism RAN at least once inside the bound.
+ * `bound-is-derived` alone remains a paper check and MUST NOT be cited for
+ * liveness.
+ */
+
+/** Host-chosen identifiers enter a PUBLISHED bundle: short, plain, no free text. */
+export const EVIDENCE_NAME_PATTERN = /^[a-z][A-Za-z0-9._-]{0,63}$/;
+export const MAX_RECOVERY_CLASSES = 16;
+export const MAX_TERMS_PER_CLASS = 16;
+
+export interface RecoveryTerm { readonly name: string; readonly ms: number }
+export interface RecoveryBound { readonly class: string; readonly bound: number; readonly terms: readonly RecoveryTerm[] }
+export interface RecoveryObservation { readonly class: string; readonly boundMs: number; readonly observedMs: number }
+/** Closed. One optional member per KIND of structured evidence a row may carry. */
+export interface RowEvidence { readonly recovery?: RecoveryObservation; readonly recoveryBounds?: readonly RecoveryBound[] }
+
+export type DurabilityRung = 'durable-single-instance' | 'durable-multi-instance' | 'multi-region-qualified';
+export const RUNGS: readonly DurabilityRung[] = ['durable-single-instance', 'durable-multi-instance', 'multi-region-qualified'];
+
+const R = 'openwop.requirement.0158.';
+/** The rows §Acceptance names for the lowest rung. */
+export const SINGLE_INSTANCE_ROWS: readonly string[] = ['kill-after-accept', 'kill-during-execution', 'duplicate-delivery', 'poison-exhaustion', 'bound-is-derived'].map((r) => R + r);
+const KILL_ROWS: readonly string[] = [R + 'kill-after-accept', R + 'kill-during-execution'];
+const BOUND_ROW = R + 'bound-is-derived';
+
+const isCount = (n: unknown): n is number => typeof n === 'number' && Number.isInteger(n) && n >= 0;
+const isName = (s: unknown): s is string => typeof s === 'string' && EVIDENCE_NAME_PATTERN.test(s);
+
+/** Normalise what a host's seam returned into bundle evidence, or say exactly why it cannot be. */
+export function parseRecoveryBounds(raw: unknown): { ok: true; bounds: RecoveryBound[] } | { ok: false; why: string } {
+  if (!Array.isArray(raw) || raw.length === 0) return { ok: false, why: 'no recovery classes were declared' };
+  if (raw.length > MAX_RECOVERY_CLASSES) return { ok: false, why: `more than ${MAX_RECOVERY_CLASSES} recovery classes` };
+  const bounds: RecoveryBound[] = [];
+  const seen = new Set<string>();
+  for (const entry of raw as Array<Record<string, unknown>>) {
+    const cls = entry?.['class'];
+    if (!isName(cls)) return { ok: false, why: `a recovery class name does not match ${String(EVIDENCE_NAME_PATTERN)}` };
+    if (seen.has(cls)) return { ok: false, why: `recovery class ${cls} is declared twice` };
+    seen.add(cls);
+    const terms = entry['terms'];
+    if (!Array.isArray(terms) || terms.length === 0 || terms.length > MAX_TERMS_PER_CLASS) return { ok: false, why: `class ${cls}: terms[] MUST carry 1..${MAX_TERMS_PER_CLASS} entries — a total alone cannot be recomputed` };
+    const clean: RecoveryTerm[] = [];
+    for (const t of terms as Array<Record<string, unknown>>) {
+      if (!isName(t?.['name']) || !isCount(t['ms'])) return { ok: false, why: `class ${cls}: every term is { name, ms } with ms a non-negative integer` };
+      clean.push({ name: t['name'] as string, ms: t['ms'] as number });
+    }
+    if (!isCount(entry['bound'])) return { ok: false, why: `class ${cls}: bound is a non-negative integer of milliseconds` };
+    const sum = clean.reduce((a, t) => a + t.ms, 0);
+    if (sum !== entry['bound']) return { ok: false, why: `class ${cls}: terms sum to ${sum} ms but the declared bound is ${String(entry['bound'])} ms — a host that states a bound its terms do not produce fails §B.5` };
+    bounds.push({ class: cls, bound: entry['bound'] as number, terms: clean });
+  }
+  return { ok: true, bounds };
+}
+
+interface Row { readonly id: string; readonly result: string; readonly evidence?: RowEvidence }
+
+/**
+ * The highest rung these SIGNED rows support, and — when it is lower than a
+ * reader might hope — the first reason why. Only `durable-single-instance` is
+ * derivable today: `peer-resume` is bundle-witnessed by a per-boot incarnation
+ * token this revision does not yet carry (§E), so a higher claim is REFUSED
+ * rather than waved through.
+ */
+export function deriveRung(rows: readonly Row[]): { rung: DurabilityRung | null; why: string } {
+  const byId = new Map(rows.map((r) => [r.id, r]));
+  for (const id of SINGLE_INSTANCE_ROWS) {
+    const row = byId.get(id);
+    if (row === undefined) return { rung: null, why: `${id} is absent from the bundle` };
+    if (row.result !== 'executed-pass') return { rung: null, why: `${id} is ${row.result}, not executed-pass` };
+  }
+  const declared = parseRecoveryBounds(byId.get(BOUND_ROW)?.evidence?.recoveryBounds);
+  if (!declared.ok) return { rung: null, why: `${BOUND_ROW} carries no usable evidence.recoveryBounds — ${declared.why}` };
+  const bounds = new Map(declared.bounds.map((b) => [b.class, b.bound]));
+  for (const id of KILL_ROWS) {
+    const obs = byId.get(id)?.evidence?.recovery;
+    if (obs === undefined) return { rung: null, why: `${id} passed but recorded no evidence.recovery — the class it exercised and the interval it observed are unknown` };
+    if (!isName(obs.class) || !isCount(obs.boundMs) || !isCount(obs.observedMs)) return { rung: null, why: `${id}: evidence.recovery is malformed` };
+    const bound = bounds.get(obs.class);
+    if (bound === undefined) return { rung: null, why: `${id} exercised recovery class "${obs.class}", which ${BOUND_ROW} does not declare (declared: ${[...bounds.keys()].join(', ')})` };
+    if (obs.boundMs !== bound) return { rung: null, why: `${id} was judged against ${obs.boundMs} ms but class "${obs.class}" declares ${bound} ms — the exercise was labelled with a bound that does not govern it` };
+    if (obs.observedMs > bound) return { rung: null, why: `${id} resumed after ${obs.observedMs} ms, outside the ${bound} ms bound of class "${obs.class}"` };
+  }
+  return { rung: 'durable-single-instance', why: 'all five rows executed-pass; each kill row names a declared class and resumed inside its bound' };
+}
+
+/** Is the rung a bundle CLAIMS supported by its own signed rows? */
+export function checkRungClaim(claimed: unknown, rows: readonly Row[]): { ok: true } | { ok: false; detail: string } {
+  if (claimed === undefined) return { ok: true };
+  if (typeof claimed !== 'string' || !(RUNGS as readonly string[]).includes(claimed)) return { ok: false, detail: `durability.rung ${JSON.stringify(claimed)} is not one of ${RUNGS.join(' | ')}` };
+  const derived = deriveRung(rows);
+  if (derived.rung === null) return { ok: false, detail: `durability.rung claims ${claimed}, but the signed rows do not support any rung: ${derived.why}` };
+  if (claimed !== derived.rung) return { ok: false, detail: `durability.rung claims ${claimed}, but the signed rows support only ${derived.rung} — a higher rung is bundle-witnessed by evidence this revision does not yet carry (RFC 0158 §E, peer-resume), so it is refused rather than assumed` };
+  return { ok: true };
+}
+
+/**
+ * Was this bundle cut by a NEWER suite than the verifier reading it?
+ *
+ * Row evidence enters the witness digest, so a verifier older than 2.34.0 that
+ * meets a bundle carrying it recomputes a different digest and reports
+ * `witness-digest` — it FAILS CLOSED, which is right, but the message reads as
+ * tampering when the truth is "upgrade the verifier". Every later digested
+ * member will repeat that. The notice is advice; it never changes a verdict.
+ */
+export function emittedByNewerSuite(bundleSuite: unknown, verifierSuite: string): boolean {
+  const parse = (v: unknown): number[] | null => {
+    const m = typeof v === 'string' ? /^(\d+)\.(\d+)\.(\d+)/.exec(v) : null;
+    return m === null ? null : [Number(m[1]), Number(m[2]), Number(m[3])];
+  };
+  const b = parse(bundleSuite); const mine = parse(verifierSuite);
+  if (b === null || mine === null) return false;
+  for (let i = 0; i < 3; i++) { if ((b[i] as number) !== (mine[i] as number)) return (b[i] as number) > (mine[i] as number); }
+  return false;
+}
+
+// ── the scenario → setup.ts → ledger channel ─────────────────────────────────
+let pending: RowEvidence | null = null;
+/** Called by a scenario inside an `it`; setup.ts attaches it to that test's ledger row. Later notes merge. */
+export function noteEvidence(evidence: RowEvidence): void { pending = { ...(pending ?? {}), ...evidence }; }
+/** setup.ts reads and clears it after each test. */
+export function takeNotedEvidence(): RowEvidence | null { const e = pending; pending = null; return e; }

package/src/lib/requirement-ledger.ts

@@ -16,6 +16,7 @@
  * That is the whole mechanism. Everything else here is bookkeeping.
  */
 
+import type { RowEvidence } from './durability-evidence.js';
 import { appendFileSync, readFileSync, existsSync } from 'node:fs';
 
 /** RFC 0148 §A. Exactly one of these per requirement, per run. */
@@ -66,6 +67,10 @@ export interface LedgerEntry {
    *  the row to a file and drops it — which is how every explicit requirement id
    *  went missing from bundle v3 while the per-`it` ids came through. */
   readonly scenarioFile?: string;
+  /** RFC 0158 §E — structured evidence the scenario noted for this row
+   *  (`durability-evidence.ts`). Recorded for `executed-pass` only: a row that
+   *  failed, blocked or skipped witnessed nothing to describe. */
+  readonly evidence?: RowEvidence;
 }
 
 const ledger = new Map<string, LedgerEntry>();
@@ -87,7 +92,7 @@ export function recordRequirement(
   requirementId: string,
   disposition: Disposition,
   detail?: string,
-  extras?: { assertionCount?: number; scenarioFile?: string },
+  extras?: { assertionCount?: number; scenarioFile?: string; evidence?: RowEvidence },
 ): void {
   const prior = ledger.get(requirementId);
   if (prior !== undefined && prior.disposition !== disposition) {
@@ -108,6 +113,7 @@ export function recordRequirement(
     ...(detail === undefined ? {} : { detail }),
     ...(extras?.assertionCount === undefined ? {} : { assertionCount: extras.assertionCount }),
     ...(extras?.scenarioFile === undefined ? {} : { scenarioFile: extras.scenarioFile }),
+    ...(extras?.evidence === undefined || disposition !== 'executed-pass' ? {} : { evidence: extras.evidence }),
   };
   ledger.set(requirementId, entry);
   journal.push(entry);

package/src/lib/scenario-disposition.ts

@@ -102,11 +102,14 @@ export function resolveItRecord(
   state: FileTestState,
   assertionCalls: number,
   gate: { disposition: 'inapplicable' | 'skipped'; detail?: string } | undefined,
-  noted: { kind: 'inapplicable' | 'skipped' | 'blocked'; reason: string } | null,
+  noted: { kind: 'inapplicable' | 'skipped' | 'blocked'; reason: string; conclusive?: true } | null,
   firstError?: string,
 ): { disposition: Disposition; detail?: string } {
   if (state === 'fail') return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
   if (state === 'pass' && assertionCalls > 0) {
+    // `blockedDespiteAssertions` (soft-skip.ts): the leg says its setup
+    // assertions are not the requirement, and the requirement went unobserved.
+    if (noted !== null && noted.kind === 'blocked' && noted.conclusive === true) return { disposition: 'blocked', detail: noted.reason };
     // A leg that asserted AND THEN soft-skipped is only a partial witness, and
     // the file-level record has always said so (`resolveFileRecord` below).
     // This `it`-level record dropped the note — and the `it`-level rows are the

package/src/lib/soft-skip.ts

@@ -43,7 +43,7 @@ export type SoftSkipKind = 'inapplicable' | 'skipped' | 'blocked';
 /** Detail marker the runner writes for a zero-assertion file that noted nothing. */
 export const UNCLASSIFIED_RETURN_DETAIL = 'every test returned early with zero assertions and no recorded reason — unclassified return; RFC 0148 §A resolves it to blocked (add softSkip(kind, reason) at the early return)';
 
-interface Note { readonly kind: SoftSkipKind; readonly reason: string; readonly seq: number }
+interface Note { readonly kind: SoftSkipKind; readonly reason: string; readonly seq: number; readonly conclusive?: true }
 
 const notes = new Map<string, Note[]>();
 let seq = 0;
@@ -83,15 +83,41 @@ export function seamAbsent(reason: string): undefined {
   return softSkip('blocked', reason);
 }
 
+/**
+ * `blocked` that STANDS even though the test already asserted something.
+ *
+ * A plain `softSkip` after an assertion records `executed-pass` with a
+ * `partial-witness:` detail (`resolveItRecord`): the acceptance predicate
+ * refuses such a row, but certification counts it as a pass. That is right for
+ * a leg that finished its requirement and skipped an optional extra. It is
+ * wrong for a leg whose REQUIREMENT went unobserved after setup assertions it
+ * could not avoid — a helper like `register()` asserts `201` before the leg has
+ * observed anything. Use this only there: the row records `blocked`, which
+ * denies certification (RFC 0168 §E.1) without convicting the host.
+ *
+ * Opt-in and per-call on purpose. Honouring every note-after-assertion as
+ * `blocked` would downgrade legs that legitimately completed; that is a suite-
+ * wide semantic change, not a patch. First use: `v2-webhook-durable-delivery`'s
+ * dead-letter leg when the retry window closes before exhaustion (2.34.1).
+ */
+export function blockedDespiteAssertions(reason: string): undefined {
+  const file = currentFile();
+  if (file === null) return undefined;
+  const arr = notes.get(file) ?? [];
+  arr.push({ kind: 'blocked', reason, seq: ++seq, conclusive: true });
+  notes.set(file, arr);
+  return undefined;
+}
+
 const RANK: Record<SoftSkipKind, number> = { blocked: 0, skipped: 1, inapplicable: 2 };
 
-function fold(arr: readonly Note[]): { kind: SoftSkipKind; reason: string } | null {
+function fold(arr: readonly Note[]): { kind: SoftSkipKind; reason: string; conclusive?: true } | null {
   if (arr.length === 0) return null;
   const uniq: Note[] = [];
   for (const n of arr) if (!uniq.some((u) => u.kind === n.kind && u.reason === n.reason)) uniq.push(n);
   const kind = [...uniq].sort((a, b) => RANK[a.kind] - RANK[b.kind])[0]!.kind;
   const reason = uniq.map((n) => (uniq.length > 1 ? `[${n.kind}] ${n.reason}` : n.reason)).join('; ');
-  return { kind, reason };
+  return uniq.some((n) => n.conclusive === true) ? { kind, reason, conclusive: true } : { kind, reason };
 }
 
 /**
@@ -113,7 +139,7 @@ export function softSkipMark(): number {
  * The noted disposition for a file counting only notes written AFTER `mark`
  * — the notes of the test that is ending. Same fold as the file rule.
  */
-export function softSkipDispositionSince(file: string, mark: number): { kind: SoftSkipKind; reason: string } | null {
+export function softSkipDispositionSince(file: string, mark: number): { kind: SoftSkipKind; reason: string; conclusive?: true } | null {
   return fold((notes.get(file) ?? []).filter((n) => n.seq > mark));
 }
 

package/src/lib/webhook-retry-window.ts

@@ -0,0 +1,56 @@
+/**
+ * How long a webhook scenario waits for a host's retry schedule to play out.
+ *
+ * The advertised `webhooks.retryPolicy` facet is closed over exactly
+ * `{ maxAttempts, backoff }`: a host has NO way to put its intervals on the
+ * wire, so the suite cannot derive how long exhaustion takes and has to choose
+ * a window. Every window it has chosen so far has convicted a durable host:
+ *
+ *   2.0.1   a hard 20 s failed a host whose first backoff was 30 s.
+ *   2.34.1  a hard 90 s cap fails a host retrying at 15 / 30 / 60 / 120 s with
+ *           `maxAttempts: 5` — attempts at t0, +15, +45, +105, +225 s. The
+ *           dead-letter leg read the sink ~120 s before that host exhausts, and
+ *           recorded `executed-fail` ("MUST be routed to the sink, not dropped")
+ *           about a host that delivers, retries five times and dead-letters
+ *           correctly. To pass it would have had to cut its PRODUCTION retry
+ *           window from ~225 s to ~75 s for every real subscriber. Reported by a
+ *           tier-2 host before it advertised the facet, from its own constants.
+ *
+ * An instrument must not choose a host's durability. So the cap is
+ * OPERATOR-RAISABLE — the shape `OPENWOP_DURABILITY_OBSERVATION_CEILING_MS`
+ * already has for RFC 0158's kill rows — and NEVER LOWERABLE: a value below the
+ * default, or not a number, is ignored, so no operator can shrink the window to
+ * hide a slow retry. A raised window is still bounded, so a host that never
+ * retries still fails; it only fails later.
+ */
+export const RETRY_WAIT_FLOOR_MS = 20_000;
+export const DEFAULT_RETRY_WAIT_CAP_MS = 90_000;
+/** A typo guard, not a policy: an hour per wait is longer than any retry schedule worth certifying in one sitting. */
+export const MAX_RETRY_WAIT_CAP_MS = 3_600_000;
+export const RETRY_WAIT_ENV = 'OPENWOP_WEBHOOK_RETRY_WAIT_MS';
+
+export function retryWaitCapMs(env: Record<string, string | undefined> = process.env): number {
+  const raw = Number(env[RETRY_WAIT_ENV]);
+  if (!Number.isFinite(raw) || raw < DEFAULT_RETRY_WAIT_CAP_MS) return DEFAULT_RETRY_WAIT_CAP_MS;
+  return Math.min(Math.floor(raw), MAX_RETRY_WAIT_CAP_MS);
+}
+
+/**
+ * The floor stays 20 s so a host that advertises nothing is measured exactly as
+ * before; an advertised `exponential` / `fixed` backoff widens it to the cap.
+ */
+export function retryWaitFor(policy: { backoff?: string } | null, capMs: number): number {
+  if (policy === null) return RETRY_WAIT_FLOOR_MS;
+  const backoff = String(policy.backoff ?? '');
+  return backoff === 'exponential' || backoff === 'fixed' ? capMs : RETRY_WAIT_FLOOR_MS;
+}
+
+/** What a row says when its window closed before the host's schedule did. Computed, so the numbers a host reads are the ones the run used. */
+export function windowClosedNote(seen: number, maxAttempts: number, waitedMs: number, capMs: number): string {
+  const raised = capMs > DEFAULT_RETRY_WAIT_CAP_MS;
+  return `${seen} of the advertised ${maxAttempts} attempts arrived inside the ${waitedMs}ms this scenario waits, and the delivery is not in the sink yet. `
+    + 'webhooks.retryPolicy carries only { maxAttempts, backoff } — no interval — so the suite cannot tell a slow conformant schedule from a host that stopped retrying, and it does not convict on a deadline it chose. '
+    + (raised
+      ? `${RETRY_WAIT_ENV} is already raised to ${capMs}ms; set it above the SUM of this host's backoff intervals (at most ${MAX_RETRY_WAIT_CAP_MS}ms).`
+      : `Set ${RETRY_WAIT_ENV} above the SUM of this host's backoff intervals (default ${DEFAULT_RETRY_WAIT_CAP_MS}ms; it can be raised, never lowered) and re-run.`);
+}