@openwop/openwop-conformance 2.34.2 → 2.35.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.35.1] — 2026-09-22 — the opt-out check could never fire on a real bundle
+
+- **RFC 0195 §3's `opted-out-but-advertised` rule, as shipped in 2.35.0, derived an empty set from every real bundle.** It read `openwop.profile.<name>` rows, and those rows never reach a bundle; the skipped rows that do named no profile. Measured on MyndHyve's committed 2.35.0 bundle, four declared opt-outs: `--verify` printed `opted out: (none)`. The rule's self-tests used synthetic rows that no real bundle contains — a check that cannot fail on the thing it exists to check.
+- **The opted-out name now rides on the signed per-test rows' detail** (`…via OPENWOP_OPTED_OUT_PROFILES: <name>`), and the verifier derives the set from that as well as from the old carrier. Measured on the reference host with `connections.packsSupported` opted out: the requirement rows a bundle carries (`0177.provider-conflict.*`) now name it. A regression test uses rows shaped exactly like the committed MyndHyve bundle and pins that they derive nothing without the name.
+- Bundles cut before 2.35.1 carry no names and derive an empty set — honest, not an error. RFC 0195 returns to `Active` until a committed bundle shows the rule deriving real opt-outs.
+- Suite patch; corpus release stays `2.35.0`.
+
+## [2.35.0] — 2026-09-21 — blocked means blocked, the declarations are signed, and the header a subscriber reads is checked
+
+### Security
+
+- **`v2-webhook-egress-refusal` (`0171.webhook-egress-refused`) now registers loopback, cloud metadata and RFC 1918 written as IPv4-mapped IPv6** — `https://[::ffff:7f00:1]/`, `https://[::ffff:a9fe:a9fe]/`, `https://[::ffff:a00:1]/` — eleven probes, up from eight. A URL parser emits the mapped form in hex (`[::ffff:127.0.0.1]` has hostname `::ffff:7f00:1`), and an egress guard that recognises only the dotted mapped form lets all three through at registration and at delivery. They are loopback, link-local and RFC 1918 addresses under `webhooks.md` §SSRF as written, so this enforces an existing MUST under the same id. Measured: the steward's reference host before its fix accepted exactly these three (`3 of 11`); after the fix, none.
+
+### Changed
+
+> **The three rules below are RFC 0195's.** They were merged before that RFC was filed; it was then made `Active` by steward override of RFC 0147 §A.6, whose full comment window it did not run.
+
+- **A `blocked` note stands at major 2 even after setup assertions.** A test that asserted something and then soft-skipped `blocked` recorded `executed-pass` with a `partial-witness:` detail — refused by the acceptance predicate, but counted by certification, so a profile could certify on a requirement nobody observed. At major 2 it now records `blocked`, which denies certification (`conformance.md` §Bundle v3). Swept first: every one of the 24 major-2 sites is "requirement unobserved" (unreachable, a control that did not answer, a window that closed), none an optional extra. Major 1 keeps its convention; the 146 v1-side sites were not measured and v1 bundles are read through its end of support. Measured on the committed bundles: the next cut changes 0 rows on the reference host and MyndHyve, 1 on openwop-app.
+- **`host.relaxations[]` is signed.** It sits outside the attestation, so a relaxation deleted after signing let the verifier re-derive the relaxed profile as certified on a bundle that still verified. `witnessSha256` now digests `{ rows, relaxations }` whenever relaxations are declared, and the rows alone otherwise — every committed bundle digests unchanged. An older verifier fails closed (`witness-digest`) on a 2.35.0 bundle that declares relaxations. `v2-relaxation-recorded` now strips a signed relaxation and requires the rejection.
+- **Opt-outs are derived and checked.** The verifier derives the operator's opt-outs from the signed `skipped` rows the behavior gate writes and rejects a bundle whose captured discovery document advertises one (`opted-out-but-advertised`); `--verify` prints the set. No schema change — a root-level list would have been unsigned. The file-level detail now says "profile or family".
+
+### Added
+
+- **`v2-terminal-event-once` — RFC 0194 (`0194.terminal-once`, `0194.terminal-once.duplicate-delivery`).** A run's log carries exactly one terminal run event and no forward-execution event after it; `compensation.*` and `run.dead-lettered` may follow. The ordinary leg drives a noop run, and the failure and cancellable fixtures where advertised; the duplicate-delivery leg needs the RFC 0158 durability test hook (`inapplicable` without it). The log is read after it settles. Pure rule in `lib/terminal-shape.ts`, unit-tested against the two logs observed in openwop#1445.
+- **`v2-callback-url-guarded` — RFC 0196 §A.3 (`0196.callback-url-guarded`), invariant `callback-url-egress-guarded`.** A host advertising `interrupt.callbackDelivery` must refuse at `createRun` a loopback, cloud-metadata or hex-mapped-loopback `callbackUrl` with `400 validation_error`, `details.field: callbackUrl`. `inapplicable` where the facet is absent — no committed host advertises it today.
+- **`0187.bound-id-kinds.webhook-emitted` (openwop#1450).** The mint row reads the `webhookId` a host returns; a subscriber identifies its deliveries by the one it emits. A tier-2 host bound the 201 and left the delivery headers bare, and the mint row stayed green — the defect surfaced only as a durability failure elsewhere. The new leg drives one delivery, selects it by the run in the body (never by the header under test), and requires `OpenWOP-Webhook-Id` — and `X-openwop-Webhook-Id` on a host advertising both majors — to equal the minted id.
+
+### Fixed
+
+- **`v2-bound-id-kinds` left a subscription behind on every run** (its `deliveryId` leg registered and never deleted). Every registering leg now deletes in `finally`. Measured: 1 leftover subscription per run before, 0 after.
+
 ## [2.34.2] — 2026-09-21 — a host that died on schedule failed the rows that were watching it recover
 
 - **The RFC 0158 kill rows read the host through two calls that did not survive the host dying.** `waitBack()` treated a refused connection as "down, keep waiting"; the watch's `readStatus` / `readLog` called `driver.get` bare. A seam may answer and *then* die — `during-execution` dies at the first `node.started`, seconds after its response — so `waitBack` saw a 200 from the still-living process, the process died mid-watch, and `fetch failed` escaped the scenario as an **`executed-fail` — for recovering.** Measured by a tier-1 host at its exact production image under a real restart supervisor, behind a port proxy that accepts and then closes: four of five rows `executed-fail` on `UND_ERR_SOCKET: other side closed`, reproduced twice; the one that passed was the row whose kill lands before the seam answers.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.34.2 @openwop/spec-artifacts@2.34.2
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.35.1 @openwop/spec-artifacts@2.35.1
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 524 scenario files under `src/scenarios/`.
+The current suite has 526 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -480,7 +480,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 524 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 526 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/coverage.md

@@ -144,7 +144,9 @@ The scenario groups in the table below (one row per group; count the rows — th
 | `tool-session-lifecycle.test.ts`                                                                                                                                                                                                                        | `capabilities.toolCatalog.sessionLifecycle` (RFC 0078 §D, `tool-catalog.md`)                                                                                                                                                                                                                                            | A (the §D bracket via `POST /v1/host/sample/tools/session-run` + the test event-log seam: `tool.session.opened` before the first RFC 0064 call event → `tool.session.closed` after the last, one shared `sessionId`, each carrying a `toolId`, `closed.outcome` ∈ {completed,failed,aborted,expired}, both content-free)                                                                                                                                                                                                                                                                                                                                                                            | `host-pending`                                                                                                                   | `behaviorGate('openwop-tool-session-lifecycle', …)`. Seam-gated; soft-skips on 404. **Part of the RFC 0078 → Accepted bar.** First adopter: MyndHyve `toolCatalog`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `egress-audience-binding.test.ts`                                                                                                                                                                                                                       | `capabilities.httpClient.egressPolicy.supported` (RFC 0079 §C, `host-capabilities.md`) + `SECURITY/invariants.yaml` `egress-credential-audience-bound`                                                                                                                                                                  | A (KEYSTONE — the §C confused-deputy MUST via `POST /v1/host/sample/egress/decide`: an out-of-audience egress is `denied`/`downgraded` with `reason:"out-of-audience"` and the credential is NOT attached (`credentialAttached !== true`); a provenance-unevaluable egress fails closed `denied`+`reason:"provenance-unevaluable"`; decision/reason ∈ the closed enums)                                                                                                                                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-egress-audience-binding', …)`. Seam-gated; soft-skips on 404. **This is the RFC 0079 → Accepted bar** (the `egress-credential-audience-bound` invariant graduates reference-impl → protocol tier when this passes against a host). First adopter: MyndHyve `httpClient.egressPolicy`.                                                                                                                                                                                                                                                                                                                            |
 | `egress-decision-content-free.test.ts`                                                                                                                                                                                                                  | `capabilities.httpClient.egressPolicy.supported` (RFC 0079 §F / SR-1)                                                                                                                                                                                                                                                   | A (the secret non-leak — a `canary` credential's sentinel never surfaces in the decision (`canaryLeaked !== true`), the `egress.decided` payload carries no forbidden content key, and `reason` stays in the CLOSED vocabulary so no blocked destination spills into a free-form field)                                                                                                                                                                                                                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-egress-decision-content-free', …)`. Seam-gated; soft-skips on 404. **Part of the RFC 0079 → Accepted bar.** First adopter: MyndHyve `httpClient.egressPolicy`.                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| `v2-webhook-egress-refusal.test.ts` | the `webhooks` family (capability-gated) | A (`webhooks.md` §SSRF at MAJOR 2 — eight registration probes, one per class the sentence names: non-`https`, IPv4/IPv6 loopback, `localhost`, two RFC 1918 ranges, link-local / cloud metadata, IPv6 ULA; each MUST answer `400 webhook_url_rejected`. Until 2.33.0 no major-2 row asserted the guard refuses anything — the refusal scenarios were major-1 only. THREE OUTCOMES: all refused → `executed-pass`; a probe accepted with a `webhooks.*` relaxation DECLARED in `OPENWOP_HOST_RELAXATIONS` → `inapplicable`, and the declared relaxation denies the owning profile; a probe accepted with NOTHING declared → `executed-fail`, which the emitter and verifier read as an OBSERVED undeclared relaxation and deny every profile built on `webhooks` (`undeclared-relaxation-observed`). Registration-time only: no probe is a destination the suite owns, nothing is delivered, an accepted registration is deleted at once) |
+| `v2-webhook-egress-refusal.test.ts` | the `webhooks` family (capability-gated) | A (`webhooks.md` §SSRF at MAJOR 2 — **eleven** registration probes since 2.35.0: the eight below plus loopback, cloud metadata and RFC 1918 written as IPv4-mapped IPv6, which a URL parser emits in HEX (`[::ffff:127.0.0.1]` has hostname `::ffff:7f00:1`) and a guard matching only the dotted mapped form lets through — same id, the same MUST. The original eight probes, one per class the sentence names: non-`https`, IPv4/IPv6 loopback, `localhost`, two RFC 1918 ranges, link-local / cloud metadata, IPv6 ULA; each MUST answer `400 webhook_url_rejected`. Until 2.33.0 no major-2 row asserted the guard refuses anything — the refusal scenarios were major-1 only. THREE OUTCOMES: all refused → `executed-pass`; a probe accepted with a `webhooks.*` relaxation DECLARED in `OPENWOP_HOST_RELAXATIONS` → `inapplicable`, and the declared relaxation denies the owning profile; a probe accepted with NOTHING declared → `executed-fail`, which the emitter and verifier read as an OBSERVED undeclared relaxation and deny every profile built on `webhooks` (`undeclared-relaxation-observed`). Registration-time only: no probe is a destination the suite owns, nothing is delivered, an accepted registration is deleted at once) |
+| `v2-terminal-event-once.test.ts` | none for the ordinary leg (every host has runs; the failed and cancelled fixtures are each gated on being advertised); the RFC 0158 durability test hook for the duplicate-delivery leg | A (RFC 0194 §A: a run's log carries exactly one terminal run event and no forward-execution event after it — `compensation.*` and `run.dead-lettered` may follow. The log is read after it SETTLES, two reads ≥ 2 s apart agreeing, bounded at 20 s, because a second delivery can finish after the first terminal event. Two ids: `0194.terminal-once`, `0194.terminal-once.duplicate-delivery`) | `host-pending` | A dedicated file on purpose: a violation must fail this RFC's rows, not unrelated ones. |
+| `v2-callback-url-guarded.test.ts` | the `interrupt` family with `interrupt.callbackDelivery: true` | A (RFC 0196 §A.3: `createRun` with a loopback, cloud-metadata or hex-mapped-loopback `callbackUrl` MUST answer `400 validation_error`, `details.field: callbackUrl`; invariant `callback-url-egress-guarded`) | `host-pending` | No committed host advertises the facet; witnessed on none today. |
 | `v2-durability-recovery.test.ts` | the RFC 0158 host-extension durability seam `POST /host/durability/kill` (non-normative; §E mints no capability field, so seam PRESENCE is how a host says it claims a rung) | A (all five `durable-single-instance` rows: `kill-after-accept` as a HOLD-DISPATCH exercise, `kill-during-execution` asserting that work executing at a real process death is never observable as completed without re-execution, `duplicate-delivery` counted AT THE EFFECT'S DESTINATION — a receiver the suite owns, `effectUrl` — because a ledger keyed on effect identity admits one row per identity by construction and cannot show a double-fire (2.32.0), `bound-is-derived` as an explicitly-labelled paper check, and `poison-exhaustion` ported from the major-1 scenario — at major 2 it reads the canonical JSON log read `GET /runs/{runId}/events/poll` (NOT `/events`, which is SSE-only at major 2 — reading it as JSON made this row pass vacuously on a host serving exactly the OpenAPI; 2.32.0), so unlike its v1 twin it needs NO seam and can never record `blocked` for want of one a host did not wire) | `host-pending` | **2.34.0 — the rows now WRITE evidence into the bundle (RFC 0158 §E):** `bound-is-derived` records `evidence.recoveryBounds[]` per recovery class and each kill row records `evidence.recovery { class, boundMs, observedMs }` — the interval was always measured and, on a pass, never recorded. Both ride on the ROW so the witness digest, and through it the signature, covers them; the bundle claims `durability.rung` only when `deriveRung` supports it and `--verify` rejects a claim it cannot re-derive (`rung-not-derivable`). A kill row records nothing unless the seam NAMES the class it exercised (`recoveryClass`) and the bound response declares that class — no name, no rung, rather than a guessed one. **Disposition rule, and it protects fleet certification:** no seam route at all ⇒ `inapplicable` (the host claims no rung); seam present but an operator precondition unmet — a restart supervisor, which a black-box suite cannot supply — ⇒ `blocked` with the precondition NAMED. Collapsing the two would deny certification to every host the day these rows entered the lane. `peer-resume` is deliberately NOT written: §E makes it bundle-witnessed, so a scenario could only ever record `blocked`. **This is the RFC 0158 → Accepted bar, and it is now complete at major 2** — before the port, a major-2 bundle could carry at most four of the five rows and the rung was unwitnessable no matter what a host did, and its witness is openwop-app, which the RFC records as having observed `kill-during-execution` across a real `SIGKILL`. |
 | `memory-degraded-projection.test.ts`                                                                                                                                                                                                                    | `capabilities.agents.manifestRuntime.supported` + `capabilities.memory.supported` (RFC 0080 §C, `agent-memory.md`)                                                                                                                                                                                                      | A (the §C iff-contract on the NORMATIVE `GET /v1/agents`: a degraded entry MUST carry `memoryDegraded:true` + a non-empty, unique `degradedMemoryDimensions[]` drawn from the closed §A-name enum [read/write/search/long-term-durability/compaction/attribution/replay-snapshot/retention]; a non-degraded entry MUST NOT carry a non-empty list; the inventory is non-empty; the degraded branch runs non-vacuously when `OPENWOP_DEGRADED_AGENT_ID` names a known-degraded agent)                                                                                                                                                                                                                | `host-pending`                                                                                                                   | `behaviorGate('openwop-memory-degraded', …)`. Black-box on the normative path (no POST seam); soft-skips on 404 / when the host computes no degradation. **This is the RFC 0080 → Accepted bar.** First adopter: MyndHyve `memory`.                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `budget-enforcement.test.ts`                                                                                                                                                                                                                            | `capabilities.budget.supported` (RFC 0084 §C/§D, `budget-policy.md`) + `SECURITY/invariants.yaml` `budget-no-pricing-leak`                                                                                                                                                                                              | A (the §C/§D enforcement via `POST /v1/host/sample/budget/run` + the test event-log seam: a `hard-cost-exhaust` run emits the strict-ordered `budget.reserved → budget.consumed → budget.threshold.crossed{percent} → budget.exhausted → cap.breached{kind:"budget-cost"} → run.failed{error:"budget_exhausted"}` chain; a `model-denied` run is refused `budget_model_denied` BEFORE the provider call (fail-closed); an `advisory` host emits the `budget.*` events without stopping; every `budget.*` payload content-free — no pricing/rate)                                                                                                                                                    | `host-pending`                                                                                                                   | `behaviorGate('openwop-budget-enforcement', …)`. Seam-gated; soft-skips on 404. **This is the RFC 0084 → Accepted bar.** First adopter: MyndHyve `budget`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |

package/dist/cli.js

@@ -697,7 +697,7 @@ async function runCertify(args, baseUrl, apiKey) {
             discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion, document },
             claimedProfiles: claimed3,
             results: { totals: totals3, requirements: rows3 },
-            witnessSha256: witnessDigest(rows3),
+            witnessSha256: witnessDigest(rows3, relaxations),
             assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
             ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
             // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
@@ -908,6 +908,8 @@ async function main() {
             `certified: ${verdict.certifiedProfiles.length > 0 ? verdict.certifiedProfiles.join(', ') : '(none)'}`,
             // RFC 0158 §D/§E: the rung is a CLAIM; a claim the signed rows do not support is a rejection below.
             `rung:      ${bundle.durability?.rung ?? '(none claimed)'}`,
+            // 2.35.0: derived from the signed `skipped` rows; checked against the signed discovery document.
+            `opted out: ${verdict.optedOut.length > 0 ? verdict.optedOut.join(', ') : '(none)'}`,
             '',
             'What this command does NOT do:',
             '  · It does not re-run anything. A host that measured itself wrongly, and signed',

package/dist/lib/certification-bundle-v3.js

@@ -31,12 +31,26 @@ export function canonicalJSON(value) {
     }
     return JSON.stringify(value);
 }
-/** RFC 0148 §C — the digest over the reporter record (the requirement rows). */
-export function witnessDigest(rows) {
+/**
+ * RFC 0148 §C — the digest over the reporter record (the requirement rows),
+ * and, from 2.35.0, the operator's declared relaxations when there are any.
+ *
+ * Why relaxations are in here: the attestation covers exactly
+ * `{ witnessSha256, host.build, suite.version, discovery.sha256 }`, so a
+ * `host.relaxations[]` beside the rows was UNSIGNED — strip it after signing
+ * and the verifier re-derives the relaxed profile as certified, on a bundle
+ * that still verifies. Included ONLY WHEN NON-EMPTY: the preimage is the rows
+ * array exactly as before for every bundle that declares nothing (all
+ * committed bundles digest unchanged, pinned in durability-evidence.test.ts),
+ * and `{ rows, relaxations }` otherwise. An older verifier fails closed on a
+ * 2.35.0 bundle that declares relaxations — `witness-digest`, never a pass.
+ */
+export function witnessDigest(rows, relaxations) {
     const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
         // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
         ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
-    return createHash('sha256').update(canonicalJSON(canonicalRows), 'utf8').digest('hex');
+    const preimage = relaxations !== undefined && relaxations.length > 0 ? { rows: canonicalRows, relaxations } : canonicalRows;
+    return createHash('sha256').update(canonicalJSON(preimage), 'utf8').digest('hex');
 }
 /** The bytes the attestation covers. */
 export function attestationPayload(b) {
@@ -58,6 +72,31 @@ export function verifierSign(bundle, privateKeyPem, keyId) {
 export function publicKeyFromPrivate(privateKeyPem) {
     return createPublicKey(createPrivateKey(privateKeyPem)).export({ type: 'spki', format: 'pem' });
 }
+const OPT_OUT_ROW = 'openwop.profile.';
+/** The opt-outs a bundle's signed rows record. */
+/**
+ * 2.35.1. The 2.35.0 version read only `openwop.profile.<name>` rows — which
+ * never reach a bundle — so on MyndHyve's real bundle (four declared opt-outs)
+ * it derived NOTHING, and `opted-out-but-advertised` could not fire: a rule
+ * pinned only by synthetic self-test rows. The name now rides on the signed
+ * per-test rows' detail (`…OPENWOP_OPTED_OUT_PROFILES: <name>`); both carriers
+ * are read. A bundle cut before 2.35.1 carries no names and derives an empty set.
+ */
+const OPT_OUT_DETAIL = /OPENWOP_OPTED_OUT_PROFILES: ([a-z][A-Za-z0-9_.-]*)/;
+export function optedOutFromRows(rows) {
+    const names = new Set();
+    for (const r of rows) {
+        if (r.result !== 'skipped')
+            continue;
+        const d = r.detail ?? '';
+        if (r.id.startsWith(OPT_OUT_ROW) && d.includes('OPENWOP_OPTED_OUT_PROFILES'))
+            names.add(r.id.slice(OPT_OUT_ROW.length));
+        const m = OPT_OUT_DETAIL.exec(d);
+        if (m)
+            names.add(m[1]);
+    }
+    return [...names].sort();
+}
 export function verifyBundleV3(bundle, opts = {}) {
     const rejections = [];
     if (bundle.bundleVersion !== '3')
@@ -78,9 +117,9 @@ export function verifyBundleV3(bundle, opts = {}) {
     for (const k of Object.keys(expected))
         if (bundle.results?.totals?.[k] !== expected[k])
             rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(bundle.results?.totals?.[k])} but the rows count ${expected[k]}` });
-    const digest = witnessDigest(rows);
+    const digest = witnessDigest(rows, bundle.host?.relaxations);
     if (bundle.witnessSha256 !== digest)
-        rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows (${digest.slice(0, 12)})` });
+        rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows and declared relaxations (${digest.slice(0, 12)})` });
     const assertions = rows.reduce((n, r) => n + (r.assertions ?? 0), 0);
     if (bundle.assertionCount !== assertions)
         rejections.push({ kind: 'assertion-count', detail: `assertionCount is ${String(bundle.assertionCount)} but the rows sum to ${assertions}` });
@@ -183,6 +222,21 @@ export function verifyBundleV3(bundle, opts = {}) {
             }
             else {
                 derivabilityChecked = true;
+                // RFC 0148 §B: "A host MUST NOT both advertise and opt out of the same
+                // profile." The suite refuses that at run time (behaviorGate throws),
+                // so a bundle that records both was edited after the run or emitted by
+                // something else. Both inputs are signed — the rows through
+                // witnessSha256, the document through discovery.sha256 — so the
+                // contradiction is checkable offline, and it is bundle-wide: an opt-out
+                // list that is false makes every `skipped` row in the bundle suspect.
+                const root = document;
+                for (const name of optedOutFromRows(rows)) {
+                    const advertised = name.startsWith('family.')
+                        ? (() => { const v = root[name.slice('family.'.length)]; return typeof v === 'object' && v !== null && !Array.isArray(v); })()
+                        : profileDerivable(document, name, targetMajor);
+                    if (advertised)
+                        rejections.push({ kind: 'opted-out-but-advertised', detail: `${name} is recorded as an operator opt-out, but the captured discovery document advertises it — a host MUST NOT both advertise and opt out of the same profile (RFC 0148 §B)` });
+                }
                 for (const p of bundle.claimedProfiles ?? []) {
                     // §B(1) binds the CERTIFICATION, not the listing: a profile a bundle
                     // names without certifying makes no claim for derivability to falsify.
@@ -209,5 +263,6 @@ export function verifyBundleV3(bundle, opts = {}) {
         verifierSignatureVerified,
         certifiedProfiles: bundleWide.length > 0 ? [] : certifiedProfiles.filter((p) => !scoped.has(p)),
         derivabilityChecked,
+        optedOut: optedOutFromRows(rows),
     };
 }

package/dist/lib/scenario-disposition.js

@@ -96,13 +96,27 @@ export const PARTIAL_WITNESS_PREFIX = 'partial-witness: ';
  * dishonest per-`it` rows denied certification to every profile on a host that
  * simply did not advertise the gated surface.
  */
-export function resolveItRecord(state, assertionCalls, gate, noted, firstError) {
+export function resolveItRecord(state, assertionCalls, gate, noted, firstError, 
+/**
+ * 2.35.0, major 2 (`conformance.md` §Bundle v3): a requirement the test did
+ * not observe records `blocked` even when the test asserted setup facts
+ * first. At major 1 a `blocked` note after assertions stays a
+ * `partial-witness` pass unless the leg used `blockedDespiteAssertions`.
+ *
+ * Why the rule changed: a `partial-witness` row is refused by the acceptance
+ * predicate but COUNTED by certification, so a profile could certify on a
+ * requirement nobody observed. Swept before the change: all 24 major-2
+ * sites were "requirement unobserved" (unreachable, control silent, window
+ * closed), none an optional extra. Scoped to major 2 because the 146 v1-side
+ * sites were not measured and v1 bundles are read through its EOS.
+ */
+blockedStands = false) {
     if (state === 'fail')
         return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
     if (state === 'pass' && assertionCalls > 0) {
         // `blockedDespiteAssertions` (soft-skip.ts): the leg says its setup
         // assertions are not the requirement, and the requirement went unobserved.
-        if (noted !== null && noted.kind === 'blocked' && noted.conclusive === true)
+        if (noted !== null && noted.kind === 'blocked' && (noted.conclusive === true || blockedStands))
             return { disposition: 'blocked', detail: noted.reason };
         // A leg that asserted AND THEN soft-skipped is only a partial witness, and
         // the file-level record has always said so (`resolveFileRecord` below).
@@ -141,14 +155,14 @@ export function fileDisposition(states, gateReason, assertionCount) {
             return { disposition: 'inapplicable', detail: 'every test returned early through behaviorGate with zero assertions: profile not advertised in the captured discovery set' };
         }
         if (assertionCount === 0 && gateReason === 'skipped') {
-            return { disposition: 'skipped', detail: 'every test returned early through behaviorGate with zero assertions: operator opted the profile out (OPENWOP_OPTED_OUT_PROFILES)' };
+            return { disposition: 'skipped', detail: 'every test returned early through behaviorGate with zero assertions: operator opted the profile or family out (OPENWOP_OPTED_OUT_PROFILES)' };
         }
         return { disposition: 'executed-pass' };
     }
     if (gateReason === 'inapplicable')
         return { disposition: 'inapplicable', detail: 'every test skipped: profile not advertised in the captured discovery set (behaviorGate)' };
     if (gateReason === 'skipped')
-        return { disposition: 'skipped', detail: 'every test skipped: operator opted the profile out (OPENWOP_OPTED_OUT_PROFILES)' };
+        return { disposition: 'skipped', detail: 'every test skipped: operator opted the profile or family out (OPENWOP_OPTED_OUT_PROFILES)' };
     return {
         disposition: 'blocked',
         detail: states.length === 0

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.34.2",
-  "stampSha256": "f4c6cce1906546565c17cc8c80b081aea9aff2d0a3338ad45d92b4836875d979"
+  "version": "2.35.1",
+  "stampSha256": "4b3e43f8c7b34b218c358dd8e8bbd8ca06b480346c58962abc297349937f5ae9"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.34.2",
+  "version": "2.35.1",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.34.2"
+    "@openwop/spec-artifacts": "2.35.1"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 582,
-    "tests": 2209,
-    "withStableId": 2209,
+    "files": 584,
+    "tests": 2213,
+    "withStableId": 2213,
     "interpolatedTitles": 0,
-    "explicitIds": 2163
+    "explicitIds": 2167
   },
   "records": [
     {
@@ -26009,7 +26009,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.subscriptionid-post-webhooks-mints-a-bound-webhookid-the-projected-segment-is-ac",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 61,
+      "line": 89,
       "title": "subscriptionId: POST /webhooks mints a bound webhookId, the projected segment is accepted, and a foreign tenant segment is refused 403",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.webhook",
       "citations": [
@@ -26033,10 +26033,29 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-bound-id-kinds.subscriptionid-the-webhookid-a-host-emits-on-a-delivery-is-the-one-it-minted",
+      "file": "v2-bound-id-kinds.test.ts",
+      "line": 132,
+      "title": "subscriptionId: the webhookId a host EMITS on a delivery is the one it minted",
+      "explicitId": "openwop.requirement.0187.bound-id-kinds.webhook-emitted",
+      "citations": [
+        {
+          "section": "webhooks.md §Headers (RFC 0187 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Headers (dual emission, RFC 0176 §D.2)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-bound-id-kinds.interruptid-the-id-a-suspension-puts-on-the-wire-is-bound",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 95,
+      "line": 179,
       "title": "interruptId: the id a suspension puts on the wire is bound",
       "explicitId": null,
       "citations": []
@@ -26044,7 +26063,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.effectid-every-row-get-runs-runid-effects-serves-is-bound",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 116,
+      "line": 200,
       "title": "effectId: every row GET /runs/{runId}/effects serves is bound",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.per-kind",
       "citations": [
@@ -26057,7 +26076,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.deliveryid-every-record-in-the-dead-letter-read-carries-a-bound-id-in-the-caller",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 131,
+      "line": 215,
       "title": "deliveryId: every record in the dead-letter read carries a bound id in the caller's tenant",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.per-kind",
       "citations": [
@@ -26184,6 +26203,23 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-callback-url-guarded.a-host-advertising-callback-delivery-refuses-a-callbackurl-its-egress-guard-woul",
+      "file": "v2-callback-url-guarded.test.ts",
+      "line": 36,
+      "title": "a host advertising callback delivery refuses a callbackUrl its egress guard would refuse",
+      "explicitId": "openwop.requirement.0196.callback-url-guarded",
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Callback delivery (RFC 0196 §A.3)",
+          "requirement": "a host advertising interrupt.callbackDelivery MUST refuse at createRun a callbackUrl the webhooks.md §SSRF registration guard would refuse"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Callback delivery (RFC 0196 §A.3)",
+          "requirement": "the refusal MUST be 400 validation_error naming details.field \"callbackUrl\""
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-capabilities-root-closed.the-host-document-validates-against-capabilities-schema-json",
       "file": "v2-capabilities-root-closed.test.ts",
@@ -28418,13 +28454,17 @@
         {
           "section": "security-defaults.md §Relaxations",
           "requirement": "a relaxation recorded against an unclaimed profile is not a rejection — recording is the obligation, claiming is the defect"
+        },
+        {
+          "section": "conformance.md §Bundle v3",
+          "requirement": "a relaxation removed after signing MUST be detected — the declaration is covered by witnessSha256, so the stripped bundle fails `witness-digest`"
         }
       ]
     },
     {
       "id": "openwop.it.v2-relaxation-recorded.a-relaxation-denies-the-real-profile-that-owns-its-family-not-only-one-named-aft",
       "file": "v2-relaxation-recorded.test.ts",
-      "line": 118,
+      "line": 130,
       "title": "a relaxation denies the REAL profile that owns its family, not only one named after it",
       "explicitId": "openwop.requirement.0173.relaxation-recorded.owned-by-registry",
       "citations": [
@@ -28449,7 +28489,7 @@
     {
       "id": "openwop.it.v2-relaxation-recorded.durability-is-a-closed-set-session-deployment-persisted",
       "file": "v2-relaxation-recorded.test.ts",
-      "line": 143,
+      "line": 155,
       "title": "durability is a closed set: session | deployment | persisted",
       "explicitId": "openwop.requirement.0173.relaxation-recorded.durability-closed",
       "citations": [
@@ -29253,6 +29293,46 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-terminal-event-once.every-run-observed-to-a-terminal-state-has-exactly-one-terminal-event-and-no-for",
+      "file": "v2-terminal-event-once.test.ts",
+      "line": 71,
+      "title": "every run observed to a terminal state has exactly one terminal event and no forward execution after it",
+      "explicitId": "openwop.requirement.0194.terminal-once",
+      "citations": [
+        {
+          "section": "spec/v2/core/events.md §The terminal event (RFC 0194 §A)",
+          "requirement": "a run's log MUST contain exactly one terminal run event and no forward-execution event after it"
+        },
+        {
+          "section": "spec/v2/core/events.md §The terminal event (RFC 0194 §A)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-terminal-event-once.work-delivered-twice-still-leaves-one-terminal-event-and-no-forward-execution-af",
+      "file": "v2-terminal-event-once.test.ts",
+      "line": 99,
+      "title": "work delivered twice still leaves one terminal event and no forward execution after it",
+      "explicitId": "openwop.requirement.0194.terminal-once.duplicate-delivery",
+      "citations": [
+        {
+          "section": "spec/v2/core/events.md §The terminal event (RFC 0194 §A)",
+          "requirement": "under a duplicate delivery the log MUST still contain exactly one terminal run event and no forward-execution event after it"
+        },
+        {
+          "section": "spec/v2/core/events.md §The terminal event (RFC 0194 §A)",
+          "requirement": "the redelivered run's log reached a terminal event"
+        },
+        {
+          "section": "spec/v2/core/events.md §The terminal event (RFC 0194 §A)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-unmapped-type-refused.poll-over-a-log-with-an-unmapped-unprefixed-type-fails-with-500-event-type-unmap",
       "file": "v2-unmapped-type-refused.test.ts",
@@ -29603,7 +29683,7 @@
     {
       "id": "openwop.it.v2-webhook-egress-refusal.a-webhook-registration-naming-a-destination-the-guard-must-refuse-is-refused-400",
       "file": "v2-webhook-egress-refusal.test.ts",
-      "line": 82,
+      "line": 92,
       "title": "a webhook registration naming a destination the guard MUST refuse is refused 400 webhook_url_rejected",
       "explicitId": "openwop.requirement.0171.webhook-egress-refused",
       "citations": [

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 524,
+    "files": 526,
     "v1": 445,
-    "v2": 81
+    "v2": 83
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1253,6 +1253,9 @@
     "v2-bundle-v3-signed.test.ts": [
       2
     ],
+    "v2-callback-url-guarded.test.ts": [
+      2
+    ],
     "v2-capabilities-root-closed.test.ts": [
       2
     ],
@@ -1445,6 +1448,9 @@
     "v2-subject-link-record.test.ts": [
       2
     ],
+    "v2-terminal-event-once.test.ts": [
+      2
+    ],
     "v2-unmapped-type-refused.test.ts": [
       2
     ],