@openwop/openwop-conformance 2.35.0 → 2.36.0

package/fixtures.md

@@ -50,6 +50,9 @@ All fixtures MUST advertise:
 | Approval (refine)                         | `conformance-approval-refine`                                                                   | RFC 0183 — refine resolution carries action + refineFeedback                                                        |
 | Approval (edit-accept)                    | `conformance-approval-edit-accept`                                                                 | RFC 0183 — edit-accept resolution carries action + editedArtifactData                                                        |
 | Clarification                             | `conformance-clarification`                                                                     | Verifies HITL clarification interrupt + resume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `completed` after resolve                                                           | unbounded (suspends)         |
+| Clarification (nested schema)             | `conformance-clarification-nested`                                                              | RFC 0199 §D.2(d) probe — an answer schema an MCP mount MUST NOT bridge in form mode                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `completed` after resolve                                                           | unbounded (suspends)         |
+| Clarification (sensitive field)           | `conformance-clarification-sensitive`                                                           | RFC 0199 §D.2(d) probe — `format: "password"`; form mode MUST be refused                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `completed` after resolve                                                           | unbounded (suspends)         |
+| Credential                                | `conformance-credential`                                                                        | RFC 0199 §C — one node declaring `auth { type: oauth2, provider: synthetic, scopes }`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `waiting-input` (credential interrupt), or the node fails without the facet          | unbounded (suspends)         |
 | Multi-node                                | `conformance-multi-node`                                                                        | Verifies edge ordering + per-node events                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `completed`                                                                         | ≤ 10s                        |
 | Idempotent                                | `conformance-idempotent`                                                                        | Verifies `Idempotency-Key` cache                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `completed`                                                                         | ≤ 5s                         |
 | Cancellable                               | `conformance-cancellable`                                                                       | Verifies `:cancel` endpoint mid-run                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `cancelled` after cancel                                                            | ≤ 60s (input-controlled)     |
@@ -105,6 +108,7 @@ All fixtures MUST advertise:
 | Orchestrator Terminate                    | `conformance-orchestrator-terminate`                                                            | Phase 5 / CO-3 — terminate decision is final                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `completed`                                                                         | ≤ 30s                        |
 | Orchestrator Low-Confidence               | `conformance-orchestrator-low-confidence`                                                       | Phase 5 / CP-1 — supervisor low-confidence suspend                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `waiting-approval` (suspends)                                                       | unbounded (suspends)         |
 | MCP Tool Roundtrip                        | `conformance-mcp-tool-roundtrip`                                                                | Track 6 — host invokes a tool on the conformance suite's synthetic MCP server; trust-boundary visibility in the event log. Node `core.conformance.mcp-invoke` is a **conformance-RESERVED** typeId (renamed 2026-08-17 from `core.ai.callPrompt` with a `config.mcp` shape that vendor pack-tier node never read — it requires `promptId` and ignores `config.mcp`, so the fixture could not execute as declared on the first host that shipped the vendor node): a host that consumes MCP MUST map it to its own MCP invoke bridge node and honour `config.mcp { tool, arguments }`; a host that does not consume MCP MUST NOT advertise this fixture (the host-mediated leg then records inapplicable) — the same treatment as `core.conformance.a2a-invoke`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `completed`                                                                         | ≤ 30s                        |
+| v2 `ctx.mcp` Client                       | `conformance-mcp-client`                                                                        | RFC 0204 — one `core.conformance.mcp-client` node (conformance-RESERVED) calls the host's `ctx.mcp.<method>` with the run's inputs and completes with `outputs.result` = the resolved value verbatim; a rejection fails the node with its code. See §"The `ctx.mcp` fixture (RFC 0204)" | `completed`, or `failed` (`not_found`) for an unknown `serverId` | ≤ 30s |
 | A2A Task Roundtrip                        | `conformance-a2a-task-roundtrip`                                                                | Track 6 — host consumes the conformance suite's synthetic A2A peer; covers drift points #3 (`AUTH_REQUIRED`) and #4 (`REJECTED`). Node `core.conformance.a2a-invoke` is a **conformance-RESERVED** typeId (renamed 2026-08-16 from `core.a2a.invoke`, a multi-segment `core.*` id no host shipped and the corpus never defined): a host that consumes A2A peers MUST map it to its A2A bridge node (a host-extension node — `a2a-integration.md` §"State projection"); a host that does not consume A2A MUST NOT advertise this fixture                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `failed` or `waiting-input` (per `driftScenario` input)                             | ≤ 30s                        |
 | WASM Pack Roundtrip                       | `conformance-wasm-pack-roundtrip`                                                               | RFC 0008 — invokes `vendor.openwop.rust-hello.greet` (loaded WASM pack); exercises required exports + at least one import                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `completed`                                                                         | ≤ 10s                        |
 | WASM Pack Memory-Cap Breach               | `conformance-wasm-pack-memory-cap-breach`                                                       | RFC 0008 §K — invokes the deliberately-misbehaving `vendor.openwop.misbehaving.memory-bomb` pack (allocates 1 GiB beyond the host's `memoryPagesMax`). Host MUST emit `cap.breached` with `kind: "wasm-memory"` and drive the run to terminal `failed`. Misbehaving pack lives at `openwop-examples:examples/packs/rust-misbehaving-memory/` (repo-qualified per the 2026-06 monorepo split — the `openwop-examples` sibling repo) and is fixture-only (NOT signed for registry publication).                                                                                                                                                             | `failed` (with `cap.breached`)                                                      | ≤ 10s                        |
@@ -480,6 +484,35 @@ Hosts that don't ship a BYOK SecretResolver MAY return `404` / `422` on the star
 
 ---
 
+## `conformance-artifact-emit` (RFC 0205 — an artifact the suite can read back)
+
+- **Purpose**: give `getArtifact` (`GET /runs/{runId}/artifacts/{artifactId}`) a target. No other fixture emits `artifact.created` with an id the suite can read (RFC 0205 register G2).
+- **Opt-in**: a host advertises the fixture in `fixtures[]` only when it implements `getArtifact`; an unadvertised fixture makes `v2-artifact-a2a-shape.test.ts` record `inapplicable`.
+- **Inputs**: none.
+- **Behavior**:
+  1. The single `conformance.artifact.emit` node produces one artifact of type `config.artifactType` whose JSON payload is `config.data`, and emits `artifact.created` with `artifactId`, `artifactType` and `nodeId`.
+  2. The run reaches `completed`.
+  3. `getArtifact` for that `artifactId` answers `200`. When the request's `Accept` prefers `application/a2a+json` and the host serves it, the body is an A2A `Artifact` (`schemas/v2/artifact.schema.json`) with that `artifactId`, carrying the payload as a `data` Part with `mediaType: application/json` (RFC 0205 §A.2).
+- **Timing**: ≤ 10s.
+
+## `conformance-credential` (RFC 0199 — the `credential` interrupt)
+
+- **Purpose**: give the `credential` interrupt, and RFC 0047 §C.3's fail-the-node default, one fixture. One `conformance.oauth.use` node declares `auth: { type: "oauth2", provider: "synthetic", scopes: ["openwop.read"] }`.
+- **Opt-in**: a host advertises the fixture only when it advertises `oauth` with the `synthetic` provider; unadvertised makes `v2-credential-interrupt` record `blocked`.
+- **Inputs**: none.
+- **Behavior**:
+  1. Run by a Subject with no credential for `synthetic`, the node either suspends on a `credential` interrupt (`oauth.credentialInterrupt` advertised — snapshot `waiting-input`, `CredentialData` carrying `provider`, `scopes`, `reason: "missing"` and an https host-owned `connectUrl`) or fails (RFC 0047 §C.3, unchanged).
+  2. The grant completes through `connectUrl` and the host's own callback; the host then resolves the interrupt itself with `{ outcome: "authorized" }` and the run continues.
+  3. A caller resolve of `authorized` while no credential resolves is `400 validation_error`; `declined` fails the node with `connector_auth_declined`.
+  4. After the `oauth/expire-refresh` seam (and a provider that refuses the refresh), a terminal refresh failure emits `connector.auth-expired` and then either suspends with `reason: "expired"` or fails the node with `connector_auth_expired`.
+- **Timing**: unbounded (it suspends).
+
+## `conformance-clarification-nested` / `conformance-clarification-sensitive` (RFC 0199 §D.2(d) probes)
+
+- **Purpose**: the two schemas an MCP server mount MUST NOT bridge in form mode — one whose answer is an object (not a flat primitive), one marked `format: "password"`. `v2-mcp-mount-map` calls them as tools with and without `elicitation.url` and asserts no `mode: "form"` appears, with the flat `conformance-clarification` as the positive control.
+- **Note**: the sensitive fixture exists to be REFUSED. Authoring a clarification that solicits credential material is itself forbidden (RFC 0199 §C.6); it ships only as the machine-checkable probe.
+- **Timing**: unbounded (they suspend).
+
 ## NodeModule registration
 
 The fixtures reference these typeIds:
@@ -493,11 +526,47 @@ The fixtures reference these typeIds:
 | `core.approvalGate`           | approval                                               | Call `ctx.interrupt({kind: 'approval', ...})`                                                                                                                                            |
 | `core.clarificationGate`      | clarification                                          | Call `ctx.interrupt({kind: 'clarification', ...})`                                                                                                                                       |
 | `conformance.requiresMissing` | capability-missing                                     | Declares `requires: ['conformance.never-provided']`; engine MUST refuse dispatch. Opt-in fixture registration is recommended so production deployments don't expose the fixture surface. |
+| `conformance.artifact.emit` | artifact-emit | Opt-in (RFC 0205). Produce one artifact of `config.artifactType` with payload `config.data`; emit `artifact.created` naming it; readable through `getArtifact`. |
+| `conformance.oauth.use` | credential | Opt-in (RFC 0199). Resolve the credential `config.auth` names for the run's Subject, refreshing host-side; no credential ⇒ a `credential` interrupt (with the facet) or a failed node. Never carries token material on any surface. |
 
 An OpenWOP-compliant server's NodeModule registry MUST include implementations for all six core typeIds before seeding fixtures. The `conformance.requiresMissing` fixture node is opt-in — see the row above.
 
 ---
 
+## Fixtures served over A2A and MCP (RFC 0208)
+
+Two suite requirements (COMPATIBILITY §2.3), not spec MUSTs, let the major-2 interop scenarios drive a host's own A2A interface and MCP mount with the fixtures above:
+
+- **A2A: one routed skill.** An A2A 1.0 `Message` carries no skill selector: the caller picks the agent, and the agent picks the skill. `v2-a2a-operation-map` therefore needs the JSONRPC interface the host's card lists to route exactly one skill, `conformance-approval` (skill id = workflowId, per the `a2a.card` `skills[]` row of `spec/v2/interop-map.json`). A card that lists another skill, or several, records `blocked` — the suite cannot choose one. A host routes a different workflow in production and points its interface at `conformance-approval` for a conformance cut.
+- **MCP: fixtures as tools.** `v2-mcp-mount-map` calls `conformance-noop`, `conformance-failure` and `conformance-approval` as tools on the mount `mcp.serverUrls[0]` names, each under its workflowId. A fixture missing from `fixtures[]` records `blocked` for the leg that calls it.
+- **MCP Tasks (RFC 0198).** `v2-mcp-tasks` also calls the approvers variant of the approval fixture (a host-defined approval gate whose `approversList` names a principal the suite's bearer is not, advertised under the id `v2-approver-enforced` names), `conformance-delay` (with `arguments.delayMs`) and `conformance-cancellable` (with `arguments.delayMs`) as tools, each under its workflowId, so the task, disconnect and SSE-cancel legs have a non-listed-approver, a short and a long run to drive. The disconnect and SSE-cancel legs also need `runList` with the `workflowId` filter, to find a run the client never received a handle for. A fixture missing from `fixtures[]` records `blocked` for the leg that calls it; without `runList` those two legs are `inapplicable`.
+
+---
+
+## The `ctx.mcp` fixture (RFC 0204)
+
+`conformance-mcp-client` is what `v2-mcp-client-results` drives. Its node `core.conformance.mcp-client` is conformance-RESERVED: a host that advertises `mcp.client` maps it to a node that calls its own `ctx.mcp` (`spec/v2/core/host-services.md` §`mcp`) and nothing else, and a host that does not MUST NOT advertise the fixture.
+
+- **Inputs.** `method` ∈ `callTool` | `listTools` | `readResource` | `serverHealth`; `serverId`; `name` and `arguments` (callTool); `cursor` (listTools); `uri` (readResource).
+- **Output.** The node's `node.completed.outputs.result` MUST be the resolved value verbatim (the v2 RunSnapshot carries no run outputs, so the observation path is the event log). A rejection fails the node, and `node.failed.error.code` is the rejection's code (`not_found` for an unknown `serverId`).
+- **Operator contract.** The host binds `serverId: "conformance"` to the suite's fake MCP server (`OPENWOP_MCP_FAKE_SERVER=true`; pin `OPENWOP_MCP_FAKE_SERVER_PORT`, or front it with `OPENWOP_MCP_FAKE_SERVER_URL`) and `"conformance.down"` to an address nothing answers. A binding that never reaches the suite's server records `blocked`.
+- **What the fake server serves** (2026-07-28 only): `structured-echo` (a fixed `CallToolResult` with `structuredContent` and the caller's `nonce` in `_meta`), `always-error` (`isError: true`, fixed `content[]`), `conformance_readonly_claim_<nonce>` (annotated `readOnlyHint: true`; the nonce is per suite process), and a six-tool `tools/list` paged 3 + 3 with `nextCursor`, `ttlMs`, `cacheScope: "private"`, `outputSchema` and `annotations`.
+
+RFC 0207's `v2-interop-trace-context` drives the same fixture twice more: its run-path carrier leg starts it with the suite's `traceparent` on `POST /runs`, and its `mcp-server-adopts-meta` leg calls it as a tool on the host's own MCP mount (a mount serves each advertised fixture under its workflowId) with `_meta.traceparent` and a different header, then reads which trace the run's outbound call to the fake server continued. A host whose mount does not list it falls back to the OTLP collector, else `inapplicable`.
+
+For `v2-tool-catalog-annotations`' unclassified-MCP leg, a host that advertises `toolCatalog.sources ∋ "mcp"` projects the same `conformance` server into `GET /tools`.
+
+---
+
+## The per-agent card pack (RFC 0202)
+
+`v2-a2a-agent-cards` reads the caller's `GET /agents`; it needs no workflow fixture. Two suite requirements (COMPATIBILITY §2.3), not spec MUSTs:
+
+- **SR-1 canaries.** A host that installs the `core.conformance.agent-pack` agent pack (the pack `conformance-agent-pack-install` names in `metadata.requiresInstalledPack`) gives at least one of its agents a system-prompt body containing `OPENWOP-CONFORMANCE-CANARY-0202-PROMPT` and a handoff schema (`hasHandoffSchemas: true`) containing `OPENWOP-CONFORMANCE-CANARY-0202-HANDOFF`. The `card-sr1` leg asserts neither string reaches that agent's card; it is `inapplicable` when the caller's inventory carries no routed agent of the pack, `blocked` when the agent declares no handoff schema.
+- **A tenant-B-only agent.** The `identical-refusal` leg needs an agent with an `a2aTenant` in the inventory of the tenant `OPENWOP_TEST_TENANT_B_API_KEY` binds, that the caller's inventory lacks. The suite finds it as the set difference of the two inventories, or takes `OPENWOP_TEST_TENANT_B_AGENT_ID`; without one the leg records `blocked`.
+
+---
+
 ## Versioning
 
 Each fixture's JSON has its own `version` field. The OpenWOP v1.0 conformance suite targets fixture version 1.0. Fixture spec breaking changes MUST bump the major; the suite MUST refuse to run against an unrecognized fixture version with a clear error message.
@@ -554,6 +623,30 @@ Negative manifests (credential material, mixed kinds, dual reach) are inline tes
 
 ---
 
+## Node-pack runtime fixtures
+
+The `fixtures/node-pack-runtime/` sub-directory holds v2 node-pack manifests for RFC 0203's `runtime.mcpServer` — the inline MCP Registry record a `language: "remote"` runtime may carry. They are read only by the corpus-coherence test `src/coherence/node-pack-mcp-server-record.test.ts` (spec-repo CI; never a host bundle) and validated server-free against `../schemas/v2/node-pack-manifest.schema.json`. None is seeded into a server. Every fixture is the RFC's positive example with one change, so each negative fails for its reason and nothing else (the test asserts every error sits under `/runtime`).
+
+| Fixture | Contract |
+| --- | --- |
+| `positive-rfc-example` | The RFC 0203 positive example, verbatim runtime. MUST validate; its `mcpServer` MUST validate against the vendored upstream schema. |
+| `positive-every-optional-member` | Adds every optional member (`$schema`, `title`, `websiteUrl`, `repository` with `id` + `subfolder`). Same contract. |
+| `negative-sse` | `remotes[0].type: "sse"`. MUST be refused (Streamable HTTP only). |
+| `negative-packages` | A `packages[]` install instruction. MUST be refused. |
+| `negative-headers` | `remotes[0].headers` carrying an `Authorization` value. MUST be refused. |
+| `negative-variables` | `remotes[0].variables` (an `isSecret` input). MUST be refused. |
+| `negative-http` | An `http://` remote URL. MUST be refused. |
+| `negative-templated-url` | `https://{tenant}.acme.example/mcp`. MUST be refused. |
+| `negative-two-remotes` | Two `remotes[]` entries. MUST be refused (exactly one). |
+| `negative-version-range` | `version: "^1.4.0"`. MUST be refused (exact SemVer). |
+| `negative-meta` | `_meta`. MUST be refused. |
+| `negative-icons` | `icons`. MUST be refused. |
+| `negative-non-remote-language` | `mcpServer` under `language: "wasm"`. MUST be refused by the schema's `if`/`else`; the same manifest without `mcpServer` validates. |
+| `negative-entry-mismatch` | `entry` ≠ `remotes[0].url`. Schema-valid (JSON Schema cannot compare two values); MUST be refused by the manifest validator (`src/lib/node-pack-runtime.ts`) with `pack_validation_failed`. |
+| `upstream/mcp-registry-server-2025-12-11.schema.json` | Byte-for-byte copy of `https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json`, sha256 `3fba09590c99f61735d234822279f4223fab9e300c0a81e81c91ab62a4114de0` (fetched 2026-09-22). The test fails if the bytes drift. Re-vendor only with an RFC that re-pins the subset (RFC 0203 G1). |
+
+---
+
 ## Trigger-event fixtures
 
 The `fixtures/trigger-events/` sub-directory holds canonical external-event ingestion documents (RFC 0099) used as schema-level proof points — validated server-free against `../schemas/trigger-event.schema.json` (`trigger-event-*`) and `../schemas/trigger-subscription-registration.schema.json` (`trigger-subscription-registration-*`) by the `fixtures-valid.test.ts` sweep + the `trigger-ingestion.test.ts` scenario. They are NOT seeded into a server.
@@ -569,8 +662,34 @@ Negative cases (cross-source sub-objects, raw attachment URLs, `Authorization` h
 
 ---
 
+## Interrupt-payload fixtures
+
+The `fixtures/interrupt-payloads/` sub-directory (suite 2.36.0) holds canonical `InterruptPayload` documents — the `ctx.interrupt(payload)` wire shape — validated server-free against BOTH `../schemas/suspend-request.schema.json` and `../schemas/v2/suspend-request.schema.json` by the `fixtures-valid.test.ts` sweep. They are NOT seeded into a server. They pin the per-kind binding of `data` to `kind` (`spec/v1/interrupt.md` §Per-kind payloads; `spec/v2/core/interrupt.md`): before 2.36.0 the `data` union was an unbound `oneOf`, so the minimal `conversation.start` and `conversation.close` payloads (both `{ conversationId }`) matched two branches and failed, while a payload whose `data` belonged to another kind passed (COMPATIBILITY.md §3, 2026-09-22).
+
+Unlike the other sub-directories, this one also carries **deliberately-invalid** files, prefixed `negative-`. The sweep asserts each is refused, and that its `data` validates under the kind the file name says it belongs to (`negative-<kind>-with-<data-kind>-data`), so a negative can only fail for the binding and never for being malformed on its own. The top-level `fixtures-valid.test.ts` workflow sweep reads the top level only, so these files never reach it.
+
+| Fixture                                                   | Expect  | Purpose |
+| --------------------------------------------------------- | ------- | ------- |
+| `interrupt-payload-approval`                              | valid   | Minimal `kind:"approval"` — the four required `ApprovalData` fields. |
+| `interrupt-payload-clarification`                         | valid   | Minimal `kind:"clarification"` — one question. |
+| `interrupt-payload-external-event`                        | valid   | Minimal `kind:"external-event"` — `eventType` + `correlation`. |
+| `interrupt-payload-custom`                                | valid   | Minimal `kind:"custom"` — `customKind` only (`payload` is optional in the schema). |
+| `interrupt-payload-conversation-start`                    | valid   | Minimal `kind:"conversation.start"` — `{ conversationId }` only. **Failed before 2.36.0** (matched `ConversationStartData` and `ConversationCloseData`). |
+| `interrupt-payload-conversation-exchange`                 | valid   | Minimal `kind:"conversation.exchange"` — `conversationId` + `prompt`. |
+| `interrupt-payload-conversation-close`                    | valid   | Minimal `kind:"conversation.close"` — `{ conversationId }` only. **Failed before 2.36.0**, same double match. |
+| `interrupt-payload-low-confidence`                        | valid   | Minimal `kind:"low-confidence"` — `agentId` + `threshold` + `observed`. |
+| `negative-approval-with-clarification-data`               | refused | `kind:"approval"` carrying `ClarificationData`. Passed before 2.36.0. |
+| `negative-conversation-start-with-conversation-exchange-data` | refused | `kind:"conversation.start"` carrying `ConversationExchangeData`. Passed before 2.36.0. |
+| `negative-conversation-close-with-conversation-start-data`    | refused | `kind:"conversation.close"` carrying a `ConversationStartData`-only field (`title`). Passed before 2.36.0. |
+| `negative-custom-with-conversation-start-data`            | refused | `kind:"custom"` carrying `{ conversationId }`. Refused before 2.36.0 too, but for the double match rather than the kind. |
+| `negative-low-confidence-with-custom-data`                | refused | `kind:"low-confidence"` carrying `CustomData`. Passed before 2.36.0. |
+
+---
+
 ## OAuth provider fixtures
 
+RFC 0199 adds `provider.issuer`, `provider.pkce` and the two issuer-less providers (`issuerlessProviders[]`) the distinct-redirect-URI leg needs; the endpoints a host actually talks to are supplied at run time by the `oauth/authorize-start` seam, which points them at the suite's authorization-server double (`src/lib/oauth-as-double.ts`).
+
 The `fixtures/oauth-providers/` sub-directory holds synthetic OAuth provider definitions used to prove the RFC 0047 `host.oauth` authorization-code roundtrip end-to-end **without a live IdP**. They are NOT `WorkflowDefinition`s and are NOT seeded as workflows — they parameterize the behavioral roundtrip scenario, which drives the host's `POST /v1/host/sample/oauth/authorize-code-roundtrip` seam against the provider's `authUrl`/`tokenUrl` (served by a conformance test double).
 
 | Fixture     | `provider.id` | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
@@ -603,6 +722,26 @@ Prompt-template fixtures are exercised by the server-free `fixtures-valid.test.t
 
 ---
 
+## A2UI v0.9 surface fixtures (RFC 0209)
+
+The `fixtures/a2ui-v09/` sub-directory (suite 2.36.0) holds `ui.a2ui-surface` payloads at per-kind **schema version 2** — ordered runs of A2UI v0.9 server-to-client messages in the OpenWOP profile of the basic catalog (`schemas/v2/envelopes/ui.a2ui-surface.schema.json` `$defs/payloadV2`; `spec/v2/ext/a2uiSurface/README.md`). They are NOT `WorkflowDefinition`s and are NOT seeded into a server. The corpus gate (`src/coherence/a2ui-v09-profile.test.ts`) validates the positive against the profile and each of its messages against the vendored upstream schemas; each negative must fail the profile AND pass a copy of the profile with only the restriction under test removed, so it can fail for no other reason. `v2-a2ui-v09-surface.test.ts` emits the positive through the v2 emit-surface seam. Like `interrupt-payloads/`, this directory carries deliberately-invalid `negative-` files; the top-level workflow sweep never reads sub-directories.
+
+| Fixture | Expect | Upstream A2UI | Purpose |
+| --- | --- | --- | --- |
+| `positive-approve-brief` | valid | valid | `createSurface` + `updateComponents` (`Column` root, `Text`, `TextField` with a `required` check, `DateTimeInput`, `ChoicePicker`, `CheckBox`, `Button` → `resume` with a bound `context`) + `updateDataModel`. |
+| `negative-functioncall-openurl` | refused | accepted | `Button.action` is the `functionCall` arm calling `openUrl` (`a2ui-action-confinement`). |
+| `negative-event-name-deleteall` | refused | accepted | `event.name: "deleteAll"`, outside `resume` / `exchange`. |
+| `negative-textfield-obscured` | refused | accepted | `TextField.variant: "obscured"` (`a2ui-surface-no-secret-input`). |
+| `negative-image-component` | refused | accepted | an `Image` component (URL fetch; `a2ui-surface-no-network-egress`). |
+| `negative-theme-iconurl` | refused | accepted | `createSurface.theme.iconUrl`. |
+| `negative-formatstring-label` | refused | accepted | a `Text.text` that is a `formatString` FunctionCall (`a2ui-surface-no-code-exec`). |
+| `negative-extra-property` | refused | refused | an `onClick` property on a component (closed objects). |
+| `negative-foreign-catalog` | refused | n/a | a `catalogId` outside the pinned basic catalog. |
+
+The `fixtures/upstream/a2ui-v0.9/` sub-directory vendors `server_to_client.json`, `catalogs/basic/catalog.json` and `common_types.json` from a2ui.org byte for byte, pinned by SHA-256 (RFC 0209 §References; its `README.md` records the URLs, fetch date and the Apache-2.0 notice). They are read only by the corpus gate.
+
+---
+
 ## References
 
 - `README.md` — conformance suite operator docs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.35.0",
+  "version": "2.36.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.35.0"
+    "@openwop/spec-artifacts": "2.36.0"
   }
 }