@openwop/openwop-conformance 2.37.1 → 2.39.0

package/src/lib/jcs.ts

@@ -0,0 +1,229 @@
+/**
+ * RFC 0212 — canonical JSON is RFC 8785 (JCS), and the input MUST be I-JSON.
+ *
+ * Every signature and digest in the corpus is over these bytes: pack
+ * signatures (`ed25519-canonical-json`), the certification-bundle attestation,
+ * `discovery.sha256`, `witnessSha256`, and the RFC 0150 semantic request digest.
+ * `conformance/vectors/jcs-v1.json` is the normative test of this module and of
+ * any other-language implementation.
+ *
+ * Two entry points, because two of the refusals are invisible after a parse:
+ *
+ *   - `canonicalJSON(value)` — the VALUE boundary. Refuses what a native value
+ *     can still show: non-finite numbers, non-JSON values (undefined, functions,
+ *     bigint, symbols, class instances such as Date) and lone surrogates.
+ *   - `parseIJson(text)` — the TEXT boundary. `JSON.parse` keeps the last of two
+ *     duplicate names and rounds `9007199254740993` to `…992` silently; both are
+ *     refused here, before coercion. Read a document you will re-canonicalize
+ *     through this, not `JSON.parse`.
+ *
+ * Why not `Object.keys(v).sort()` + `JSON.stringify` with no checks (the code
+ * this replaces): it is JCS for well-formed input — the default sort IS UTF-16
+ * code-unit order and ES number/string serialization IS JCS §3.2.2 — but it
+ * turns NaN into `null`, emits the text `undefined`, and signs a rounded
+ * integer. Each of those is a document two verifiers read differently with no
+ * error on either side.
+ */
+
+export type JcsRefusalKind = 'duplicate-name' | 'lone-surrogate' | 'integer-out-of-range' | 'non-finite' | 'not-json';
+
+export class JcsRefusal extends Error {
+  readonly kind: JcsRefusalKind;
+  constructor(kind: JcsRefusalKind, message: string) {
+    super(`RFC 0212 §B refusal (${kind}): ${message}`);
+    this.name = 'JcsRefusal';
+    this.kind = kind;
+  }
+}
+
+/** A JSON number literal, matched in place (sticky) so parsing stays linear. */
+const NUMBER = /-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/y;
+
+/** ±(2^53 − 1), for the integer-literal refusal at the text boundary. */
+const MAX_EXACT_BIG = 2n ** 53n - 1n;
+
+/**
+ * RFC 8785 §3.2.3 — compare by UTF-16 code units. Explicit rather than the
+ * `Array.prototype.sort` default so the rule is visible at every call site, and
+ * never `localeCompare`: collation is locale-dependent (Czech sorts `ch` after
+ * `h`; English puts `a` before `A` and ignores `-`), so a digest computed with
+ * it depends on the machine that computed it.
+ */
+export function codeUnitCompare(a: string, b: string): number {
+  const n = Math.min(a.length, b.length);
+  for (let i = 0; i < n; i += 1) {
+    const d = a.charCodeAt(i) - b.charCodeAt(i);
+    if (d !== 0) return d;
+  }
+  return a.length - b.length;
+}
+
+function assertWellFormed(s: string, where: string): void {
+  for (let i = 0; i < s.length; i += 1) {
+    const u = s.charCodeAt(i);
+    if (u >= 0xd800 && u <= 0xdbff) {
+      const next = s.charCodeAt(i + 1);
+      if (next >= 0xdc00 && next <= 0xdfff) { i += 1; continue; }
+      throw new JcsRefusal('lone-surrogate', `lone high surrogate U+${u.toString(16).toUpperCase()} in ${where}`);
+    }
+    if (u >= 0xdc00 && u <= 0xdfff) throw new JcsRefusal('lone-surrogate', `lone low surrogate U+${u.toString(16).toUpperCase()} in ${where}`);
+  }
+}
+
+function serializeNumber(n: number): string {
+  if (!Number.isFinite(n)) throw new JcsRefusal('non-finite', `${String(n)} is not a JSON number`);
+  // No magnitude check here: a double is already exact, and JCS serializes it
+  // (RFC 8785 Appendix B includes 9007199254740994). The integer-range refusal
+  // is about a LITERAL that no double holds, which only the text shows — see
+  // `parseIJson`.
+  return Object.is(n, -0) ? '0' : String(n);
+}
+
+function isPlainObject(v: object): boolean {
+  const proto = Object.getPrototypeOf(v) as unknown;
+  return proto === Object.prototype || proto === null;
+}
+
+/** RFC 8785 serialization of an I-JSON value. Throws `JcsRefusal` instead of coercing. */
+export function canonicalJSON(value: unknown): string {
+  if (value === null) return 'null';
+  switch (typeof value) {
+    case 'boolean': return value ? 'true' : 'false';
+    case 'number': return serializeNumber(value);
+    case 'string': assertWellFormed(value, 'a string'); return JSON.stringify(value);
+    case 'object': break;
+    default: throw new JcsRefusal('not-json', `a ${typeof value} is not a JSON value`);
+  }
+  if (Array.isArray(value)) {
+    const parts: string[] = [];
+    for (let i = 0; i < value.length; i += 1) {
+      if (!(i in value)) throw new JcsRefusal('not-json', 'a sparse array hole is not a JSON value');
+      parts.push(canonicalJSON(value[i]));
+    }
+    return `[${parts.join(',')}]`;
+  }
+  if (!isPlainObject(value)) throw new JcsRefusal('not-json', `a ${(value as object).constructor?.name ?? 'non-plain'} object is not a JSON value`);
+  const obj = value as Record<string, unknown>;
+  const keys = Object.keys(obj).sort(codeUnitCompare);
+  return `{${keys.map((k) => { assertWellFormed(k, 'a member name'); return `${JSON.stringify(k)}:${canonicalJSON(obj[k])}`; }).join(',')}}`;
+}
+
+/**
+ * Parse JSON text, refusing what `JSON.parse` would silently accept or change:
+ * duplicate member names, integer literals outside ±(2^53 − 1), literals that
+ * overflow to ±Infinity, and lone surrogates. Members are defined, not
+ * assigned, so a member named `__proto__` is data, not a prototype write.
+ */
+export function parseIJson(text: string): unknown {
+  let i = 0;
+  const fail = (m: string): never => { throw new JcsRefusal('not-json', `${m} at offset ${i}`); };
+  const ws = (): void => { while (i < text.length && (text[i] === ' ' || text[i] === '\t' || text[i] === '\n' || text[i] === '\r')) i += 1; };
+
+  const str = (): string => {
+    if (text[i] !== '"') fail('expected a string');
+    i += 1;
+    let out = '';
+    for (;;) {
+      if (i >= text.length) fail('unterminated string');
+      const c = text[i];
+      i += 1;
+      if (c === '"') break;
+      if (c === '\\') {
+        const e = text[i];
+        i += 1;
+        switch (e) {
+          case '"': out += '"'; break;
+          case '\\': out += '\\'; break;
+          case '/': out += '/'; break;
+          case 'b': out += '\b'; break;
+          case 'f': out += '\f'; break;
+          case 'n': out += '\n'; break;
+          case 'r': out += '\r'; break;
+          case 't': out += '\t'; break;
+          case 'u': {
+            const h = text.slice(i, i + 4);
+            if (!/^[0-9a-fA-F]{4}$/.test(h)) fail('bad \\u escape');
+            out += String.fromCharCode(parseInt(h, 16));
+            i += 4;
+            break;
+          }
+          default: fail('bad escape');
+        }
+      } else {
+        if ((c as string).charCodeAt(0) < 0x20) fail('raw control character in a string');
+        out += c;
+      }
+    }
+    assertWellFormed(out, 'a string');
+    return out;
+  };
+
+  const num = (): number => {
+    NUMBER.lastIndex = i;
+    const m = NUMBER.exec(text);
+    if (m === null) return fail('bad number');
+    i += m[0].length;
+    if (m[2] === undefined && m[3] === undefined) {
+      const b = BigInt(m[0]);
+      if (b > MAX_EXACT_BIG || b < -MAX_EXACT_BIG) throw new JcsRefusal('integer-out-of-range', `integer literal ${m[0]} is outside ±(2^53 − 1)`);
+    }
+    const v = Number(m[0]);
+    if (!Number.isFinite(v)) throw new JcsRefusal('non-finite', `${m[0]} overflows to a non-finite number`);
+    return v;
+  };
+
+  const val = (): unknown => {
+    ws();
+    const c = text[i];
+    if (c === '{') {
+      i += 1;
+      const obj: Record<string, unknown> = {};
+      ws();
+      if (text[i] === '}') { i += 1; return obj; }
+      for (;;) {
+        ws();
+        const k = str();
+        if (Object.prototype.hasOwnProperty.call(obj, k)) throw new JcsRefusal('duplicate-name', `duplicate member name ${JSON.stringify(k)}`);
+        ws();
+        if (text[i] !== ':') fail('expected :');
+        i += 1;
+        Object.defineProperty(obj, k, { value: val(), enumerable: true, writable: true, configurable: true });
+        ws();
+        const d = text[i];
+        i += 1;
+        if (d === '}') return obj;
+        if (d !== ',') fail('expected , or }');
+      }
+    }
+    if (c === '[') {
+      i += 1;
+      const arr: unknown[] = [];
+      ws();
+      if (text[i] === ']') { i += 1; return arr; }
+      for (;;) {
+        arr.push(val());
+        ws();
+        const d = text[i];
+        i += 1;
+        if (d === ']') return arr;
+        if (d !== ',') fail('expected , or ]');
+      }
+    }
+    if (c === '"') return str();
+    if (text.startsWith('true', i)) { i += 4; return true; }
+    if (text.startsWith('false', i)) { i += 5; return false; }
+    if (text.startsWith('null', i)) { i += 4; return null; }
+    if (c === '-' || (c !== undefined && c >= '0' && c <= '9')) return num();
+    return fail('unexpected token');
+  };
+
+  const v = val();
+  ws();
+  if (i !== text.length) fail('trailing data');
+  return v;
+}
+
+/** JCS bytes of a JSON text, with every §B refusal applied. */
+export function canonicalizeText(text: string): string {
+  return canonicalJSON(parseIJson(text));
+}

package/src/lib/llm-cache-key-recipe.ts

@@ -10,30 +10,20 @@
  *     RFC 0041 §E SECURITY-invariant probe (intra-host reproducibility +
  *     non-recipe-field invariance + Phase 4 advertisement alignment).
  *
- * `canonicalize` mirrors RFC 8785 JCS-style output (sorted keys, no
- * whitespace, preserved array order). Hosts that have a real JCS library
- * available SHOULD prefer it; this helper is for the conformance side,
- * not the host side. Keep in sync with `spec/v1/replay.md` §B.
+ * `canonicalize` is RFC 8785 JCS with the RFC 0212 I-JSON refusal set (the
+ * suite's one implementation, `./jcs.ts`), and `tools[]` sorts by UTF-16 code
+ * units — never `localeCompare`, which orders `get_weather` / `getWeather`
+ * differently per locale and so breaks the TS/Python/Go agreement RFC 0150 §C
+ * asks for. Keep in sync with `spec/v1/replay.md` §B.
  */
 
 import { createHash } from 'node:crypto';
 import { driver } from './driver.js';
+import { canonicalJSON, codeUnitCompare } from './jcs.js';
 
-/** RFC 8785 JCS-style canonicalization (subset suitable for the recipe
- *  fields). Sorted keys recursively; no whitespace; preserved array order;
- *  strings JSON-encoded verbatim (no NFC normalization — the recipe
- *  inputs in our test seam are ASCII). */
+/** RFC 8785 JCS (RFC 0212). Throws `JcsRefusal` on a non-I-JSON value. */
 export function canonicalize(value: unknown): string {
-  if (value === null) return 'null';
-  if (typeof value === 'boolean' || typeof value === 'number') return JSON.stringify(value);
-  if (typeof value === 'string') return JSON.stringify(value);
-  if (Array.isArray(value)) return '[' + value.map((v) => canonicalize(v)).join(',') + ']';
-  if (typeof value === 'object') {
-    const obj = value as Record<string, unknown>;
-    const keys = Object.keys(obj).sort();
-    return '{' + keys.map((k) => `${JSON.stringify(k)}:${canonicalize(obj[k])}`).join(',') + '}';
-  }
-  return JSON.stringify(value);
+  return canonicalJSON(value);
 }
 
 /** @deprecated RETIRED v1 projection (pre RFC 0150 §C). Kept ONLY so a
@@ -44,7 +34,7 @@ export function canonicalize(value: unknown): string {
 export function projectRecipe(raw: Record<string, unknown>): Record<string, unknown> {
   const out: Record<string, unknown> = { provider: raw.provider, model: raw.model, messages: raw.messages };
   if (Array.isArray(raw.tools) && raw.tools.length > 0) {
-    out.tools = [...(raw.tools as Array<{ name: string }>)].sort((a, b) => a.name.localeCompare(b.name));
+    out.tools = [...(raw.tools as Array<{ name: string }>)].sort((a, b) => codeUnitCompare(a.name, b.name));
   }
   if (typeof raw.temperature === 'number') out.temperature = raw.temperature;
   if (typeof raw.topP === 'number') out.topP = raw.topP;
@@ -76,7 +66,7 @@ export const SEMANTIC_REQUEST_RECIPE_V2 = 'openwop-semantic-request-v2';
 export function projectSemanticRequestV2(raw: Record<string, unknown>): Record<string, unknown> {
   const request: Record<string, unknown> = { messages: raw.messages };
   if (Array.isArray(raw.tools) && raw.tools.length > 0) {
-    request.tools = [...(raw.tools as Array<{ name: string }>)].sort((a, b) => a.name.localeCompare(b.name));
+    request.tools = [...(raw.tools as Array<{ name: string }>)].sort((a, b) => codeUnitCompare(a.name, b.name));
   }
   for (const k of ['temperature', 'topP', 'topK', 'maxOutputTokens', 'seed'] as const) {
     if (typeof raw[k] === 'number') request[k] = raw[k];

package/src/lib/scoped-receiver.ts

@@ -49,7 +49,7 @@
 
 import { randomBytes } from 'node:crypto';
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
-import { FRONT_MUX_PREFIX, registerBehindFront, routeFronted, unregisterBehindFront } from './front-mux.js';
+import { FRONT_MUX_PREFIX, registerBehindFront, routeFronted, unregisterBehindFront, withoutFrontPath } from './front-mux.js';
 import { receiverBinding, resolvePublicFront } from './webhook-receiver.js';
 
 /** The operator's public front for the suite's webhook receiver. */
@@ -122,7 +122,7 @@ export async function startScopedReceiver(
     // Counted BEFORE routing: `routeFronted` answers an unknown nonce itself and
     // cannot report that it did, and a request that is not this exercise's must
     // still be visible in the failure detail.
-    if (!(request.url ?? '/').startsWith(`${FRONT_MUX_PREFIX}${nonce}`)) foreign += 1;
+    if (!withoutFrontPath(WEBHOOK_FRONT_ENV, request.url ?? '/').startsWith(`${FRONT_MUX_PREFIX}${nonce}`)) foreign += 1;
     if (routeFronted(WEBHOOK_FRONT_ENV, request, res)) return;
     // Not an `/fx/` path at all: a stranger, or a host that dropped the path it
     // was given. Answered, never recorded — a receiver that counts what it was

package/src/scenarios/jcs-vectors.test.ts

@@ -0,0 +1,108 @@
+/**
+ * RFC 0212 — canonical JSON is RFC 8785 (JCS), and the input MUST be I-JSON.
+ *
+ * `conformance/vectors/jcs-v1.json` is normative: every signature and digest in
+ * the corpus (pack signatures, the certification-bundle attestation,
+ * `discovery.sha256`, `witnessSha256`, the RFC 0150 request digest) is over
+ * these bytes, and an SDK in another language reproduces the same file. This
+ * scenario holds the suite's one implementation (`lib/jcs.ts`) to it.
+ *
+ * Every leg RECOMPUTES from the vector input; none compares two constants from
+ * the file. The sabotages RFC 0212 names, each of which turns a leg red:
+ *
+ *   - a rebuild-object canonicalizer (`JSON.stringify` of an object whose keys
+ *     were inserted in sorted order) — integer-like keys enumerate first, so
+ *     `integer-like-keys` fails;
+ *   - NaN → `null` coercion — the value-boundary refusal leg fails;
+ *   - a parser that keeps the last duplicate name (`JSON.parse`) — the
+ *     `duplicate-name` refusal is accepted;
+ *   - a `localeCompare` comparator — the ordering leg and the
+ *     `rfc8785-3.2.3-sort` vector fail.
+ *
+ * Server-free and always-on; the vectors ship with the conformance package.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve } from 'node:path';
+import { canonicalJSON, canonicalizeText, codeUnitCompare, JcsRefusal } from '../lib/jcs.js';
+import { witnessDigest, type BundleV3Requirement } from '../lib/certification-bundle-v3.js';
+import { req } from '../lib/requirement-ids.js';
+
+interface NumberVector { readonly ieee754: string; readonly canonical: string }
+interface NumberRefusal { readonly ieee754: string; readonly refuse: string }
+interface ObjectVector { readonly id: string; readonly why: string; readonly input: string; readonly canonical: string; readonly sha256: string }
+interface RefusalVector { readonly id: string; readonly why: string; readonly input: string; readonly refuse: string }
+interface Ordering { readonly why: string; readonly ids: readonly string[]; readonly codeUnit: readonly string[] }
+
+const VECTORS_PATH = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', 'vectors', 'jcs-v1.json');
+const doc = JSON.parse(readFileSync(VECTORS_PATH, 'utf8')) as {
+  numbers: readonly NumberVector[];
+  numberRefusals: readonly NumberRefusal[];
+  objects: readonly ObjectVector[];
+  refusals: readonly RefusalVector[];
+  ordering: Ordering;
+};
+
+const SPEC = 'RFC 0212 · spec/v2/core/conformance.md §"Canonical JSON"';
+const sha256 = (s: string): string => createHash('sha256').update(s, 'utf8').digest('hex');
+const double = (hex: string): number => Buffer.from(hex, 'hex').readDoubleBE(0);
+
+function refusalOf(fn: () => unknown): JcsRefusal | undefined {
+  try { fn(); } catch (e) { if (e instanceof JcsRefusal) return e; throw e; }
+  return undefined;
+}
+
+describe('RFC 0212 — canonical JSON is RFC 8785 JCS over I-JSON', () => {
+  it('the vector set is present and non-trivial', () => {
+    // An empty or truncated file would make every leg below vacuous.
+    expect(doc.numbers.length, req('openwop.it.jcs-vectors.the-vector-set-is-present-and-non-trivial', SPEC, 'the vectors MUST cover RFC 8785 Appendix B numbers, documents and every §B refusal kind')).toBeGreaterThanOrEqual(20);
+    expect(doc.objects.length).toBeGreaterThanOrEqual(10);
+    expect(new Set(doc.refusals.map((r) => r.refuse))).toEqual(new Set(['duplicate-name', 'lone-surrogate', 'integer-out-of-range', 'not-json', 'non-finite']));
+  });
+
+  it.each(doc.numbers.map((n) => [n.ieee754, n] as const))('number %s serializes per RFC 8785 Appendix B', (_hex, n) => {
+    expect(canonicalJSON(double(n.ieee754)), req('openwop.it.jcs-vectors.number-s-serializes-per-rfc-8785-appendix-b', SPEC, 'numbers MUST serialize as ECMAScript Number::toString (RFC 8785 §3.2.2.3)')).toBe(n.canonical);
+  });
+
+  it.each(doc.objects.map((o) => [o.id, o] as const))('document %s canonicalizes and hashes', (_id, o) => {
+    // The preimage is asserted as well as the hash so a failing implementation
+    // can diff WHICH member it got wrong.
+    const canonical = canonicalizeText(o.input);
+    expect(canonical, req('openwop.it.jcs-vectors.document-s-canonicalizes-and-hashes', SPEC, o.why)).toBe(o.canonical);
+    expect(sha256(canonical), req('openwop.it.jcs-vectors.document-s-canonicalizes-and-hashes', SPEC, o.why)).toBe(o.sha256);
+  });
+
+  it.each(doc.refusals.map((r) => [r.id, r] as const))('text %s is refused, not coerced', (_id, r) => {
+    const refusal = refusalOf(() => canonicalizeText(r.input));
+    expect(refusal?.kind, req('openwop.it.jcs-vectors.text-s-is-refused-not-coerced', SPEC, `RFC 0212 §B: ${r.why}`)).toBe(r.refuse);
+  });
+
+  it('a non-I-JSON native value is refused at the value boundary', () => {
+    const cases: readonly [string, unknown][] = [
+      ...doc.numberRefusals.map((n) => [`ieee754 ${n.ieee754}`, { n: double(n.ieee754) }] as [string, unknown]),
+      ['NaN', { n: Number.NaN }],
+      ['undefined member', { a: undefined }],
+      ['undefined element', [undefined]],
+      ['Date', { at: new Date(0) }],
+      ['bigint', { n: 1n }],
+      ['lone surrogate', { s: '\ud800' }],
+      ['lone surrogate in a name', { '\udc00': 1 }],
+    ];
+    for (const [label, value] of cases) {
+      expect(refusalOf(() => canonicalJSON(value)), req('openwop.it.jcs-vectors.a-non-i-json-native-value-is-refused-at-the-value-boundary', SPEC, `RFC 0212 §B: ${label} MUST be refused, not serialized`)).toBeInstanceOf(JcsRefusal);
+    }
+  });
+
+  it('member names and certification rows sort by UTF-16 code units, not by locale', () => {
+    const o = doc.ordering;
+    expect([...o.ids].sort(codeUnitCompare), req('openwop.it.jcs-vectors.member-names-and-certification-rows-sort-by-utf-16-code-units-not-by-locale', SPEC, o.why)).toEqual([...o.codeUnit]);
+    // The certification digest uses the same comparator (RFC 0212 §C): rows
+    // given in vector order digest to the JCS of the code-unit-sorted rows.
+    const rows: BundleV3Requirement[] = o.ids.map((id) => ({ id, scenario: 's.test.ts', result: 'executed-pass' }) as BundleV3Requirement);
+    const expected = sha256(canonicalJSON([...o.codeUnit].map((id) => ({ id, scenario: 's.test.ts', result: 'executed-pass' }))));
+    expect(witnessDigest(rows), req('openwop.it.jcs-vectors.member-names-and-certification-rows-sort-by-utf-16-code-units-not-by-locale', SPEC, 'witnessSha256 rows MUST sort by id in UTF-16 code-unit order; a locale-sensitive comparator MUST NOT be used')).toBe(expected);
+  });
+});

package/src/scenarios/semantic-digest-vectors.test.ts

@@ -110,6 +110,14 @@ describe('RFC 0150 §C — semantic request digest golden vectors', () => {
     expect(digest('tools-sorted-by-name'), req('openwop.it.semantic-digest-vectors.tool-order-is-not-semantic-sorted-and-reversed-agree', 'RFC 0150 §C', 'tool order is not semantic — sorted and reversed agree')).toBe(digest('tools-reversed-same-digest'));
   });
 
+  it('tool order uses UTF-16 code units, where a locale comparator disagrees', () => {
+    // RFC 0212 §D. `alpha`/`zeta` order the same under every comparator, so the
+    // pair above cannot catch a `localeCompare` sort; `getWeather`/`get_weather`
+    // can — English collation ignores `_` and puts them the other way round.
+    expect(digest('tools-code-unit-order'), req('openwop.it.semantic-digest-vectors.tool-order-uses-utf-16-code-units-where-a-locale-comparator-disagrees', 'RFC 0212 §D · RFC 0150 §C', 'tools[] MUST sort by name in UTF-16 code-unit order')).toBe(digest('tools-code-unit-order-reversed'));
+    expect(canonicalize(projectSemanticRequestV2(byId.get('tools-code-unit-order')?.input ?? {})), req('openwop.it.semantic-digest-vectors.tool-order-uses-utf-16-code-units-where-a-locale-comparator-disagrees', 'RFC 0212 §D · RFC 0150 §C', 'getWeather (0x57) MUST precede get_weather (0x5F)')).toContain('"tools":[{"name":"getWeather"');
+  });
+
   it('message order IS semantic — reversing changes the digest', () => {
     expect(
       digest('message-order-is-semantic'),

package/src/scenarios/v2-a2a-operation-map.test.ts

@@ -25,6 +25,7 @@
  * @see spec/v2/interop-map.json a2a.operations / a2a.taskState / a2a.errors
  * @see RFCS/0208-v2-a2a-mcp-operation-mappings.md §C, §D, §E
  * @see RFCS/0199-outbound-oauth-client-and-credential-interrupt.md §D.1 (the credential leg; interop-map.json a2a.taskState override row)
+ * @see RFCS/0214-a2a-push-credential-is-a-destination-credential.md (the push-config refusal leg; invariants a2a-push-credential-destination-bound, a2a-push-secrets-not-returned)
  * @see RFCS/0211-a2a-error-details-are-errorinfo.md §A–§E (the error-details legs; the isolation comparator)
  */
 import { describe, it, expect } from 'vitest';
@@ -38,9 +39,10 @@ import { softSkip } from '../lib/soft-skip.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
 import { req } from '../lib/requirement-ids.js';
 import { SEAMS_PREFIX } from '../lib/seams.js';
+import { unservedDestination } from '../lib/scoped-receiver.js';
 import { errorInfos, normaliseErrorData, isOpenwopEnvelope, A2A_ERROR_DOMAIN } from '../lib/a2a-error-info.js';
 
-export const HOST_CALLBACK_NOT_REQUIRED = 'the suite is the A2A client: every leg POSTs JSON-RPC to the interface the host\'s own card lists; nothing harness-hosted is handed to the host';
+export const HOST_CALLBACK_NOT_REQUIRED = 'the suite is the A2A client: every leg POSTs JSON-RPC to the interface the host\'s own card lists; the RFC 0214 push-config legs register an UNSERVED destination (lib/scoped-receiver unservedDestination) whose deliveries are neither required nor read — delivery is v2-a2a-push-delivery\'s claim';
 
 const DOC = 'spec/v2/core/interop.md §"The operation mappings" (RFC 0208)';
 const PROFILE = 'a2a-1.0';
@@ -249,6 +251,133 @@ describe('RFC 0208 — v2-a2a-operation-map (host as A2A 1.0 server, gated on a2
     await rpc(t.url, 'CancelTask', { id });
   });
 
+  it('a host not advertising a2a.pushNotifications refuses all four push-config operations with PushNotificationNotSupportedError', async () => {
+    const rid = 'openwop.requirement.0214.a2a-push-unadvertised-refused';
+    const pushDoc = 'interop-map.json a2a.errors PushNotificationNotSupportedError (serverWhen: push config without a2a.pushNotifications) and the push-config operation rows; A2A v1.0.1 §3.3.4';
+    const t = await target(true);
+    if (!t.ok) return skip(t, rid);
+    const a2a = (await familyAdvertised('a2a'))!;
+    if (a2a['pushNotifications'] === true) return softSkip('inapplicable', 'a2a.pushNotifications is advertised — the push-config rows are served here, not refused');
+    const first = await startApprovalTask(t.url);
+    const id = first.task?.id;
+    expect(typeof id, req(rid, DOC, `SendMessage MUST start a task: ${JSON.stringify(first.rpc.error)}`)).toBe('string');
+    // Positive control: the task is readable, so a -32001 below could not be masking the refusal under test.
+    const read = await rpc(t.url, 'GetTask', { id });
+    expect(read.error, req(rid, 'a2a.operations GetTask', `positive control: the task the suite just started MUST be readable (got ${JSON.stringify(read.error)})`)).toBeUndefined();
+    const configId = `conf-0214-${randomBytes(6).toString('hex')}`;
+    const calls: Array<[string, Record<string, unknown>]> = [
+      ['CreateTaskPushNotificationConfig', { taskId: id, url: 'https://push.example.com/openwop-conformance' }],
+      ['GetTaskPushNotificationConfig', { taskId: id, id: configId }],
+      ['ListTaskPushNotificationConfigs', { taskId: id }],
+      ['DeleteTaskPushNotificationConfig', { taskId: id, id: configId }],
+    ];
+    for (const [method, params] of calls) {
+      const r = await rpc(t.url, method, params);
+      expect(r.error?.code, req(rid, pushDoc, `${method} on a host not advertising a2a.pushNotifications MUST be refused PushNotificationNotSupportedError -32003 — not method-not-found -32601 (got ${JSON.stringify(r.error ?? r.result)})`)).toBe(-32003);
+    }
+    await rpc(t.url, 'CancelTask', { id });
+  });
+
+  // ── RFC 0214 — push-config legs on a host that ADVERTISES a2a.pushNotifications ──
+  // Delivery itself (credential at the destination, no redirect, discard, fork) needs
+  // a public receiver and lives in v2-a2a-push-delivery.test.ts; these three need none.
+
+  it('RFC 0214 — CreateTaskPushNotificationConfig refuses a non-https or private destination', async () => {
+    const rid = 'openwop.requirement.0214.a2a-push-register-ssrf';
+    const doc = 'interop-map.json a2a.operations CreateTaskPushNotificationConfig ("the url MUST pass the webhooks.md egress guard"); webhooks.md §Egress; RFC 0214 §B';
+    const t = await target(true);
+    if (!t.ok) return skip(t, rid);
+    const a2a = (await familyAdvertised('a2a'))!;
+    if (a2a['pushNotifications'] !== true) return softSkip('inapplicable', 'a2a.pushNotifications is not advertised — the refusal row (a2a-push-unadvertised-refused) applies instead');
+    const first = await startApprovalTask(t.url);
+    const id = first.task?.id;
+    expect(typeof id, req(rid, DOC, `SendMessage MUST start a task: ${JSON.stringify(first.rpc.error)}`)).toBe('string');
+    for (const bad of ['http://push.example.com/openwop-conformance', 'https://10.0.0.1/openwop-conformance', 'https://127.0.0.1/openwop-conformance', 'https://169.254.169.254/latest/meta-data']) {
+      const r = await rpc(t.url, 'CreateTaskPushNotificationConfig', { taskId: id, url: bad });
+      expect(r.result, req(rid, doc, `a push destination the egress guard refuses (${bad}) MUST NOT be registered (got result ${JSON.stringify(r.result)})`)).toBeUndefined();
+      expect(typeof r.error?.code, req(rid, doc, `the refusal of ${bad} MUST be a JSON-RPC error (got ${JSON.stringify(r)})`)).toBe('number');
+    }
+    await rpc(t.url, 'CancelTask', { id });
+  });
+
+  it('RFC 0214 §E — a push config of another tenant\'s task, of another task, or unknown, is answered identically', async () => {
+    const rid = 'openwop.requirement.0214.a2a-push-config-isolation';
+    const doc = 'interop.md §"A2A push delivery" (RFC 0214 §E); interop.md §"The operation mappings" Isolation';
+    const t = await target(true);
+    if (!t.ok) return skip(t, rid);
+    const a2a = (await familyAdvertised('a2a'))!;
+    if (a2a['pushNotifications'] !== true) return softSkip('inapplicable', 'a2a.pushNotifications is not advertised — no push config can exist to isolate');
+    const one = (await startApprovalTask(t.url)).task?.id;
+    const two = (await startApprovalTask(t.url)).task?.id;
+    expect(typeof one === 'string' && typeof two === 'string' && one.includes('/'), req(rid, DOC, 'SendMessage MUST start two tasks with tenant-bound ids')).toBe(true);
+    const dest = unservedDestination('https://example.com/openwop-conformance-push');
+    const created = await rpc(t.url, 'CreateTaskPushNotificationConfig', { taskId: one, url: dest.url });
+    const cfg = (created.result ?? {}) as { id?: string };
+    if (created.error !== undefined && !dest.tunnelled) {
+      await rpc(t.url, 'CancelTask', { id: one }); await rpc(t.url, 'CancelTask', { id: two });
+      return softSkip('blocked', `Create was refused for ${dest.url} and no public front (OPENWOP_WEBHOOK_RECEIVER_URL) is wired — the isolation leg needs one config to exist (${JSON.stringify(created.error)})`);
+    }
+    expect(typeof cfg.id, req(rid, doc, `positive control: Create on the caller's own task with a public destination MUST return a config id (got ${JSON.stringify(created.error ?? created.result)})`)).toBe('string');
+    const own = await rpc(t.url, 'GetTaskPushNotificationConfig', { taskId: one, id: cfg.id });
+    expect(own.error, req(rid, doc, `positive control: the caller MUST read its own config back (got ${JSON.stringify(own.error)})`)).toBeUndefined();
+    const opaque = one!.slice(one!.indexOf('/') + 1);
+    const foreignTask = `zz-conformance-foreign/${opaque}`;
+    const unknownId = `pnc-${randomBytes(12).toString('hex')}`;
+    const answers: Array<[string, Rpc, string]> = [
+      ['unknown config id', await rpc(t.url, 'GetTaskPushNotificationConfig', { taskId: one, id: unknownId }), unknownId],
+      ['config id under another of the caller\'s tasks', await rpc(t.url, 'GetTaskPushNotificationConfig', { taskId: two, id: cfg.id }), cfg.id!],
+      ['config id under another tenant\'s task segment', await rpc(t.url, 'GetTaskPushNotificationConfig', { taskId: foreignTask, id: cfg.id }), cfg.id!],
+    ];
+    const shape = (r: Rpc, echo: string): string => JSON.stringify({ status: r.status, code: r.error?.code, message: (r.error?.message ?? '').split(echo).join('<id>'), data: normaliseErrorData(r.error?.data, echo), result: r.result });
+    const base = shape(answers[0]![1], answers[0]![2]);
+    expect(answers[0]![1].error?.code, req(rid, doc, `an unknown config id MUST be refused (got ${JSON.stringify(answers[0]![1].result)})`)).toBeTypeOf('number');
+    for (const [what, r, echo] of answers.slice(1)) {
+      expect(shape(r, echo), req(rid, doc, `a read of a ${what} MUST be answered exactly as an unknown id — same status, code, message and error details (minus an echo of the requested id)`)).toBe(base);
+    }
+    const foreignDelete = await rpc(t.url, 'DeleteTaskPushNotificationConfig', { taskId: foreignTask, id: cfg.id });
+    expect(foreignDelete.result === undefined || JSON.stringify(foreignDelete.result) === '{}', req(rid, doc, `a delete naming another tenant's task MUST NOT disclose anything beyond the idempotent answer (got ${JSON.stringify(foreignDelete)})`)).toBe(true);
+    const still = await rpc(t.url, 'GetTaskPushNotificationConfig', { taskId: one, id: cfg.id });
+    expect(still.error, req(rid, doc, 'a delete naming another tenant\'s task MUST NOT delete the caller\'s config')).toBeUndefined();
+    await rpc(t.url, 'DeleteTaskPushNotificationConfig', { taskId: one, id: cfg.id });
+    const again = await rpc(t.url, 'DeleteTaskPushNotificationConfig', { taskId: one, id: cfg.id });
+    expect(again.error, req(rid, 'A2A v1.0.1 §3.1.10 ("MUST be idempotent")', `a second delete of the same config MUST succeed idempotently (got ${JSON.stringify(again.error)})`)).toBeUndefined();
+    await rpc(t.url, 'CancelTask', { id: one }); await rpc(t.url, 'CancelTask', { id: two });
+  });
+
+  it('RFC 0214 §A — a push config\'s token and credentials are never returned, and never reach task, events or state', async () => {
+    const rid = 'openwop.requirement.0214.a2a-push-secrets-not-returned';
+    const doc = 'interop-map.json a2a.operations push rows ("secrets are never returned"); security-defaults.md §"Onward hops" (RFC 0214 §A)';
+    const t = await target(true);
+    if (!t.ok) return skip(t, rid);
+    const a2a = (await familyAdvertised('a2a'))!;
+    if (a2a['pushNotifications'] !== true) return softSkip('inapplicable', 'a2a.pushNotifications is not advertised — no push credential can be registered');
+    const first = await startApprovalTask(t.url);
+    const id = first.task?.id;
+    expect(typeof id, req(rid, DOC, `SendMessage MUST start a task: ${JSON.stringify(first.rpc.error)}`)).toBe('string');
+    const credSentinel = `owcred${randomBytes(12).toString('hex')}`;
+    const tokenSentinel = `owtok${randomBytes(12).toString('hex')}`;
+    const dest = unservedDestination('https://example.com/openwop-conformance-push');
+    const created = await rpc(t.url, 'CreateTaskPushNotificationConfig', { taskId: id, url: dest.url, token: tokenSentinel, authentication: { scheme: 'Bearer', credentials: credSentinel } });
+    if (created.error !== undefined && !dest.tunnelled) {
+      await rpc(t.url, 'CancelTask', { id });
+      return softSkip('blocked', `Create was refused for ${dest.url} and no public front (OPENWOP_WEBHOOK_RECEIVER_URL) is wired (${JSON.stringify(created.error)})`);
+    }
+    const cfgId = (created.result as { id?: string } | undefined)?.id;
+    expect(typeof cfgId, req(rid, doc, `positive control: Create with a credential MUST succeed (got ${JSON.stringify(created.error ?? created.result)})`)).toBe('string');
+    const leaks = (what: string, v: unknown): void => {
+      const text = JSON.stringify(v ?? null);
+      expect(text.includes(credSentinel) || text.includes(tokenSentinel), req(rid, doc, `${what} MUST NOT carry the registered token or credentials`)).toBe(false);
+    };
+    leaks('the Create response', created.result);
+    leaks('GetTaskPushNotificationConfig', (await rpc(t.url, 'GetTaskPushNotificationConfig', { taskId: id, id: cfgId })).result);
+    leaks('ListTaskPushNotificationConfigs', (await rpc(t.url, 'ListTaskPushNotificationConfigs', { taskId: id })).result);
+    leaks('GetTask', (await rpc(t.url, 'GetTask', { id })).result);
+    leaks('the run snapshot (getRun)', (await driver.get(`/runs/${encodeURIComponent(id!)}`)).json);
+    leaks('the run event log (pollRunEvents)', (await driver.get(`/runs/${encodeURIComponent(id!)}/events/poll?timeout=1`)).json);
+    await rpc(t.url, 'DeleteTaskPushNotificationConfig', { taskId: id, id: cfgId });
+    await rpc(t.url, 'CancelTask', { id });
+  });
+
   it('ListTasks returns only what listRuns returns to the same Subject; tenant and contextId never select', async () => {
     const other = process.env.OPENWOP_TEST_TENANT_B_API_KEY;
     if (!other) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set — the cross-caller leg cannot run');