@openwop/openwop-conformance 2.4.1 → 2.4.3

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.4.3] — 2026-09-18 — a check with nothing to complain about is not `blocked`
+
+**Why a patch.** Two assertions change shape inside existing legs; no scenario
+file is added or removed and no host obligation changes.
+
+### Fixed
+
+- **`spec-corpus-validity`'s per-file `$ref` and Markdown-link legs asserted
+  only on failure.** A schema with no absolute `$ref`, or a Markdown file with
+  no local links, ran an empty loop and asserted nothing — and an `it` that
+  passes with zero assertions resolves to `blocked` with the unclassified-return
+  detail. 608 of the corpus ledger's 943 ids read `blocked` for that reason.
+  Each leg now collects its offenders and asserts once, unconditionally, which
+  also reports every bad link or `$ref` rather than only the first. Ledger:
+  `blocked` 608 → 0, `executed-pass` 841 → 1449.
+
+## [2.4.2] — 2026-09-18 — an id no host could ever witness
+
+**Why a patch.** One assertion moves into its own `it`; no scenario file is
+added or removed and no host obligation changes.
+
+### Fixed
+
+- **`openwop.requirement.0173.pack-isolation.seam`** was minted inside
+  `v2-pack-isolation`'s shared `invoke()` helper.
+  `generate-requirement-registry.mjs` harvests `req(…)` only within an `it`, so
+  the id never reached `requirements.json` and no bundle could carry a row for
+  it — while `check-cut-gates.mjs` scans every `req(` in the source and went on
+  demanding one, failing RFC 0167 §G.2 on a row no host could supply. The seam
+  contract now has its own `it`, which is the copy the registry can see. The
+  helper keeps its `req(…)` call — RFC 0168 §A.1 makes `req(…)` the only
+  assertion-message form in `src/scenarios`, so the fix is the extra `it`, not
+  a quieter assertion.
+
 ## [2.4.1] — 2026-09-18 — the leg that reads the host, not the schema
 
 **Why a patch.** A leg is added to an existing scenario file; no file is added or removed.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.4.1",
-  "stampSha256": "576f2a6451072e6ae17a6398428f6fba4c8a505d80e8899431d4bcf69a2c0fec"
+  "version": "2.4.3",
+  "stampSha256": "b7de0e8729aff41308e7c9ad1ab46e1ff55eb01fa60505209d806a9fa1244157"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.4.1",
+  "version": "2.4.3",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.4.1"
+    "@openwop/spec-artifacts": "2.4.3"
   }
 }

package/requirements.json

@@ -3,10 +3,10 @@
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
     "files": 571,
-    "tests": 2173,
-    "withStableId": 2173,
+    "tests": 2174,
+    "withStableId": 2174,
     "interpolatedTitles": 0,
-    "explicitIds": 2126
+    "explicitIds": 2127
   },
   "records": [
     {
@@ -27681,7 +27681,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.sandbox-isolationmodel-names-a-real-mechanism-never-node-vm",
       "file": "v2-pack-isolation.test.ts",
-      "line": 70,
+      "line": 78,
       "title": "sandbox.isolationModel names a real mechanism, never node:vm",
       "explicitId": "openwop.requirement.0173.pack-isolation",
       "citations": [
@@ -27696,10 +27696,24 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-pack-isolation.the-sandbox-invoke-seam-answers-the-seam-contract",
+      "file": "v2-pack-isolation.test.ts",
+      "line": 92,
+      "title": "the sandbox-invoke seam answers the seam contract",
+      "explicitId": "openwop.requirement.0173.pack-isolation.seam",
+      "citations": [
+        {
+          "section": "host-sample-test-seams.md §8",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-fs-gated-a-host-filesystem-read-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 84,
+      "line": 104,
       "title": "node-pack-sandbox-fs-gated: a host filesystem read is refused",
       "explicitId": null,
       "citations": []
@@ -27707,7 +27721,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-fs-gated-a-host-filesystem-write-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 91,
+      "line": 111,
       "title": "node-pack-sandbox-fs-gated: a host filesystem write is refused",
       "explicitId": null,
       "citations": []
@@ -27715,7 +27729,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-no-env-the-host-environment-does-not-leak",
       "file": "v2-pack-isolation.test.ts",
-      "line": 98,
+      "line": 118,
       "title": "node-pack-sandbox-no-env: the host environment does not leak",
       "explicitId": null,
       "citations": []
@@ -27723,7 +27737,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-network-gated-ungated-network-egress-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 105,
+      "line": 125,
       "title": "node-pack-sandbox-network-gated: ungated network egress is refused",
       "explicitId": null,
       "citations": []
@@ -27731,7 +27745,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-no-process-host-process-access-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 112,
+      "line": 132,
       "title": "node-pack-sandbox-no-process: host process access is refused",
       "explicitId": null,
       "citations": []
@@ -27739,7 +27753,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-timeout-exceeding-wallclocklimitms-fails-with-sandbox-timeout",
       "file": "v2-pack-isolation.test.ts",
-      "line": 119,
+      "line": 139,
       "title": "node-pack-sandbox-timeout: exceeding wallClockLimitMs fails with sandbox_timeout",
       "explicitId": "openwop.requirement.0173.pack-isolation.timeout",
       "citations": [
@@ -27752,7 +27766,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-memory-cap-exceeding-memorylimitbytes-fails-with-sandbox-memor",
       "file": "v2-pack-isolation.test.ts",
-      "line": 126,
+      "line": 146,
       "title": "node-pack-sandbox-memory-cap: exceeding memoryLimitBytes fails with sandbox_memory_exceeded",
       "explicitId": "openwop.requirement.0173.pack-isolation.memory-cap",
       "citations": [
@@ -27765,7 +27779,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-isolated-context-a-pack-cannot-mutate-state-another-invocation",
       "file": "v2-pack-isolation.test.ts",
-      "line": 133,
+      "line": 153,
       "title": "node-pack-sandbox-isolated-context: a pack cannot mutate state another invocation sees",
       "explicitId": "openwop.requirement.0173.pack-isolation.isolated-context",
       "citations": [
@@ -34637,7 +34651,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.payload-type-index-keys-exactly-match-runeventtype-enum-values",
       "file": "spec-corpus-validity.test.ts",
-      "line": 656,
+      "line": 662,
       "title": "payload type-index keys exactly match RunEventType enum values",
       "explicitId": "openwop.it.spec-corpus-validity.payload-type-index-keys-exactly-match-runeventtype-enum-values",
       "citations": [
@@ -34650,7 +34664,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.payload-type-index-refs-point-to-declared-payload-defs",
       "file": "spec-corpus-validity.test.ts",
-      "line": 665,
+      "line": 671,
       "title": "payload type-index refs point to declared payload $defs",
       "explicitId": "openwop.it.spec-corpus-validity.payload-type-index-refs-point-to-declared-payload-defs",
       "citations": [
@@ -34678,7 +34692,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.payload-schema-description-states-the-current-runeventtype-variant-count",
       "file": "spec-corpus-validity.test.ts",
-      "line": 681,
+      "line": 687,
       "title": "payload schema description states the current RunEventType variant count",
       "explicitId": "openwop.it.spec-corpus-validity.payload-schema-description-states-the-current-runeventtype-variant-count",
       "citations": [
@@ -34695,7 +34709,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.exists",
       "file": "spec-corpus-validity.test.ts",
-      "line": 696,
+      "line": 702,
       "title": "exists",
       "explicitId": "openwop.it.spec-corpus-validity.exists",
       "citations": [
@@ -34708,7 +34722,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.declares-openapi-3-1-required-top-level-keys",
       "file": "spec-corpus-validity.test.ts",
-      "line": 700,
+      "line": 706,
       "title": "declares openapi: 3.1 + required top-level keys",
       "explicitId": "openwop.it.spec-corpus-validity.declares-openapi-3-1-required-top-level-keys",
       "citations": [
@@ -34721,7 +34735,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-ref-to-schemas-json-resolves-to-a-real-file",
       "file": "spec-corpus-validity.test.ts",
-      "line": 709,
+      "line": 715,
       "title": "every $ref to ../schemas/*.json resolves to a real file",
       "explicitId": "openwop.it.spec-corpus-validity.every-ref-to-schemas-json-resolves-to-a-real-file",
       "citations": [
@@ -34735,7 +34749,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.operationids-are-unique",
       "file": "spec-corpus-validity.test.ts",
-      "line": 719,
+      "line": 725,
       "title": "operationIds are unique",
       "explicitId": "openwop.it.spec-corpus-validity.operationids-are-unique",
       "citations": [
@@ -34753,7 +34767,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-operation-tag-is-declared-in-the-top-level-tags-list",
       "file": "spec-corpus-validity.test.ts",
-      "line": 728,
+      "line": 734,
       "title": "every operation tag is declared in the top-level tags list",
       "explicitId": "openwop.it.spec-corpus-validity.every-operation-tag-is-declared-in-the-top-level-tags-list",
       "citations": [
@@ -34775,7 +34789,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.declares-apikeyauth-as-the-global-default-security-requirement",
       "file": "spec-corpus-validity.test.ts",
-      "line": 744,
+      "line": 750,
       "title": "declares ApiKeyAuth as the global default security requirement",
       "explicitId": "openwop.it.spec-corpus-validity.declares-apikeyauth-as-the-global-default-security-requirement",
       "citations": [
@@ -34792,7 +34806,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.only-documented-public-or-signed-token-operations-clear-security",
       "file": "spec-corpus-validity.test.ts",
-      "line": 755,
+      "line": 761,
       "title": "only documented public or signed-token operations clear security",
       "explicitId": "openwop.it.spec-corpus-validity.only-documented-public-or-signed-token-operations-clear-security",
       "citations": [
@@ -34810,7 +34824,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.protected-operations-document-canonical-401-and-403-auth-failure-responses",
       "file": "spec-corpus-validity.test.ts",
-      "line": 776,
+      "line": 782,
       "title": "protected operations document canonical 401 and 403 auth failure responses",
       "explicitId": "openwop.it.spec-corpus-validity.protected-operations-document-canonical-401-and-403-auth-failure-responses",
       "citations": [
@@ -34833,7 +34847,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.declares-both-the-literal-v1-agents-roster-org-chart-routes-and-the-agentid-para",
       "file": "spec-corpus-validity.test.ts",
-      "line": 803,
+      "line": 809,
       "title": "declares both the literal /v1/agents/{roster,org-chart} routes and the {agentId} param route",
       "explicitId": "openwop.it.spec-corpus-validity.declares-both-the-literal-v1-agents-roster-org-chart-routes-and-the-agentid-para",
       "citations": [
@@ -34846,7 +34860,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-v1-agents-agentid-param-excludes-the-reserved-literals-roster-org-chart",
       "file": "spec-corpus-validity.test.ts",
-      "line": 810,
+      "line": 816,
       "title": "every /v1/agents/{agentId} param excludes the reserved literals (roster, org-chart)",
       "explicitId": "openwop.it.spec-corpus-validity.every-v1-agents-agentid-param-excludes-the-reserved-literals-roster-org-chart",
       "citations": [
@@ -34863,7 +34877,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-reserved-literal-exclusion-pattern-rejects-roster-org-chart-and-accepts-a-re",
       "file": "spec-corpus-validity.test.ts",
-      "line": 821,
+      "line": 827,
       "title": "the reserved-literal exclusion pattern rejects roster/org-chart and accepts a real agentId",
       "explicitId": "openwop.it.spec-corpus-validity.the-reserved-literal-exclusion-pattern-rejects-roster-org-chart-and-accepts-a-re",
       "citations": [
@@ -34880,7 +34894,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-agent-manifest-agentid-pattern-can-never-produce-a-reserved-literal-defense",
       "file": "spec-corpus-validity.test.ts",
-      "line": 828,
+      "line": 834,
       "title": "the agent-manifest agentId pattern can never produce a reserved literal (defense in depth)",
       "explicitId": "openwop.it.spec-corpus-validity.the-agent-manifest-agentid-pattern-can-never-produce-a-reserved-literal-defense",
       "citations": [
@@ -34901,7 +34915,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.typed-error-specializations-compose-the-canonical-error-schema",
       "file": "spec-corpus-validity.test.ts",
-      "line": 840,
+      "line": 846,
       "title": "typed error specializations compose the canonical Error schema",
       "explicitId": "openwop.it.spec-corpus-validity.typed-error-specializations-compose-the-canonical-error-schema",
       "citations": [
@@ -34925,7 +34939,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-openapi-operationid-is-represented-in-conformance-coverage-md",
       "file": "spec-corpus-validity.test.ts",
-      "line": 865,
+      "line": 871,
       "title": "every OpenAPI operationId is represented in conformance/coverage.md",
       "explicitId": "openwop.it.spec-corpus-validity.every-openapi-operationid-is-represented-in-conformance-coverage-md",
       "citations": [
@@ -34943,7 +34957,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-openapi-operation-has-a-matching-method-path-row-in-rest-endpoints-md",
       "file": "spec-corpus-validity.test.ts",
-      "line": 885,
+      "line": 891,
       "title": "every OpenAPI operation has a matching method/path row in rest-endpoints.md",
       "explicitId": "openwop.it.spec-corpus-validity.every-openapi-operation-has-a-matching-method-path-row-in-rest-endpoints-md",
       "citations": [
@@ -34965,7 +34979,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.rest-catalog-auth-scope-columns-match-openapi-security-overrides",
       "file": "spec-corpus-validity.test.ts",
-      "line": 903,
+      "line": 909,
       "title": "REST catalog auth/scope columns match OpenAPI security overrides",
       "explicitId": "openwop.it.spec-corpus-validity.rest-catalog-auth-scope-columns-match-openapi-security-overrides",
       "citations": [
@@ -34999,7 +35013,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.does-not-document-retry-conflict-metadata-as-top-level-error-fields",
       "file": "spec-corpus-validity.test.ts",
-      "line": 942,
+      "line": 948,
       "title": null,
       "explicitId": "openwop.it.spec-corpus-validity.does-not-document-retry-conflict-metadata-as-top-level-error-fields",
       "citations": [
@@ -35018,7 +35032,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.typescript-exports-http-error-codes-and-ishttperrorcode",
       "file": "spec-corpus-validity.test.ts",
-      "line": 996,
+      "line": 1002,
       "title": "TypeScript exports HTTP_ERROR_CODES and isHttpErrorCode",
       "explicitId": "openwop.it.spec-corpus-validity.typescript-exports-http-error-codes-and-ishttperrorcode",
       "citations": [
@@ -35035,7 +35049,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.python-exports-http-error-codes-and-is-http-error-code",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1003,
+      "line": 1009,
       "title": "Python exports HTTP_ERROR_CODES and is_http_error_code",
       "explicitId": "openwop.it.spec-corpus-validity.python-exports-http-error-codes-and-is-http-error-code",
       "citations": [
@@ -35052,7 +35066,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.go-exports-httperrorcodes-and-ishttperrorcode",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1010,
+      "line": 1016,
       "title": "Go exports HTTPErrorCodes and IsHTTPErrorCode",
       "explicitId": "openwop.it.spec-corpus-validity.go-exports-httperrorcodes-and-ishttperrorcode",
       "citations": [
@@ -35069,7 +35083,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.sdk-readmes-document-the-http-error-helper-surface",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1017,
+      "line": 1023,
       "title": "SDK READMEs document the HTTP error helper surface",
       "explicitId": "openwop.it.spec-corpus-validity.sdk-readmes-document-the-http-error-helper-surface",
       "citations": [
@@ -35082,7 +35096,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.sdk-changelogs-mention-the-http-error-helper-surface",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1026,
+      "line": 1032,
       "title": "SDK changelogs mention the HTTP error helper surface",
       "explicitId": "openwop.it.spec-corpus-validity.sdk-changelogs-mention-the-http-error-helper-surface",
       "citations": [
@@ -35095,7 +35109,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.typescript-dist-exports-the-http-error-helper-surface",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1035,
+      "line": 1041,
       "title": "TypeScript dist exports the HTTP error helper surface",
       "explicitId": "openwop.it.spec-corpus-validity.typescript-dist-exports-the-http-error-helper-surface",
       "citations": [
@@ -35109,7 +35123,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.typescript-dist-metadata-uses-openwop-branding",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1051,
+      "line": 1057,
       "title": "TypeScript dist metadata uses openwop branding",
       "explicitId": "openwop.it.spec-corpus-validity.typescript-dist-metadata-uses-openwop-branding",
       "citations": [
@@ -35128,7 +35142,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.typescript-dist-source-maps-point-back-to-src-and-avoid-legacy-branding",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1059,
+      "line": 1065,
       "title": "TypeScript dist source maps point back to src and avoid legacy branding",
       "explicitId": "openwop.it.spec-corpus-validity.typescript-dist-source-maps-point-back-to-src-and-avoid-legacy-branding",
       "citations": [
@@ -35157,7 +35171,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.all-sdk-http-error-helpers-include",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1088,
+      "line": 1094,
       "title": null,
       "explicitId": "openwop.it.spec-corpus-validity.all-sdk-http-error-helpers-include",
       "citations": [
@@ -35171,7 +35185,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.readme-suite-count-equals-src-scenarios-test-ts-count",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1104,
+      "line": 1110,
       "title": "README suite count equals src/scenarios/*.test.ts count",
       "explicitId": "openwop.it.spec-corpus-validity.readme-suite-count-equals-src-scenarios-test-ts-count",
       "citations": [
@@ -35192,7 +35206,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.exists~2",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1124,
+      "line": 1130,
       "title": "exists",
       "explicitId": "openwop.it.spec-corpus-validity.exists~2",
       "citations": [
@@ -35205,7 +35219,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.declares-asyncapi-3-1-required-top-level-keys",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1128,
+      "line": 1134,
       "title": "declares asyncapi: 3.1 + required top-level keys",
       "explicitId": "openwop.it.spec-corpus-validity.declares-asyncapi-3-1-required-top-level-keys",
       "citations": [
@@ -35218,7 +35232,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-ref-to-schemas-json-resolves-to-a-real-file~2",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1137,
+      "line": 1143,
       "title": "every $ref to ../schemas/*.json resolves to a real file",
       "explicitId": "openwop.it.spec-corpus-validity.every-ref-to-schemas-json-resolves-to-a-real-file~2",
       "citations": [
@@ -35232,7 +35246,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.named-runeventdoc-messages-use-event-names-from-run-event-schema-json",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1146,
+      "line": 1152,
       "title": "named RunEventDoc messages use event names from run-event.schema.json",
       "explicitId": "openwop.it.spec-corpus-validity.named-runeventdoc-messages-use-event-names-from-run-event-schema-json",
       "citations": [
@@ -35250,7 +35264,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.operation-channel-refs-point-to-declared-channels",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1167,
+      "line": 1173,
       "title": "operation channel refs point to declared channels",
       "explicitId": "openwop.it.spec-corpus-validity.operation-channel-refs-point-to-declared-channels",
       "citations": [
@@ -35272,7 +35286,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.channel-keys-and-message-names-are-unique",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1189,
+      "line": 1195,
       "title": "channel keys and message names are unique",
       "explicitId": "openwop.it.spec-corpus-validity.channel-keys-and-message-names-are-unique",
       "citations": [
@@ -35291,7 +35305,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.finds-the-expected-prose-doc-set",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1236,
+      "line": 1242,
       "title": "finds the expected prose doc set",
       "explicitId": "openwop.it.spec-corpus-validity.finds-the-expected-prose-doc-set",
       "citations": [
@@ -35304,7 +35318,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.declares-a-status-tag-stub-draft-outline-final-stable-stabilizing-draft-experime",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1243,
+      "line": 1249,
       "title": null,
       "explicitId": "openwop.it.spec-corpus-validity.declares-a-status-tag-stub-draft-outline-final-stable-stabilizing-draft-experime",
       "citations": [
@@ -35318,7 +35332,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.readme-total-count-equals-the-number-of-spec-v1-prose-docs",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1270,
+      "line": 1276,
       "title": "README Total count equals the number of spec/v1 prose docs",
       "explicitId": "openwop.it.spec-corpus-validity.readme-total-count-equals-the-number-of-spec-v1-prose-docs",
       "citations": [
@@ -35335,7 +35349,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.readme-document-index-links-every-spec-v1-prose-doc-exactly-once",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1280,
+      "line": 1286,
       "title": "README document index links every spec/v1 prose doc exactly once",
       "explicitId": "openwop.it.spec-corpus-validity.readme-document-index-links-every-spec-v1-prose-doc-exactly-once",
       "citations": [
@@ -35349,7 +35363,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.finds-markdown-files-to-check",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1306,
+      "line": 1312,
       "title": "finds Markdown files to check",
       "explicitId": "openwop.it.spec-corpus-validity.finds-markdown-files-to-check",
       "citations": [
@@ -35362,7 +35376,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.has-no-broken-local-markdown-file-links",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1312,
+      "line": 1318,
       "title": null,
       "explicitId": "openwop.it.spec-corpus-validity.has-no-broken-local-markdown-file-links",
       "citations": [
@@ -35376,7 +35390,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.scans-public-docs-and-schemas",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1384,
+      "line": 1397,
       "title": "scans public docs and schemas",
       "explicitId": "openwop.it.spec-corpus-validity.scans-public-docs-and-schemas",
       "citations": [
@@ -35389,7 +35403,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.has-no-private-implementation-or-pre-v1-breadcrumbs",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1390,
+      "line": 1403,
       "title": null,
       "explicitId": "openwop.it.spec-corpus-validity.has-no-private-implementation-or-pre-v1-breadcrumbs",
       "citations": [
@@ -35403,7 +35417,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-fixture-id-mentioned-in-fixtures-md-has-a-corresponding-json",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1419,
+      "line": 1432,
       "title": "every fixture id mentioned in fixtures.md has a corresponding JSON",
       "explicitId": "openwop.it.spec-corpus-validity.every-fixture-id-mentioned-in-fixtures-md-has-a-corresponding-json",
       "citations": [
@@ -35417,7 +35431,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-fixture-json-file-is-referenced-by-fixtures-md",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1461,
+      "line": 1474,
       "title": "every fixture JSON file is referenced by fixtures.md",
       "explicitId": "openwop.it.spec-corpus-validity.every-fixture-json-file-is-referenced-by-fixtures-md",
       "citations": [
@@ -35431,7 +35445,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.a-sample-bundle-validates-against-conformance-certification-bundle-schema-json",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1514,
+      "line": 1527,
       "title": "a sample bundle validates against conformance-certification-bundle.schema.json",
       "explicitId": "openwop.it.spec-corpus-validity.a-sample-bundle-validates-against-conformance-certification-bundle-schema-json",
       "citations": [
@@ -35445,7 +35459,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-accepts-a-claim-that-is-discovery-derivable-and-floor-proven-b",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1520,
+      "line": 1533,
       "title": "verifyBundle ACCEPTS a claim that is discovery-derivable AND floor-proven (§B)",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-accepts-a-claim-that-is-discovery-derivable-and-floor-proven-b",
       "citations": [
@@ -35458,7 +35472,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-profile-its-discovery-document-does-not-derive-b-1",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1527,
+      "line": 1540,
       "title": "verifyBundle REJECTS a profile its discovery document does not derive (§B(1))",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-profile-its-discovery-document-does-not-derive-b-1",
       "citations": [
@@ -35471,7 +35485,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-bundle-missing-a-floor-scenario-b-2",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1537,
+      "line": 1550,
       "title": "verifyBundle REJECTS a bundle missing a floor scenario (§B(2))",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-bundle-missing-a-floor-scenario-b-2",
       "citations": [
@@ -35484,7 +35498,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-committed-bundle-file-exists-generated-by-certify",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1574,
+      "line": 1587,
       "title": "the committed bundle file exists (generated by --certify)",
       "explicitId": "openwop.it.spec-corpus-validity.the-committed-bundle-file-exists-generated-by-certify",
       "citations": [
@@ -35498,7 +35512,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-committed-reference-bundle-validates-against-the-bundle-schema-a",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1578,
+      "line": 1591,
       "title": "the committed reference bundle validates against the bundle schema (§A)",
       "explicitId": "openwop.it.spec-corpus-validity.the-committed-reference-bundle-validates-against-the-bundle-schema-a",
       "citations": [
@@ -35512,7 +35526,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-rejects-the-committed-reference-bundle-it-is-invalidated-rfc-0148-d",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1585,
+      "line": 1598,
       "title": "verifyBundle REJECTS the committed reference bundle — it is `invalidated` (RFC 0148 §D)",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-rejects-the-committed-reference-bundle-it-is-invalidated-rfc-0148-d",
       "citations": [
@@ -35533,7 +35547,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.discovery-sha256-is-the-canonical-json-sha-256-of-the-captured-discovery-documen",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1611,
+      "line": 1624,
       "title": "discovery.sha256 is the canonical-JSON SHA-256 of the captured discovery.document",
       "explicitId": "openwop.it.spec-corpus-validity.discovery-sha256-is-the-canonical-json-sha-256-of-the-captured-discovery-documen",
       "citations": [
@@ -35546,7 +35560,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-requestbody-closes-at-the-composition-unevaluatedproperties-not-inside-a-bra",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1672,
+      "line": 1685,
       "title": "the requestBody closes at the composition (unevaluatedProperties), not inside a branch",
       "explicitId": "openwop.it.spec-corpus-validity.the-requestbody-closes-at-the-composition-unevaluatedproperties-not-inside-a-bra",
       "citations": [
@@ -35559,7 +35573,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.canonical-createrun-bodies-pass-the-composed-schema-an-undeclared-property-fails",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1687,
+      "line": 1700,
       "title": "canonical createRun bodies PASS the composed schema; an undeclared property FAILS",
       "explicitId": "openwop.it.spec-corpus-validity.canonical-createrun-bodies-pass-the-composed-schema-an-undeclared-property-fails",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.4.1",
-  "corpusTag": "v2.4.1",
+  "version": "2.4.3",
+  "corpusTag": "v2.4.3",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "f6385deac1f8292cce87c896725bcf709308b65dfb8050f9f8113a99492596c2",
-    "api/v2/asyncapi.yaml": "edc8d91a418cc29fea8d4cbe20ad1a69af8a26c0addf9b55e29d2fbea50716b0",
-    "api/v2/openapi.yaml": "ff765953f64a79f6d7e28e3d1e4adff7d912feb03e5ee804af2bffacbd8da2b3",
+    "api/seams-v2.yaml": "3ce9fa9f9ba2809ee34e43bc328bed3a46f1d8bd3449f0126aa3c1cd1340333d",
+    "api/v2/asyncapi.yaml": "4d1bba9238c7e2345a769c131b652559e0dcc5329b195ae4fa8f473d16b47c17",
+    "api/v2/openapi.yaml": "d1a156627e36bd1aebe71b6eaf88fd961bb14ec4e7a60a5139535081444e4b35",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -200,7 +200,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "e90916db12d2297e2e560b2d54d2c4702d6cb3bef7179a575844687a7ec17262",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "195b0a6fa7944758b773e3814659ed7eb4791597ce08b3d5cf5e1588ab7c5702",
+    "spec/v1/core-standard-manifest.json": "380ae43259ab60281ee15cc3bebdda9815c08fb10b1c1a44a36cbc1fc945a98b",
     "spec/v1/deprecations.json": "c81c8f71460936c8d489d8270477c7661cf4a5d7b7bad86c98899750b5656027",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -219,7 +219,7 @@
     "spec/v2/core/errors.md": "ad85fc830139e587f20deabf88297b91b1fb6ce31e80d5442624a650246ab16e",
     "spec/v2/core/events.md": "f1bac16419740f3b722febb6f5caaabed8838e092cba3d080fe9184024049dcf",
     "spec/v2/core/form-content-packs.md": "6ffaae85d4550be48dd53fb6e2959af8aceb35bd87c5343b722885084f197713",
-    "spec/v2/core/headers.md": "91167479e63afd8fcfa1f5ee8f5da965eef8fd1cde87135911792dd2effa1b05",
+    "spec/v2/core/headers.md": "1e9fc20087985f5f1c15c45cc671fecbe7ef377bb35f3ddc0b3cb8aca31d9f2b",
     "spec/v2/core/idempotency.md": "b86c352d964aebad532727f314e26ed2177d49de382076fa64d3162e2f56118d",
     "spec/v2/core/identity.md": "9d2b823eb899463807452fe5721dcf09881837c161be024175957db27870b243",
     "spec/v2/core/interop.md": "d4c404e469e1d9d9be88bc2c939d777e7d7c1d0419b1251c18770f039838a401",
@@ -271,8 +271,8 @@
     "spec/v2/path-manifest.json": "a6f4e652e866889e8bde815874062f62929aee95dc8e58e7152c56adee262163",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "4d9ec16c653702e80967db2a08da55dd09326b5dce60e301623826a801702f78",
+    "spec/v2/release.json": "59fd18aaa5300c3555b28d9c7073439e138885216eea2ef2a12297601c5537dd",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "7e0c22fdb50aac7803ca4d9bf46c0406ae944b78"
+  "corpusCommit": "28f50899e479f710a6bad7f04ff0b399f797d45b"
 }

package/src/scenarios/v2-pack-isolation.test.ts

@@ -57,6 +57,14 @@ async function invoke(typeId: string, extra: Record<string, unknown> = {}): Prom
   if (!doc || !seamsProfileAdvertised(doc)) { softSkip('inapplicable', `the ${typeId} leg is seam-driven — seams profile (conformance.seamsProfile = openwop-conformance-seams-v2) not advertised`); return null; }
   const res = await driver.post(INVOKE, { typeId, ...extra });
   if (res.status === 404 || res.status === 403 || res.status === 405) { seamAbsent(`host advertises packs + sandbox but ${INVOKE} answered ${res.status} — the ${typeId} leg is unobservable (host-sample-test-seams.md §8)`); return null; }
+  // The same id is ALSO asserted by its own `it` above, and that is the copy the
+  // registry can see: `generate-requirement-registry.mjs` harvests `req(…)` only
+  // within an `it`, so this helper-level call alone left the id out of
+  // requirements.json — and no bundle could carry a row for it — while
+  // `check-cut-gates.mjs`, which scans every `req(` in the source, went on
+  // demanding one. §G.2 failed on a row no host could supply. RFC 0168 §A.1
+  // requires `req(…)` here rather than a bare describe, so the fix is the extra
+  // `it`, not a quieter assertion.
   expect(res.status, req('openwop.requirement.0173.pack-isolation.seam', 'host-sample-test-seams.md §8', `${INVOKE} MUST answer 200 { result } | 200 { error } for ${typeId}`)).toBe(200);
   return (res.json ?? {}) as InvokeResult;
 }
@@ -81,6 +89,18 @@ describe('RFC 0173 §B — pack-isolation (gated on packs + sandbox)', () => {
     ).toContain(model);
   });
 
+  it('the sandbox-invoke seam answers the seam contract', async () => {
+    if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
+    const doc = await discovery();
+    if (!doc || !seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'seam-driven — seams profile (conformance.seamsProfile = openwop-conformance-seams-v2) not advertised');
+    const res = await driver.post(INVOKE, { typeId: 'misbehave.fs-escape-read' });
+    if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises packs + sandbox but ${INVOKE} answered ${res.status}`);
+    expect(
+      res.status,
+      req('openwop.requirement.0173.pack-isolation.seam', 'host-sample-test-seams.md §8', `${INVOKE} MUST answer 200 { result } | 200 { error } — the eight behavioural legs are unobservable otherwise`),
+    ).toBe(200);
+  });
+
   it('node-pack-sandbox-fs-gated: a host filesystem read is refused', async () => {
     if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
     const r = await invoke('misbehave.fs-escape-read');