@openwop/openwop-conformance 2.40.0 → 2.40.2

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.40.0",
-  "corpusTag": "v2.40.0",
+  "version": "2.40.2",
+  "corpusTag": "v2.40.2",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "acd23b627e68bee6c886f21f4b8252f0dcb49d9deb5d4abc4c19d390f56b426a",
-    "api/v2/asyncapi.yaml": "de935d89b72a1196c0f8f9731f1c3d32cee118e81b4271365e76ffdc5c9fced6",
-    "api/v2/openapi.yaml": "0d12490c1739defdb302ec384d9dd81306d1d865c7023fda040baa846ff35c8b",
+    "api/seams-v2.yaml": "c92bde1fb2ac949edfb50519651ac3755cfc88b8a2a8785eab0e15bcb6a8dbb9",
+    "api/v2/asyncapi.yaml": "87d5b9de8e3fa920a0ddecce7f51018f8f573b5ef14f954973a0776d3b9d9a0f",
+    "api/v2/openapi.yaml": "532467b699c179c355349c8bb483a801156a68b003d02aa9d7cf576f867c3097",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -117,7 +117,7 @@
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "740944d7f0a00c91308449f3a3f52fa7b91b16b8fd36a0171b917afe9f4b0f09",
-    "schemas/v2/certification-bundle.schema.json": "67ac56bbf5f8deeec58b32e8d7bc9ce854a6a8c3cd81693e65192e5c3b726154",
+    "schemas/v2/certification-bundle.schema.json": "82ce31a1ed6c7e21b0ba88ff62a7b8b768fc3b176b1d06fce023203830b94725",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "92a57db2fd4b2463f14ef155fef8e3f18afc78960b646459dcf32efc79ff6bf5",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "ca5a83168c0e6a4d73d22d32acdd4ca37bfc62297ad730df6698134caa99ebbb",
+    "spec/v1/core-standard-manifest.json": "a16e3a91b9121d7b6d58fd9f65a348f92a07636417406f56bc3173571e9d55ea",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "468d5b60f5e8b276f895833ac072c3984ab104d0ad97c4d31b757290c6077172",
+    "spec/v1/gaps.json": "3decfec271c30f796ba76586ca06ab31e6ea3b8bcae174c3af0b8bb1c19709b5",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -218,7 +218,7 @@
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "ccfed7d978ce7293a6d8f3c0f6045835dfb7e488f2b67a68f6b04d67c4b0cfc9",
     "spec/v2/core/capabilities.md": "e22381fed3a93376ad478fa7f07571fdad9653aefd7c05f189a2ef45a49f6c63",
-    "spec/v2/core/conformance.md": "38ebc9e56a830d0ee0ade429b81b0cd302c23e49a13647b1b902275262d6610d",
+    "spec/v2/core/conformance.md": "e4d3b34ef5b7c6a34675ed59a086143e8bfd0e00d0d04ce0f2a2ec6245275084",
     "spec/v2/core/connection-packs.md": "7257339a4fc125011bf89961588c949cb058a0c0f7d9808ad08a5288deb3f8fc",
     "spec/v2/core/conversation.md": "c9a937e410fdb4e092cec2f05a7cab8b5232745090cfb20041c03c70ccbb5cdc",
     "spec/v2/core/errors.md": "619cd74381c41acf33d012eb1afd834e148ac292663a1a6fa6744dbaff9661d9",
@@ -231,7 +231,7 @@
     "spec/v2/core/interop.md": "9a6b37e07c0235856199ace6b3a84f592fa5903fcf6c442f8a18f4d6b6aa5525",
     "spec/v2/core/interrupt.md": "1dc94f7c791dd5a547b1abafde6a8a76acd3d2993d288057f302f57911dc83bf",
     "spec/v2/core/node-pack-runtimes.md": "c435ad506f618831b6c0a9fd9150d83a5dc6caa1e3d755b949af2ff8949f1140",
-    "spec/v2/core/oauth.md": "08e558a742259e75cfb2123f4c364d238dc4c57eea1a3c25d8f420ab4dff8244",
+    "spec/v2/core/oauth.md": "38ec0e70d46f328430138559095f261ae4fcd3d32c2d994a2d3e630a062c0e6c",
     "spec/v2/core/overview.md": "8f9d4a68b6185664e40d226cb82d9a9270a6c6630e3db59bddff300be781947d",
     "spec/v2/core/packs.md": "91cd577b4a636c1587ef78742e583a203244b8508b289b01a18a8ef2ef0a9b3e",
     "spec/v2/core/persistence.md": "d32736bd74e51df7c552565b4105a8ec801ece6d2292c8676421368ee9bffec1",
@@ -284,6 +284,8 @@
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
     "spec/v2/facets/webhooks.schema.json": "2fac635ee5fbc10a14a1a46cf512a11bac660bfbabe0aea79f6c7b657ecb9e4e",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
+    "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
+    "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
     "spec/v2/id-field-bindings.json": "9f6fd280250447e26a6704811c352bb8f2ff6c4bd242befe3da0ba38962370e9",
     "spec/v2/interop-map.json": "02255dafe7eb55f61ca7f9ae7c21f079d1848a6756991343088975ac9d184b8d",
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
@@ -292,9 +294,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "f17a7e0066d7851adfb246c586f12199d14fee60bf7a0eda203a124116dcff9e",
+    "spec/v2/release.json": "f04bc2406dfc3af40a495d8750349409f053bb56f009359ebc62a8877251c90f",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "2ba53481583261c59008da86d1db82ed9f657675dfe2f8b019ec7d82f5bdb4b4"
+    "spec/v2/surface-baseline.json": "26f2a03c650413ac9c0d0b5facee47ee0eaebeb01d377c808fe6e737bb08687c"
   },
-  "corpusCommit": "44b89e1e50f56dd2a0834771225b8e04d2bd9e6f"
+  "corpusCommit": "70c93c0fcd5c595893c1cac7cf1020d5c5835ec2"
 }

package/src/cli.ts

@@ -83,6 +83,8 @@ interface ParsedArgs {
   readonly verifyPath: string | undefined;
   /** `--host-key <pem>` — the key `--verify` checks the host signature under. Absent ⇒ the verdict is INCOMPLETE, not clean. */
   readonly verifyHostKeyPath: string | undefined;
+  /** RFC 0216 §B — `--as-colocated-companion`. */
+  readonly colocatedCompanion: boolean;
   readonly verifierKeyId: string | undefined;
   /**
    * S43 (2026-08-18) — cap on concurrently running scenario FILES, forwarded to
@@ -112,6 +114,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
   let signingKeyPath: string | undefined, signingKeyId: string | undefined, verifierKeyPath: string | undefined, verifierKeyId: string | undefined;
   let targetMajor: 1 | 2 | undefined;
   let maxWorkers: number | undefined = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
+  let colocatedCompanion = false;
 
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i] ?? '';
@@ -202,6 +205,12 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
       case '--host-key':
         verifyHostKeyPath = nextValue();
         break;
+      // RFC 0216 §B — marks the bundle as cut from a colocated companion (the
+      // served host's image beside the suite, trusting a suite-held anchor).
+      // The marker is inside witnessSha256, so a signed companion cannot shed it.
+      case '--as-colocated-companion':
+        colocatedCompanion = true;
+        break;
       case '--require-behavior':
         process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
         break;
@@ -240,6 +249,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
     maxWorkers,
     verifyPath,
     verifyHostKeyPath,
+    colocatedCompanion,
   };
 }
 
@@ -288,6 +298,10 @@ Certification (RFC 0089):
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.
+  --as-colocated-companion  v3 (RFC 0216): mark the bundle as cut from a colocated companion — the
+                        served host's image run beside the suite so it can trust a suite-held
+                        trust anchor. Signed (inside witnessSha256). A companion is acceptance
+                        evidence only for spec/v2/harness-trust-anchors.json rows.
   --max-workers <n>     Cap concurrently running scenario files (vitest --maxWorkers).
                         Default: one worker per CPU. Use a small number against a
                         rate-limited production origin so 429s don't read as failures.
@@ -709,7 +723,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       bundleVersion: '3',
       generatedAt: new Date().toISOString(),
       suite: { name: '@openwop/openwop-conformance', version, targetMajor: target.major, specArtifactsVersion: lock?.version ?? 'repo-layout', ...(lock ? { stampSha256: lock.stampSha256 } : {}) },
-      host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}) },
+      host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}), ...(args.colocatedCompanion ? { deployment: 'colocated-companion' as const } : {}) },
       // `document` is what makes `claimedProfiles[].certified` checkable by
       // someone other than this process (RFC 0148 §B(1)); v2 carried it and v3
       // dropped it. `sha256` is a digest of `canonicalJSON(document)`, so the
@@ -717,7 +731,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion, document },
       claimedProfiles: claimed3,
       results: { totals: totals3, requirements: rows3 },
-      witnessSha256: witnessDigest(rows3, relaxations),
+      witnessSha256: witnessDigest(rows3, relaxations, args.colocatedCompanion ? 'colocated-companion' : undefined),
       assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
       ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
       // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
@@ -908,6 +922,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
 
 async function main(): Promise<never> {
   const args = parseArgs(process.argv.slice(2));
+  if (args.colocatedCompanion && (!args.certify || args.bundleVersion !== '3')) {
+    process.stderr.write('openwop-conformance: --as-colocated-companion marks a v3 certification bundle; it needs --certify with bundle version 3 (RFC 0216 §B)\n');
+    process.exit(2);
+  }
   // Refused before anything runs: a pinned-port certification that is not
   // single-worker loses the host's traffic to a worker nobody reads (lib/pinned-ports.ts).
   const pinnedConflict = pinnedPortWorkerConflict(process.env, args.maxWorkers, args.certify !== undefined);

package/src/lib/certification-bundle-v3.ts

@@ -41,12 +41,14 @@ export interface BundleV3Profile {
   readonly certified: boolean;
 }
 export interface BundleV3Relaxation { readonly obligation: string; readonly durability: 'session' | 'deployment' | 'persisted'; readonly reason: string }
+/** RFC 0216 §B — absent means the bundle measures the served host. */
+export type BundleV3Deployment = 'colocated-companion';
 export interface BundleV3Signature { readonly alg: 'ed25519'; readonly keyId: string; readonly sig: string; readonly over: readonly string[]; readonly verifierKeyId?: string }
 export interface BundleV3 {
   bundleVersion: '3';
   generatedAt: string;
   suite: { name: '@openwop/openwop-conformance'; version: string; targetMajor: 1 | 2; specArtifactsVersion: string; stampSha256?: string };
-  host: { name: string; version: string; vendor?: string; build: { kind: 'image-digest' | 'commit' | 'artifact-sha256'; id: string }; signingKeyId?: string; relaxations?: BundleV3Relaxation[] };
+  host: { name: string; version: string; vendor?: string; build: { kind: 'image-digest' | 'commit' | 'artifact-sha256'; id: string }; signingKeyId?: string; relaxations?: BundleV3Relaxation[]; deployment?: BundleV3Deployment };
   /**
    * `document` is the captured `/.well-known/openwop` payload, OPTIONAL.
    *
@@ -106,12 +108,20 @@ export { canonicalJSON } from './jcs.js';
  * from the same bundle anywhere else (Czech sorts `ch` after `h`). Every
  * committed bundle's ids are `[a-z0-9.-]`, where the two orders coincide, so no
  * stored digest changes (v2-bundle-witness-preimage.test.ts pins that).
+ *
+ * RFC 0216 §B.7 — a colocated companion's `host.deployment` joins the preimage
+ * the same way, ONLY WHEN PRESENT (`{ rows, relaxations?, deployment }`), so a
+ * signed companion cannot shed the marker and pass as a served-host bundle, and
+ * every bundle without it digests exactly as before.
  */
-export function witnessDigest(rows: readonly BundleV3Requirement[], relaxations?: readonly BundleV3Relaxation[]): string {
+export function witnessDigest(rows: readonly BundleV3Requirement[], relaxations?: readonly BundleV3Relaxation[], deployment?: BundleV3Deployment): string {
   const canonicalRows = [...rows].sort((a, b) => codeUnitCompare(a.id, b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
     // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
     ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
-  const preimage = relaxations !== undefined && relaxations.length > 0 ? { rows: canonicalRows, relaxations } : canonicalRows;
+  const relaxed = relaxations !== undefined && relaxations.length > 0;
+  const preimage = relaxed || deployment !== undefined
+    ? { rows: canonicalRows, ...(relaxed ? { relaxations } : {}), ...(deployment !== undefined ? { deployment } : {}) }
+    : canonicalRows;
   return createHash('sha256').update(canonicalJSON(preimage), 'utf8').digest('hex');
 }
 
@@ -219,8 +229,8 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
   const count = (d: BundleV3Result): number => rows.filter((r) => r.result === d).length;
   const expected = { executedPass: count('executed-pass'), executedFail: count('executed-fail'), skipped: count('skipped'), inapplicable: count('inapplicable'), blocked: count('blocked') };
   for (const k of Object.keys(expected) as (keyof typeof expected)[]) if (bundle.results?.totals?.[k] !== expected[k]) rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(bundle.results?.totals?.[k])} but the rows count ${expected[k]}` });
-  const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations));
-  if (digest !== undefined && bundle.witnessSha256 !== digest) rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows and declared relaxations (${digest.slice(0, 12)})` });
+  const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations, bundle.host?.deployment));
+  if (digest !== undefined && bundle.witnessSha256 !== digest) rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows, declared relaxations and deployment marker (${digest.slice(0, 12)})` });
   const assertions = rows.reduce((n, r) => n + (r.assertions ?? 0), 0);
   if (bundle.assertionCount !== assertions) rejections.push({ kind: 'assertion-count', detail: `assertionCount is ${String(bundle.assertionCount)} but the rows sum to ${assertions}` });
   const nonPass = rows.filter((r) => r.result !== 'executed-pass');

package/src/lib/harness-issuer.ts

@@ -0,0 +1,101 @@
+/**
+ * The suite's harness OIDC issuer, as an INSTRUMENT a host claims.
+ *
+ * Two major-2 scenarios need a token the host would accept, and the suite can
+ * mint one only with a key it holds: `v2-oidc-id-token-audience` (RFC 0200 §D)
+ * and `v2-lane-exp-only-bound` (RFC 0210 §B). The suite holds the key of exactly
+ * one issuer, the one it stands up at `OPENWOP_TEST_OIDC_ISSUER_URL`.
+ *
+ * ── Why the gate reads the host's lane, not only the environment ────────────
+ * Until 2.40.2 both files recorded `blocked` whenever the harness was not the
+ * host's trust root. A PRODUCTION host MUST NOT trust a test issuer — a deployed
+ * service that accepts tokens signed by a key living on a test runner has an
+ * authentication bypass — so every honest production bundle advertising an
+ * `oidc` or `exp-only` lane carried `blocked` rows, and RFC 0168 §E.1 makes one
+ * `blocked` row deny certification bundle-wide. Measured on openwop-app
+ * (ADR 0745 corpus defect 1); MyndHyve is in the same position.
+ *
+ * RFC 0168 §C.1 already rules on this shape for the other suite instrument a
+ * host has to be configured for, the seams profile: "a scenario that finds the
+ * exact advert absent records `inapplicable` — never `blocked`, which is
+ * reserved for an advertised profile whose seam does not answer". The harness
+ * issuer is claimed the same way, by the host's own advertisement: a lane's
+ * `issuers[]` (`spec/v2/facets/auth.schema.json`) names the trust roots that
+ * lane accepts. So:
+ *
+ *   - the lane's `issuers[]` does not name the harness URL (or no harness URL is
+ *     configured) → `inapplicable`, and the reason names the issuers the host
+ *     DOES trust — a fact about the host, not about the suite;
+ *   - the lane names it → the host has claimed the instrument; a harness that
+ *     cannot be served, or a control token the host then refuses, is `blocked`
+ *     or a failure exactly as before.
+ *
+ * The cost, stated rather than hidden: a production bundle no longer witnesses
+ * these rows at all, just as it witnesses no seam-gated row. The witness comes
+ * from a cut whose lane advertises the harness issuer — the reference host, or
+ * a colocated boot of the same release image.
+ *
+ * ── Reachability ─────────────────────────────────────────────────────────────
+ * The PORT is `issuerListenPort()` (2.39.4: `OPENWOP_TEST_OIDC_ISSUER_PORT`,
+ * else the URL's port). The BIND is `receiverBinding()`, as for the webhook
+ * receiver and the OAuth doubles: loopback, or `0.0.0.0` when
+ * `OPENWOP_CONFORMANCE_HARNESS_HOST` says the host is in a container or on
+ * another box. Until 2.40.2 the issuer always bound `127.0.0.1`, so a host in a
+ * Linux container reaching it through `host-gateway` found nothing listening on
+ * the interface it arrived at (openwop-app ADR 0745 defect 2). The URL is what
+ * the host was configured with and is what `iss` and discovery carry; only the
+ * listening socket moves.
+ */
+
+import { createServer, type Server } from 'node:http';
+import { receiverBinding } from './webhook-receiver.js';
+import { issuerListenPort, type SyntheticOIDCIssuer } from './oidc-issuer.js';
+
+const norm = (u: string): string => u.trim().replace(/\/+$/, '');
+
+export type HarnessClaim =
+  | { readonly ok: true; readonly url: string }
+  | { readonly ok: false; readonly kind: 'inapplicable'; readonly reason: string };
+
+/**
+ * Has the host claimed the harness issuer on `lane`? Pure: decided from the
+ * advertised lane record and the configured harness URL.
+ */
+export function harnessClaimed(lane: Readonly<Record<string, unknown>>, harnessUrl: string | undefined): HarnessClaim {
+  const name = String(lane['lane']);
+  const issuers = Array.isArray(lane['issuers']) ? (lane['issuers'] as unknown[]).filter((x): x is string => typeof x === 'string') : [];
+  const listed = issuers.length > 0 ? issuers.join(', ') : 'none';
+  const url = harnessUrl?.trim();
+  if (!url) {
+    return { ok: false, kind: 'inapplicable', reason: `lane ${name} trusts ${listed}, and no harness issuer is configured (OPENWOP_TEST_OIDC_ISSUER_URL unset): the suite holds a signing key for none of the host's trust roots, so no token it mints could be accepted. A host claims the harness by listing it in the lane's issuers[] (RFC 0168 §C.1's reading for suite instruments)` };
+  }
+  if (!issuers.some((i) => norm(i) === norm(url))) {
+    return { ok: false, kind: 'inapplicable', reason: `lane ${name} trusts ${listed}, which does not include the harness issuer ${url}: this host has not claimed the suite's issuer as a trust root (a production host must not), so the suite holds no key the host accepts. RFC 0168 §C.1's reading for suite instruments — witnessed on a cut whose lane lists the harness` };
+  }
+  return { ok: true, url: norm(url) };
+}
+
+/** Serve `issuer`'s discovery + JWKS for the host to fetch. Resolves to the listening server. */
+export async function serveHarnessIssuer(issuer: SyntheticOIDCIssuer, url: string): Promise<Server> {
+  const port = issuerListenPort(url);
+  const { bind } = receiverBinding();
+  const srv = createServer((r, res) => {
+    if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(issuer.jwksJson); return; }
+    if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(issuer.discoveryJson); return; }
+    res.writeHead(404); res.end();
+  });
+  // Two scenario files serve the one issuer URL, and vitest runs files in
+  // parallel: wait for the holder to close rather than fail (each instance has
+  // its own kid, so a host that cached the other file's JWKS re-fetches).
+  const deadline = Date.now() + 25_000;
+  for (;;) {
+    const e = await new Promise<NodeJS.ErrnoException | null>((ok) => {
+      const onErr = (err: NodeJS.ErrnoException): void => ok(err);
+      srv.once('error', onErr);
+      srv.listen(port, bind, () => { srv.off('error', onErr); ok(null); });
+    });
+    if (e === null) return srv;
+    if (e.code !== 'EADDRINUSE' || Date.now() > deadline) throw e;
+    await new Promise((ok) => setTimeout(ok, 250));
+  }
+}

package/src/lib/v2-retired-members.ts

@@ -0,0 +1,119 @@
+/**
+ * RFC 0197 §A.3 — which persisted-class v2 members are retired at the release
+ * the suite ships, and whether an emitted event carries one.
+ *
+ * A persisted-class retirement keeps the member in the READER schema,
+ * annotated `x-openwop-retired-in: "2.N"`, and forbids only its EMISSION after
+ * `2.N`. The deprecations register says WHICH rows are persisted-class and
+ * when they fall due; the annotation in the v2 schema says WHAT the member is
+ * (a property name, or a `const` / single-member `enum` value). This module
+ * joins the two so `v2-capability-maturity-bounded`'s `retired-not-emitted`
+ * leg can scan real events for it.
+ *
+ * Pure (the caller passes the parsed register and a schema loader) so the
+ * self-test drives the due / not-due / unlocatable branches with fixtures —
+ * the register is empty today, so the host leg cannot reach them yet.
+ *
+ * @see RFCS/0197-v2-surfaces-retired-never-reshaped.md §A.3
+ * @see scripts/check-removal-dates.mjs (the corpus gate that requires the annotation on a due persisted row)
+ */
+
+type Json = Record<string, unknown>;
+
+export interface PersistedRetirement {
+  readonly id: string;
+  readonly removeIn: string;
+  readonly due: boolean;
+  /** `schemas/v2/…` source files the row cites, relative to the contract root. */
+  readonly schemaFiles: readonly string[];
+}
+
+export interface RetiredMember {
+  readonly rowId: string;
+  readonly removeIn: string;
+  readonly schemaFile: string;
+  /** `property`: an object key; `value`: a string value. */
+  readonly kind: 'property' | 'value';
+  readonly name: string;
+}
+
+export interface RetiredEmission {
+  readonly rowId: string;
+  readonly member: string;
+  readonly eventType: string;
+  readonly path: string;
+}
+
+const minorOf = (v: string): number | null => {
+  const m = /^2\.(\d+)(?:\.\d+)?$/.exec(v.trim());
+  return m ? Number(m[1]) : null;
+};
+
+const triggersOf = (e: Json): string[] => {
+  const t = e['removalTrigger'];
+  return Array.isArray(t) ? t.filter((x): x is string => typeof x === 'string') : typeof t === 'string' ? [t] : [];
+};
+
+/** Every `v2-minor` row whose `retirement.persistence` is `persisted`, and whether `release` has reached its `removeIn`. */
+export function persistedRetirements(deprecations: unknown, release: string): PersistedRetirement[] {
+  const entries = ((deprecations as { entries?: unknown } | null)?.entries ?? []) as Json[];
+  const rel = minorOf(release);
+  const out: PersistedRetirement[] = [];
+  for (const e of Array.isArray(entries) ? entries : []) {
+    if (!triggersOf(e).includes('v2-minor')) continue;
+    const r = e['retirement'] as Json | undefined;
+    if ((r?.['persistence'] ?? 'advertised') !== 'persisted') continue;
+    const removeIn = String(e['removeIn'] ?? '');
+    const at = minorOf(removeIn);
+    const sources = (Array.isArray(e['sources']) ? e['sources'] : []) as Json[];
+    out.push({
+      id: String(e['id'] ?? '(no id)'),
+      removeIn,
+      due: rel !== null && at !== null && rel >= at,
+      schemaFiles: sources.map((s) => String(s['file'] ?? '')).filter((f) => /^schemas\/v2\//.test(f)),
+    });
+  }
+  return out;
+}
+
+/** The members a due row's schema annotates `x-openwop-retired-in: <removeIn>`. */
+export function retiredMembers(row: PersistedRetirement, loadSchema: (file: string) => unknown): RetiredMember[] {
+  const out: RetiredMember[] = [];
+  for (const file of row.schemaFiles) {
+    const walk = (node: unknown, parentKey: string | null, grandKey: string | null): void => {
+      if (Array.isArray(node)) { for (const n of node) walk(n, null, parentKey); return; }
+      if (node === null || typeof node !== 'object') return;
+      const o = node as Json;
+      if (o['x-openwop-retired-in'] === row.removeIn) {
+        if (typeof o['const'] === 'string') out.push({ rowId: row.id, removeIn: row.removeIn, schemaFile: file, kind: 'value', name: o['const'] });
+        else if (Array.isArray(o['enum']) && o['enum'].length === 1 && typeof o['enum'][0] === 'string') out.push({ rowId: row.id, removeIn: row.removeIn, schemaFile: file, kind: 'value', name: o['enum'][0] });
+        else if (grandKey === 'properties' && parentKey !== null) out.push({ rowId: row.id, removeIn: row.removeIn, schemaFile: file, kind: 'property', name: parentKey });
+      }
+      for (const [k, v] of Object.entries(o)) walk(v, k, parentKey);
+    };
+    walk(loadSchema(file), null, null);
+  }
+  return out;
+}
+
+/** Every place an event carries a retired member: a key named for a `property` member, or a string equal to a `value` member. */
+export function findRetiredEmissions(events: readonly unknown[], members: readonly RetiredMember[]): RetiredEmission[] {
+  const hits: RetiredEmission[] = [];
+  for (const ev of events) {
+    const eventType = String((ev as Json | null)?.['type'] ?? '(untyped)');
+    const walk = (node: unknown, path: string): void => {
+      if (typeof node === 'string') {
+        for (const m of members) if (m.kind === 'value' && node === m.name) hits.push({ rowId: m.rowId, member: m.name, eventType, path });
+        return;
+      }
+      if (Array.isArray(node)) { node.forEach((n, i) => walk(n, `${path}[${i}]`)); return; }
+      if (node === null || typeof node !== 'object') return;
+      for (const [k, v] of Object.entries(node as Json)) {
+        for (const m of members) if (m.kind === 'property' && k === m.name) hits.push({ rowId: m.rowId, member: m.name, eventType, path: `${path}.${k}` });
+        walk(v, `${path}.${k}`);
+      }
+    };
+    walk(ev, '$');
+  }
+  return hits;
+}

package/src/scenarios/v2-a2ui-v09-surface.test.ts

@@ -19,6 +19,14 @@
  * Every refusal leg carries an admitted control in the same run, so a host that
  * refuses everything fails as surely as one that refuses nothing.
  *
+ * The last describe accounts for §C.9's `render-needs-root`, whose
+ * Falsifiability verdict is `unwitnessable`: the guarantee is render-side, and
+ * a server-oriented suite cannot observe a renderer. It records `inapplicable`
+ * on EVERY host, before any request and before the seam gate, and names where
+ * the real witness lives: a reference-app client probe, `tier: reference-impl`,
+ * following the `a2ui-surface-no-code-exec` precedent. It never asserts and
+ * cannot become a pass.
+ *
  * @see RFCS/0209-v2-a2ui-surfaces-are-a2ui-v0-9.md
  * @see spec/v2/ext/a2uiSurface/README.md
  * @see spec/v2/core/events.md §"The envelope-kind catalog"
@@ -295,3 +303,10 @@ describe('RFC 0209 §C.12 — trust is sticky across the fold (seam-gated)', ()
     }
   });
 });
+
+describe('RFC 0209 §C.9 — no render before root (declared unwitnessable here; reference-impl witness)', () => {
+  it('records why render-needs-root has no server-side witness, and where its witness lives', () => {
+    req('openwop.requirement.0209.render-needs-root', 'RFC 0209 §C.9', 'a renderer does not render a surface before its root component exists');
+    return softSkip('inapplicable', 'unwitnessable by this suite (RFC 0209 §C.9 Falsifiability verdict): a render-side guarantee, and a server-oriented suite cannot observe a renderer. The fold guard the server CAN observe is openwop.requirement.0209.fold-guarded, above. The render half is witnessed as a reference-app client probe (tier: reference-impl, the a2ui-surface-no-code-exec precedent): openwop/openwop-app frontend/react/src/chat/a2ui/__tests__/a2ui-v09-render-needs-root.test.tsx (openwop-app#4121, ADR 0749). Removing the `if (!state.renderable)` guard in frontend/react/src/chat/a2ui/v09/A2uiV09Surface.tsx turns 2 of its 4 cases red. This row records that the suite reached the requirement, and it is not a pass.');
+  });
+});

package/src/scenarios/v2-artifact-a2a-shape.test.ts

@@ -21,6 +21,13 @@
  * The server-free legs (the schemas against A2A v1.0.1) are corpus rows in
  * `src/coherence/a2a-parts-schemas.test.ts`.
  *
+ * The last describe accounts for §C.11's `export-alias-equivalence`, whose
+ * Falsifiability verdict is `unwitnessable`. It records `inapplicable` with that
+ * verdict's reason on EVERY host, before any request, and never asserts. The
+ * row exists so a bundle says the suite reached the requirement and why it
+ * cannot observe it (`check-accepted-predicate` rule 4, second branch). It is
+ * not a witness and cannot become one.
+ *
  * @see RFCS/0205-run-artifacts-and-turns-speak-a2a-parts.md
  * @see spec/v2/core/runs.md §"Annotations, artifacts, eval summary"
  */
@@ -120,3 +127,10 @@ describe('RFC 0205 §A.3 — a url Part does not resolve beyond the caller\'s au
     }
   });
 });
+
+describe('RFC 0205 §C.11 — an export alias and its media type name one format (declared unwitnessable)', () => {
+  it('records why export-alias-equivalence has no wire witness', () => {
+    req('openwop.requirement.0205.export-alias-equivalence', 'RFC 0205 §C.11', 'an export alias and its media type name one format');
+    return softSkip('inapplicable', 'unwitnessable on the wire (RFC 0205 §C.11 Falsifiability verdict): the equivalence binds a consumer\'s format-matching logic and the pack author\'s host.artifactTypes.export call, and neither is on the wire. The advertised spellings are readable, but a mismatch between them is legal, so no host response can falsify the row. No wire witness exists; this row records that the suite reached the requirement, and it is not a pass.');
+  });
+});

package/src/scenarios/v2-capability-maturity-bounded.test.ts

@@ -27,21 +27,44 @@
  * document and 38 families fail. That run is the sabotage proof, recorded in
  * the RFC 0197 gates PR.
  *
+ * The second describe is RFC 0197 §A.3's emission leg,
+ * `openwop.requirement.0197.retired-not-emitted`. Its Falsifiability verdict
+ * is "unwitnessable until the first persisted-class retirement row exists", so
+ * the leg is CONDITIONAL, never vacuous. It reads the deprecations register
+ * the suite ships, and while that has no due `v2-minor` row with
+ * `retirement.persistence: "persisted"`, it records `inapplicable` with the
+ * RFC's own reason. It must record a reason: rule 4 of
+ * `check-accepted-predicate` accepts a declared non-executable row only when a
+ * bundle row gives one. Once such a row is due, the leg drives a run and fails
+ * on any event that carries a member the v2 schema annotates
+ * `x-openwop-retired-in`. It never records `executed-pass` without scanning
+ * events. The branches the host leg cannot reach today are self-tested in
+ * `lib/v2-retired-members.test.ts`.
+ *
  * @see spec/v2/core/capabilities.md §8
  * @see spec/v2/declaration.json
- * @see RFCS/0197-v2-surfaces-retired-never-reshaped.md §C
+ * @see RFCS/0197-v2-surfaces-retired-never-reshaped.md §A.3, §C
  */
 
 import { describe, it, expect } from 'vitest';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { v2Discovery } from '../lib/v2.js';
+import { driver } from '../lib/driver.js';
+import { persistedRetirements, retiredMembers, findRetiredEmissions } from '../lib/v2-retired-members.js';
 import { SCHEMAS_DIR, SPEC_V2_DIR } from '../lib/paths.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const DOC = 'spec/v2/core/capabilities.md §8';
 const ID = 'openwop.requirement.0197.maturity-not-overstated';
+const RETIRED_ID = 'openwop.requirement.0197.retired-not-emitted';
+const RETIRED_DOC = 'RFC 0197 §A.3';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+function readJson(path: string): unknown {
+  return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : null;
+}
 
 interface DeclarationFamily { key: string; maturity?: { technical?: string } }
 
@@ -106,3 +129,41 @@ describe('v2 capability-maturity-bounded (RFC 0197 §C.7)', () => {
     expect(records.length, req(ID, DOC, `the scenario asserted over ${records.length} family record(s)${undeclared.length > 0 ? `; ${undeclared.length} carry no declaration row and are left to v2-capabilities-root-closed: ${undeclared.join(', ')}` : ''}`)).toBeGreaterThan(0);
   });
 });
+
+describe('v2 retired-not-emitted (RFC 0197 §A.3) — conditional on a due persisted-class retirement', () => {
+  it('no run emits a persisted member the release has retired', async () => {
+    if (SPEC_V2_DIR === null) return softSkip('blocked', 'spec/v2/ is not present in this layout — the retirement register cannot be read, and a register that cannot be read is not an absence');
+    const deprecations = readJson(join(SPEC_V2_DIR, '..', 'v1', 'deprecations.json'));
+    const migrations = readJson(join(SPEC_V2_DIR, 'migrations.json')) as { rows?: unknown[] } | null;
+    const release = (readJson(join(SPEC_V2_DIR, 'release.json')) as { version?: unknown } | null)?.version;
+    if (deprecations === null || typeof release !== 'string') return softSkip('blocked', 'spec/v1/deprecations.json or spec/v2/release.json is missing from the shipped corpus — the retirement register cannot be read');
+    const rows = persistedRetirements(deprecations, release);
+    const due = rows.filter((r) => r.due);
+    const census = `corpus ${release}: ${rows.length} persisted-class v2-minor retirement row(s), ${(migrations?.rows ?? []).length} v2→v2 migration row(s)`;
+    if (due.length === 0) {
+      return softSkip('inapplicable', `unwitnessable until the first persisted-class retirement row is due (RFC 0197 §A.3 Falsifiability): ${census}${rows.length > 0 ? `, none due yet (${rows.map((r) => `${r.id} removeIn ${r.removeIn}`).join(', ')})` : ''} — no retired member exists for a post-2.N event to carry. Before one does, a scenario would be vacuous, and a row that cannot fail is not a witness. This leg asserts the moment such a row falls due.`);
+    }
+    const contractRoot = join(SPEC_V2_DIR, '..', '..');
+    const members = due.flatMap((r) => retiredMembers(r, (file) => readJson(join(contractRoot, file))));
+    const unlocated = due.filter((r) => !members.some((m) => m.rowId === r.id));
+    if (unlocated.length > 0) return softSkip('blocked', `due persisted-class retirement row(s) whose member carries no x-openwop-retired-in annotation the suite can read: ${unlocated.map((r) => `${r.id} (${r.schemaFiles.join(', ') || 'no schemas/v2 source'})`).join('; ')}. Without the member there is nothing to scan for, and scanning for nothing is not a pass (check-removal-dates owns the missing annotation)`);
+    const create = await driver.post('/runs', { workflowId: 'conformance-noop' });
+    const runId = String((create.json as { runId?: unknown } | null)?.runId ?? '');
+    if (create.status !== 201 || runId === '') return softSkip('blocked', `POST /runs {workflowId: conformance-noop} answered ${create.status} — no post-${due[0]!.removeIn} run to read events from`);
+    const deadline = Date.now() + 20_000;
+    for (;;) {
+      const res = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+      if (res.status === 200 && TERMINAL.has(String((res.json as { status?: unknown } | null)?.status ?? ''))) break;
+      if (Date.now() > deadline) return softSkip('blocked', `conformance-noop run ${runId} did not reach a terminal status within 20 s`);
+      await new Promise((r) => setTimeout(r, 200));
+    }
+    const poll = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`);
+    const events = (poll.json as { events?: unknown } | null)?.events;
+    if (poll.status !== 200 || !Array.isArray(events) || events.length === 0) return softSkip('blocked', `the event poll for run ${runId} answered ${poll.status} with no events — there is nothing emitted to scan`);
+    const hits = findRetiredEmissions(events, members);
+    expect(
+      hits.map((h) => `${h.member} (${h.rowId}, retired in ${members.find((m) => m.rowId === h.rowId)?.removeIn}) in ${h.eventType} at ${h.path}`),
+      req(RETIRED_ID, RETIRED_DOC, `a host MUST NOT emit a persisted member after the minor that retired it; scanned ${events.length} event(s) for ${members.length} retired member(s): ${members.map((m) => `${m.kind} ${m.name}`).join(', ')}`),
+    ).toEqual([]);
+  });
+});