@openwop/openwop-conformance 2.42.5 → 2.42.7

package/src/scenarios/redactionAdversarial.test.ts

@@ -48,7 +48,7 @@ import { CANARIES, CANARY_MARKER, getCanary } from '../lib/canaries.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const NOOP_WORKFLOW_ID = 'conformance-noop';
 const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);
@@ -77,8 +77,9 @@ describe.skipIf(SKIP_NO_NOOP)('redaction-adversarial: workflow input canaries',
       `/v1/runs/${encodeURIComponent(runId)}/events/poll`,
     );
     if (events.status !== 200) {
-      // Host doesn't expose polling; SSE is the alternative. Skip-equivalent.
-      return softSkip('blocked', 'precondition not met — `events.status !== 200` returned early (Host doesn\'t expose polling; SSE is the alternative. Skip-equivalent.) (seam, prior step, or fixture unavailable)');
+      // events/poll is a core endpoint (rest-endpoints.md); without it the
+      // canary check below never runs, so the leg is blocked, not passed.
+      return blockedDespiteAssertions('GET /v1/runs/{runId}/events/poll did not answer 200 — the canary non-disclosure is unobserved');
     }
 
     const eventsText = events.text;
@@ -139,7 +140,7 @@ describe.skipIf(SKIP_NO_NOOP)('redaction-adversarial: bearer-shaped strings roun
     const events = await driver.get(
       `/v1/runs/${encodeURIComponent(runId)}/events/poll`,
     );
-    if (events.status !== 200) return softSkip('blocked', 'precondition not met — `events.status !== 200` returned early (seam, prior step, or fixture unavailable)');
+    if (events.status !== 200) return blockedDespiteAssertions('GET /v1/runs/{runId}/events/poll did not answer 200 — the canary non-disclosure is unobserved');
 
     expect(events.text.includes(canary), req('openwop.it.redactionAdversarial.anthropic-shaped-canary-embedded-in-non-credential-input-must-not-appear-verbati', 
       'capabilities.md §"Secrets" + NFR-7',

package/src/scenarios/registry-public.test.ts

@@ -215,7 +215,11 @@ describe('registry-public: tarball + signature + Ed25519 verify roundtrip', () =
     // `method=ed25519` — the simpler path. Extending to `manual` would
     // require the tarball extractor from registry/scripts/verify-
     // signatures.mjs which is intentionally out of scope here.
-    if (method !== 'ed25519') return softSkip('blocked', 'precondition not met — `method !== \'ed25519\'` returned early (seam, prior step, or fixture unavailable)');
+    // partial-witness-ok: tarball, signature, public key and SRI were asserted
+    // above. `manual` is a conforming signing method whose pack.json-in-tarball
+    // verification this scenario does not implement, a suite limitation, not a
+    // host shortfall.
+    if (method !== 'ed25519') return softSkip('inapplicable', `${PACK_NAME} is signed method=manual; this scenario verifies only method=ed25519 signatures`);
 
     const verified = cryptoVerify(null, tarball.bytes, publicKey, sig.bytes);
     expect(verified, req('openwop.it.registry-public.tarball-sig-public-key-all-retrievable-sri-matches-ed25519-verifies-for', 'spec/v1/registry-operations.md', `Ed25519 signature over ${PACK_NAME}@${PACK_VERSION}.tgz MUST verify against ${manifest.signing!.keyId}`))

package/src/scenarios/replay-divergence-at-refusal.test.ts

@@ -45,7 +45,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
@@ -246,9 +246,12 @@ describe.skipIf(HTTP_SKIP)('replay-divergence-at-refusal: behavioral (RFC 0041
       workflowId: 'conformance-phase4-replay-divergence',
     });
     if (createRes.status === 404 || createRes.status === 422) {
-      softSkip('blocked', 'precondition not met — `createRes.status === 404 || createRes.status === 422` returned early (seam, prior step, or fixture unavailable)');
-      ctx.skip(); // fixture not advertised
-      return softSkip('blocked', 'precondition not met — `createRes.status === 404 || createRes.status === 422` returned early (seam, prior step, or fixture unavailable)');
+      // The host advertises refusalDivergenceEmission and its mock seam took the
+      // program (asserted above), but the fixture run would not start: the
+      // requirement was never observed. ctx.skip() throws, so this note is the
+      // row's disposition (`blocked`), exactly as before 2026-09-27.
+      blockedDespiteAssertions('the mock-AI seam accepted the program but POST /v1/runs of conformance-phase4-replay-divergence answered 404/422 — the fixture is not seeded, so no divergence was driven');
+      return ctx.skip();
     }
     expect(createRes.status).toBe(201);
     const sourceRunId = (createRes.json as { runId: string }).runId;
@@ -336,9 +339,9 @@ describe.skipIf(HTTP_SKIP)('replay-divergence-at-refusal: behavioral (RFC 0041
       workflowId: 'conformance-phase4-replay-divergence',
     });
     if (createRes.status === 404 || createRes.status === 422) {
-      softSkip('blocked', 'precondition not met — `createRes.status === 404 || createRes.status === 422` returned early (seam, prior step, or fixture unavailable)');
-      ctx.skip();
-      return softSkip('blocked', 'precondition not met — `createRes.status === 404 || createRes.status === 422` returned early (seam, prior step, or fixture unavailable)');
+      // As in the first case: ctx.skip() throws, so the note is the disposition.
+      blockedDespiteAssertions('the mock-AI seam accepted the program but POST /v1/runs of conformance-phase4-replay-divergence answered 404/422 — the fixture is not seeded, so no divergence was driven');
+      return ctx.skip();
     }
     expect(createRes.status).toBe(201);
     const sourceRunId = (createRes.json as { runId: string }).runId;

package/src/scenarios/replay-fanout-suppression.test.ts

@@ -283,8 +283,8 @@ describe('replay-fanout-suppression: a replay fork MUST NOT fan out re-emitted e
         'host does not advertise `replay.supported: true`, so a replay fork cannot occur and this MUST NOT '
           + 'has nothing to constrain on this host',
       );
-      ctx.skip();
-      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `replayCap?.supported !== true` returned early');
+      // recordRequirement above carries the disposition; ctx.skip() throws.
+      return ctx.skip();
     }
 
     // ── LEG 2 — THE MUST NOT. A replay fork re-emits; it must not deliver. ───
@@ -308,8 +308,8 @@ describe('replay-fanout-suppression: a replay fork MUST NOT fan out re-emitted e
         `replay fork returned ${replay.status} — the re-emission this requirement is stated over never happened, `
           + 'so the absence of deliveries below would prove nothing',
       );
-      ctx.skip();
-      return softSkip('blocked', 'precondition not met — `forkDeclined(replay.status, \'fanout-suppression replay fork\')` returned early (seam, prior step, or fixture unavailable)');
+      // recordRequirement above carries the disposition; ctx.skip() throws.
+      return ctx.skip();
     }
     expect(replay.status, req('openwop.it.replay-fanout-suppression.delivers-for-a-live-run-suppresses-for-a-replay-fork-and-delivers-again-for-a-br', 'webhooks.md §"Register"', 'replay fork should be accepted')).toBe(201);
     const replayRunId = (replay.json as { runId: string }).runId;
@@ -373,6 +373,9 @@ describe('replay-fanout-suppression: a replay fork MUST NOT fan out re-emitted e
     });
     if (branch.status === 501 || branch.status === 400) {
       // branch not offered on this range — leg 2 still stands on its own.
+      // partial-witness-ok: the MUST NOT (leg 2) was observed and recorded
+      // executed-pass above; leg 3 only pins the out-of-scope boundary, on a
+      // fork mode the host may not offer.
       return softSkip('blocked', 'precondition not met — `branch.status === 501 || branch.status === 400` returned early (branch not offered on this range — leg 2 still stands on its own.) (seam, prior step, or fixture unavailable)');
     }
     expect(branch.status, req('openwop.it.replay-fanout-suppression.delivers-for-a-live-run-suppresses-for-a-replay-fork-and-delivers-again-for-a-br', 'replay.md §"Host-initiated fan-out is an external effect"', 'branch fork should be accepted')).toBe(201);

package/src/scenarios/replay-fork-arbitrary.test.ts

@@ -30,7 +30,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { forkDeclined } from '../lib/fork-availability.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
@@ -246,7 +246,7 @@ describe.skipIf(SKIP_NO_MULTI)(
         );
         if (forkDeclined(fork2.status, 'arbitrary-event fork 2')) {
           ctx.skip();
-          return softSkip('blocked', 'precondition not met — `forkDeclined(fork2.status, \'arbitrary-event fork 2\')` returned early (seam, prior step, or fixture unavailable)');
+          return blockedDespiteAssertions('arbitrary-event fork 2 was declined — fork determinism is unobserved');
         }
         expect(fork2.status).toBe(201);
         const fork2Id = (fork2.json as { runId: string }).runId;

package/src/scenarios/replay-side-effect-suppression.test.ts

@@ -55,7 +55,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { V1_DIR } from '../lib/paths.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const WORKFLOW_ID = 'conformance-replay-side-effect';
 const EFFECT_NODE = 'effect';
@@ -178,7 +178,7 @@ describe.skipIf(SKIP_NO_FIXTURE)('replay-side-effect-suppression: a replay does
     });
     if (forkDeclined(fork.status, 'side-effect-suppression replay fork')) {
       ctx.skip();
-      return softSkip('blocked', 'precondition not met — `forkDeclined(fork.status, \'side-effect-suppression replay fork\')` returned early (seam, prior step, or fixture unavailable)');
+      return blockedDespiteAssertions('the replay fork was declined — side-effect suppression is unobserved');
     }
     expect(fork.status, req('openwop.it.replay-side-effect-suppression.fails-a-side-effecting-node-closed-with-replay-source-missing-when-the-source-ne', 'replay.md §"Side-effect suppression in replay" requirement 1', 'fork should be accepted')).toBe(201);
     const forkRunId = (fork.json as { runId: string }).runId;

package/src/scenarios/replayDeterminism.test.ts

@@ -18,7 +18,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { forkDeclined } from '../lib/fork-availability.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
@@ -121,7 +121,10 @@ describe.skipIf(SKIP_NO_NOOP)('replay-determinism: same fromSeq + same workflow
         mode: 'replay',
         fromSeq: 0,
       });
-      if (forkDeclined(fork2.status, 'determinism fork 2')) return softSkip('blocked', 'precondition not met — `forkDeclined(fork2.status, \'determinism fork 2\')` returned early (seam, prior step, or fixture unavailable)');
+      // Fork 1 of the same run was accepted (asserted above), so a decline here
+      // leaves the determinism comparison unobserved on a host that can fork:
+      // `blocked`, not the partial-witness pass a plain softSkip records.
+      if (forkDeclined(fork2.status, 'determinism fork 2')) return blockedDespiteAssertions(`the second replay fork of ${originalRunId} was declined (${fork2.status}) after the first was accepted — there is no second event list to compare`);
       expect(fork2.status).toBe(201);
       const fork2Id = (fork2.json as { runId: string }).runId;
       await pollUntilTerminal(fork2Id, { timeoutMs: 10_000 });
@@ -129,11 +132,13 @@ describe.skipIf(SKIP_NO_NOOP)('replay-determinism: same fromSeq + same workflow
       // Phase 4: fetch both fork event streams.
       const fork1Events = await driver.get(`/v1/runs/${encodeURIComponent(fork1Id)}/events/poll`);
       const fork2Events = await driver.get(`/v1/runs/${encodeURIComponent(fork2Id)}/events/poll`);
-      if (fork1Events.status !== 200 || fork2Events.status !== 200) return softSkip('blocked', 'precondition not met — `fork1Events.status !== 200 || fork2Events.status !== 200` returned early (seam, prior step, or fixture unavailable)');
+      // rest-endpoints.md §"Required endpoints": /events/poll is a MUST, so a
+      // conforming host always makes the two event lists readable.
+      if (fork1Events.status !== 200 || fork2Events.status !== 200) return blockedDespiteAssertions(`GET /events/poll for the forks answered ${fork1Events.status} / ${fork2Events.status} — the event lists were never compared`);
 
       const fork1Body = fork1Events.json as { events?: RawEvent[] };
       const fork2Body = fork2Events.json as { events?: RawEvent[] };
-      if (!fork1Body.events || !fork2Body.events) return softSkip('blocked', 'precondition not met — `!fork1Body.events || !fork2Body.events` returned early (seam, prior step, or fixture unavailable)');
+      if (!fork1Body.events || !fork2Body.events) return blockedDespiteAssertions('a fork /events/poll body carried no events[] — the event lists were never compared');
 
       // Phase 5: assert structural identity (modulo timestamps + IDs).
       expect(fork1Body.events.length, req('openwop.it.replayDeterminism.two-replay-forks-of-the-same-point-produce-structurally-identical-event-lists', 

package/src/scenarios/runner-ledger.test.ts

@@ -251,10 +251,14 @@ describe('RFC 0148 §A (S6) — the runner derivation', () => {
 describe('RFC 0148 §A — softSkip notes the reason for an early return, per file', () => {
   it('notes are keyed to the current test file, worst-first when mixed, and read back with joined reasons', () => {
     resetSoftSkips();
+    // partial-witness-ok: not a skip — this leg unit-tests softSkip itself, and
+    // resetSoftSkips() below clears every note it writes before the leg ends.
     expect(softSkip('inapplicable', 'host does not advertise X'), req('openwop.it.runner-ledger.notes-are-keyed-to-the-current-test-file-worst-first-when-mixed-and-read-back-wi', 'RFC 0148 §A', 'notes are keyed to the current test file, worst-first when mixed, and read back with joined reasons')).toBeUndefined();
+    // partial-witness-ok: not a skip — the subject under test (de-duplication).
     softSkip('inapplicable', 'host does not advertise X'); // de-duplicated
     let d = softSkipDisposition('runner-ledger.test.ts');
     expect(d).toEqual({ kind: 'inapplicable', reason: 'host does not advertise X' });
+    // partial-witness-ok: not a skip — the subject under test (worst-first fold).
     softSkip('blocked', 'seam not mounted');
     d = softSkipDisposition('runner-ledger.test.ts');
     expect(d?.kind).toBe('blocked');

package/src/scenarios/runtime-capabilities.test.ts

@@ -52,6 +52,8 @@ describe('runtime-capabilities: /.well-known/openwop forward-compat shape', () =
       // of v1 hosts will omit it. Assertion passes trivially; don't
       // force a value on a host that doesn't advertise any.
       expect(caps).toBeUndefined();
+      // partial-witness-ok: discovery answered 200 and runtimeCapabilities is OPTIONAL; when
+      // absent, the IF-present MUSTs below bind nothing.
       return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `caps === undefined` returned early');
     }
 

package/src/scenarios/speech-synthesis-roundtrip.test.ts

@@ -58,7 +58,7 @@ describe('speech-synthesis-roundtrip (RFC 0105 §A)', () => {
       audio !== undefined,
       req('openwop.it.speech-synthesis-roundtrip.synthesizes-an-audio-asset-with-exactly-one-of-url-base64-and-echoes-the-voiceid', 'RFC 0105 §A', 'the response MUST carry an `audio` object'),
     ).toBe(true);
-    if (!audio) return softSkip('blocked', 'precondition not met — `!audio` returned early (seam, prior step, or fixture unavailable)');
+    if (!audio) throw new Error('unreachable: the assertion above has already failed this leg');
 
     const hasUrl = typeof audio.url === 'string' && (audio.url as string).length > 0;
     const hasBase64 = typeof audio.base64 === 'string' && (audio.base64 as string).length > 0;

package/src/scenarios/streamReconnect.test.ts

@@ -22,7 +22,7 @@ import { subscribe, type SseEvent } from '../lib/sse.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const WORKFLOW_ID = 'conformance-cancellable';
 const SKIP_NO_FIXTURE = !isFixtureAdvertised(WORKFLOW_ID);
@@ -84,7 +84,7 @@ describe.skipIf(SKIP_NO_FIXTURE)('stream-reconnect: Last-Event-ID resume per spe
         // because the run already completed and the server closed before we
         // got events. Skip the rest of this scenario; the host is fast enough
         // that the reconnect path doesn't apply.
-        return softSkip('blocked', 'precondition not met — `lastSeen < 0` returned early (First connection emitted no events with a parseable sequence — e.g. because the run already completed and the server closed before we got events. Skip the rest of …');
+        return blockedDespiteAssertions('the first SSE connection yielded no event with a parseable sequence within 1s — the Last-Event-ID resume is unobserved');
       }
 
       // Phase 3: reconnect with Last-Event-ID set to the last seq we saw.

package/src/scenarios/subrun-approval-gate.test.ts

@@ -10,7 +10,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { readSubRunAttestationCap, invokeSubRunAttest } from '../lib/subRunAttestation.js';
 import { req } from '../lib/requirement-ids.js';
 
@@ -27,7 +27,7 @@ describe('subrun-approval-gate (RFC 0063 §C)', () => {
     ).toBe(true);
 
     const rejected = await invokeSubRunAttest({ ...base, approvalAction: 'reject' });
-    if (rejected === null) return softSkip('blocked', 'precondition not met — `rejected === null` returned early (seam, prior step, or fixture unavailable)');
+    if (rejected === null) return blockedDespiteAssertions('the sub-run attestation seam answered accept but not reject — the no-merge-on-reject rule is unobserved');
     expect(
       rejected.merged,
       req('openwop.it.subrun-approval-gate.accept-merges-the-child-outputs-reject-does-not', 'RFC 0063 §C', 'a `reject` approval MUST NOT merge the child outputs'),

package/src/scenarios/subworkflow-input-mapping.test.ts

@@ -24,7 +24,7 @@ import { pollUntilTerminal, pollUntilStatus } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { setHostCapability, resetHostCapabilities, isToggleAvailable } from '../lib/host-toggle.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const PARENT = 'conformance-subworkflow-input-mapping';
 const CHILD = 'conformance-subworkflow-input-mapping-child';
@@ -102,7 +102,7 @@ describe.skipIf(SKIP)('subworkflow-input-mapping: parent → child variable seed
     const subwfCompleted = events.find(
       (e) => e.type === 'node.completed' && e.nodeId === 'subwf-call',
     );
-    if (!subwfCompleted) return softSkip('blocked', 'precondition not met — `!subwfCompleted` returned early (seam, prior step, or fixture unavailable)');
+    if (!subwfCompleted) return blockedDespiteAssertions('the advertised fixture\'s parent run has no node.completed for subwf-call — the unset-variable projection is unobserved');
     const childRunId = subwfCompleted.payload?.outputs?.childRunId;
 
     const childRes = await driver.get(`/v1/runs/${encodeURIComponent(childRunId!)}`);

package/src/scenarios/tool-catalog-projection.test.ts

@@ -84,13 +84,6 @@ describe('tool-catalog-projection (RFC 0078 §B/§F)', () => {
     if (!(await toolCatalogGate('openwop-tool-catalog'))) return;
     const validate = descriptorValidator();
 
-    // ---- Leg 3: auth-gated (unauthenticated list MUST be 401) -------------
-    const unauth = await driver.get(toolsPath(), { authenticated: false });
-    expect(
-      unauth.status === 401,
-      req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', `GET ${toolsPath()} MUST require authentication (401 unauthenticated)`),
-    ).toBe(true);
-
     // ---- Leg 1: the list (§B) -------------------------------------------
     // unfailable-leg audit wave 2, 2026-09-27: a host that ADVERTISES the
     // catalog but 404s the list (or answers 500 / a non-list 200, which the
@@ -99,7 +92,17 @@ describe('tool-catalog-projection (RFC 0078 §B/§F)', () => {
     // fails under OPENWOP_REQUIRE_BEHAVIOR=true), and any other non-200 or
     // non-list body FAILS.
     const read = await listTools();
+    // The unserved check runs before any assertion: after the 401 assertion below,
+    // seamAbsent's `blocked` note recorded a partial-witness pass at major 1.
     if (read.unserved) return seamAbsent(`host advertises toolCatalog but ${toolsPath()} answered ${read.status}`);
+
+    // ---- Leg 3: auth-gated (unauthenticated list MUST be 401) -------------
+    const unauth = await driver.get(toolsPath(), { authenticated: false });
+    expect(
+      unauth.status === 401,
+      req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', `GET ${toolsPath()} MUST require authentication (401 unauthenticated)`),
+    ).toBe(true);
+
     expect(
       read.status,
       req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', `GET ${toolsPath()} MUST return 200 to an authenticated caller on a host advertising toolCatalog`),

package/src/scenarios/tool-session-lifecycle.test.ts

@@ -50,7 +50,7 @@ describe('tool-session-lifecycle (RFC 0078 §D)', () => {
       opened.length >= 1 && closed.length >= 1,
       req('openwop.it.tool-session-lifecycle.brackets-the-call-events-with-tool-session-opened-first-closed-last-one-sessioni', 'tool-catalog.md §D', 'a tool session MUST emit tool.session.opened + tool.session.closed'),
     ).toBe(true);
-    if (opened.length === 0 || closed.length === 0) return softSkip('blocked', 'precondition not met — `opened.length === 0 || closed.length === 0` returned early (seam, prior step, or fixture unavailable)');
+    if (opened.length === 0 || closed.length === 0) throw new Error('unreachable: the assertion above has already failed this leg');
 
     const open = opened[0]!;
     const close = closed[closed.length - 1]!;

package/src/scenarios/trigger-ingestion.test.ts

@@ -48,7 +48,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 
@@ -213,7 +213,7 @@ describe.skipIf(HTTP_SKIP)('trigger-ingestion: behavioral ingestion + SSRF (capa
       verification: { mode: 'none' },
       webhook: { method: 'POST', headers: { Authorization: 'Bearer canary' }, body: { x: 1 } },
     });
-    if (del.status === 404 || del.status === 403) return softSkip('blocked', 'precondition not met — `del.status === 404 || del.status === 403` returned early (seam, prior step, or fixture unavailable)');
+    if (del.status === 404 || del.status === 403) return blockedDespiteAssertions('the ingest seam answered the SSRF probe but not the webhook delivery — ingestion content redaction is unobserved');
     const delBody = del.json as
       | { deliveryEvent?: Record<string, unknown>; triggerEvent?: { webhook?: { headers?: Record<string, string> } } }
       | undefined;

package/src/scenarios/v2-a2ui-v09-surface.test.ts

@@ -306,3 +306,18 @@ describe('RFC 0209 §C.9 — no render before root (declared unwitnessable here;
     return softSkip('inapplicable', 'unwitnessable by this suite (RFC 0209 §C.9 Falsifiability verdict): a render-side guarantee, and a server-oriented suite cannot observe a renderer. The fold guard the server CAN observe is openwop.requirement.0209.fold-guarded, above. The render half is witnessed as a reference-app client probe (tier: reference-impl, the a2ui-surface-no-code-exec precedent): openwop/openwop-app frontend/react/src/chat/a2ui/__tests__/a2ui-v09-render-needs-root.test.tsx (openwop-app#4121, ADR 0749). Removing the `if (!state.renderable)` guard in frontend/react/src/chat/a2ui/v09/A2uiV09Surface.tsx turns 2 of its 4 cases red. This row records that the suite reached the requirement, and it is not a pass.');
   });
 });
+
+describe('RFC 0220 §C — the a2uiSurface family witness (seam-gated)', () => {
+  it('a version-2 surface is admitted and a version-1 body under schema version 2 is refused, in the same run', async () => {
+    const g = await gate((f) => f >= 2, 'a floor of at least 2');
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const { runId } = g.ctx;
+    const R = (why: string) => req('openwop.family.a2uiSurface', 'spec/v2/ext/a2uiSurface/README.md §Conformance', why);
+    try {
+      const good = await emit(runId, envelope(2, v2(sid('fam-good'), (POSITIVE['messages'] as Json[]))));
+      expect(good.status, R(`the positive version-2 surface MUST be admitted (201), got ${code(good)}`)).toBe(201);
+      const mixed = await emit(runId, envelope(2, V1_SURFACE));
+      expect(code(mixed), R('a version-1 body under schema version 2 MUST be refused with envelope_invalid (control: a host that admits everything fails here)')).toBe('422 envelope_invalid');
+    } finally { await done(runId); }
+  });
+});

package/src/scenarios/v2-effect-identity-business-key.test.ts

@@ -29,6 +29,15 @@ import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { startEffectReceiver } from '../lib/effect-receiver.js';
 import { req } from '../lib/requirement-ids.js';
 
+/**
+ * The retry leg hands the host the address of the suite's OWN receiver
+ * (`lib/effect-receiver.ts`, since 2.42.4) and the host calls it — a connection
+ * the host originates back to the harness. `host-callback-declaration` requires
+ * that to be declared; 2.42.4 added the receiver and not the declaration, so
+ * the self-check failed on every host that runs the full catalog.
+ */
+export const REQUIRES_HOST_CALLBACK = 'the host makes the retried outbound effect call to the suite-owned effect receiver (OPENWOP_WEBHOOK_RECEIVER_PORT)';
+
 const FIXTURE = 'conformance-noop';
 const KEYING = ['business-identity', 'activity-recipe'];
 const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
@@ -73,6 +82,9 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
     const body = res.json as { runId?: unknown; effects?: Array<{ effectId?: unknown; keying?: unknown; providerKey?: unknown }> } | null;
     const effects = body?.effects ?? [];
     if (res.status === 200 && check.ok && body?.runId === runId && effects.length === 0) {
+      // partial-witness-ok: no assertion has passed at runtime. The only earlier
+      // expect runs solely when the create is not 201, and then it throws, so this
+      // skip is a zero-assertion `inapplicable` (the gate reads source order).
       return softSkip('inapplicable', 'the noop fixture issued no external effect — the ledger read is well-formed but the per-row keying leg had no rows (an effect-issuing fixture would exercise it)');
     }
     expect(

package/src/scenarios/v2-era-2-append-vocabulary.test.ts

@@ -31,10 +31,12 @@ import { v2Discovery } from '../lib/v2.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { codemapV1toV2, era2Gate, eventsOf, pollEvents, seedEra2Log, v1FixtureLog, type ReadEvent } from '../lib/era2-seed.js';
+import { appendEra2Event, codemapV1toV2, era2Gate, eventsOf, pollEvents, seedEra2Log, v1FixtureLog, type ReadEvent } from '../lib/era2-seed.js';
 
 const ID = 'openwop.requirement.0176.era-2-append-vocabulary';
 const DOC = 'spec/v2/core/persistence.md §The writer rule';
+/** A type the codemap renames (v1 `agent.reasoning.delta`); artifact event, no projection effect. */
+const WITNESS_TYPE = 'agent.reasoning-delta';
 
 async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
   try {
@@ -88,20 +90,31 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
     // Neither answer is asserted: the resume transition's event set is not
     // pinned to a renamed type, and a seeded run's pause is host latitude. If
     // no renamed type is appended, the leg records `blocked` below, not a pass.
+    // 2.42.6: the writer-rule witness proper. `appendEra2Event` (host-sample-test-
+    // seams.md §27) hands the host ONE event of a type the codemap RENAMES
+    // (`agent.reasoning-delta`, stored v1 `agent.reasoning.delta`) and the host's
+    // production writer chooses the stored spelling; the read below is the witness.
+    // It is an artifact event, so it moves no projection. A host that does not
+    // serve the seam falls through to the pre-seam path below and ends in the
+    // annotated partial witness, never `blocked` (see the next comment); the gate
+    // above already made a host without the seams profile `inapplicable`.
+    const appended = await appendEra2Event(runId, WITNESS_TYPE, { agentId: 'conformance', delta: 'era-2 writer-rule witness', sequence: 0 });
+    // A served seam that breaks its contract is `blocked`. An UNSERVED seam is not:
+    // §27 is optional and newer than this leg, so its absence falls through to the
+    // pre-seam path and ends in the partial witness below — it never denies a
+    // host certification it held before the seam existed.
+    if (!appended.ok && !appended.unserved) return softSkip(appended.kind, appended.reason);
+    const seamServed = appended.ok;
+
     const enc = encodeURIComponent(runId);
     const paused = await http(() => driver.post(`/runs/${enc}:pause`, { reason: 'conformance', drainPolicy: 'immediate' }));
-    const resumed = paused?.status === 202 ? await http(() => driver.post(`/runs/${enc}:resume`, { reason: 'conformance' })) : null;
-
-    // One canonical mutation so the HOST's own writer appends. Cancel is the
-    // universally available terminal transition; a host that refuses it on a
-    // seeded run records `blocked` rather than a pass — unless the pause and
-    // resume above were both accepted, which already drove the host's writer.
-    const cancelled = await http(() => driver.post(`/runs/${enc}/cancel`, {}));
-    const cancelOk = cancelled !== null && (cancelled.status === 200 || cancelled.status === 202 || cancelled.status === 204);
-    const pauseResumeOk = paused?.status === 202 && resumed?.status === 202;
-    if (!cancelOk && !pauseResumeOk) {
-      return softSkip('blocked', `POST /runs/{runId}/cancel answered ${cancelled?.status ?? 'no response'} on a seeded era-2 run (pause ${paused?.status ?? 'no response'}, resume ${resumed?.status ?? 'not attempted'}) — no canonical mutation drove the host's writer, so the append is unwitnessed`);
-    }
+    if (paused?.status === 202) await http(() => driver.post(`/runs/${enc}:resume`, { reason: 'conformance' }));
+
+    // A canonical mutation as well, so the host's own lifecycle writer appends
+    // beside the seam's append. The seam append above already drove the
+    // production writer, so a host that refuses cancel on a SEEDED run no longer
+    // leaves the rule unwitnessed — the answer is not asserted here.
+    await http(() => driver.post(`/runs/${enc}/cancel`, {}));
 
     const after = await pollEvents(runId);
     if (after === null) return softSkip('blocked', 'the event read failed after the append');
@@ -157,18 +170,20 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
     // writer rule is unobserved.
     const renamedV2 = new Set([...codemapV1toV2()].filter(([v1, v2]) => v1 !== v2).map(([, v2]) => v2));
     const appendedTypes = rows.slice(seedCount).map((r) => String(r.type ?? ''));
-    if (!appendedTypes.some((t) => renamedV2.has(t))) {
-      // partial-witness-ok: HOTFIX 2.42.5 (2026-09-27). 2.42.3 and 2.42.4 made this
-      // `blockedDespiteAssertions`, which is bundle-fatal (RFC 0168 §E.1). No catalogued
-      // seam lets ANY host make a seeded era-2 run append a type the codemap renames,
-      // so the row blocked on every host and no host could certify. That is the suite's
-      // gap, not a host's. The append, the read-back and the sequence rules above ARE
-      // observed. The codemap-renaming writer rule is NOT, and this partial witness says
-      // so in its detail; the acceptance predicate refuses a partial-witness row. The
-      // seams-contract addition that makes the rule witnessable is in progress
-      // (openwop-1f); when it lands, this becomes a real assertion again.
-      return softSkip('inapplicable', `partial witness — the codemap-renaming writer rule is UNWITNESSED: every type the host appended to the era-2 log (${appendedTypes.join(', ') || 'none'}) is spelled identically in v1 and v2 (spec/v2/event-codemap.json), so a host writing v2 names reads back the same as one writing v1 names — the writer rule is unobserved. The leg needs a canonical mutation that appends a renamed type (e.g. run.resuming → run.resume-started); pause ${paused?.status ?? 'no response'} / resume ${resumed?.status ?? 'not attempted'} on the seeded run appended none, and the seed seam (api/seams-v2.yaml seedEra2EventLog) cannot seed a paused or interrupt-suspended era-2 run to resume. A seams-contract addition to seed one is in progress.`);
+    if (!seamServed && !appendedTypes.some((t) => renamedV2.has(t))) {
+      // partial-witness-ok: the host does not serve the optional appendEra2Event
+      // seam (host-sample-test-seams.md §27), and none of its own appends was a
+      // codemap-RENAMED type, so the writer rule is unobserved here. The append,
+      // the read-back and the sequence rules above ARE observed. This is the
+      // 2.42.5 disposition, kept for hosts without the seam; the acceptance
+      // predicate refuses a partial-witness row. (A host without the seam whose
+      // own pause/resume appended a renamed type falls through: that IS a witness.)
+      return softSkip('inapplicable', `partial witness — the codemap-renaming writer rule is UNWITNESSED: ${appended.ok ? '' : appended.reason}; every type the host appended to the era-2 log (${appendedTypes.join(', ') || 'none'}) is spelled identically in v1 and v2 (spec/v2/event-codemap.json)`);
     }
+    if (seamServed) expect(
+      appendedTypes.includes(WITNESS_TYPE),
+      req(ID, DOC, `the event appended through appendEra2Event (${WITNESS_TYPE}, a codemap-RENAMED type) MUST read back under its v2 name through the translated read — it read as ${appendedTypes.join(', ') || 'nothing'}: a host that stored the v2 spelling in an era-2 log makes the reader map it a second time (event_type_unmapped), and one that bypassed the storage boundary leaks the v1 spelling`),
+    ).toBe(true);
   });
 
   it('the run keeps the era it was created with; an append does not promote it to era 3', async () => {

package/src/scenarios/v2-ext-family-claims.test.ts

@@ -0,0 +1,62 @@
+/**
+ * v2-ext-family-claims — RFC 0220 §B, the `claims-check` witness for the 11
+ * discovery-only extension families (suite 2.42.7, target major 2).
+ *
+ * Each family is a reservation: v2 defines no portable operation for it, so the
+ * only thing a server-oriented suite can check is the claim itself. A host that
+ * advertises `extensions["<org>.<extensionName>"]` records `executed-pass` under
+ * `openwop.family.<key>` when the claim is well formed (lib/ext-claims.ts), and
+ * `executed-fail` when it is not. A host that does not advertise the family
+ * records `inapplicable`.
+ *
+ * Why not behaviorGate: an ext family is outside every profile
+ * (spec/v2/ext/README.md), so strict mode has nothing to demand here — a host
+ * that serves no `kanban` has made no promise about one. The gate is the claim.
+ *
+ * Every req() id is a literal so the requirement registry collects it. That a
+ * leg exists for every claims-check family in the declaration is a corpus fact,
+ * checked by the self-test in src/lib/ext-claims.test.ts, not by a host run.
+ *
+ * @see RFCS/0220-ext-families-graduate-on-evidence.md
+ * @see spec/v2/ext/README.md
+ * @see spec/v2/core/capabilities.md §3.2
+ */
+import { describe, it, expect } from 'vitest';
+import { v2Discovery } from '../lib/v2.js';
+import { extDeclaration, classifyExtClaim } from '../lib/ext-claims.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const LEGS = ['brand', 'canvas', 'chat', 'coordination', 'dataIntegration', 'entities', 'kanban', 'knowledge', 'launchStudio', 'messaging', 'webResearch'] as const;
+
+async function leg(key: (typeof LEGS)[number], cite: (why: string) => string): Promise<undefined> {
+  const decl = extDeclaration();
+  if (!decl) return softSkip('blocked', 'spec/v2/declaration.json is not resolvable in this layout — the extension name and the org registry come from it, and guessing either would make the suite the registry (conformance.md §Whose fact is the reason?)');
+  const family = decl.families.find((f) => f.key === key);
+  if (!family) return softSkip('blocked', `the declaration has no ext row for ${key} — this leg is stale against the corpus`);
+  const doc = await v2Discovery();
+  if (!doc) return softSkip('blocked', 'v2 discovery unreachable');
+  const claims = classifyExtClaim(doc, family, decl);
+  if (claims.length === 1 && claims[0].state === 'absent') return softSkip('inapplicable', `no extensions["<org>.${family.extensionName}"] record under a registered org — the host does not advertise ${key}`);
+  for (const c of claims) {
+    if (c.state === 'absent') continue;
+    expect(c.state, cite(c.state === 'malformed' ? `extensions["${c.key}"]: ${c.why}` : `extensions["${c.key}"] is a well-formed claim`)).toBe('well-formed');
+  }
+  return undefined;
+}
+
+const S = (key: string): string => `spec/v2/ext/${key}/README.md §Conformance`;
+
+describe('RFC 0220 §B — an extension family is claimed in a well-formed extensions record (claims-check)', () => {
+  it('brand', () => leg('brand', (why) => req('openwop.family.brand', S('brand'), why)));
+  it('canvas', () => leg('canvas', (why) => req('openwop.family.canvas', S('canvas'), why)));
+  it('chat', () => leg('chat', (why) => req('openwop.family.chat', S('chat'), why)));
+  it('coordination', () => leg('coordination', (why) => req('openwop.family.coordination', S('coordination'), why)));
+  it('dataIntegration', () => leg('dataIntegration', (why) => req('openwop.family.dataIntegration', S('dataIntegration'), why)));
+  it('entities', () => leg('entities', (why) => req('openwop.family.entities', S('entities'), why)));
+  it('kanban', () => leg('kanban', (why) => req('openwop.family.kanban', S('kanban'), why)));
+  it('knowledge', () => leg('knowledge', (why) => req('openwop.family.knowledge', S('knowledge'), why)));
+  it('launchStudio', () => leg('launchStudio', (why) => req('openwop.family.launchStudio', S('launchStudio'), why)));
+  it('messaging', () => leg('messaging', (why) => req('openwop.family.messaging', S('messaging'), why)));
+  it('webResearch', () => leg('webResearch', (why) => req('openwop.family.webResearch', S('webResearch'), why)));
+});