@openwop/openwop-conformance 2.42.6 → 2.42.8

package/src/scenarios/v2-version-header-honored.test.ts

@@ -168,6 +168,9 @@ describe('v2-version-header-honored (RFC 0172 §A.3)', () => {
         },
         req(ID, DOC, `a host that does not serve major 2 MUST refuse OpenWOP-Version: 2.0 with 406 protocol_version_unsupported and details.protocolVersions[] echoing [${advertised.join(', ')}]; a host that LISTS a 2.x member MUST serve it (§1.3 row 1), not refuse it`),
       ).toEqual({ status: 406, code: 'protocol_version_unsupported', echoed: [...advertised].sort(), listsMajor2: false });
+      // partial-witness-ok: the 406 refusal was held to §1.3 row 2 in full above. It is a
+      // complete, correct answer, and there is no second representation to compare bytes
+      // against.
       return softSkip('inapplicable', 'the host refused major 2 with the specified 406 — a correct answer, and there is no second representation to compare bytes against');
     }
     if (asked.status !== 200) {

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -366,6 +366,8 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
         }
       }
     } else {
+      // partial-witness-ok: delivery and retry were observed above; the spacing leg binds only
+      // an advertised backoff other than none.
       softSkip('inapplicable', 'no advertised retryPolicy.backoff other than none — the spacing leg is not asserted');
     }
 

package/src/scenarios/v2-webhook-generated-secret.test.ts

@@ -0,0 +1,76 @@
+/**
+ * RFC 0221 — a secret the host generates is returned once (`spec/v2/core/webhooks.md`
+ * §Surfaces; suite 2.42.8, target major 2; gated on the `webhooks` family and the
+ * `conformance-noop` fixture).
+ *
+ * `registerWebhook` makes `secret` optional. When the request omits it, the host
+ * MUST generate one and return it in the `201` as `secret`, the only time it
+ * appears on the wire, and every delivery to that subscription MUST verify under
+ * it (`OpenWOP-Signature`, scheme `v1`). When the request supplies a secret, the
+ * `201` MUST NOT echo it (RFC 0201 §B.6, now for every subscription).
+ *
+ * How it FAILS: a `201` without `secret` for a secret-less registration (the
+ * subscriber can never verify a delivery); a returned secret the deliveries are
+ * not signed with; a `201` that echoes a supplied secret.
+ *
+ * @see spec/v2/core/webhooks.md §Surfaces
+ * @see RFCS/0221-generated-webhook-secret-returned-once.md
+ */
+
+import { afterEach, describe, it, expect } from 'vitest';
+import { createHmac } from 'node:crypto';
+import { req } from '../lib/requirement-ids.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { hitHeader, startModalReceiver, type ModalHit } from '../lib/webhook-receiver.js';
+import { SW_FIXTURE, deliveriesFor, driveRun, loopbackRefusal, registerSw, unregisterAllSw, waitFor } from '../lib/standard-webhooks.js';
+
+const ID = 'openwop.requirement.0221.generated-secret-returned';
+const SPEC = 'RFC 0221 · webhooks.md §Surfaces';
+
+let closeReceiver: (() => Promise<void>) | null = null;
+afterEach(async () => {
+  await unregisterAllSw();
+  if (closeReceiver) { const c = closeReceiver; closeReceiver = null; await c(); }
+});
+
+function v1SignedBy(secret: string, h: ModalHit): boolean {
+  const ts = hitHeader(h, 'openwop-timestamp');
+  return ts !== undefined && hitHeader(h, 'openwop-signature') === `sha256=${createHmac('sha256', secret).update(`${ts}.${h.body}`, 'utf8').digest('hex')}`;
+}
+
+describe('RFC 0221 — a host-generated webhook secret is returned once', () => {
+  it('a secret-less registration returns the generated secret, and deliveries verify under it; a supplied secret is never echoed', async () => {
+    let doc: Record<string, unknown> | null = null;
+    try { doc = await v2Discovery(); } catch { doc = null; }
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable');
+    if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
+    const fixtures = Array.isArray(doc['fixtures']) ? (doc['fixtures'] as unknown[]) : [];
+    if (!fixtures.includes(SW_FIXTURE)) return softSkip('inapplicable', `${SW_FIXTURE} fixture not advertised — no run to deliver`);
+
+    const rx = await startModalReceiver();
+    closeReceiver = rx.close;
+    const target = rx.urlFor('no-echo');
+    const reg = await registerSw({ url: target.url, events: ['run.completed'] });
+    const refused = loopbackRefusal(reg, target.tunnelled);
+    if (refused) return softSkip('blocked', refused);
+    if (reg.status !== 201) return softSkip('blocked', `registerWebhook answered ${reg.status} ${readErrorCode(reg.json) ?? ''} — webhooks.md §Surfaces owns that contract`);
+
+    const body = reg.json as { webhookId: string; secret?: unknown };
+    expect(typeof body.secret === 'string' && body.secret.length > 0, req(ID, SPEC, 'a registration that omits secret MUST get the host-generated secret back in the 201 as a non-empty string')).toBe(true);
+    const secret = body.secret as string;
+
+    const run = await driveRun();
+    expect(run.status, req(ID, 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    await waitFor(() => deliveriesFor(rx.hits, body.webhookId, run.runId).length > 0, 15_000);
+    const delivery = deliveriesFor(rx.hits, body.webhookId, run.runId)[0];
+    expect(delivery, req(ID, 'webhooks.md §Durability', 'the subscription MUST receive the run.completed delivery')).toBeDefined();
+    expect(v1SignedBy(secret, delivery!), req(ID, SPEC, 'the delivery MUST verify (OpenWOP-Signature, scheme v1) under the secret the 201 returned')).toBe(true);
+
+    const supplied = `conformance-${'s'.repeat(24)}`;
+    const own = await registerSw({ url: rx.urlFor('no-echo').url, events: ['run.completed'], secret: supplied });
+    expect(own.status, req(ID, SPEC, `a registration with a supplied secret MUST answer 201 (got ${own.status} ${readErrorCode(own.json) ?? ''})`)).toBe(201);
+    expect(own.text.includes(supplied) || (own.json as { secret?: unknown }).secret !== undefined, req(ID, 'RFC 0221 · RFC 0201 §B.6', 'the 201 MUST NOT echo a supplied secret')).toBe(false);
+  });
+});

package/src/scenarios/v2-webhook-secret-rotation.test.ts

@@ -117,7 +117,14 @@ describe('RFC 0201 §E — secret rotation overlaps, then retires (gated on webh
     // After the overlap: only when it fits the operator's wait cap.
     const expiresAt = Date.parse(body.previousSecretExpiresAt ?? '');
     if (expiresAt - Date.now() > CAP_MS) {
-      return softSkip('inapplicable', `the post-overlap leg is not observed: overlapSeconds (${overlapSeconds}) exceeds the suite wait cap (${CAP_MS}ms; raise OPENWOP_WEBHOOK_RETRY_WAIT_MS to witness it)`);
+      // partial-witness-ok: the tenant check, the rotate response and the dual signature during
+      // the overlap were asserted above. "The previous secret MUST NOT sign after
+      // previousSecretExpiresAt" cannot be observed inside a bounded run when the host's
+      // advertised webhooks.secretRotation.overlapSeconds outlasts the suite's wait cap, and
+      // blocking every long-overlap host would deny certification to conforming hosts
+      // (steward ruling, 2026-09-27). The row detail names both numbers. Raise
+      // OPENWOP_WEBHOOK_RETRY_WAIT_MS past the overlap to witness it.
+      return softSkip('inapplicable', `the post-overlap leg is not observed: the advertised webhooks.secretRotation.overlapSeconds is ${overlapSeconds}s (expiry ${new Date(expiresAt).toISOString()}) and the suite wait cap is ${CAP_MS}ms; raise OPENWOP_WEBHOOK_RETRY_WAIT_MS past the overlap to witness it`);
     }
     await new Promise((r) => setTimeout(r, Math.max(0, expiresAt - Date.now()) + 1_500));
     const after = await oneDelivery(rx, webhookId);

package/src/scenarios/verifier-gating.test.ts

@@ -24,7 +24,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const SEAM = '/v1/host/sample/agents/verify-run';
 
@@ -62,7 +62,7 @@ describe('verifier-gating (RFC 0090 §B)', () => {
 
     // PASS verdict → completes normally.
     const passRes = await driver.post(SEAM, { simulateVerdict: 'pass' });
-    if (passRes.status === 404) return softSkip('blocked', 'precondition not met — `passRes.status === 404` returned early (seam, prior step, or fixture unavailable)');
+    if (passRes.status === 404) return blockedDespiteAssertions('the verify seam answered the fail verdict but not the pass verdict — pass-completes is unobserved');
     expect(
       verifiedVerdict(passRes.json) === 'pass',
       req('openwop.it.verifier-gating.a-fail-verdict-blocks-commit-on-a-gating-host-a-pass-verdict-completes', 'RFC 0090 §A', 'a verify-run forcing a pass MUST emit agent.verified{verdict:"pass"}'),

package/src/scenarios/version-fold.test.ts

@@ -34,7 +34,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
@@ -106,7 +106,7 @@ describe.skipIf(SKIP_NO_FIXTURE)('version-fold: forced engine versions fold-best
       if (create.status === 403 && errCode(create.json) === 'force_engine_version_forbidden') {
         // eslint-disable-next-line no-console
         console.warn('[version-fold] API key is production-scoped (403 force_engine_version_forbidden); skipping');
-        return softSkip('blocked', '[version-fold] API key is production-scoped (403 force_engine_version_forbidden); skipping (create.status === 403 && errCode(create.json) === \'force_engine_version_forbidden\')');
+        return blockedDespiteAssertions('[version-fold] API key is production-scoped (403 force_engine_version_forbidden) — the advertised forceEngineVersionRange cannot be exercised; run with a test key');
       }
       expect(
         create.status,

package/src/scenarios/wasm-pack-invoke-suspended.test.ts

@@ -65,12 +65,13 @@ describe('wasm-pack-invoke-suspended: suspend → resume round-trip', () => {
         'RFCS/0008-wasm-abi.md §D',
         "if a host doesn't implement WASM-driven suspends it MUST surface a recognizable code",
       )).toBe(true);
-      return softSkip('blocked', 'precondition not met — `terminal.status === \'failed\'` returned early (seam, prior step, or fixture unavailable)');
+      // A failed run carrying the recognizable code IS one of the two conformant
+      // outcomes: the requirement was observed.
+    } else {
+      // Completed path: the reference pack never suspends. Asserting
+      // 'completed' confirms the host did not spuriously enter a
+      // waiting-* state.
+      expect(terminal.status).toBe('completed');
     }
-
-    // Completed path: the reference pack never suspends. Asserting
-    // 'completed' confirms the host did not spuriously enter a
-    // waiting-* state.
-    expect(terminal.status).toBe('completed');
   });
 });

package/src/scenarios/webhook-signed-delivery.test.ts

@@ -390,6 +390,8 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     // `X-openwop-*` counterpart and the signature verifies reading either.
     const dual = first.headers['openwop-signature'];
     if (dual === undefined) {
+      // partial-witness-ok: every X-openwop-* delivery MUST was asserted above; dual-emitting
+      // the OpenWOP-* family is an RFC 0165 §C.1 SHOULD.
       softSkip('inapplicable', 'host does not yet dual-emit the OpenWOP-* webhook header family (RFC 0165 §C.1 — SHOULD)');
     } else {
       for (const [neu, old] of [

package/src/scenarios/workflow-chain-host-expansion.test.ts

@@ -169,7 +169,10 @@ describe('workflow-chain-host-expansion: live host wraps expansion algorithm cor
       const [fm, fn] = PACK.version.split('.').map(Number);
       const older = hm! < fm! || (hm === fm && hn! < fn!);
       expect(older, req('openwop.it.workflow-chain-host-expansion.positive-1-node-chain-expansion-matches-the-reference-library-for-the-bundled-pa', 'workflow-chain-host-expansion', `host bundles workflow-chain-sample ${body.packVersion}; this suite's fixture is ${PACK.version} — a host pack NEWER than the suite is unaccounted for`)).toBe(true);
-      softSkip('blocked', `host bundles workflow-chain-sample ${body.packVersion} (suite fixture ${PACK.version}) — the RFC 0157 chains are absent there until its conformance pin catches up`);
+      // No note here (until 2026-09-27 a blocked soft-skip turned this leg into
+      // a partial-witness pass): the chain this leg expands is identical in the
+      // older pack, so the comparison below is complete. The RFC 0157 legs,
+      // whose chains an older pack lacks, record their own `blocked`.
     }
     expect(typeof body.expansionId).toBe('string');
     expect(body.expansionId.length).toBeGreaterThan(0);
@@ -321,6 +324,9 @@ describe('workflow-chain-host-expansion: live host wraps expansion algorithm cor
       // the sign flipped.
       expect(res.status >= 400, req('openwop.it.workflow-chain-host-expansion.rfc-0157-a-chain-carrying-an-unwind-policy-is-refused-with-capability-required-o', 'compensation.md §"Workflow policy"', 'a non-advertising host MUST refuse a chain carrying `compensation` (policy) — 4xx, not 200')).toBe(true);
       expect(readErrorCode(res.json), req('openwop.it.workflow-chain-host-expansion.rfc-0157-a-chain-carrying-an-unwind-policy-is-refused-with-capability-required-o', 'capabilities.md §"Unsupported capability — refusal contract"', '`capability_required`')).toBe('capability_required');
+      // partial-witness-ok: the half of this requirement that binds a
+      // non-advertising host — refuse with capability_required — was observed
+      // above; the expand-on-an-advertiser half does not apply to this host.
       return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!advertises` returned early');
     }
     expect(res.status, req('openwop.it.workflow-chain-host-expansion.rfc-0157-a-chain-carrying-an-unwind-policy-is-refused-with-capability-required-o', 'workflow-chain-packs.md §"Compensation (RFC 0157)"', 'an advertising host expands the policy-carrying chain')).toBe(200);
@@ -338,6 +344,9 @@ describe('workflow-chain-host-expansion: live host wraps expansion algorithm cor
     if (body.settings?.compensation !== undefined) {
       expect(body.settings.compensation, req('openwop.it.workflow-chain-host-expansion.rfc-0157-a-chain-carrying-an-unwind-policy-is-refused-with-capability-required-o', 'workflow-chain-packs.md §"Compensation (RFC 0157)" rule 9b', 'the chain policy becomes settings.compensation, copied verbatim')).toEqual(expected.settingsCompensation);
     } else {
+      // partial-witness-ok: the node carry was observed above; echoing
+      // `settings` on the expand seam is host-optional, so the rule 9b policy
+      // carry is unobservable through it on a conforming host.
       softSkip('blocked', 'the expand seam does not echo `settings`, so the policy → settings.compensation carry (rule 9b) is unobservable through it; the node carry above was witnessed');
     }
   });

package/src/scenarios/workflow-variable-format.test.ts

@@ -48,7 +48,7 @@ import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { driver } from '../lib/driver.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 const WORKFLOW_DEF = join(SCHEMAS_DIR, 'workflow-definition.schema.json');
 // S38 (2026-08-17): `spec/` is NOT in the published package (`files`), so a path built
@@ -193,7 +193,7 @@ describe('workflow-variable-format §B: host behaviour (RFC 0136, capability-gat
     if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (A host advertising deferredParameters but not yet serving the variables[]-returning seam extension soft-skips (404), as does a host with the seam disabled in…');
     expect(res.status, req('openwop.it.workflow-variable-format.b1-deferred-expansion-mints-format-onto-the-workflowvariable-string-copied-req-7', '§Deferred-parameter expansion', 'the deferred-expand seam returns 200')).toBe(200);
     const variables = (res.json as { variables?: Array<{ name: string; type?: string; format?: string }> }).variables;
-    if (!Array.isArray(variables)) return softSkip('blocked', 'precondition not met — `!Array.isArray(variables)` returned early (seam present but not returning variables[] yet — soft-skip) (seam, prior step, or fixture unavailable)'); // seam present but not returning variables[] yet — soft-skip
+    if (!Array.isArray(variables)) return blockedDespiteAssertions('the deferred-expand seam answered 200 without variables[] — the minted WorkflowVariable.format is unobserved');
     const fmt = (n: string): string | undefined => variables.find((v) => v.name === n)?.format;
 
     expect(fmt('email'), req('openwop.it.workflow-variable-format.b1-deferred-expansion-mints-format-onto-the-workflowvariable-string-copied-req-7', '§WorkflowVariable', 'req 7: a string param\'s recognised `format` is minted verbatim')).toBe('email');

package/src/scenarios/workload-identity-chain-bounds.test.ts

@@ -36,7 +36,7 @@ import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
-import { seamAbsent, softSkip } from '../lib/soft-skip.js';
+import { seamAbsent, softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const DELEGATION_PROFILE = 'openwop-workload-identity-delegation';
@@ -94,7 +94,7 @@ describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)',
     const depth = caps.maxChainDepth as number;
     const chain = Array.from({ length: depth + 1 }, (_, i) => hop(i + 1));
     const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
-    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
+    if (r === null) return blockedDespiteAssertions('the identity-resolve seam is unwired — the maxChainDepth refusal is unobserved');
     expectRefusal('openwop.it.workload-identity-chain-bounds.a-chain-longer-than-the-advertised-maxchaindepth-is-refused', r, 'delegation_chain_too_long', `a chain of ${depth + 1} hops exceeds the advertised bound of ${depth} — each hop is another party the host trusts transitively`);
   });
 
@@ -113,7 +113,10 @@ describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)',
       expect(r.status >= 400, req('openwop.it.workload-identity-chain-bounds.a-chain-that-revisits-a-subject-is-refused-as-cyclic', 'RFCS/0154 §B', 'a cyclic chain is refused')).toBe(true);
       expect(['delegation_chain_cyclic', 'delegation_chain_too_long'], req('openwop.it.workload-identity-chain-bounds.a-chain-that-revisits-a-subject-is-refused-as-cyclic', 'spec/v1/host-sample-test-seams.md §20', 'cyclic or too-long — the bound is below the cycle length')).toContain(readErrorCode(r.json));
       expect(readRetriable(r.json)).toBe(false);
-      return softSkip('blocked', 'precondition not met — `bound < 3` returned early (seam, prior step, or fixture unavailable)');
+      // partial-witness-ok: with maxChainDepth < 3 a 3-hop cyclic chain is also too long. The
+      // non-retriable refusal (either code) was asserted above; the cyclic-specific code cannot
+      // be told apart here.
+      return softSkip('inapplicable', 'maxChainDepth < 3: the cyclic chain is also too long, so the refusal was checked for either code');
     }
     expectRefusal('openwop.it.workload-identity-chain-bounds.a-chain-that-revisits-a-subject-is-refused-as-cyclic', r, 'delegation_chain_cyclic', 'a subject appearing twice is a chain that loops back through authority it already spent — unbounded laundering with a bounded length');
   });

package/vectors/audit-checkpoint-v1.json

@@ -0,0 +1,260 @@
+{
+  "$comment": [
+    "RFC 0218 — vectors for the audit checkpoint preimage (spec/v1/auth-profiles.md §\"Audit-log integrity\" 3).",
+    "A conforming producer or verifier MUST reproduce every entryHash, merkleRoot and signature here, and MUST refuse every `refusals` case.",
+    "The key is RFC 8032 §7.1 TEST 1. It is a published test key: never use it for anything else."
+  ],
+  "spec": "RFC 0218; RFC 8785; RFC 8032",
+  "construction": {
+    "entryHash": "lowercase-hex SHA-256 of the entry's RFC 8785 JCS bytes (the value the next entry carries as prevHash)",
+    "range": "entries with sequence in (P, atSequence], P = the previous checkpoint's atSequence, or 0 for the first",
+    "parent": "lowercase-hex SHA-256 of the ASCII bytes of left ‖ right (each 64 lowercase hex)",
+    "odd": "a last odd node is promoted unchanged, never duplicated",
+    "signature": "Ed25519 over the 32 bytes merkleRoot hex-decodes to; base64 (RFC 4648 §4, padded)"
+  },
+  "publicKeySpkiBase64": "MCowBQYDK2VwAyEA11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=",
+  "entries": [
+    {
+      "entry": {
+        "action": "run.created",
+        "actor": "key:vector-1",
+        "atSequence": 1,
+        "details": {
+          "runId": "run-1"
+        },
+        "occurredAt": "2026-09-27T00:00:01.000Z",
+        "prevHash": null,
+        "target": "run-1"
+      },
+      "entryHash": "2bb3eb03f572491c7334c1a5a12a43e5786663fd4df773b0beb9d05a5d1b496e"
+    },
+    {
+      "entry": {
+        "action": "run.created",
+        "actor": "key:vector-0",
+        "atSequence": 2,
+        "details": {
+          "runId": "run-2"
+        },
+        "occurredAt": "2026-09-27T00:00:02.000Z",
+        "prevHash": "2bb3eb03f572491c7334c1a5a12a43e5786663fd4df773b0beb9d05a5d1b496e",
+        "target": "run-2"
+      },
+      "entryHash": "66892fdd522ad21a99968866d05cb92f4c1db98ddfebf747817891d744060fda"
+    },
+    {
+      "entry": {
+        "action": "interrupt.resolved",
+        "actor": "key:vector-1",
+        "atSequence": 3,
+        "details": {
+          "runId": "run-3"
+        },
+        "occurredAt": "2026-09-27T00:00:03.000Z",
+        "prevHash": "66892fdd522ad21a99968866d05cb92f4c1db98ddfebf747817891d744060fda",
+        "target": "run-3"
+      },
+      "entryHash": "5873ed119eb591fa8c4af1d7d9d947662c78ca5569c57733ebab3d2b399da6fb"
+    },
+    {
+      "entry": {
+        "action": "run.created",
+        "actor": "key:vector-0",
+        "atSequence": 4,
+        "details": {
+          "runId": "run-4"
+        },
+        "occurredAt": "2026-09-27T00:00:04.000Z",
+        "prevHash": "5873ed119eb591fa8c4af1d7d9d947662c78ca5569c57733ebab3d2b399da6fb",
+        "target": "run-4"
+      },
+      "entryHash": "4e48e5dd88bf081edfdbb176a89cfb75697fd4adec954272d65f804ce5643518"
+    },
+    {
+      "entry": {
+        "action": "run.created",
+        "actor": "key:vector-1",
+        "atSequence": 5,
+        "details": {
+          "note": "ünïcode ✓",
+          "votes": [
+            1,
+            2
+          ]
+        },
+        "occurredAt": "2026-09-27T00:00:05.000Z",
+        "prevHash": "4e48e5dd88bf081edfdbb176a89cfb75697fd4adec954272d65f804ce5643518",
+        "target": "run-5"
+      },
+      "entryHash": "9930634e696476f67dce8ea69bd89e6ef1d77dbe3279ec694e47e7dacda47f8a"
+    },
+    {
+      "entry": {
+        "action": "interrupt.resolved",
+        "actor": "key:vector-0",
+        "atSequence": 6,
+        "details": {
+          "runId": "run-6"
+        },
+        "occurredAt": "2026-09-27T00:00:06.000Z",
+        "prevHash": "9930634e696476f67dce8ea69bd89e6ef1d77dbe3279ec694e47e7dacda47f8a",
+        "target": "run-6"
+      },
+      "entryHash": "eda0c73fa14541ca52f2fa9446f07f319a3192c54e66a9a23a48fe22f5c5316f"
+    },
+    {
+      "entry": {
+        "action": "run.created",
+        "actor": "key:vector-1",
+        "atSequence": 7,
+        "details": {
+          "runId": "run-7"
+        },
+        "occurredAt": "2026-09-27T00:00:07.000Z",
+        "prevHash": "eda0c73fa14541ca52f2fa9446f07f319a3192c54e66a9a23a48fe22f5c5316f",
+        "target": "run-7"
+      },
+      "entryHash": "5d2e74535536c835517898427b6e152fcdd5ed79751d165ffe736d66529ea2c0"
+    },
+    {
+      "entry": {
+        "action": "run.created",
+        "actor": "key:vector-0",
+        "atSequence": 8,
+        "details": {
+          "runId": "run-8"
+        },
+        "occurredAt": "2026-09-27T00:00:08.000Z",
+        "prevHash": "5d2e74535536c835517898427b6e152fcdd5ed79751d165ffe736d66529ea2c0",
+        "target": "run-8"
+      },
+      "entryHash": "ebe7b92183a8fe2712cb524d7b5ebf052ef85b1c0cffd8b9a977a33d80cb8a4c"
+    },
+    {
+      "entry": {
+        "action": "interrupt.resolved",
+        "actor": "key:vector-1",
+        "atSequence": 9,
+        "details": {
+          "runId": "run-9"
+        },
+        "occurredAt": "2026-09-27T00:00:09.000Z",
+        "prevHash": "ebe7b92183a8fe2712cb524d7b5ebf052ef85b1c0cffd8b9a977a33d80cb8a4c",
+        "target": "run-9"
+      },
+      "entryHash": "6c3648ec20243c855823056e5ae63b52e7d3e570feef5f6d7a182e084bde6c08"
+    },
+    {
+      "entry": {
+        "action": "run.created",
+        "actor": "key:vector-0",
+        "atSequence": 10,
+        "details": {
+          "runId": "run-10"
+        },
+        "occurredAt": "2026-09-27T00:00:10.000Z",
+        "prevHash": "6c3648ec20243c855823056e5ae63b52e7d3e570feef5f6d7a182e084bde6c08",
+        "target": "run-10"
+      },
+      "entryHash": "740826be7291e62cd84199d8702eb7b32db57f12376a6bc13f680acdaba61bce"
+    },
+    {
+      "entry": {
+        "action": "run.created",
+        "actor": "key:vector-1",
+        "atSequence": 11,
+        "details": {
+          "runId": "run-11"
+        },
+        "occurredAt": "2026-09-27T00:00:11.000Z",
+        "prevHash": "740826be7291e62cd84199d8702eb7b32db57f12376a6bc13f680acdaba61bce",
+        "target": "run-11"
+      },
+      "entryHash": "31d04cd504983f8c9c740128167063a6c4708139e9a9d1b9891e8933792390e4"
+    },
+    {
+      "entry": {
+        "action": "interrupt.resolved",
+        "actor": "key:vector-0",
+        "atSequence": 12,
+        "details": {
+          "runId": "run-12"
+        },
+        "occurredAt": "2026-09-27T00:00:12.000Z",
+        "prevHash": "31d04cd504983f8c9c740128167063a6c4708139e9a9d1b9891e8933792390e4",
+        "target": "run-12"
+      },
+      "entryHash": "213f18d0c231ca4206f7aba10ed4b5a11a7b51f71d77dd4c4f04455a24238fe1"
+    }
+  ],
+  "checkpoints": [
+    {
+      "atSequence": 1,
+      "previousAtSequence": 0,
+      "leafCount": 1,
+      "merkleRoot": "2bb3eb03f572491c7334c1a5a12a43e5786663fd4df773b0beb9d05a5d1b496e",
+      "signature": "+O3og3Lozimsu+l0X6NZ3bTpFhvE6bFdVNqOUpAeHGoRSgeAyuufmXPKwoHcnAr4SqxdUtaXhjiyp4jicjYnAg=="
+    },
+    {
+      "atSequence": 3,
+      "previousAtSequence": 1,
+      "leafCount": 2,
+      "merkleRoot": "42750e6edbe7a4e7f10f5af0ebc0a25c45db6f89193dd2688cca5cc405d95b32",
+      "signature": "9Yo8N2iXAYLIXIlysqH0OfLkSlgzX4Za4fM/S/1MtIdS1khdBUZ6kTDAYT2Z0XhH0/Qq/KMJA4qjfJekx4oHDg=="
+    },
+    {
+      "atSequence": 7,
+      "previousAtSequence": 3,
+      "leafCount": 4,
+      "merkleRoot": "5e277e32a11f6a3ae377850cdf199e6726daa32e0d83873b698f07aa3096c3e2",
+      "signature": "rcjz09tb2ltcoaMYUKjZbp7iY2AHo0WXrJyOPny8T5u/uryyYIgVyzBaEZ3BT3kbAT1y+x7MHtStEt1sIsn2Dw=="
+    },
+    {
+      "atSequence": 12,
+      "previousAtSequence": 7,
+      "leafCount": 5,
+      "merkleRoot": "44a4232543a863aa7fc48477ceb0872e5513dd18db568201990b1b83b4fbbf96",
+      "signature": "axFFc3cFhUONP0Y7Is1vWMg12nNvEiT1aZV54XBcj7LN58VbVqGSWQS5jJ5fdzYM0DjfdPJK1x+pKR4KAuCfCg=="
+    }
+  ],
+  "refusals": [
+    {
+      "id": "interior-nodes-as-leaves",
+      "why": "the 4-leaf checkpoint at 7 recomputed from its two level-1 nodes gives the same root; a verifier that does not hold the leaf count to atSequence − P accepts it",
+      "checkpointAtSequence": 7,
+      "leaves": [
+        "62cf43b39d9b7ad76060add3967e09f876aa8d962bafd224e1190c3bb7495f3d",
+        "a4c9291d9fa45b513d9f22ad3fb8f3d9716869e747c822e49845d4f164328de9"
+      ],
+      "expectedLeaves": 4
+    },
+    {
+      "id": "uppercase-leaf",
+      "why": "leaves are lowercase hex; an uppercase leaf hashes to a different parent",
+      "leaves": [
+        "2BB3EB03F572491C7334C1A5A12A43E5786663FD4DF773B0BEB9D05A5D1B496E"
+      ],
+      "expectedLeaves": 1
+    },
+    {
+      "id": "empty-range",
+      "why": "a checkpoint anchors at least one entry",
+      "leaves": [],
+      "expectedLeaves": 0
+    }
+  ],
+  "signatureRefusals": [
+    {
+      "id": "signed-canonical-json",
+      "why": "a signature over the checkpoint object's canonical JSON instead of the root bytes (the reading the schema description once gave) does not verify",
+      "merkleRoot": "42750e6edbe7a4e7f10f5af0ebc0a25c45db6f89193dd2688cca5cc405d95b32",
+      "signature": "PNlGy3uTxxx3RXhFHBTV1wCm4XpluOy5QXDR4gWHQjh4tNBEYKN0ur7KJxvNXIHTWdKZSWK2Yk0SB4cJk+ZhBw=="
+    },
+    {
+      "id": "signed-hex-text",
+      "why": "a signature over the 64 ASCII hex characters instead of the 32 decoded bytes does not verify",
+      "merkleRoot": "42750e6edbe7a4e7f10f5af0ebc0a25c45db6f89193dd2688cca5cc405d95b32",
+      "signature": "niqG8/dnZLpwv8WfBW082VDfTi5UCrH7uck+hSh3a6ne3RhO+KWvPbyLK++Fw2vumLqD6P4zfTfEgamjxM4ZDA=="
+    }
+  ]
+}