@openwop/openwop-conformance 2.42.6 → 2.42.8

package/src/scenarios/a2ui-surface-delta-transport.test.ts

@@ -48,7 +48,7 @@ import { SCHEMAS_DIR } from '../lib/paths.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 
 const ajv = new Ajv2020({ strict: false, allErrors: true });
 
@@ -518,28 +518,33 @@ describe.skipIf(HTTP_SKIP)('a2ui-surface-delta-transport: live host delta transp
     const surfaceB = fullSurfaceMaterializedAfterUpdates();
 
     // Baseline (surface A) through the host's REAL surface-emit path.
+    // The two emits and the JSON event read are SETUP for this leg, and each is
+    // an early return rather than an assertion, so that a host on which the
+    // agreement is unobservable records that honestly instead of a
+    // partial-witness PASS (until 2026-09-27 the emit statuses were asserted
+    // first). JSON content negotiation on the events endpoint is OPTIONAL
+    // (stream-modes.md §"Content negotiation") and delivering a delta frame is
+    // MAY even under the advertisement (§"A2UI delta transport"), so an
+    // SSE-only host, or one that sends no frame, is conformant and out of reach
+    // of this leg: `inapplicable`, never `blocked`.
     const emitA = await driver.post('/v1/host/sample/a2ui/emit-surface', { runId, surface: surfaceA });
     if (emitA.status === 404 || emitA.status === 405) return softSkip('blocked', 'precondition not met — `emitA.status === 404 || emitA.status === 405` returned early (seam absent — soft-skip the live leg) (seam, prior step, or fixture unavailable)'); // seam absent — soft-skip the live leg
-    expect(
-      emitA.status,
-      req('openwop.it.a2ui-surface-delta-transport.drives-the-emit-surface-seam-a-a2uidelta-1-subscriber-reconstruction-equals-the', 'RFC 0114 §15', 'the emit-surface seam MUST record the baseline full surface'),
-    ).toBeLessThan(300);
+    if (emitA.status >= 300) return softSkip('blocked', `the emit-surface seam refused the baseline full surface (${emitA.status}) — it MUST record it (RFC 0114 §15), and nothing was transported`);
 
     // Second full surface (surface B) — recorded full AND transported as a delta
     // to any ?a2uiDelta=1 subscriber.
     const emitB = await driver.post('/v1/host/sample/a2ui/emit-surface', { runId, surface: surfaceB });
-    if (emitB.status === 404 || emitB.status === 405) return softSkip('blocked', 'precondition not met — `emitB.status === 404 || emitB.status === 405` returned early (seam, prior step, or fixture unavailable)');
-    expect(emitB.status, req('openwop.it.a2ui-surface-delta-transport.drives-the-emit-surface-seam-a-a2uidelta-1-subscriber-reconstruction-equals-the', 'RFC 0114 §15', 'the second emit MUST succeed')).toBeLessThan(300);
+    if (emitB.status >= 300) return softSkip('blocked', `the emit-surface seam accepted the baseline surface, then answered ${emitB.status} for the second — no update was transported`);
     const refB = (emitB.json as EmitSurfaceResponse)?.surfaceRef;
 
     // ?a2uiDelta=1 subscriber: locate the delta frame the host transported.
     const deltaEvents = await getEvents(runId, true);
-    if (deltaEvents === null) return softSkip('blocked', 'precondition not met — `deltaEvents === null` returned early (events stream unavailable in JSON — soft-skip) (seam, prior step, or fixture unavailable)'); // events stream unavailable in JSON — soft-skip
+    if (deltaEvents === null) return softSkip('inapplicable', 'GET /v1/runs/{runId}/events?a2uiDelta=1 with Accept: application/json did not answer a JSON 200 — the host serves the events endpoint as SSE only, which is conformant (stream-modes.md §"Content negotiation"), and this leg reads JSON');
     const frames = collectMatching(deltaEvents, validateFrame)
       .map(readFrame)
       .filter((f): f is { surfaceRef: string; catalogVersion: string; patch: PatchOp[] } => f !== null)
       .filter((f) => refB === undefined || f.surfaceRef === refB);
-    if (frames.length === 0) return softSkip('blocked', 'precondition not met — `frames.length === 0` returned early (host streams SSE-only or buffered the frame — soft-skip) (seam, prior step, or fixture unavailable)'); // host streams SSE-only or buffered the frame — soft-skip
+    if (frames.length === 0) return softSkip('inapplicable', 'the ?a2uiDelta=1 JSON read carried no delta frame for the update — delivering one is MAY (stream-modes.md §"A2UI delta transport"), so there is nothing to reconstruct');
     const frame = frames[frames.length - 1];
 
     // catalogVersion on the delta MUST equal the baseline full surface's.
@@ -557,9 +562,13 @@ describe.skipIf(HTTP_SKIP)('a2ui-surface-delta-transport: live host delta transp
 
     // Non-negotiating subscriber: the host materializes the FULL surface for the same update.
     const fullEvents = await getEvents(runId, false);
-    if (fullEvents === null) return softSkip('blocked', 'precondition not met — `fullEvents === null` returned early (seam, prior step, or fixture unavailable)');
+    // The same endpoint just answered JSON for the ?a2uiDelta=1 read, so the host
+    // negotiates JSON; failing the plain read leaves the agreement unobserved.
+    if (fullEvents === null) return blockedDespiteAssertions('the non-negotiating GET /v1/runs/{runId}/events did not answer 200 with JSON — the materialized full surface was never read');
     const fulls = collectMatching(fullEvents, validateRecorded);
-    if (fulls.length === 0) return softSkip('blocked', 'precondition not met — `fulls.length === 0` returned early (soft-skip — no full surface observed on the non-delta stream) (seam, prior step, or fixture unavailable)'); // soft-skip — no full surface observed on the non-delta stream
+    // ai-envelope.md §"Delta transport": without ?a2uiDelta=1 the host MUST
+    // deliver the materialized full surface, so a conforming host always has one here.
+    if (fulls.length === 0) return blockedDespiteAssertions('the non-negotiating event read carried no full ui.a2ui-surface — the delta reconstruction had nothing to be compared against');
     const materializedFull = fulls[fulls.length - 1];
 
     // delta and full agree — the core RFC 0114 transport guarantee, witnessed live.
@@ -590,7 +599,9 @@ describe.skipIf(HTTP_SKIP)('a2ui-surface-delta-transport: live host delta transp
       surface: { components: [{ component: 'iframe', src: 'https://evil.example/x' }] },
     };
     const rejected = await driver.post('/v1/host/sample/a2ui/emit-surface', { runId, surface: outOfCatalog });
-    if (rejected.status === 404 || rejected.status === 405) return softSkip('blocked', 'precondition not met — `rejected.status === 404 || rejected.status === 405` returned early (seam, prior step, or fixture unavailable)');
+    // The seam accepted the baseline (asserted above), so a 404/405 here is the
+    // seam vanishing, not absent: the fail-closed rejection was never observed.
+    if (rejected.status === 404 || rejected.status === 405) return blockedDespiteAssertions(`the emit-surface seam accepted the baseline surface, then answered ${rejected.status} for the out-of-catalog one — the fail-closed rejection was never observed`);
     expect(
       rejected.status,
       req('openwop.it.a2ui-surface-delta-transport.the-emit-surface-seam-rejects-an-out-of-catalog-surface-fail-closed-real-catalog', 

package/src/scenarios/agent-channel-dispatch.test.ts

@@ -153,8 +153,9 @@ describe.skipIf(HTTP_SKIP)('agent-channel-dispatch (RFC 0082 §B): production ru
       { fromSeq: 0, mode: 'replay' },
     );
     if (forkDeclined(fork1.status, 'channel-dispatch replay fork 1')) {
-      ctx.skip();
-      return softSkip('blocked', 'precondition not met — `forkDeclined(fork1.status, \'channel-dispatch replay fork 1\')` returned early (seam, prior step, or fixture unavailable)');
+      // forkDeclined() already noted `blocked` with the status; ctx.skip()
+      // throws, so the row is `blocked` — nothing after it runs.
+      return ctx.skip();
     }
     expect(
       fork1.status,
@@ -198,6 +199,10 @@ describe.skipIf(HTTP_SKIP)('agent-channel-dispatch (RFC 0082 §B): production ru
       // evidence; the cross-move proof needs the seam. Honest skip of Leg 3.
       // eslint-disable-next-line no-console
       console.warn('[agent-channel-dispatch] deployment seam absent — skipping the channel-move non-re-resolution leg (Leg 3)');
+      // partial-witness-ok: Legs 1+2 observed the §B pin on a real run and the
+      // replay re-reading it; the deployment-transition seam is OPTIONAL
+      // (conformance-only), so a conforming host without it cannot show the
+      // channel-move half.
       return softSkip('blocked', 'precondition not met — `moved === null` returned early ([agent-channel-dispatch] deployment seam absent — skipping the channel-move non-re-resolution leg (Leg 3)) (seam, prior step, or fixture unavailable)');
     }
     // Confirm the move is OBSERVABLE: a fresh channel-bound run must now resolve
@@ -209,6 +214,9 @@ describe.skipIf(HTTP_SKIP)('agent-channel-dispatch (RFC 0082 §B): production ru
     if (typeof movedVersion !== 'string' || movedVersion === pinnedVersion) {
       // eslint-disable-next-line no-console
       console.warn('[agent-channel-dispatch] channel did not observably move — skipping Leg 3 strict assertion');
+      // partial-witness-ok: Legs 1+2 observed the §B pin and its replay
+      // re-read; a promote that does not move the head (canary split, no-op)
+      // is conforming, and without a moved head non-re-resolution has no contrast.
       return softSkip('blocked', 'precondition not met — `typeof movedVersion !== \'string\' || movedVersion === pinnedVersion` returned early ([agent-channel-dispatch] channel did not observably move — skipping Leg 3 strict assertion) (seam, prior step…');
     }
     const fork2 = await driver.post(
@@ -216,8 +224,9 @@ describe.skipIf(HTTP_SKIP)('agent-channel-dispatch (RFC 0082 §B): production ru
       { fromSeq: 0, mode: 'replay' },
     );
     if (forkDeclined(fork2.status, 'channel-dispatch replay fork 2')) {
-      ctx.skip();
-      return softSkip('blocked', 'precondition not met — `forkDeclined(fork2.status, \'channel-dispatch replay fork 2\')` returned early (seam, prior step, or fixture unavailable)');
+      // forkDeclined() already noted `blocked` with the status; ctx.skip()
+      // throws, so the row is `blocked` — nothing after it runs.
+      return ctx.skip();
     }
     expect(
       fork2.status,

package/src/scenarios/agent-live-invocation-bracket.test.ts

@@ -50,7 +50,7 @@ describe('agent-live-invocation-bracket (RFC 0077 §E)', () => {
       started.length >= 1 && completed.length >= 1,
       req('openwop.it.agent-live-invocation-bracket.brackets-a-live-invocation-with-started-first-completed-last-matching-invocation', 'multi-agent-execution.md §"Live manifest dispatch"', 'a live invocation MUST emit agent.invocation.started + agent.invocation.completed'),
     ).toBe(true);
-    if (started.length === 0 || completed.length === 0) return softSkip('blocked', 'precondition not met — `started.length === 0 || completed.length === 0` returned early (seam, prior step, or fixture unavailable)');
+    if (started.length === 0 || completed.length === 0) throw new Error('unreachable: the assertion above has already failed this leg');
 
     const start = started[0]!;
     const end = completed[completed.length - 1]!;

package/src/scenarios/agent-manifest-runtime.test.ts

@@ -61,6 +61,9 @@ describe('agent-manifest-runtime (RFC 0070)', () => {
       // Empty is conformant; the cross-tenant no-disclosure 404 is covered by the
       // owner-triple isolation harness (RFC 0048/0059), not re-probed here. Nothing
       // to dispatch.
+      // partial-witness-ok: installScope, the served inventory and its array
+      // shape were observed; an empty tenant-scoped inventory is conformant,
+      // so the dispatch half has nothing to dispatch on this host.
       return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `agents.length === 0` returned early (RFC 0074 §A + Unresolved Q3 — tenant-scoped: GET /v1/agents is the authenticated principal\'s workspace set, which MAY be e…');
     }
 

package/src/scenarios/aiEnvelope.capBreached.test.ts

@@ -168,7 +168,7 @@ describe('aiEnvelope.capBreached: behavioral cap enforcement (FINAL v1.1)', () =
 import { queryTestEvents, isEventLogSeamAvailable, resetTestSeam } from '../lib/event-log-query.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 describe('aiEnvelope.capBreached: engine projection via event-log seam (capabilities.md §"cap.breached")', () => {
   it('breached outcome projects to cap.breached { kind: "envelopes" } event with causationId chain', async () => {
@@ -193,7 +193,7 @@ describe('aiEnvelope.capBreached: engine projection via event-log seam (capabili
     expect(r.body.status).toBe('breached');
 
     const events = await queryTestEvents(runId, { type: 'cap.breached' });
-    if (!events.ok) return softSkip('blocked', 'precondition not met — `!events.ok` returned early (seam, prior step, or fixture unavailable)');
+    if (!events.ok) return blockedDespiteAssertions('the event-log seam is advertised but the cap.breached query failed — the projection is unobserved');
     expect(
       events.events.length,
       req('openwop.it.aiEnvelope.capBreached.breached-outcome-projects-to-cap-breached-kind-envelopes-event-with-causationid', 'capabilities.md §"Engine-enforced limits and the cap.breached event"', 'breached outcome MUST project to exactly one cap.breached event'),

package/src/scenarios/aiEnvelope.contractRefusal.test.ts

@@ -143,7 +143,7 @@ describe('aiEnvelope.contractRefusal: behavioral accept-gate (FINAL v1.1)', () =
 // E.1 engine-projection via the test-only event-log seam.
 import { queryTestEvents, isEventLogSeamAvailable, resetTestSeam } from '../lib/event-log-query.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 describe('aiEnvelope.contractRefusal: engine projection via event-log seam', () => {
   it('gated (fail-node) → node.failed { error.code: "envelope_contract_violation" }', async () => {
@@ -167,7 +167,7 @@ describe('aiEnvelope.contractRefusal: engine projection via event-log seam', ()
     if (r.status === 404) return softSkip('blocked', 'precondition not met — `r.status === 404` returned early (seam, prior step, or fixture unavailable)');
     expect(r.body.status).toBe('gated');
     const events = await queryTestEvents(runId, { type: 'node.failed' });
-    if (!events.ok || events.events.length === 0) return softSkip('blocked', 'precondition not met — `!events.ok || events.events.length === 0` returned early (seam, prior step, or fixture unavailable)');
+    if (!events.ok || events.events.length === 0) return blockedDespiteAssertions('the gated outcome was accepted but no node.failed was read back from the event-log seam — the envelope_contract_violation projection is unobserved');
     const err = events.events[0]!.payload.error as { code?: string; details?: { refusedType?: string; acceptedTypes?: string[] } };
     expect(
       err.code,

package/src/scenarios/aiEnvelope.schemaDrift.test.ts

@@ -191,7 +191,7 @@ import { queryTestSpans, isOtelSeamAvailable } from '../lib/otel-scrape.js';
 import { resetTestSeam } from '../lib/event-log-query.js';
 import { capabilityFamily, discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 describe('aiEnvelope.schemaDrift: OTel drift attribute projection (E.2)', () => {
   it('below-floor + strictness:warn → OTel span MUST carry envelope_schema_version_drift attribute', async () => {
@@ -216,7 +216,7 @@ describe('aiEnvelope.schemaDrift: OTel drift attribute projection (E.2)', () =>
     expect(r.body.status).toBe('accepted');
 
     const spans = await queryTestSpans({ runId });
-    if (!spans.ok) return softSkip('blocked', 'precondition not met — `!spans.ok` returned early (seam, prior step, or fixture unavailable)');
+    if (!spans.ok) return blockedDespiteAssertions('the OTel span seam is advertised but the span query failed — envelope_schema_version_drift is unobserved');
     expect(
       spans.data.some((s) => s.attributes.envelope_schema_version_drift === true),
       req('openwop.it.aiEnvelope.schemaDrift.below-floor-strictness-warn-otel-span-must-carry-envelope-schema-version-drift-a', 

package/src/scenarios/aiEnvelope.universalKinds.test.ts

@@ -168,7 +168,7 @@ describe('aiEnvelope.universalKinds: behavioral accept via /v1/host/sample/envel
 import { queryTestEvents, isEventLogSeamAvailable, resetTestSeam } from '../lib/event-log-query.js';
 import { capabilityFamily, discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 describe('aiEnvelope.universalKinds: engine projection via event-log seam', () => {
   it('clarification.request MUST be lifted to interrupt.requested { kind: "clarification" } per interrupt.md', async () => {
@@ -188,7 +188,7 @@ describe('aiEnvelope.universalKinds: engine projection via event-log seam', () =
     if (r.status === 404) return softSkip('blocked', 'precondition not met — `r.status === 404` returned early (seam, prior step, or fixture unavailable)');
     expect(r.body.status).toBe('accepted');
     const events = await queryTestEvents(runId, { type: 'interrupt.requested' });
-    if (!events.ok) return softSkip('blocked', 'precondition not met — `!events.ok` returned early (seam, prior step, or fixture unavailable)');
+    if (!events.ok) return blockedDespiteAssertions('the event-log seam is advertised but the interrupt.requested query failed — the clarification lift is unobserved');
     expect(
       events.events.length,
       req('openwop.it.aiEnvelope.universalKinds.clarification-request-must-be-lifted-to-interrupt-requested-kind-clarification-p', 'ai-envelope.md §"Universal kinds"', 'accepted clarification.request MUST project to interrupt.requested per interrupt.md'),

package/src/scenarios/aiproviders-selfhosted-honesty.test.ts

@@ -40,7 +40,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const SEAM = '/v1/host/sample/ai/call';
 
@@ -118,7 +118,7 @@ describe('aiproviders-selfhosted-honesty (RFC 0108 §A.2/§D)', () => {
         '[openwop-selfhosted-providers] §D disclosure check skipped — set OPENWOP_TEST_COMPAT_ENDPOINT ' +
           "to the host's configured compat endpoint to assert non-disclosure on the wire.",
       );
-      return softSkip('blocked', 'precondition not met — `!endpoint` returned early (seam, prior step, or fixture unavailable)');
+      return blockedDespiteAssertions('§D non-disclosure is unobserved: OPENWOP_TEST_COMPAT_ENDPOINT is unset, so there is no configured endpoint to search the response for (§A.2 was observed)');
     }
 
     const serialized = JSON.stringify(res.json ?? {});

package/src/scenarios/append-ordering.test.ts

@@ -19,7 +19,7 @@ import { driver } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const CANDIDATES = ['conformance-append-ordering', 'conformance-multi-node'] as const;
 const FIXTURE = CANDIDATES.find((id) => isFixtureAdvertised(id)) ?? null;
@@ -49,31 +49,36 @@ interface RunEvent {
 describe.skipIf(SKIP)('append-ordering: folded channel reflects event sequence', () => {
   it('append-reducer channels project entries in event-sequence order', async () => {
     const create = await driver.post('/v1/runs', { workflowId: FIXTURE! });
-    expect(create.status).toBe(201);
-    const runId = (create.json as { runId: string }).runId;
-
-    await pollUntilTerminal(runId, { timeoutMs: 30_000 });
-
-    const events = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
-    const list = (events.json as { events?: RunEvent[] }).events ?? [];
+    const runId = (create.json as { runId?: string } | undefined)?.runId;
 
     // Group channel.written events by channel.
     const byChannel = new Map<string, RunEvent[]>();
-    for (const e of list) {
-      if (e.type !== 'channel.written') continue;
-      const ch = e.payload?.channel;
-      if (typeof ch !== 'string') continue;
-      const arr = byChannel.get(ch) ?? [];
-      arr.push(e);
-      byChannel.set(ch, arr);
+    if (create.status === 201 && typeof runId === 'string') {
+      await pollUntilTerminal(runId, { timeoutMs: 30_000 });
+      const events = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
+      const list = (events.json as { events?: RunEvent[] }).events ?? [];
+      for (const e of list) {
+        if (e.type !== 'channel.written') continue;
+        const ch = e.payload?.channel;
+        if (typeof ch !== 'string') continue;
+        const arr = byChannel.get(ch) ?? [];
+        arr.push(e);
+        byChannel.set(ch, arr);
+      }
+      // The conformance-multi-node fallback is not required to write an append
+      // channel, so when it wrote none the ordering rule has nothing to bind on this
+      // host. Decided before any assertion so the row is `inapplicable`, not a
+      // partial-witness pass on the run-created assertion.
+      if (byChannel.size === 0 && FIXTURE !== 'conformance-append-ordering') {
+        return softSkip('inapplicable', 'the conformance-multi-node fallback fixture wrote no append channel and the host advertises no conformance-append-ordering fixture');
+      }
     }
+    expect(create.status).toBe(201);
 
     if (byChannel.size === 0) {
-      // eslint-disable-next-line no-console
-      console.warn(
-        '[append-ordering] fixture emitted no channel.written events; skipping ordering assertions',
-      );
-      return softSkip('blocked', 'precondition not met — `byChannel.size === 0` returned early ([append-ordering] fixture emitted no channel.written events; skipping ordering assertions) (seam, prior step, or fixture unavailable)');
+      // The dedicated fixture exists to write an append channel, so a run of it with
+      // no channel.written leaves the ordering rule unobserved: blocked, not passed.
+      return blockedDespiteAssertions('conformance-append-ordering ran but emitted no channel.written event — append ordering is unobserved');
     }
 
     // For each channel, sequence MUST be strictly increasing within the run.
@@ -122,7 +127,7 @@ describe.skipIf(SKIP)('append-ordering: folded channel reflects event sequence',
 
     // Cross-check against the projected channel state on the run snapshot
     // (when surfaced) — projected array length MUST equal the number of writes.
-    const snapshot = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
+    const snapshot = await driver.get(`/v1/runs/${encodeURIComponent(runId!)}`);
     const channels = (snapshot.json as { channels?: Record<string, unknown> }).channels ?? {};
     for (const [channel, writes] of byChannel) {
       const projected = (channels as Record<string, unknown>)[channel];

package/src/scenarios/artifact-auth.test.ts

@@ -47,7 +47,9 @@ describe('artifact-auth: unauthenticated artifact requests are rejected', () =>
     } catch {
       // Some hosts return a bare 401 with no body — acceptable. Skip the
       // envelope-shape assertion in that case.
-      return softSkip('blocked', 'precondition not met — an earlier step threw (Some hosts return a bare 401 with no body — acceptable. Skip the envelope-shape assertion in that case.) (seam, prior step, or fixture unavailable)');
+      // partial-witness-ok: the 401 refusal, the MUST, was asserted above; the
+      // `error: "unauthenticated"` envelope is a SHOULD and a bare 401 has no body.
+      return softSkip('inapplicable', 'the 401 carried no JSON body (acceptable), so the SHOULD envelope shape was not checked');
     }
     if (typeof body.error === 'string') {
       expect(body.error, req('openwop.it.artifact-auth.get-v1-runs-runid-artifacts-artifactid-without-authorization-returns-401', 

package/src/scenarios/artifact-type-registration-source.test.ts

@@ -37,7 +37,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGatePresent } from '../lib/behavior-gate.js';
 import { readArtifactTypesCap } from '../lib/artifactTypes.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 const CAPS = join(SCHEMAS_DIR, 'capabilities.schema.json');
 const EVENT_PAYLOADS = join(SCHEMAS_DIR, 'run-event-payloads.schema.json');
 const readDoc = (name: string): string => (V1_DIR ? readFileSync(join(V1_DIR, name), 'utf8') : '');
@@ -206,7 +206,7 @@ describe('artifact-type-registration-source: the advert agrees with the event (R
     const created = list.filter((e) => e['type'] === 'artifact.created');
     // Emission itself is RFC 0142's MUST, reported by its own leg. Reaching here without an
     // event means that leg is already red; don't restate its finding as a 0145 failure.
-    if (created.length === 0) return softSkip('blocked', 'precondition not met — `created.length === 0` returned early (Emission itself is RFC 0142\'s MUST, reported by its own leg. Reaching here without an event means that leg is already red; don\'t restate its finding as a 0…');
+    if (created.length === 0) return blockedDespiteAssertions('the run emitted no artifact.created event, so registrationSource is unobserved (RFC 0142\'s emission leg reports the missing event)');
 
     const payload = (created[0]?.['payload'] ?? created[0]?.['data'] ?? {}) as Record<string, unknown>;
     expect(

package/src/scenarios/audit-checkpoint-signature.test.ts

@@ -0,0 +1,63 @@
+/**
+ * RFC 0218 — a host's audit checkpoints are signed over their Merkle root
+ * (`spec/v1/auth-profiles.md` §"Audit-log integrity" 3).
+ *
+ * Gated on the `openwop-audit-log-integrity` profile. Every checkpoint
+ * `GET /v1/audit/verify` returns MUST verify under the advertised
+ * `checkpointPublicKey` as Ed25519 over its hex-decoded `merkleRoot`. The root
+ * itself cannot be recomputed from outside (the entries are not on the wire),
+ * so the black box witnesses the signature half only. The root half belongs to
+ * the vectors (`audit-checkpoint-vectors.test.ts`), the host-internal tamper
+ * test and the out-of-band verifier. A host with no checkpoint yet records
+ * `inapplicable` before any assertion. Sabotage: a host that signs the
+ * checkpoint's canonical JSON, or the 64 hex characters, fails the row.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { checkpointPublicKey, verifyCheckpointSignature } from '../lib/audit-checkpoint.js';
+
+const SPEC = 'RFC 0218 · spec/v1/auth-profiles.md §"Audit-log integrity" 3';
+const SIGNED = 'openwop.requirement.0218.checkpoint-signature-over-root';
+
+interface AuditIntegrityCaps { checkpointPublicKey?: string }
+interface AuthCaps { profiles?: string[]; auditLogIntegrity?: AuditIntegrityCaps }
+
+describe('RFC 0218 — a host\'s checkpoints are signed over their root', () => {
+  it('every checkpoint GET /v1/audit/verify returns verifies under the advertised key', async () => {
+    const disco = await driver.get('/.well-known/openwop');
+    const auth = capabilityFamily<AuthCaps>(disco.json, 'auth') ?? {};
+    if (!(Array.isArray(auth.profiles) && auth.profiles.includes('openwop-audit-log-integrity'))) {
+      return softSkip('inapplicable', 'the host does not claim openwop-audit-log-integrity');
+    }
+    const advertised = auth.auditLogIntegrity?.checkpointPublicKey;
+    if (typeof advertised !== 'string' || advertised.length === 0) {
+      // A claimed profile without its key is the profile-shape leg's failure
+      // (audit-log-integrity.test.ts); this row cannot be observed without it.
+      return softSkip('blocked', 'the host claims the profile but advertises no auditLogIntegrity.checkpointPublicKey');
+    }
+    let key;
+    try { key = checkpointPublicKey(advertised); } catch (e) {
+      return softSkip('blocked', `auditLogIntegrity.checkpointPublicKey is not an Ed25519 SPKI key: ${(e as Error).message}`);
+    }
+
+    const verify = await driver.get('/v1/audit/verify?fromSeq=0&toSeq=1000000');
+    if (verify.status !== 200) {
+      return softSkip('blocked', `GET /v1/audit/verify answered ${verify.status}; the verify leg of audit-log-integrity owns that contract`);
+    }
+    const checkpoints = ((verify.json as { checkpoints?: Array<{ atSequence?: number; merkleRoot?: string; signature?: string }> }).checkpoints) ?? [];
+    if (checkpoints.length === 0) {
+      return softSkip('inapplicable', 'the host has minted no checkpoint yet (its interval has not elapsed)');
+    }
+
+    for (const cp of checkpoints) {
+      expect(
+        verifyCheckpointSignature(String(cp.merkleRoot ?? ''), String(cp.signature ?? ''), key),
+        req(SIGNED, SPEC, `checkpoint at ${cp.atSequence}: signature MUST be Ed25519 over the 32 bytes merkleRoot hex-decodes to, under the advertised checkpointPublicKey`),
+      ).toBe(true);
+    }
+  });
+});

package/src/scenarios/audit-checkpoint-vectors.test.ts

@@ -0,0 +1,93 @@
+/**
+ * RFC 0218 — the audit checkpoint preimage, server-free
+ * (`spec/v1/auth-profiles.md` §"Audit-log integrity" 3).
+ *
+ * `conformance/vectors/audit-checkpoint-v1.json` is normative. Every leg
+ * RECOMPUTES from the vector input through `lib/audit-checkpoint.ts` and compares
+ * with the committed value; none compares two constants from the file. The
+ * vectors were produced by an implementation independent of that lib and
+ * cross-checked in a second language. Sabotages, each of which turns a leg red:
+ * duplicating a last odd node (the 12-sequence checkpoint has 5 leaves); hashing
+ * the concatenated DECODED bytes instead of the hex text; ranging leaves over
+ * `0..atSequence` instead of `(P, atSequence]`; signing the checkpoint's
+ * canonical JSON or the hex text instead of the 32 root bytes; dropping the
+ * leaf-count check (the interior-nodes-as-leaves refusal is then accepted).
+ *
+ * Server-free and always-on; the vectors ship with the conformance package. The
+ * black-box half is `audit-checkpoint-signature.test.ts`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve } from 'node:path';
+import { req } from '../lib/requirement-ids.js';
+import {
+  auditEntryHash,
+  checkpointMerkleRoot,
+  checkpointPublicKey,
+  verifyCheckpointSignature,
+  CheckpointPreimageError,
+} from '../lib/audit-checkpoint.js';
+
+interface VectorCheckpoint { atSequence: number; previousAtSequence: number; leafCount: number; merkleRoot: string; signature: string }
+interface Refusal { id: string; why: string; leaves: string[]; expectedLeaves: number }
+interface SigRefusal { id: string; why: string; merkleRoot: string; signature: string }
+
+const VECTORS_PATH = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', 'vectors', 'audit-checkpoint-v1.json');
+const doc = JSON.parse(readFileSync(VECTORS_PATH, 'utf8')) as {
+  publicKeySpkiBase64: string;
+  entries: Array<{ entry: { atSequence: number }; entryHash: string }>;
+  checkpoints: VectorCheckpoint[];
+  refusals: Refusal[];
+  signatureRefusals: SigRefusal[];
+};
+
+const SPEC = 'RFC 0218 · spec/v1/auth-profiles.md §"Audit-log integrity" 3';
+const VECTORS = 'openwop.requirement.0218.checkpoint-preimage-vectors';
+
+describe('RFC 0218 — the audit checkpoint preimage (vectors)', () => {
+  it('the vector set is present and non-trivial', () => {
+    // An empty or truncated file would make every leg below vacuous.
+    expect(doc.entries.length, req(VECTORS, SPEC, 'the vector file carries entries')).toBeGreaterThanOrEqual(12);
+    expect(doc.checkpoints.map((c) => c.leafCount), req(VECTORS, SPEC, 'the checkpoints cover 1, 2, 4 and 5 leaves (odd promotion at 5)')).toEqual([1, 2, 4, 5]);
+  });
+
+  it('every entry hash is the SHA-256 of the entry\'s JCS bytes, and chains as prevHash', () => {
+    let prev: string | null = null;
+    for (const { entry, entryHash } of doc.entries) {
+      expect(auditEntryHash(entry), req(VECTORS, SPEC, `entry ${entry.atSequence}: entryHash = SHA-256(JCS(entry))`)).toBe(entryHash);
+      expect((entry as { prevHash?: string | null }).prevHash ?? null, req(VECTORS, SPEC, `entry ${entry.atSequence}: prevHash is the previous entry's hash`)).toBe(prev);
+      prev = entryHash;
+    }
+  });
+
+  it('every root is recomputed over (P, atSequence], pairwise, odd node promoted', () => {
+    for (const c of doc.checkpoints) {
+      const leaves = doc.entries.filter((e) => e.entry.atSequence > c.previousAtSequence && e.entry.atSequence <= c.atSequence).map((e) => e.entryHash);
+      expect(checkpointMerkleRoot(leaves, c.atSequence - c.previousAtSequence), req(VECTORS, SPEC, `checkpoint at ${c.atSequence}: merkleRoot`)).toBe(c.merkleRoot);
+    }
+  });
+
+  it('every signature verifies as Ed25519 over the 32 root bytes', () => {
+    const key = checkpointPublicKey(doc.publicKeySpkiBase64);
+    for (const c of doc.checkpoints) {
+      expect(verifyCheckpointSignature(c.merkleRoot, c.signature, key), req(VECTORS, SPEC, `checkpoint at ${c.atSequence}: signature over the root bytes`)).toBe(true);
+    }
+  });
+
+  it('refuses a leaf list whose count is not atSequence − P, an uppercase leaf, and an empty range', () => {
+    for (const r of doc.refusals) {
+      let refused: unknown;
+      try { checkpointMerkleRoot(r.leaves, r.expectedLeaves); } catch (e) { refused = e; }
+      expect(refused instanceof CheckpointPreimageError, req(VECTORS, SPEC, `${r.id} MUST be refused — ${r.why}`)).toBe(true);
+    }
+  });
+
+  it('a signature over any other preimage does not verify', () => {
+    const key = checkpointPublicKey(doc.publicKeySpkiBase64);
+    for (const s of doc.signatureRefusals) {
+      expect(verifyCheckpointSignature(s.merkleRoot, s.signature, key), req(VECTORS, SPEC, `${s.id} MUST NOT verify — ${s.why}`)).toBe(false);
+    }
+  });
+});

package/src/scenarios/audit-log-integrity.test.ts

@@ -27,23 +27,14 @@ import { join } from 'node:path';
 import { SCHEMAS_DIR } from '../lib/paths.js';
 
 /**
- * audit-verify-result.schema.json with every `additionalProperties: false`
- * relaxed: the REQUIRED members and their types are enforced, extra members
- * are not (the reference postgres host emits `checkpointsValid` and a
- * per-checkpoint `verified` bit; convicting extras is a separate decision).
+ * audit-verify-result.schema.json, CLOSED: every `additionalProperties: false`
+ * is enforced. (Until 2026-09-27 the suite stripped them because the reference
+ * postgres/sqlite hosts emitted a per-checkpoint `verified` bit the schema does
+ * not name; the hosts now keep that bit host-internal. The aggregate verdict is
+ * the schema's OPTIONAL `checkpointsValid`.)
  */
-function relaxAdditional(node: unknown): unknown {
-  if (Array.isArray(node)) return node.map(relaxAdditional);
-  if (node === null || typeof node !== 'object') return node;
-  const out: Record<string, unknown> = {};
-  for (const [k, v] of Object.entries(node as Record<string, unknown>)) {
-    if (k === 'additionalProperties' && v === false) continue;
-    out[k] = relaxAdditional(v);
-  }
-  return out;
-}
-const VERIFY_RESULT_SCHEMA = relaxAdditional(
-  JSON.parse(readFileSync(join(SCHEMAS_DIR, 'audit-verify-result.schema.json'), 'utf8')),
+const VERIFY_RESULT_SCHEMA = JSON.parse(
+  readFileSync(join(SCHEMAS_DIR, 'audit-verify-result.schema.json'), 'utf8'),
 ) as Record<string, unknown>;
 
 interface AuditIntegrityCaps {

package/src/scenarios/auth-mtls.test.ts

@@ -266,12 +266,13 @@ describe.skipIf(!RUN_BEHAVIOR)('auth-mtls: client cert behavior', () => {
         'auth-profiles.md §`openwop-auth-mtls`',
         'mtls.required: true MUST reject no-cert requests (TLS handshake failure is conformant)',
       )).toBe(true);
-      return softSkip('blocked', 'precondition not met — `\'error\' in res` returned early (seam, prior step, or fixture unavailable)');
+      // The TLS-layer rejection IS the conformant refusal: the requirement was observed.
+      // (This branch used to end in a blocked note, a partial-witness pass at major 1.)
+    } else {
+      expect(res.status >= 400, req('openwop.it.auth-mtls.no-client-cert-against-mtls-required-true-non-2xx-or-tls-failure', 
+        'auth-profiles.md §`openwop-auth-mtls`',
+        'mtls.required: true MUST reject no-cert requests at the auth layer (4xx) when not rejected at the TLS layer',
+      )).toBe(true);
     }
-
-    expect(res.status >= 400, req('openwop.it.auth-mtls.no-client-cert-against-mtls-required-true-non-2xx-or-tls-failure', 
-      'auth-profiles.md §`openwop-auth-mtls`',
-      'mtls.required: true MUST reject no-cert requests at the auth layer (4xx) when not rejected at the TLS layer',
-    )).toBe(true);
   });
 });

package/src/scenarios/auth-subject-link-key-class.test.ts

@@ -39,7 +39,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
@@ -150,7 +150,7 @@ describe('auth-subject-link-key-class: same-IdP trust root (RFC 0163 §B — beh
     expect(provSame.status, req('openwop.it.auth-subject-link-key-class.a-same-idp-link-forms-control-but-a-cross-idp-collision-must-not-link', 'auth-profiles.md §Subject linking', 'SCIM provisioning MUST succeed')).toBeLessThan(400);
 
     const sameIdp = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl: idpAUrl, variant: 'valid', nameId: sameId });
-    if (sameIdp.status === 404) return softSkip('blocked', 'SAML validate seam unwired');
+    if (sameIdp.status === 404) return blockedDespiteAssertions('SAML validate seam answered 404 after SCIM provisioning succeeded — the same-IdP control and the cross-IdP MUST are unobserved');
     expect(
       (sameIdp.json as { authenticated?: boolean } | undefined)?.authenticated,
       req('openwop.it.auth-subject-link-key-class.a-same-idp-link-forms-control-but-a-cross-idp-collision-must-not-link', 'auth-profiles.md §Subject linking', 'RFC 0163 §B positive control: a SAML assertion from the SAME IdP trust root as the SCIM lane links and authenticates'),
@@ -172,7 +172,7 @@ describe('auth-subject-link-key-class: same-IdP trust root (RFC 0163 §B — beh
     expect(provCross.status, req('openwop.it.auth-subject-link-key-class.a-same-idp-link-forms-control-but-a-cross-idp-collision-must-not-link', 'auth-profiles.md §Subject linking', 'SCIM provisioning MUST succeed')).toBeLessThan(400);
 
     const crossIdp = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl: idpBUrl, variant: 'valid', nameId: collideId });
-    if (crossIdp.status === 404) return softSkip('blocked', 'SAML validate seam unwired');
+    if (crossIdp.status === 404) return blockedDespiteAssertions('SAML validate seam answered 404 on the cross-IdP probe — RFC 0163 §B.1 is unobserved');
     expect(
       (crossIdp.json as { authenticated?: boolean } | undefined)?.authenticated === true,
       req('openwop.it.auth-subject-link-key-class.a-same-idp-link-forms-control-but-a-cross-idp-collision-must-not-link',