@openwop/openwop-conformance 2.42.6 → 2.42.8

package/src/scenarios/auth-subject-link.test.ts

@@ -25,7 +25,7 @@
 
 import { randomBytes } from 'node:crypto';
 import { describe, it, expect } from 'vitest';
-import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { softSkip, seamAbsent, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
@@ -139,7 +139,7 @@ describe('auth-subject-link: cross-lane deactivation (RFC 0159 §A.3 — opt-in)
     // 2. A valid SAML assertion whose persistent NameID equals the externalId
     //    links to the same subject and authenticates.
     const before = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl, variant: 'valid', nameId: externalId });
-    if (before.status === 404) return softSkip('blocked', 'seam unwired');
+    if (before.status === 404) return blockedDespiteAssertions('SAML validate seam answered 404 after SCIM provisioning succeeded — the deactivation fail-close is unobserved');
     expect(
       (before.json as { authenticated?: boolean } | undefined)?.authenticated,
       req('openwop.it.auth-subject-link.a-scim-deactivation-fail-closes-the-linked-saml-identity', 'auth-profiles.md §Subject linking', 'a valid linked SAML assertion authenticates before deactivation'),
@@ -189,23 +189,24 @@ describe('auth-subject-link: link-key hygiene (RFC 0159 §A.2 — opt-in)', () =
         link.status,
         req('openwop.it.auth-subject-link.a-mutable-pii-link-key-email-never-produces-a-cross-lane-pass', 'auth-profiles.md §Subject linking', 'RFC 0159 §A.2: a link on a mutable/PII key (email) MUST be rejected'),
       ).toBeGreaterThanOrEqual(400);
-      return softSkip('blocked', 'precondition not met — `link.status >= 400` returned early (seam, prior step, or fixture unavailable)');
+      // A 4xx on the mutable-key link IS the §A.2 conformant answer: the requirement was
+      // observed. (This branch used to end in a blocked note, a partial-witness pass.)
+    } else {
+      // If the host accepted the request, it MUST NOT have formed a cross-lane
+      // link on email: a deactivation via the email "link" MUST NOT deny (or
+      // otherwise act on) an unrelated SAML subject, and MUST NOT let a mutable
+      // key authorize one. Probe: deactivate by email, then a SAML assertion for
+      // a DIFFERENT opaque subject MUST be unaffected by the email operation.
+      await driver.post('/v1/host/sample/auth/scim/provision', { scimUrl, op: 'deactivate-user', email: 'r.smith@example.test' });
+      const other = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl, variant: 'valid', nameId: 'idp-op-DIFFERENT' });
+      expect(
+        (other.json as { linkedDenied?: boolean } | undefined)?.linkedDenied === true,
+        req('openwop.it.auth-subject-link.a-mutable-pii-link-key-email-never-produces-a-cross-lane-pass', 
+          'auth-profiles.md §Subject linking',
+          'RFC 0159 §A.2: a mutable-key (email) operation MUST NOT drive a cross-lane deny on any opaque subject',
+        ),
+      ).toBe(false);
     }
-
-    // If the host accepted the request, it MUST NOT have formed a cross-lane
-    // link on email: a deactivation via the email "link" MUST NOT deny (or
-    // otherwise act on) an unrelated SAML subject, and MUST NOT let a mutable
-    // key authorize one. Probe: deactivate by email, then a SAML assertion for
-    // a DIFFERENT opaque subject MUST be unaffected by the email operation.
-    await driver.post('/v1/host/sample/auth/scim/provision', { scimUrl, op: 'deactivate-user', email: 'r.smith@example.test' });
-    const other = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl, variant: 'valid', nameId: 'idp-op-DIFFERENT' });
-    expect(
-      (other.json as { linkedDenied?: boolean } | undefined)?.linkedDenied === true,
-      req('openwop.it.auth-subject-link.a-mutable-pii-link-key-email-never-produces-a-cross-lane-pass', 
-        'auth-profiles.md §Subject linking',
-        'RFC 0159 §A.2: a mutable-key (email) operation MUST NOT drive a cross-lane deny on any opaque subject',
-      ),
-    ).toBe(false);
   });
 });
 

package/src/scenarios/blob-presign-expiry.test.ts

@@ -17,7 +17,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -84,7 +84,7 @@ describe('blob-presign-expiry: behavioral (RFC 0019 §B point 1)', () => {
 
     // Fetch within the window — MUST return 200 + the bytes
     const within = await driver.get(body.url!);
-    if (within.status === 404) return softSkip('blocked', 'precondition not met — `within.status === 404` returned early (host doesn\'t expose the resolver route — soft-skip the expiry side too) (seam, prior step, or fixture unavailable)'); // host doesn't expose the resolver route — soft-skip the expiry side too
+    if (within.status === 404) return blockedDespiteAssertions('the presigned URL answered 404 inside its TTL — neither the in-window resolve nor the post-expiry 403 is observable');
     expect(
       within.status,
       req('openwop.it.blob-presign-expiry.presigned-url-must-resolve-to-the-blob-inside-its-ttl-window-and-return-403-afte', 'RFC 0019 §B point 1', 'presigned URL MUST resolve to 200 within its TTL window'),

package/src/scenarios/byok-roundtrip.test.ts

@@ -81,7 +81,10 @@ describe.skipIf(SKIP_NO_FIXTURE)('byok: end-to-end credentialRef resolution roun
       // Host doesn't expose node outputs in variables/outputs map —
       // some hosts only expose them on the events stream. Skip the
       // shape check; the run-completed assertion above is sufficient.
-      return softSkip('blocked', 'precondition not met — `!candidate || typeof candidate !== \'object\'` returned early (Host doesn\'t expose node outputs in variables/outputs map — some hosts only expose them on the events stream. Skip the shape check; …');
+      // partial-witness-ok: the run reached `completed`, which is the secret-resolution witness
+      // (a failed resolve fails the run); surfacing node outputs on variables/outputs is a MAY,
+      // so the SHA-256 shape check is an optional extra.
+      return softSkip('inapplicable', 'the host does not surface node outputs on variables/outputs (a MAY) — the SHA-256 shape check is not run; the completed run was asserted');
     }
 
     if ('secretSha256' in candidate && typeof candidate.secretSha256 === 'string') {

package/src/scenarios/compensation-behavior.test.ts

@@ -40,7 +40,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
@@ -101,7 +101,7 @@ describe('RFC 0151 §C — compensation lifecycle (capability-gated behavior)',
             'cannot be certified (RFC 0148 §A: unobservable resolves to `blocked`, not to a pass)',
         ),
       ).not.toBe(404);
-      return softSkip('blocked', 'precondition not met — `seam.status === 404` returned early (seam, prior step, or fixture unavailable)');
+      throw new Error('unreachable: the assertion above fails first');
     }
     const events = (seam.json as { events?: { type: string }[] }).events ?? [];
     const requestedAt = events.findIndex((e) => e.type === 'compensation.requested');
@@ -194,7 +194,10 @@ describe('RFC 0151 §C — compensation lifecycle (capability-gated behavior)',
             `— got ${String(status)}`,
         ),
       ).toBe(true);
-      return softSkip('blocked', 'precondition not met — `expected === null` returned early (seam, prior step, or fixture unavailable)');
+      // partial-witness-ok: an unwind that started and did not complete folds to
+      // one of running | partial | failed, and the assertion above observed that;
+      // which of the three is host state the seam's event list cannot decide.
+      return softSkip('blocked', 'the unwind started and did not complete: the rollup was asserted to be running | partial | failed, but which one is not decidable from the seam events');
     }
     expect(
       status,
@@ -267,8 +270,10 @@ describe('RFC 0151 §C — compensation lifecycle (capability-gated behavior)',
     // that legitimately has a plan.
     const types = (body.events ?? []).map((e) => e.type);
     if (types.includes('compensation.requested')) {
-      return softSkip(
-        'blocked',
+      // host-sample-test-seams.md §21: under `fail: false` the host MUST record no
+      // compensation.requested, and a host that fails the node anyway leaves this
+      // leg `blocked`, not passed — the runId assertion above is setup.
+      return blockedDespiteAssertions(
         `the seam emitted ${JSON.stringify(types)} under \`fail: false\` — a trigger fired, so this run ` +
           'is not the healthy case the leg needs',
       );

package/src/scenarios/conformance-advertised-seam-required.test.ts

@@ -97,14 +97,20 @@ describe('RFC 0148 §B — conformance-advertised-seam-required', () => {
   it('strict mode: seamAbsent (advertised, seam answered 404/403 mid-scenario) FAILS; default mode notes blocked with the reason', () => {
     process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
     __resetEnvCacheForTests();
+    // partial-witness-ok: seamAbsent is the subject under test in this server-free unit test of
+    // the helper, not an early return.
     expect(() => seamAbsent('host advertises X but /v1/host/sample/x answered 404'), req('openwop.it.conformance-advertised-seam-required.strict-mode-seamabsent-advertised-seam-answered-404-403-mid-scenario-fails-defau', 'RFC 0148 §B', 'strict mode: seamAbsent (advertised, seam answered 404/403 mid-scenario) FAILS; default mode notes blocked with the reason')).toThrow(/RFC 0148 §B/);
     delete process.env['OPENWOP_REQUIRE_BEHAVIOR'];
     __resetEnvCacheForTests();
     resetSoftSkips();
+    // partial-witness-ok: seamAbsent is the subject under test in this server-free unit test of
+    // the helper, not an early return.
     expect(seamAbsent('host advertises X but /v1/host/sample/x answered 403')).toBeUndefined();
     const noted = softSkipDisposition('conformance-advertised-seam-required.test.ts');
     expect(noted?.kind).toBe('blocked');
     expect(noted?.reason).toContain('answered 403');
+    // The note above is this test's subject, not a disposition of the leg.
+    resetSoftSkips();
   });
 
   it('the sanctioned escape is an explicit opt-out, which records skipped with the reason — still never a pass', () => {

package/src/scenarios/connection-pack-apihosts.test.ts

@@ -48,7 +48,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const SCHEMA_PATH = join(SCHEMAS_DIR, 'connection-pack-manifest.schema.json');
 const APIHOSTS_FIXTURE = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-apihosts-valid.json');
@@ -188,7 +188,7 @@ describe('connection-pack apiHosts — behavioral egress allow-list (RFC 0120 it
 
     for (const evil of ['evil.com', 'notfacebook.com', 'facebook.com.evil.com']) {
       const denied = await probe(evil);
-      if (denied === undefined) return softSkip('blocked', 'precondition not met — `denied === undefined` returned early (soft-skip) (seam, prior step, or fixture unavailable)'); // soft-skip
+      if (denied === undefined) return blockedDespiteAssertions('the egress-check seam stopped answering on a non-matching host — fail-closed egress is unobserved');
       expect(
         denied.allowed,
         req('openwop.it.connection-pack-apihosts.permits-a-credential-bearing-egress-to-an-apihosts-match-fails-closed-otherwise', 'connection-packs.md §Manifest item 10', `egress to "${evil}" (no apiHosts match) MUST fail closed — no credential sent`),

package/src/scenarios/connection-provider-resolution.test.ts

@@ -35,7 +35,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const FIXTURE_PATH = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-github.json');
 
@@ -117,7 +117,7 @@ describe('connection-provider-resolution (RFC 0095 §B.6/§B.8)', () => {
       provider: 'conformance-prerelease-probe',
       simulateBuiltinVersion: '1.0.0',
     });
-    if (res.status === 404 || res.status === 403) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 403` returned early (simulate knob unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // simulate knob unwired — soft-skip
+    if (res.status === 404 || res.status === 403) return blockedDespiteAssertions('the resolve seam (simulateBuiltinVersion) answered 404/403 — the prerelease-vs-release conflict is unobserved');
     const body = res.json as ResolveResult | undefined;
     expect(
       body?.code,

package/src/scenarios/context-budget-transcript-bound.test.ts

@@ -104,13 +104,13 @@ describe('context-budget-transcript-bound (RFC 0111 §"Context economy")', () =>
     if (typeof budget !== 'number') return softSkip('inapplicable', 'transcriptTokenBudget not advertised');
     if (!isFixtureAdvertised(FIXTURE)) return softSkip('inapplicable', `the live fixture ${FIXTURE} is not advertised — the scripted multiturn fixture drives a mock supervisor, which RFC 0111 §Scope forbids from advertising contextBudget`);
     expect(typeof advertisedCounter === 'string', req(ID, 'RFC 0111', 'tokenCounter MUST be advertised when transcriptTokenBudget is present (schema if/then)')).toBe(true);
-    if (typeof advertisedCounter !== 'string') return softSkip('blocked', 'contextBudget.tokenCounter is not advertised (the assertion above records the failure)');
+    if (typeof advertisedCounter !== 'string') throw new Error('unreachable: the assertion above fails first');
 
     const create = await driver.post(runsPath(), { workflowId: FIXTURE });
     expect(create.status, req(ID, 'RFC 0111', `POST ${runsPath()} MUST create the live-fixture run`)).toBe(201);
     const runId = runIdOf(create.json);
     expect(runId, req(ID, 'RFC 0111', 'the create response MUST carry a runId')).toBeDefined();
-    if (runId === undefined) return softSkip('blocked', 'no runId');
+    if (runId === undefined) throw new Error('unreachable: the assertion above fails first');
     await pollUntilTerminal(runId, { timeoutMs: LIVE_RUN_POLL_MS });
 
     const windows: Array<{ iteration: number; window: TranscriptWindow }> = [];
@@ -121,6 +121,10 @@ describe('context-budget-transcript-bound (RFC 0111 §"Context economy")', () =>
         // `softSkip('blocked')` after the create/runId asserts, which records a
         // partial-witness PASS — a host with no transcript-window seam passed
         // the transcript bound without a single window being read.
+        // partial-witness-ok: not a partial witness at either major — seamAbsent
+        // runs only when major === 2, where a blocked note after assertions
+        // stands as `blocked` (2.35.0) and strict mode fails it; major 1 takes
+        // blockedDespiteAssertions.
         if (iteration === 1) return major === 2 ? seamAbsent(`contextBudget is advertised but the transcript-window seam answered ${res.status} (host-sample-test-seams.md §14)`) : blockedDespiteAssertions(`the transcript-window seam answered ${res.status} (host-sample-test-seams.md §14)`);
         break;
       }
@@ -128,7 +132,7 @@ describe('context-budget-transcript-bound (RFC 0111 §"Context economy")', () =>
       expect(res.status, req(ID, 'host-sample-test-seams.md §14', `iteration ${iteration}: the transcript-window seam MUST return 200 for a valid iteration`)).toBe(200);
       const window = parseTranscriptWindow(res.json);
       expect(window, req(ID, 'host-sample-test-seams.md §14', `iteration ${iteration}: the seam MUST return { tokenCounter, tokenCount, eventIds, summarizedRanges, entries? } with a well-formed entries[] when present`)).toBeDefined();
-      if (window === undefined) return softSkip('blocked', `iteration ${iteration}: the seam answer was malformed (the assertion above records the failure)`);
+      if (window === undefined) throw new Error('unreachable: the assertion above fails first');
       windows.push({ iteration, window });
     }
     expect(windows.length, req(ID, 'host-sample-test-seams.md §14', 'a wired transcript-window seam MUST report at least one orchestrator iteration')).toBeGreaterThan(0);

package/src/scenarios/context-summarization-replay.test.ts

@@ -159,6 +159,8 @@ describe('context-summarization-replay (RFC 0111 §"Replay determinism")', () =>
     // The model-facing half: the summary TEXT the host fed on the fork.
     const sourceTexts = await fedSummaryTexts(sourceRunId, toLog(sourceQ.events));
     const forkTexts = await fedSummaryTexts(forkRunId, toLog(forkQ.events));
+    // partial-witness-ok: summaryRef reuse, the replay MUST, was asserted above; the summary-
+    // text comparison needs the transcript-window seam's entries[], an optional extra.
     if (sourceTexts === null || forkTexts === null) return softSkip('inapplicable', 'the transcript-window seam serves no entries[] for these runs, so the model-facing summary text was not compared (summaryRef reuse was)');
     expect(sourceTexts.length, req(ID, 'RFC 0111 §"Replay determinism"', 'the source run summarized, so its transcript windows MUST carry the summary text it fed')).toBeGreaterThan(0);
     expect(forkTexts, req(ID, 'RFC 0111 §"Replay determinism"', 'the replay MUST feed the model the recorded summary text, byte for byte — never a re-summarization')).toEqual(sourceTexts);

package/src/scenarios/cost-attribution.test.ts

@@ -93,7 +93,9 @@ describe.skipIf(SKIP_NO_NOOP)('cost-attribution: metrics.openwopCost forward-com
       // passes trivially; don't force a value on a workflow that produces
       // no cost.
       expect(openwopCost).toBeUndefined();
-      return softSkip('blocked', 'precondition not met — `openwopCost === undefined` returned early (seam, prior step, or fixture unavailable)');
+      // partial-witness-ok: an IF-present clause. The noop fixture records no cost and absence
+      // is spec-allowed, so there is no openwopCost shape to bind; the run itself completed.
+      return softSkip('inapplicable', 'metrics.openwopCost is absent on the noop run (spec-allowed) — no shape to check');
     }
 
     // When present, validate the canonical shape per

package/src/scenarios/debugBundle.test.ts

@@ -43,7 +43,7 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { CANARY_MARKER, getCanary } from '../lib/canaries.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { makeTraceparent } from '../lib/trace-context.js';
 
 const NOOP_WORKFLOW_ID = 'conformance-noop';
@@ -188,7 +188,9 @@ describe.skipIf(SKIP_NO_NOOP)('debug-bundle: invariants per debug-bundle.md', ()
 
     const bundleRes = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/debug-bundle`);
     const eventsRes = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events/poll`);
-    if (eventsRes.status !== 200) return softSkip('blocked', 'precondition not met — `eventsRes.status !== 200` returned early (host without polling) (seam, prior step, or fixture unavailable)'); // host without polling
+    // rest-endpoints.md §"Required endpoints": every host MUST expose
+    // /events/poll, so a conforming host always makes this comparison observable.
+    if (eventsRes.status !== 200) return blockedDespiteAssertions(`GET /v1/runs/{runId}/events/poll answered ${eventsRes.status} — the bundle/poll agreement was never observed`);
 
     const bundle = bundleRes.json as DebugBundleShape;
     const polledEvents = (eventsRes.json as { events?: unknown[] }).events ?? [];
@@ -238,12 +240,15 @@ describe.skipIf(SKIP_NO_NOOP)('debug-bundle: spans join the trace (RFC 0207 §C,
   it('span traceId / kind / status have the RFC 0207 shape and the run span joins the caller trace', async () => {
     if (!(await isAdvertised())) return softSkip('inapplicable', 'debugBundle not advertised by this host');
     const tp = makeTraceparent();
+    // Run create and the bundle read are asserted by the legs above; here they
+    // are setup, and returning before any assertion lets a host that emits no
+    // spans record `inapplicable` rather than a partial-witness pass.
     const create = await driver.post('/v1/runs', { workflowId: NOOP_WORKFLOW_ID }, { headers: { traceparent: tp.header } });
-    expect(create.status).toBe(201);
+    if (create.status !== 201) return softSkip('blocked', `POST /v1/runs answered ${create.status} — no run to read spans from`);
     const runId = (create.json as { runId: string }).runId;
     await pollUntilTerminal(runId);
     const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/debug-bundle`);
-    expect(res.status).toBe(200);
+    if (res.status !== 200) return softSkip('blocked', `GET /v1/runs/{runId}/debug-bundle answered ${res.status} — no spans to read`);
     const spans = ((res.json as DebugBundleShape | undefined)?.spans ?? []) as Array<Record<string, unknown>>;
     if (spans.length === 0) return softSkip('inapplicable', 'host emits no spans (spans: []) — the RFC 0207 §C trace-join rule has nothing to hold');
     for (const s of spans) {
@@ -259,6 +264,9 @@ describe.skipIf(SKIP_NO_NOOP)('debug-bundle: spans join the trace (RFC 0207 §C,
       }
     }
     const run = spans.find((s) => s['name'] === 'openwop.run');
+    // partial-witness-ok: the span shape rules above were observed on every
+    // span; the trace-join half needs an openwop.run span with a traceId, which
+    // is SHOULD, so its absence is recorded rather than failed.
     if (run === undefined || run['traceId'] === undefined) return softSkip('inapplicable', 'the bundle carries no openwop.run span with a traceId (traceId is SHOULD) — the trace-join half has nothing to compare');
     expect(run['traceId'], req(LEG, 'debug-bundle.md §"spans field" (RFC 0207 §C)', 'the openwop.run span of a run started with an honoured inbound traceparent MUST carry that trace id')).toBe(tp.traceId);
   });

package/src/scenarios/discovery.test.ts

@@ -64,7 +64,9 @@ describe('discovery: /.well-known/openwop', () => {
         'capabilities-change-detection.md §Capabilities-Etag',
         'Capabilities-Etag is optional; hosts that omit it remain conformant',
       )).toBeNull();
-      return softSkip('blocked', 'precondition not met — `firstEtag === null` returned early (seam, prior step, or fixture unavailable)');
+      // partial-witness-ok: Capabilities-Etag is OPTIONAL; when absent, the IF-present MUSTs
+      // below bind nothing.
+      return softSkip('inapplicable', 'Capabilities-Etag not sent (optional) — no etag to check');
     }
 
     expect(firstEtag.trim().length, req('openwop.it.discovery.if-capabilities-etag-is-present-it-is-non-empty-and-stable-within-the-cache-wind', 
@@ -116,7 +118,9 @@ describe('discovery: /.well-known/openwop fixtures field shape per RFC 0003', ()
       // RFC 0003 makes the field OPTIONAL — pre-RFC hosts and hosts
       // that opt out advertise nothing. Assertion passes trivially.
       expect(fixtures).toBeUndefined();
-      return softSkip('blocked', 'precondition not met — `fixtures === undefined` returned early (seam, prior step, or fixture unavailable)');
+      // partial-witness-ok: discovery answered 200 and `fixtures` is OPTIONAL (RFC 0003); when
+      // absent, the IF-present MUSTs below bind nothing.
+      return softSkip('inapplicable', 'discovery carries no fixtures[] (optional, RFC 0003) — no entries to check');
     }
 
     expect(Array.isArray(fixtures), req('openwop.it.discovery.if-fixtures-is-present-it-must-be-a-string-of-unique-non-empty-entries', 

package/src/scenarios/dispatch-cross-worker-handoff.test.ts

@@ -26,7 +26,7 @@ import { driver } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const PARENT = 'conformance-dispatch-cross-worker-handoff';
 const CHILD_A = 'conformance-dispatch-cross-worker-handoff-child-a';
@@ -106,7 +106,7 @@ describe.skipIf(SKIP)('dispatch-cross-worker-handoff: sequential child→parent
     const events = ((eventsRes.json as { events?: RunEvent[] } | undefined)?.events ?? []);
     const dispatchedA = events.find((e) => e.type === 'node.dispatched' && e.payload?.childWorkflowId === CHILD_A);
     const dispatchedB = events.find((e) => e.type === 'node.dispatched' && e.payload?.childWorkflowId === CHILD_B);
-    if (!dispatchedA || !dispatchedB) return softSkip('blocked', 'precondition not met — `!dispatchedA || !dispatchedB` returned early (seam, prior step, or fixture unavailable)');
+    if (!dispatchedA || !dispatchedB) return blockedDespiteAssertions('the advertised fixture\'s parent run emitted no node.dispatched for child-a and child-b — per-worker mapping precedence is unobserved');
 
     const childARes = await driver.get(`/v1/runs/${encodeURIComponent(dispatchedA.payload!.childRunId!)}`);
     const childBRes = await driver.get(`/v1/runs/${encodeURIComponent(dispatchedB.payload!.childRunId!)}`);

package/src/scenarios/dispatch-input-mapping.test.ts

@@ -26,7 +26,7 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { setHostCapability, resetHostCapabilities, isToggleAvailable } from '../lib/host-toggle.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const PARENT = 'conformance-dispatch-input-mapping';
 const CHILD = 'conformance-dispatch-input-mapping-child';
@@ -100,7 +100,7 @@ describe.skipIf(SKIP)('dispatch-input-mapping: parent → child variable project
     const dispatched = events.find(
       (e) => e.type === 'node.dispatched' && e.payload?.childWorkflowId === CHILD,
     );
-    if (!dispatched) return softSkip('blocked', 'precondition not met — `!dispatched` returned early (host doesn\'t emit node.dispatched — soft-skip) (seam, prior step, or fixture unavailable)'); // host doesn't emit node.dispatched — soft-skip
+    if (!dispatched) return blockedDespiteAssertions('the advertised fixture\'s parent run emitted no node.dispatched — the unset-variable projection is unobserved');
     const childRunId = dispatched.payload?.childRunId;
 
     const childRes = await driver.get(`/v1/runs/${encodeURIComponent(childRunId!)}`);

package/src/scenarios/dispatch-output-mapping.test.ts

@@ -124,7 +124,9 @@ describe.skipIf(!isFixtureAdvertised('conformance-dispatch-cancellable-child'))(
     const parentId = await registerParent('conformance-dispatch-cancellable-child');
     if (!parentId) return softSkip('blocked', 'precondition not met — `!parentId` returned early (soft-skip) (seam, prior step, or fixture unavailable)'); // soft-skip
     const create = await driver.post('/v1/runs', { workflowId: parentId });
-    expect(create.status).toBe(201);
+    // Asserted only when it fails, so no assertion has passed when the skip below
+    // decides the row (see there).
+    if (create.status !== 201) expect(create.status).toBe(201);
     const parentRunId = (create.json as { runId: string }).runId;
 
     // Poll for the node.dispatched event so we can cancel the child mid-flight.
@@ -140,7 +142,18 @@ describe.skipIf(!isFixtureAdvertised('conformance-dispatch-cancellable-child'))(
       }
       await new Promise((r) => setTimeout(r, 250));
     }
-    if (!childRunId) return softSkip('blocked', 'precondition not met — `!childRunId` returned early (dispatch didn\'t surface child run id — soft-skip) (seam, prior step, or fixture unavailable)'); // dispatch didn't surface child run id — soft-skip
+    if (!childRunId) {
+      // Not `blocked`: a conforming host may emit node.dispatched only when the dispatch
+      // step RETURNS. The payload's `childStatus` is "the status of the child run at the
+      // moment the dispatch step returned" (run-event-payloads.schema.json
+      // $defs.nodeDispatched), and openwop-app emits it after the child terminates, so the
+      // 30 s child cannot be located and cancelled mid-flight. Recording `blocked` here
+      // denied certification to a conforming host (measured on openwop-app, 2026-09-27).
+      await driver.post(`/v1/runs/${encodeURIComponent(parentRunId)}/cancel`, { reason: 'conformance-cleanup' });
+      // partial-witness-ok: no assertion has passed at runtime; the only earlier expect
+      // runs solely when the create is not 201, and then it throws.
+      return softSkip('inapplicable', 'no node.dispatched carried a childRunId while the child was running; this host emits it when the dispatch step returns, so the child cannot be cancelled mid-flight and the cancelled-child case cannot be driven');
+    }
     const cancelRes = await driver.post(`/v1/runs/${encodeURIComponent(childRunId)}/cancel`, { reason: 'hvmap-1b-cancelled test' });
     expect(cancelRes.status === 200 || cancelRes.status === 202).toBe(true);
 

package/src/scenarios/distillation-token-budget.test.ts

@@ -11,7 +11,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { readDistillationCap, invokeDistill } from '../lib/distillation.js';
 import { req } from '../lib/requirement-ids.js';
 
@@ -33,7 +33,7 @@ describe('distillation-token-budget (RFC 0062 §B)', () => {
 
     // A budget too small to distill the corpus MUST fail closed, no partial archive.
     const tooSmall = await invokeDistill({ memoryRef: 'conformance-distill', tokenBudget: 1 });
-    if (tooSmall === null) return softSkip('blocked', 'precondition not met — `tooSmall === null` returned early (seam, prior step, or fixture unavailable)');
+    if (tooSmall === null) return blockedDespiteAssertions('the distill seam answered the in-budget call but not the un-meetable one — the atomic token_budget_exceeded failure is unobserved');
     expect(
       tooSmall.status >= 400 && tooSmall.body.error === 'token_budget_exceeded',
       req('openwop.it.distillation-token-budget.within-budget-tokensused-tokenbudget-an-un-meetable-budget-fails-atomically', 'RFC 0062 §B', 'an un-meetable budget MUST fail with token_budget_exceeded'),

package/src/scenarios/durability-poison-exhaustion.test.ts

@@ -47,7 +47,7 @@ import { describe, expect, it } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { pollUntilTerminal, scaledTimeoutMs } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { queryTestEvents, requireEvents } from '../lib/event-log-query.js';
 import { recordRequirement } from '../lib/requirement-ledger.js';
 import { requirementIdForFile } from '../lib/scenario-disposition.js';
@@ -112,7 +112,7 @@ describe.skipIf(SKIP_NO_FIXTURE)('RFC 0158 §C.8 — poison work terminates with
         ? 'event-log seam /v1/host/sample/test/runs/{runId}/events not wired — attempts are unobservable'
         : `event-log seam returned HTTP ${first.status}`;
       recordRequirement(REQ, 'blocked', why);
-      return softSkip('blocked', why);
+      return blockedDespiteAssertions(why);
     }
 
     const events = requireEvents(first, 'RFC 0158 §C.8 attempt counting');

package/src/scenarios/envelope-completion-distinguishes-truncation.test.ts

@@ -33,7 +33,8 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
+import { readDispatchBudgets } from '../lib/mock-ai-budgets.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 /**
@@ -210,26 +211,61 @@ describe.skipIf(HTTP_SKIP)('envelope-completion-distinguishes-truncation: schema
     ]);
     if (seed.status === 404) return softSkip('blocked', 'precondition not met — `seed.status === 404` returned early (seam, prior step, or fixture unavailable)');
 
-    await startRunAndRead(SCHEMA_VIOLATION_FIXTURE);
-    const budget = await lastBudget(SCHEMA_VIOLATION_FIXTURE);
-    if (budget === null) return softSkip('blocked', 'precondition not met — `budget === null` returned early (seam, prior step, or fixture unavailable)');
-    // The schema-violation fixture doesn't set maxTokens explicitly →
-    // budget snapshots whatever the host's default is on each call.
-    // The KEY invariant: the retry call's budget MUST NOT be multiplied
-    // (the truncation path doubles; this path keeps the same). The
-    // budget on the last call equals the budget on the first call.
-    // Without a per-call history hook, we can't strictly compare; we
-    // assert the budget didn't grow into the truncation-path range
-    // (which would be ≥2× the default — typically 8000 for the
-    // sample's structuredOutput dispatch path).
-    if (budget !== null) {
+    const result = await startRunAndRead(SCHEMA_VIOLATION_FIXTURE);
+    const REQ_ID = 'openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on';
+
+    // Suite 2.42.7: the per-attempt witness. `last-dispatch-budget` reports only
+    // the most recent call, so the retry's budget could not be compared with the
+    // attempt before it — a host that doubled 256 → 512 on a schema-violation
+    // retry passed the `< 20_000` range check below. `dispatch-budgets`
+    // (host-sample-test-seams.md §28) returns every call's budget in call order,
+    // and the fixture now sets `maxTokens: 256` so attempt 1 carries one. A served
+    // seam that breaks its contract is `blocked`; an UNSERVED one falls through to
+    // the pre-seam partial witness below (the seam is newer than this leg).
+    const budgets = await readDispatchBudgets(NODE_OF[SCHEMA_VIOLATION_FIXTURE] as string);
+    if (!budgets.ok && !budgets.unserved) return blockedDespiteAssertions(budgets.reason);
+    if (!budgets.ok) {
+      const budget = await lastBudget(SCHEMA_VIOLATION_FIXTURE);
+      if (budget === null) return softSkip('blocked', 'precondition not met — `budget === null` returned early (seam, prior step, or fixture unavailable)');
+      // Pre-seam path: only the most recent call's budget is visible, so it is
+      // range-checked against the truncation path (≥2× the default — typically
+      // 8000 for the sample's structuredOutput dispatch path), not compared.
       expect(
         budget,
-        req('openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on', 
+        req(REQ_ID,
           'RFCS/0033-envelope-completion-contract.md §C',
           'schema-violation retry MUST NOT multiply maxTokens — budget stays at the original value (host default)',
         ),
       ).toBeLessThan(20_000);
+      // partial-witness-ok: the host does not serve the optional dispatch-budgets
+      // seam (host-sample-test-seams.md §28), so the retry's budget is range-checked,
+      // not compared with the attempt before it. The acceptance predicate refuses a
+      // partial-witness row.
+      return softSkip('inapplicable', `partial witness — the §C budget rule is only range-checked: ${budgets.reason}; the most recent call's maxTokens (${budget}) is below the truncation-path range, but a retry that grew the budget within that range is not detected`);
+    }
+    if (result === null) return blockedDespiteAssertions('the run create or event-log read failed — the retry count the budgets are checked against was never observed');
+    const retries = result.events.filter((e) => e.type === 'envelope.retry.attempted').length;
+    // RFC 0033 §C: a host MAY retry. No retry means no retry budget to compare;
+    // the sibling leg above convicts a host that should have retried and did not.
+    // partial-witness-ok: no retry happened, so there is no retry budget to observe.
+    if (retries === 0) return softSkip('inapplicable', 'the host made no schema-violation retry (RFC 0033 §C: MAY retry) — there is no retry budget to compare');
+    if (budgets.attempts.length < retries + 1) {
+      return blockedDespiteAssertions(`the dispatch-budgets seam recorded ${budgets.attempts.length} call(s) but the run emitted ${retries} envelope.retry.attempted event(s), i.e. ${retries + 1} calls — the seam does not report every attempt (host-sample-test-seams.md §28)`);
+    }
+    const attempts = budgets.attempts;
+    if (!attempts.every((m): m is number => m !== null)) {
+      // partial-witness-ok: the seam is served but at least one call carried no
+      // budget (maxTokens null), so no two attempts' budgets can be compared.
+      return softSkip('inapplicable', `partial witness — the §C budget rule is UNWITNESSED: the dispatch-budgets seam shows a call with no output budget (per-attempt budgets: ${JSON.stringify(attempts)}), so no retry's budget can be compared with the attempt before it`);
+    }
+    for (let i = 1; i < attempts.length; i++) {
+      expect(
+        attempts[i]! <= attempts[i - 1]!,
+        req(REQ_ID,
+          'RFCS/0033-envelope-completion-contract.md §C',
+          `schema-violation retries SHALL NOT include an increased output budget — attempt ${i + 1} carried maxTokens ${attempts[i]} after attempt ${i} carried ${attempts[i - 1]} (per-attempt budgets: ${JSON.stringify(attempts)})`,
+        ),
+      ).toBe(true);
     }
   });
 });

package/src/scenarios/envelope-nl-to-format-engaged.test.ts

@@ -29,7 +29,7 @@ import { driver } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 const FIXTURE = 'conformance-envelope-nl-to-format-engaged';
@@ -77,7 +77,7 @@ describe.skipIf(HTTP_SKIP)('envelope-nl-to-format-engaged: runtime behavior (RFC
     expect(seed.status).toBe(200);
 
     const events = await runAndReadEvents();
-    if (events === null) return softSkip('blocked', 'precondition not met — `events === null` returned early (seam, prior step, or fixture unavailable)');
+    if (events === null) return blockedDespiteAssertions('the advertised fixture run did not start (≠201) or its event log did not read (≠200) — envelope.nlToFormat.engaged is unobserved');
     const engagements = events.filter((e) => e.type === 'envelope.nlToFormat.engaged');
     expect(
       engagements.length,

package/src/scenarios/envelope-recovery-applied.test.ts

@@ -123,7 +123,7 @@ describe.skipIf(HTTP_SKIP)('envelope-recovery-applied: SECURITY invariant envelo
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const RECOVERY_FIXTURE = 'conformance-envelope-recovery-applied';
 const RECOVERY_NODE_ID = 'recovery-applied-structured-call';
@@ -163,7 +163,7 @@ describe.skipIf(HTTP_SKIP)('envelope-recovery-applied: end-to-end through the en
     expect(seed.status).toBe(200);
 
     const events = await runAndReadEvents();
-    if (events === null) return softSkip('blocked', 'precondition not met — `events === null` returned early (seam, prior step, or fixture unavailable)');
+    if (events === null) return blockedDespiteAssertions('the advertised fixture run did not start (≠201) or its event log did not read (≠200) — envelope.recovery.applied is unobserved');
     const recoveries = events.filter((e) => e.type === 'envelope.recovery.applied');
     expect(
       recoveries.length,

package/src/scenarios/envelope-refusal-shape.test.ts

@@ -193,7 +193,7 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const E2E_FIXTURE = 'conformance-envelope-refusal';
 const E2E_NODE_ID = 'refusal-structured-call';
@@ -232,7 +232,7 @@ describe.skipIf(HTTP_SKIP)('envelope-refusal-shape: end-to-end refusal through d
     expect(seed.status).toBe(200);
 
     const result = await runE2eAndRead();
-    if (result === null) return softSkip('blocked', 'precondition not met — `result === null` returned early (seam, prior step, or fixture unavailable)');
+    if (result === null) return blockedDespiteAssertions('the advertised fixture run did not start (≠201) or its event log did not read (≠200) — envelope.refusal and the no-retry rule are unobserved');
     const refusals = result.events.filter((e) => e.type === 'envelope.refusal');
     expect(
       refusals.length,