@openwop/openwop-conformance 2.42.6 → 2.42.8

package/src/scenarios/prompt-read-workspace-membership-enforced.test.ts

@@ -46,7 +46,8 @@
  *     diagnostic log. Indicates the host doesn't recognize `?workspaceId=`
  *     on this endpoint (e.g., host-only template library with no
  *     workspace dimension).
- *   - 5xx — PASS (refused; envelope shape unconstrained).
+ *   - 5xx — `blocked`: a server error is not a readable refusal (a crash
+ *     also answers 5xx), so enforcement was not observed.
  *
  * Why a random workspaceId is sufficient: the assertion is negative-space.
  * A host that correctly enforces membership MUST refuse for ANY workspace
@@ -118,27 +119,17 @@ describe.skipIf(HTTP_SKIP)(
         `/v1/prompts?workspaceId=${encodeURIComponent(nonMemberWorkspaceId)}`,
       );
 
-      // 4xx — refused. Acceptable shape for the membership-required failure
-      // (and any other refusal mode the host chooses: 401, 404 for
-      // existence-disclosure avoidance, etc).
-      if (res.status >= 400 && res.status < 500) {
-        // Canonical envelope on 403 per rest-endpoints.md §"Common error codes".
-        if (res.status === 403) {
-          const body = res.json as { error?: unknown } | null;
-          expect(
-            body?.error,
-            req('openwop.it.prompt-read-workspace-membership-enforced.get-v1-prompts-workspaceid-non-member-must-refuse-or-return-empty-templates-neve', 
-              'spec/v1/rest-endpoints.md §Common error codes — workspace_membership_required',
-              `403 refusal of a workspace-scoped read MUST carry error: "workspace_membership_required"; got error: ${JSON.stringify(body?.error)}`,
-            ),
-          ).toBe('workspace_membership_required');
-        }
-        return softSkip('blocked', 'precondition not met — `res.status >= 400 && res.status < 500` returned early (4xx — refused. Acceptable shape for the membership-required failure (and any other refusal mode the host chooses: 401, 404 for existence-d…');
-      }
+      const ID = 'openwop.it.prompt-read-workspace-membership-enforced.get-v1-prompts-workspaceid-non-member-must-refuse-or-return-empty-templates-neve';
+
+      // 5xx — not a refusal the suite can read as enforcement (a crash also
+      // answers 5xx). Checked first so it returns before any assertion.
+      if (res.status >= 500) return softSkip('blocked', `GET /v1/prompts?workspaceId=<non-member> answered ${res.status} — a server error is neither a refusal nor an empty result, so membership enforcement was not observed`);
 
-      // 5xx — refused (infrastructure failure is acceptable; envelope shape
-      // unconstrained).
-      if (res.status >= 500) return softSkip('blocked', 'precondition not met — `res.status >= 500` returned early (5xx — refused (infrastructure failure is acceptable; envelope shape unconstrained).) (seam, prior step, or fixture unavailable)');
+      // Other status codes (1xx, 3xx) — not a clear signal either way.
+      if (res.status < 200 || (res.status >= 300 && res.status < 400)) {
+        softSkip('skipped', `GET /v1/prompts?workspaceId=… answered ${res.status} — neither a refusal nor a list`);
+        return ctx.skip();
+      }
 
       // 2xx — must inspect the response body. The failure mode this
       // invariant guards against is a 200 response that LEAKS templates
@@ -152,35 +143,53 @@ describe.skipIf(HTTP_SKIP)(
         ) {
           // Host doesn't recognize `?workspaceId=` on this endpoint
           // (response shape doesn't include the documented `templates[]`
-          // field). Soft-skip: this scenario probes hosts that expose
+          // field). Skip: this scenario probes hosts that expose
           // workspace-scoped reads, and a host without that surface is
-          // simply out of scope.
-          ctx.skip();
-          return softSkip('blocked', 'precondition not met — `body === null || typeof body !== \'object\' || !(\'templates\' in body)` returned early (seam, prior step, or fixture unavailable)');
+          // simply out of scope. The note is written BEFORE ctx.skip(),
+          // which throws.
+          softSkip('skipped', 'GET /v1/prompts?workspaceId=… answered 2xx without a templates field — the host does not expose workspace-scoped prompt reads');
+          return ctx.skip();
         }
         const templates = body.templates;
         if (!Array.isArray(templates)) {
           // Same: unrecognized shape, skip.
-          ctx.skip();
-          return softSkip('blocked', 'precondition not met — `!Array.isArray(templates)` returned early (seam, prior step, or fixture unavailable)');
+          softSkip('skipped', 'GET /v1/prompts?workspaceId=… answered 2xx with a non-array templates field — the host does not expose workspace-scoped prompt reads');
+          return ctx.skip();
         }
 
         // A random non-member workspaceId can never legitimately contain
         // templates the caller is authorized to see. Any non-empty result
-        // is a cross-tenant data leak.
+        // is a cross-tenant data leak. An empty result IS the requirement
+        // observed, so the leg ends as a plain pass.
         expect(
           templates.length,
-          req('openwop.it.prompt-read-workspace-membership-enforced.get-v1-prompts-workspaceid-non-member-must-refuse-or-return-empty-templates-neve', 
+          req(ID,
             'spec/v1/prompts.md §Workspace membership on workspace-scoped reads and writes',
             `GET /v1/prompts?workspaceId=<random-non-member> MUST NOT return any templates; got ${templates.length} templates which is a cross-tenant data leak (the random workspaceId is freshly generated per probe and cannot legitimately contain authorized content)`,
           ),
         ).toBe(0);
-        return softSkip('blocked', 'precondition not met — `res.status >= 200 && res.status < 300` returned early (2xx — must inspect the response body. The failure mode this invariant guards against is a 200 response that LEAKS templates from a workspa…');
+      } else {
+        // 4xx — refused. Acceptable shape for the membership-required failure
+        // (and any other refusal mode the host chooses: 401, 404 for
+        // existence-disclosure avoidance, etc). The refusal IS the requirement
+        // observed; until 2026-09-27 this branch ended in a blocked soft-skip,
+        // recording a refused read as blocked (401/404) or a partial witness (403).
+        expect(
+          res.status,
+          req(ID, 'spec/v1/prompts.md §Workspace membership on workspace-scoped reads and writes', 'a workspace-scoped read for a non-member workspace MUST be refused (4xx) or return no templates'),
+        ).toBeGreaterThanOrEqual(400);
+        // Canonical envelope on 403 per rest-endpoints.md §"Common error codes".
+        if (res.status === 403) {
+          const body = res.json as { error?: unknown } | null;
+          expect(
+            body?.error,
+            req(ID,
+              'spec/v1/rest-endpoints.md §Common error codes — workspace_membership_required',
+              `403 refusal of a workspace-scoped read MUST carry error: "workspace_membership_required"; got error: ${JSON.stringify(body?.error)}`,
+            ),
+          ).toBe('workspace_membership_required');
+        }
       }
-
-      // Other status codes (1xx, 3xx) — soft-skip with note. Not a clear
-      // signal either way.
-      ctx.skip();
     });
   },
 );

package/src/scenarios/provider-usage.test.ts

@@ -29,7 +29,7 @@ import { SCHEMAS_DIR } from '../lib/paths.js';
 import { queryTestEvents, isEventLogSeamAvailable, resetTestSeam } from '../lib/event-log-query.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 interface DiscoveryDoc {
   capabilities?: {
@@ -145,7 +145,7 @@ describe('provider-usage: event presence via emit-seam + event-log query (RFC 00
     expect(emit.status).toBe(200);
 
     const events = await queryTestEvents(runId, { type: 'provider.usage' });
-    if (!events.ok) return softSkip('blocked', 'precondition not met — `!events.ok` returned early (seam, prior step, or fixture unavailable)');
+    if (!events.ok) return blockedDespiteAssertions('the event-log seam is advertised but the provider.usage query failed — the projection is unobserved');
     expect(
       events.events.length,
       req('openwop.it.provider-usage.emit-seam-projects-exactly-one-provider-usage-event-with-required-fields-populat', 'RFC 0026 §B', 'emit-seam MUST project exactly one provider.usage event'),

package/src/scenarios/redaction.test.ts

@@ -66,15 +66,17 @@ const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);
 describe('redaction: /.well-known/openwop secrets+aiProviders shape contract', () => {
   it('secrets is well-formed regardless of supported value', async () => {
     const res = await driver.get('/.well-known/openwop', { authenticated: false });
-    expect(res.status).toBe(200);
-
     const body = res.json as { secrets?: unknown } | undefined;
     const secrets = body?.secrets;
 
-    if (secrets === undefined) {
-      // Optional v1 field — hosts MAY omit. Spec-allowed; nothing to assert.
-      return softSkip('blocked', 'precondition not met — `secrets === undefined` returned early (Optional v1 field — hosts MAY omit. Spec-allowed; nothing to assert.) (seam, prior step, or fixture unavailable)');
+    if (res.status === 200 && secrets === undefined) {
+      // Optional v1 field — hosts MAY omit. Spec-allowed; nothing to assert,
+      // so the leg returns before any assertion and records `inapplicable`
+      // (it was a `blocked` note after the status assertion until 2026-09-27,
+      // i.e. a partial-witness pass).
+      return softSkip('inapplicable', '`secrets` is omitted from discovery — an OPTIONAL v1 field, so there is no shape to check');
     }
+    expect(res.status).toBe(200);
 
     // Per capabilities.schema.json: `secrets.supported` is REQUIRED
     // when secrets is present.

package/src/scenarios/redactionAdversarial.test.ts

@@ -48,7 +48,7 @@ import { CANARIES, CANARY_MARKER, getCanary } from '../lib/canaries.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const NOOP_WORKFLOW_ID = 'conformance-noop';
 const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);
@@ -77,8 +77,9 @@ describe.skipIf(SKIP_NO_NOOP)('redaction-adversarial: workflow input canaries',
       `/v1/runs/${encodeURIComponent(runId)}/events/poll`,
     );
     if (events.status !== 200) {
-      // Host doesn't expose polling; SSE is the alternative. Skip-equivalent.
-      return softSkip('blocked', 'precondition not met — `events.status !== 200` returned early (Host doesn\'t expose polling; SSE is the alternative. Skip-equivalent.) (seam, prior step, or fixture unavailable)');
+      // events/poll is a core endpoint (rest-endpoints.md); without it the
+      // canary check below never runs, so the leg is blocked, not passed.
+      return blockedDespiteAssertions('GET /v1/runs/{runId}/events/poll did not answer 200 — the canary non-disclosure is unobserved');
     }
 
     const eventsText = events.text;
@@ -139,7 +140,7 @@ describe.skipIf(SKIP_NO_NOOP)('redaction-adversarial: bearer-shaped strings roun
     const events = await driver.get(
       `/v1/runs/${encodeURIComponent(runId)}/events/poll`,
     );
-    if (events.status !== 200) return softSkip('blocked', 'precondition not met — `events.status !== 200` returned early (seam, prior step, or fixture unavailable)');
+    if (events.status !== 200) return blockedDespiteAssertions('GET /v1/runs/{runId}/events/poll did not answer 200 — the canary non-disclosure is unobserved');
 
     expect(events.text.includes(canary), req('openwop.it.redactionAdversarial.anthropic-shaped-canary-embedded-in-non-credential-input-must-not-appear-verbati', 
       'capabilities.md §"Secrets" + NFR-7',

package/src/scenarios/registry-public.test.ts

@@ -215,7 +215,11 @@ describe('registry-public: tarball + signature + Ed25519 verify roundtrip', () =
     // `method=ed25519` — the simpler path. Extending to `manual` would
     // require the tarball extractor from registry/scripts/verify-
     // signatures.mjs which is intentionally out of scope here.
-    if (method !== 'ed25519') return softSkip('blocked', 'precondition not met — `method !== \'ed25519\'` returned early (seam, prior step, or fixture unavailable)');
+    // partial-witness-ok: tarball, signature, public key and SRI were asserted
+    // above. `manual` is a conforming signing method whose pack.json-in-tarball
+    // verification this scenario does not implement, a suite limitation, not a
+    // host shortfall.
+    if (method !== 'ed25519') return softSkip('inapplicable', `${PACK_NAME} is signed method=manual; this scenario verifies only method=ed25519 signatures`);
 
     const verified = cryptoVerify(null, tarball.bytes, publicKey, sig.bytes);
     expect(verified, req('openwop.it.registry-public.tarball-sig-public-key-all-retrievable-sri-matches-ed25519-verifies-for', 'spec/v1/registry-operations.md', `Ed25519 signature over ${PACK_NAME}@${PACK_VERSION}.tgz MUST verify against ${manifest.signing!.keyId}`))

package/src/scenarios/replay-divergence-at-refusal.test.ts

@@ -45,7 +45,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
@@ -246,9 +246,12 @@ describe.skipIf(HTTP_SKIP)('replay-divergence-at-refusal: behavioral (RFC 0041
       workflowId: 'conformance-phase4-replay-divergence',
     });
     if (createRes.status === 404 || createRes.status === 422) {
-      softSkip('blocked', 'precondition not met — `createRes.status === 404 || createRes.status === 422` returned early (seam, prior step, or fixture unavailable)');
-      ctx.skip(); // fixture not advertised
-      return softSkip('blocked', 'precondition not met — `createRes.status === 404 || createRes.status === 422` returned early (seam, prior step, or fixture unavailable)');
+      // The host advertises refusalDivergenceEmission and its mock seam took the
+      // program (asserted above), but the fixture run would not start: the
+      // requirement was never observed. ctx.skip() throws, so this note is the
+      // row's disposition (`blocked`), exactly as before 2026-09-27.
+      blockedDespiteAssertions('the mock-AI seam accepted the program but POST /v1/runs of conformance-phase4-replay-divergence answered 404/422 — the fixture is not seeded, so no divergence was driven');
+      return ctx.skip();
     }
     expect(createRes.status).toBe(201);
     const sourceRunId = (createRes.json as { runId: string }).runId;
@@ -336,9 +339,9 @@ describe.skipIf(HTTP_SKIP)('replay-divergence-at-refusal: behavioral (RFC 0041
       workflowId: 'conformance-phase4-replay-divergence',
     });
     if (createRes.status === 404 || createRes.status === 422) {
-      softSkip('blocked', 'precondition not met — `createRes.status === 404 || createRes.status === 422` returned early (seam, prior step, or fixture unavailable)');
-      ctx.skip();
-      return softSkip('blocked', 'precondition not met — `createRes.status === 404 || createRes.status === 422` returned early (seam, prior step, or fixture unavailable)');
+      // As in the first case: ctx.skip() throws, so the note is the disposition.
+      blockedDespiteAssertions('the mock-AI seam accepted the program but POST /v1/runs of conformance-phase4-replay-divergence answered 404/422 — the fixture is not seeded, so no divergence was driven');
+      return ctx.skip();
     }
     expect(createRes.status).toBe(201);
     const sourceRunId = (createRes.json as { runId: string }).runId;

package/src/scenarios/replay-fanout-suppression.test.ts

@@ -283,8 +283,8 @@ describe('replay-fanout-suppression: a replay fork MUST NOT fan out re-emitted e
         'host does not advertise `replay.supported: true`, so a replay fork cannot occur and this MUST NOT '
           + 'has nothing to constrain on this host',
       );
-      ctx.skip();
-      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `replayCap?.supported !== true` returned early');
+      // recordRequirement above carries the disposition; ctx.skip() throws.
+      return ctx.skip();
     }
 
     // ── LEG 2 — THE MUST NOT. A replay fork re-emits; it must not deliver. ───
@@ -308,8 +308,8 @@ describe('replay-fanout-suppression: a replay fork MUST NOT fan out re-emitted e
         `replay fork returned ${replay.status} — the re-emission this requirement is stated over never happened, `
           + 'so the absence of deliveries below would prove nothing',
       );
-      ctx.skip();
-      return softSkip('blocked', 'precondition not met — `forkDeclined(replay.status, \'fanout-suppression replay fork\')` returned early (seam, prior step, or fixture unavailable)');
+      // recordRequirement above carries the disposition; ctx.skip() throws.
+      return ctx.skip();
     }
     expect(replay.status, req('openwop.it.replay-fanout-suppression.delivers-for-a-live-run-suppresses-for-a-replay-fork-and-delivers-again-for-a-br', 'webhooks.md §"Register"', 'replay fork should be accepted')).toBe(201);
     const replayRunId = (replay.json as { runId: string }).runId;
@@ -373,6 +373,9 @@ describe('replay-fanout-suppression: a replay fork MUST NOT fan out re-emitted e
     });
     if (branch.status === 501 || branch.status === 400) {
       // branch not offered on this range — leg 2 still stands on its own.
+      // partial-witness-ok: the MUST NOT (leg 2) was observed and recorded
+      // executed-pass above; leg 3 only pins the out-of-scope boundary, on a
+      // fork mode the host may not offer.
       return softSkip('blocked', 'precondition not met — `branch.status === 501 || branch.status === 400` returned early (branch not offered on this range — leg 2 still stands on its own.) (seam, prior step, or fixture unavailable)');
     }
     expect(branch.status, req('openwop.it.replay-fanout-suppression.delivers-for-a-live-run-suppresses-for-a-replay-fork-and-delivers-again-for-a-br', 'replay.md §"Host-initiated fan-out is an external effect"', 'branch fork should be accepted')).toBe(201);

package/src/scenarios/replay-fork-arbitrary.test.ts

@@ -30,7 +30,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { forkDeclined } from '../lib/fork-availability.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
@@ -246,7 +246,7 @@ describe.skipIf(SKIP_NO_MULTI)(
         );
         if (forkDeclined(fork2.status, 'arbitrary-event fork 2')) {
           ctx.skip();
-          return softSkip('blocked', 'precondition not met — `forkDeclined(fork2.status, \'arbitrary-event fork 2\')` returned early (seam, prior step, or fixture unavailable)');
+          return blockedDespiteAssertions('arbitrary-event fork 2 was declined — fork determinism is unobserved');
         }
         expect(fork2.status).toBe(201);
         const fork2Id = (fork2.json as { runId: string }).runId;

package/src/scenarios/replay-side-effect-suppression.test.ts

@@ -55,7 +55,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { V1_DIR } from '../lib/paths.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const WORKFLOW_ID = 'conformance-replay-side-effect';
 const EFFECT_NODE = 'effect';
@@ -178,7 +178,7 @@ describe.skipIf(SKIP_NO_FIXTURE)('replay-side-effect-suppression: a replay does
     });
     if (forkDeclined(fork.status, 'side-effect-suppression replay fork')) {
       ctx.skip();
-      return softSkip('blocked', 'precondition not met — `forkDeclined(fork.status, \'side-effect-suppression replay fork\')` returned early (seam, prior step, or fixture unavailable)');
+      return blockedDespiteAssertions('the replay fork was declined — side-effect suppression is unobserved');
     }
     expect(fork.status, req('openwop.it.replay-side-effect-suppression.fails-a-side-effecting-node-closed-with-replay-source-missing-when-the-source-ne', 'replay.md §"Side-effect suppression in replay" requirement 1', 'fork should be accepted')).toBe(201);
     const forkRunId = (fork.json as { runId: string }).runId;

package/src/scenarios/replayDeterminism.test.ts

@@ -18,7 +18,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { forkDeclined } from '../lib/fork-availability.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
@@ -121,7 +121,10 @@ describe.skipIf(SKIP_NO_NOOP)('replay-determinism: same fromSeq + same workflow
         mode: 'replay',
         fromSeq: 0,
       });
-      if (forkDeclined(fork2.status, 'determinism fork 2')) return softSkip('blocked', 'precondition not met — `forkDeclined(fork2.status, \'determinism fork 2\')` returned early (seam, prior step, or fixture unavailable)');
+      // Fork 1 of the same run was accepted (asserted above), so a decline here
+      // leaves the determinism comparison unobserved on a host that can fork:
+      // `blocked`, not the partial-witness pass a plain softSkip records.
+      if (forkDeclined(fork2.status, 'determinism fork 2')) return blockedDespiteAssertions(`the second replay fork of ${originalRunId} was declined (${fork2.status}) after the first was accepted — there is no second event list to compare`);
       expect(fork2.status).toBe(201);
       const fork2Id = (fork2.json as { runId: string }).runId;
       await pollUntilTerminal(fork2Id, { timeoutMs: 10_000 });
@@ -129,11 +132,13 @@ describe.skipIf(SKIP_NO_NOOP)('replay-determinism: same fromSeq + same workflow
       // Phase 4: fetch both fork event streams.
       const fork1Events = await driver.get(`/v1/runs/${encodeURIComponent(fork1Id)}/events/poll`);
       const fork2Events = await driver.get(`/v1/runs/${encodeURIComponent(fork2Id)}/events/poll`);
-      if (fork1Events.status !== 200 || fork2Events.status !== 200) return softSkip('blocked', 'precondition not met — `fork1Events.status !== 200 || fork2Events.status !== 200` returned early (seam, prior step, or fixture unavailable)');
+      // rest-endpoints.md §"Required endpoints": /events/poll is a MUST, so a
+      // conforming host always makes the two event lists readable.
+      if (fork1Events.status !== 200 || fork2Events.status !== 200) return blockedDespiteAssertions(`GET /events/poll for the forks answered ${fork1Events.status} / ${fork2Events.status} — the event lists were never compared`);
 
       const fork1Body = fork1Events.json as { events?: RawEvent[] };
       const fork2Body = fork2Events.json as { events?: RawEvent[] };
-      if (!fork1Body.events || !fork2Body.events) return softSkip('blocked', 'precondition not met — `!fork1Body.events || !fork2Body.events` returned early (seam, prior step, or fixture unavailable)');
+      if (!fork1Body.events || !fork2Body.events) return blockedDespiteAssertions('a fork /events/poll body carried no events[] — the event lists were never compared');
 
       // Phase 5: assert structural identity (modulo timestamps + IDs).
       expect(fork1Body.events.length, req('openwop.it.replayDeterminism.two-replay-forks-of-the-same-point-produce-structurally-identical-event-lists', 

package/src/scenarios/runner-ledger.test.ts

@@ -251,10 +251,14 @@ describe('RFC 0148 §A (S6) — the runner derivation', () => {
 describe('RFC 0148 §A — softSkip notes the reason for an early return, per file', () => {
   it('notes are keyed to the current test file, worst-first when mixed, and read back with joined reasons', () => {
     resetSoftSkips();
+    // partial-witness-ok: not a skip — this leg unit-tests softSkip itself, and
+    // resetSoftSkips() below clears every note it writes before the leg ends.
     expect(softSkip('inapplicable', 'host does not advertise X'), req('openwop.it.runner-ledger.notes-are-keyed-to-the-current-test-file-worst-first-when-mixed-and-read-back-wi', 'RFC 0148 §A', 'notes are keyed to the current test file, worst-first when mixed, and read back with joined reasons')).toBeUndefined();
+    // partial-witness-ok: not a skip — the subject under test (de-duplication).
     softSkip('inapplicable', 'host does not advertise X'); // de-duplicated
     let d = softSkipDisposition('runner-ledger.test.ts');
     expect(d).toEqual({ kind: 'inapplicable', reason: 'host does not advertise X' });
+    // partial-witness-ok: not a skip — the subject under test (worst-first fold).
     softSkip('blocked', 'seam not mounted');
     d = softSkipDisposition('runner-ledger.test.ts');
     expect(d?.kind).toBe('blocked');

package/src/scenarios/runtime-capabilities.test.ts

@@ -52,6 +52,8 @@ describe('runtime-capabilities: /.well-known/openwop forward-compat shape', () =
       // of v1 hosts will omit it. Assertion passes trivially; don't
       // force a value on a host that doesn't advertise any.
       expect(caps).toBeUndefined();
+      // partial-witness-ok: discovery answered 200 and runtimeCapabilities is OPTIONAL; when
+      // absent, the IF-present MUSTs below bind nothing.
       return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `caps === undefined` returned early');
     }
 

package/src/scenarios/speech-synthesis-roundtrip.test.ts

@@ -58,7 +58,7 @@ describe('speech-synthesis-roundtrip (RFC 0105 §A)', () => {
       audio !== undefined,
       req('openwop.it.speech-synthesis-roundtrip.synthesizes-an-audio-asset-with-exactly-one-of-url-base64-and-echoes-the-voiceid', 'RFC 0105 §A', 'the response MUST carry an `audio` object'),
     ).toBe(true);
-    if (!audio) return softSkip('blocked', 'precondition not met — `!audio` returned early (seam, prior step, or fixture unavailable)');
+    if (!audio) throw new Error('unreachable: the assertion above has already failed this leg');
 
     const hasUrl = typeof audio.url === 'string' && (audio.url as string).length > 0;
     const hasBase64 = typeof audio.base64 === 'string' && (audio.base64 as string).length > 0;

package/src/scenarios/streamReconnect.test.ts

@@ -22,7 +22,7 @@ import { subscribe, type SseEvent } from '../lib/sse.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const WORKFLOW_ID = 'conformance-cancellable';
 const SKIP_NO_FIXTURE = !isFixtureAdvertised(WORKFLOW_ID);
@@ -84,7 +84,7 @@ describe.skipIf(SKIP_NO_FIXTURE)('stream-reconnect: Last-Event-ID resume per spe
         // because the run already completed and the server closed before we
         // got events. Skip the rest of this scenario; the host is fast enough
         // that the reconnect path doesn't apply.
-        return softSkip('blocked', 'precondition not met — `lastSeen < 0` returned early (First connection emitted no events with a parseable sequence — e.g. because the run already completed and the server closed before we got events. Skip the rest of …');
+        return blockedDespiteAssertions('the first SSE connection yielded no event with a parseable sequence within 1s — the Last-Event-ID resume is unobserved');
       }
 
       // Phase 3: reconnect with Last-Event-ID set to the last seq we saw.

package/src/scenarios/subrun-approval-gate.test.ts

@@ -10,7 +10,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { readSubRunAttestationCap, invokeSubRunAttest } from '../lib/subRunAttestation.js';
 import { req } from '../lib/requirement-ids.js';
 
@@ -27,7 +27,7 @@ describe('subrun-approval-gate (RFC 0063 §C)', () => {
     ).toBe(true);
 
     const rejected = await invokeSubRunAttest({ ...base, approvalAction: 'reject' });
-    if (rejected === null) return softSkip('blocked', 'precondition not met — `rejected === null` returned early (seam, prior step, or fixture unavailable)');
+    if (rejected === null) return blockedDespiteAssertions('the sub-run attestation seam answered accept but not reject — the no-merge-on-reject rule is unobserved');
     expect(
       rejected.merged,
       req('openwop.it.subrun-approval-gate.accept-merges-the-child-outputs-reject-does-not', 'RFC 0063 §C', 'a `reject` approval MUST NOT merge the child outputs'),

package/src/scenarios/subworkflow-input-mapping.test.ts

@@ -24,7 +24,7 @@ import { pollUntilTerminal, pollUntilStatus } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { setHostCapability, resetHostCapabilities, isToggleAvailable } from '../lib/host-toggle.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const PARENT = 'conformance-subworkflow-input-mapping';
 const CHILD = 'conformance-subworkflow-input-mapping-child';
@@ -102,7 +102,7 @@ describe.skipIf(SKIP)('subworkflow-input-mapping: parent → child variable seed
     const subwfCompleted = events.find(
       (e) => e.type === 'node.completed' && e.nodeId === 'subwf-call',
     );
-    if (!subwfCompleted) return softSkip('blocked', 'precondition not met — `!subwfCompleted` returned early (seam, prior step, or fixture unavailable)');
+    if (!subwfCompleted) return blockedDespiteAssertions('the advertised fixture\'s parent run has no node.completed for subwf-call — the unset-variable projection is unobserved');
     const childRunId = subwfCompleted.payload?.outputs?.childRunId;
 
     const childRes = await driver.get(`/v1/runs/${encodeURIComponent(childRunId!)}`);

package/src/scenarios/tool-catalog-projection.test.ts

@@ -84,13 +84,6 @@ describe('tool-catalog-projection (RFC 0078 §B/§F)', () => {
     if (!(await toolCatalogGate('openwop-tool-catalog'))) return;
     const validate = descriptorValidator();
 
-    // ---- Leg 3: auth-gated (unauthenticated list MUST be 401) -------------
-    const unauth = await driver.get(toolsPath(), { authenticated: false });
-    expect(
-      unauth.status === 401,
-      req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', `GET ${toolsPath()} MUST require authentication (401 unauthenticated)`),
-    ).toBe(true);
-
     // ---- Leg 1: the list (§B) -------------------------------------------
     // unfailable-leg audit wave 2, 2026-09-27: a host that ADVERTISES the
     // catalog but 404s the list (or answers 500 / a non-list 200, which the
@@ -99,7 +92,17 @@ describe('tool-catalog-projection (RFC 0078 §B/§F)', () => {
     // fails under OPENWOP_REQUIRE_BEHAVIOR=true), and any other non-200 or
     // non-list body FAILS.
     const read = await listTools();
+    // The unserved check runs before any assertion: after the 401 assertion below,
+    // seamAbsent's `blocked` note recorded a partial-witness pass at major 1.
     if (read.unserved) return seamAbsent(`host advertises toolCatalog but ${toolsPath()} answered ${read.status}`);
+
+    // ---- Leg 3: auth-gated (unauthenticated list MUST be 401) -------------
+    const unauth = await driver.get(toolsPath(), { authenticated: false });
+    expect(
+      unauth.status === 401,
+      req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', `GET ${toolsPath()} MUST require authentication (401 unauthenticated)`),
+    ).toBe(true);
+
     expect(
       read.status,
       req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', `GET ${toolsPath()} MUST return 200 to an authenticated caller on a host advertising toolCatalog`),

package/src/scenarios/tool-session-lifecycle.test.ts

@@ -50,7 +50,7 @@ describe('tool-session-lifecycle (RFC 0078 §D)', () => {
       opened.length >= 1 && closed.length >= 1,
       req('openwop.it.tool-session-lifecycle.brackets-the-call-events-with-tool-session-opened-first-closed-last-one-sessioni', 'tool-catalog.md §D', 'a tool session MUST emit tool.session.opened + tool.session.closed'),
     ).toBe(true);
-    if (opened.length === 0 || closed.length === 0) return softSkip('blocked', 'precondition not met — `opened.length === 0 || closed.length === 0` returned early (seam, prior step, or fixture unavailable)');
+    if (opened.length === 0 || closed.length === 0) throw new Error('unreachable: the assertion above has already failed this leg');
 
     const open = opened[0]!;
     const close = closed[closed.length - 1]!;

package/src/scenarios/trigger-ingestion.test.ts

@@ -48,7 +48,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 
@@ -213,7 +213,7 @@ describe.skipIf(HTTP_SKIP)('trigger-ingestion: behavioral ingestion + SSRF (capa
       verification: { mode: 'none' },
       webhook: { method: 'POST', headers: { Authorization: 'Bearer canary' }, body: { x: 1 } },
     });
-    if (del.status === 404 || del.status === 403) return softSkip('blocked', 'precondition not met — `del.status === 404 || del.status === 403` returned early (seam, prior step, or fixture unavailable)');
+    if (del.status === 404 || del.status === 403) return blockedDespiteAssertions('the ingest seam answered the SSRF probe but not the webhook delivery — ingestion content redaction is unobserved');
     const delBody = del.json as
       | { deliveryEvent?: Record<string, unknown>; triggerEvent?: { webhook?: { headers?: Record<string, string> } } }
       | undefined;

package/src/scenarios/v2-a2ui-v09-surface.test.ts

@@ -306,3 +306,18 @@ describe('RFC 0209 §C.9 — no render before root (declared unwitnessable here;
     return softSkip('inapplicable', 'unwitnessable by this suite (RFC 0209 §C.9 Falsifiability verdict): a render-side guarantee, and a server-oriented suite cannot observe a renderer. The fold guard the server CAN observe is openwop.requirement.0209.fold-guarded, above. The render half is witnessed as a reference-app client probe (tier: reference-impl, the a2ui-surface-no-code-exec precedent): openwop/openwop-app frontend/react/src/chat/a2ui/__tests__/a2ui-v09-render-needs-root.test.tsx (openwop-app#4121, ADR 0749). Removing the `if (!state.renderable)` guard in frontend/react/src/chat/a2ui/v09/A2uiV09Surface.tsx turns 2 of its 4 cases red. This row records that the suite reached the requirement, and it is not a pass.');
   });
 });
+
+describe('RFC 0220 §C — the a2uiSurface family witness (seam-gated)', () => {
+  it('a version-2 surface is admitted and a version-1 body under schema version 2 is refused, in the same run', async () => {
+    const g = await gate((f) => f >= 2, 'a floor of at least 2');
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const { runId } = g.ctx;
+    const R = (why: string) => req('openwop.family.a2uiSurface', 'spec/v2/ext/a2uiSurface/README.md §Conformance', why);
+    try {
+      const good = await emit(runId, envelope(2, v2(sid('fam-good'), (POSITIVE['messages'] as Json[]))));
+      expect(good.status, R(`the positive version-2 surface MUST be admitted (201), got ${code(good)}`)).toBe(201);
+      const mixed = await emit(runId, envelope(2, V1_SURFACE));
+      expect(code(mixed), R('a version-1 body under schema version 2 MUST be refused with envelope_invalid (control: a host that admits everything fails here)')).toBe('422 envelope_invalid');
+    } finally { await done(runId); }
+  });
+});