@openwop/openwop-conformance 2.42.9 → 2.43.0

package/src/scenarios/byok-roundtrip.test.ts

@@ -6,12 +6,23 @@
  * asserts credentialRefs DO resolve and DO get used (positive test) —
  * with redaction-safe verification via SHA-256 hashing.
  *
- * Both scenarios skip trivially-pass when the host returns 404/422 from
- * the start-run call (production deployments don't advertise the
- * fixture surface). Hosts that opt into `OPENWOP_CONFORMANCE_FIXTURES=1`
+ * This is a FLOOR scenario (`openwop.floor.byok-roundtrip`), so a host that
+ * cannot run it has NOT witnessed the floor. When the canary fixture is not
+ * advertised, or the start-run call answers 404/422, every test records
+ * `blocked` with the reason — never a trivial pass. A production posture that
+ * keeps the `conformance.secret.echo` seam off therefore leaves its claimed
+ * `openwop-secrets` profile uncertified, and only that profile: the cut's
+ * other claims still certify. Hosts that opt into `OPENWOP_CONFORMANCE_FIXTURES=1`
  * AND pre-provision a secret under `openwop-conformance-canary-secret`
  * expose the surface and the scenarios run end-to-end.
  *
+ * Why not `describe.skipIf`: a file whose tests are all skipped WITHOUT a
+ * recorded reason is an unclassified return (RFC 0148 §A), and an
+ * unclassified FLOOR row in a claimed profile rejects the whole
+ * certification, not just that profile. Measured on openwop-app's
+ * 2026-09-28 post-deploy major-1 cut: 2,116 rows, `certified: none`, the
+ * only unclassified row being this file.
+ *
  * The scenarios assert shape + non-empty + redaction, not exact value
  * equality — any host-defined canary value works as long as it's
  * non-empty and the host's `secrets.resolve` returns it intact.
@@ -34,17 +45,18 @@ const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
 
 const BYOK_WORKFLOW_ID = 'openwop-smoke-byok-roundtrip';
 const SKIP_NO_FIXTURE = !isFixtureAdvertised(BYOK_WORKFLOW_ID);
+const NO_FIXTURE_REASON = `precondition not met — the \`${BYOK_WORKFLOW_ID}\` fixture is not advertised, so this host cannot witness the BYOK roundtrip floor (the \`conformance.secret.echo\` seam and the \`openwop-conformance-canary-secret\` canary are off)`;
 
-describe.skipIf(SKIP_NO_FIXTURE)('byok: end-to-end credentialRef resolution roundtrip (openwop-byok profile)', () => {
+describe('byok: end-to-end credentialRef resolution roundtrip (openwop-byok profile)', () => {
   it('the canary fixture run MUST resolve a host-provisioned secret and emit SHA-256 hex', async () => {
+    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });
 
-    // Fixture absent OR canary not provisioned — host doesn't opt in.
-    // Scenario passes trivially.
+    // Fixture absent OR canary not provisioned: the floor is not witnessed.
     if (create.status === 404 || create.status === 422) {
-      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `create.status === 404 || create.status === 422` returned early (Fixture absent OR canary not provisioned — host doesn\'t opt in. Scenario passes trivially.)');
+      return softSkip('blocked', 'precondition not met — `create.status === 404 || create.status === 422` returned early (fixture advertised but the run could not start: canary not provisioned or seam unavailable)');
     }
 
     expect(create.status, req('openwop.it.byok-roundtrip.the-canary-fixture-run-must-resolve-a-host-provisioned-secret-and-emit-sha-256-h', 
@@ -102,6 +114,7 @@ describe.skipIf(SKIP_NO_FIXTURE)('byok: end-to-end credentialRef resolution roun
   });
 
   it('BYOK fixture run MUST emit a node.completed event for the resolve step', async () => {
+    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });
@@ -128,6 +141,7 @@ describe.skipIf(SKIP_NO_FIXTURE)('byok: end-to-end credentialRef resolution roun
   });
 
   it('BYOK fixture run event log MUST NOT echo the resolved secret value (redaction)', async () => {
+    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });

package/src/scenarios/v2-approval-reject-disposition.test.ts

@@ -0,0 +1,162 @@
+/**
+ * RFC 0223 — a rejected approval gate fails closed, and the failure is
+ * routable (`spec/v2/core/interrupt.md` §Rejection; suite 2.43.0, target
+ * major 2; gated on the `interrupt` family).
+ *
+ * Legs:
+ *   1. `conformance-approval` (one gate, no edges) resolved `reject` ⇒ the run
+ *      terminates `failed`, and both the snapshot `error.code` and
+ *      `run.failed.error.code` are `approval_rejected`;
+ *   2. the same run's `interrupt.resolved` records `action: "reject"` and
+ *      `decision: "rejected"` (the `action` half is interrupt.md §Events, RFC
+ *      0183; RFC 0223 names both for a reject);
+ *   3. the gate's `node.failed` carries `approval_rejected` with
+ *      `retryable: false`, and `run.failed.failedNodeId` names the gate;
+ *   4. `conformance-interrupt-quorum` (requiredApprovals 3, `majority`): one
+ *      reject leaves the run `waiting-approval`; a second decides the gate and
+ *      the run terminates `failed` with `approval_rejected`.
+ *
+ * The legs are separate rows so a host that misses one field fails that row
+ * only. The timeout disposition is not tested: no registered fixture carries a
+ * gate with a short `timeoutMs`, and the suite cannot make a host's timer fire.
+ * The routed case (an `all_complete` / `any_failed` edge) is not tested either:
+ * `conformance-approval` has no edges, and widening a fixture every host serves
+ * would force a re-registration (fixtures.md §conformance-approval-refine).
+ *
+ * The quorum leg presents distinct votes on one bearer through the resume
+ * value's `voter` member, as `interrupt-quorum-resolution` does at major 1. A
+ * host that counts both votes as one principal cannot be driven to a majority
+ * this way; that records `blocked`, not a failure.
+ *
+ * @see spec/v2/core/interrupt.md §Rejection
+ * @see spec/v2/errors.json approval_rejected
+ * @see RFCS/0223-approval-reject-disposition.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { gateFamily } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/interrupt.md §Rejection (RFC 0223)';
+const R = (slug: string): string => `openwop.requirement.0223.${slug}`;
+const FIXTURE = 'conformance-approval';
+const QUORUM = 'conformance-interrupt-quorum';
+const NODE_ID = 'gate';
+const CODE = 'approval_rejected';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+interface Ev { type?: string; nodeId?: string; payload?: Record<string, unknown> }
+
+const enc = (id: string): string => encodeURIComponent(id);
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
+
+async function snapshot(runId: string): Promise<Record<string, unknown> | null> {
+  const res = await http(() => driver.get(`/runs/${enc(runId)}`));
+  return res?.status === 200 && res.json && typeof res.json === 'object' ? (res.json as Record<string, unknown>) : null;
+}
+async function waitStatus(runId: string, wanted: ReadonlySet<string>, timeoutMs: number): Promise<Record<string, unknown> | null> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const s = await snapshot(runId);
+    if (s !== null && wanted.has(String(s['status']))) return s;
+    if (Date.now() > deadline) return s;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+}
+async function events(runId: string): Promise<Ev[]> {
+  const res = await http(() => driver.get(`/runs/${enc(runId)}/events/poll?timeout=1`));
+  return ((res?.json as { events?: Ev[] } | null)?.events ?? []);
+}
+const errorCode = (o: unknown): string | undefined => (o as { code?: unknown } | null | undefined)?.code as string | undefined;
+const resolve = (runId: string, resumeValue: unknown): Promise<OpenWOPResponse | null> => http(() => driver.post(`/runs/${enc(runId)}/interrupts/${enc(NODE_ID)}`, { resumeValue }));
+
+/** Create a run of `fixture` and wait for it to suspend on its gate. */
+async function suspended(fixture: string): Promise<{ runId: string } | { reason: string }> {
+  const res = await http(() => driver.post('/runs', { workflowId: fixture }));
+  if (res === null) return { reason: 'POST /runs unreachable (fetch failed)' };
+  const runId = (res.json as { runId?: unknown } | null)?.runId;
+  if (res.status !== 201 || typeof runId !== 'string') return { reason: `POST /runs (${fixture}) answered ${res.status} ${readErrorCode(res.json) ?? ''}`.trim() };
+  const s = await waitStatus(runId, new Set(['waiting-approval', ...TERMINAL]), 10_000);
+  if (s?.['status'] !== 'waiting-approval') return { reason: `the ${fixture} run did not suspend on its approval gate (status ${String(s?.['status'])})` };
+  return { runId };
+}
+
+/** One rejected `conformance-approval` run per file: legs 1–3 read the same run. */
+let rejected: Promise<{ runId: string; terminal: Record<string, unknown> | null; evs: Ev[] } | { reason: string }> | undefined;
+function rejectedRun(): Promise<{ runId: string; terminal: Record<string, unknown> | null; evs: Ev[] } | { reason: string }> {
+  rejected ??= (async () => {
+    const s = await suspended(FIXTURE);
+    if ('reason' in s) return s;
+    const res = await resolve(s.runId, { action: 'reject' });
+    if (res === null || res.status < 200 || res.status >= 300) return { reason: `the reject resolve answered ${res?.status ?? 'nothing'} ${readErrorCode(res?.json) ?? ''} — interrupt resolution owns that contract` };
+    const terminal = await waitStatus(s.runId, TERMINAL, 10_000);
+    return { runId: s.runId, terminal, evs: await events(s.runId) };
+  })();
+  return rejected;
+}
+
+describe('RFC 0223 — v2-approval-reject-disposition (gated on interrupt + conformance-approval)', () => {
+  it('a rejected gate with no routing edge fails the run with approval_rejected', async () => {
+    if (!(await gateFamily('interrupt'))) return softSkip('inapplicable', 'interrupt family not advertised (gate recorded under openwop.family.interrupt)');
+    const r = await rejectedRun();
+    if ('reason' in r) return softSkip('blocked', r.reason);
+    const id = R('reject-fails-run');
+    expect(r.terminal?.['status'], req(id, DOC, `with no edge admitting a failed source the run MUST terminate failed (got ${String(r.terminal?.['status'])})`)).toBe('failed');
+    expect(errorCode(r.terminal?.['error']), req(id, `${DOC}; runs.md §Snapshot`, 'the terminal snapshot error.code MUST be approval_rejected')).toBe(CODE);
+    const failed = r.evs.find((e) => e.type === 'run.failed');
+    expect(errorCode(failed?.payload?.['error']), req(id, DOC, 'run.failed.error.code MUST be approval_rejected')).toBe(CODE);
+  }, 45_000);
+
+  it('interrupt.resolved records action reject and decision rejected', async () => {
+    if (!(await gateFamily('interrupt'))) return softSkip('inapplicable', 'interrupt family not advertised (gate recorded under openwop.family.interrupt)');
+    const r = await rejectedRun();
+    if ('reason' in r) return softSkip('blocked', r.reason);
+    const id = R('reject-recorded');
+    const resolved = r.evs.find((e) => e.type === 'interrupt.resolved');
+    expect(resolved, req(id, `${DOC}; interrupt.md §Events`, 'the reject MUST be recorded as interrupt.resolved')).toBeDefined();
+    expect(
+      { action: resolved?.payload?.['action'], decision: resolved?.payload?.['decision'] },
+      req(id, `${DOC}; interrupt.md §Events (RFC 0183)`, 'interrupt.resolved MUST carry action "reject" and decision "rejected"'),
+    ).toEqual({ action: 'reject', decision: 'rejected' });
+  }, 45_000);
+
+  it('the gate node fails with approval_rejected, not retryable, and run.failed names it', async () => {
+    if (!(await gateFamily('interrupt'))) return softSkip('inapplicable', 'interrupt family not advertised (gate recorded under openwop.family.interrupt)');
+    const r = await rejectedRun();
+    if ('reason' in r) return softSkip('blocked', r.reason);
+    const id = R('reject-fails-node');
+    const nodeFailed = r.evs.find((e) => e.type === 'node.failed' && (e.payload?.['nodeId'] ?? e.nodeId) === NODE_ID);
+    expect(nodeFailed, req(id, DOC, 'the gate that does not turn the rejection into an output MUST emit node.failed')).toBeDefined();
+    const err = nodeFailed?.payload?.['error'] as { code?: unknown; retryable?: unknown } | undefined;
+    expect({ code: err?.code, retryable: err?.retryable }, req(id, DOC, 'node.failed.error MUST carry code approval_rejected and retryable false')).toEqual({ code: CODE, retryable: false });
+    const runFailed = r.evs.find((e) => e.type === 'run.failed');
+    expect(runFailed?.payload?.['failedNodeId'], req(id, DOC, 'run.failed.failedNodeId MUST name the gate')).toBe(NODE_ID);
+  }, 45_000);
+
+  it('a majority reject decides the quorum gate on the deciding vote and fails the run with approval_rejected', async () => {
+    if (!(await gateFamily('interrupt'))) return softSkip('inapplicable', 'interrupt family not advertised (gate recorded under openwop.family.interrupt)');
+    if (!isFixtureAdvertised(QUORUM)) return softSkip('inapplicable', `fixture ${QUORUM} is not advertised — the host does not claim the quorum fixture`);
+    const s = await suspended(QUORUM);
+    if ('reason' in s) return softSkip('blocked', s.reason);
+    const id = R('quorum-reject-fails-run');
+    const first = await resolve(s.runId, { action: 'reject', voter: 'approver-1' });
+    if (first === null || first.status < 200 || first.status >= 300) return softSkip('blocked', `the first reject vote answered ${first?.status ?? 'nothing'} ${readErrorCode(first?.json) ?? ''}`);
+    const between = (await snapshot(s.runId))?.['status'];
+    const resolvedEarly = (await events(s.runId)).some((e) => e.type === 'interrupt.resolved');
+    const second = await resolve(s.runId, { action: 'reject', voter: 'approver-2' });
+    if (second === null || second.status < 200 || second.status >= 300) return softSkip('blocked', `the second reject vote answered ${second?.status ?? 'nothing'} ${readErrorCode(second?.json) ?? ''}`);
+    const terminal = await waitStatus(s.runId, TERMINAL, 10_000);
+    if (between === 'waiting-approval' && terminal?.['status'] === 'waiting-approval') {
+      await http(() => driver.post(`/runs/${enc(s.runId)}/cancel`, {}));
+      return softSkip('blocked', 'the host counted both votes as one approver (one bearer; the resume value\'s voter was not honoured), so a majority could not be caused');
+    }
+    expect(between, req(id, DOC, 'one reject of three under majority does not decide the gate: the run MUST stay waiting-approval')).toBe('waiting-approval');
+    expect(resolvedEarly, req(id, DOC, 'a vote that does not decide the gate MUST NOT emit interrupt.resolved')).toBe(false);
+    expect(terminal?.['status'], req(id, DOC, `two rejects of three under majority MUST resolve the gate rejected and fail the run (got ${String(terminal?.['status'])})`)).toBe('failed');
+    expect(errorCode(terminal?.['error']), req(id, DOC, 'the terminal snapshot error.code MUST be approval_rejected')).toBe(CODE);
+  }, 60_000);
+});

package/src/scenarios/v2-registry-lifecycle.test.ts

@@ -0,0 +1,232 @@
+/**
+ * RFC 0222 — v2 registry lifecycle and signing keys, witnessed against a
+ * registry (`spec/v2/core/packs.md` §"Version manifests" and §Signing; suite
+ * 2.43.0, target major 2).
+ *
+ * This scenario reads a REGISTRY, not the host under test. It runs only when
+ * one is named: `OPENWOP_REGISTRY_URL=<origin>` (a mirror, a vendor registry,
+ * or `node registry/scripts/serve.mjs` in openwop-registry), or
+ * `OPENWOP_TEST_PUBLIC_REGISTRY=true` for `https://packs.openwop.dev`. With
+ * neither it records `inapplicable`, like `registry-public.test.ts`: a host
+ * conformance run MUST NOT need outbound access to a registry. It is a major-2
+ * file, so it runs in a major-2 lane (`OPENWOP_TARGET_MAJOR=2`).
+ *
+ * Every path is resolved through `.well-known/openwop-registry` `endpoints.v2`
+ * (packs.md §"The registry tree"), never constructed.
+ *
+ * How it FAILS:
+ *   - a per-pack index names a yanked version `latest` while the pack has one
+ *     that is not yanked, or disagrees with the version manifest's `yanked` /
+ *     `versionDeprecated`, or the registry-wide row disagrees with it;
+ *   - a yanked version's manifest, tarball or signature is no longer served;
+ *   - a served version names a key that `signingKeys[]` no longer lists, or one
+ *     whose `permittedNamespaces` does not admit the pack, or whose signature
+ *     does not verify. A key that is no longer `active` still verifies what it
+ *     signed; the scenario refuses only a key that disappeared.
+ *
+ * @see spec/v2/core/packs.md §"Version manifests", §Signing
+ * @see RFCS/0222-v2-registry-operations.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { gunzipSync } from 'node:zlib';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
+
+type Json = Record<string, unknown>;
+
+const ID_YANK = 'openwop.requirement.0222.yanked-version-lifecycle';
+const ID_KEYS = 'openwop.requirement.0222.signing-keys-cover-served-versions';
+const SPEC_VM = 'RFC 0222 · packs.md §"Version manifests"';
+const SPEC_SIG = 'RFC 0222 · packs.md §Signing';
+
+const BASE = (process.env['OPENWOP_REGISTRY_URL'] ?? (process.env['OPENWOP_TEST_PUBLIC_REGISTRY'] === 'true' ? 'https://packs.openwop.dev' : '')).replace(/\/+$/, '');
+const NO_REGISTRY = 'no registry named — set OPENWOP_REGISTRY_URL (or OPENWOP_TEST_PUBLIC_REGISTRY=true for packs.openwop.dev); a host run does not read a registry';
+
+async function fetchWithRetry(url: string): Promise<Response> {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await fetch(url, { headers: { Accept: 'application/json, */*' } });
+    } catch (err) {
+      if (attempt >= 2) throw err;
+      await new Promise((r) => setTimeout(r, 250 * (attempt + 1)));
+    }
+  }
+}
+
+async function getJson(path: string): Promise<{ status: number; json: Json | null }> {
+  const res = await fetchWithRetry(`${BASE}${path}`);
+  if (res.status !== 200) return { status: res.status, json: null };
+  try {
+    return { status: 200, json: (await res.json()) as Json };
+  } catch {
+    return { status: 200, json: null };
+  }
+}
+
+async function getBytes(path: string): Promise<{ status: number; bytes: Buffer }> {
+  const res = await fetchWithRetry(`${BASE}${path}`);
+  return { status: res.status, bytes: Buffer.from(await res.arrayBuffer()) };
+}
+
+/** Run `fn` over `items`, `width` at a time. */
+async function pool<T, R>(items: readonly T[], width: number, fn: (t: T) => Promise<R>): Promise<R[]> {
+  const out: R[] = new Array(items.length);
+  let next = 0;
+  await Promise.all(Array.from({ length: Math.min(width, items.length) }, async () => {
+    for (let i = next++; i < items.length; i = next++) out[i] = await fn(items[i]!);
+  }));
+  return out;
+}
+
+/** The exact bytes of `pack.json` inside a gzipped USTAR tarball (what a v2 signature covers). */
+function packJsonBytes(tgz: Buffer): Buffer | null {
+  const tar = gunzipSync(tgz);
+  for (let off = 0; off + 512 <= tar.length; ) {
+    const nameBuf = tar.subarray(off, off + 100);
+    const end = nameBuf.indexOf(0);
+    const name = nameBuf.subarray(0, end < 0 ? 100 : end).toString('utf8');
+    if (!name) return null;
+    const size = parseInt(tar.subarray(off + 124, off + 136).toString('ascii').replace(/\0/g, '').trim() || '0', 8);
+    if (name === 'pack.json' || name === './pack.json' || name === 'package/pack.json') return tar.subarray(off + 512, off + 512 + size);
+    off += 512 + Math.ceil(size / 512) * 512;
+  }
+  return null;
+}
+
+function fill(template: string, name: string, version?: string): string {
+  return template.replace('{name}', name).replace('{version}', version ?? '');
+}
+
+interface Registry {
+  readonly discovery: Json;
+  readonly v2: Record<string, string>;
+  readonly packs: Json[];
+}
+
+let cached: Promise<Registry | string> | null = null;
+
+/** Discovery + the v2 index, or the reason the registry is unreadable (an assertion failure, not a skip). */
+function registry(): Promise<Registry | string> {
+  cached ??= (async () => {
+    const wk = await getJson('/.well-known/openwop-registry');
+    if (!wk.json) return `GET /.well-known/openwop-registry answered ${wk.status} without a JSON document`;
+    const endpoints = (wk.json['endpoints'] ?? {}) as Json;
+    const v2 = endpoints['v2'] as Record<string, string> | undefined;
+    if (!v2 || typeof v2['registryIndex'] !== 'string' || typeof v2['packMetadata'] !== 'string' || typeof v2['versionManifest'] !== 'string') {
+      return 'the discovery document has no endpoints.v2 {registryIndex, packMetadata, versionManifest}';
+    }
+    const idx = await getJson(v2['registryIndex']);
+    if (!idx.json || !Array.isArray(idx.json['packs'])) return `GET ${v2['registryIndex']} answered ${idx.status} without a packs[] index`;
+    return { discovery: wk.json, v2, packs: idx.json['packs'] as Json[] };
+  })();
+  return cached;
+}
+
+interface Version { readonly pack: string; readonly version: string; readonly manifest: Json }
+
+describe('RFC 0222 — v2 registry lifecycle and signing keys', () => {
+  it('a yanked version is never latest while an unyanked one exists, the flags agree across index and manifest, and a yanked version stays served', async () => {
+    if (!BASE) return softSkip('inapplicable', NO_REGISTRY);
+    const reg = await registry();
+    expect(typeof reg, req(ID_YANK, SPEC_VM, `the registry MUST serve a v2 index through endpoints.v2 — ${typeof reg === 'string' ? reg : ''}`)).toBe('object');
+    if (typeof reg === 'string') throw new Error(reg);
+
+    const problems: string[] = [];
+    const yanked: Version[] = [];
+    await pool(reg.packs, 8, async (row) => {
+      const name = String(row['name']);
+      const meta = await getJson(fill(reg.v2['packMetadata']!, name));
+      if (!meta.json) { problems.push(`${name}: pack metadata answered ${meta.status}`); return; }
+      const versions = (Array.isArray(meta.json['versions']) ? meta.json['versions'] : []) as Json[];
+      const unyanked = versions.filter((v) => v['yanked'] !== true).map((v) => String(v['version']));
+      const latest = String(meta.json['latest']);
+      const latestRow = versions.find((v) => v['version'] === latest);
+      if (latestRow?.['yanked'] === true && unyanked.length > 0) problems.push(`${name}: latest ${latest} is yanked while ${unyanked.join(', ')} is not`);
+      if (row['latestVersion'] !== latest) problems.push(`${name}: registry index latestVersion ${String(row['latestVersion'])} ≠ pack metadata latest ${latest}`);
+      if (row['yanked'] === true && unyanked.length > 0) problems.push(`${name}: registry index marks the pack yanked while ${unyanked.join(', ')} is not`);
+      for (const v of versions) {
+        const version = String(v['version']);
+        const vm = await getJson(fill(reg.v2['versionManifest']!, name, version));
+        if (!vm.json) { problems.push(`${name}@${version}: version manifest answered ${vm.status}`); continue; }
+        if ((vm.json['yanked'] === true) !== (v['yanked'] === true)) problems.push(`${name}@${version}: index yanked=${String(v['yanked'])} but manifest yanked=${String(vm.json['yanked'])}`);
+        if ((vm.json['versionDeprecated'] === true) !== (v['versionDeprecated'] === true)) problems.push(`${name}@${version}: index versionDeprecated=${String(v['versionDeprecated'])} but manifest versionDeprecated=${String(vm.json['versionDeprecated'])}`);
+        if (vm.json['yanked'] === true) yanked.push({ pack: name, version, manifest: vm.json });
+      }
+    });
+    expect(problems, req(ID_YANK, SPEC_VM, 'the per-pack index MUST NOT name a yanked version latest while an unyanked one exists, and the index MUST agree with each version manifest')).toEqual([]);
+
+    if (yanked.length === 0) {
+      // partial-witness-ok: the index/manifest agreement was asserted over every
+      // version; the served-after-yank half has nothing to observe.
+      return softSkip('inapplicable', 'no version in this v2 tree is yanked — the latest rule held vacuously and there is no yanked version whose files could be checked');
+    }
+    const unserved: string[] = [];
+    await pool(yanked, 8, async ({ pack, version }) => {
+      for (const key of ['versionTarball', 'versionSignature'] as const) {
+        const tmpl = reg.v2[key];
+        if (typeof tmpl !== 'string') { unserved.push(`endpoints.v2.${key} is absent`); continue; }
+        const r = await getBytes(fill(tmpl, pack, version));
+        if (r.status !== 200 || r.bytes.byteLength === 0) unserved.push(`${pack}@${version}: ${key} answered ${r.status}`);
+      }
+    });
+    expect(unserved, req(ID_YANK, SPEC_VM, `the registry MUST keep serving a yanked version's manifest, tarball and signature at their exact paths (${yanked.length} yanked)`)).toEqual([]);
+  });
+
+  it('every served version names a listed key whose permittedNamespaces admit it, and its signature verifies — whatever the key status', async () => {
+    if (!BASE) return softSkip('inapplicable', NO_REGISTRY);
+    const reg = await registry();
+    expect(typeof reg, req(ID_KEYS, SPEC_SIG, `the registry MUST serve a v2 index through endpoints.v2 — ${typeof reg === 'string' ? reg : ''}`)).toBe('object');
+    if (typeof reg === 'string') throw new Error(reg);
+
+    const keys = (Array.isArray(reg.discovery['signingKeys']) ? reg.discovery['signingKeys'] : []) as Json[];
+    const malformed = keys.filter((k) => typeof k['keyId'] !== 'string' || typeof k['publicKeyUrl'] !== 'string' || typeof k['status'] !== 'string' || !Array.isArray(k['permittedNamespaces']));
+    expect(malformed.map((k) => String(k['keyId'])), req(ID_KEYS, SPEC_SIG, 'every signingKeys[] entry MUST carry keyId, publicKeyUrl, status and permittedNamespaces')).toEqual([]);
+    const byId = new Map(keys.map((k) => [String(k['keyId']), k]));
+    const publicKeys = new Map<string, ReturnType<typeof createPublicKey> | null>();
+
+    const permits = (key: Json, name: string): boolean => (key['permittedNamespaces'] as unknown[]).some((p) => {
+      const pat = String(p);
+      return pat.endsWith('.*') ? name.startsWith(pat.slice(0, -1)) : pat === name;
+    });
+
+    const versions: Version[] = [];
+    await pool(reg.packs, 8, async (row) => {
+      const name = String(row['name']);
+      const meta = await getJson(fill(reg.v2['packMetadata']!, name));
+      for (const v of (Array.isArray(meta.json?.['versions']) ? meta.json!['versions'] : []) as Json[]) {
+        const vm = await getJson(fill(reg.v2['versionManifest']!, name, String(v['version'])));
+        if (vm.json) versions.push({ pack: name, version: String(v['version']), manifest: vm.json });
+      }
+    });
+    expect(versions.length, req(ID_KEYS, SPEC_SIG, 'the v2 tree MUST serve at least one version manifest to witness')).toBeGreaterThan(0);
+
+    const problems: string[] = [];
+    const statuses = new Map<string, number>();
+    await pool(versions, 8, async ({ pack, version, manifest }) => {
+      const at = `${pack}@${version}`;
+      const keyId = String((manifest['signing'] as Json | undefined)?.['keyId'] ?? '');
+      const key = byId.get(keyId);
+      if (!key) { problems.push(`${at}: signed by ${keyId || '(no keyId)'}, which signingKeys[] does not list`); return; }
+      if (!permits(key, pack)) { problems.push(`${at}: key ${keyId} does not permit this namespace (${(key['permittedNamespaces'] as unknown[]).join(', ')})`); return; }
+      statuses.set(String(key['status']), (statuses.get(String(key['status'])) ?? 0) + 1);
+      if (!publicKeys.has(keyId)) {
+        const r = await getBytes(String(key['publicKeyUrl']));
+        let pk: ReturnType<typeof createPublicKey> | null = null;
+        try { pk = r.status === 200 ? createPublicKey(r.bytes.toString('utf8')) : null; } catch { pk = null; }
+        publicKeys.set(keyId, pk);
+      }
+      const pk = publicKeys.get(keyId);
+      if (!pk) { problems.push(`${at}: publicKeyUrl for ${keyId} does not serve a public key`); return; }
+      const tgz = await getBytes(fill(reg.v2['versionTarball'] ?? '', pack, version));
+      const sig = await getBytes(fill(reg.v2['versionSignature'] ?? '', pack, version));
+      if (tgz.status !== 200 || sig.status !== 200) { problems.push(`${at}: tarball ${tgz.status}, signature ${sig.status}`); return; }
+      if (typeof manifest['integrity'] === 'string' && manifest['integrity'] !== `sha256-${createHash('sha256').update(tgz.bytes).digest('base64')}`) problems.push(`${at}: integrity does not match the served tarball`);
+      const signed = packJsonBytes(tgz.bytes);
+      if (!signed) { problems.push(`${at}: the tarball has no pack.json`); return; }
+      if (!cryptoVerify(null, signed, pk, sig.bytes)) problems.push(`${at}: the signature does not verify under ${keyId}`);
+    });
+    expect(problems, req(ID_KEYS, SPEC_SIG, `every served version MUST name a listed key permitted for its namespace and verify under it, whatever the key status (${versions.length} versions; key status ${JSON.stringify(Object.fromEntries(statuses))})`)).toEqual([]);
+  });
+});