@openwop/openwop-conformance 2.42.9 → 2.43.1

package/src/scenarios/audit-anomaly-shape.test.ts

@@ -0,0 +1,100 @@
+/**
+ * RFC 0218 §C — an audit anomaly's shape, server-free
+ * (`spec/v1/auth-profiles.md` §"Audit-log integrity" 4).
+ *
+ * A black-box caller cannot tamper with a host's audit log, so an untampered log
+ * serves no anomaly and `audit-log-integrity.test.ts` sees an empty array. This
+ * file holds the shape instead: one sample anomaly of every `kind` validates
+ * against `audit-verify-result.schema.json` (v1 and the derived v2 copy), and the
+ * shapes that must not are refused, the reference hosts' pre-§C
+ * `{ atSequence, kind, detail }` first among them. The host side is the tamper
+ * tests in openwop-examples, which assert every kind's member set.
+ *
+ * Sabotages, each of which turns a leg red: dropping the `checkpoint` conditional
+ * (a `merkle-mismatch` without it validates); dropping the `chain-break`
+ * conditional (a `chain-break` without its hashes validates); dropping the
+ * `else` arms (a mixed entry validates); dropping the root `chainValid`
+ * conditional (a forged-signature report with `chainValid: true` validates);
+ * admitting `atSequence` and dropping `atSeq` from `required` (the hosts' old
+ * hash-mismatch validates).
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
+
+const SPEC = 'RFC 0218 §C · spec/v1/auth-profiles.md §"Audit-log integrity" 4';
+const SHAPE = 'openwop.requirement.0218.anomaly-shape';
+
+const HASH_A = 'a'.repeat(64);
+const HASH_B = 'b'.repeat(64);
+const CHECKPOINT = { checkpoint: 'cp_5', atSequence: 5, merkleRoot: HASH_A, signature: 'c2ln' };
+
+const result = (anomalies: object[], chainValid = anomalies.length === 0): object => ({
+  fromSeq: 1,
+  toSeq: 5,
+  chainValid,
+  checkpoints: [CHECKPOINT],
+  anomalies,
+});
+
+const VALID: Array<[string, object]> = [
+  ['a chain-break with both hashes', { atSeq: 4, kind: 'chain-break', expectedPrevHash: HASH_A, actualPrevHash: HASH_B, detail: 'prev_hash differs' }],
+  ['a chain-break at the genesis entry (null hashes)', { atSeq: 1, kind: 'chain-break', expectedPrevHash: null, actualPrevHash: HASH_B }],
+  ['a legacy entry without kind (a chain-break)', { atSeq: 4, expectedPrevHash: HASH_A, actualPrevHash: '' }],
+  ['a hash-mismatch', { atSeq: 3, kind: 'hash-mismatch', detail: 'recomputed != stored' }],
+  ['a missing-entry', { atSeq: 2, kind: 'missing-entry' }],
+  ['a merkle-mismatch with its checkpoint', { atSeq: 5, kind: 'merkle-mismatch', checkpoint: 'cp_5' }],
+  ['a signature-invalid with its checkpoint', { atSeq: 5, kind: 'signature-invalid', checkpoint: 'cp_5', detail: 'does not verify' }],
+];
+
+const INVALID: Array<[string, object]> = [
+  // The reference hosts' pre-§C hash-mismatch, verbatim: wrong only in the
+  // sequence member's name, so nothing but `atSeq` can refuse it.
+  ['`atSequence` for `atSeq` (the reference hosts\' pre-§C shape)', { atSequence: 3, kind: 'hash-mismatch', detail: 'recomputed != stored' }],
+  ['a merkle-mismatch without `checkpoint`', { atSeq: 5, kind: 'merkle-mismatch' }],
+  ['a signature-invalid without `checkpoint`', { atSeq: 5, kind: 'signature-invalid', detail: 'x' }],
+  ['a chain-break without its hashes', { atSeq: 4, kind: 'chain-break', detail: 'x' }],
+  ['a legacy entry without kind or hashes', { atSeq: 4 }],
+  ['a mixed entry: a merkle-mismatch carrying the chain hashes', { atSeq: 5, kind: 'merkle-mismatch', checkpoint: 'cp_5', expectedPrevHash: HASH_A, actualPrevHash: HASH_B }],
+  ['a mixed entry: a chain-break carrying a checkpoint', { atSeq: 4, kind: 'chain-break', expectedPrevHash: HASH_A, actualPrevHash: HASH_B, checkpoint: 'cp_5' }],
+  ['a hash-mismatch carrying a checkpoint', { atSeq: 3, kind: 'hash-mismatch', checkpoint: 'cp_5' }],
+  ['an unknown kind', { atSeq: 3, kind: 'row-rewritten' }],
+];
+
+const SCHEMAS = [['v1', 'audit-verify-result.schema.json'], ['v2', join('v2', 'audit-verify-result.schema.json')]].map(([label, file]) => {
+  const schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, file!), 'utf8')) as object;
+  return { label: label!, validate: new Ajv2020({ strict: false, allErrors: true }).compile(schema) };
+});
+
+describe('RFC 0218 §C — audit anomaly shape (server-free, v1 and v2 schemas)', () => {
+  it('every anomaly kind validates in its own shape', () => {
+    for (const { label, validate } of SCHEMAS) {
+      for (const [name, anomaly] of VALID) {
+        const ok = validate(result([anomaly]));
+        expect(ok, req(SHAPE, SPEC, `${label}: ${name} validates: ${JSON.stringify(validate.errors)}`)).toBe(true);
+      }
+      expect(validate(result([])), req(SHAPE, SPEC, `${label}: an untampered result with no anomaly validates`)).toBe(true);
+    }
+  });
+
+  it('an anomaly outside its kind\'s shape is refused', () => {
+    for (const { label, validate } of SCHEMAS) {
+      for (const [name, anomaly] of INVALID) {
+        expect(validate(result([anomaly])), req(SHAPE, SPEC, `${label}: ${name} is refused`)).toBe(false);
+      }
+    }
+  });
+
+  it('chainValid is false exactly when anomalies is non-empty', () => {
+    const forged = { atSeq: 5, kind: 'signature-invalid', checkpoint: 'cp_5' };
+    for (const { label, validate } of SCHEMAS) {
+      expect(validate(result([forged], true)), req(SHAPE, SPEC, `${label}: chainValid: true beside a signature-invalid anomaly is refused`)).toBe(false);
+      expect(validate(result([], false)), req(SHAPE, SPEC, `${label}: chainValid: false with no anomaly is refused`)).toBe(false);
+      expect(validate(result([forged], false)), req(SHAPE, SPEC, `${label}: chainValid: false beside the anomaly validates`)).toBe(true);
+    }
+  });
+});

package/src/scenarios/audit-checkpoint-signature.test.ts

@@ -2,8 +2,10 @@
  * RFC 0218 — a host's audit checkpoints are signed over their Merkle root
  * (`spec/v1/auth-profiles.md` §"Audit-log integrity" 3).
  *
- * Gated on the `openwop-audit-log-integrity` profile. Every checkpoint
- * `GET /v1/audit/verify` returns MUST verify under the advertised
+ * Gated on the `openwop-audit-log-integrity` profile at major 1 and on the
+ * `auditLogIntegrity` family at major 2 (RFC 0224; spec/v2/core/
+ * security-defaults.md §Audit-log integrity). Every checkpoint
+ * `GET /v1/audit/verify` (major 2: `GET /audit/verify`) returns MUST verify under the advertised
  * `checkpointPublicKey` as Ed25519 over its hex-decoded `merkleRoot`. The root
  * itself cannot be recomputed from outside (the entries are not on the wire),
  * so the black box witnesses the signature half only. The root half belongs to
@@ -15,38 +17,35 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
-import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { checkpointPublicKey, verifyCheckpointSignature } from '../lib/audit-checkpoint.js';
+import { auditClaimName, auditIntegrityAdvert, auditVerifyPath } from '../lib/auditIntegrity.js';
 
-const SPEC = 'RFC 0218 · spec/v1/auth-profiles.md §"Audit-log integrity" 3';
+const SPEC = 'RFC 0218 · spec/v1/auth-profiles.md §"Audit-log integrity" 3; spec/v2/core/security-defaults.md §"Audit-log integrity" (RFC 0224)';
 const SIGNED = 'openwop.requirement.0218.checkpoint-signature-over-root';
 
-interface AuditIntegrityCaps { checkpointPublicKey?: string }
-interface AuthCaps { profiles?: string[]; auditLogIntegrity?: AuditIntegrityCaps }
-
 describe('RFC 0218 — a host\'s checkpoints are signed over their root', () => {
   it('every checkpoint GET /v1/audit/verify returns verifies under the advertised key', async () => {
-    const disco = await driver.get('/.well-known/openwop');
-    const auth = capabilityFamily<AuthCaps>(disco.json, 'auth') ?? {};
-    if (!(Array.isArray(auth.profiles) && auth.profiles.includes('openwop-audit-log-integrity'))) {
-      return softSkip('inapplicable', 'the host does not claim openwop-audit-log-integrity');
+    const integrity = await auditIntegrityAdvert();
+    if (integrity === null) {
+      return softSkip('inapplicable', `the host does not claim ${auditClaimName()}`);
     }
-    const advertised = auth.auditLogIntegrity?.checkpointPublicKey;
+    const advertised = integrity.checkpointPublicKey;
     if (typeof advertised !== 'string' || advertised.length === 0) {
       // A claimed profile without its key is the profile-shape leg's failure
       // (audit-log-integrity.test.ts); this row cannot be observed without it.
-      return softSkip('blocked', 'the host claims the profile but advertises no auditLogIntegrity.checkpointPublicKey');
+      return softSkip('blocked', `the host claims ${auditClaimName()} but advertises no auditLogIntegrity.checkpointPublicKey`);
     }
     let key;
     try { key = checkpointPublicKey(advertised); } catch (e) {
       return softSkip('blocked', `auditLogIntegrity.checkpointPublicKey is not an Ed25519 SPKI key: ${(e as Error).message}`);
     }
 
-    const verify = await driver.get('/v1/audit/verify?fromSeq=0&toSeq=1000000');
+    const path = auditVerifyPath(0, 1_000_000);
+    const verify = await driver.get(path);
     if (verify.status !== 200) {
-      return softSkip('blocked', `GET /v1/audit/verify answered ${verify.status}; the verify leg of audit-log-integrity owns that contract`);
+      return softSkip('blocked', `GET ${path.split('?')[0]} answered ${verify.status}; the verify leg of audit-log-integrity owns that contract`);
     }
     const checkpoints = ((verify.json as { checkpoints?: Array<{ atSequence?: number; merkleRoot?: string; signature?: string }> }).checkpoints) ?? [];
     if (checkpoints.length === 0) {

package/src/scenarios/audit-log-integrity.test.ts

@@ -1,11 +1,24 @@
 /**
- * Track 13: audit-log integrity profile (auth-profiles.md v1.1).
+ * Track 13: audit-log integrity profile (auth-profiles.md v1.1), and at major 2
+ * the `auditLogIntegrity` family (RFC 0224, spec/v2/core/security-defaults.md
+ * §Audit-log integrity).
  *
- * Verifies that hosts claiming the `openwop-audit-log-integrity` profile:
- *   1. Surface `capabilities.auth.auditLogIntegrity.hashChain: true`.
- *   2. Expose `GET /v1/audit/verify` which returns `{chainValid, checkpoints, anomalies}`.
+ * Verifies that hosts claiming audit-log integrity:
+ *   1. Advertise the facets a verifier needs — at major 1
+ *      `capabilities.auth.auditLogIntegrity.hashChain: true` plus the key; at
+ *      major 2 a record that validates against the generated family schema,
+ *      whose `checkpointPublicKey` is an Ed25519 SPKI key.
+ *   2. Expose `GET /v1/audit/verify` (major 2: `GET /audit/verify`) which
+ *      returns `{chainValid, checkpoints, anomalies}`.
  *   3. Report `chainValid: true` for an unmodified range.
  *   4. Surface at least one signed checkpoint with a non-empty `signature`.
+ *   5. List checkpoints ascending, no more than `checkpointIntervalEntries`
+ *      apart (RFC 0224 §A.3). A host that omits a checkpoint from the verify
+ *      body leaves a gap the advertised cadence forbids.
+ *
+ * Major 1 gates through behaviorGate (strict mode fails an unadvertised
+ * profile). Major 2 records `inapplicable` before any assertion when the
+ * family is absent — presence of the record is the claim.
  *
  * Tamper detection (mutating an entry then asserting `chainValid: false`)
  * requires admin access to the host's audit store and is NOT exercised
@@ -13,14 +26,18 @@
  * test for tamper detection — see auth-profiles.md.
  *
  * @see spec/v1/auth-profiles.md §"Audit-log integrity"
+ * @see spec/v2/core/security-defaults.md §"Audit-log integrity"
  */
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
-import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip } from '../lib/soft-skip.js';
+import { targetMajor } from '../lib/seams.js';
+import { v2RefValidator, v2Validator } from '../lib/v2.js';
+import { checkpointPublicKey } from '../lib/audit-checkpoint.js';
+import { AUDIT_PROFILE, auditClaimName, auditIntegrityAdvert, auditVerifyPath, type AuditIntegrityCaps } from '../lib/auditIntegrity.js';
 import Ajv2020 from 'ajv/dist/2020.js';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -31,67 +48,77 @@ import { SCHEMAS_DIR } from '../lib/paths.js';
  * is enforced. (Until 2026-09-27 the suite stripped them because the reference
  * postgres/sqlite hosts emitted a per-checkpoint `verified` bit the schema does
  * not name; the hosts now keep that bit host-internal. The aggregate verdict is
- * the schema's OPTIONAL `checkpointsValid`.)
+ * the schema's OPTIONAL `checkpointsValid`.) Major 2 validates against the v2 copy.
  */
 const VERIFY_RESULT_SCHEMA = JSON.parse(
   readFileSync(join(SCHEMAS_DIR, 'audit-verify-result.schema.json'), 'utf8'),
 ) as Record<string, unknown>;
 
-interface AuditIntegrityCaps {
-  hashChain?: boolean;
-  checkpointSignatureAlgorithm?: string;
-  checkpointPublicKey?: string;
-  checkpointIntervalEntries?: number;
-  checkpointIntervalSeconds?: number;
-}
+const CADENCE = 'openwop.requirement.0224.checkpoint-cadence';
 
-interface AuthCaps {
-  profiles?: string[];
-  auditLogIntegrity?: AuditIntegrityCaps;
+/**
+ * The gate, per major. Major 1: behaviorGate on the profile (unchanged). Major 2:
+ * the family record or null. A null is recorded `inapplicable` by the caller
+ * before any assertion (`unclaimed()`).
+ */
+async function gate(): Promise<AuditIntegrityCaps | null> {
+  const caps = await auditIntegrityAdvert();
+  if (targetMajor() === 2) return caps;
+  return behaviorGate(AUDIT_PROFILE, caps !== null) ? caps : null;
 }
 
-async function isProfileAdvertised(): Promise<boolean> {
-  const disco = await driver.get('/.well-known/openwop');
-  const auth = capabilityFamily<AuthCaps>(disco.json, 'auth') ?? {};
-  return Array.isArray(auth.profiles) && auth.profiles.includes('openwop-audit-log-integrity');
+const unclaimed = (): undefined => softSkip('inapplicable', `the host does not claim ${auditClaimName()} at major ${targetMajor()}`);
+
+function validateVerifyBody(body: unknown): { ok: boolean; errors: string } {
+  if (targetMajor() === 2) return v2Validator('audit-verify-result')(body);
+  const validate = new Ajv2020({ strict: false, allErrors: true }).compile(VERIFY_RESULT_SCHEMA);
+  const ok = validate(body) as boolean;
+  return { ok, errors: JSON.stringify(validate.errors ?? []) };
 }
 
 describe('audit-log-integrity: profile shape', () => {
   it('host that claims the profile advertises required capability fields', async () => {
-    if (!behaviorGate('openwop-audit-log-integrity', await isProfileAdvertised())) {
-      return;
-    }
-
-    const disco = await driver.get('/.well-known/openwop');
-    const integrity =
-      capabilityFamily<AuthCaps>(disco.json, 'auth')
-        ?.auditLogIntegrity ?? {};
+    const integrity = await gate();
+    if (integrity === null) return unclaimed();
 
-    expect(integrity.hashChain, req('openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields', 
-      'auth-profiles.md §"Audit-log integrity"',
-      "openwop-audit-log-integrity profile MUST advertise auditLogIntegrity.hashChain: true",
-    )).toBe(true);
-    expect(integrity.checkpointSignatureAlgorithm, req('openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields', 
-      'auth-profiles.md §"Audit-log integrity" §"Key management"',
-      'checkpointSignatureAlgorithm MUST be present (canonical: ed25519)',
-    )).toBeDefined();
-    expect(typeof integrity.checkpointPublicKey).toBe('string');
+    if (targetMajor() === 2) {
+      const shape = v2RefValidator('capabilities.schema.json#/properties/auditLogIntegrity')(integrity);
+      expect(shape.ok, req('openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields',
+        'security-defaults.md §"Audit-log integrity"',
+        `the auditLogIntegrity record MUST validate against the generated family schema: ${shape.errors}`,
+      )).toBe(true);
+      let keyOk = true;
+      try { checkpointPublicKey(String(integrity.checkpointPublicKey ?? '')); } catch { keyOk = false; }
+      expect(keyOk, req('openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields',
+        'security-defaults.md §"Audit-log integrity"',
+        'auditLogIntegrity.checkpointPublicKey MUST be an Ed25519 SubjectPublicKeyInfo, base64',
+      )).toBe(true);
+    } else {
+      expect(integrity.hashChain, req('openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields',
+        'auth-profiles.md §"Audit-log integrity"',
+        "openwop-audit-log-integrity profile MUST advertise auditLogIntegrity.hashChain: true",
+      )).toBe(true);
+      expect(integrity.checkpointSignatureAlgorithm, req('openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields',
+        'auth-profiles.md §"Audit-log integrity" §"Key management"',
+        'checkpointSignatureAlgorithm MUST be present (canonical: ed25519)',
+      )).toBeDefined();
+      expect(typeof integrity.checkpointPublicKey).toBe('string');
+    }
   });
 });
 
 describe('audit-log-integrity: verify endpoint returns chainValid', () => {
   it('GET /v1/audit/verify on a recent range reports chainValid: true', async () => {
-    if (!behaviorGate('openwop-audit-log-integrity', await isProfileAdvertised())) {
-      return;
-    }
+    if ((await gate()) === null) return unclaimed();
 
-    const verify = await driver.get('/v1/audit/verify?fromSeq=0&toSeq=100');
+    const path = auditVerifyPath(0, 100);
+    const verify = await driver.get(path);
     if (verify.status === 404) {
       // Host claims the profile but doesn't expose the endpoint — that's
       // a profile-claim violation. Fail explicitly.
       expect(verify.status, req('openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true', 
         'auth-profiles.md §"Audit-log integrity" §"Verification endpoint"',
-        'claiming openwop-audit-log-integrity profile REQUIRES exposing GET /v1/audit/verify',
+        `claiming ${auditClaimName()} REQUIRES exposing GET ${path.split('?')[0]}`,
       )).not.toBe(404);
       return softSkip('blocked', 'precondition not met — `verify.status === 404` returned early (seam, prior step, or fixture unavailable)');
     }
@@ -111,11 +138,10 @@ describe('audit-log-integrity: verify endpoint returns chainValid', () => {
     // length > 0)`. The body is now validated against
     // audit-verify-result.schema.json (checkpoints[] + anomalies[] required;
     // each checkpoint needs checkpoint/atSequence/merkleRoot/signature).
-    const validate = new Ajv2020({ strict: false, allErrors: true }).compile(VERIFY_RESULT_SCHEMA);
-    const shapeOk = validate(body);
-    expect(shapeOk, req('openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true',
+    const shape = validateVerifyBody(body);
+    expect(shape.ok, req('openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true',
       'audit-verify-result.schema.json',
-      `GET /v1/audit/verify MUST return the AuditVerifyResult shape: ${JSON.stringify(validate.errors ?? [])}`,
+      `GET ${path.split('?')[0]} MUST return the AuditVerifyResult shape: ${shape.errors}`,
     )).toBe(true);
 
     expect(body.chainValid, req('openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true', 
@@ -132,3 +158,33 @@ describe('audit-log-integrity: verify endpoint returns chainValid', () => {
     }
   });
 });
+
+describe('audit-log-integrity: checkpoints at the advertised cadence', () => {
+  it('verify lists every checkpoint ascending, no more than checkpointIntervalEntries apart', async () => {
+    const integrity = await gate();
+    if (integrity === null) return unclaimed();
+    const every = integrity.checkpointIntervalEntries;
+    if (typeof every !== 'number' || !Number.isInteger(every) || every < 1) {
+      // Required at major 2 (the shape leg owns that failure); optional at major 1.
+      return softSkip(targetMajor() === 2 ? 'blocked' : 'inapplicable', 'checkpointIntervalEntries is not advertised as a positive integer, so no cadence is claimed');
+    }
+    const verify = await driver.get(auditVerifyPath(0, 1_000_000));
+    if (verify.status !== 200) {
+      return softSkip('blocked', `the verify endpoint answered ${verify.status}; the verify leg owns that contract`);
+    }
+    const seqs = (((verify.json as { checkpoints?: Array<{ atSequence?: unknown }> }).checkpoints) ?? []).map((c) => c.atSequence);
+    if (seqs.length === 0) {
+      return softSkip('inapplicable', 'the host has minted no checkpoint yet, so there is no cadence to observe');
+    }
+    let prev = 0;
+    for (const at of seqs) {
+      expect(typeof at === 'number' && Number.isInteger(at), req(CADENCE, 'security-defaults.md §"Audit-log integrity"', 'every checkpoint MUST carry an integer atSequence')).toBe(true);
+      const n = at as number;
+      expect(n >= prev, req(CADENCE, 'security-defaults.md §"Audit-log integrity"', `checkpoints MUST be listed ascending by atSequence: ${n} follows ${prev}`)).toBe(true);
+      expect(n - prev, req(CADENCE, 'security-defaults.md §"Audit-log integrity"',
+        `a checkpoint MUST anchor at most checkpointIntervalEntries (${every}) entries: checkpoint at ${n} follows ${prev === 0 ? 'the start of the log' : `the checkpoint at ${prev}`} — a checkpoint is missing from the verify body, or was never minted`,
+      )).toBeLessThanOrEqual(every);
+      prev = n;
+    }
+  });
+});

package/src/scenarios/byok-roundtrip.test.ts

@@ -6,12 +6,23 @@
  * asserts credentialRefs DO resolve and DO get used (positive test) —
  * with redaction-safe verification via SHA-256 hashing.
  *
- * Both scenarios skip trivially-pass when the host returns 404/422 from
- * the start-run call (production deployments don't advertise the
- * fixture surface). Hosts that opt into `OPENWOP_CONFORMANCE_FIXTURES=1`
+ * This is a FLOOR scenario (`openwop.floor.byok-roundtrip`), so a host that
+ * cannot run it has NOT witnessed the floor. When the canary fixture is not
+ * advertised, or the start-run call answers 404/422, every test records
+ * `blocked` with the reason — never a trivial pass. A production posture that
+ * keeps the `conformance.secret.echo` seam off therefore leaves its claimed
+ * `openwop-secrets` profile uncertified, and only that profile: the cut's
+ * other claims still certify. Hosts that opt into `OPENWOP_CONFORMANCE_FIXTURES=1`
  * AND pre-provision a secret under `openwop-conformance-canary-secret`
  * expose the surface and the scenarios run end-to-end.
  *
+ * Why not `describe.skipIf`: a file whose tests are all skipped WITHOUT a
+ * recorded reason is an unclassified return (RFC 0148 §A), and an
+ * unclassified FLOOR row in a claimed profile rejects the whole
+ * certification, not just that profile. Measured on openwop-app's
+ * 2026-09-28 post-deploy major-1 cut: 2,116 rows, `certified: none`, the
+ * only unclassified row being this file.
+ *
  * The scenarios assert shape + non-empty + redaction, not exact value
  * equality — any host-defined canary value works as long as it's
  * non-empty and the host's `secrets.resolve` returns it intact.
@@ -34,17 +45,18 @@ const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
 
 const BYOK_WORKFLOW_ID = 'openwop-smoke-byok-roundtrip';
 const SKIP_NO_FIXTURE = !isFixtureAdvertised(BYOK_WORKFLOW_ID);
+const NO_FIXTURE_REASON = `precondition not met — the \`${BYOK_WORKFLOW_ID}\` fixture is not advertised, so this host cannot witness the BYOK roundtrip floor (the \`conformance.secret.echo\` seam and the \`openwop-conformance-canary-secret\` canary are off)`;
 
-describe.skipIf(SKIP_NO_FIXTURE)('byok: end-to-end credentialRef resolution roundtrip (openwop-byok profile)', () => {
+describe('byok: end-to-end credentialRef resolution roundtrip (openwop-byok profile)', () => {
   it('the canary fixture run MUST resolve a host-provisioned secret and emit SHA-256 hex', async () => {
+    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });
 
-    // Fixture absent OR canary not provisioned — host doesn't opt in.
-    // Scenario passes trivially.
+    // Fixture absent OR canary not provisioned: the floor is not witnessed.
     if (create.status === 404 || create.status === 422) {
-      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `create.status === 404 || create.status === 422` returned early (Fixture absent OR canary not provisioned — host doesn\'t opt in. Scenario passes trivially.)');
+      return softSkip('blocked', 'precondition not met — `create.status === 404 || create.status === 422` returned early (fixture advertised but the run could not start: canary not provisioned or seam unavailable)');
     }
 
     expect(create.status, req('openwop.it.byok-roundtrip.the-canary-fixture-run-must-resolve-a-host-provisioned-secret-and-emit-sha-256-h', 
@@ -102,6 +114,7 @@ describe.skipIf(SKIP_NO_FIXTURE)('byok: end-to-end credentialRef resolution roun
   });
 
   it('BYOK fixture run MUST emit a node.completed event for the resolve step', async () => {
+    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });
@@ -128,6 +141,7 @@ describe.skipIf(SKIP_NO_FIXTURE)('byok: end-to-end credentialRef resolution roun
   });
 
   it('BYOK fixture run event log MUST NOT echo the resolved secret value (redaction)', async () => {
+    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });

package/src/scenarios/v2-agent-org-chart-served-shape.test.ts

@@ -0,0 +1,63 @@
+/**
+ * RFC 0087 §A/§D — the SERVED bodies of the org-chart read pair validate against
+ * `schemas/v2/agent-org-chart.schema.json` and
+ * `schemas/v2/org-chart-responsibility-view.schema.json`. Target major 2; the
+ * major-1 twin is the served-shape leg of `agent-org-chart-scoping.test.ts`.
+ *
+ * Why this exists: until 2026-09-28 only a server-free probe compiled the
+ * schema. openwop-app served its stored record (`{ tenantId, departments,
+ * members, updatedAt }` — `owner` missing, two extra keys on an
+ * `additionalProperties:false` object) on `GET /agents/org-chart` at both
+ * majors and nothing in the suite noticed (fixed in openwop-app #4189).
+ *
+ * Gate: the v2 `agents` record carries `orgChart` (presence is the claim,
+ * capabilities.md; there is no `supported` seat), else `inapplicable` — never a
+ * strict-mode failure. The department leg runs when the record carries
+ * `responsibilityView: true` and the chart has a department to read.
+ *
+ * @see api/v2/openapi.yaml `/agents/org-chart`, `/agents/org-chart/{departmentId}`
+ * @see RFCS/0087-agent-org-chart.md
+ */
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { familyAdvertised, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.it.v2-agent-org-chart-served-shape.serves-the-org-chart-read-pair-in-the-exact-v2-schema-shape';
+
+describe('RFC 0087 §A/§D — org-chart served shape (major 2, gated on agents.orgChart)', () => {
+  it('serves the org-chart read pair in the exact v2 schema shape', async () => {
+    const agents = await familyAdvertised('agents');
+    const orgChart = agents?.['orgChart'];
+    if (!orgChart || typeof orgChart !== 'object') return softSkip('inapplicable', 'agents.orgChart not advertised in the v2 discovery document');
+
+    const chartRes = await driver.get('/agents/org-chart');
+    expect(
+      chartRes.status,
+      req(ID, 'api/v2/openapi.yaml /agents/org-chart (RFC 0087 §D)', 'a host advertising agents.orgChart MUST serve GET /agents/org-chart with 200'),
+    ).toBe(200);
+    const chartCheck = v2Validator('agent-org-chart')(chartRes.json);
+    expect(
+      chartCheck.ok ? 'valid' : chartCheck.errors,
+      req(ID, 'schemas/v2/agent-org-chart.schema.json (RFC 0087 §A)', 'the served GET /agents/org-chart body MUST validate against agent-org-chart.schema.json (owner required; no extra keys)'),
+    ).toBe('valid');
+
+    const departments = (chartRes.json as { departments?: Array<{ departmentId?: unknown }> } | undefined)?.departments;
+    const probeDeptId = Array.isArray(departments) ? departments[0]?.departmentId : undefined;
+    // The view leg needs a department to read; an empty chart is still
+    // validated above (an empty chart is a conforming chart).
+    if ((orgChart as Record<string, unknown>)['responsibilityView'] === true && typeof probeDeptId === 'string') {
+      const view = await driver.get(`/agents/org-chart/${encodeURIComponent(probeDeptId)}`);
+      expect(
+        view.status,
+        req(ID, 'api/v2/openapi.yaml /agents/org-chart/{departmentId} (RFC 0087 §D)', "a host advertising agents.orgChart.responsibilityView MUST serve GET /agents/org-chart/{departmentId} with 200 for a department in the caller's chart"),
+      ).toBe(200);
+      const viewCheck = v2Validator('org-chart-responsibility-view')(view.json);
+      expect(
+        viewCheck.ok ? 'valid' : viewCheck.errors,
+        req(ID, 'schemas/v2/org-chart-responsibility-view.schema.json (RFC 0087 §D)', 'the served GET /agents/org-chart/{departmentId} body MUST validate against org-chart-responsibility-view.schema.json'),
+      ).toBe('valid');
+    }
+  });
+});