@openwop/openwop-conformance 2.43.0 → 2.43.1

package/src/cli.ts

@@ -46,7 +46,7 @@ import { readLedgerFile } from './lib/requirement-ledger.js';
 import { deriveRung, emittedByNewerSuite, type RowEvidence } from './lib/durability-evidence.js';
 import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
-import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest, type BundleV3, type BundleV3Requirement } from './lib/certification-bundle-v3.js';
+import { publicKeyFromPrivate, sealBundleV3, verifierSign, verifyBundleV3, type BundleV3, type BundleV3Requirement } from './lib/certification-bundle-v3.js';
 import { canonicalJSON, parseIJson } from './lib/jcs.js';
 import {
   deriveProfiles,
@@ -718,7 +718,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     if (rows3.some((r) => r.id.startsWith('openwop.requirement.0158.') && r.result === 'executed-pass' && r.id !== 'openwop.requirement.0158.poison-exhaustion')) {
       process.stderr.write(`openwop-conformance --certify: RFC 0158 rung — ${rung3.rung ?? 'NONE'} (${rung3.why})\n`);
     }
-    const unsigned: Omit<BundleV3, 'signature'> = {
+    const draft: Omit<BundleV3, 'signature' | 'witnessSha256'> = {
       bundleVersion: '3',
       generatedAt: new Date().toISOString(),
       suite: { name: '@openwop/openwop-conformance', version, targetMajor: target.major, specArtifactsVersion: lock?.version ?? 'repo-layout', ...(lock ? { stampSha256: lock.stampSha256 } : {}) },
@@ -730,7 +730,6 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion, document },
       claimedProfiles: claimed3,
       results: { totals: totals3, requirements: rows3 },
-      witnessSha256: witnessDigest(rows3, relaxations, args.colocatedCompanion ? 'colocated-companion' : undefined),
       assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
       ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
       // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
@@ -738,20 +737,24 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       // claimed more would be writing a bundle its own `--verify` rejects.
       ...(rung3.rung === null ? {} : { durability: { rung: rung3.rung } }),
     };
-    const signature = signBundleV3(unsigned, signingKeyPem, keyId);
-    const v3: BundleV3 = { ...unsigned, signature };
+    // The published keyId is never a secret, whichever variable carried it
+    // (evidenceSecretsFromEnv: the `_ID` exclusion is the rule, `except` is
+    // the belt for a host that names its env var differently). Scrubbed BEFORE
+    // the digest and the signature (sealBundleV3), so the signed rows are the
+    // written rows.
+    const secrets3 = evidenceSecretsFromEnv(process.env, [apiKey, signingKeyPem], [keyId]);
+    const sealed = sealBundleV3(draft, secrets3, signingKeyPem, keyId);
+    const { unsigned } = sealed;
+    const v3Out: BundleV3 = sealed.bundle;
+    if (sealed.redactedAt.length > 0) {
+      process.stderr.write(`openwop-conformance --certify: REDACTED ${sealed.redactedAt.length} evidence field(s) that carried a configured secret or the conformance canary: ${sealed.redactedAt.slice(0, 8).join(', ')}${sealed.redactedAt.length > 8 ? ', …' : ''}\n`);
+    }
     if (args.evidenceTier === 'independent') {
       const vk = args.verifierKeyPath ? readFileSync(args.verifierKeyPath, 'utf8') : process.env['OPENWOP_BUNDLE_VERIFIER_KEY'];
       const vkId = args.verifierKeyId ?? process.env['OPENWOP_BUNDLE_VERIFIER_KEY_ID'];
       if (!vk || !vkId) { process.stderr.write('openwop-conformance --certify: --evidence-tier independent needs --verifier-key and --verifier-key-id (RFC 0168 §E.2)\n'); process.exit(2); }
-      v3.verifierSignature = verifierSign(unsigned, vk, vkId);
+      v3Out.verifierSignature = verifierSign(unsigned, vk, vkId);
     }
-    // The published keyId is never a secret, whichever variable carried it
-    // (evidenceSecretsFromEnv: the `_ID` exclusion is the rule, `except` is
-    // the belt for a host that names its env var differently).
-    const secrets3 = evidenceSecretsFromEnv(process.env, [apiKey, signingKeyPem], [keyId]);
-    const scrubbed3 = scrubEvidence(v3, secrets3);
-    const v3Out = scrubbed3.value as BundleV3;
     const audit3 = verifyBundleV3(v3Out, { hostPublicKeyPem: publicKeyFromPrivate(signingKeyPem) });
     // `relaxed-profile-certified` is no longer excused: the emitter now computes
     // the relaxation into `certified`, so if the verifier still finds that

package/src/lib/certification-bundle-v3.ts

@@ -22,6 +22,7 @@ import { profileDerivable, type DiscoveryPayload } from './profiles.js';
 import { checkRungClaim, type DurabilityRung, type RowEvidence } from './durability-evidence.js';
 import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 import { canonicalJSON, codeUnitCompare, JcsRefusal } from './jcs.js';
+import { scrubEvidence } from './certification-bundle-verify.js';
 
 export type BundleV3Result = 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
 
@@ -145,6 +146,30 @@ export function verifierSign(bundle: Pick<BundleV3, 'witnessSha256' | 'host' | '
   return { alg: 'ed25519', keyId, sig: toBase64url(edSign(null, attestationPayload(bundle), key)) };
 }
 
+/**
+ * Scrub, THEN digest, THEN sign (RFC 0148 §C + RFC 0168 §E.2).
+ *
+ * Until 2.43.1 the emitter computed `witnessSha256` over the raw rows, signed,
+ * and only then ran `scrubEvidence` over the finished bundle. A secret found in
+ * a row's `detail` or `evidence` was redacted AFTER the digest was taken, so
+ * the written rows no longer hashed to `witnessSha256` and the emitter's own
+ * self-verification refused the bundle (`[witness-digest]`, exit 2, no bundle)
+ * — openwop-app at major 1 on suite 2.43.0, 2026-09-28. The redaction was
+ * right and the check was right; the order was wrong. Everything the digest and
+ * the attestation cover is now scrubbed before either is computed, so the
+ * signed bytes are the shipped bytes.
+ */
+export function sealBundleV3(
+  draft: Omit<BundleV3, 'signature' | 'witnessSha256'>,
+  secrets: readonly string[],
+  privateKeyPem: string,
+  keyId: string,
+): { unsigned: Omit<BundleV3, 'signature'>; bundle: BundleV3; redactedAt: readonly string[] } {
+  const { value: scrubbed, redactedAt } = scrubEvidence(draft, secrets);
+  const unsigned: Omit<BundleV3, 'signature'> = { ...scrubbed, witnessSha256: witnessDigest(scrubbed.results.requirements, scrubbed.host.relaxations, scrubbed.host.deployment) };
+  return { unsigned, bundle: { ...unsigned, signature: signBundleV3(unsigned, privateKeyPem, keyId) }, redactedAt };
+}
+
 export function publicKeyFromPrivate(privateKeyPem: string): string {
   return createPublicKey(createPrivateKey(privateKeyPem)).export({ type: 'spki', format: 'pem' }) as string;
 }

package/src/lib/standard-webhooks.ts

@@ -20,6 +20,7 @@ import { readErrorCode } from './error-envelope.js';
 import type { SoftSkipKind } from './soft-skip.js';
 import { projectBoundId } from './bound-id.js';
 import { hitHeader, type ModalHit } from './webhook-receiver.js';
+import { SEAMS_PREFIX } from './seams.js';
 
 export const STANDARD_WEBHOOKS_ALG = 'standard-webhooks-1';
 export const SW_FIXTURE = 'conformance-noop';
@@ -118,3 +119,55 @@ export function deliveriesFor(hits: readonly ModalHit[], webhookId: string, runI
 export function standardWebhooksHeaderNames(hit: ModalHit): string[] {
   return Object.keys(hit.headers).filter((k) => k.toLowerCase().startsWith('webhook-'));
 }
+
+export const ROTATION_OVERLAP_SEAM = `${SEAMS_PREFIX}/sample/webhooks/rotation-overlap`;
+
+export type ShortenedOverlap =
+  | { readonly ok: true; readonly expiresAt: number }
+  | { readonly ok: false; readonly unserved: true; readonly reason: string }
+  | { readonly ok: false; readonly unserved: false; readonly reason: string };
+
+/**
+ * Shorten the rotation overlap in progress on ONE subscription
+ * (host-sample-test-seams.md §29, `shortenRotationOverlap`), so the RFC 0201
+ * §E.20 post-overlap leg can be observed on a host whose advertised
+ * `overlapSeconds` outlasts the wait cap. The seam only moves the stored expiry;
+ * which secret signs after it is the production signer's decision, and that is
+ * what the caller asserts on. UNSERVED (404/405/501) is reported apart from a
+ * served seam that breaks its contract: the seam is OPTIONAL and newer than the
+ * leg, so its absence falls back to the pre-seam partial witness.
+ *
+ * The contract checked here: `200 { webhookId, previousSecretExpiresAt }` with
+ * the expiry `overlapSeconds` after the request (±1 s), and a foreign-tenant id
+ * refused `403 id_tenant_mismatch` before the lookup, as `rotateWebhookSecret`
+ * refuses it. The real call goes first so that a 404 can only mean "unserved".
+ */
+export async function shortenRotationOverlap(webhookId: string, overlapSeconds: number, foreignWebhookId: string): Promise<ShortenedOverlap> {
+  const before = Date.now();
+  let res: OpenWOPResponse;
+  try { res = await driver.post(ROTATION_OVERLAP_SEAM, { webhookId, overlapSeconds }); } catch {
+    return { ok: false, unserved: false, reason: `${ROTATION_OVERLAP_SEAM} unreachable (fetch failed)` };
+  }
+  const after = Date.now();
+  if (res.status === 404 || res.status === 405 || res.status === 501) {
+    return { ok: false, unserved: true, reason: `${ROTATION_OVERLAP_SEAM} answered ${res.status} — the host does not serve the optional shortenRotationOverlap seam (host-sample-test-seams.md §29)` };
+  }
+  const body = (res.json ?? {}) as { webhookId?: unknown; previousSecretExpiresAt?: unknown };
+  const expiresAt = typeof body.previousSecretExpiresAt === 'string' ? Date.parse(body.previousSecretExpiresAt) : Number.NaN;
+  if (res.status !== 200 || body.webhookId !== webhookId || !Number.isFinite(expiresAt)) {
+    return { ok: false, unserved: false, reason: `${ROTATION_OVERLAP_SEAM} answered ${res.status} ${readErrorCode(res.json) ?? ''} without 200 { webhookId, previousSecretExpiresAt } for ${webhookId} — the seam contract (api/seams-v2.yaml shortenRotationOverlap) is not honoured`.replace(/ +/g, ' ') };
+  }
+  const lo = before + overlapSeconds * 1000 - 1000;
+  const hi = after + overlapSeconds * 1000 + 1000;
+  if (expiresAt < lo || expiresAt > hi) {
+    return { ok: false, unserved: false, reason: `${ROTATION_OVERLAP_SEAM} reported previousSecretExpiresAt ${body.previousSecretExpiresAt as string}, not ${overlapSeconds}s after the request (window ${new Date(lo).toISOString()}..${new Date(hi).toISOString()}) — the overlap it reports is not the one it was asked to set` };
+  }
+  let cross: OpenWOPResponse;
+  try { cross = await driver.post(ROTATION_OVERLAP_SEAM, { webhookId: foreignWebhookId, overlapSeconds }); } catch {
+    return { ok: false, unserved: false, reason: `${ROTATION_OVERLAP_SEAM} unreachable on the foreign-tenant probe (fetch failed)` };
+  }
+  if (cross.status !== 403 || readErrorCode(cross.json) !== 'id_tenant_mismatch') {
+    return { ok: false, unserved: false, reason: `${ROTATION_OVERLAP_SEAM} answered ${cross.status} ${readErrorCode(cross.json) ?? ''} for a foreign-tenant webhookId — the seam MUST be tenant-checked before the lookup (403 id_tenant_mismatch), exactly as rotateWebhookSecret`.replace(/ +/g, ' ') };
+  }
+  return { ok: true, expiresAt };
+}

package/src/scenarios/agent-org-chart-scoping.test.ts

@@ -29,10 +29,31 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readOrgChartCap, getOrgChartResponse, getDepartmentView, type OrgChart } from '../lib/agentOrgChart.js';
+import { SCHEMAS_DIR } from '../lib/paths.js';
 import { req } from '../lib/requirement-ids.js';
 
+function loadSchema(name: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as Record<string, unknown>;
+}
+
+/** A validator for `schemas/<name>.schema.json` (this file targets major 1;
+ *  the major-2 twin is `v2-agent-org-chart-served-shape.test.ts`). The
+ *  responsibility view `$ref`s the chart's `$defs`, so the chart schema is
+ *  registered first. */
+function servedShapeValidator(name: 'agent-org-chart' | 'org-chart-responsibility-view'): (d: unknown) => { ok: boolean; errors: string } {
+  const ajv = new Ajv2020({ strict: false, allErrors: true });
+  addFormats(ajv);
+  if (name !== 'agent-org-chart') ajv.addSchema(loadSchema('agent-org-chart.schema.json'));
+  const validate = ajv.compile(loadSchema(`${name}.schema.json`));
+  return (d: unknown) => ({ ok: validate(d) as boolean, errors: ajv.errorsText(validate.errors, { separator: '; ' }) });
+}
+
 const ROSTER_ID_RE = /^host:[a-z0-9][a-z0-9._-]*$/;
 
 describe('agent-org-chart-scoping (RFC 0087 §A/§C/§D)', () => {
@@ -159,3 +180,45 @@ describe('agent-org-chart-scoping (RFC 0087 §A/§C/§D)', () => {
     }
   });
 });
+
+// Org-chart served-shape leg (2026-09-28). Leg 1 above walks the chart's tree
+// and member references but never validated the body against the schema, so a
+// host serving its stored record (`{ tenantId, departments, members, updatedAt }`
+// — `owner` missing, two extra keys on an `additionalProperties:false` object)
+// passed at both majors; openwop-app did exactly that (fixed in openwop-app
+// #4189). This leg validates the SERVED bodies of the normative read pair
+// against `agent-org-chart.schema.json` / `org-chart-responsibility-view.schema.json`;
+// `v2-agent-org-chart-served-shape.test.ts` is the same leg at major 2.
+describe('agent-org-chart-scoping: served shape (RFC 0087 §A/§D)', () => {
+  it('serves the org-chart read pair in the exact schema shape', async () => {
+    const cap = await readOrgChartCap();
+    if (!behaviorGate('openwop-org-chart-scoping', cap?.supported === true)) return;
+
+    const chartRes = await getOrgChartResponse();
+    expect(
+      chartRes.status,
+      req('openwop.it.agent-org-chart-scoping.serves-the-org-chart-read-pair-in-the-exact-schema-shape', 'agent-org-chart.md §A / §E', 'a host advertising agents.orgChart.supported MUST serve GET /v1/agents/org-chart with 200'),
+    ).toBe(200);
+    const chartCheck = servedShapeValidator('agent-org-chart')(chartRes.chart);
+    expect(
+      chartCheck.ok ? 'valid' : chartCheck.errors,
+      req('openwop.it.agent-org-chart-scoping.serves-the-org-chart-read-pair-in-the-exact-schema-shape', 'agent-org-chart.schema.json (RFC 0087 §A)', 'the served GET /v1/agents/org-chart body MUST validate against agent-org-chart.schema.json (owner required; no extra keys)'),
+    ).toBe('valid');
+
+    const probeDeptId = chartRes.chart?.departments?.[0]?.departmentId;
+    // The view leg needs a department to read; an empty chart is still
+    // validated above (an empty chart is a conforming chart).
+    if (cap?.responsibilityView === true && typeof probeDeptId === 'string') {
+      const { status, view } = await getDepartmentView(probeDeptId);
+      expect(
+        status,
+        req('openwop.it.agent-org-chart-scoping.serves-the-org-chart-read-pair-in-the-exact-schema-shape', 'agent-org-chart.md §D / §E', "a host advertising agents.orgChart.responsibilityView MUST serve GET /v1/agents/org-chart/{departmentId} with 200 for a department in the caller's chart"),
+      ).toBe(200);
+      const viewCheck = servedShapeValidator('org-chart-responsibility-view')(view);
+      expect(
+        viewCheck.ok ? 'valid' : viewCheck.errors,
+        req('openwop.it.agent-org-chart-scoping.serves-the-org-chart-read-pair-in-the-exact-schema-shape', 'org-chart-responsibility-view.schema.json (RFC 0087 §D)', 'the served GET /v1/agents/org-chart/{departmentId} body MUST validate against org-chart-responsibility-view.schema.json'),
+      ).toBe('valid');
+    }
+  });
+});

package/src/scenarios/v2-agent-org-chart-served-shape.test.ts

@@ -0,0 +1,63 @@
+/**
+ * RFC 0087 §A/§D — the SERVED bodies of the org-chart read pair validate against
+ * `schemas/v2/agent-org-chart.schema.json` and
+ * `schemas/v2/org-chart-responsibility-view.schema.json`. Target major 2; the
+ * major-1 twin is the served-shape leg of `agent-org-chart-scoping.test.ts`.
+ *
+ * Why this exists: until 2026-09-28 only a server-free probe compiled the
+ * schema. openwop-app served its stored record (`{ tenantId, departments,
+ * members, updatedAt }` — `owner` missing, two extra keys on an
+ * `additionalProperties:false` object) on `GET /agents/org-chart` at both
+ * majors and nothing in the suite noticed (fixed in openwop-app #4189).
+ *
+ * Gate: the v2 `agents` record carries `orgChart` (presence is the claim,
+ * capabilities.md; there is no `supported` seat), else `inapplicable` — never a
+ * strict-mode failure. The department leg runs when the record carries
+ * `responsibilityView: true` and the chart has a department to read.
+ *
+ * @see api/v2/openapi.yaml `/agents/org-chart`, `/agents/org-chart/{departmentId}`
+ * @see RFCS/0087-agent-org-chart.md
+ */
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { familyAdvertised, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.it.v2-agent-org-chart-served-shape.serves-the-org-chart-read-pair-in-the-exact-v2-schema-shape';
+
+describe('RFC 0087 §A/§D — org-chart served shape (major 2, gated on agents.orgChart)', () => {
+  it('serves the org-chart read pair in the exact v2 schema shape', async () => {
+    const agents = await familyAdvertised('agents');
+    const orgChart = agents?.['orgChart'];
+    if (!orgChart || typeof orgChart !== 'object') return softSkip('inapplicable', 'agents.orgChart not advertised in the v2 discovery document');
+
+    const chartRes = await driver.get('/agents/org-chart');
+    expect(
+      chartRes.status,
+      req(ID, 'api/v2/openapi.yaml /agents/org-chart (RFC 0087 §D)', 'a host advertising agents.orgChart MUST serve GET /agents/org-chart with 200'),
+    ).toBe(200);
+    const chartCheck = v2Validator('agent-org-chart')(chartRes.json);
+    expect(
+      chartCheck.ok ? 'valid' : chartCheck.errors,
+      req(ID, 'schemas/v2/agent-org-chart.schema.json (RFC 0087 §A)', 'the served GET /agents/org-chart body MUST validate against agent-org-chart.schema.json (owner required; no extra keys)'),
+    ).toBe('valid');
+
+    const departments = (chartRes.json as { departments?: Array<{ departmentId?: unknown }> } | undefined)?.departments;
+    const probeDeptId = Array.isArray(departments) ? departments[0]?.departmentId : undefined;
+    // The view leg needs a department to read; an empty chart is still
+    // validated above (an empty chart is a conforming chart).
+    if ((orgChart as Record<string, unknown>)['responsibilityView'] === true && typeof probeDeptId === 'string') {
+      const view = await driver.get(`/agents/org-chart/${encodeURIComponent(probeDeptId)}`);
+      expect(
+        view.status,
+        req(ID, 'api/v2/openapi.yaml /agents/org-chart/{departmentId} (RFC 0087 §D)', "a host advertising agents.orgChart.responsibilityView MUST serve GET /agents/org-chart/{departmentId} with 200 for a department in the caller's chart"),
+      ).toBe(200);
+      const viewCheck = v2Validator('org-chart-responsibility-view')(view.json);
+      expect(
+        viewCheck.ok ? 'valid' : viewCheck.errors,
+        req(ID, 'schemas/v2/org-chart-responsibility-view.schema.json (RFC 0087 §D)', 'the served GET /agents/org-chart/{departmentId} body MUST validate against org-chart-responsibility-view.schema.json'),
+      ).toBe('valid');
+    }
+  });
+});

package/src/scenarios/v2-approval-reject-disposition.test.ts

@@ -14,14 +14,32 @@
  *      `retryable: false`, and `run.failed.failedNodeId` names the gate;
  *   4. `conformance-interrupt-quorum` (requiredApprovals 3, `majority`): one
  *      reject leaves the run `waiting-approval`; a second decides the gate and
- *      the run terminates `failed` with `approval_rejected`.
+ *      the run terminates `failed` with `approval_rejected`;
+ *   5. `conformance-approval-reject-routed` (gap G1, suite 2.43.1): rejected, the
+ *      gate fails with `approval_rejected` / `retryable: false`, its
+ *      `any_failed` target runs, its `all_success` target never runs, and the
+ *      run completes;
+ *   6. `conformance-approval-timeout` (gap G2, suite 2.43.1): left unresolved
+ *      past its 1500 ms `timeoutMs` with no `onTimeout`, the host resolves the
+ *      gate itself (`action: timeout`, `decision: rejected`, `reason: timeout`),
+ *      the gate fails with `approval_rejected` and `run.failed` names it;
+ *   7. `conformance-approval-timeout-approve` (openwop#1696, suite 2.43.1): the
+ *      same gate with `onTimeout: "approve"` still resolves rejected — a
+ *      timeout never grants — and the run fails, never completes;
+ *   8. `conformance-approval-reject-loopback` (openwop#1697, suite 2.43.1): a
+ *      rejected gate routed back to itself through `revise` is asked again —
+ *      a second `interrupt.requested` with a different `key`, the run back in
+ *      `waiting-approval`, and no second `interrupt.resolved` (the first
+ *      rejection is not replayed). `inapplicable` on a host that does not
+ *      advertise the fixture, i.e. one that does not run cycles.
  *
  * The legs are separate rows so a host that misses one field fails that row
- * only. The timeout disposition is not tested: no registered fixture carries a
- * gate with a short `timeoutMs`, and the suite cannot make a host's timer fire.
- * The routed case (an `all_complete` / `any_failed` edge) is not tested either:
- * `conformance-approval` has no edges, and widening a fixture every host serves
- * would force a re-registration (fixtures.md §conformance-approval-refine).
+ * only. Legs 5 and 6 each need their own fixture, because `conformance-approval`
+ * has no edges and no timer and widening a fixture every host serves would force
+ * a re-registration (fixtures.md §conformance-approval-refine); a host that
+ * does not advertise one records `inapplicable`. Leg 5 does not require
+ * `node.skipped`: interrupt.md says the `all_success` edge is not satisfied, not
+ * how a host records that, so the leg asserts only that the target never ran.
  *
  * The quorum leg presents distinct votes on one bearer through the resume
  * value's `voter` member, as `interrupt-quorum-resolution` does at major 1. A
@@ -40,11 +58,16 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
+import { scaledTimeoutMs } from '../lib/polling.js';
 
 const DOC = 'spec/v2/core/interrupt.md §Rejection (RFC 0223)';
 const R = (slug: string): string => `openwop.requirement.0223.${slug}`;
 const FIXTURE = 'conformance-approval';
 const QUORUM = 'conformance-interrupt-quorum';
+const ROUTED = 'conformance-approval-reject-routed';
+const TIMEOUT = 'conformance-approval-timeout';
+const TIMEOUT_APPROVE = 'conformance-approval-timeout-approve';
+const LOOPBACK = 'conformance-approval-reject-loopback';
 const NODE_ID = 'gate';
 const CODE = 'approval_rejected';
 const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
@@ -159,4 +182,81 @@ describe('RFC 0223 — v2-approval-reject-disposition (gated on interrupt + conf
     expect(terminal?.['status'], req(id, DOC, `two rejects of three under majority MUST resolve the gate rejected and fail the run (got ${String(terminal?.['status'])})`)).toBe('failed');
     expect(errorCode(terminal?.['error']), req(id, DOC, 'the terminal snapshot error.code MUST be approval_rejected')).toBe(CODE);
   }, 60_000);
+
+  it('a rejected gate routed over an any_failed edge fails as a node, its all_success sibling never runs, and the run completes', async () => {
+    if (!(await gateFamily('interrupt'))) return softSkip('inapplicable', 'interrupt family not advertised (gate recorded under openwop.family.interrupt)');
+    if (!isFixtureAdvertised(ROUTED)) return softSkip('inapplicable', `fixture ${ROUTED} is not advertised — the host does not claim the routed-reject fixture`);
+    const s = await suspended(ROUTED);
+    if ('reason' in s) return softSkip('blocked', s.reason);
+    const res = await resolve(s.runId, { action: 'reject' });
+    if (res === null || res.status < 200 || res.status >= 300) return softSkip('blocked', `the reject resolve answered ${res?.status ?? 'nothing'} ${readErrorCode(res?.json) ?? ''} — interrupt resolution owns that contract`);
+    const id = R('reject-routed');
+    const terminal = await waitStatus(s.runId, TERMINAL, 10_000);
+    const evs = await events(s.runId);
+    const ran = (nodeId: string, type: string): boolean => evs.some((e) => e.type === type && (e.payload?.['nodeId'] ?? e.nodeId) === nodeId);
+    const gateFailed = evs.find((e) => e.type === 'node.failed' && (e.payload?.['nodeId'] ?? e.nodeId) === NODE_ID);
+    const err = gateFailed?.payload?.['error'] as { code?: unknown; retryable?: unknown } | undefined;
+    expect({ code: err?.code, retryable: err?.retryable }, req(id, DOC, 'the routed gate still fails as a node: node.failed.error MUST carry approval_rejected and retryable false')).toEqual({ code: CODE, retryable: false });
+    expect(ran('on-reject', 'node.completed'), req(id, DOC, 'the any_failed edge admits the failed gate: on-reject MUST run to node.completed')).toBe(true);
+    expect(ran('on-accept', 'node.started') || ran('on-accept', 'node.completed'), req(id, DOC, 'a rejected gate MUST NOT satisfy an all_success edge: on-accept MUST NOT run')).toBe(false);
+    expect(terminal?.['status'], req(id, DOC, `a routed rejection does not fail the run: it MUST complete (got ${String(terminal?.['status'])})`)).toBe('completed');
+  }, 45_000);
+
+  it('an unresolved gate past its timeoutMs with no onTimeout is resolved rejected by the host and fails the run naming the gate', async () => {
+    if (!(await gateFamily('interrupt'))) return softSkip('inapplicable', 'interrupt family not advertised (gate recorded under openwop.family.interrupt)');
+    if (!isFixtureAdvertised(TIMEOUT)) return softSkip('inapplicable', `fixture ${TIMEOUT} is not advertised — the host does not claim the timeout fixture`);
+    const s = await suspended(TIMEOUT);
+    if ('reason' in s) return softSkip('blocked', s.reason);
+    const id = R('timeout-rejects');
+    const terminal = await waitStatus(s.runId, TERMINAL, scaledTimeoutMs(20_000));
+    const evs = await events(s.runId);
+    const resolved = evs.find((e) => e.type === 'interrupt.resolved');
+    expect(
+      { action: resolved?.payload?.['action'], decision: resolved?.payload?.['decision'], reason: resolved?.payload?.['reason'] },
+      req(id, DOC, 'the host MUST resolve the timed-out gate itself, recording action "timeout", decision "rejected" and reason "timeout"'),
+    ).toEqual({ action: 'timeout', decision: 'rejected', reason: 'timeout' });
+    const gateFailed = evs.find((e) => e.type === 'node.failed' && (e.payload?.['nodeId'] ?? e.nodeId) === NODE_ID);
+    expect(errorCode(gateFailed?.payload?.['error']), req(id, DOC, 'the timed-out gate MUST fail with approval_rejected')).toBe(CODE);
+    const runFailed = evs.find((e) => e.type === 'run.failed');
+    expect({ status: terminal?.['status'], code: errorCode(runFailed?.payload?.['error']), failedNodeId: runFailed?.payload?.['failedNodeId'] }, req(id, DOC, 'with no routing edge the run MUST terminate failed, run.failed carrying approval_rejected and failedNodeId naming the gate')).toEqual({ status: 'failed', code: CODE, failedNodeId: NODE_ID });
+  }, 60_000);
+
+  it('a gate whose onTimeout is approve still resolves rejected on timeout and fails the run: a timeout never grants', async () => {
+    if (!(await gateFamily('interrupt'))) return softSkip('inapplicable', 'interrupt family not advertised (gate recorded under openwop.family.interrupt)');
+    if (!isFixtureAdvertised(TIMEOUT_APPROVE)) return softSkip('inapplicable', `fixture ${TIMEOUT_APPROVE} is not advertised — the host does not claim the timeout-approve fixture`);
+    const s = await suspended(TIMEOUT_APPROVE);
+    if ('reason' in s) return softSkip('blocked', s.reason);
+    const id = R('timeout-never-grants');
+    const terminal = await waitStatus(s.runId, TERMINAL, scaledTimeoutMs(20_000));
+    const evs = await events(s.runId);
+    const resolved = evs.find((e) => e.type === 'interrupt.resolved');
+    expect(
+      { action: resolved?.payload?.['action'], decision: resolved?.payload?.['decision'] },
+      req(id, DOC, 'whatever onTimeout holds, the host MUST resolve the timed-out gate rejected (action "timeout", decision "rejected") — onTimeout "approve" is treated as reject'),
+    ).toEqual({ action: 'timeout', decision: 'rejected' });
+    const gateFailed = evs.find((e) => e.type === 'node.failed' && (e.payload?.['nodeId'] ?? e.nodeId) === NODE_ID);
+    expect(errorCode(gateFailed?.payload?.['error']), req(id, DOC, 'the timed-out gate MUST fail with approval_rejected')).toBe(CODE);
+    expect(terminal?.['status'], req(id, DOC, `a timeout MUST NOT grant a gate: with no routing edge the run MUST terminate failed, never completed (got ${String(terminal?.['status'])})`)).toBe('failed');
+  }, 60_000);
+
+  it('a rejected gate looped back to itself is asked again under a new key, and the first rejection is not replayed', async () => {
+    if (!(await gateFamily('interrupt'))) return softSkip('inapplicable', 'interrupt family not advertised (gate recorded under openwop.family.interrupt)');
+    if (!isFixtureAdvertised(LOOPBACK)) return softSkip('inapplicable', `fixture ${LOOPBACK} is not advertised — the host does not run cycles`);
+    const s = await suspended(LOOPBACK);
+    if ('reason' in s) return softSkip('blocked', s.reason);
+    const res = await resolve(s.runId, { action: 'reject' });
+    if (res === null || res.status < 200 || res.status >= 300) return softSkip('blocked', `the reject resolve answered ${res?.status ?? 'nothing'} ${readErrorCode(res?.json) ?? ''} — interrupt resolution owns that contract`);
+    const id = R('reject-loopback-reasks');
+    const gateRequests = (evs: Ev[]): Ev[] => evs.filter((e) => e.type === 'interrupt.requested' && (e.nodeId ?? e.payload?.['nodeId']) === NODE_ID);
+    const deadline = Date.now() + scaledTimeoutMs(10_000);
+    let evs = await events(s.runId);
+    while (gateRequests(evs).length < 2 && Date.now() < deadline) { await new Promise((r) => setTimeout(r, 250)); evs = await events(s.runId); }
+    const snap = await snapshot(s.runId);
+    const [first, second] = gateRequests(evs);
+    expect(second, req(id, 'spec/v2/core/interrupt.md §Re-entry and resume values', 'the second visit of the gate MUST raise a new interrupt.requested')).toBeDefined();
+    expect(second?.payload?.['key'] !== undefined && second?.payload?.['key'] !== first?.payload?.['key'], req(id, 'spec/v2/core/interrupt.md §Re-entry and resume values', `a later execution of the node MUST derive a different key (got ${String(first?.payload?.['key'])} then ${String(second?.payload?.['key'])})`)).toBe(true);
+    expect(snap?.['status'], req(id, 'spec/v2/core/interrupt.md §Re-entry and resume values', 'the second visit MUST wait for a new decision: the run is waiting-approval again')).toBe('waiting-approval');
+    expect(evs.filter((e) => e.type === 'interrupt.resolved').length, req(id, 'spec/v2/core/interrupt.md §Re-entry and resume values', 'an earlier visit\'s resumeValue MUST NOT be returned: only the one caller resolve is recorded')).toBe(1);
+    await http(() => driver.post(`/runs/${enc(s.runId)}/cancel`, {}));
+  }, 45_000);
 });

package/src/scenarios/v2-error-registry.test.ts

@@ -10,6 +10,14 @@
  * lives in `Retry-After` only, which a `429 rate_limited` MUST set. The
  * deliberately bad request is `GET /runs/does-not-exist` (outside the runId
  * grammar, so a host may answer `400 validation_error` or `404 not_found`).
+ *
+ * `event-code-registered` (openwop#1698, suite 2.43.1): errors.md §The
+ * registry binds `error.code` on `run.failed`, `node.failed` and the snapshot's
+ * `error` exactly as it binds an error response. The leg runs
+ * `conformance-failure` and checks every such code against the registry and the
+ * vendor pattern (first segment an org registered in `spec/v2/declaration.json`).
+ * ADVISORY for suite 2.43.1: a violation is recorded as a partial witness naming
+ * the codes, not a failure, while hosts remap (per-host rows in gaps.json).
  */
 
 import { describe, it, expect } from 'vitest';
@@ -25,6 +33,8 @@ import { req } from '../lib/requirement-ids.js';
 const DOC = 'spec/v2/core/errors.md §The envelope';
 const ERRORS_PATH = join(SCHEMAS_DIR, '..', 'spec', 'v2', 'errors.json');
 const RETRY_SPELLINGS = ['retryAfter', 'retryAfterMs', 'retryAfterSeconds'];
+const DECLARATION_PATH = join(SCHEMAS_DIR, '..', 'spec', 'v2', 'declaration.json');
+const FAILURE_FIXTURE = 'conformance-failure';
 
 async function discovery(): Promise<Record<string, unknown> | null> {
   try { return await v2Discovery(); } catch { return null; }
@@ -40,6 +50,16 @@ function registryStatus(): Map<string, number> | null {
   return new Map(rows.map((r) => [r.code, r.httpStatus]));
 }
 
+/** code → registered, or a vendor code whose org is registered; null when the registry or declaration is absent. */
+function codeAccepted(): ((code: string) => boolean) | null {
+  const registry = registryStatus();
+  if (registry === null || !existsSync(DECLARATION_PATH)) return null;
+  const reg = JSON.parse(readFileSync(ERRORS_PATH, 'utf8')) as { vendorCodePattern?: string };
+  const pattern = new RegExp(reg.vendorCodePattern ?? '^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$');
+  const orgs = new Set(Object.keys((JSON.parse(readFileSync(DECLARATION_PATH, 'utf8')) as { extensions?: Record<string, unknown> }).extensions ?? {}));
+  return (code: string) => registry.has(code) || (pattern.test(code) && orgs.has(code.split('.')[0] ?? ''));
+}
+
 async function badRequest(): Promise<OpenWOPResponse | { reason: string }> {
   if (!(await discovery())) return { reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
   const res = await http(() => driver.get('/runs/does-not-exist'));
@@ -86,4 +106,43 @@ describe('v2 error-registry (RFC 0171 §B.1–§B.2)', () => {
       expect(r.headers.get('retry-after'), req('openwop.requirement.0171.error-registry.retry-after', 'spec/v2/core/errors.md §Retry timing', 'a 429 rate_limited response MUST set Retry-After')).not.toBeNull();
     }
   });
+
+  it('an error code on run.failed, node.failed and the snapshot is registered or a vendor code (advisory in 2.43.1)', async () => {
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const accepted = codeAccepted();
+    if (accepted === null) return softSkip('inapplicable', 'spec/v2/errors.json or spec/v2/declaration.json is not present in this layout');
+    const fixtures = ((await discovery())?.['fixtures'] ?? []) as unknown[];
+    if (!fixtures.includes(FAILURE_FIXTURE)) return softSkip('blocked', `fixture ${FAILURE_FIXTURE} is not advertised — no failing run to read codes from`);
+    const create = await http(() => driver.post('/runs', { workflowId: FAILURE_FIXTURE }));
+    const runId = (create?.json as { runId?: unknown } | null)?.runId;
+    if (create === null || create.status !== 201 || typeof runId !== 'string') return softSkip('blocked', `POST /runs (${FAILURE_FIXTURE}) answered ${create?.status ?? 'nothing'}`);
+    const deadline = Date.now() + 10_000;
+    let snap: Record<string, unknown> | null = null;
+    for (;;) {
+      const r = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
+      snap = r?.status === 200 ? (r.json as Record<string, unknown>) : null;
+      if (snap !== null && ['completed', 'failed', 'cancelled'].includes(String(snap['status']))) break;
+      if (Date.now() > deadline) return softSkip('blocked', `the ${FAILURE_FIXTURE} run did not reach a terminal state within 10 s`);
+      await new Promise((ok) => setTimeout(ok, 250));
+    }
+    const polled = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`));
+    const events = ((polled?.json as { events?: Array<{ type?: string; payload?: { error?: { code?: unknown } } }> } | null)?.events ?? []);
+    const seen: Array<{ where: string; code: string }> = [];
+    for (const e of events) {
+      const code = e.payload?.error?.code;
+      if ((e.type === 'run.failed' || e.type === 'node.failed') && typeof code === 'string') seen.push({ where: e.type, code });
+    }
+    const snapCode = (snap?.['error'] as { code?: unknown } | undefined)?.code;
+    if (typeof snapCode === 'string') seen.push({ where: 'snapshot.error', code: snapCode });
+    const ID = 'openwop.requirement.errors.event-code-registered';
+    expect(seen.length, req(ID, 'spec/v2/core/errors.md §The registry', `a failed ${FAILURE_FIXTURE} run MUST carry an error code on run.failed, node.failed or the snapshot (status ${String(snap?.['status'])})`)).toBeGreaterThan(0);
+    const bad = seen.filter((s) => !accepted(s.code));
+    if (bad.length > 0) {
+      // partial-witness-ok: ADVISORY for suite 2.43.1 (openwop#1698). The codes were
+      // observed and checked above; a violation is recorded, not failed, for one
+      // suite patch while hosts remap. Per-host gap rows track them.
+      return softSkip('inapplicable', `ADVISORY (suite 2.43.1, openwop#1698): unregistered, non-vendor error codes: ${bad.map((b) => `${b.where}=${b.code}`).join(', ')}`);
+    }
+    expect(bad, req(ID, 'spec/v2/core/errors.md §The registry', 'every error code on run.failed, node.failed and the snapshot MUST be registered or a vendor code')).toEqual([]);
+  }, 45_000);
 });

package/src/scenarios/v2-manifest-ceiling-refused.test.ts

@@ -14,10 +14,12 @@
  *   2. `>=1.0.0 <2.0.0`   (v1 ceiling)      → refused, pack_engine_unsupported
  *   3. `>=2.0.0 <3.0.0`   (admits major 2)  → installs (200/201)
  *
- * Gated on the `packs` family (RFC 0169 §A.2: presence is the claim) and on
- * the seams profile (`conformance.seamsProfile: openwop-conformance-seams-v2`);
- * a host without the profile records `blocked` — the write API is the only
- * install path the suite can drive.
+ * Gated on the seams profile (`conformance.seamsProfile:
+ * openwop-conformance-seams-v2`): its publish seam is the only install path the
+ * suite can drive. Not gated on `packs` since suite 2.43.1 (#1706): §A.1 binds
+ * at install on every path, and `packs` advertises registry resolution, which a
+ * host installing only local packs correctly omits. A seam 404 records `blocked`
+ * when `packs` is advertised and `inapplicable` when it is not.
  *
  * @see RFCS/0177-v2-registry-packs-and-extension-tail.md §A.1
  * @see spec/v2/core/packs.md §"The engine range"
@@ -31,7 +33,7 @@ import { readErrorCode } from '../lib/error-envelope.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip, type SoftSkipKind } from '../lib/soft-skip.js';
 import { seamsProfileAdvertised, targetMajor } from '../lib/seams.js';
-import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
 
 const SECTION = 'packs.md §"The engine range" (RFC 0177 §A.1)';
 
@@ -87,6 +89,17 @@ async function publish(manifest: Record<string, unknown>) {
 }
 
 /** The reason this leg cannot run, or null when the seam is reachable. */
+/**
+ * The publish seam answered 404. Whether that is a defect depends on `packs`
+ * (#1706): a host advertising `packs` claims an install path and must mount it
+ * (`blocked`); a host that omits `packs` may have no install path the suite can
+ * drive (`inapplicable`). §A.1 binds at install on every path, not on `packs`.
+ */
+async function seamMissing(): Promise<undefined> {
+  if (await familyAdvertised('packs')) return softSkip('blocked', 'packs-test publish seam answered 404 — packs and the seams profile are advertised but the seam is not mounted');
+  return softSkip('inapplicable', 'packs-test publish seam answered 404 and packs is not advertised — no install path the suite can drive');
+}
+
 async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | null> {
   if (targetMajor() !== 2) return { kind: 'inapplicable', reason: 'suite 2.0.0 v2 scenario: OPENWOP_TARGET_MAJOR is not 2' };
   let doc: Record<string, unknown> | null;
@@ -96,7 +109,6 @@ async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | nul
     doc = null;
   }
   if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
-  if (!(await gateFamily('packs'))) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise the packs family (RFC 0169 §A.2)' };
   if (!seamsProfileAdvertised(doc)) return { kind: 'inapplicable', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only install path the suite can drive (RFC 0168 §C.1)' };
   return null;
 }
@@ -106,7 +118,7 @@ describe('v2-manifest-ceiling-refused (RFC 0177 §A.1)', () => {
     const skip = await preflight();
     if (skip) return softSkip(skip.kind, skip.reason);
     const res = await publish(nodePack(freshName('unbounded'), '>=1.0.0'));
-    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    if (res.status === 404) return seamMissing();
     expect(res.status, req('openwop.requirement.0177.manifest-ceiling-refused.unbounded', SECTION, 'an unbounded range does not admit protocol major 2 and MUST be refused with 400 pack_engine_unsupported')).toBe(400);
     expect(readErrorCode(res.json), req('openwop.requirement.0177.manifest-ceiling-refused.unbounded', SECTION, 'the refusal code MUST be pack_engine_unsupported (not pack_runtime_requirement_unmet)')).toBe('pack_engine_unsupported');
   });
@@ -115,7 +127,7 @@ describe('v2-manifest-ceiling-refused (RFC 0177 §A.1)', () => {
     const skip = await preflight();
     if (skip) return softSkip(skip.kind, skip.reason);
     const res = await publish(nodePack(freshName('v1-ceiling'), '>=1.0.0 <2.0.0'));
-    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    if (res.status === 404) return seamMissing();
     expect(res.status, req('openwop.requirement.0177.manifest-ceiling-refused.v1-ceiling', SECTION, 'a <2.0.0 ceiling does not admit protocol major 2 and MUST be refused with 400 pack_engine_unsupported')).toBe(400);
     expect(readErrorCode(res.json), req('openwop.requirement.0177.manifest-ceiling-refused.v1-ceiling', SECTION, 'the refusal code MUST be pack_engine_unsupported')).toBe('pack_engine_unsupported');
   });
@@ -124,7 +136,7 @@ describe('v2-manifest-ceiling-refused (RFC 0177 §A.1)', () => {
     const skip = await preflight();
     if (skip) return softSkip(skip.kind, skip.reason);
     const res = await publish(nodePack(freshName('v2-installs'), '>=2.0.0 <3.0.0'));
-    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    if (res.status === 404) return seamMissing();
     expect([200, 201].includes(res.status), req('openwop.requirement.0177.manifest-ceiling-refused.v2-installs', SECTION, `a manifest whose range admits major 2 MUST install (got ${res.status} ${readErrorCode(res.json) ?? ''})`)).toBe(true);
   });
 });