@openwop/openwop-conformance 2.43.0 → 2.43.2

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.43.2] — 2026-09-28 — three Class 3 corrections, and a failing scenario hook no longer hides its test
+
+- **The 2.43.2 cycle opens.** #1724 changes the packed `@openwop/spec-artifacts` tree (`spec/v2/core/interrupt.md`, `spec/v1/gaps.json`) after `v2.43.1` was tagged. No scenario changes in this entry: `approval.rejected` goes from SHOULD to MAY (Class 3), and no leg asserted the SHOULD.
+- **The replay outcome key uses the execution ordinal** (#1718, Class 3). New `v2-replay-suppression-ordinal.test.ts` (target major 2), row `openwop.requirement.replay.suppression-execution-ordinal`, fixture `conformance-replay-ordinal-loop` (start → effect → wait → effect). The suite cancels the source after `effect`'s first execution, then forks `mode: "replay"`. `effect`'s second execution has no recorded outcome for n = 2 and MUST fail closed with `replay_source_missing`; a host keyed on `(nodeId, attempt)`, or on the latest outcome, completes it instead. `inapplicable` unless the host runs cycles and advertises the fixture. No host witnesses it yet.
+- **Suite `2.43.2`**. `@openwop/spec-artifacts` moves in lockstep at the same exact pin.
+- **A scenario hook that fails no longer hides its test** (#1753). vitest runs a file's `afterEach` hooks in stack order, so a scenario's own cleanup runs before the runner's recorder. If it threw or timed out, the recorder never saw the test and the file row read "no test executed and no disposition recorded" (`blocked`). `setup.ts`'s `afterAll` now recovers such tests from vitest's task results (`unrecordedTests` in `lib/scenario-disposition.ts`, self-test `lib/unrecorded-tests.test.ts`), so the row is `executed-fail` and names the error.
+- **A fork has no ancestry parent** (Class 3). New `v2-run-fork-ancestry.test.ts` (target major 2), row `openwop.requirement.0040.fork-has-no-ancestry-parent`. It is gated on `replay` and on `multiAgent.executionModel.crossHostCausation.ancestryEndpointSupported`, and records `inapplicable` without them. It creates a `conformance-noop` run and checks its ancestry `parent` is `null` as a control. It then makes a branch fork at `fromSeq: 0`, checks the `201` names the source as `sourceRunId`, and asserts the fork's ancestry `parent` is `null` (`runs.md` §Diff and ancestry). It is a file of its own so that most v2 hosts, which do not advertise ancestry, do not get a `partial-witness` row on `v2-run-fork-refusals`. Measured on the v2 reference host (openwop-examples #124) with a temporary ancestry advertisement: `executed-pass`. With its previous `cause: "core.subWorkflow"` line restored the row fails, and a host reporting a parent for every run fails the control. As shipped, with nothing advertised, it records `inapplicable`. openwop-app also derives ancestry from the `parentRunId` its forks set, so it fails this row wherever it advertises ancestry.
+
+## [2.43.1] — 2026-09-28 — major-1 certification works again, RFC 0223's routed and timed-out rejects are witnessed, and four Class 3 corrections
+
+- **`v2-manifest-hatch-carried`'s agent fixture is schema-valid.** Its `agents[0]` had neither `systemPrompt` nor `systemPromptRef`, and `agent-manifest` (v1 and v2) requires exactly one. A conforming host therefore had to refuse the pack for a reason unrelated to the `x-` hatch, and `0177.manifest-hatch-carried.agents-x-field` could not pass on any host. The fixture now carries `systemPrompt`. Validated against `schemas/v2/agent-manifest.schema.json`: invalid before, valid after. Reported by MyndHyve.
+- **RFC 0223 G1 and G2: the routed and the timed-out approval reject are witnessed** (#1700). Two new fixtures and two new rows in `v2-approval-reject-disposition.test.ts` (target major 2). Each row is `inapplicable` on a host that does not advertise its fixture.
+  - `conformance-approval-reject-routed` and `0223.reject-routed`: the gate has an `any_failed` edge to `on-reject` and an `all_success` edge to `on-accept`. Rejected, the gate still fails as a node (`approval_rejected`, `retryable: false`), `on-reject` completes, `on-accept` never runs, and the run completes. `node.skipped` is not required, because `interrupt.md` §Rejection says the edge is not satisfied, not how a host records it.
+  - `conformance-approval-timeout` and `0223.timeout-rejects`: the gate has a 1500 ms `timeoutMs` and no `onTimeout`. Left unresolved, the host resolves it with `action: "timeout"`, `decision: "rejected"`, `reason: "timeout"`, the gate fails with `approval_rejected`, and `run.failed` names it.
+  - Witnessed on the v2 reference host (openwop-examples `777b485`) with both fixtures added to its honoured set: all six rows `executed-pass`. Sabotaged, emptying the host's failure-admitting `triggerRule` set fails `0223.reject-routed`, and short-circuiting its timeout sweep fails `0223.timeout-rejects`. The host registers the two ids in a follow-up.
+- **The pack isolation and manifest rows no longer gate on `packs`** (#1706, Class 3). `packs` advertises registry resolution, which a host that only loads local packs correctly omits, so these rows went unmeasured on exactly that host. `v2-pack-isolation` gates on `sandbox` alone. `v2-manifest-ceiling-refused`, `v2-manifest-hatch-carried` and `v2-peer-dependency-declared` gate on the seams-profile install path, and a publish-seam `404` records `inapplicable` when `packs` is absent and `blocked` when it is advertised. Requirement ids are unchanged.
+- **A timeout never grants an approval gate** (#1696, Class 3). New fixture `conformance-approval-timeout-approve` (1500 ms `timeoutMs`, `onTimeout: "approve"`) and row `0223.timeout-never-grants` in `v2-approval-reject-disposition` (`inapplicable` without the fixture). The timed-out gate MUST resolve rejected (`action: timeout`, `decision: rejected`), fail with `approval_rejected`, and the run MUST fail rather than complete. Measured on the v2 reference host: `executed-fail` today, because its sweep skips a non-`reject` `onTimeout` and the run waits forever. It passes with that exclusion dropped, which is its follow-up.
+- **An interrupt `key` is per visit** (#1697, Class 3). New fixture `conformance-approval-reject-loopback` (`start` → `gate`, `gate` → `revise` on `any_failed`, `revise` → `gate`) and row `0223.reject-loopback-reasks`. Rejected once, the gate is asked again under a different `key`, the run is `waiting-approval` again, and only one `interrupt.resolved` is recorded. The fixture is advertised only by a host that runs cycles; everyone else records `inapplicable`.
+- **`v2-error-registry` checks the codes on events** (#1698, Class 3). New leg `openwop.requirement.errors.event-code-registered`. It runs `conformance-failure` and checks every `error.code` on `run.failed`, `node.failed` and the snapshot against the registry and the vendor pattern (the org must be registered in `declaration.json`). It is ADVISORY in 2.43.1: a violation records `executed-pass` with a `partial-witness` detail naming the codes, and becomes a failure in a later patch. On the v2 reference host it currently names `fixture_failure`. `fixtures.md`'s `core.fail` now throws `example.conformance_failure`.
+- **RFC 0201 §E.20's post-overlap rule is witnessable on a long overlap.** New OPTIONAL seams-profile seam `POST /conformance/seams/sample/webhooks/rotation-overlap { webhookId, overlapSeconds }` (`host-sample-test-seams.md` §29; `api/seams-v2.yaml` `shortenRotationOverlap`) shortens the rotation overlap in progress on one subscription by moving the stored expiry the production signer reads. It is tenant-checked like `rotateWebhookSecret` and only ever shortens. `v2-webhook-secret-rotation` calls it only when the advertised `overlapSeconds` outlasts the wait cap: it sets 3 s, waits past the reported expiry, and asserts that only the new secret signs. Dispositions: seam served → real assertion; served but contract broken (wrong expiry, or a foreign-tenant id not refused `403 id_tenant_mismatch`) → `blocked`; not served, or no seams profile → the pre-seam partial witness, never `blocked`. Witnessed on the v2 reference host (openwop-examples#117) with a 3600 s overlap: `executed-pass` (17 assertions); seam unmounted → partial witness; a signer that ignores the expiry → `executed-fail`; a seam that misreports the expiry → `blocked`.
+- **`--certify --bundle-version 3` no longer refuses its own bundle when a secret is redacted from a row.** The emitter digested and signed the raw requirement rows, then ran `scrubEvidence` over the finished bundle. A configured secret (the handed `--api-key`, an `OPENWOP_*` key/token/secret env value, or the canary) found in a row's `detail` or `evidence` was redacted AFTER `witnessSha256` was taken, so the written rows no longer hashed to it and self-verification exited 2 with `[witness-digest]` and no bundle. openwop-app hit it at major 1 on 2.43.0. The new `sealBundleV3` scrubs first, then digests and signs, so the signed rows are the shipped rows; the v3 path now also prints the `REDACTED … field(s)` line the v2 path always had. Reproduced on published 2.43.0 against the v1 SQLite reference host at major 1 with an `OPENWOP_*_SECRET` value that occurs in 274 row details: exit 2, `witnessSha256 0657c889365e` (the clean run's digest) against rows digesting to `803b02c17414`. With the fix the same run writes a bundle `--verify` accepts. New self-tests in `certification-bundle-v3.test.ts` pin both orders. Sabotaged, digesting the pre-scrub rows fails the new test. No wire, schema or digest-preimage change.
+- **The org-chart read pair's served bodies are validated against their schemas** (RFC 0087 §A/§D). Only a server-free probe compiled `agent-org-chart.schema.json`; the live scenario walked the tree and member refs and never validated the body. openwop-app served its stored record (`{ tenantId, departments, members, updatedAt }`: `owner` missing, two extra keys on a closed object) at both majors, and every row passed (fixed in openwop-app #4189). New row `openwop.it.agent-org-chart-scoping.serves-the-org-chart-read-pair-in-the-exact-schema-shape` (major 1, same `openwop-org-chart-scoping` gate) and new file `v2-agent-org-chart-served-shape.test.ts` (major 2, `inapplicable` unless the v2 `agents` record carries `orgChart`) validate `GET /agents/org-chart` against `agent-org-chart.schema.json` and, when `responsibilityView` is advertised, `GET /agents/org-chart/{departmentId}` against `org-chart-responsibility-view.schema.json`. Witnessed on openwop-app `c4aad98c2` in-process (one seeded department): `executed-pass` at both majors; the pre-fix `routes/orgChart.ts` (`553355847`) → `executed-fail` at both majors on `owner` + extra keys while the old tree row still passed; an extra key on the department view alone → `executed-fail` at both majors. openwop-app does not advertise `agents` at major 2, so the v2 row records `inapplicable` there; the major-2 witness advertised `agents.orgChart` via a local, uncommitted discovery patch.
+- **Suite `2.43.1`**. This adds scenario rows and fixtures, the same class as the 2.42.8 and 2.42.9 scenario changes. The only packed contract file that changes is `spec/v1/gaps.json`, where G1 and G2 close. No wire change. `@openwop/spec-artifacts` moves in lockstep at the same exact pin.
+
 ## [2.43.0] — 2026-09-28 — four RFCs: approval reject, registry operations, the audit anomaly shape, and a v2 home for audit-log integrity
 
 - **RFC 0222: v2 registry lifecycle and signing keys, witnessed against a registry.** New `v2-registry-lifecycle.test.ts` (target major 2). It reads a registry, not the host: it runs when `OPENWOP_REGISTRY_URL` names one or `OPENWOP_TEST_PUBLIC_REGISTRY=true` names `packs.openwop.dev`, records `inapplicable` otherwise, and resolves every path through `.well-known` `endpoints.v2`. Leg 1 (`openwop.requirement.0222.yanked-version-lifecycle`): every pack index agrees with its version manifests on `yanked` and `versionDeprecated`, never names a yanked version `latest` while an unyanked one exists, and a yanked version's tarball and signature stay served. Leg 2 (`openwop.requirement.0222.signing-keys-cover-served-versions`): every served version names a key `signingKeys[]` still lists, whose `permittedNamespaces` admit it, and its integrity and signature over the in-tarball `pack.json` verify, whatever the key's `status`. Passes on `packs.openwop.dev` (198 versions; leg 1 `partial-witness`, no v2 version is yanked) and on a local tree with a yanked version; fails on seven sabotages, including the registry's previous `build-index.mjs`.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.43.0 @openwop/spec-artifacts@2.43.0
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.43.2 @openwop/spec-artifacts@2.43.2
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 570 scenario files under `src/scenarios/`.
+The current suite has 573 scenario files under `src/scenarios/`.
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
@@ -481,7 +481,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 570 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 573 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -45,7 +45,7 @@ import { readLedgerFile } from './lib/requirement-ledger.js';
 import { deriveRung, emittedByNewerSuite } from './lib/durability-evidence.js';
 import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
-import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
+import { publicKeyFromPrivate, sealBundleV3, verifierSign, verifyBundleV3 } from './lib/certification-bundle-v3.js';
 import { canonicalJSON, parseIJson } from './lib/jcs.js';
 import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
@@ -687,7 +687,7 @@ async function runCertify(args, baseUrl, apiKey) {
         if (rows3.some((r) => r.id.startsWith('openwop.requirement.0158.') && r.result === 'executed-pass' && r.id !== 'openwop.requirement.0158.poison-exhaustion')) {
             process.stderr.write(`openwop-conformance --certify: RFC 0158 rung — ${rung3.rung ?? 'NONE'} (${rung3.why})\n`);
         }
-        const unsigned = {
+        const draft = {
             bundleVersion: '3',
             generatedAt: new Date().toISOString(),
             suite: { name: '@openwop/openwop-conformance', version, targetMajor: target.major, specArtifactsVersion: lock?.version ?? 'repo-layout', ...(lock ? { stampSha256: lock.stampSha256 } : {}) },
@@ -699,7 +699,6 @@ async function runCertify(args, baseUrl, apiKey) {
             discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion, document },
             claimedProfiles: claimed3,
             results: { totals: totals3, requirements: rows3 },
-            witnessSha256: witnessDigest(rows3, relaxations, args.colocatedCompanion ? 'colocated-companion' : undefined),
             assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
             ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
             // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
@@ -707,8 +706,18 @@ async function runCertify(args, baseUrl, apiKey) {
             // claimed more would be writing a bundle its own `--verify` rejects.
             ...(rung3.rung === null ? {} : { durability: { rung: rung3.rung } }),
         };
-        const signature = signBundleV3(unsigned, signingKeyPem, keyId);
-        const v3 = { ...unsigned, signature };
+        // The published keyId is never a secret, whichever variable carried it
+        // (evidenceSecretsFromEnv: the `_ID` exclusion is the rule, `except` is
+        // the belt for a host that names its env var differently). Scrubbed BEFORE
+        // the digest and the signature (sealBundleV3), so the signed rows are the
+        // written rows.
+        const secrets3 = evidenceSecretsFromEnv(process.env, [apiKey, signingKeyPem], [keyId]);
+        const sealed = sealBundleV3(draft, secrets3, signingKeyPem, keyId);
+        const { unsigned } = sealed;
+        const v3Out = sealed.bundle;
+        if (sealed.redactedAt.length > 0) {
+            process.stderr.write(`openwop-conformance --certify: REDACTED ${sealed.redactedAt.length} evidence field(s) that carried a configured secret or the conformance canary: ${sealed.redactedAt.slice(0, 8).join(', ')}${sealed.redactedAt.length > 8 ? ', …' : ''}\n`);
+        }
         if (args.evidenceTier === 'independent') {
             const vk = args.verifierKeyPath ? readFileSync(args.verifierKeyPath, 'utf8') : process.env['OPENWOP_BUNDLE_VERIFIER_KEY'];
             const vkId = args.verifierKeyId ?? process.env['OPENWOP_BUNDLE_VERIFIER_KEY_ID'];
@@ -716,14 +725,8 @@ async function runCertify(args, baseUrl, apiKey) {
                 process.stderr.write('openwop-conformance --certify: --evidence-tier independent needs --verifier-key and --verifier-key-id (RFC 0168 §E.2)\n');
                 process.exit(2);
             }
-            v3.verifierSignature = verifierSign(unsigned, vk, vkId);
+            v3Out.verifierSignature = verifierSign(unsigned, vk, vkId);
         }
-        // The published keyId is never a secret, whichever variable carried it
-        // (evidenceSecretsFromEnv: the `_ID` exclusion is the rule, `except` is
-        // the belt for a host that names its env var differently).
-        const secrets3 = evidenceSecretsFromEnv(process.env, [apiKey, signingKeyPem], [keyId]);
-        const scrubbed3 = scrubEvidence(v3, secrets3);
-        const v3Out = scrubbed3.value;
         const audit3 = verifyBundleV3(v3Out, { hostPublicKeyPem: publicKeyFromPrivate(signingKeyPem) });
         // `relaxed-profile-certified` is no longer excused: the emitter now computes
         // the relaxation into `certified`, so if the verifier still finds that

package/dist/lib/certification-bundle-v3.js

@@ -22,6 +22,7 @@ import { profileDerivable } from './profiles.js';
 import { checkRungClaim } from './durability-evidence.js';
 import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 import { canonicalJSON, codeUnitCompare, JcsRefusal } from './jcs.js';
+import { scrubEvidence } from './certification-bundle-verify.js';
 export const SIGNATURE_OVER = ['witnessSha256', 'host.build', 'suite.version', 'discovery.sha256'];
 /**
  * RFC 0212 §A — the bytes every attestation and digest here covers are RFC 8785
@@ -82,6 +83,24 @@ export function verifierSign(bundle, privateKeyPem, keyId) {
     const key = createPrivateKey(privateKeyPem);
     return { alg: 'ed25519', keyId, sig: toBase64url(edSign(null, attestationPayload(bundle), key)) };
 }
+/**
+ * Scrub, THEN digest, THEN sign (RFC 0148 §C + RFC 0168 §E.2).
+ *
+ * Until 2.43.1 the emitter computed `witnessSha256` over the raw rows, signed,
+ * and only then ran `scrubEvidence` over the finished bundle. A secret found in
+ * a row's `detail` or `evidence` was redacted AFTER the digest was taken, so
+ * the written rows no longer hashed to `witnessSha256` and the emitter's own
+ * self-verification refused the bundle (`[witness-digest]`, exit 2, no bundle)
+ * — openwop-app at major 1 on suite 2.43.0, 2026-09-28. The redaction was
+ * right and the check was right; the order was wrong. Everything the digest and
+ * the attestation cover is now scrubbed before either is computed, so the
+ * signed bytes are the shipped bytes.
+ */
+export function sealBundleV3(draft, secrets, privateKeyPem, keyId) {
+    const { value: scrubbed, redactedAt } = scrubEvidence(draft, secrets);
+    const unsigned = { ...scrubbed, witnessSha256: witnessDigest(scrubbed.results.requirements, scrubbed.host.relaxations, scrubbed.host.deployment) };
+    return { unsigned, bundle: { ...unsigned, signature: signBundleV3(unsigned, privateKeyPem, keyId) }, redactedAt };
+}
 export function publicKeyFromPrivate(privateKeyPem) {
     return createPublicKey(createPrivateKey(privateKeyPem)).export({ type: 'spki', format: 'pem' });
 }

package/dist/lib/scenario-disposition.js

@@ -142,6 +142,36 @@ testName) {
         return { disposition: 'blocked', detail: 'unclassified return: the test passed with zero assertions and recorded no reason — RFC 0148 §A resolves it to blocked, never to a pass' };
     return { disposition: 'skipped', detail: 'vitest skipped the test (ctx.skip / it.skip) without a recorded gate reason' };
 }
+/**
+ * The tests the per-test recorder never saw, as file states and failures.
+ *
+ * vitest runs a file's `afterEach` hooks in stack order, so a scenario's own
+ * `afterEach` (unregistering webhooks, closing a receiver) runs BEFORE the
+ * recorder `setup.ts` registers. If that hook throws or times out, vitest
+ * fails the test and skips the remaining hooks, so the recorder never runs.
+ * The file then has no recorded state, and its row read "no test executed and
+ * no disposition recorded" (`blocked`). That row gives no reason and hides a
+ * real failure. One tier-2 cut of `v2-webhook-message-id-stable` produced it
+ * on 2026-09-28.
+ *
+ * Only tests that finished `pass` or `fail` are recovered. A skipped test
+ * never reaches the recorder either way, and the existing rules already cover it.
+ */
+export function unrecordedTests(tests, recordedIds) {
+    const states = [];
+    const failures = [];
+    for (const t of tests) {
+        if (recordedIds.has(t.id))
+            continue;
+        if (t.state === 'pass')
+            states.push('pass');
+        else if (t.state === 'fail') {
+            states.push('fail');
+            failures.push({ name: t.name, message: `the test or its afterEach hook failed before the runner recorded it: ${t.message ?? 'no message'}` });
+        }
+    }
+    return { states, failures };
+}
 /**
  * The `executed-fail` detail for a file row: WHICH cases failed, and what the
  * first one said.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.43.0",
-  "stampSha256": "be64f880013ebf7f3327443eafa05d0e5e9eb993843d745981cc72bf18313133"
+  "version": "2.43.2",
+  "stampSha256": "79b88391faebb7060dbaab54084f7e00e9ffcbaad1534dada438fcaa500483f9"
 }

package/fixtures/conformance-approval-reject-loopback.json

@@ -0,0 +1,33 @@
+{
+  "id": "conformance-approval-reject-loopback",
+  "name": "Conformance: Approval (reject loops back)",
+  "version": "1.0",
+  "description": "openwop#1697. A rejected approval gate routed over an any_failed edge to revise, which loops back to the gate (bounded by settings.maxLoopbackIterations 2). Rejected once, the gate is visited again: the host MUST raise a new interrupt.requested with a different key and wait for a new decision, never replaying the first rejection. Conformance scenario: v2-approval-reject-disposition.test.ts.",
+  "nodes": [
+    { "id": "start", "typeId": "core.noop", "name": "Start", "position": { "x": 0, "y": 0 }, "config": {}, "inputs": {} },
+    {
+      "id": "gate",
+      "typeId": "core.approvalGate",
+      "name": "Approval Gate",
+      "position": { "x": 200, "y": 0 },
+      "config": {
+        "title": "Conformance approval (reject loops back)",
+        "description": "Conformance suite — reject once; the gate is asked again.",
+        "actions": ["accept", "reject"]
+      },
+      "inputs": {}
+    },
+    { "id": "revise", "typeId": "core.noop", "name": "Revise", "position": { "x": 400, "y": 0 }, "config": {}, "inputs": {} }
+  ],
+  "edges": [
+    { "id": "start-gate", "sourceNodeId": "start", "targetNodeId": "gate", "triggerRule": "any_success" },
+    { "id": "gate-revise", "sourceNodeId": "gate", "targetNodeId": "revise", "triggerRule": "any_failed" },
+    { "id": "revise-gate", "sourceNodeId": "revise", "targetNodeId": "gate", "triggerRule": "any_success" }
+  ],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [],
+  "metadata": { "tags": ["conformance", "hitl"] },
+  "settings": { "timeout": 0, "maxLoopbackIterations": 2 }
+}

package/fixtures/conformance-approval-reject-routed.json

@@ -0,0 +1,32 @@
+{
+  "id": "conformance-approval-reject-routed",
+  "name": "Conformance: Approval (reject routed)",
+  "version": "1.0",
+  "description": "RFC 0223 G1. An approval gate with two outgoing edges: an any_failed edge to on-reject and an all_success edge to on-accept. Rejected, the gate fails with approval_rejected, on-reject runs, on-accept never runs, and the run completes. Conformance scenario: v2-approval-reject-disposition.test.ts.",
+  "nodes": [
+    {
+      "id": "gate",
+      "typeId": "core.approvalGate",
+      "name": "Approval Gate",
+      "position": { "x": 0, "y": 0 },
+      "config": {
+        "title": "Conformance approval (reject routed)",
+        "description": "Conformance suite — reject to take the any_failed route.",
+        "actions": ["accept", "reject"]
+      },
+      "inputs": {}
+    },
+    { "id": "on-reject", "typeId": "core.noop", "name": "On reject", "position": { "x": 200, "y": -80 }, "config": {}, "inputs": {} },
+    { "id": "on-accept", "typeId": "core.noop", "name": "On accept", "position": { "x": 200, "y": 80 }, "config": {}, "inputs": {} }
+  ],
+  "edges": [
+    { "id": "gate-on-reject", "sourceNodeId": "gate", "targetNodeId": "on-reject", "triggerRule": "any_failed" },
+    { "id": "gate-on-accept", "sourceNodeId": "gate", "targetNodeId": "on-accept", "triggerRule": "all_success" }
+  ],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [],
+  "metadata": { "tags": ["conformance", "hitl"] },
+  "settings": { "timeout": 0 }
+}

package/fixtures/conformance-approval-timeout-approve.json

@@ -0,0 +1,46 @@
+{
+  "id": "conformance-approval-timeout-approve",
+  "name": "Conformance: Approval (timeout, onTimeout approve)",
+  "version": "1.0",
+  "description": "RFC 0223 / openwop#1696. An approval gate with a 1500 ms timeoutMs and onTimeout: approve. Nobody resolves it: a timeout never grants, so the host's timer resolves the gate rejected (action timeout, decision rejected, reason timeout), the gate fails with approval_rejected and the run fails. Conformance scenario: v2-approval-reject-disposition.test.ts.",
+  "nodes": [
+    {
+      "id": "gate",
+      "typeId": "core.approvalGate",
+      "name": "Approval Gate",
+      "position": {
+        "x": 0,
+        "y": 0
+      },
+      "config": {
+        "title": "Conformance approval (timeout, onTimeout approve)",
+        "description": "Conformance suite — do not resolve; the gate times out and MUST NOT be granted.",
+        "actions": [
+          "accept",
+          "reject"
+        ],
+        "timeoutMs": 1500,
+        "onTimeout": "approve"
+      },
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    {
+      "id": "manual",
+      "type": "manual",
+      "enabled": true
+    }
+  ],
+  "variables": [],
+  "metadata": {
+    "tags": [
+      "conformance",
+      "hitl"
+    ]
+  },
+  "settings": {
+    "timeout": 0
+  }
+}

package/fixtures/conformance-approval-timeout.json

@@ -0,0 +1,28 @@
+{
+  "id": "conformance-approval-timeout",
+  "name": "Conformance: Approval (timeout)",
+  "version": "1.0",
+  "description": "RFC 0223 G2. An approval gate with a 1500 ms timeoutMs and no onTimeout. Nobody resolves it: the host's timer resolves the gate rejected (action timeout, decision rejected, reason timeout), the gate fails with approval_rejected and the run fails naming it. Conformance scenario: v2-approval-reject-disposition.test.ts.",
+  "nodes": [
+    {
+      "id": "gate",
+      "typeId": "core.approvalGate",
+      "name": "Approval Gate",
+      "position": { "x": 0, "y": 0 },
+      "config": {
+        "title": "Conformance approval (timeout)",
+        "description": "Conformance suite — do not resolve; the gate times out.",
+        "actions": ["accept", "reject"],
+        "timeoutMs": 1500
+      },
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [],
+  "metadata": { "tags": ["conformance", "hitl"] },
+  "settings": { "timeout": 0 }
+}

package/fixtures/conformance-replay-ordinal-loop.json

@@ -0,0 +1,31 @@
+{
+  "id": "conformance-replay-ordinal-loop",
+  "name": "Conformance: Replay outcome keyed on the execution ordinal",
+  "version": "1.0",
+  "description": "openwop#1718. start → effect (a side-effecting node) → wait (core.delay) → back to effect, bounded by settings.maxLoopbackIterations 2, so effect executes twice. The suite cancels the source run inside wait, after effect's first execution completed and before its second, then forks mode:\"replay\" at effect's first node.started. In the fork, effect's first execution resolves from the recorded outcome for n = 1, and its second execution has no recorded outcome for n = 2, so it MUST fail closed with replay_source_missing (replay.md §Suppression rule 2). A host keying on (nodeId, attempt) or selecting the latest outcome resolves the second execution from the first and completes it. core.conformance.side-effect is the reserved side-effecting typeId (see conformance-replay-side-effect). Advertised only by a host that runs cycles and suppresses side effects in replay.",
+  "nodes": [
+    { "id": "start", "typeId": "core.noop", "name": "Start", "position": { "x": 0, "y": 0 }, "config": {}, "inputs": {} },
+    { "id": "effect", "typeId": "core.conformance.side-effect", "name": "Side Effect", "position": { "x": 200, "y": 0 }, "config": {}, "inputs": {} },
+    {
+      "id": "wait",
+      "typeId": "core.delay",
+      "name": "Wait",
+      "position": { "x": 400, "y": 0 },
+      "config": {},
+      "inputs": { "delayMs": { "type": "variable", "variableName": "delayMs" } }
+    }
+  ],
+  "edges": [
+    { "id": "start-effect", "sourceNodeId": "start", "targetNodeId": "effect", "triggerRule": "any_success" },
+    { "id": "effect-wait", "sourceNodeId": "effect", "targetNodeId": "wait" },
+    { "id": "wait-effect", "sourceNodeId": "wait", "targetNodeId": "effect", "triggerRule": "any_success" }
+  ],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    { "name": "delayMs", "type": "number", "defaultValue": 3000 }
+  ],
+  "metadata": { "tags": ["conformance", "replay"] },
+  "settings": { "timeout": 0, "maxLoopbackIterations": 2 }
+}

package/fixtures.md

@@ -49,6 +49,10 @@ All fixtures MUST advertise:
 | Approval                                  | `conformance-approval`                                                                          | Verifies HITL approval interrupt + resume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `completed` after resolve                                                           | unbounded (suspends)         |
 | Approval (refine)                         | `conformance-approval-refine`                                                                   | RFC 0183 — refine resolution carries action + refineFeedback                                                        |
 | Approval (edit-accept)                    | `conformance-approval-edit-accept`                                                                 | RFC 0183 — edit-accept resolution carries action + editedArtifactData                                                        |
+| Approval (reject routed) | `conformance-approval-reject-routed` | RFC 0223 G1 — a rejected gate is routed over an `any_failed` edge; its `all_success` sibling never runs | `completed` after reject | unbounded (suspends) |
+| Approval (timeout) | `conformance-approval-timeout` | RFC 0223 G2 — a 1500 ms `timeoutMs`, no `onTimeout`: the host's timer resolves the gate rejected | `failed` (`approval_rejected`) after the timeout | ~1.5 s + the host's sweep |
+| Approval (timeout, onTimeout approve) | `conformance-approval-timeout-approve` | openwop#1696 — a 1500 ms `timeoutMs` with `onTimeout: approve`: a timeout never grants, so the gate still resolves rejected | `failed` (`approval_rejected`) after the timeout | ~1.5 s + the host's sweep |
+| Approval (reject loops back) | `conformance-approval-reject-loopback` | openwop#1697 — a rejected gate routed back to itself through `revise` is asked again under a new `key` | `waiting-approval` again after one reject (the suite cancels) | unbounded (suspends) |
 | Clarification                             | `conformance-clarification`                                                                     | Verifies HITL clarification interrupt + resume                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `completed` after resolve                                                           | unbounded (suspends)         |
 | Clarification (nested schema)             | `conformance-clarification-nested`                                                              | RFC 0199 §D.2(d) probe — an answer schema an MCP mount MUST NOT bridge in form mode                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `completed` after resolve                                                           | unbounded (suspends)         |
 | Clarification (sensitive field)           | `conformance-clarification-sensitive`                                                           | RFC 0199 §D.2(d) probe — `format: "password"`; form mode MUST be refused                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `completed` after resolve                                                           | unbounded (suspends)         |
@@ -57,6 +61,7 @@ All fixtures MUST advertise:
 | Idempotent                                | `conformance-idempotent`                                                                        | Verifies `Idempotency-Key` cache                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `completed`                                                                         | ≤ 5s                         |
 | Cancellable                               | `conformance-cancellable`                                                                       | Verifies `:cancel` endpoint mid-run                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `cancelled` after cancel                                                            | ≤ 60s (input-controlled)     |
 | Replay Side-Effect Suppression            | `conformance-replay-side-effect`                                                                | RFC 0140. Verifies a `mode:"replay"` fork does NOT re-fire a side-effecting node                                                                                                                                                                                                                                                                                                                                                                                                                                        | fork `failed` (`error.code='replay_source_missing'`)                                | ≤ 60s (input-controlled)     |
+| Replay ordinal loop | `conformance-replay-ordinal-loop` | openwop#1718 — a side-effecting node executed twice in a loop; a replay fork keys each execution by its ordinal `n` | `cancelled` (source); fork: execution 2 fails `replay_source_missing` | ~3 s + fork |
 | Capability Missing                        | `conformance-capability-missing`                                                                | Verifies dispatch refusal on unsatisfied `requires`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `failed` (`error.code='capability_not_provided'`)                                   | ≤ 5s                         |
 | Prompt End-to-End                         | `conformance-prompt-end-to-end`                                                                 | RFC 0027 + RFC 0029 end-to-end. Single `mock-ai` node with `config.systemPromptRef` set; host MUST emit `agent.promptResolved` + `prompt.composed` events during dispatch, then complete. Capability-gated on `capabilities.prompts.supported`.                                                                                                                                                                                                                                                                                                                                                                                                           | `completed`                                                                         | ≤ 10s                        |
 | Prompt All Four Kinds                     | `conformance-prompt-all-four-kinds`                                                             | RFC 0027 §A four-kind dispatch coverage with a MULTI-ENTRY `fewShotPromptRefs[]` array. Single `mock-ai` node with one ref per singular-kind slot (`systemPromptRef`, `userPromptRef`, `schemaHintPromptRef`) + two distinct templateIds in `fewShotPromptRefs[]`; host MUST emit 5 `agent.promptResolved` events (one per slot) AND 5 `prompt.composed` events. Multi-entry few-shot is the regression pin for `fewShotPromptRefs[slotIndex]` per-index resolution — a host that hard-codes `[0]` would emit the same template twice in the few-shot events and fail the per-templateId assertion. Capability-gated on `capabilities.prompts.supported`. | `completed`                                                                         | ≤ 10s                        |
@@ -211,6 +216,54 @@ The `messages`-mode stream fixture (AI token streaming) is covered by the determ
   5. An `edit-accept` resolution supplying no `editedArtifactData` MUST be refused.
 - **Why it is separate**: same reason as `conformance-approval-refine` — widening a registered fixture's `actions` forces every host to re-register a test-only change.
 
+### `conformance-approval-reject-routed`
+
+- **Purpose**: witness that a rejected approval gate is a failed source a workflow can route (RFC 0223 §A, gap G1; `spec/v2/core/interrupt.md` §Rejection).
+- **Inputs**: none.
+- **Behavior**:
+  1. Run starts and reaches the `gate` (`core.approvalGate`, actions `accept | reject`).
+  2. Run status MUST be `waiting-approval`.
+  3. Client POSTs `{action: 'reject'}` to the interrupt.
+  4. `gate` MUST emit `node.failed` with `error.code` `approval_rejected` and `retryable: false`.
+  5. `on-reject` (incoming edge `triggerRule: any_failed`) MUST run to `node.completed`.
+  6. `on-accept` (incoming edge `triggerRule: all_success`) MUST NOT run: no `node.started` or `node.completed` for it. A host MAY record `node.skipped`; the spec does not require it.
+  7. Run reaches `completed`.
+- **Terminal status (after reject)**: `completed`.
+- **Why it is separate from `conformance-approval`**: that fixture has no edges, and giving it some would force every host to re-register a registered definition.
+
+### `conformance-approval-timeout`
+
+- **Purpose**: witness the timeout disposition (RFC 0223 §A, gap G2).
+- **Inputs**: none.
+- **Behavior**:
+  1. Run starts and reaches the `gate` (`core.approvalGate`, `config.timeoutMs: 1500`, no `onTimeout`). The host carries the node's `timeoutMs` onto the interrupt payload.
+  2. Run status MUST be `waiting-approval`.
+  3. Nobody resolves it. After the deadline, the host MUST resolve the gate itself: `interrupt.resolved` with `action: "timeout"`, `decision: "rejected"`, `reason: "timeout"`.
+  4. `gate` MUST emit `node.failed` with `error.code` `approval_rejected`, and `run.failed` MUST carry `approval_rejected` with `failedNodeId: "gate"`.
+- **Terminal status**: `failed`.
+- **Timing**: the suite waits up to 20 s (scaled) for the terminal state; a host's timer granularity is its own.
+
+### `conformance-approval-timeout-approve`
+
+- **Purpose**: witness that a timeout never grants a gate, whatever `onTimeout` holds (`spec/v2/core/interrupt.md` §Rejection; RFC 0223 §C as corrected by openwop#1696).
+- **Inputs**: none.
+- **Behavior**: as `conformance-approval-timeout`, with `config.onTimeout: "approve"`. After the deadline, the host MUST resolve the gate rejected (`action: "timeout"`, `decision: "rejected"`, `reason: "timeout"`), `gate` MUST fail with `approval_rejected`, and the run MUST NOT complete.
+- **Terminal status**: `failed`.
+- **Why it is separate**: `conformance-approval-timeout` witnesses the absent case; this one witnesses the value that used to read as permission to fail open.
+
+### `conformance-approval-reject-loopback`
+
+- **Purpose**: witness that `key` is per visit (`spec/v2/core/interrupt.md` §Re-entry and resume values, openwop#1697).
+- **Inputs**: none.
+- **Graph**: `start` (`core.noop`) → `gate` (`any_success`); `gate` → `revise` (`core.noop`, `any_failed`); `revise` → `gate` (`any_success`). `settings.maxLoopbackIterations: 2`.
+- **Behavior**:
+  1. Run reaches `gate` and MUST be `waiting-approval`.
+  2. Client POSTs `{action: 'reject'}`. `gate` fails with `approval_rejected`, and `revise` runs.
+  3. `gate` runs again. The host MUST raise a second `interrupt.requested` for `gate` with a different `key`, and the run MUST be `waiting-approval` again.
+  4. The first rejection MUST NOT be replayed into the second visit: only one `interrupt.resolved` is on the log.
+- **Terminal status**: none reached by the suite, which cancels the run.
+- **Advertise only if** the host runs cycles. A host that does not MUST NOT advertise the fixture, and the row is `inapplicable`.
+
 ### `conformance-clarification`
 
 - **Purpose**: verify HITL clarification interrupt + resume.
@@ -251,6 +304,17 @@ The `messages`-mode stream fixture (AI token streaming) is covered by the determ
   3. Server emits `run.cancelled` within 5s.
   4. Subsequent `GET /v1/runs/{runId}` MUST return `status: "cancelled"`.
 
+### `conformance-replay-ordinal-loop`
+
+- **Purpose**: witness that a replay fork keys a side-effecting node's recorded outcome on `(sourceRunId, nodeId, n)`, where `n` counts the node's `node.started` events through this execution (`spec/v2/core/replay.md` §Suppression rule 2, openwop#1718).
+- **Shape**: `start` (`core.noop`) → `effect` (`core.conformance.side-effect`, `any_success`) → `wait` (`core.delay`) → `effect` (`any_success`); `settings.maxLoopbackIterations: 2`, so `effect` executes twice.
+- **Inputs**: `delayMs` (integer, default 3000), long enough to cancel inside `wait`.
+- **Expected behavior**:
+  1. The source run completes `effect`'s first execution. The client cancels it inside `wait`, before the second execution.
+  2. The client forks `mode: "replay"` at `effect`'s first `node.started`.
+  3. In the fork, execution 1 (n = 1) resolves from the recorded outcome. Execution 2 (n = 2) has none, so it MUST fail closed with `replay_source_missing` and MUST NOT complete.
+- **Advertise only if** the host runs cycles and maps `core.conformance.side-effect` to a side-effecting node (see `conformance-replay-side-effect`).
+
 ### `conformance-replay-side-effect`
 
 - **Purpose**: verify RFC 0140 — a `mode:"replay"` fork MUST NOT re-perform a side-effecting node's effect.
@@ -524,7 +588,7 @@ The fixtures reference these typeIds:
 | `core.noop`                   | noop, multi-node, approval, clarification, cancellable | Immediate completion, no output                                                                                                                                                          |
 | `core.identity`               | identity                                               | Echo `input.payload` to `output.payload`                                                                                                                                                 |
 | `core.delay`                  | delay, cancellable                                     | Sleep `config.delayMs` ms                                                                                                                                                                |
-| `core.fail`                   | failure                                                | Throw with `code: "conformance_test_failure"`, message: "Intentional conformance failure"                                                                                                |
+| `core.fail`                   | failure                                                | Throw with `code: "example.conformance_failure"` (a vendor code under the registered `example` org; errors.md §The registry, openwop#1698), message: "Intentional conformance failure"                                                                                                |
 | `core.approvalGate`           | approval                                               | Call `ctx.interrupt({kind: 'approval', ...})`                                                                                                                                            |
 | `core.clarificationGate`      | clarification                                          | Call `ctx.interrupt({kind: 'clarification', ...})`                                                                                                                                       |
 | `conformance.requiresMissing` | capability-missing                                     | Declares `requires: ['conformance.never-provided']`; engine MUST refuse dispatch. Opt-in fixture registration is recommended so production deployments don't expose the fixture surface. |
@@ -588,6 +652,10 @@ conformance/
     conformance-approval.json
     conformance-approval-refine.json
     conformance-approval-edit-accept.json
+    conformance-approval-reject-routed.json
+    conformance-approval-timeout.json
+    conformance-approval-timeout-approve.json
+    conformance-approval-reject-loopback.json
     conformance-clarification.json
     conformance-multi-node.json
     conformance-idempotent.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.43.0",
+  "version": "2.43.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.43.0"
+    "@openwop/spec-artifacts": "2.43.2"
   }
 }