@openwop/openwop-conformance 2.45.1 → 2.45.3

package/CHANGELOG.md

@@ -1,5 +1,67 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.3] — 2026-10-01 — RFC 0229 (Active): a production host can witness secret resolution without an oracle; v2 tenant-isolation witnesses for storage, fs, memory, workspace, queues and secrets
+
+- **Two self-checks that failed on every host are fixed before the cut.** Found by running the candidate on openwop-app at major 1 against 2.45.2: four rows went `executed-pass` → `executed-fail`, and both files failed the same way with no host.
+  - `host-callback-declaration`: `v2-tool-authorization-fail-closed` imports `lib/effect-receiver` and now exports `REQUIRES_HOST_CALLBACK`.
+  - `runner-ledger`: the derivation emits the any-of summary row for `openwop-secrets` whatever profile is claimed, as it does the prefix rows. The test's synthetic report holds neither member, so the row is `blocked`; the test now asserts that and excludes it from the claimed floor's pass count. The derivation is unchanged.
+  - The rest of that diff was as intended: no row newly `blocked`, the four `0083.trigger-delivery.*` rows and the any-of row `executed-pass`, `secrets-run-witness` and `trigger-refused-event-keeps-subscription` `inapplicable`.
+- **The 2.45.3 cycle opens.** RFC 0229's gap register changes the packed `spec/v1/gaps.json`.
+- **A lost response is `blocked`, not `executed-fail`** (#1829).
+  - **Bound.** `driver.request` gives each request 20 s (`REQUEST_TIMEOUT_MS`, scaled by `OPENWOP_POLL_TIMEOUT_SCALE`), below vitest's 30 s `testTimeout`. The body read is under the same bound. A caller's own `signal` replaces the bound, and its abort is rethrown as-is.
+  - **Named.** A timeout or a failed connection throws `TransportError` (`transport-loss: <METHOD> <origin+path> got no response …`). The query string is dropped from the message.
+  - **Recorded.** A test that fails on a transport loss before its first assertion records `blocked`; the file row follows when every failure in it is one and nothing was asserted. A loss after an assertion stays `executed-fail`, and an assertion failure is never excused.
+  - **Why.** On MyndHyve's 2.45.2 cut the runner's network dropped for about 9 s. `v2-mcp-client-results` hung to the harness timeout and recorded `executed-fail` with 0 assertions against a host that had answered in 2.6 ms. `blocked` still denies certification, so a flaky runner cannot certify; it can no longer convict the host.
+  - **Proof.** `src/lib/driver-transport-loss.test.ts` (10 cases): a local server that never answers yields a timeout `TransportError` well inside the bound; without the classification the same failure is `executed-fail`.
+- **New scenario `v2-eval-mode-unadvertised-refused`** (major 2, unaided): a host that does not advertise `agents.evalSuite` answers `POST /runs {mode: "eval"}` with `422 capability_not_provided` (`runs.md` §Refusals; `openwop.requirement.runs.eval-mode-unadvertised-refused`). The eval scenarios ran at major 1 only, so nothing measured this at major 2. A host that advertises the facet records `inapplicable`. If a host wrongly accepts the create, the leg cancels the run before asserting.
+  - **Proof.** Passes on the v2 reference host with openwop-examples #143; fails on the host without it, which answered `capability_required`.
+- **`trigger-bridge-delivery`: a normative-surface witness path (RFC 0230), and one requirement per leg.**
+  - **Split.** The single combined `it` becomes four, each with its own requirement id: `openwop.requirement.0083.trigger-delivery.{dedup,dead-letter,causation,runless-content-free}`. The old per-`it` id aliases to the dedup leg.
+  - **Seam path unchanged.** It stays the primary witness whenever the host serves the seams.
+  - **Normative-surface path.** When the seams are absent and the host advertises `triggerBridge.ingestion.inboundSigning: ["standard-webhooks-1"]`, legs 1–3 run it. The suite registers a webhook subscription, then POSTs Standard-Webhooks-signed bodies to its `ingestUrl` with no OpenWOP credential:
+    - dedup: 202, then `200 duplicate` with the same `runId`;
+    - dead-letter: a bad signature gets 401 with no run, the subscription stays `active` (RFC 0230 §C.1), and a signed post then gets 202;
+    - causation: `run.started.causationId` via the run's own event poll.
+  - **Run-less content-freeness** stays seam-only, since those events are on no run's log. It **stays in the floor**, which never narrows: a seam-free host records one honest red row instead of three.
+  - **Proof.** Measured on openwop-app with the RFC 0230 route on and the seams off: legs 1–3 pass in strict mode on the new path. Sabotaged host builds each fail only their own leg:
+    - a duplicate `webhook-id` starting a new run fails dedup;
+    - a bad signature accepted fails dead-letter;
+    - a refused post dead-lettering the subscription fails dead-letter;
+    - a missing `causationId` fails causation.
+- **RFC 0229 `Active`** (the window is waived by steward override of RFC 0147 §A.6). Two new scenarios, `secrets-run-witness` (major 1) and `v2-secrets-run-witness` (major 2), share `lib/run-secrets-witness.ts`. Each draws a fresh 64-character value `C` per run, supplies it as `createRun.runSecrets` under `run:openwop-witness`, and runs the fixture `openwop-secrets-run-witness`. Four rows, the same ids at both majors:
+  - `openwop.requirement.secrets.run-witness-resolves`: `matched: true` for `C`, and `false` when `expectedSha256` names another value;
+  - `openwop.requirement.secrets.run-witness-redacted`: `C` is absent from the create answer, snapshot, polled and `debug`-mode events, the run list and the debug bundle where served. The scan reads raw text and covers every encoding RFC 0229 §F lists. It also covers the digest, wherever the suite did not send that digest itself;
+  - `openwop.requirement.secrets.run-witness-scope-bound`: a non-`run:` ref fails `credential_forbidden`; an unsupplied or earlier run's `run:` ref fails `credential_not_found`; a branch fork, where served, fails `credential_not_found`;
+  - `openwop.requirement.secrets.run-secrets-outside-request-digest`: a same-key retry differing only in `runSecrets` replays with the original `runId` and `OpenWOP-Idempotent-Replay: true`, is never `409 idempotency_key_mismatch`, and its value appears nowhere.
+
+  **Dispositions.** Facet absent: `inapplicable`. Facet without the fixture: `blocked`. A refused well-formed `runSecrets`: `executed-fail`.
+
+  **Sabotage.** Each row failed against a scratch host with its defect: a witness that resolves a stored secret by a non-`run:` name, an echoed value, an emitted digest, a digest-covering idempotency record, a fork that inherits, and a cross-run fallback. The clean host passed all four rows at both majors.
+- **The `openwop-secrets` floor is an any-of group** (`requiredAnyOf`, RFC 0229 §E). It is satisfied by a witnessed pass of `byok-roundtrip` or `secrets-run-witness` with no member failing, and never by an `inapplicable` one. The runner writes one summary row, `openwop.floor.anyof.byok-roundtrip+secrets-run-witness`, and both bundle verifiers and the `--certify` witness count read it. `src/lib/floor-any-of.test.ts` pins this.
+  - `byok-roundtrip` records `inapplicable` instead of `blocked` when the canary fixture is withheld and the host advertises `secrets.runSecrets` and the witness fixture. A host that takes the other path is not denied the bundle over a canary it does not serve.
+  - Otherwise `byok-roundtrip` is unchanged.
+- **Host impact: none today.** No committed bundle and neither live production host advertises `secrets.runSecrets`, so both new files record `inapplicable` everywhere, and `byok-roundtrip` keeps its current disposition.
+- **New v2 tenant-isolation witnesses** from `docs/V2-WITNESS-COVERAGE.md`, each sabotage-proved against a host with the exact defect: `v2-storage-cross-tenant-isolation` (eight families, one id each), `v2-fs-sandbox-escape-refused` (absolute, `..`, symlink), `v2-memory-cross-tenant-isolation`, `v2-workspace-scope-from-identity`, `v2-queue-cross-tenant-isolation`, and `v2-secret-canary-absent` (a host-resolved secret on no readable surface, including after a failure and in a fork). Each is `inapplicable` where its family is not advertised; MyndHyve runs the memory and secret-canary legs.
+- **`memory-attribution-replay-stable` runs on v2 hosts.** `emitsWriteEvents()` (`lib/memoryAttribution.ts`) required `attribution.supported === true`, a field a v2 family record does not have (presence is the claim, RFC 0169 §A.2), so the file recorded `inapplicable` on every v2 host, including the two that advertise `memory.attribution.emitsWriteEvents: true`. At major 2 it now reads `emitsWriteEvents` on the present record; major 1 still requires `supported`. `memoryWrittenEvents()` read `GET /runs/{runId}/events` at major 2, which is the SSE stream, so once the gate opened every leg would have recorded `blocked` ("run wrote no memory"). It now reads `GET /runs/{runId}/events/poll` and pages on `afterSequence`. No other `conformance/src/lib` helper that a major-2 scenario imports has the same bug (`toolCatalog`, `context-budget` and `run-secrets-witness` were already major-aware). Sabotage: against a loopback v2 stub, the clean host passes, and a replay that re-mints ids, one that suppresses them, and one that adds a fresh id each fail. A host without the facet records `inapplicable`. Self-test: `lib/memoryAttribution.test.ts`.
+- **New scenario `trigger-refused-event-keeps-subscription` (major 1), for the §F.2 Class 3 correction (RFC 0230 risk R3).** Row `openwop.requirement.trigger-bridge.refused-event-keeps-subscription`. The row is gated on the `openwop-trigger-bridge` profile and on `webhook` in `triggerBridge.ingestion.externalSources`. It drives the delivery seam's new OPTIONAL `scenario: "refused"`, then `deliver` on the same `subscriptionId`, and asserts three things:
+  - the refused event is a dead-lettered `trigger.delivery.attempted` and starts no run;
+  - no `trigger.subscription.state.changed` is emitted, and the subscription reads back `active`;
+  - the next verified event on that subscription is delivered.
+
+  **Dispositions.** Seam without `refused` (`400`): `blocked` (fails under strict mode). No `webhook` ingestion: `inapplicable`.
+
+  **Sabotage.** Proved against a loopback stub. The corrected host passes (default and strict). Each defective variant fails: the old subscription-level transition with its `state.changed`; the same transition with no event (the read shows `dead-lettered`); a refused event that starts a run. **Host impact:** trigger scenarios are major-1 only and no committed bundle carries one; a major-1 host that derives the profile with `webhook` ingestion records `blocked` until its seam serves `refused`.
+
+## [2.45.2] — 2026-09-30 — a run-failure code must be registered or a vendor code (no longer advisory)
+
+- **`errors.event-code-registered` is required** (#1698). The leg in `v2-error-registry` shipped ADVISORY in 2.43.1: an unregistered, non-vendor code on `run.failed`, `node.failed` or the snapshot's `error` recorded a partial witness naming the codes, while hosts remapped. That branch is removed, so such a code now fails the row, which names each `where=code`.
+  - **Evidence.** All three hosts' latest certified bundles record it as a clean `executed-pass` (2 assertions, no partial-witness detail), each verified under the key its host serves:
+    - the v2 reference host at 2.44.6 (witness `188a23d56886`);
+    - MyndHyve at 2.44.3 (`58da9407e616`);
+    - openwop-app at 2.44.5 (build `ab77c3aa`, `cb16716e1be6`).
+  - **Negative control.** A stub host whose failed run carries `totally_unregistered_code` passed the advisory leg and now fails it. A vendor code (`example.conformance_failure`) still passes.
+  - **Ids.** The title drops "(advisory in 2.43.1)". The per-`it` id is unchanged, since the slug is capped before those words.
+
 ## [2.45.1] — 2026-09-29 — the run-list legs stop walking once they find their runs, and no scenario skips every test at describe level
 
 - **No scenario file skips every test at describe level any more, and the guard is a hard rule** (patch; no requirement added or removed; the gates are identical, and only their placement moves).

package/README.md

@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 575 scenario files under `src/scenarios/`.
+The current suite has 587 scenario files under `src/scenarios/`.
 - 2026-09-29 (suite 2.45.0, openwop#1763): NEW `v2-cors-preflight.test.ts` — `headers.md` §Cross-origin preflight. For every operation it preflights with `Origin`, the method, and the operation's declared request headers (plus `authorization` / `content-type` where they apply, from `spec/v2/path-manifest.json`), and reads the answer as the Fetch standard's CORS-preflight check does. Self-gated: `inapplicable` when no operation's preflight grants `OPENWOP_CORS_ORIGIN` (default `https://conformance.invalid`).
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
@@ -482,7 +482,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 575 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 587 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -646,7 +646,7 @@ async function runCertify(args, baseUrl, apiKey) {
             const floor = PROFILE_FLOOR_SCENARIOS[profile];
             if (!floor)
                 return 0;
-            const onFloor = (scenario) => floor.required.includes(scenario) || (floor.requiredAnyPrefix ?? []).some((pre) => scenario.startsWith(pre));
+            const onFloor = (scenario) => floor.required.includes(scenario) || (floor.requiredAnyPrefix ?? []).some((pre) => scenario.startsWith(pre)) || (floor.requiredAnyOf ?? []).some((g) => g.includes(scenario));
             return derived.requirements.filter((r) => r.disposition === 'executed-pass' && onFloor(r.scenarioId)).length;
         };
         // `certified` IS the verdict (RFC 0148 §A; RFC 0168 §E.1 adds the bundle-wide

package/dist/lib/certification-bundle-verify.js

@@ -26,7 +26,7 @@
 import { createHash } from 'node:crypto';
 import { PROFILE_FLOOR_SCENARIOS, profileDerivable, } from './profiles.js';
 import { CERTIFIABLE, DISPOSITIONS } from './requirement-ledger.js';
-import { floorFilesFor, requirementIdForPrefix, requirementIdForScenario } from './requirement-registry.js';
+import { floorFilesFor, requirementIdForAnyOf, requirementIdForPrefix, requirementIdForScenario } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 /**
  * The BYOK conformance canary (`fixtures.md` §conformance-secrets-roundtrip;
@@ -84,6 +84,7 @@ function requiredFor(profile, document) {
     return {
         files: [...files],
         prefixes: [...(floor.requiredAnyPrefix ?? [])],
+        anyOf: [...(floor.requiredAnyOf ?? [])],
         discoveryOnly: floor.discoveryOnly === true,
     };
 }
@@ -192,6 +193,26 @@ export function verifyBundleV2(bundle) {
             if (!considered.some((r) => isWitnessedPass(r)))
                 notCertifiable.push(id);
         }
+        for (const group of req.anyOf) {
+            // RFC 0229 §E: one requirement, satisfied by a WITNESSED pass of any
+            // member with no member failing. The emitter writes a summary row under
+            // the group id; member rows are read when it is absent.
+            const id = requirementIdForAnyOf(group);
+            required.push(id);
+            const summary = byId.get(id)?.[0];
+            const members = group.map((f) => byId.get(requirementIdForScenario(scenarioBasename(f)))?.[0]).filter((r) => r !== undefined);
+            if (summary === undefined && members.length === 0) {
+                profileRejections.push({ kind: 'unwitnessed-requirement', profile, requirementId: id, detail: `${id}: no alternative (${group.join(', ')}) recorded a row` });
+                continue;
+            }
+            const considered = summary !== undefined ? [summary] : members;
+            if (considered.some((r) => r.disposition === 'executed-pass' && !isWitnessedPass(r))) {
+                profileRejections.push({ kind: 'vacuous-pass', profile, requirementId: id, detail: `${id}: executed-pass with no witnessed assertion` });
+                continue;
+            }
+            if (considered.some((r) => r.disposition === 'executed-fail') || !considered.some((r) => isWitnessedPass(r)))
+                notCertifiable.push(id);
+        }
         const evidenceValid = profileRejections.length === 0;
         const certified = derivable && evidenceValid && notCertifiable.length === 0 && (req.discoveryOnly || required.length > 0);
         return { profile, derivable, floorUnspecified: false, required, rejections: profileRejections, notCertifiable, evidenceValid, certified };

package/dist/lib/profiles.js

@@ -462,6 +462,10 @@ export function hasProfile(c, profile) {
             return isTriggerBridge(c);
     }
 }
+/** Every scenario FILE a floor names: `required`, every `conditional` branch, and every `requiredAnyOf` member. */
+export function floorMemberFiles(floor) {
+    return [...floor.required, ...(floor.conditional ?? []).flatMap((c) => c.required), ...(floor.requiredAnyOf ?? []).flat()];
+}
 export const PROFILE_FLOOR_SCENARIOS = {
     'openwop-core-standard': {
         required: [
@@ -531,7 +535,11 @@ export const PROFILE_FLOOR_SCENARIOS = {
     // `profiles.md` §`openwop-secrets`: credential resolution per `run-options.md`
     // §"Credential references" — the BYOK canary round-trip (`fixtures.md`
     // §conformance-secrets-roundtrip, SR-1) is the profile's proof.
-    'openwop-secrets': { required: ['byok-roundtrip.test.ts'] },
+    // RFC 0229 §E (2026-09-30): a SECOND floor path, as an any-of group. The
+    // canary fixture's node is an oracle over whatever its name reaches, so a
+    // production host rightly withholds it; the run-witness reads only a value
+    // the caller supplied with the same run and outputs only `matched`.
+    'openwop-secrets': { required: [], requiredAnyOf: [['byok-roundtrip.test.ts', 'secrets-run-witness.test.ts']] },
     // `profiles.md` §`openwop-provider-policy`: the four-mode taxonomy shape and
     // its enforcement on the wire.
     'openwop-provider-policy': { required: ['policies.test.ts', 'providerPolicyEnforcement.test.ts'] },
@@ -650,9 +658,16 @@ export function verifyBundleProfile(bundle, profile) {
     }
     const missingFloor = requiredFiles.filter((r) => !passed.has(scenarioBasename(r)));
     const prefixOk = (floor.requiredAnyPrefix ?? []).every((p) => [...passed].some((s) => s.startsWith(p)));
+    // RFC 0229 §E any-of groups: a v1 bundle lists only what passed, so a group
+    // holds when one member is in `results.passed`; an unmet group is reported
+    // as missing, spelled as its alternatives.
+    const groups = floor.requiredAnyOf ?? [];
+    for (const g of groups)
+        if (!g.some((f) => passed.has(scenarioBasename(f))))
+            missingFloor.push(g.join(' | '));
     // A conditional floor none of whose branches matched requires nothing — that
     // is unprovable for a non-discovery-only profile, not proven.
-    const evaluable = floor.discoveryOnly === true || requiredFiles.length > 0 || (floor.requiredAnyPrefix ?? []).length > 0;
+    const evaluable = floor.discoveryOnly === true || requiredFiles.length > 0 || (floor.requiredAnyPrefix ?? []).length > 0 || groups.length > 0;
     const floorProven = evaluable && missingFloor.length === 0 && prefixOk;
     return {
         profile,

package/dist/lib/requirement-registry.js

@@ -32,6 +32,14 @@ export function requirementIdForScenario(scenarioFile) {
 export function requirementIdForPrefix(prefix) {
     return `openwop.floor.any.${prefix}`;
 }
+/**
+ * Any-of groups (RFC 0229 §E) become one requirement:
+ * `['byok-roundtrip.test.ts', 'secrets-run-witness.test.ts']` →
+ * `openwop.floor.anyof.byok-roundtrip+secrets-run-witness`.
+ */
+export function requirementIdForAnyOf(files) {
+    return `openwop.floor.anyof.${files.map((f) => f.replace(/\.test\.ts$/, '')).join('+')}`;
+}
 /**
  * The requirement IDs a profile's certification rests on.
  *
@@ -121,6 +129,7 @@ export function requirementsFor(profile, document) {
     return [
         ...files.map(requirementIdForScenario),
         ...(floor.requiredAnyPrefix ?? []).map(requirementIdForPrefix),
+        ...(floor.requiredAnyOf ?? []).map(requirementIdForAnyOf),
     ];
 }
 /** Every registered requirement ID across every profile with a runtime floor. */
@@ -137,6 +146,12 @@ export function allRequirements() {
                 ids.add(requirementIdForScenario(f));
         for (const p of floor.requiredAnyPrefix ?? [])
             ids.add(requirementIdForPrefix(p));
+        // an any-of group is one requirement, and each member file records under its own floor id
+        for (const g of floor.requiredAnyOf ?? []) {
+            ids.add(requirementIdForAnyOf(g));
+            for (const f of g)
+                ids.add(requirementIdForScenario(f));
+        }
         void profile;
     }
     return [...ids].sort();

package/dist/lib/scenario-disposition.js

@@ -26,24 +26,20 @@
  * host or a vitest subprocess.
  */
 import { scenarioFileOfItId } from './requirement-ids.js';
-import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
+import { PROFILE_FLOOR_SCENARIOS, floorMemberFiles } from './profiles.js';
 import { targetMajor } from './seams.js';
 import { PKG_ROOT_PATH } from './paths.js';
 import { v2ProfileFloorFiles } from './requirement-registry.js';
-import { requirementIdForScenario, requirementIdForPrefix, requirementsFor, v2FloorsActive } from './requirement-registry.js';
+import { requirementIdForScenario, requirementIdForPrefix, requirementIdForAnyOf, requirementsFor, v2FloorsActive } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
 import { CERTIFIABLE } from './requirement-ledger.js';
 /** All scenario basenames that appear in some profile's runtime floor. */
 export function floorScenarioFiles() {
     const out = new Set();
-    for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) {
-        for (const f of floor.required)
+    for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS))
+        for (const f of floorMemberFiles(floor))
             out.add(f);
-        for (const c of floor.conditional ?? [])
-            for (const f of c.required)
-                out.add(f);
-    }
     // At target major 2 the floors come from the declaration, not the v1 hand
     // table. The ledger and --certify MUST agree on this set, or a floor file is
     // minted `openwop.scenario.*` and looked up as `openwop.floor.*` — which is
@@ -77,10 +73,13 @@ export function requirementIdForFile(basename) {
  * the thing that passed.
  */
 export const PARTIAL_WITNESS_PREFIX = 'partial-witness: ';
+/** `driver.ts`'s `TRANSPORT_LOSS_PREFIX`, restated so this module stays free of the driver (a test pins the two equal). */
+export const TRANSPORT_LOSS_MARK = 'transport-loss: ';
 /**
  * The per-`it` record (RFC 0148 §A at test granularity), as `setup.ts`
  * computes it in `afterEach`. Pure so a lib test can pin it:
  *   - fail                         ⇒ executed-fail (detail = the first error message)
+ *   - fail on a driver transport loss, 0 assertions ⇒ blocked (#1829: nothing was observed)
  *   - pass with ≥ 1 assertion      ⇒ executed-pass
  *   - a behaviorGate entry journaled during the test ⇒ that gate's disposition
  *   - pass with 0 assertions       ⇒ the softSkip note written DURING THIS TEST
@@ -114,6 +113,15 @@ blockedStands = false,
 /** The `it` title, so a failed row says WHICH leg of the requirement failed. */
 testName) {
     if (state === 'fail') {
+        // #1829: the driver got no response (`TransportError`) before the test
+        // asserted anything. Nothing about the host was observed, so this is not a
+        // verdict on it. `blocked` still denies certification, so a flaky runner
+        // cannot certify; it just cannot convict the host either. A loss AFTER an
+        // assertion stays `executed-fail`: the test was mid-measurement, and a host
+        // that stops answering part-way is a finding.
+        if (assertionCalls === 0 && firstError !== undefined && firstError.includes(TRANSPORT_LOSS_MARK)) {
+            return { disposition: 'blocked', detail: firstError.slice(firstError.indexOf(TRANSPORT_LOSS_MARK), firstError.indexOf(TRANSPORT_LOSS_MARK) + 300) };
+        }
         const where = testName === undefined || testName.trim() === '' ? '' : ` in "${testName.slice(0, 120)}"`;
         return { disposition: 'executed-fail', detail: `the test executed and failed${where}: ${(firstError ?? 'no message').slice(0, 300)}` };
     }
@@ -198,6 +206,11 @@ export function failureDetail(failures, failedCount) {
  *  the ONE disposition the file records. */
 export function fileDisposition(states, gateReason, assertionCount, failures = []) {
     const failed = states.filter((s) => s === 'fail').length;
+    // #1829, the file-level half of `resolveItRecord`'s rule: every failure was a
+    // driver transport loss and the file asserted nothing, so nothing was observed.
+    if (failed > 0 && assertionCount === 0 && failures.length === failed && failures.every((f) => f.message?.includes(TRANSPORT_LOSS_MARK) === true)) {
+        return { disposition: 'blocked', detail: `no response reached the suite in ${failed} test(s); first: ${failures[0].message.slice(failures[0].message.indexOf(TRANSPORT_LOSS_MARK)).slice(0, 300)}` };
+    }
     if (failed > 0)
         return { disposition: 'executed-fail', detail: failureDetail(failures, failed) };
     if (states.some((s) => s === 'pass')) {
@@ -381,6 +394,34 @@ document) {
         }
         rows.push(row);
     }
+    // Any-of requirements (RFC 0229 §E): one summary row per group, derived from
+    // its member files. Satisfied only by a WITNESSED pass (assertions > 0) with
+    // no member failing; `inapplicable`/`skipped` members never satisfy it. v1
+    // hand table only, like the prefix groups (the major-2 floors have none).
+    const groups = new Map();
+    if (!v2FloorsActive())
+        for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS))
+            for (const g of floor.requiredAnyOf ?? [])
+                groups.set(requirementIdForAnyOf(g), g);
+    for (const [id, members] of [...groups.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+        const scenarioId = `anyof:${members.join('|')}`;
+        const matching = members.map((f) => perFile.get(f)).filter((r) => r !== undefined);
+        const witnessed = matching.filter((r) => r.disposition === 'executed-pass' && (r.assertionCount ?? 0) > 0);
+        let row;
+        if (matching.some((r) => r.disposition === 'executed-fail')) {
+            row = { requirementId: id, scenarioId, disposition: 'executed-fail', detail: `an alternative failed: ${matching.filter((r) => r.disposition === 'executed-fail').map((r) => r.scenarioId).join(', ')}` };
+        }
+        else if (witnessed.length > 0) {
+            row = { requirementId: id, scenarioId, disposition: 'executed-pass', assertionCount: witnessed.reduce((n, r) => n + (r.assertionCount ?? 0), 0) };
+        }
+        else if (matching.length === 0) {
+            row = { requirementId: id, scenarioId, disposition: 'blocked', detail: `none of ${members.join(', ')} ran — unclassified return` };
+        }
+        else {
+            row = { requirementId: id, scenarioId, disposition: 'blocked', detail: `no alternative recorded a witnessed pass (${matching.map((r) => `${r.scenarioId}: ${r.disposition}`).join(', ')})` };
+        }
+        rows.push(row);
+    }
     // Per-`it` rows (suite 1.153.0): every ledger entry keyed `openwop.it.<file>.<slug>`
     // becomes its own bundle row, attributed to its scenario file. Additive — the
     // file-level and prefix rows above are unchanged, and the floors still key on
@@ -440,7 +481,7 @@ document) {
         const atMajor2 = v2FloorsActive();
         for (const id of ids) {
             const r = rowById.get(id);
-            const fromLedger = byId.has(id) || (r !== undefined && r.scenarioId.endsWith('*'));
+            const fromLedger = byId.has(id) || (r !== undefined && (r.scenarioId.endsWith('*') || r.scenarioId.startsWith('anyof:')));
             if (r !== undefined && r.disposition === 'executed-pass' && (r.assertionCount ?? 0) > 0)
                 witnessedPasses += 1;
             // Unclassified: no row, or a report-derived blocked (nothing recorded), or a

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.1",
-  "stampSha256": "936dd4e3e65e05d7ee49e2507fe818d6adce84fce582c0f78ce7def2343caff6"
+  "version": "2.45.3",
+  "stampSha256": "2b7ce94326d2cb0fa88b311a7d6d89c0a0b68f03e66934ad49a19722904a75e7"
 }

package/fixtures/conformance-fs-probe.json

@@ -0,0 +1,25 @@
+{
+  "id": "conformance-fs-probe",
+  "name": "Conformance: v2 fs sandbox probe",
+  "version": "1.0",
+  "description": "Fixture for `v2-fs-sandbox-escape-refused.test.ts` (spec/v2/core/storage.md §`fs`). One node, `core.conformance.fs-probe` (conformance-RESERVED): a host that advertises `fs` maps it to a node that calls its OWN `ctx.fs` with the run's inputs and nothing else. `op: write` calls `write(path, utf8(content), \"text/plain\")` and completes with `outputs.result` = the resolved `{ path, sizeBytes }`; `op: read` calls `read(path)` and completes with `outputs.result = { content }`, the bytes decoded as UTF-8. The node passes `path` through UNCHANGED (no normalisation of its own, so the host's sandbox check is what is exercised). A rejection fails the node with the rejection's code and details, unchanged. Operator contract: `<sandboxRoot>/conformance/escape-link` is a symbolic link to a readable file OUTSIDE the root. A host that does not advertise `fs` MUST NOT advertise this fixture.",
+  "nodes": [
+    {
+      "id": "fs-probe",
+      "typeId": "core.conformance.fs-probe",
+      "name": "Probe ctx.fs",
+      "position": { "x": 0, "y": 0 },
+      "config": {},
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [{ "id": "manual", "type": "manual", "enabled": true }],
+  "variables": [
+    { "name": "op", "type": "string", "defaultValue": "read" },
+    { "name": "path", "type": "string" },
+    { "name": "content", "type": "string" }
+  ],
+  "metadata": { "tags": ["conformance", "storage", "fs", "security"] },
+  "settings": { "timeout": 0 }
+}

package/fixtures/conformance-queue-consume.json

@@ -0,0 +1,27 @@
+{
+  "id": "conformance-queue-consume",
+  "name": "Conformance: Queue Consume",
+  "version": "1.0",
+  "description": "host-services.md §queueBus — node 'consume' (conformance.queue.probe, action 'consume') calls ctx.queueBus.consume on `topic` under the run's own tenant for up to config.waitMs, acks every message it receives, and outputs { consumed: [<payload.message of each, in order>] } — [] when none arrived, never unset. Paired with conformance-queue-publish. See v2-queue-cross-tenant-isolation.test.ts.",
+  "nodes": [
+    {
+      "id": "consume",
+      "typeId": "conformance.queue.probe",
+      "name": "Consume",
+      "position": { "x": 0, "y": 0 },
+      "config": { "action": "consume", "waitMs": 1000 },
+      "inputs": {
+        "topic": { "type": "variable", "variableName": "topic" }
+      }
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    { "name": "topic", "type": "string", "description": "Topic to consume from.", "required": true }
+  ],
+  "metadata": { "tags": ["conformance", "queue", "security"] },
+  "settings": { "timeout": 10000, "maxRetries": 0 }
+}

package/fixtures/conformance-queue-publish.json

@@ -0,0 +1,29 @@
+{
+  "id": "conformance-queue-publish",
+  "name": "Conformance: Queue Publish",
+  "version": "1.0",
+  "description": "host-services.md §queueBus — node 'publish' (conformance.queue.probe, action 'publish') calls ctx.queueBus.publish({ topic, payload: { message } }) under the run's own tenant and outputs { published: true }. Paired with conformance-queue-consume. See v2-queue-cross-tenant-isolation.test.ts.",
+  "nodes": [
+    {
+      "id": "publish",
+      "typeId": "conformance.queue.probe",
+      "name": "Publish",
+      "position": { "x": 0, "y": 0 },
+      "config": { "action": "publish" },
+      "inputs": {
+        "topic": { "type": "variable", "variableName": "topic" },
+        "message": { "type": "variable", "variableName": "message" }
+      }
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    { "name": "topic", "type": "string", "description": "Topic to publish on.", "required": true },
+    { "name": "message", "type": "string", "description": "Opaque message string carried as payload.message.", "required": true }
+  ],
+  "metadata": { "tags": ["conformance", "queue", "security"] },
+  "settings": { "timeout": 10000, "maxRetries": 0 }
+}

package/fixtures/conformance-safefetch-probe.json

@@ -0,0 +1,23 @@
+{
+  "id": "conformance-safefetch-probe",
+  "name": "Conformance: v2 safeFetch SSRF probe",
+  "version": "1.0",
+  "description": "Fixture for `v2-safefetch-ssrf-refused.test.ts` (spec/v2/core/host-services.md §`httpClient`). One node, `core.conformance.safefetch-probe` (conformance-RESERVED): a host that advertises `httpClient.safeFetch` maps it to a node that calls its OWN `ctx.http.safeFetch(url)` with the run's `url` input, unchanged, and nothing else (method GET, no headers, no body). On success it completes with `outputs.result = { status }`, the response status only (never the body, so the fixture is not a read proxy). A rejection fails the node with the rejection's code and details, unchanged (a refused target is `egress_denied`, `details.reason: ssrf-blocked`; an unreachable one `upstream_unavailable`). A host that does not advertise `httpClient.safeFetch` MUST NOT advertise this fixture.",
+  "nodes": [
+    {
+      "id": "safefetch-probe",
+      "typeId": "core.conformance.safefetch-probe",
+      "name": "Probe ctx.http.safeFetch",
+      "position": { "x": 0, "y": 0 },
+      "config": {},
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [{ "id": "manual", "type": "manual", "enabled": true }],
+  "variables": [
+    { "name": "url", "type": "string" }
+  ],
+  "metadata": { "tags": ["conformance", "httpClient", "safeFetch", "ssrf", "security"] },
+  "settings": { "timeout": 0 }
+}

package/fixtures/conformance-secret-resolve-then-fail.json

@@ -0,0 +1,33 @@
+{
+  "id": "conformance-secret-resolve-then-fail",
+  "name": "Conformance: Secret Resolve Then Fail",
+  "version": "1.0",
+  "description": "host-services.md §secrets — node 'resolve-secret' (conformance.secret.echo) resolves the host-provisioned canary 'openwop-conformance-canary-secret' exactly as openwop-smoke-byok-roundtrip does and outputs only {secretSha256, secretLength}; node 'fail' (core.fail) then fails the run. The canary MUST appear on no readable surface of the failed run: snapshot, error, events, or any error envelope. See v2-secret-canary-absent.test.ts.",
+  "nodes": [
+    {
+      "id": "resolve-secret",
+      "typeId": "conformance.secret.echo",
+      "name": "Resolve Canary Secret",
+      "position": { "x": 0, "y": 0 },
+      "config": { "secretId": "openwop-conformance-canary-secret" },
+      "inputs": {}
+    },
+    {
+      "id": "fail",
+      "typeId": "core.fail",
+      "name": "Fail After Resolve",
+      "position": { "x": 200, "y": 0 },
+      "config": { "message": "Intentional failure after resolving the conformance canary" },
+      "inputs": {}
+    }
+  ],
+  "edges": [
+    { "id": "resolve-then-fail", "sourceNodeId": "resolve-secret", "targetNodeId": "fail" }
+  ],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [],
+  "metadata": { "tags": ["conformance", "byok", "secrets", "security"] },
+  "settings": { "timeout": 10000, "maxRetries": 0 }
+}

package/fixtures/conformance-storage-probe.json

@@ -0,0 +1,27 @@
+{
+  "id": "conformance-storage-probe",
+  "name": "Conformance: v2 storage tenant-isolation probe",
+  "version": "1.0",
+  "description": "Fixture for `v2-storage-cross-tenant-isolation.test.ts` (spec/v2/core/storage.md §Shared rules, tenant isolation). One node, `core.conformance.storage-probe` (conformance-RESERVED): a host maps it to a node that calls its OWN storage service for the run's tenant, the one `family` names (kvStorage | tableStorage | blobStorage | cache | vectorStore | searchIndex | sql | nosql), with the run's inputs, and nothing else. `action: write` stores `value` under `key` and completes with `outputs.result = { written: true, ref? }`; `action: read` completes with `outputs.result = { values, keys }`, every value and every key the family's tenant-isolated read operations return for `key` (and for `ref`, when given); `action: delete` removes it. A rejection fails the node with the rejection's code, unchanged. The per-family mapping is in conformance/fixtures.md §\"The storage probe fixture\". A host MUST NOT advertise this fixture unless it implements it for every storage family it advertises.",
+  "nodes": [
+    {
+      "id": "storage-probe",
+      "typeId": "core.conformance.storage-probe",
+      "name": "Probe host storage",
+      "position": { "x": 0, "y": 0 },
+      "config": {},
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [{ "id": "manual", "type": "manual", "enabled": true }],
+  "variables": [
+    { "name": "family", "type": "string", "defaultValue": "kvStorage" },
+    { "name": "action", "type": "string", "defaultValue": "read" },
+    { "name": "key", "type": "string" },
+    { "name": "value", "type": "string" },
+    { "name": "ref", "type": "string" }
+  ],
+  "metadata": { "tags": ["conformance", "storage", "tenant-isolation"] },
+  "settings": { "timeout": 0 }
+}

package/fixtures/conformance-tool-scope-probe.json

@@ -0,0 +1,27 @@
+{
+  "id": "conformance-tool-scope-probe",
+  "name": "Conformance: per-tool authorization probe",
+  "version": "1.0",
+  "description": "host-services.md §toolHooks (`perToolAuthorization`) — one node, `core.conformance.scoped-tool` (conformance-RESERVED): a host that advertises `toolHooks.perToolAuthorization` maps it to ONE external tool call, of the tool `conformance.scope-probe`, made through the host's ordinary tool-invocation path as the run's principal, with the tool's `requiredScopes` set to `[inputs.requiredScope]` (or `[]` when it is empty or absent). The tool, when invoked, POSTs `{}` to `inputs.url` and returns `{ invoked: true }`. The per-tool authorization check runs before it, as for any tool: a lacked or unevaluable scope MUST NOT invoke it, MUST emit `agent.tool-returned { status: forbidden }`, and fails the node with the refusal — `forbidden` with `details.scope: \"tool\"`, `toolName` and `requiredScopes` — unchanged. Operator contract: no principal holds `conformance:never-granted`, and evaluating `conformance:unevaluable` errors. See conformance/fixtures.md §`conformance-tool-scope-probe` and v2-tool-authorization-fail-closed.test.ts.",
+  "nodes": [
+    {
+      "id": "scoped-tool",
+      "typeId": "core.conformance.scoped-tool",
+      "name": "Call a scoped tool",
+      "position": { "x": 0, "y": 0 },
+      "config": { "toolName": "conformance.scope-probe" },
+      "inputs": {
+        "requiredScope": { "type": "variable", "variableName": "requiredScope" },
+        "url": { "type": "variable", "variableName": "url" }
+      }
+    }
+  ],
+  "edges": [],
+  "triggers": [{ "id": "manual", "type": "manual", "enabled": true }],
+  "variables": [
+    { "name": "requiredScope", "type": "string", "description": "The one scope the tool requires; empty for none (the positive control).", "defaultValue": "" },
+    { "name": "url", "type": "string", "description": "Where the tool POSTs when it is invoked — the suite's receiver.", "required": true }
+  ],
+  "metadata": { "tags": ["conformance", "toolHooks", "security"] },
+  "settings": { "timeout": 15000, "maxRetries": 0 }
+}

package/fixtures/openwop-secrets-run-witness.json

@@ -0,0 +1,29 @@
+{
+  "id": "openwop-secrets-run-witness",
+  "name": "Conformance: Run-supplied secret witness",
+  "version": "1.0",
+  "description": "RFC 0229 §C. One node, 'witness' (typeId core.secret.witness), whose 'ref' and 'expectedSha256' inputs come from the run's inputs of the same names. The client supplies the value with the run (top-level runSecrets on createRun, under a reserved run: ref that resolves only within that run); the node compares the SHA-256 of the resolved value with expectedSha256 and outputs only { matched }. A ref without the run: prefix fails credential_forbidden without resolving anything; an unsupplied run: ref fails credential_not_found. It can only confirm a value the caller already holds, so it is safe to advertise in production. Advertised by every host that advertises secrets.runSecrets. Spec: host-services.md §Run-supplied secrets (v2), capabilities.md §Run-supplied secrets (v1).",
+  "nodes": [
+    {
+      "id": "witness",
+      "typeId": "core.secret.witness",
+      "name": "Witness Run Secret",
+      "position": { "x": 0, "y": 0 },
+      "config": {},
+      "inputs": {
+        "ref": { "type": "variable", "variableName": "ref" },
+        "expectedSha256": { "type": "variable", "variableName": "expectedSha256" }
+      }
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    { "name": "ref", "type": "string", "required": true },
+    { "name": "expectedSha256", "type": "string", "required": true }
+  ],
+  "metadata": { "tags": ["conformance", "secrets", "run-witness"] },
+  "settings": { "timeout": 10000, "maxRetries": 0 }
+}