@openwop/openwop-conformance 2.45.13 → 2.45.15

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 594,
+    "files": 615,
     "v1": 455,
-    "v2": 154
+    "v2": 175
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1299,6 +1299,12 @@
     "v2-agent-org-chart-served-shape.test.ts": [
       2
     ],
+    "v2-ai-envelope-shape-static.test.ts": [
+      2
+    ],
+    "v2-ai-providers-advertisement.test.ts": [
+      2
+    ],
     "v2-approval-reject-disposition.test.ts": [
       2
     ],
@@ -1389,6 +1395,18 @@
     "v2-enum-growth-rule.test.ts": [
       2
     ],
+    "v2-envelope-reasoning-shape.test.ts": [
+      2
+    ],
+    "v2-envelope-tier-one-subset-static.test.ts": [
+      2
+    ],
+    "v2-envelope-variant-discriminator-static.test.ts": [
+      2
+    ],
+    "v2-envelopes-advertisement.test.ts": [
+      2
+    ],
     "v2-era-2-append-vocabulary.test.ts": [
       2
     ],
@@ -1425,6 +1443,9 @@
     "v2-header-scheme.test.ts": [
       2
     ],
+    "v2-i18n-negotiation.test.ts": [
+      2
+    ],
     "v2-id-grammar.test.ts": [
       2
     ],
@@ -1455,6 +1476,12 @@
     "v2-legacy-profiles-absent.test.ts": [
       2
     ],
+    "v2-limits-envelope-caps-advertisement.test.ts": [
+      2
+    ],
+    "v2-localized-content-delivery.test.ts": [
+      2
+    ],
     "v2-malformed-body-envelope.test.ts": [
       2
     ],
@@ -1473,6 +1500,9 @@
     "v2-mcp-tasks.test.ts": [
       2
     ],
+    "v2-media-inline-cap-static.test.ts": [
+      2
+    ],
     "v2-memory-cross-tenant-isolation.test.ts": [
       2
     ],
@@ -1482,6 +1512,12 @@
     "v2-minimum-version-refused.test.ts": [
       2
     ],
+    "v2-model-capabilities-advertisement.test.ts": [
+      2
+    ],
+    "v2-model-capability-insufficient.test.ts": [
+      2
+    ],
     "v2-mrtr-rounds-ceiling.test.ts": [
       2
     ],
@@ -1536,6 +1572,30 @@
     "v2-profiles-derived-only.test.ts": [
       2
     ],
+    "v2-prompt-all-four-kinds-events.test.ts": [
+      2
+    ],
+    "v2-prompt-end-to-end-events.test.ts": [
+      2
+    ],
+    "v2-prompt-list-and-fetch.test.ts": [
+      2
+    ],
+    "v2-prompt-mutable-lifecycle.test.ts": [
+      2
+    ],
+    "v2-prompt-pack-install.test.ts": [
+      2
+    ],
+    "v2-prompt-render-deterministic.test.ts": [
+      2
+    ],
+    "v2-prompt-resolution-chain-event.test.ts": [
+      2
+    ],
+    "v2-prompt-template-shape.test.ts": [
+      2
+    ],
     "v2-protected-resource-metadata.test.ts": [
       2
     ],
@@ -1575,6 +1635,9 @@
     "v2-run-diff-identical.test.ts": [
       2
     ],
+    "v2-run-execution-bounds.test.ts": [
+      2
+    ],
     "v2-run-fork-ancestry.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.13",
-  "corpusTag": "v2.45.13",
+  "version": "2.45.15",
+  "corpusTag": "v2.45.15",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "e04f33a55093271aa1d8c1de7e9415c234e0422e1d51c78eaf89e4f45fface82",
-    "api/v2/asyncapi.yaml": "ae7e64de2b5bca421d98e244ddf4f25a20e22555945c39b2095661d074c994cb",
-    "api/v2/openapi.yaml": "eb07406e2e79a0f6096fbc50a509028568bff40edf11f6d736d97711b20a3db7",
+    "api/seams-v2.yaml": "b8a98faeb78af296f41b6c4bb926d8c01d45b5b81974d785924d6d4efa939831",
+    "api/v2/asyncapi.yaml": "667763e99e9bbaf49ed0468e2f10fca37a94327fb1d6a6168d011ab4e892066e",
+    "api/v2/openapi.yaml": "be44d7aa5c911d59c2a993206bb9b491070ad8551d03d49be04371cac7e6b6af",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "bd1c00fae7b6fda506a75aff841bbdc438d4ce092642a72041203bee999b88de",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -207,13 +207,14 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "0e4fef9b14346bff71b5141679bc5a8b5325a0025c49155cdf17fa985c6d9ecf",
+    "spec/v1/core-standard-manifest.json": "430abcd05b35ca4fbb14f21f1d7a76a7408d80a795986b6c6a4aa525870e7624",
     "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
+    "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "54fd7e55136294a2f852f95c87209bb991947e5075e56ffa23679dcf2f5c50ff",
+    "spec/v1/gaps.json": "68e23cccf787f77e31710671baa3618ca24ee6eada68df84a7b55dc746762a2a",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -238,7 +239,7 @@
     "spec/v2/core/interrupt.md": "10f15dfe30baa0fc748aea0a067f9b271bea316fde6b598d78f77edc296f698a",
     "spec/v2/core/node-pack-runtimes.md": "e1088cb69b8c3c67256c494063328916c2980ab1aa97a7063de25bab82fdb1e5",
     "spec/v2/core/oauth.md": "c069ae4f9aae2eafe14c07c0bf709aa7ade0dcc821973d740400d49d901f7061",
-    "spec/v2/core/overview.md": "d7000fbcd2f59280870fc592f5d5ea28a5195b9eb209029f09c5de59e0f2bf9c",
+    "spec/v2/core/overview.md": "999cb657711d6c28e62032fc31a013cc175f7a981a3b012e4bf4a90a2b84344c",
     "spec/v2/core/packs.md": "0d1516c4b08fe67b85759feb9ccbafdd766216435a4a0a7e58e27e6f9fe6b6cc",
     "spec/v2/core/persistence.md": "249a1de353f421cdf92b9006a13a10afdb002f4029eb6a13520cc95252edb2ec",
     "spec/v2/core/portability.md": "ab13a6ca43544b9a6a91edfb377ec680c768d14be841c84fb79125b231426891",
@@ -247,13 +248,14 @@
     "spec/v2/core/security-defaults.md": "887d8c4bc592094e3b931c23f1c2175c18ebbd47528b074016f9d2091bc513b2",
     "spec/v2/core/storage.md": "dc94b985847c1341c7a064f04a6010f0fdbe6c3ab3e555d4362878c81d764c18",
     "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
-    "spec/v2/core/versioning.md": "fe48f4514b9c9f998d5da1930b8faa02ca4de89dcd49b07d95414fb04c67d438",
+    "spec/v2/core/versioning.md": "348a6dc5bd3425efc0016bb6772d5d04ebf578b73eebcdfec6c2d82346a8577e",
     "spec/v2/core/webhooks.md": "daf6ec03092f4b3fde1eb74a5e2e801ec48db5139a13fcc0fd7fb4a004635ae3",
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "3a8d93e33865b692d26a3b6bfd3819766e206b2e0c2a69669baa4bf833d05a49",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
     "spec/v2/declaration.json": "e963d3aa73892ee08281227c8a01aa6c06f1b825cdcb26aab029b1ab3f4155bf",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
+    "spec/v2/eos-override.json": "4c72d2f6a658943b01c1de1643cf294642091933af7832f38ee5495df684cb2d",
     "spec/v2/errors.json": "83f048b0a06952b4af6f125fb66c4212acab51056b411390f1010acd6ab9cdc0",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
@@ -307,9 +309,9 @@
     "spec/v2/path-manifest.json": "b84c7561f50c7df0cb61b202bd6595acad3ee7edca7a45f711949bea3c69bd27",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "38fa895f3288a59e95ec9d37b7d493c897bc7a174e9cde0f82d65d0d235ddff5",
+    "spec/v2/release.json": "75a6a33e253e1015ff582bcd3dbc2ed23cd8bea95e12d34006ee3239c91b71bb",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "c53a82ff3aa935978d29ed7832ce4df54792c12a81c987cd524a9f8e3f85b099"
+    "spec/v2/surface-baseline.json": "49311a9dd16aaa597d1c6724aa24456edd5f372d9b7d0bd6f5f1647f68db6db8"
   },
-  "corpusCommit": "9419dea220a38f0c498b48e894d43992f34ce5d5"
+  "corpusCommit": "eef96d5601f777c4bf94d9c2a69b06df86948172"
 }

package/src/lib/backpressure-witness.ts

@@ -89,7 +89,7 @@ export async function saturate(profile: MajorProfile, discovery: unknown): Promi
       streams.push(ctl);
       // `Accept: text/event-stream` keeps the request in flight; without it a
       // negotiating host answers a one-shot snapshot and the slot drops.
-      const stream = fetch(`${env.baseUrl}${profile.runsPath}/${encodeURIComponent(runId)}/events`, {
+      const stream = fetch(`${env.baseUrl}${profile.runsPath}/${profile.idSegment(runId)}/events`, {
         headers: { Authorization: `Bearer ${env.apiKey}`, Accept: 'text/event-stream', ...profile.versionHeaders },
         signal: ctl.signal,
       }).then((r) => r.status, () => null);
@@ -127,7 +127,7 @@ export async function saturate(profile: MajorProfile, discovery: unknown): Promi
     if (runIds.length > 0) {
       const bulk = await http(() => driver.post(`${profile.runsPath}:bulk-cancel`, { runIds }));
       if (bulk === null || bulk.status >= 400) {
-        for (const id of runIds) await http(() => driver.post(`${profile.runsPath}/${encodeURIComponent(id)}/cancel`, {}));
+        for (const id of runIds) await http(() => driver.post(`${profile.runsPath}/${profile.idSegment(id)}/cancel`, {}));
       }
     }
     await Promise.allSettled(pending);

package/src/lib/budget-witness.ts

@@ -59,7 +59,7 @@ async function readEvents(profile: MajorProfile, runId: string): Promise<RunEven
   const out: RunEvent[] = [];
   let after = 0;
   for (let page = 0; page < 50; page++) {
-    const res = await http(() => driver.get(`${profile.runsPath}/${encodeURIComponent(runId)}/events/poll?timeout=1&afterSequence=${after}`));
+    const res = await http(() => driver.get(`${profile.runsPath}/${profile.idSegment(runId)}/events/poll?timeout=1&afterSequence=${after}`));
     if (res === null || res.status !== 200) return page === 0 ? null : out;
     const batch = (res.json as { events?: unknown } | undefined)?.events;
     if (!Array.isArray(batch) || batch.length === 0) return out;
@@ -101,11 +101,11 @@ export async function drive(profile: MajorProfile, discovery: unknown, timeoutMs
   const deadline = Date.now() + timeoutMs;
   let snap: Record<string, unknown> | null = null;
   for (;;) {
-    const res = await http(() => driver.get(`${profile.runsPath}/${encodeURIComponent(runId)}`));
+    const res = await http(() => driver.get(`${profile.runsPath}/${profile.idSegment(runId)}`));
     snap = res?.status === 200 && isRecord(res.json) ? res.json : null;
     if (snap !== null && TERMINAL.has(String(snap['status']))) break;
     if (Date.now() > deadline) {
-      await http(() => driver.post(`${profile.runsPath}/${encodeURIComponent(runId)}/cancel`, {}));
+      await http(() => driver.post(`${profile.runsPath}/${profile.idSegment(runId)}/cancel`, {}));
       return { kind: 'skip', disposition: 'blocked', reason: `the budgeted run did not reach a terminal status within ${timeoutMs} ms (last: ${snap === null ? 'unreadable' : String(snap['status'])})` };
     }
     await new Promise((r) => setTimeout(r, 250));

package/src/lib/envelope-schema-static.ts

@@ -0,0 +1,166 @@
+/**
+ * Static walkers over envelope payload schemas, shared by the v2 static twins
+ * `v2-envelope-tier-one-subset-static` and `v2-envelope-variant-discriminator-static`.
+ *
+ * The walk rules are the v1 rules unchanged (RFC 0030 §B, RFC 0031 §A); what
+ * moved at major 2 is where the schemas live (`schemas/v2/envelopes/`) and
+ * where a host's kind catalog is advertised (`supportedEnvelopes.kinds`, a
+ * family record, instead of a root `string[]`).
+ *
+ * Every function here is pure and is proven in both directions in
+ * `envelope-schema-static.test.ts`: a conforming schema yields no violation,
+ * and each defect yields the one it names.
+ */
+
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { SCHEMAS_DIR } from './paths.js';
+
+export interface SchemaViolation { readonly path: string; readonly rule: string; readonly detail?: string }
+
+const isRecord = (v: unknown): v is Record<string, unknown> => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+/** The v2 envelope payload schema directory. */
+export const V2_ENVELOPES_DIR = join(SCHEMAS_DIR, 'v2', 'envelopes');
+
+/** The four kinds every engine recognizes (`events.md` §"AI envelopes"). */
+export const UNIVERSAL_KINDS = ['clarification.request', 'schema.request', 'schema.response', 'error'] as const;
+
+/** A v2 envelope payload schema by kind, or `null` when the corpus has none. */
+export function loadV2EnvelopeSchema(kind: string): Record<string, unknown> | null {
+  const p = join(V2_ENVELOPES_DIR, `${kind}.schema.json`);
+  if (!existsSync(p)) return null;
+  const v: unknown = JSON.parse(readFileSync(p, 'utf8'));
+  return isRecord(v) ? v : null;
+}
+
+/** Every kind with a payload schema under `schemas/v2/envelopes/`. */
+export function listV2EnvelopeKinds(): string[] {
+  if (!existsSync(V2_ENVELOPES_DIR)) return [];
+  return readdirSync(V2_ENVELOPES_DIR).filter((f) => f.endsWith('.schema.json')).map((f) => f.replace(/\.schema\.json$/, '')).sort();
+}
+
+// ---------------------------------------------------------------------------
+// RFC 0030 §B — the Tier-1 structured-output subset.
+// ---------------------------------------------------------------------------
+
+/** Keywords that fail across more than one Tier-1 vendor (Gemini drops `oneOf` silently). Checked in both modes. */
+const LOAD_BEARING_KEYWORDS = ['oneOf', 'allOf', 'not', 'if', 'then', 'else', 'dependencies', 'prefixItems', 'propertyNames'] as const;
+export const MAX_DEPTH = 5;
+export const MAX_PROPERTIES = 100;
+
+const hasType = (schema: Record<string, unknown>, t: string): boolean => schema['type'] === t || (Array.isArray(schema['type']) && (schema['type'] as unknown[]).includes(t));
+
+/**
+ * Walk a payload schema for Tier-1 subset violations.
+ *
+ * `load-bearing`: only the rules that fail across several vendors — the floor
+ * every corpus schema is held to. `strict`: every rule of the OpenAI-strict ∩
+ * Anthropic-strict ∩ Gemini intersection, applied only when a host advertises
+ * `envelopes.tierOneSubsetCompliance: "strict"`.
+ */
+export function tierOneViolations(schema: Record<string, unknown>, mode: 'load-bearing' | 'strict'): SchemaViolation[] {
+  const out: SchemaViolation[] = [];
+  const count = { n: 0 };
+  walkTierOne(schema, '#', 0, count, out, mode);
+  if (count.n > MAX_PROPERTIES) out.push({ path: '#', rule: 'max-property-count-100-exceeded', detail: `count=${count.n}` });
+  return out;
+}
+
+function walkTierOne(schema: Record<string, unknown>, path: string, depth: number, count: { n: number }, out: SchemaViolation[], mode: 'load-bearing' | 'strict'): void {
+  if (depth > MAX_DEPTH) { out.push({ path, rule: 'max-nesting-depth-5', detail: `depth=${depth}` }); return; }
+  for (const kw of LOAD_BEARING_KEYWORDS) if (kw in schema) out.push({ path, rule: 'forbidden-keyword', detail: kw });
+  if (Array.isArray(schema['anyOf'])) {
+    (schema['anyOf'] as unknown[]).forEach((b, i) => { if (isRecord(b)) walkTierOne(b, `${path}/anyOf/${i}`, depth + 1, count, out, mode); });
+  }
+  if (hasType(schema, 'object')) {
+    if (mode === 'strict' && schema['additionalProperties'] !== false) out.push({ path, rule: 'additionalProperties-must-be-false-on-object-strict-only' });
+    const props = isRecord(schema['properties']) ? schema['properties'] : {};
+    const required = Array.isArray(schema['required']) ? (schema['required'] as unknown[]) : [];
+    for (const [name, sub] of Object.entries(props)) {
+      count.n++;
+      if (mode === 'strict' && !required.includes(name)) out.push({ path: `${path}/properties/${name}`, rule: 'property-not-in-required-strict-mode-only' });
+      if (isRecord(sub)) walkTierOne(sub, `${path}/properties/${name}`, depth + 1, count, out, mode);
+    }
+  }
+  if (mode === 'strict') {
+    const bounded: Array<[boolean, readonly string[], string]> = [
+      [hasType(schema, 'string'), ['minLength', 'maxLength', 'pattern', 'format'], 'forbidden-string-constraint-strict-only'],
+      [hasType(schema, 'number') || hasType(schema, 'integer'), ['minimum', 'maximum', 'multipleOf'], 'forbidden-number-constraint-strict-only'],
+      [hasType(schema, 'array'), ['minItems', 'maxItems', 'uniqueItems'], 'forbidden-array-constraint-strict-only'],
+    ];
+    for (const [applies, kws, rule] of bounded) if (applies) for (const kw of kws) if (kw in schema) out.push({ path, rule, detail: kw });
+  }
+  if (hasType(schema, 'array') && isRecord(schema['items'])) walkTierOne(schema['items'], `${path}/items`, depth + 1, count, out, mode);
+  const defs = isRecord(schema['$defs']) ? schema['$defs'] : {};
+  for (const [name, sub] of Object.entries(defs)) if (isRecord(sub)) walkTierOne(sub, `${path}/$defs/${name}`, depth + 1, count, out, mode);
+}
+
+// ---------------------------------------------------------------------------
+// RFC 0031 §A — variant payloads: no `oneOf`; every `anyOf` branch discriminated.
+// ---------------------------------------------------------------------------
+
+/** `oneOf` anywhere in a payload schema. */
+export function oneOfViolations(schema: unknown, path = '#'): SchemaViolation[] {
+  const out: SchemaViolation[] = [];
+  const walk = (s: unknown, p: string): void => {
+    if (Array.isArray(s)) { s.forEach((x, i) => walk(x, `${p}/${i}`)); return; }
+    if (!isRecord(s)) return;
+    if ('oneOf' in s) out.push({ path: p, rule: 'oneOf-forbidden', detail: 'use anyOf with a single-string-enum discriminator (RFC 0031 §A)' });
+    for (const [k, v] of Object.entries(s)) walk(v, `${p}/${k}`);
+  };
+  walk(schema, path);
+  return out;
+}
+
+/**
+ * A branch is discriminated when one of its `required` properties is
+ * `type: string` with an `enum` of exactly one value. A `$ref` branch is
+ * accepted unresolved, as at v1: the referenced shape is walked where it is
+ * defined, and a version-selected union (one branch per `schemaVersion`, as
+ * `ui.a2ui-surface` declares) is not a payload-field discrimination at all.
+ */
+export function branchDiscriminated(branch: unknown): boolean {
+  if (!isRecord(branch)) return false;
+  if ('$ref' in branch) return true;
+  const required = Array.isArray(branch['required']) ? (branch['required'] as unknown[]) : [];
+  const props = isRecord(branch['properties']) ? branch['properties'] : {};
+  return required.some((name) => {
+    const p = typeof name === 'string' ? props[name] : undefined;
+    return isRecord(p) && p['type'] === 'string' && Array.isArray(p['enum']) && (p['enum'] as unknown[]).length === 1;
+  });
+}
+
+/** Whether a branch can match a JSON object: an explicit object type, a `$ref`, or object keywords with no type. */
+function admitsObject(branch: unknown): boolean {
+  if (!isRecord(branch)) return false;
+  if ('$ref' in branch) return true;
+  const t = branch['type'];
+  if (t === undefined) return 'properties' in branch || 'required' in branch;
+  return t === 'object' || (Array.isArray(t) && t.includes('object'));
+}
+
+/**
+ * Every `anyOf` branch, at any depth, that carries no single-string-enum
+ * discriminator — in a VARIANT union, one where two or more branches can be
+ * objects. A union with at most one object branch (`string | binding`,
+ * `string | number | boolean | array | binding`, as `ui.a2ui-surface`
+ * payload v2 declares) is a type union: JSON type alone selects the branch, no
+ * field is inspected, and a scalar branch has no property to discriminate on.
+ * RFC 0031 §A governs variant payloads; it is not read as forbidding these.
+ */
+export function anyOfDiscriminatorViolations(schema: unknown, path = '#'): SchemaViolation[] {
+  const out: SchemaViolation[] = [];
+  const walk = (s: unknown, p: string): void => {
+    if (Array.isArray(s)) { s.forEach((x, i) => walk(x, `${p}/${i}`)); return; }
+    if (!isRecord(s)) return;
+    if (Array.isArray(s['anyOf']) && (s['anyOf'] as unknown[]).filter(admitsObject).length >= 2) {
+      (s['anyOf'] as unknown[]).forEach((b, i) => {
+        if (admitsObject(b) && !branchDiscriminated(b)) out.push({ path: `${p}/anyOf/${i}`, rule: 'anyOf-branch-missing-discriminator', detail: 'a branch MUST declare a single-string-enum discriminator property in required (RFC 0031 §A)' });
+      });
+    }
+    for (const [k, v] of Object.entries(s)) walk(v, `${p}/${k}`);
+  };
+  walk(schema, path);
+  return out;
+}

package/src/lib/exhaustion-facet-witness.ts

@@ -75,7 +75,7 @@ export async function drive(profile: MajorProfile, doc: unknown): Promise<FacetR
 
   // A host that accepted the create started a run. Stop it, so a failing row leaves none behind.
   const runId = (res.json as { runId?: unknown } | undefined)?.runId;
-  if (typeof runId === 'string') await http(() => driver.post(`${profile.runsPath}/${encodeURIComponent(runId)}/cancel`, {}));
+  if (typeof runId === 'string') await http(() => driver.post(`${profile.runsPath}/${profile.idSegment(runId)}/cancel`, {}));
 
   return { kind: 'observed', observation: { facet, create: { status: res.status, code: readErrorCode(res.json) ?? undefined } } };
 }

package/src/lib/family-advert-witness.ts

@@ -0,0 +1,212 @@
+/**
+ * The advertisement-shape witness for the claims-check AI families at major 2:
+ * `envelopes`, `limits` (the three envelope caps), `modelCapabilities` and
+ * `aiProviders`.
+ *
+ * A claims-check family is witnessed by what the host says about itself, so
+ * every leg here reads the discovery record alone. Each leg checks one facet
+ * twice: against `schemas/v2/capabilities.schema.json` (the record seat or the
+ * facet's subschema, through `v2RefValidator`) and against the v2 prose rule
+ * that gives the facet its meaning. The schema and the prose do not always
+ * agree; where they do not, the leg says which one it is enforcing.
+ *
+ * Not here, on purpose:
+ *   - `limits.maxRunDurationMs` / `maxLoopIterations` — `run-bounds-witness.ts`;
+ *   - every runtime rule of these families (retry routing, refusal, substitution,
+ *     cap enforcement) — they need a mock-provider or envelope-accept seam.
+ *
+ * Every leg is pure: `(profile, discovery) → outcome`. A family the host does
+ * not advertise, or a facet it does not carry, is `inapplicable` — never a
+ * pass. Proven in both directions in `family-advert-witness.test.ts`.
+ */
+
+import type { MajorProfile } from './major-profile.js';
+import { v2RefValidator } from './v2.js';
+
+export interface AdvertFinding { readonly ok: boolean; readonly doc: string; readonly message: string }
+export type AdvertOutcome =
+  | { readonly kind: 'skip'; readonly disposition: 'inapplicable' | 'blocked'; readonly reason: string }
+  | { readonly kind: 'observed'; readonly findings: readonly AdvertFinding[] };
+
+const isRecord = (v: unknown): v is Record<string, unknown> => v !== null && typeof v === 'object' && !Array.isArray(v);
+const inapplicable = (reason: string): AdvertOutcome => ({ kind: 'skip', disposition: 'inapplicable', reason });
+const observed = (findings: AdvertFinding[]): AdvertOutcome => ({ kind: 'observed', findings });
+const SCHEMA = 'schemas/v2/capabilities.schema.json';
+
+/** Validate a value against a pointer into the v2 capabilities schema. */
+function bySchema(pointer: string, value: unknown, doc: string, what: string): AdvertFinding {
+  const r = v2RefValidator(`capabilities.schema.json#${pointer}`)(value);
+  return { ok: r.ok, doc, message: `${what} MUST validate against ${SCHEMA}#${pointer}${r.ok ? '' : ` (${r.errors})`}` };
+}
+
+/** One leg: given the family record, judge one facet. */
+type Leg = (rec: Record<string, unknown>) => AdvertOutcome;
+
+/** Run a leg against a discovery document, gating on the family record. */
+function onFamily(profile: MajorProfile, discovery: unknown, family: string, leg: Leg): AdvertOutcome {
+  const rec = profile.family(discovery, family);
+  if (rec === null) return inapplicable(`the host does not advertise ${family}`);
+  return leg(rec);
+}
+
+/** The record as a whole against its seat in the capabilities schema. Catches every v1 shape v2 retired (`supported`, `selfHosted[]`, the per-provider `authModes` map, …). */
+export function recordSchemaLeg(profile: MajorProfile, discovery: unknown, family: 'envelopes' | 'modelCapabilities' | 'aiProviders', doc: string): AdvertOutcome {
+  return onFamily(profile, discovery, family, (rec) => observed([bySchema(`/properties/${family}`, rec, doc, `the ${family} record`)]));
+}
+
+// ---------------------------------------------------------------------------
+// envelopes — spec/v2/core/events.md §`envelopes`
+// ---------------------------------------------------------------------------
+
+const ENV_DOC = 'events.md §envelopes';
+const ENV = '/properties/envelopes/properties';
+
+/** `envelopes.reasoning`: an object whose `promptDirective` is one of three values; no `supported` seat at v2. */
+export const envelopesReasoningLeg = (p: MajorProfile, d: unknown): AdvertOutcome => onFamily(p, d, 'envelopes', (rec) => {
+  const r = rec['reasoning'];
+  if (r === undefined) return inapplicable('the host does not advertise envelopes.reasoning (optional)');
+  const out = [bySchema(`${ENV}/reasoning`, r, ENV_DOC, 'envelopes.reasoning')];
+  if (isRecord(r) && r['promptDirective'] !== undefined) {
+    out.push({ ok: ['mandatory', 'advisory', 'off'].includes(String(r['promptDirective'])), doc: ENV_DOC, message: `envelopes.reasoning.promptDirective MUST be mandatory, advisory or off (got ${JSON.stringify(r['promptDirective'])})` });
+  }
+  return observed(out);
+});
+
+/** `envelopes.tierOneSubsetCompliance`: one of strict, warn, off. */
+export const envelopesTierOneLeg = (p: MajorProfile, d: unknown): AdvertOutcome => onFamily(p, d, 'envelopes', (rec) => {
+  const v = rec['tierOneSubsetCompliance'];
+  if (v === undefined) return inapplicable('the host does not advertise envelopes.tierOneSubsetCompliance (optional)');
+  return observed([bySchema(`${ENV}/tierOneSubsetCompliance`, v, ENV_DOC, 'envelopes.tierOneSubsetCompliance')]);
+});
+
+/** The six reliability events by their v2 names, and the four v1 dotted names v2 accepts as aliases until 3.0 (RFC 0228 §G). */
+export const RELIABILITY_EVENTS = ['envelope.retry-attempted', 'envelope.retry-exhausted', 'envelope.refusal', 'envelope.truncated', 'envelope.nl-to-format-engaged', 'envelope.recovery-applied'] as const;
+export const RELIABILITY_ALIASES: Readonly<Record<string, string>> = {
+  'envelope.retry.attempted': 'envelope.retry-attempted',
+  'envelope.retry.exhausted': 'envelope.retry-exhausted',
+  'envelope.nlToFormat.engaged': 'envelope.nl-to-format-engaged',
+  'envelope.recovery.applied': 'envelope.recovery-applied',
+};
+/** A listed reliability event by its v2 name: an alias folds to its hyphenated equivalent; anything else is returned unchanged. */
+export const canonicalReliabilityEvent = (e: string): string => RELIABILITY_ALIASES[e] ?? e;
+
+/**
+ * `envelopes.reliability`: `events[]` names only reliability events (v2 name
+ * or v1 alias), and — after folding aliases — includes the two MUST-tier ones;
+ * `maxRetryAttempts` is an integer in [1, 16].
+ */
+export const envelopesReliabilityLeg = (p: MajorProfile, d: unknown): AdvertOutcome => onFamily(p, d, 'envelopes', (rec) => {
+  const r = rec['reliability'];
+  if (r === undefined) return inapplicable('the host does not advertise envelopes.reliability (optional)');
+  const out = [bySchema(`${ENV}/reliability`, r, ENV_DOC, 'envelopes.reliability')];
+  const events = isRecord(r) ? r['events'] : undefined;
+  if (!Array.isArray(events)) {
+    out.push({ ok: false, doc: ENV_DOC, message: `a host advertising envelopes.reliability MUST list the events it emits in reliability.events[] (got ${JSON.stringify(events)})` });
+    return observed(out);
+  }
+  const canonical = new Set(events.filter((e): e is string => typeof e === 'string').map(canonicalReliabilityEvent));
+  for (const e of events) {
+    const name = typeof e === 'string' ? canonicalReliabilityEvent(e) : undefined;
+    out.push({ ok: name !== undefined && (RELIABILITY_EVENTS as readonly string[]).includes(name), doc: ENV_DOC, message: `reliability.events[] MUST name only reliability events, by v2 name or v1 alias (got ${JSON.stringify(e)})` });
+  }
+  for (const must of ['envelope.retry-exhausted', 'envelope.refusal']) {
+    out.push({ ok: canonical.has(must), doc: ENV_DOC, message: `a host advertising envelopes.reliability MUST emit and list ${must} (aliases folded; listed: ${JSON.stringify(events)})` });
+  }
+  return observed(out);
+});
+
+/** `envelopes.reliability.completion`: `distinguishesTruncation` is a boolean; `truncationBudgetMultiplier` a number in [1, 8]. */
+export const envelopesCompletionLeg = (p: MajorProfile, d: unknown): AdvertOutcome => onFamily(p, d, 'envelopes', (rec) => {
+  const r = rec['reliability'];
+  const c = isRecord(r) ? r['completion'] : undefined;
+  if (c === undefined) return inapplicable('the host does not advertise envelopes.reliability.completion (optional)');
+  const out = [bySchema(`${ENV}/reliability/properties/completion`, c, ENV_DOC, 'envelopes.reliability.completion')];
+  const dt = isRecord(c) ? c['distinguishesTruncation'] : undefined;
+  out.push({ ok: typeof dt === 'boolean', doc: ENV_DOC, message: `reliability.completion.distinguishesTruncation MUST be a boolean (got ${JSON.stringify(dt)})` });
+  return observed(out);
+});
+
+// ---------------------------------------------------------------------------
+// limits — spec/v2/core/runs.md §Limits: the three envelope caps
+// ---------------------------------------------------------------------------
+
+export const ENVELOPE_CAPS = ['clarificationRounds', 'schemaRounds', 'envelopesPerTurn'] as const;
+export type EnvelopeCap = (typeof ENVELOPE_CAPS)[number];
+
+/** `limits.<cap>`: present (runs.md: "`limits` always carries" it) and a non-negative integer. */
+export const limitsCapLeg = (p: MajorProfile, d: unknown, cap: EnvelopeCap): AdvertOutcome => onFamily(p, d, 'limits', (rec) => {
+  const v = rec[cap];
+  const doc = 'runs.md §Limits';
+  if (v === undefined) return observed([{ ok: false, doc, message: `limits MUST always carry ${cap} (absent)` }]);
+  return observed([
+    bySchema(`/properties/limits/properties/${cap}`, v, doc, `limits.${cap}`),
+    { ok: Number.isInteger(v) && (v as number) >= 0, doc, message: `limits.${cap} MUST be a non-negative integer (got ${JSON.stringify(v)})` },
+  ]);
+});
+
+// ---------------------------------------------------------------------------
+// modelCapabilities — spec/v2/core/host-services.md §modelCapabilities
+// ---------------------------------------------------------------------------
+
+/** The spec-reserved identifiers (RFC 0031 §C, RFC 0055), as listed by the schema seat's description. */
+export const RESERVED_MODEL_CAPABILITIES = ['structured-output', 'discriminator-enum', 'long-context', 'reasoning', 'function-calling', 'vision-input', 'audio-input', 'audio-output', 'image-output'] as const;
+const HOST_PRIVATE = /^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$/;
+const MC_DOC = 'host-services.md §modelCapabilities';
+
+/** `modelCapabilities.advertised`: unique strings, each spec-reserved or prefixed `x-host-<host>-`. */
+export const modelCapabilitiesAdvertisedLeg = (p: MajorProfile, d: unknown): AdvertOutcome => onFamily(p, d, 'modelCapabilities', (rec) => {
+  const a = rec['advertised'];
+  if (a === undefined) return inapplicable('the host does not advertise modelCapabilities.advertised');
+  const out = [bySchema('/properties/modelCapabilities/properties/advertised', a, MC_DOC, 'modelCapabilities.advertised')];
+  if (Array.isArray(a)) {
+    for (const id of a) {
+      const s = typeof id === 'string' ? id : '';
+      out.push({ ok: (RESERVED_MODEL_CAPABILITIES as readonly string[]).includes(s) || HOST_PRIVATE.test(s), doc: MC_DOC, message: `a modelCapabilities.advertised identifier MUST be spec-reserved (${RESERVED_MODEL_CAPABILITIES.join(', ')}) or host-private, prefixed x-host-<host>- (got ${JSON.stringify(id)})` });
+    }
+  }
+  return observed(out);
+});
+
+/** `modelCapabilities.substitutionSupported`: a boolean. */
+export const modelCapabilitiesSubstitutionLeg = (p: MajorProfile, d: unknown): AdvertOutcome => onFamily(p, d, 'modelCapabilities', (rec) => {
+  const v = rec['substitutionSupported'];
+  if (v === undefined) return inapplicable('the host does not advertise modelCapabilities.substitutionSupported (absent means no substitution)');
+  return observed([bySchema('/properties/modelCapabilities/properties/substitutionSupported', v, MC_DOC, 'modelCapabilities.substitutionSupported')]);
+});
+
+// ---------------------------------------------------------------------------
+// aiProviders — spec/v2/core/host-services.md §aiProviders (v1 facets narrowed by C2.11)
+// ---------------------------------------------------------------------------
+
+const AP_DOC = 'host-services.md §aiProviders';
+const AP = '/properties/aiProviders/properties';
+
+/** The modes `host-services.md` §aiProviders names. The v2 schema seat is `string[]` with no enum; the vocabulary is the prose's. */
+
+/** `aiProviders.selfHosted`: one boolean at v2 (the v1 `selfHosted[]` id list retired, C2.11). */
+export const aiProvidersSelfHostedLeg = (p: MajorProfile, d: unknown): AdvertOutcome => onFamily(p, d, 'aiProviders', (rec) => {
+  const v = rec['selfHosted'];
+  if (v === undefined) return inapplicable('the host does not advertise aiProviders.selfHosted');
+  return observed([bySchema(`${AP}/selfHosted`, v, AP_DOC, 'aiProviders.selfHosted (a boolean at v2, not the v1 id list)')]);
+});
+
+/** `aiProviders.authModes`: one flat list of modes at v2 (the v1 per-provider map retired, C2.11). */
+export const aiProvidersAuthModesShapeLeg = (p: MajorProfile, d: unknown): AdvertOutcome => onFamily(p, d, 'aiProviders', (rec) => {
+  const v = rec['authModes'];
+  if (v === undefined) return inapplicable('the host does not advertise aiProviders.authModes');
+  return observed([bySchema(`${AP}/authModes`, v, AP_DOC, 'aiProviders.authModes (one flat list at v2, not the v1 per-provider map)')]);
+});
+
+/** `aiProviders.maxInlineMediaBytes`: an integer ≥ 1. */
+export const aiProvidersInlineMediaLeg = (p: MajorProfile, d: unknown): AdvertOutcome => onFamily(p, d, 'aiProviders', (rec) => {
+  const v = rec['maxInlineMediaBytes'];
+  if (v === undefined) return inapplicable('the host does not advertise aiProviders.maxInlineMediaBytes (default 256 KiB)');
+  return observed([bySchema(`${AP}/maxInlineMediaBytes`, v, AP_DOC, 'aiProviders.maxInlineMediaBytes')]);
+});
+
+/** `aiProviders.promptPrefixCache`: one boolean at v2 (the v1 `{ supported, providers[] }` object retired, C2.11). */
+export const aiProvidersPromptPrefixCacheLeg = (p: MajorProfile, d: unknown): AdvertOutcome => onFamily(p, d, 'aiProviders', (rec) => {
+  const v = rec['promptPrefixCache'];
+  if (v === undefined) return inapplicable('the host does not advertise aiProviders.promptPrefixCache');
+  return observed([bySchema(`${AP}/promptPrefixCache`, v, AP_DOC, 'aiProviders.promptPrefixCache (a boolean at v2, not the v1 object)')]);
+});