@openwop/openwop-conformance 2.45.14 → 2.45.16

package/src/scenarios/v2-envelope-variant-discriminator-static.test.ts

@@ -0,0 +1,57 @@
+/**
+ * v2 — variant payload discrimination, statically (RFC 0031 §A). The v1 twin
+ * is `envelope-variant-discriminator-static`; the walker lives in
+ * `lib/envelope-schema-static.ts`.
+ *
+ * For every payload schema in `schemas/v2/envelopes/`:
+ *   no oneOf       `oneOf` appears at no depth (Gemini drops it silently, so a
+ *                  model gets a looser schema than declared);
+ *   discriminated  in a variant union — an `anyOf` where two or more branches
+ *                  can be objects — every object branch declares, in `required`,
+ *                  a property of `type: string` with a one-value `enum`; a `$ref`
+ *                  branch is accepted unresolved, as at v1. A type union with at
+ *                  most one object branch (`string | binding`, as
+ *                  `ui.a2ui-surface` payload v2's `dyn*` defs declare) is
+ *                  selected by JSON type and is not judged: a scalar branch has
+ *                  no property to discriminate on. This scoping is new at v2 —
+ *                  the v1 walker flagged every non-`$ref` branch, which no v1
+ *                  schema exercised.
+ *
+ * No v2 core document states this rule: `spec/v2/core/` carries no text on
+ * variant payload discrimination (the nearest is `ext/a2uiSurface/README.md`,
+ * whose components are "discriminated by a single-string-enum `component`").
+ * The requirement is cited to RFC 0031 §A, its only normative home.
+ *
+ * Host-free: every leg runs with no OPENWOP_BASE_URL.
+ *
+ * @see RFCS/0031-envelope-variants-and-model-capabilities.md §A
+ */
+
+import { describe, it, expect } from 'vitest';
+import { req } from '../lib/requirement-ids.js';
+import { anyOfDiscriminatorViolations, listV2EnvelopeKinds, loadV2EnvelopeSchema, oneOfViolations, UNIVERSAL_KINDS } from '../lib/envelope-schema-static.js';
+
+const DOC = 'RFC 0031 §A';
+const ID_PRESENT = 'openwop.requirement.envelopes.payload-schemas-present';
+const ID_NO_ONEOF = 'openwop.requirement.envelopes.variant-no-oneof';
+const ID_DISCRIMINATED = 'openwop.requirement.envelopes.variant-anyof-discriminated';
+
+const KINDS = listV2EnvelopeKinds();
+
+describe('v2 envelope variant discrimination (RFC 0031 §A)', () => {
+  it('schemas/v2/envelopes carries a payload schema for each universal kind', () => {
+    for (const k of UNIVERSAL_KINDS) expect(KINDS.includes(k), req(ID_PRESENT, DOC, `schemas/v2/envelopes/${k}.schema.json MUST exist`)).toBe(true);
+  });
+
+  for (const kind of KINDS) {
+    it(`${kind} contains no oneOf at any depth`, () => {
+      const v = oneOfViolations(loadV2EnvelopeSchema(kind));
+      expect(v, req(ID_NO_ONEOF, DOC, `${kind} MUST NOT use oneOf — use anyOf with a single-string-enum discriminator: ${JSON.stringify(v)}`)).toEqual([]);
+    });
+
+    it(`${kind} discriminates every anyOf branch by a single-string-enum property`, () => {
+      const v = anyOfDiscriminatorViolations(loadV2EnvelopeSchema(kind));
+      expect(v, req(ID_DISCRIMINATED, DOC, `${kind} anyOf branches without a discriminator: ${JSON.stringify(v)}`)).toEqual([]);
+    });
+  }
+});

package/src/scenarios/v2-envelopes-advertisement.test.ts

@@ -0,0 +1,85 @@
+/**
+ * v2 — the `envelopes` advertisement (`spec/v2/core/events.md` §`envelopes`;
+ * RFCs 0030, 0032, 0033). A claims-check family: what the host says about its
+ * envelope posture is what is witnessed. The v1 twins are the advertisement
+ * legs of `envelope-reasoning-shape`, `envelope-retry-attempted` /
+ * `envelope-refusal-shape` and `envelope-completion-distinguishes-truncation`;
+ * the legs live in `lib/family-advert-witness.ts`.
+ *
+ *   record       the record validates against its seat in
+ *                `schemas/v2/capabilities.schema.json` (no v1 `supported` seat);
+ *   reasoning    `reasoning.promptDirective` is mandatory | advisory | off;
+ *   tier-one     `tierOneSubsetCompliance` is strict | warn | off;
+ *   reliability  `reliability.events[]` names only reliability events and, with
+ *                the four v1 dotted names folded to their v2 equivalents
+ *                (aliases until 3.0, RFC 0228 §G), lists the two MUST-tier
+ *                events `envelope.retry-exhausted` and `envelope.refusal`;
+ *   completion   `reliability.completion.distinguishesTruncation` is a boolean
+ *                and `truncationBudgetMultiplier` is in [1, 8].
+ *
+ * Dispositions: discovery unreadable ⇒ `blocked`; `envelopes` absent, or the
+ * facet a leg reads absent ⇒ `inapplicable`.
+ *
+ * @see spec/v2/core/events.md §envelopes
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { envelopesCompletionLeg, envelopesReasoningLeg, envelopesReliabilityLeg, envelopesTierOneLeg, recordSchemaLeg } from '../lib/family-advert-witness.js';
+
+const PROFILE = majorProfile(2);
+const ID_RECORD = 'openwop.requirement.envelopes.advert-record-schema';
+const ID_REASONING = 'openwop.requirement.envelopes.reasoning-advert-shape';
+const ID_TIER_ONE = 'openwop.requirement.envelopes.tier-one-subset-compliance-value';
+const ID_RELIABILITY = 'openwop.requirement.envelopes.reliability-events-advert';
+const ID_COMPLETION = 'openwop.requirement.envelopes.completion-advert-shape';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+const UNREADABLE = 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0';
+
+describe('v2 envelopes advertisement (events.md §envelopes)', () => {
+  it('the envelopes record validates against its capabilities-schema seat', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = recordSchemaLeg(PROFILE, doc, 'envelopes', 'events.md §envelopes');
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_RECORD, x.doc, x.message)).toBe(true);
+  });
+
+  it('envelopes.reasoning.promptDirective is mandatory, advisory or off', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = envelopesReasoningLeg(PROFILE, doc);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_REASONING, x.doc, x.message)).toBe(true);
+  });
+
+  it('envelopes.tierOneSubsetCompliance is strict, warn or off', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = envelopesTierOneLeg(PROFILE, doc);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_TIER_ONE, x.doc, x.message)).toBe(true);
+  });
+
+  it('envelopes.reliability.events lists only reliability events and includes retry-exhausted and refusal', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = envelopesReliabilityLeg(PROFILE, doc);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_RELIABILITY, x.doc, x.message)).toBe(true);
+  });
+
+  it('envelopes.reliability.completion.distinguishesTruncation is a boolean', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = envelopesCompletionLeg(PROFILE, doc);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_COMPLETION, x.doc, x.message)).toBe(true);
+  });
+});

package/src/scenarios/v2-export-bundle-static.test.ts

@@ -0,0 +1,108 @@
+/**
+ * v2 — the export bundle, the `import.applied` payload and the `portability`
+ * record's `import ⇒ dryRun` rule, statically (`spec/v2/core/portability.md`;
+ * RFC 0098; invariant `export-bundle-no-credential-material`). The v1 twin is
+ * the server-free half of `export-bundle-portability`; its import-seam leg is
+ * not ported (v2 defines no import route).
+ *
+ *   version     a bundle carries `bundleVersion: "2"`. This FLIPS the v1 leg:
+ *               at v1 `"1"` was good and `"2"` rejected; at v2 `"1"` is
+ *               rejected;
+ *   shape       an unknown item kind and an item without `ref` are rejected;
+ *   no-cred     no credential-named field is admitted at the bundle root or
+ *               under `source` ("A bundle MUST NOT contain credential values");
+ *   applied     `import.applied` is a registered v2 event type, and its payload
+ *               is counts and references only, never item payloads;
+ *   dryRun      the capabilities seat refuses `import: true` without
+ *               `dryRun: true` ("A host advertising `import` MUST advertise
+ *               `dryRun: true`"). At v2 that `if/then` sits in the record's
+ *               `allOf`, so it is witnessed by validation, not by reading
+ *               `portability.if`.
+ *
+ * Host-free: every leg runs with no OPENWOP_BASE_URL.
+ *
+ * @see spec/v2/core/portability.md
+ * @see schemas/v2/export-bundle.schema.json
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2RefValidator, v2Validator } from '../lib/v2.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'portability.md §The export bundle';
+const ID_VERSION = 'openwop.requirement.portability.bundle-version-2';
+const ID_SHAPE = 'openwop.requirement.portability.bundle-item-shape';
+const ID_NO_CRED = 'openwop.requirement.portability.bundle-no-credential-field';
+const ID_APPLIED = 'openwop.requirement.portability.import-applied-content-free';
+const ID_DRY_RUN = 'openwop.requirement.portability.import-dry-run-schema-rule';
+
+const CRED_NAMES = ['clientSecret', 'client_secret', 'apiKey', 'api_key', 'accessToken', 'refreshToken', 'password', 'privateKey'] as const;
+
+const GOOD = {
+  bundleVersion: '2',
+  source: { origin: 'https://host-a.example', exportedAt: '2026-10-04T00:00:00Z' },
+  items: [
+    { kind: 'prompt-template', ref: 'tpl-1', payload: { templateId: 'welcome', version: '1.0.0' } },
+    { kind: 'connection-ref', ref: 'conn-1', dependsOn: ['tpl-1'], payload: { provider: 'slack', credentialRef: 'cred:abc' } },
+  ],
+} as const;
+
+describe('v2 export bundle (portability.md §The export bundle)', () => {
+  const validate = v2Validator('export-bundle');
+
+  it('accepts a conforming bundle at bundleVersion "2"', () => {
+    const r = validate(GOOD);
+    expect(r.ok, req(ID_VERSION, DOC, `a conforming v2 bundle MUST validate (${r.errors})`)).toBe(true);
+  });
+
+  it('rejects the v1 bundleVersion "1" and a missing bundleVersion', () => {
+    expect(validate({ ...GOOD, bundleVersion: '1' }).ok, req(ID_VERSION, DOC, 'a v2 bundle MUST carry bundleVersion "2"; "1" MUST be rejected')).toBe(false);
+    const { bundleVersion: _gone, ...rest } = GOOD;
+    expect(validate(rest).ok, req(ID_VERSION, DOC, 'a bundle without bundleVersion MUST be rejected')).toBe(false);
+  });
+
+  it('rejects an unknown item kind and an item without ref', () => {
+    expect(validate({ ...GOOD, items: [{ kind: 'workflow', ref: 'x', payload: {} }] }).ok, req(ID_SHAPE, DOC, 'an unknown item kind MUST be rejected')).toBe(false);
+    expect(validate({ ...GOOD, items: [{ kind: 'agent', payload: {} }] }).ok, req(ID_SHAPE, DOC, 'an item without a ref MUST be rejected')).toBe(false);
+  });
+
+  it.each(CRED_NAMES)('admits no %s field at the bundle root or under source', (name) => {
+    expect(validate({ ...GOOD, [name]: 'xxx' }).ok, req(ID_NO_CRED, DOC, `a "${name}" field at the bundle root MUST NOT validate`)).toBe(false);
+    expect(validate({ ...GOOD, source: { ...GOOD.source, [name]: 'xxx' } }).ok, req(ID_NO_CRED, DOC, `a "${name}" field under source MUST NOT validate`)).toBe(false);
+  });
+});
+
+describe('v2 import.applied (portability.md §The import.applied event)', () => {
+  const applied = v2RefValidator('run-event-payloads.schema.json#/$defs/importApplied');
+  const ADOC = 'portability.md §The import.applied event';
+
+  it('import.applied is a registered v2 run-event type', () => {
+    const r = v2RefValidator('run-event.schema.json#/properties/type')('import.applied');
+    expect(r.ok, req(ID_APPLIED, ADOC, `import.applied MUST be accepted by the v2 run-event type union (${r.errors})`)).toBe(true);
+  });
+
+  it('a counts-and-refs payload validates; one carrying item payloads does not', () => {
+    const r = applied({ bundleOrigin: 'https://host-a.example', counts: { created: 2, skipped: 1 }, secretsToRebind: ['anthropic'] });
+    expect(r.ok, req(ID_APPLIED, ADOC, `a content-free import.applied MUST validate (${r.errors})`)).toBe(true);
+    expect(applied({ bundleOrigin: 'h', counts: { created: 1 }, items: [{ payload: {} }] }).ok, req(ID_APPLIED, ADOC, 'import.applied MUST NOT carry item payloads')).toBe(false);
+    expect(applied({ bundleOrigin: 'h', counts: { created: 1, leaked: 1 } }).ok, req(ID_APPLIED, ADOC, 'import.applied counts MUST be the four outcome tallies only')).toBe(false);
+  });
+});
+
+describe('v2 portability record: import ⇒ dryRun (portability.md §The portability record)', () => {
+  const record = v2RefValidator('capabilities.schema.json#/properties/portability');
+  const PDOC = 'portability.md §The portability record';
+  const base = { status: 'experimental', since: '2.0', until: '2099-01-01', witness: 'witnessable-gated', export: true } as const;
+
+  it('import: true with dryRun: true validates; import: false needs no dryRun', () => {
+    for (const r of [{ ...base, import: true, dryRun: true }, { ...base, import: false }, { ...base }]) {
+      const v = record(r);
+      expect(v.ok, req(ID_DRY_RUN, PDOC, `a portability record ${JSON.stringify(r)} MUST validate (${v.errors})`)).toBe(true);
+    }
+  });
+
+  it('import: true without dryRun, or with dryRun: false, is rejected', () => {
+    expect(record({ ...base, import: true }).ok, req(ID_DRY_RUN, PDOC, 'import: true without dryRun MUST be rejected')).toBe(false);
+    expect(record({ ...base, import: true, dryRun: false }).ok, req(ID_DRY_RUN, PDOC, 'import: true with dryRun: false MUST be rejected')).toBe(false);
+  });
+});

package/src/scenarios/v2-i18n-negotiation.test.ts

@@ -0,0 +1,91 @@
+/**
+ * v2 — locale negotiation (`spec/v2/core/i18n.md` §`Accept-Language`,
+ * §Fallback, §Error envelopes, §The `i18n` record). The v1 twin is
+ * `i18n-negotiation`; the legs live in `lib/i18n-negotiation-witness.ts`, and
+ * what differs between majors (the unversioned run path, the `~`-projected
+ * bound id, presence-as-advertisement) is the profile row.
+ *
+ *   shape        the `i18n` record validates against the v2 capabilities
+ *                schema, and `supportedLocales` contains `defaultLocale`;
+ *   unsupported  an unsupported `Accept-Language` is answered exactly as the
+ *                same request without it; `Content-Language`, when sent, is a
+ *                BCP 47 tag naming the default locale;
+ *   malformed    a malformed `Accept-Language` never yields `400`;
+ *   error code   the `error` code and the `details` keys are identical under
+ *                the default and a negotiated locale.
+ *
+ * The probe reads a run id no host minted (`GET /runs/{bound id}`). Its answer
+ * is not pinned — `404 not_found`, or `403 id_tenant_mismatch` because the
+ * tenant segment is not the caller's — since every leg compares against the
+ * same request with no `Accept-Language`.
+ *
+ * Dispositions: no target ⇒ `inapplicable`; discovery unreadable ⇒ `blocked`;
+ * `i18n` not advertised ⇒ `inapplicable` (gated with the record's presence,
+ * never a strict-mode failure); a probe that answers no 4xx envelope ⇒
+ * `blocked` (no baseline).
+ *
+ * Proven against a scratch double in `lib/i18n-negotiation-witness.test.ts`.
+ *
+ * @see spec/v2/core/i18n.md
+ * @see schemas/v2/capabilities.schema.json §i18n
+ */
+
+import { describe, it, expect } from 'vitest';
+import { familyAdvertised, v2Discovery, v2RefValidator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { errorCodeLeg, i18nAdverts, malformedLeg, shapeLeg, unsupportedLeg, type I18nAdverts } from '../lib/i18n-negotiation-witness.js';
+
+const PROFILE = majorProfile(2);
+const ID_SHAPE = 'openwop.requirement.i18n.record-shape';
+const ID_UNSUPPORTED = 'openwop.requirement.i18n.unsupported-locale-falls-back';
+const ID_MALFORMED = 'openwop.requirement.i18n.malformed-accept-language-not-400';
+const ID_CODE = 'openwop.requirement.i18n.error-code-locale-invariant';
+const HTTP_SKIP = !process.env['OPENWOP_BASE_URL'];
+const validRecord = v2RefValidator('capabilities.schema.json#/properties/i18n');
+
+type Ready = { ok: true; a: I18nAdverts } | { ok: false; skip: () => undefined };
+async function ready(): Promise<Ready> {
+  if (HTTP_SKIP) return { ok: false, skip: () => softSkip('inapplicable', 'no target: OPENWOP_BASE_URL is unset') };
+  let doc: Record<string, unknown> | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  if (!doc) return { ok: false, skip: () => softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0') };
+  if ((await familyAdvertised('i18n')) === null) return { ok: false, skip: () => softSkip('inapplicable', 'the host does not advertise i18n — it serves one locale and ignores Accept-Language (i18n.md §The i18n record)') };
+  return { ok: true, a: i18nAdverts(PROFILE, doc) };
+}
+
+describe('v2 i18n negotiation (i18n.md §Accept-Language, §Fallback, §Error envelopes)', () => {
+  it('the advertised i18n record is well-formed and lists its default locale', async () => {
+    const r = await ready();
+    if (!r.ok) return r.skip();
+    const v = validRecord(r.a.record);
+    const out = shapeLeg(r.a);
+    expect(v.ok, req(ID_SHAPE, 'schemas/v2/capabilities.schema.json §i18n', `the i18n record MUST validate: ${v.errors}`)).toBe(true);
+    if (out.kind === 'observed') for (const x of out.findings) expect(x.ok, req(ID_SHAPE, x.doc, x.message)).toBe(true);
+  });
+
+  it('an unsupported Accept-Language falls back and Content-Language never lies', async () => {
+    const r = await ready();
+    if (!r.ok) return r.skip();
+    const out = await unsupportedLeg(PROFILE, r.a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_UNSUPPORTED, x.doc, x.message)).toBe(true);
+  });
+
+  it('a malformed Accept-Language does not cause 400', async () => {
+    const r = await ready();
+    if (!r.ok) return r.skip();
+    const out = await malformedLeg(PROFILE, r.a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_MALFORMED, x.doc, x.message)).toBe(true);
+  });
+
+  it('the error code and details keys are identical under every negotiated locale', async () => {
+    const r = await ready();
+    if (!r.ok) return r.skip();
+    const out = await errorCodeLeg(PROFILE, r.a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_CODE, x.doc, x.message)).toBe(true);
+  });
+});

package/src/scenarios/v2-limits-envelope-caps-advertisement.test.ts

@@ -0,0 +1,61 @@
+/**
+ * v2 — the three envelope caps on `limits` (`spec/v2/core/runs.md` §Limits:
+ * "`limits` always carries `clarificationRounds` (per task), `schemaRounds`
+ * (per envelope) and `envelopesPerTurn` (per chat turn)"). The v1 twin is the
+ * advertisement half of `aiEnvelope.capBreached`; the legs live in
+ * `lib/family-advert-witness.ts`. The other `limits` facets
+ * (`maxRunDurationMs`, `maxLoopIterations`) are `v2-run-execution-bounds`.
+ *
+ * Each cap MUST be present and validate against its subschema in
+ * `schemas/v2/capabilities.schema.json` (a non-negative integer).
+ *
+ * Dispositions: discovery unreadable ⇒ `blocked`; `limits` absent ⇒
+ * `inapplicable` (at v2 presence of the record is the claim; the v1 rule that
+ * `limits` itself is always present has no v2 seat — the root schema requires
+ * only `protocolVersions` and `preferredVersion`).
+ *
+ * @see spec/v2/core/runs.md §Limits
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { limitsCapLeg } from '../lib/family-advert-witness.js';
+
+const PROFILE = majorProfile(2);
+const UNREADABLE = 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0';
+const ID_CLARIFICATION = 'openwop.requirement.limits.clarification-rounds-advertised';
+const ID_SCHEMA = 'openwop.requirement.limits.schema-rounds-advertised';
+const ID_ENVELOPES = 'openwop.requirement.limits.envelopes-per-turn-advertised';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+describe('v2 limits envelope caps (runs.md §Limits)', () => {
+  it('limits.clarificationRounds is present and a non-negative integer', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = limitsCapLeg(PROFILE, doc, 'clarificationRounds');
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_CLARIFICATION, x.doc, x.message)).toBe(true);
+  });
+
+  it('limits.schemaRounds is present and a non-negative integer', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = limitsCapLeg(PROFILE, doc, 'schemaRounds');
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_SCHEMA, x.doc, x.message)).toBe(true);
+  });
+
+  it('limits.envelopesPerTurn is present and a non-negative integer', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = limitsCapLeg(PROFILE, doc, 'envelopesPerTurn');
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_ENVELOPES, x.doc, x.message)).toBe(true);
+  });
+});

package/src/scenarios/v2-localized-content-delivery.test.ts

@@ -0,0 +1,136 @@
+/**
+ * v2 — localized content (`spec/v2/core/i18n.md` §Localized content;
+ * `schemas/v2/localized-content-*.schema.json`; RFCs 0103, 0206). The v1 twin
+ * is `localized-content-delivery`.
+ *
+ * Two layers:
+ *
+ *   A. Server-free — the v2 `content` capability record (no `supported` seat;
+ *      presence is the claim), the four v2 content schemas, and the section
+ *      merge every host MUST resolve identically (exact tag → `ll-Ssss` script
+ *      family → language → `data`, shallow overlay), against the suite's one
+ *      reference copy in `lib/localized-content.ts`.
+ *
+ *   B. Live — the advertised `content` record is coherent with the advertised
+ *      `i18n` record (`lib/localized-content-witness.ts`, a pure judge proven in
+ *      `localized-content-witness.test.ts`). Gated by the presence of the v2
+ *      `content` record: absent ⇒ `inapplicable`.
+ *
+ * Not ported here: the `/content/*` delivery legs (published-only, tenant
+ * isolation, no enumeration); v1 never drove them either.
+ *
+ * @see spec/v2/core/i18n.md §Localized content
+ * @see SECURITY/invariants.yaml id: content-published-cache-no-draft, content-response-tenant-scoped
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { familyAdvertised, v2Discovery, v2RefValidator, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { resolveSection, type Section } from '../lib/localized-content.js';
+import { coherenceLeg } from '../lib/localized-content-witness.js';
+
+const PROFILE = majorProfile(2);
+const DOC = 'spec/v2/core/i18n.md §Localized content';
+const ID_RECORD = 'openwop.requirement.content.capability-record-shape';
+const ID_SECTION = 'openwop.requirement.content.section-schema';
+const ID_PAGE = 'openwop.requirement.content.page-schema';
+const ID_SETTINGS = 'openwop.requirement.content.language-settings-schema';
+const ID_RESPONSE = 'openwop.requirement.content.page-response-schema';
+const ID_MERGE = 'openwop.requirement.content.section-merge';
+const ID_COHERENT = 'openwop.requirement.content.advertisement-coherent';
+const HTTP_SKIP = !process.env['OPENWOP_BASE_URL'];
+
+const caps = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'capabilities.schema.json'), 'utf8')) as { properties: Record<string, { required?: string[]; properties?: Record<string, unknown> }> };
+const section = v2Validator('localized-content-section');
+const page = v2Validator('localized-content-page');
+const settings = v2Validator('localized-content-language-settings');
+const response = v2Validator('localized-content-page-response');
+const contentRecord = v2RefValidator('capabilities.schema.json#/properties/content');
+
+const goodSection = {
+  sectionId: 'hero', sectionType: 'hero', data: { heading: 'Welcome', cta: 'Get started' },
+  localizations: { es: { heading: 'Bienvenido', cta: 'Empezar' }, 'pt-BR': { heading: 'Bem-vindo' } },
+  status: 'published', enabled: true, order: 0,
+};
+
+describe('v2 localized content: the capability record (server-free)', () => {
+  it('the v2 content record requires baseLocale and supportedLocales and has no supported seat', () => {
+    const content = caps.properties['content'];
+    expect(content?.required, req(ID_RECORD, 'schemas/v2/capabilities.schema.json §content', 'content MUST require baseLocale and supportedLocales')).toEqual(expect.arrayContaining(['baseLocale', 'supportedLocales']));
+    expect(content?.properties?.['supported'], req(ID_RECORD, 'spec/v2/core/capabilities.md (presence is the claim)', 'the v2 content record MUST NOT declare a supported seat')).toBeUndefined();
+    const base = { status: 'experimental', since: '2.0', until: '2.9', witness: 'witnessable-gated' };
+    expect(contentRecord({ ...base, baseLocale: 'en', supportedLocales: ['es'] }).ok, req(ID_RECORD, 'schemas/v2/capabilities.schema.json §content', 'a conforming content record MUST validate')).toBe(true);
+    expect(contentRecord({ ...base, supported: true, baseLocale: 'en', supportedLocales: ['es'] }).ok, req(ID_RECORD, 'schemas/v2/capabilities.schema.json §content', 'a content record carrying supported MUST be rejected (closed record)')).toBe(false);
+  });
+});
+
+describe('v2 localized content: schema shapes (server-free)', () => {
+  it('a conforming section validates; a non-canonical or underscore locale key, a missing status, or an unknown status is rejected', () => {
+    expect(section(goodSection).ok, req(ID_SECTION, DOC, `a conforming section MUST validate: ${section(goodSection).errors}`)).toBe(true);
+    for (const key of ['zh-Hans', 'zh-Hant-TW', 'es-419', 'fil']) {
+      expect(section({ ...goodSection, localizations: { [key]: { heading: 'x' } } }).ok, req(ID_SECTION, 'RFC 0206 §A.1', `${key} MUST validate as a localizations key`)).toBe(true);
+    }
+    for (const key of ['EN', 'en_US', 'en-us', 'zh-hans', 'de-CH-1996']) {
+      expect(section({ ...goodSection, localizations: { [key]: { heading: 'x' } } }).ok, req(ID_SECTION, 'RFC 0206 §A.1', `${key} MUST be rejected as a localizations key`)).toBe(false);
+    }
+    const { status: _omit, ...noStatus } = goodSection;
+    expect(section(noStatus).ok, req(ID_SECTION, DOC, 'status is REQUIRED')).toBe(false);
+    expect(section({ ...goodSection, status: 'archived' }).ok, req(ID_SECTION, DOC, 'status MUST be draft or published')).toBe(false);
+    expect(section({ ...goodSection, extra: true }).ok, req(ID_SECTION, DOC, 'a section is a closed record')).toBe(false);
+  });
+
+  it('a conforming page validates and a bad slug is rejected', () => {
+    const good = { pageId: 'home', slug: 'home', name: 'Home', status: 'published', sectionOrder: ['hero'] };
+    expect(page(good).ok, req(ID_PAGE, DOC, `a conforming page MUST validate: ${page(good).errors}`)).toBe(true);
+    expect(page({ ...good, slug: 'Home Page' }).ok, req(ID_PAGE, DOC, 'slug MUST match ^[a-z][a-z0-9-]*$')).toBe(false);
+  });
+
+  it('a conforming language-settings document validates', () => {
+    const good = { baseLocale: 'en', supportedLocales: ['es', 'pt-BR', 'fr'], autoTranslateOnPublish: false };
+    expect(settings(good).ok, req(ID_SETTINGS, DOC, `settings MUST validate: ${settings(good).errors}`)).toBe(true);
+    expect(settings({ ...good, baseLocale: 'en_US' }).ok, req(ID_SETTINGS, DOC, 'baseLocale MUST be a canonical BCP 47 key')).toBe(false);
+  });
+
+  it('a conforming page response validates', () => {
+    const good = {
+      version: '1', generatedAt: '2026-06-17T00:00:00Z', locale: 'pt-BR', slug: 'home',
+      page: { pageId: 'home', slug: 'home', name: 'Home' },
+      sections: [{ sectionId: 'hero', sectionType: 'hero', data: { heading: 'Bem-vindo', cta: 'Get started' } }],
+    };
+    expect(response(good).ok, req(ID_RESPONSE, DOC, `a resolved response MUST validate: ${response(good).errors}`)).toBe(true);
+    expect(response({ ...good, sections: [{ ...good.sections[0], localizations: {} }] }).ok, req(ID_RESPONSE, DOC, 'a delivered section carries resolved data, never its localizations')).toBe(false);
+  });
+});
+
+describe('v2 localized content: the section merge every host resolves identically (server-free)', () => {
+  it('exact tag, then script family, then language, then data — a shallow overlay', () => {
+    const s: Section = { data: { heading: 'Welcome', cta: 'Get started' }, localizations: { es: { heading: 'Bienvenido', cta: 'Empezar' }, 'pt-BR': { heading: 'Bem-vindo' } } };
+    expect(resolveSection(s, 'es', 'en'), req(ID_MERGE, DOC, 'an exact hit MUST overlay its fields onto data')).toEqual({ heading: 'Bienvenido', cta: 'Empezar' });
+    expect(resolveSection(s, 'pt-BR', 'en'), req(ID_MERGE, DOC, 'a field the overlay lacks MUST fall through to data')).toEqual({ heading: 'Bem-vindo', cta: 'Get started' });
+    expect(resolveSection({ data: { h: 'Hi' }, localizations: { pt: { h: 'Oi' } } }, 'pt-BR', 'en'), req(ID_MERGE, DOC, 'pt-BR MUST fall back to the pt language overlay')).toEqual({ h: 'Oi' });
+    expect(resolveSection({ data: { h: 'x' }, localizations: { 'zh-Hant': { h: '繁' }, zh: { h: '简' } } }, 'zh-Hant-TW', 'en'), req(ID_MERGE, DOC, 'zh-Hant-TW MUST take the zh-Hant script family before zh')).toEqual({ h: '繁' });
+    expect(resolveSection(s, 'de', 'en'), req(ID_MERGE, DOC, 'no overlay MUST resolve to data alone')).toEqual(s.data);
+    expect(resolveSection(s, 'en', 'en'), req(ID_MERGE, DOC, 'baseLocale MUST resolve to data')).toEqual(s.data);
+  });
+});
+
+describe('v2 localized content: live advertisement coherence (i18n.md §Localized content "Advertisement")', () => {
+  it('the advertised content record is coherent with the advertised i18n record', async () => {
+    if (HTTP_SKIP) return softSkip('inapplicable', 'no target: OPENWOP_BASE_URL is unset');
+    let doc: Record<string, unknown> | null;
+    try { doc = await v2Discovery(); } catch { doc = null; }
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0');
+    const content = await familyAdvertised('content');
+    if (content === null) return softSkip('inapplicable', 'the host does not advertise content');
+    const out = coherenceLeg(PROFILE, doc);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    const v = contentRecord(content);
+    expect(v.ok, req(ID_COHERENT, 'schemas/v2/capabilities.schema.json §content', `the content record MUST validate: ${v.errors}`)).toBe(true);
+    for (const x of out.findings) expect(x.ok, req(ID_COHERENT, x.doc, x.message)).toBe(true);
+  });
+});

package/src/scenarios/v2-media-inline-cap-static.test.ts

@@ -0,0 +1,59 @@
+/**
+ * v2 — the `media.*` payload shapes, statically (`spec/v2/core/host-services.md`
+ * §aiProviders: "A `media.*` envelope inlines base64 only up to
+ * `maxInlineMediaBytes` (default 256 KiB); above that the host MUST use a
+ * `url`"; RFC 0055 §C). The v1 twin is the static half of
+ * `media-url-inline-cap`. Its advertisement leg (`aiProviders.maxInlineMediaBytes`)
+ * is in `v2-ai-providers-advertisement`; its seam legs (the media store and the
+ * debug-bundle walk) are not ported.
+ *
+ *   compile   the three `media.{image,audio,file}` schemas compile;
+ *   url       a URL-reference payload validates;
+ *   inline    an inline-base64 payload validates;
+ *   bytes     a payload without `bytes` is rejected (`bytes` is what a cap is
+ *             judged against);
+ *   closed    an unknown property is rejected.
+ *
+ * Host-free: every leg runs with no OPENWOP_BASE_URL.
+ *
+ * @see spec/v2/core/host-services.md §aiProviders
+ * @see schemas/v2/envelopes/media.image.schema.json
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Validator } from '../lib/v2.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'host-services.md §aiProviders';
+const MEDIA_KINDS = ['media.image', 'media.audio', 'media.file'] as const;
+const ID_COMPILE = 'openwop.requirement.media.payload-schemas-compile';
+const ID_URL = 'openwop.requirement.media.url-reference-accepted';
+const ID_INLINE = 'openwop.requirement.media.inline-base64-accepted';
+const ID_BYTES = 'openwop.requirement.media.bytes-required';
+const ID_CLOSED = 'openwop.requirement.media.payload-closed';
+
+describe('v2 media payload shapes (host-services.md §aiProviders)', () => {
+  for (const kind of MEDIA_KINDS) {
+    it(`envelopes/${kind}.schema.json compiles under Ajv 2020`, () => {
+      expect(() => v2Validator(`envelopes/${kind}`), req(ID_COMPILE, DOC, `schemas/v2/envelopes/${kind}.schema.json MUST compile`)).not.toThrow();
+    });
+  }
+
+  it('accepts a URL-reference image payload', () => {
+    const r = v2Validator('envelopes/media.image')({ url: 'https://host.example/runs/run_1/assets/img_9.png', bytes: 184320, mimeType: 'image/png' });
+    expect(r.ok, req(ID_URL, DOC, `a URL-reference media payload MUST validate (${r.errors})`)).toBe(true);
+  });
+
+  it('accepts an inline-base64 audio payload', () => {
+    const r = v2Validator('envelopes/media.audio')({ base64: 'AAAA', bytes: 3, mimeType: 'audio/ogg', durationSeconds: 1.2 });
+    expect(r.ok, req(ID_INLINE, DOC, `an inline-base64 media payload MUST validate (${r.errors})`)).toBe(true);
+  });
+
+  it('rejects a media payload missing bytes', () => {
+    expect(v2Validator('envelopes/media.file')({ url: 'https://host.example/runs/run_1/assets/report.pdf' }).ok, req(ID_BYTES, DOC, 'bytes is required on a media payload — it is what the inline cap is judged against')).toBe(false);
+  });
+
+  it('rejects a media payload with an unknown property', () => {
+    expect(v2Validator('envelopes/media.image')({ bytes: 1, wat: true }).ok, req(ID_CLOSED, DOC, 'a media payload is closed: an unknown property MUST be rejected')).toBe(false);
+  });
+});