@openwop/openwop-conformance 2.45.2 → 2.45.3

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 575,
-    "v1": 452,
-    "v2": 138
+    "files": 587,
+    "v1": 454,
+    "v2": 148
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1149,6 +1149,9 @@
     "secret-leakage-otel-attribute.test.ts": [
       1
     ],
+    "secrets-run-witness.test.ts": [
+      1
+    ],
     "self-hosted-runner.test.ts": [
       1
     ],
@@ -1263,6 +1266,9 @@
     "trigger-ingestion.test.ts": [
       1
     ],
+    "trigger-refused-event-keeps-subscription.test.ts": [
+      1
+    ],
     "trigger-stream-cdc-sources.test.ts": [
       1
     ],
@@ -1386,6 +1392,9 @@
     "v2-error-registry.test.ts": [
       2
     ],
+    "v2-eval-mode-unadvertised-refused.test.ts": [
+      2
+    ],
     "v2-event-type-closed.test.ts": [
       2
     ],
@@ -1401,6 +1410,9 @@
     "v2-form-when-reuses-edge-conditions.test.ts": [
       2
     ],
+    "v2-fs-sandbox-escape-refused.test.ts": [
+      2
+    ],
     "v2-header-scheme.test.ts": [
       2
     ],
@@ -1452,6 +1464,9 @@
     "v2-mcp-tasks.test.ts": [
       2
     ],
+    "v2-memory-cross-tenant-isolation.test.ts": [
+      2
+    ],
     "v2-min-client-version.test.ts": [
       2
     ],
@@ -1515,6 +1530,9 @@
     "v2-provider-conflict.test.ts": [
       2
     ],
+    "v2-queue-cross-tenant-isolation.test.ts": [
+      2
+    ],
     "v2-refresh-sla.test.ts": [
       2
     ],
@@ -1566,12 +1584,24 @@
     "v2-run-snapshot-etag.test.ts": [
       2
     ],
+    "v2-safefetch-ssrf-refused.test.ts": [
+      2
+    ],
+    "v2-secret-canary-absent.test.ts": [
+      2
+    ],
+    "v2-secrets-run-witness.test.ts": [
+      2
+    ],
     "v2-sse-last-event-id-cursor.test.ts": [
       2
     ],
     "v2-sse-last-event-id.test.ts": [
       2
     ],
+    "v2-storage-cross-tenant-isolation.test.ts": [
+      2
+    ],
     "v2-stream-mode-refusal.test.ts": [
       2
     ],
@@ -1584,6 +1614,9 @@
     "v2-terminal-event-once.test.ts": [
       2
     ],
+    "v2-tool-authorization-fail-closed.test.ts": [
+      2
+    ],
     "v2-tool-catalog-annotations.test.ts": [
       2
     ],
@@ -1635,6 +1668,9 @@
     "v2-well-known-one-resource.test.ts": [
       2
     ],
+    "v2-workspace-scope-from-identity.test.ts": [
+      2
+    ],
     "vector-knn-roundtrip.test.ts": [
       1
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.2",
-  "corpusTag": "v2.45.2",
+  "version": "2.45.3",
+  "corpusTag": "v2.45.3",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
-    "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
+    "api/openapi.yaml": "ad37a5a5c732ad46100fc03c3f4243fdd4f2976e330f02a8791b6b5b10a8a0c1",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "4eb20e64dbccf5e7ed1f3ffba7882f576bb1629f8523eaffae54d05809e1bc66",
-    "api/v2/asyncapi.yaml": "910690735bc6bca78f51801854fa3e3ed9eb9a56f65441d594401fb19e684ba3",
-    "api/v2/openapi.yaml": "b4fb04a206521719a1b13733914550d4d671e57c0c276122bedb88635fd8901c",
+    "api/seams-v2.yaml": "1f22ab7223019080332312b0fc9f7eb4c97bca2eebd57cab886acd1d6e3081d0",
+    "api/v2/asyncapi.yaml": "5b74151b1867c3c234203aa1f2dfb1ceeea216e013395e8696da02d4a8630412",
+    "api/v2/openapi.yaml": "05a07d9cd1e7f80da1e7044aace1073bf4ab584186cdd67979ba2664f90a80d0",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -31,7 +31,7 @@
     "schemas/artifact-type-pack-manifest.schema.json": "60342fcb15eb7f3ab46271f0641409a30d3a4a8f318b1020c53070886b191252",
     "schemas/audit-verify-result.schema.json": "0d3a3088ac1c32f9df66d346c33d7adbd8037940dba040e14ea847565a1a14bd",
     "schemas/budget-policy.schema.json": "3d4fe30ae129fe136ab9ece395f2a2a42a76360786b1b9a1d5f1cbc753eb5b39",
-    "schemas/capabilities.schema.json": "56b367074bce0f02ff87e0b84ccdf91856793d3d285e28f261656edba6352cc0",
+    "schemas/capabilities.schema.json": "d1d491248930e9b50ac6aca93a33cb1155eb997c4fbb2af0a940e8e889c76807",
     "schemas/certification-bundle-v2.schema.json": "2f85530dd04824a15810c94e96869362dee1e78396eca21fdd18e5501416bb7d",
     "schemas/channel-presence-payload.schema.json": "f9d0ef4219814c2b765baf3e68cbe5eea2cb42379f516a93a0459dcd5f7db47e",
     "schemas/channel-written-payload.schema.json": "54723a56bc5a35232f64544ca686ac1ac959a5fb05b32b2401facca6b3ef51a3",
@@ -95,7 +95,7 @@
     "schemas/suspend-request.schema.json": "7a90b622d5c619e3ffb5da696d272d6505e2780ab92ab631ac1b900f5daea908",
     "schemas/tool-descriptor.schema.json": "7f6adbae63003c1f1311f6a436f7f286542be62aa19a27b46730f2c2810857f7",
     "schemas/trigger-event.schema.json": "59d63b79dca3593f45d281776cbfe43ae4d85ee25519b82ad59f162a9efb592c",
-    "schemas/trigger-subscription-registration.schema.json": "929d628bad08e1def696e47e9a148aba00fa801e28d49bbd0dc2360b08673435",
+    "schemas/trigger-subscription-registration.schema.json": "2ca680ca6ffdb3cfc5de7bb8b8db8c3ec8eab4b88b7c9f7fe5edaecc7cf61ad0",
     "schemas/trigger-subscription.schema.json": "4f7b067f20032073b140c4bb15dc9a9914c4f6421a252ff1ff261cbdd8edf270",
     "schemas/ui-plugin-message.schema.json": "346638babf1f8ea7b161cde75c0038b518cd2cc5bf0631772e20a9b74c96b5dd",
     "schemas/v2/a2a-task-state.schema.json": "1810363e2d9bddb5997923bdac4044cc17c6f46ec5a40515d2ff21d9c82c1ad9",
@@ -116,7 +116,7 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
-    "schemas/v2/capabilities.schema.json": "d0b72f589b4e29ef69bd26e38a309aca1db2965c8441cae56c1dcc12c8d7152f",
+    "schemas/v2/capabilities.schema.json": "3792aa9d292229cf9b82c7306600a5dfdb63b3274523e0ed5dd4f952a04cb833",
     "schemas/v2/certification-bundle.schema.json": "82ce31a1ed6c7e21b0ba88ff62a7b8b768fc3b176b1d06fce023203830b94725",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -130,7 +130,7 @@
     "schemas/v2/conversation-turn.schema.json": "75bb6a4a03072a958feb5b34e2a1f40471e9e3996a81fa430b65717f0773c9a4",
     "schemas/v2/credential-provenance.schema.json": "f86b09e94b1c524dec7d1c6353965665ae8891e9517faef6e742d639c5578c99",
     "schemas/v2/credential-reference.schema.json": "ea699ce30f58fb2c32d4279158b3f730f70be7b2dc8c3037693a76e66eb3e001",
-    "schemas/v2/debug-bundle.schema.json": "f2b72cd658a2072e24031fcd916ba3eb8afe5618c540ea0e7e5cc79ef29d5cab",
+    "schemas/v2/debug-bundle.schema.json": "0ec1e0bca9c0a359cc6cf3448e5200a1c3d3d5b1e5efaa6605231477daaf3fee",
     "schemas/v2/dispatch-config.schema.json": "5718c1ed7d95672e618bcb1f1da8e38180e144b12151307afc3aba1314dfcef0",
     "schemas/v2/effect-ledger-projection.schema.json": "0d118d385a43921118a76888449c5c3c5618eab1b80914b84a0a1b48d18822c1",
     "schemas/v2/effect-seam-manifest.schema.json": "197ef9944ab027a50d1b9352f317cbbc12c8ad955fdb14650fb90477052ffef0",
@@ -186,7 +186,7 @@
     "schemas/v2/suspend-request.schema.json": "368d9932efb08f85b4520cac44b3c553876209f55bada93b5fcac93cc890b411",
     "schemas/v2/tool-descriptor.schema.json": "8c98fb5e93bc649dff859d3d1dde8075db929efd6c49c496252d0a88cccc73e1",
     "schemas/v2/trigger-event.schema.json": "710ecca8b3ecdad3a532a96768177f062192b24a589a4f798c7eb24bab64b30a",
-    "schemas/v2/trigger-subscription-registration.schema.json": "04bc314a07c7e8b565577cb8df5821d968ce2af915900dfdccd4a24e928d20db",
+    "schemas/v2/trigger-subscription-registration.schema.json": "5f7959f3e13f49399783e47f73101d6af95e5abccea1af2f0014ccbe3e51006c",
     "schemas/v2/trigger-subscription.schema.json": "1f5c286f68577d531ef9445ab2493f8d69ac9ee42313d28d758a0f00dd0fab36",
     "schemas/v2/ui-plugin-message.schema.json": "879d65867c01656b3962d64283e66364dcb8f626ad26c5fcf2d2d55a79ae0ce9",
     "schemas/v2/webhook-dead-letter-page.schema.json": "543f5ccc26d8f777684a037172ab7b9fdf70735e5394eeb42e5fa6569503f528",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "c948680f15a882c4bd97fa41235879d4103d3d3887ed294028ba9dfbb1d5d1a9",
+    "spec/v1/core-standard-manifest.json": "746278bbf9cf46840ba3bd5a85683251ddbc379466585f54e582754ce684d637",
     "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "ac1fb9286c963aa19824292526a6f9726d9d2df5fe06695cc6afdfb33554edd2",
+    "spec/v1/gaps.json": "2705bd6f7be31392ba09da318e99d55905dd08aa80e76e1226cf8f1a85132d18",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -227,7 +227,7 @@
     "spec/v2/core/execution.md": "8a0c9db1bbfb97c008ab9328b7333c1cc3318196e78bfbefb49e781bdf4f9d44",
     "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
     "spec/v2/core/headers.md": "21d6c8220c3ac75b10e31c4cf6179abb539e2558af5006e40228d8c383ed5c92",
-    "spec/v2/core/host-services.md": "18389b55286875922c26e13fbcd6c787fca2568f68b7e6f65176f1938404a218",
+    "spec/v2/core/host-services.md": "73f26ea32891044131d63f9861d2cbddccb5d08bf76e29e47afef9bb5b646791",
     "spec/v2/core/i18n.md": "882904b7d59f992ab1e5f7346167161a54cf665b8fee47e64a3862cf9133a580",
     "spec/v2/core/idempotency.md": "adbd317a6ebb57c2759c076297b31f67def9e391576bccd0bbea787b13e85872",
     "spec/v2/core/identity.md": "f61dc646f56fc1c07016c3acec9e8eb8c51051c55ecbedc986de793669fb6e6b",
@@ -240,16 +240,16 @@
     "spec/v2/core/persistence.md": "249a1de353f421cdf92b9006a13a10afdb002f4029eb6a13520cc95252edb2ec",
     "spec/v2/core/portability.md": "ab13a6ca43544b9a6a91edfb377ec680c768d14be841c84fb79125b231426891",
     "spec/v2/core/replay.md": "4a8b53325e18aa53400ece81168c76b4402b932e5e304a391754f293b126eabf",
-    "spec/v2/core/runs.md": "18261bf0fff85101ee9547dd2cd9f06055f2095609dfd23e0f8fdbd1f1d2d0d0",
+    "spec/v2/core/runs.md": "991757ded9b3645bafad2344f4ccb75c7d79993bd80269f9dd3489193841d71b",
     "spec/v2/core/security-defaults.md": "887d8c4bc592094e3b931c23f1c2175c18ebbd47528b074016f9d2091bc513b2",
     "spec/v2/core/storage.md": "dc94b985847c1341c7a064f04a6010f0fdbe6c3ab3e555d4362878c81d764c18",
     "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
     "spec/v2/core/versioning.md": "b7acb0d8b77425cb53ea700e47ba790bf7506de600c398690e6ec5bb9c7a220e",
-    "spec/v2/core/webhooks.md": "7b2606b2ebbeafd84ca052a5c4d2f392cade0b482fbb063acb0aeb38675f6ede",
+    "spec/v2/core/webhooks.md": "b0c08a3511b9319da7b0f7d83cddb15758acfc92e4c58c3604ac0f6b1ab13242",
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
-    "spec/v2/corrections.json": "59f647f4d22477f6c2b06dcf913b682dde5d51dd5e607a5d0cf648ab60864d6e",
+    "spec/v2/corrections.json": "3a8d93e33865b692d26a3b6bfd3819766e206b2e0c2a69669baa4bf833d05a49",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "24866c15908b3b70d96339dd852187ba908ddf65f90fad1d566ba6df5881aa48",
+    "spec/v2/declaration.json": "967f6db929fd7c4000d41a12d8b6d9f77bad90348de0dbc792b02f33e7026385",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/errors.json": "83f048b0a06952b4af6f125fb66c4212acab51056b411390f1010acd6ab9cdc0",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
@@ -260,7 +260,7 @@
     "spec/v2/ext/brand/README.md": "82989c018d7965bab029bcce7a67b1d76ffc433d08971a4cac91befcccc09438",
     "spec/v2/ext/canvas/README.md": "00ca0856e3a0146f1eeaec87209d450e2900ed2748dc7520cc60250a0d3ffbeb",
     "spec/v2/ext/chat/README.md": "f59b6706162abbfff96f8bccd4c0e1aeed721047cf62e9af58c875727a38d716",
-    "spec/v2/ext/coordination/README.md": "c7fe0884f52405fdd02c5f9ec309ac6b585685ee06ec5f338fff7acf03c07148",
+    "spec/v2/ext/coordination/README.md": "7185af14aa0a2b554095ddbf10b0443b535fd28311a1836c6aa733b203030a9a",
     "spec/v2/ext/dataIntegration/README.md": "286dec8aa29e4d3225cbd8b3a361f5a438c3288e759966b9415ecbb99c576e70",
     "spec/v2/ext/entities/README.md": "956d4a9a2aedb8cb9c79ce8145580480920474cc6943f0e33ede32d7b20414dc",
     "spec/v2/ext/grpc-transport/README.md": "6ba378e3c6d1f2e3269b392cfdf0c40565ee9bfa259d1baaa9ee1d350e38e792",
@@ -303,9 +303,9 @@
     "spec/v2/path-manifest.json": "27c2307b84376b2f22bea4e2213fc7e33ef3bf8fd1d18039f7955edb00dc9c9a",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "f042a3f11bc9eaffcd054a6f4b94e78931d6289191d2c8dde2f169a63478e3f1",
+    "spec/v2/release.json": "0befa21e6634c82cd3d6be9e487f79b7bf77fd3143ce3e0aed301230753b21bc",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "18c9f38e3b596465128ceeee10cbdd17395672da5fe321db03ab4eee67bd50a4"
+    "spec/v2/surface-baseline.json": "fd44c977c6646c0bcbd85f9f5c4dce620bba29ee56b10cd077e3f71437e0276a"
   },
-  "corpusCommit": "5bc14dd1ef9a0c6d8ab4bf220fbef47a74792212"
+  "corpusCommit": "f84011f0ce7ba068e53c1aa2b92d17fa97f5df5f"
 }

package/src/cli.ts

@@ -685,7 +685,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       if (target.major === 2) return verdictFor(profile)?.witnessedPasses ?? 0;
       const floor = PROFILE_FLOOR_SCENARIOS[profile];
       if (!floor) return 0;
-      const onFloor = (scenario: string): boolean => floor.required.includes(scenario) || (floor.requiredAnyPrefix ?? []).some((pre) => scenario.startsWith(pre));
+      const onFloor = (scenario: string): boolean => floor.required.includes(scenario) || (floor.requiredAnyPrefix ?? []).some((pre) => scenario.startsWith(pre)) || (floor.requiredAnyOf ?? []).some((g) => g.includes(scenario));
       return derived.requirements.filter((r) => r.disposition === 'executed-pass' && onFloor(r.scenarioId)).length;
     };
     // `certified` IS the verdict (RFC 0148 §A; RFC 0168 §E.1 adds the bundle-wide

package/src/lib/certification-bundle-verify.ts

@@ -31,7 +31,7 @@ import {
   type DiscoveryPayload,
 } from './profiles.js';
 import { CERTIFIABLE, DISPOSITIONS, type Disposition } from './requirement-ledger.js';
-import { floorFilesFor, requirementIdForPrefix, requirementIdForScenario } from './requirement-registry.js';
+import { floorFilesFor, requirementIdForAnyOf, requirementIdForPrefix, requirementIdForScenario } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 
 /**
@@ -149,7 +149,7 @@ export function findLiteral(value: unknown, literal: string): string[] {
  * it is the prefix requirement id, and the rows that satisfy it are the
  * matching scenario rows.
  */
-function requiredFor(profile: string, document: Readonly<Record<string, unknown>>): { files: string[]; prefixes: string[]; discoveryOnly: boolean } | null {
+function requiredFor(profile: string, document: Readonly<Record<string, unknown>>): { files: string[]; prefixes: string[]; anyOf: Array<readonly string[]>; discoveryOnly: boolean } | null {
   const floor = PROFILE_FLOOR_SCENARIOS[profile];
   if (floor === undefined) return null;
   // Discovery-conditional floors (G7) are evaluated against the bundle's own
@@ -159,6 +159,7 @@ function requiredFor(profile: string, document: Readonly<Record<string, unknown>
   return {
     files: [...files],
     prefixes: [...(floor.requiredAnyPrefix ?? [])],
+    anyOf: [...(floor.requiredAnyOf ?? [])],
     discoveryOnly: floor.discoveryOnly === true,
   };
 }
@@ -272,6 +273,26 @@ export function verifyBundleV2(bundle: BundleV2Like): BundleV2Verdict {
       if (!considered.some((r) => isWitnessedPass(r))) notCertifiable.push(id);
     }
 
+    for (const group of req.anyOf) {
+      // RFC 0229 §E: one requirement, satisfied by a WITNESSED pass of any
+      // member with no member failing. The emitter writes a summary row under
+      // the group id; member rows are read when it is absent.
+      const id = requirementIdForAnyOf(group);
+      required.push(id);
+      const summary = byId.get(id)?.[0];
+      const members = group.map((f) => byId.get(requirementIdForScenario(scenarioBasename(f)))?.[0]).filter((r): r is BundleV2Requirement => r !== undefined);
+      if (summary === undefined && members.length === 0) {
+        profileRejections.push({ kind: 'unwitnessed-requirement', profile, requirementId: id, detail: `${id}: no alternative (${group.join(', ')}) recorded a row` });
+        continue;
+      }
+      const considered = summary !== undefined ? [summary] : members;
+      if (considered.some((r) => r.disposition === 'executed-pass' && !isWitnessedPass(r))) {
+        profileRejections.push({ kind: 'vacuous-pass', profile, requirementId: id, detail: `${id}: executed-pass with no witnessed assertion` });
+        continue;
+      }
+      if (considered.some((r) => r.disposition === 'executed-fail') || !considered.some((r) => isWitnessedPass(r))) notCertifiable.push(id);
+    }
+
     const evidenceValid = profileRejections.length === 0;
     const certified = derivable && evidenceValid && notCertifiable.length === 0 && (req.discoveryOnly || required.length > 0);
     return { profile, derivable, floorUnspecified: false, required, rejections: profileRejections, notCertifiable, evidenceValid, certified };

package/src/lib/driver.ts

@@ -11,6 +11,46 @@
 
 import { loadEnv } from './env.js';
 import { seamPath, targetMajor } from './seams.js';
+import { scaledTimeoutMs } from './timeout-scale.js';
+
+/**
+ * How long one request may go unanswered before the driver gives up (#1829).
+ * Below vitest's 30 s `testTimeout`, so a lost response ends as a named
+ * {@link TransportError} and not as a bare harness timeout. Driver long-polls
+ * are at most 5 s. Scales with `OPENWOP_POLL_TIMEOUT_SCALE`.
+ */
+export const REQUEST_TIMEOUT_MS = 20_000;
+
+/** Leads every {@link TransportError} message; `resolveItRecord` keys on it. */
+export const TRANSPORT_LOSS_PREFIX = 'transport-loss: ';
+
+/**
+ * No response arrived: the request timed out or the connection failed. The
+ * suite observed nothing about the host, so this is never a verdict on it. A
+ * runner whose network dropped for 9 s once recorded `executed-fail` against a
+ * host that had answered in 2.6 ms (MyndHyve cut, suite 2.45.2).
+ */
+export class TransportError extends Error {
+  constructor(
+    readonly kind: 'timeout' | 'network',
+    readonly method: string,
+    /** Origin and path only. A query string can carry a token. */
+    readonly target: string,
+    reason: string,
+  ) {
+    super(`${TRANSPORT_LOSS_PREFIX}${method} ${target} got no response (${reason}); the suite could not observe the host`);
+    this.name = 'TransportError';
+  }
+}
+
+function withoutQuery(url: string): string {
+  try {
+    const u = new URL(url);
+    return `${u.origin}${u.pathname}`;
+  } catch {
+    return url.split('?')[0] ?? url;
+  }
+}
 
 export interface OpenWOPResponse {
   readonly status: number;
@@ -25,6 +65,10 @@ export interface OpenWOPRequestInit {
   /** `false` sends no default credential. A caller-supplied `Authorization`
    *  header is always sent as given, whatever this says. */
   readonly authenticated?: boolean;
+  /** Replaces the driver's own bound entirely; an abort it raises is rethrown as-is. */
+  readonly signal?: AbortSignal;
+  /** Overrides {@link REQUEST_TIMEOUT_MS} for one request (scaled the same way). */
+  readonly timeoutMs?: number;
 }
 
 class OpenWOPDriver {
@@ -83,9 +127,24 @@ class OpenWOPDriver {
         fetchInit.body = JSON.stringify(init.body);
       }
     }
-    const res = await fetch(url, fetchInit);
+    const boundMs = scaledTimeoutMs(init.timeoutMs ?? REQUEST_TIMEOUT_MS);
+    fetchInit.signal = init.signal ?? AbortSignal.timeout(boundMs);
+    let res: Response;
+    let text: string;
+    try {
+      res = await fetch(url, fetchInit);
+      // The body is read under the same bound: a response whose headers arrive
+      // and whose body never does is the same lost observation.
+      text = await res.text();
+    } catch (err) {
+      // The caller's own signal aborted: that is the caller's event, not a loss.
+      if (init.signal?.aborted === true) throw err;
+      const name = err instanceof Error ? err.name : '';
+      if (name === 'TimeoutError') throw new TransportError('timeout', method, withoutQuery(url), `no response within ${boundMs} ms`);
+      const cause = err instanceof Error ? (err.cause instanceof Error ? err.cause.message : err.message) : String(err);
+      throw new TransportError('network', method, withoutQuery(url), cause.slice(0, 160));
+    }
 
-    const text = await res.text();
     let json: unknown;
     try {
       json = text.length > 0 ? JSON.parse(text) : undefined;

package/src/lib/memoryAttribution.ts

@@ -42,9 +42,19 @@ export async function readMemoryAttributionCap(): Promise<Record<string, unknown
   return attr && typeof attr === 'object' ? (attr as Record<string, unknown>) : null;
 }
 
-/** True when the host commits to emitting `memory.written`. */
+/**
+ * True when the host commits to emitting `memory.written`.
+ *
+ * Major 1: the v1 block's `supported: true` (its schema `const`) AND
+ * `emitsWriteEvents: true`. Major 2: there is no `supported` field — presence
+ * of the `memory` family record IS the claim (RFC 0169 §A.2), and
+ * `readMemoryAttributionCap` returns the `attribution` object only when that
+ * record is present — so the commitment is `emitsWriteEvents: true` alone.
+ * Requiring `supported` at major 2 soft-skipped every v2 host (suite 2.45.3).
+ */
 export function emitsWriteEvents(cap: Record<string, unknown> | null): boolean {
-  return cap?.['supported'] === true && cap?.['emitsWriteEvents'] === true;
+  if (cap?.['emitsWriteEvents'] !== true) return false;
+  return targetMajor() === 2 ? true : cap['supported'] === true;
 }
 
 const SEED_FIXTURE = 'conformance-noop';
@@ -71,9 +81,34 @@ interface RunEventLike {
   payload?: Record<string, unknown>;
 }
 
-/** Fetches a run's events and returns only the `memory.written` ones. */
+/**
+ * Fetches a run's events and returns only the `memory.written` ones.
+ *
+ * Major 2: `GET /runs/{runId}/events` is the SSE stream (`streamRunEvents`,
+ * `text/event-stream` only), so a JSON read of it yields nothing and every leg
+ * would soft-skip "run wrote no memory" — a `blocked` row that denies
+ * certification for a suite defect. The JSON projection at v2 is the poll
+ * (`events.md` §Poll), read from sequence 0 and paged on `afterSequence` until
+ * `lastSequence` is reached.
+ */
 export async function memoryWrittenEvents(runId: string): Promise<RunEventLike[]> {
-  const res = await driver.get(`${runsPath()}/${encodeURIComponent(runId)}/events`);
-  const events = (res.json as { events?: RunEventLike[] } | undefined)?.events ?? [];
-  return events.filter((e) => e.type === 'memory.written');
+  if (targetMajor() !== 2) {
+    const res = await driver.get(`${runsPath()}/${encodeURIComponent(runId)}/events`);
+    const events = (res.json as { events?: RunEventLike[] } | undefined)?.events ?? [];
+    return events.filter((e) => e.type === 'memory.written');
+  }
+  const out: RunEventLike[] = [];
+  let after = -1;
+  for (let page = 0; page < 50; page++) {
+    const q = after < 0 ? '' : `&afterSequence=${after}`;
+    const res = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1${q}`);
+    const body = res.json as { events?: Array<RunEventLike & { sequence?: number }>; lastSequence?: number } | undefined;
+    const events = res.status === 200 && Array.isArray(body?.events) ? body.events : [];
+    out.push(...events);
+    const seqs = events.map((e) => e.sequence).filter((s): s is number => typeof s === 'number');
+    const next = seqs.length ? Math.max(...seqs) : after;
+    if (next <= after || typeof body?.lastSequence !== 'number' || next >= body.lastSequence) break;
+    after = next;
+  }
+  return out.filter((e) => e.type === 'memory.written');
 }

package/src/lib/polling.ts

@@ -28,6 +28,7 @@
  */
 
 import { driver } from './driver.js';
+import { scaledTimeoutMs } from './timeout-scale.js';
 import { targetMajor } from './seams.js';
 
 export interface RunSnapshot {
@@ -52,24 +53,7 @@ export interface RunSnapshot {
 const POLL_INTERVAL_MS = 250;
 const DEFAULT_TIMEOUT_MS = Number(process.env.OPENWOP_LIFECYCLE_TIMEOUT_MS ?? 10_000);
 
-/**
- * Multiplier applied to every poll bound (see the module docstring). Invalid,
- * non-positive, or non-finite values fall back to `1` rather than silently
- * producing a zero or negative deadline — a mis-set knob must not turn every
- * poll into an instant failure that looks like a host defect.
- */
-function pollTimeoutScale(): number {
-  const raw = process.env.OPENWOP_POLL_TIMEOUT_SCALE;
-  if (raw === undefined || raw === '') return 1;
-  const n = Number(raw);
-  return Number.isFinite(n) && n > 0 ? n : 1;
-}
-
-/** Apply the scale to a bound, rounding up so a scale of 1 is exactly a no-op. */
-export function scaledTimeoutMs(timeoutMs: number): number {
-  const scale = pollTimeoutScale();
-  return scale === 1 ? timeoutMs : Math.ceil(timeoutMs * scale);
-}
+export { scaledTimeoutMs };
 
 /**
  * Live-model scenarios (RFC 0111's `conformance-context-budget-live`) drive real

package/src/lib/profiles.ts

@@ -495,6 +495,16 @@ export interface ProfileFloor {
   readonly required: readonly string[];
   /** Prefix groups where ≥1 matching passed scenario satisfies the group. */
   readonly requiredAnyPrefix?: readonly string[];
+  /**
+   * RFC 0229 §E — ANY-OF groups: each inner list names alternative scenario
+   * files, and the group is satisfied when at least one of them records a
+   * WITNESSED pass and none of them records a failure. A group is one
+   * requirement (`openwop.floor.anyof.<stem>+<stem>`, a summary row the runner
+   * derives from the members, like `requiredAnyPrefix`). An `inapplicable` or
+   * `skipped` member never satisfies it: `openwop-secrets` is certified by the
+   * canary round-trip OR the run-witness, not by the absence of both.
+   */
+  readonly requiredAnyOf?: ReadonlyArray<readonly string[]>;
   /**
    * The profile is discovery-payload-only: its predicate IS the whole claim and
    * it has no runtime floor. This flag exists so an EMPTY floor is a decision on
@@ -529,6 +539,11 @@ export interface ProfileFloor {
   readonly conditional?: ReadonlyArray<{ readonly path: string; readonly includes: string; readonly required: readonly string[] }>;
 }
 
+/** Every scenario FILE a floor names: `required`, every `conditional` branch, and every `requiredAnyOf` member. */
+export function floorMemberFiles(floor: ProfileFloor): string[] {
+  return [...floor.required, ...(floor.conditional ?? []).flatMap((c) => c.required), ...(floor.requiredAnyOf ?? []).flat()];
+}
+
 export const PROFILE_FLOOR_SCENARIOS: Readonly<Record<string, ProfileFloor>> = {
   'openwop-core-standard': {
     required: [
@@ -607,7 +622,11 @@ export const PROFILE_FLOOR_SCENARIOS: Readonly<Record<string, ProfileFloor>> = {
   // `profiles.md` §`openwop-secrets`: credential resolution per `run-options.md`
   // §"Credential references" — the BYOK canary round-trip (`fixtures.md`
   // §conformance-secrets-roundtrip, SR-1) is the profile's proof.
-  'openwop-secrets': { required: ['byok-roundtrip.test.ts'] },
+  // RFC 0229 §E (2026-09-30): a SECOND floor path, as an any-of group. The
+  // canary fixture's node is an oracle over whatever its name reaches, so a
+  // production host rightly withholds it; the run-witness reads only a value
+  // the caller supplied with the same run and outputs only `matched`.
+  'openwop-secrets': { required: [], requiredAnyOf: [['byok-roundtrip.test.ts', 'secrets-run-witness.test.ts']] },
 
   // `profiles.md` §`openwop-provider-policy`: the four-mode taxonomy shape and
   // its enforcement on the wire.
@@ -756,9 +775,14 @@ export function verifyBundleProfile(bundle: CertificationBundleLike, profile: st
   }
   const missingFloor = requiredFiles.filter((r) => !passed.has(scenarioBasename(r)));
   const prefixOk = (floor.requiredAnyPrefix ?? []).every((p) => [...passed].some((s) => s.startsWith(p)));
+  // RFC 0229 §E any-of groups: a v1 bundle lists only what passed, so a group
+  // holds when one member is in `results.passed`; an unmet group is reported
+  // as missing, spelled as its alternatives.
+  const groups = floor.requiredAnyOf ?? [];
+  for (const g of groups) if (!g.some((f) => passed.has(scenarioBasename(f)))) missingFloor.push(g.join(' | '));
   // A conditional floor none of whose branches matched requires nothing — that
   // is unprovable for a non-discovery-only profile, not proven.
-  const evaluable = floor.discoveryOnly === true || requiredFiles.length > 0 || (floor.requiredAnyPrefix ?? []).length > 0;
+  const evaluable = floor.discoveryOnly === true || requiredFiles.length > 0 || (floor.requiredAnyPrefix ?? []).length > 0 || groups.length > 0;
   const floorProven = evaluable && missingFloor.length === 0 && prefixOk;
   return {
     profile,

package/src/lib/requirement-registry.ts

@@ -36,6 +36,15 @@ export function requirementIdForPrefix(prefix: string): string {
   return `openwop.floor.any.${prefix}`;
 }
 
+/**
+ * Any-of groups (RFC 0229 §E) become one requirement:
+ * `['byok-roundtrip.test.ts', 'secrets-run-witness.test.ts']` →
+ * `openwop.floor.anyof.byok-roundtrip+secrets-run-witness`.
+ */
+export function requirementIdForAnyOf(files: readonly string[]): string {
+  return `openwop.floor.anyof.${files.map((f) => f.replace(/\.test\.ts$/, '')).join('+')}`;
+}
+
 /**
  * The requirement IDs a profile's certification rests on.
  *
@@ -122,6 +131,7 @@ export function requirementsFor(profile: string, document?: Readonly<Record<stri
   return [
     ...files.map(requirementIdForScenario),
     ...(floor.requiredAnyPrefix ?? []).map(requirementIdForPrefix),
+    ...(floor.requiredAnyOf ?? []).map(requirementIdForAnyOf),
   ];
 }
 
@@ -134,6 +144,8 @@ export function allRequirements(): readonly string[] {
     for (const f of floor.required) ids.add(requirementIdForScenario(f));
     for (const c of floor.conditional ?? []) for (const f of c.required) ids.add(requirementIdForScenario(f));
     for (const p of floor.requiredAnyPrefix ?? []) ids.add(requirementIdForPrefix(p));
+    // an any-of group is one requirement, and each member file records under its own floor id
+    for (const g of floor.requiredAnyOf ?? []) { ids.add(requirementIdForAnyOf(g)); for (const f of g) ids.add(requirementIdForScenario(f)); }
     void profile;
   }
   return [...ids].sort();