@openwop/openwop-conformance 2.45.2 → 2.45.3

package/src/lib/run-secrets-witness.ts

@@ -0,0 +1,240 @@
+/**
+ * RFC 0229 — the production-safe secret witness, shared by `secrets-run-witness`
+ * (major 1, `/v1/...`) and `v2-secrets-run-witness` (major 2, unversioned
+ * paths under `OpenWOP-Version: 2.0`, which the driver adds).
+ *
+ * The suite draws a fresh value `C` per run (48 CSPRNG bytes, base64url, 64
+ * characters, no fixed prefix) and supplies it as the top-level
+ * `runSecrets: [{ ref, value: C }]` of `createRun`. The fixture
+ * `openwop-secrets-run-witness` runs one `core.secret.witness` node that
+ * compares `sha256(C)` with an `expectedSha256` input and outputs only
+ * `{ matched }`. The scans read RAW response text, never parsed JSON, so an
+ * escaping difference cannot hide a hit (RFC 0229 Implementation notes).
+ *
+ * @see spec/v2/core/host-services.md §Run-supplied secrets
+ * @see spec/v1/capabilities.md §"Run-supplied secrets"
+ * @see RFCS/0229-production-safe-secrets-witness.md
+ */
+
+import { createHash, randomBytes } from 'node:crypto';
+import { driver, type OpenWOPResponse } from './driver.js';
+import { loadEnv } from './env.js';
+import { discoveryFamilies } from './discovery-capabilities.js';
+import { isFixtureAdvertised } from './fixtures.js';
+
+export const WITNESS_FIXTURE = 'openwop-secrets-run-witness';
+export const WITNESS_NODE = 'witness';
+export const WITNESS_REF = 'run:openwop-witness';
+export const CANARY_NAME = 'openwop-conformance-canary-secret';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+export type Major = 1 | 2;
+export type Gate =
+  | { ok: true; maxEntries: number; branchFork: boolean }
+  | { ok: false; kind: 'inapplicable' | 'blocked'; reason: string };
+
+export const sha256Hex = (s: string): string => createHash('sha256').update(s, 'utf8').digest('hex');
+
+/** A fresh witness value: 48 CSPRNG bytes, base64url, 64 characters, no fixed prefix. */
+export function freshValue(): string {
+  return randomBytes(48).toString('base64url');
+}
+
+/** A fresh non-`run:` secret name (the scope leg's "random name"). */
+export function freshName(): string {
+  return `openwop-witness-${randomBytes(9).toString('hex')}`;
+}
+
+/**
+ * Every form in which `C` "appears" (RFC 0229 §F row 2): raw; standard and
+ * URL-safe base64 of its UTF-8 bytes, padded and not; lower- and upper-case
+ * hex of those bytes; percent-encoded; JSON-string-escaped; and `sha256(C)`
+ * (lower and upper hex, and base64) — the digest is an output §B.3 forbids.
+ */
+export function forms(c: string): ReadonlyArray<{ name: string; text: string }> {
+  const bytes = Buffer.from(c, 'utf8');
+  const b64 = bytes.toString('base64');
+  const b64url = bytes.toString('base64url');
+  const digest = createHash('sha256').update(bytes).digest();
+  const out = [
+    { name: 'raw', text: c },
+    { name: 'base64', text: b64 },
+    { name: 'base64 (unpadded)', text: b64.replace(/=+$/, '') },
+    { name: 'base64url', text: b64url },
+    { name: 'base64url (padded)', text: b64url + '='.repeat((4 - (b64url.length % 4)) % 4) },
+    { name: 'hex', text: bytes.toString('hex') },
+    { name: 'HEX', text: bytes.toString('hex').toUpperCase() },
+    { name: 'percent-encoded', text: encodeURIComponent(c) },
+    { name: 'JSON-escaped', text: JSON.stringify(c).slice(1, -1) },
+    { name: 'sha256 hex', text: digest.toString('hex') },
+    { name: 'SHA256 HEX', text: digest.toString('hex').toUpperCase() },
+    { name: 'sha256 base64', text: digest.toString('base64') },
+  ];
+  return out.filter((f, i) => out.findIndex((g) => g.text === f.text) === i);
+}
+
+/**
+ * The forms of `c` that occur in `text`. `digestSupplied`: the suite itself
+ * passed `sha256(C)` as the run's `expectedSha256` input, which a host may
+ * legitimately echo as an input, so the digest forms are not a leak for that
+ * run and are not scanned. They are scanned for every value whose digest the
+ * suite never sent (the mismatch run, and the retried value `C′`).
+ */
+export function hits(text: string, c: string, digestSupplied = false): string[] {
+  return forms(c).filter((f) => !(digestSupplied && f.name.toLowerCase().startsWith('sha256'))).filter((f) => text.includes(f.text)).map((f) => f.name);
+}
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+export class WitnessHost {
+  constructor(readonly major: Major) {}
+
+  private p(path: string): string {
+    return this.major === 1 ? `/v1${path}` : path;
+  }
+
+  private enc(id: string): string {
+    return encodeURIComponent(id);
+  }
+
+  async discovery(): Promise<Record<string, unknown> | null> {
+    const res = await http(() => driver.get('/.well-known/openwop', { authenticated: false }));
+    return res?.status === 200 && res.json && typeof res.json === 'object' ? discoveryFamilies(res.json) : null;
+  }
+
+  /**
+   * RFC 0229 §F dispositions: facet absent ⇒ `inapplicable` (the host offers
+   * no run-supplied secrets); facet advertised without the fixture ⇒ `blocked`
+   * (§C requires it). Discovery unreadable ⇒ `blocked`.
+   */
+  async gate(): Promise<Gate> {
+    const doc = await this.discovery();
+    if (doc === null) return { ok: false, kind: 'blocked', reason: '/.well-known/openwop did not answer 200 with a JSON body' };
+    const secrets = doc['secrets'];
+    const rs = secrets && typeof secrets === 'object' ? (secrets as Record<string, unknown>)['runSecrets'] : undefined;
+    if (rs === undefined || rs === null || typeof rs !== 'object') {
+      return { ok: false, kind: 'inapplicable', reason: 'secrets.runSecrets is not advertised — the host offers no run-supplied secrets (RFC 0229 §D)' };
+    }
+    if (!isFixtureAdvertised(WITNESS_FIXTURE)) {
+      return { ok: false, kind: 'blocked', reason: `secrets.runSecrets is advertised but the fixture ${WITNESS_FIXTURE} is not — RFC 0229 §C requires it, so the witness cannot run` };
+    }
+    const maxEntries = Number((rs as Record<string, unknown>)['maxEntries']);
+    const replay = doc['replay'];
+    const modes = replay && typeof replay === 'object' ? (replay as Record<string, unknown>)['modes'] : undefined;
+    const supported = this.major === 1 ? (replay as Record<string, unknown> | undefined)?.['supported'] === true : replay !== undefined;
+    return { ok: true, maxEntries: Number.isFinite(maxEntries) ? maxEntries : 1, branchFork: supported && Array.isArray(modes) && modes.includes('branch') };
+  }
+
+  /** `createRun` of the witness fixture. `runSecrets` is omitted when `undefined`. */
+  create(inputs: { ref: string; expectedSha256: string }, runSecrets?: ReadonlyArray<{ ref: string; value: string }>, idempotencyKey?: string): Promise<OpenWOPResponse | null> {
+    const body: Record<string, unknown> = { workflowId: WITNESS_FIXTURE, inputs };
+    if (runSecrets !== undefined) body['runSecrets'] = runSecrets;
+    return http(() => driver.post(this.p('/runs'), body, idempotencyKey === undefined ? {} : { headers: { 'Idempotency-Key': idempotencyKey } }));
+  }
+
+  async snapshot(runId: string): Promise<OpenWOPResponse | null> {
+    return http(() => driver.get(this.p(`/runs/${this.enc(runId)}`)));
+  }
+
+  async waitTerminal(runId: string, timeoutMs = 20_000): Promise<Record<string, unknown> | null> {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+      const res = await this.snapshot(runId);
+      const snap = res?.status === 200 && res.json && typeof res.json === 'object' ? (res.json as Record<string, unknown>) : null;
+      if (snap !== null && TERMINAL.has(String(snap['status']))) return snap;
+      if (Date.now() > deadline) return snap;
+      await new Promise((r) => setTimeout(r, 250));
+    }
+  }
+
+  async events(runId: string): Promise<{ text: string; events: Array<Record<string, unknown>> }> {
+    const res = await http(() => driver.get(this.p(`/runs/${this.enc(runId)}/events/poll?timeout=1`)));
+    let events: Array<Record<string, unknown>> = [];
+    const body = res?.json as { events?: unknown } | undefined;
+    if (Array.isArray(body?.events)) events = body.events as Array<Record<string, unknown>>;
+    if (events.length === 0 && this.major === 1) {
+      const alt = await http(() => driver.get(this.p(`/runs/${this.enc(runId)}/events`)));
+      const b = alt?.json as { events?: unknown } | undefined;
+      if (Array.isArray(b?.events)) return { text: `${res?.text ?? ''}\n${alt?.text ?? ''}`, events: b.events as Array<Record<string, unknown>> };
+    }
+    return { text: res?.text ?? '', events };
+  }
+
+  /** The raw SSE text under `streamMode=debug` — the most verbose mode (events.md §Stream modes). */
+  async debugStream(runId: string, timeoutMs = 6_000): Promise<string> {
+    const env = loadEnv();
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), timeoutMs);
+    try {
+      const res = await fetch(`${env.baseUrl}${this.p(`/runs/${this.enc(runId)}/events`)}?streamMode=debug`, {
+        headers: { Accept: 'text/event-stream', Authorization: `Bearer ${env.apiKey}`, ...(this.major === 2 ? { 'OpenWOP-Version': '2.0' } : {}) },
+        signal: ctl.signal,
+      });
+      if (res.body === null) return '';
+      try { return await res.text(); } catch { return ''; }
+    } catch {
+      return '';
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  /**
+   * Every readable surface of a terminal run, as raw text: the create answer,
+   * the snapshot, the polled events, the `debug` stream, the run list (where
+   * served), and the debug bundle (where the seam serves one).
+   */
+  async surfaces(runId: string, extra: readonly string[] = []): Promise<{ text: string; read: string[] }> {
+    const read: string[] = [];
+    const parts: string[] = [...extra];
+    if (extra.length > 0) read.push('createRun response');
+    const snap = await this.snapshot(runId);
+    if (snap !== null) { parts.push(snap.text); read.push('snapshot'); }
+    const ev = await this.events(runId);
+    parts.push(ev.text); read.push('events (poll)');
+    const dbg = await this.debugStream(runId);
+    if (dbg.length > 0) { parts.push(dbg); read.push('events (streamMode=debug)'); }
+    const list = await http(() => driver.get(this.p('/runs?limit=50')));
+    if (list?.status === 200) { parts.push(list.text); read.push('listRuns'); }
+    const bundle = await http(() => driver.post('/v1/host/sample/test/debug-bundle/export', { runId }));
+    if (bundle?.status === 200) { parts.push(bundle.text); read.push('debug bundle'); }
+    return { text: parts.join('\n'), read };
+  }
+
+  /** `witness`'s `matched`, from `node.completed` outputs or the snapshot; `undefined` when not observable. */
+  async matched(runId: string, snap: Record<string, unknown> | null): Promise<boolean | undefined> {
+    const { events } = await this.events(runId);
+    for (const e of events) {
+      if (e['type'] !== 'node.completed') continue;
+      const payload = (e['payload'] ?? e['data'] ?? {}) as Record<string, unknown>;
+      if ((payload['nodeId'] ?? e['nodeId']) !== WITNESS_NODE) continue;
+      const outputs = (payload['outputs'] ?? e['outputs']) as Record<string, unknown> | undefined;
+      if (typeof outputs?.['matched'] === 'boolean') return outputs['matched'] as boolean;
+    }
+    for (const key of ['outputs', 'variables', 'nodeOutputs']) {
+      const bag = snap?.[key] as Record<string, unknown> | undefined;
+      const node = bag?.[WITNESS_NODE] as Record<string, unknown> | undefined;
+      if (typeof node?.['matched'] === 'boolean') return node['matched'] as boolean;
+    }
+    return undefined;
+  }
+
+  /** `witness`'s `node.failed` error code; `null` when no `node.failed` names it. */
+  async nodeFailedCode(runId: string): Promise<string | null> {
+    const { events } = await this.events(runId);
+    for (const e of events) {
+      if (e['type'] !== 'node.failed') continue;
+      const payload = (e['payload'] ?? e['data'] ?? {}) as Record<string, unknown>;
+      if ((payload['nodeId'] ?? e['nodeId']) !== WITNESS_NODE) continue;
+      const err = (payload['error'] ?? e['error']) as Record<string, unknown> | undefined;
+      return typeof err?.['code'] === 'string' ? (err['code'] as string) : '';
+    }
+    return null;
+  }
+
+  fork(runId: string): Promise<OpenWOPResponse | null> {
+    return http(() => driver.post(this.p(`/runs/${this.enc(runId)}:fork`), { mode: 'branch', fromSeq: 0 }));
+  }
+}

package/src/lib/scenario-disposition.ts

@@ -27,11 +27,11 @@
  */
 
 import { scenarioFileOfItId } from './requirement-ids.js';
-import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
+import { PROFILE_FLOOR_SCENARIOS, floorMemberFiles } from './profiles.js';
 import { targetMajor } from './seams.js';
 import { PKG_ROOT_PATH } from './paths.js';
 import { v2ProfileFloorFiles } from './requirement-registry.js';
-import { requirementIdForScenario, requirementIdForPrefix, requirementsFor, v2FloorsActive } from './requirement-registry.js';
+import { requirementIdForScenario, requirementIdForPrefix, requirementIdForAnyOf, requirementsFor, v2FloorsActive } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
 import { CERTIFIABLE, type Disposition, type LedgerEntry } from './requirement-ledger.js';
@@ -39,10 +39,7 @@ import { CERTIFIABLE, type Disposition, type LedgerEntry } from './requirement-l
 /** All scenario basenames that appear in some profile's runtime floor. */
 export function floorScenarioFiles(): ReadonlySet<string> {
   const out = new Set<string>();
-  for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) {
-    for (const f of floor.required) out.add(f);
-    for (const c of floor.conditional ?? []) for (const f of c.required) out.add(f);
-  }
+  for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) for (const f of floorMemberFiles(floor)) out.add(f);
   // At target major 2 the floors come from the declaration, not the v1 hand
   // table. The ledger and --certify MUST agree on this set, or a floor file is
   // minted `openwop.scenario.*` and looked up as `openwop.floor.*` — which is
@@ -77,12 +74,16 @@ export function requirementIdForFile(basename: string): string {
  */
 export const PARTIAL_WITNESS_PREFIX = 'partial-witness: ';
 
+/** `driver.ts`'s `TRANSPORT_LOSS_PREFIX`, restated so this module stays free of the driver (a test pins the two equal). */
+export const TRANSPORT_LOSS_MARK = 'transport-loss: ';
+
 export type FileTestState = 'pass' | 'fail' | 'skip';
 
 /**
  * The per-`it` record (RFC 0148 §A at test granularity), as `setup.ts`
  * computes it in `afterEach`. Pure so a lib test can pin it:
  *   - fail                         ⇒ executed-fail (detail = the first error message)
+ *   - fail on a driver transport loss, 0 assertions ⇒ blocked (#1829: nothing was observed)
  *   - pass with ≥ 1 assertion      ⇒ executed-pass
  *   - a behaviorGate entry journaled during the test ⇒ that gate's disposition
  *   - pass with 0 assertions       ⇒ the softSkip note written DURING THIS TEST
@@ -122,6 +123,15 @@ export function resolveItRecord(
   testName?: string,
 ): { disposition: Disposition; detail?: string } {
   if (state === 'fail') {
+    // #1829: the driver got no response (`TransportError`) before the test
+    // asserted anything. Nothing about the host was observed, so this is not a
+    // verdict on it. `blocked` still denies certification, so a flaky runner
+    // cannot certify; it just cannot convict the host either. A loss AFTER an
+    // assertion stays `executed-fail`: the test was mid-measurement, and a host
+    // that stops answering part-way is a finding.
+    if (assertionCalls === 0 && firstError !== undefined && firstError.includes(TRANSPORT_LOSS_MARK)) {
+      return { disposition: 'blocked', detail: firstError.slice(firstError.indexOf(TRANSPORT_LOSS_MARK), firstError.indexOf(TRANSPORT_LOSS_MARK) + 300) };
+    }
     const where = testName === undefined || testName.trim() === '' ? '' : ` in "${testName.slice(0, 120)}"`;
     return { disposition: 'executed-fail', detail: `the test executed and failed${where}: ${(firstError ?? 'no message').slice(0, 300)}` };
   }
@@ -225,6 +235,11 @@ export function fileDisposition(
   failures: readonly TestFailure[] = [],
 ): { disposition: Disposition; detail?: string } {
   const failed = states.filter((s) => s === 'fail').length;
+  // #1829, the file-level half of `resolveItRecord`'s rule: every failure was a
+  // driver transport loss and the file asserted nothing, so nothing was observed.
+  if (failed > 0 && assertionCount === 0 && failures.length === failed && failures.every((f) => f.message?.includes(TRANSPORT_LOSS_MARK) === true)) {
+    return { disposition: 'blocked', detail: `no response reached the suite in ${failed} test(s); first: ${failures[0]!.message!.slice(failures[0]!.message!.indexOf(TRANSPORT_LOSS_MARK)).slice(0, 300)}` };
+  }
   if (failed > 0) return { disposition: 'executed-fail', detail: failureDetail(failures, failed) };
   if (states.some((s) => s === 'pass')) {
     // A test that early-returned through `behaviorGate` is reported by vitest
@@ -458,6 +473,29 @@ export function deriveRequirementDispositions(
     rows.push(row);
   }
 
+  // Any-of requirements (RFC 0229 §E): one summary row per group, derived from
+  // its member files. Satisfied only by a WITNESSED pass (assertions > 0) with
+  // no member failing; `inapplicable`/`skipped` members never satisfy it. v1
+  // hand table only, like the prefix groups (the major-2 floors have none).
+  const groups = new Map<string, readonly string[]>();
+  if (!v2FloorsActive()) for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) for (const g of floor.requiredAnyOf ?? []) groups.set(requirementIdForAnyOf(g), g);
+  for (const [id, members] of [...groups.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    const scenarioId = `anyof:${members.join('|')}`;
+    const matching = members.map((f) => perFile.get(f)).filter((r): r is DerivedRequirement => r !== undefined);
+    const witnessed = matching.filter((r) => r.disposition === 'executed-pass' && (r.assertionCount ?? 0) > 0);
+    let row: DerivedRequirement;
+    if (matching.some((r) => r.disposition === 'executed-fail')) {
+      row = { requirementId: id, scenarioId, disposition: 'executed-fail', detail: `an alternative failed: ${matching.filter((r) => r.disposition === 'executed-fail').map((r) => r.scenarioId).join(', ')}` };
+    } else if (witnessed.length > 0) {
+      row = { requirementId: id, scenarioId, disposition: 'executed-pass', assertionCount: witnessed.reduce((n, r) => n + (r.assertionCount ?? 0), 0) };
+    } else if (matching.length === 0) {
+      row = { requirementId: id, scenarioId, disposition: 'blocked', detail: `none of ${members.join(', ')} ran — unclassified return` };
+    } else {
+      row = { requirementId: id, scenarioId, disposition: 'blocked', detail: `no alternative recorded a witnessed pass (${matching.map((r) => `${r.scenarioId}: ${r.disposition}`).join(', ')})` };
+    }
+    rows.push(row);
+  }
+
   // Per-`it` rows (suite 1.153.0): every ledger entry keyed `openwop.it.<file>.<slug>`
   // becomes its own bundle row, attributed to its scenario file. Additive — the
   // file-level and prefix rows above are unchanged, and the floors still key on
@@ -513,7 +551,7 @@ export function deriveRequirementDispositions(
     const atMajor2 = v2FloorsActive();
     for (const id of ids) {
       const r = rowById.get(id);
-      const fromLedger = byId.has(id) || (r !== undefined && r.scenarioId.endsWith('*'));
+      const fromLedger = byId.has(id) || (r !== undefined && (r.scenarioId.endsWith('*') || r.scenarioId.startsWith('anyof:')));
       if (r !== undefined && r.disposition === 'executed-pass' && (r.assertionCount ?? 0) > 0) witnessedPasses += 1;
       // Unclassified: no row, or a report-derived blocked (nothing recorded), or a
       // VACUOUS pass — executed-pass with assertionCount 0 is a witness of nothing

package/src/lib/secret-scan.ts

@@ -0,0 +1,141 @@
+/**
+ * Find a resolved secret on a readable surface — `host-services.md` §`secrets`:
+ * "Raw key material MUST NOT appear in any event, log, trace, prompt, error,
+ * export or screenshot".
+ *
+ * Two detectors, because the suite does not always know the secret:
+ *
+ *   - **value** — the operator told the runner the canary's plaintext
+ *     (`OPENWOP_CANARY_SECRET_VALUE`, the same agreement
+ *     `secret-leakage-otel-attribute` uses). The text is searched for the value
+ *     in every common encoding: raw, JSON-string-escaped, percent-encoded,
+ *     standard and URL-safe base64 with and without padding, lower- and
+ *     upper-case hex.
+ *   - **digest** — the runner does not know the value, but the
+ *     `openwop-smoke-byok-roundtrip` node surfaced `{secretSha256,
+ *     secretLength}` (fixtures.md). Every window of `secretLength` bytes in
+ *     every string of the surface — and in every base64 / hex / percent-decoded
+ *     token inside it — is hashed and compared with the digest. A match is a
+ *     preimage of the secret's digest on the surface: the secret itself.
+ *
+ * The digest itself is NOT a finding here: the byok fixture's contract emits it
+ * (fixtures.md §`openwop-smoke-byok-roundtrip`). RFC 0229's run witness, which
+ * forbids a digest, owns that stricter rule for the values it supplies.
+ */
+
+import { createHash } from 'node:crypto';
+
+export interface SecretDetector {
+  /** What the detector knows, for the failure message — never the secret. */
+  readonly label: string;
+  /** The encoding in which the secret was found in `text`, or null. */
+  find(text: string): string | null;
+}
+
+/** Upper bound on hashed window positions per surface, so a huge body cannot stall a leg. */
+const MAX_WINDOWS = 4_000_000;
+
+function b64(buf: Buffer): string { return buf.toString('base64'); }
+function b64url(buf: Buffer): string { return b64(buf).replace(/\+/g, '-').replace(/\//g, '_'); }
+
+/** The known-value detector. `value` MUST be non-empty. */
+export function valueDetector(value: string): SecretDetector {
+  const bytes = Buffer.from(value, 'utf8');
+  const forms: Array<[string, string]> = [
+    ['raw', value],
+    ['JSON-string-escaped', JSON.stringify(value).slice(1, -1)],
+    ['percent-encoded', encodeURIComponent(value)],
+    ['base64', b64(bytes)],
+    ['base64 (unpadded)', b64(bytes).replace(/=+$/, '')],
+    ['base64url', b64url(bytes)],
+    ['base64url (unpadded)', b64url(bytes).replace(/=+$/, '')],
+    ['hex', bytes.toString('hex')],
+    ['HEX', bytes.toString('hex').toUpperCase()],
+  ];
+  return {
+    label: `the operator-supplied canary value (OPENWOP_CANARY_SECRET_VALUE, ${bytes.length} bytes)`,
+    find(text) {
+      for (const [name, form] of forms) if (form.length > 0 && text.includes(form)) return name;
+      return null;
+    },
+  };
+}
+
+/** Every string (keys and values) of a parsed JSON document; the raw text when it is not JSON. */
+function stringsOf(text: string): string[] {
+  let doc: unknown;
+  try { doc = JSON.parse(text); } catch { return [text]; }
+  const out: string[] = [];
+  const walk = (v: unknown): void => {
+    if (typeof v === 'string') out.push(v);
+    else if (Array.isArray(v)) v.forEach(walk);
+    else if (v !== null && typeof v === 'object') for (const [k, x] of Object.entries(v as Record<string, unknown>)) { out.push(k); walk(x); }
+  };
+  walk(doc);
+  return out;
+}
+
+/** The byte sequences a string can carry the secret in: itself, and its decodable tokens. */
+function candidatesOf(s: string, minBytes: number): Array<[string, Buffer]> {
+  const out: Array<[string, Buffer]> = [['raw', Buffer.from(s, 'utf8')]];
+  if (s.includes('%')) { try { out.push(['percent-decoded', Buffer.from(decodeURIComponent(s), 'utf8')]); } catch { /* not percent-encoded */ } }
+  const minB64 = Math.max(4, Math.floor((minBytes * 4) / 3));
+  for (const tok of s.match(new RegExp(`[A-Za-z0-9+/_-]{${minB64},}={0,2}`, 'g')) ?? []) {
+    const buf = Buffer.from(tok.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+    if (buf.length >= minBytes) out.push(['base64-decoded', buf]);
+  }
+  for (const tok of s.match(new RegExp(`(?:[0-9a-fA-F]{2}){${minBytes},}`, 'g')) ?? []) out.push(['hex-decoded', Buffer.from(tok, 'hex')]);
+  return out;
+}
+
+/** The digest detector: a preimage of `sha256Hex` of exactly `length` bytes anywhere on the surface. */
+export function digestDetector(sha256Hex: string, length: number): SecretDetector {
+  const want = sha256Hex.toLowerCase();
+  return {
+    label: `a preimage of the secretSha256 the byok fixture surfaced (${length}-byte windows)`,
+    find(text) {
+      let budget = MAX_WINDOWS;
+      for (const s of stringsOf(text)) {
+        if (Buffer.byteLength(s, 'utf8') < length) continue; // no encoding makes a string longer than its decoding
+        for (const [enc, buf] of candidatesOf(s, length)) {
+          for (let i = 0; i + length <= buf.length; i += 1) {
+            if (budget-- <= 0) return null;
+            if (createHash('sha256').update(buf.subarray(i, i + length)).digest('hex') === want) return enc;
+          }
+        }
+      }
+      return null;
+    },
+  };
+}
+
+/** A named readable surface of a run, as the host answered it. */
+export interface Surface { readonly name: string; readonly text: string }
+
+/** The surfaces (by name) on which any detector finds the secret, with the encoding. */
+export function leaks(surfaces: readonly Surface[], detectors: readonly SecretDetector[]): string[] {
+  const out: string[] = [];
+  for (const s of surfaces) {
+    for (const d of detectors) {
+      const enc = d.find(s.text);
+      if (enc !== null) { out.push(`${s.name} (${enc}, found by ${d.label})`); break; }
+    }
+  }
+  return out;
+}
+
+/** `{secretSha256, secretLength}` wherever a surface carries it (the byok node's outputs), or null. */
+export function findSecretDigest(docs: readonly unknown[]): { sha256: string; length: number } | null {
+  let hit: { sha256: string; length: number } | null = null;
+  const walk = (v: unknown): void => {
+    if (hit !== null || v === null || typeof v !== 'object') return;
+    if (Array.isArray(v)) { v.forEach(walk); return; }
+    const o = v as Record<string, unknown>;
+    const sha = o['secretSha256'];
+    const len = o['secretLength'];
+    if (typeof sha === 'string' && /^[0-9a-f]{64}$/i.test(sha) && typeof len === 'number' && Number.isInteger(len) && len > 0) { hit = { sha256: sha, length: len }; return; }
+    Object.values(o).forEach(walk);
+  };
+  docs.forEach(walk);
+  return hit;
+}

package/src/lib/timeout-scale.ts

@@ -0,0 +1,25 @@
+/**
+ * The `OPENWOP_POLL_TIMEOUT_SCALE` knob, in its own module so `driver.ts` can
+ * scale its request bound without importing `polling.ts` (which imports the
+ * driver). `polling.ts` re-exports `scaledTimeoutMs`; its docstring explains
+ * the knob.
+ */
+
+/**
+ * Multiplier applied to every poll bound (see the module docstring). Invalid,
+ * non-positive, or non-finite values fall back to `1` rather than silently
+ * producing a zero or negative deadline — a mis-set knob must not turn every
+ * poll into an instant failure that looks like a host defect.
+ */
+function pollTimeoutScale(): number {
+  const raw = process.env.OPENWOP_POLL_TIMEOUT_SCALE;
+  if (raw === undefined || raw === '') return 1;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : 1;
+}
+
+/** Apply the scale to a bound, rounding up so a scale of 1 is exactly a no-op. */
+export function scaledTimeoutMs(timeoutMs: number): number {
+  const scale = pollTimeoutScale();
+  return scale === 1 ? timeoutMs : Math.ceil(timeoutMs * scale);
+}

package/src/lib/triggerBridge.ts

@@ -20,7 +20,7 @@
  * @see spec/v1/trigger-bridge.md
  * @see spec/v1/profiles.md (§openwop-trigger-bridge)
  */
-import { randomBytes, randomInt } from 'node:crypto';
+import { createHmac, randomBytes, randomInt } from 'node:crypto';
 import { driver } from './driver.js';
 import { deriveProfiles, type DiscoveryPayload } from './profiles.js';
 
@@ -121,3 +121,71 @@ export function freshStreamDedupKey(topic = 'events', partition = 3): string {
 
 export const SUBSCRIPTION_STATES = ['active', 'paused', 'failed', 'dead-lettered'];
 export const DELIVERY_OUTCOMES = ['delivered', 'retrying', 'dead-lettered'];
+
+// ---------------------------------------------------------------------------
+// RFC 0230 — the normative-surface (seam-free) ingest path.
+// ---------------------------------------------------------------------------
+
+/** Does discovery advertise `triggerBridge.ingestion.inboundSigning` ∋ `standard-webhooks-1`? */
+export async function inboundSigningAdvertised(): Promise<boolean> {
+  const disco = await driver.get('/.well-known/openwop');
+  if (disco.status !== 200 || !disco.json) return false;
+  const d = disco.json as Record<string, any>;
+  const tb = d.triggerBridge ?? d.capabilities?.triggerBridge;
+  const s = tb?.ingestion?.inboundSigning;
+  return Array.isArray(s) && s.includes('standard-webhooks-1');
+}
+
+export interface SignedWebhookSubscription {
+  subscriptionId: string;
+  ingestUrl: string;
+  signingSecret: string;
+}
+
+/**
+ * Register a `webhook` subscription bound to the `conformance-noop` fixture
+ * (RFC 0230 §B). Returns null (with a reason) when the registration does not
+ * yield the §B binding — the caller records that as a host defect, not a skip.
+ */
+export async function registerSignedWebhook(mode: 'none' | 'required'): Promise<SignedWebhookSubscription | { reason: string }> {
+  const res = await driver.post('/v1/trigger-subscriptions', { source: 'webhook', workflowId: 'conformance-noop', verification: { mode } });
+  const body = res.json as { subscription?: { subscriptionId?: string }; binding?: { ingestUrl?: string; signingSecret?: string } } | undefined;
+  const subscriptionId = body?.subscription?.subscriptionId;
+  const ingestUrl = body?.binding?.ingestUrl;
+  const signingSecret = body?.binding?.signingSecret;
+  if (res.status !== 201 || !subscriptionId || !ingestUrl || !signingSecret) {
+    return { reason: `POST /v1/trigger-subscriptions answered ${res.status} without the RFC 0230 §B binding (subscriptionId, ingestUrl, signingSecret)` };
+  }
+  return { subscriptionId, ingestUrl, signingSecret };
+}
+
+/** A Standard Webhooks `webhook-id` (RFC 0201 grammar). */
+export function freshWebhookId(): string {
+  return `msg_${randomBytes(12).toString('hex')}`;
+}
+
+/** `v1,<base64 HMAC-SHA256(key, "{id}.{ts}.{body}")>`, key = base64-decode after `whsec_`. */
+export function standardWebhooksSignature(secret: string, id: string, ts: string, body: string): string {
+  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
+  return `v1,${createHmac('sha256', key).update(`${id}.${ts}.${body}`).digest('base64')}`;
+}
+
+/**
+ * POST a raw body to `ingestUrl` with NO OpenWOP credential and the three
+ * Standard Webhooks headers (RFC 0230 §C). `signature` overrides the computed one
+ * (a bad-signature probe); `timestamp` overrides the current second (a skew probe).
+ */
+export async function signedIngest(
+  sub: SignedWebhookSubscription,
+  body: string,
+  opts: { webhookId?: string; timestamp?: string; signature?: string } = {},
+): Promise<{ status: number; json: Record<string, unknown> | undefined }> {
+  const id = opts.webhookId ?? freshWebhookId();
+  const ts = opts.timestamp ?? String(Math.floor(Date.now() / 1000));
+  const sig = opts.signature ?? standardWebhooksSignature(sub.signingSecret, id, ts, body);
+  const res = await driver.post(sub.ingestUrl, body, {
+    authenticated: false,
+    headers: { 'Content-Type': 'application/json', 'webhook-id': id, 'webhook-timestamp': ts, 'webhook-signature': sig },
+  });
+  return { status: res.status, json: res.json as Record<string, unknown> | undefined };
+}

package/src/scenarios/byok-roundtrip.test.ts

@@ -9,7 +9,8 @@
  * This is a FLOOR scenario (`openwop.floor.byok-roundtrip`), so a host that
  * cannot run it has NOT witnessed the floor. When the canary fixture is not
  * advertised, or the start-run call answers 404/422, every test records
- * `blocked` with the reason — never a trivial pass. A production posture that
+ * `blocked` with the reason — never a trivial pass (unless the host takes the
+ * RFC 0229 run-witness floor path instead: then `inapplicable`). A production posture that
  * keeps the `conformance.secret.echo` seam off therefore leaves its claimed
  * `openwop-secrets` profile uncertified, and only that profile: the cut's
  * other claims still certify. Hosts that opt into `OPENWOP_CONFORMANCE_FIXTURES=1`
@@ -39,6 +40,7 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip } from '../lib/soft-skip.js';
+import { WITNESS_FIXTURE, WitnessHost } from '../lib/run-secrets-witness.js';
 
 /** SHA-256 hex regex — 64 lowercase hex chars exactly. */
 const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
@@ -47,9 +49,23 @@ const BYOK_WORKFLOW_ID = 'openwop-smoke-byok-roundtrip';
 const SKIP_NO_FIXTURE = !isFixtureAdvertised(BYOK_WORKFLOW_ID);
 const NO_FIXTURE_REASON = `precondition not met — the \`${BYOK_WORKFLOW_ID}\` fixture is not advertised, so this host cannot witness the BYOK roundtrip floor (the \`conformance.secret.echo\` seam and the \`openwop-conformance-canary-secret\` canary are off)`;
 
+/**
+ * RFC 0229 §E: `openwop-secrets` has a second floor path, `secrets-run-witness`.
+ * A host that withholds the canary but advertises `secrets.runSecrets` and the
+ * `openwop-secrets-run-witness` fixture takes that path, so this file is
+ * `inapplicable` on it, not `blocked` — a `blocked` row would deny the whole
+ * bundle (RFC 0168 §E.1) for a floor the host satisfies the other way.
+ */
+async function noFixture(): Promise<undefined> {
+  if (isFixtureAdvertised(WITNESS_FIXTURE) && (await new WitnessHost(1).gate()).ok) {
+    return softSkip('inapplicable', `the \`${BYOK_WORKFLOW_ID}\` fixture is withheld and the host takes the run-witness floor path instead (secrets.runSecrets and \`${WITNESS_FIXTURE}\` are advertised; RFC 0229 §E, profiles.md §openwop-secrets)`);
+  }
+  return softSkip('blocked', NO_FIXTURE_REASON);
+}
+
 describe('byok: end-to-end credentialRef resolution roundtrip (openwop-byok profile)', () => {
   it('the canary fixture run MUST resolve a host-provisioned secret and emit SHA-256 hex', async () => {
-    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
+    if (SKIP_NO_FIXTURE) return noFixture();
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });
@@ -114,7 +130,7 @@ describe('byok: end-to-end credentialRef resolution roundtrip (openwop-byok prof
   });
 
   it('BYOK fixture run MUST emit a node.completed event for the resolve step', async () => {
-    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
+    if (SKIP_NO_FIXTURE) return noFixture();
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });
@@ -141,7 +157,7 @@ describe('byok: end-to-end credentialRef resolution roundtrip (openwop-byok prof
   });
 
   it('BYOK fixture run event log MUST NOT echo the resolved secret value (redaction)', async () => {
-    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
+    if (SKIP_NO_FIXTURE) return noFixture();
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });