@openwop/openwop-conformance 2.45.2 → 2.45.3

package/src/scenarios/trigger-refused-event-keeps-subscription.test.ts

@@ -0,0 +1,141 @@
+/**
+ * A refused inbound event dead-letters only its delivery — `trigger-bridge.md`
+ * §F.2, corrected 2026-09-30 (`docs/COMPATIBILITY-CORRECTIONS-LOG.md`).
+ *
+ * §F.2 used to send an event failing a `required` verification to
+ * `trigger.subscription.state.changed.reason: 'signature-invalid'`, a
+ * SUBSCRIPTION transition. Anyone able to post one badly signed event could
+ * then disable a working integration: every later delivery is refused as
+ * `subscription_not_active`. RFC 0230 §C.1 closed that for the uncredentialed
+ * Standard Webhooks ingest; the correction states it for every host.
+ *
+ * Driven through the delivery seam's OPTIONAL `scenario: "refused"` value
+ * (`host-sample-test-seams.md`, trigger-bridge delivery seam), then the
+ * `deliver` value on the same `subscriptionId`. Three observations, each of
+ * which a host implementing the old subscription-level transition fails:
+ *
+ *   1. the refused event is recorded as a dead-lettered
+ *      `trigger.delivery.attempted` and starts no run;
+ *   2. no `trigger.subscription.state.changed` is emitted for the subscription,
+ *      and it reads back `active` (seam response, and the normative
+ *      `GET /v1/trigger-subscriptions/{id}` when the host serves it);
+ *   3. a verified event on the same subscription is then delivered and starts
+ *      a run.
+ *
+ * Gated on the `openwop-trigger-bridge` profile and on
+ * `triggerBridge.ingestion.externalSources` listing `webhook`. The uncredentialed
+ * public path (RFC 0230, `inboundSigning`) is witnessed separately.
+ *
+ * @see spec/v1/trigger-bridge.md §F.2
+ * @see spec/v2/core/webhooks.md §Inbound triggers
+ * @see RFCS/0230-inbound-webhook-ingest-contract.md §C.1 (risk R3)
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { seamAbsent, softSkip } from '../lib/soft-skip.js';
+import { behaviorGate } from '../lib/behavior-gate.js';
+import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { isTriggerBridgeProfileAdvertised } from '../lib/triggerBridge.js';
+import { queryTestEvents, requireEvents, isEventLogSeamAvailable } from '../lib/event-log-query.js';
+import { req } from '../lib/requirement-ids.js';
+
+const SEAM = '/v1/host/sample/trigger-bridge/deliver';
+const ID = 'openwop.requirement.trigger-bridge.refused-event-keeps-subscription';
+const SPEC = 'trigger-bridge.md §F.2 (corrected 2026-09-30)';
+
+interface SeamResult {
+  subscriptionId?: unknown;
+  outcome?: unknown;
+  subscriptionState?: unknown;
+  runId?: unknown;
+}
+
+describe('trigger-refused-event-keeps-subscription (trigger-bridge.md §F.2)', () => {
+  it('a refused event dead-letters only its delivery; the subscription stays active and a verified event then delivers', async () => {
+    if (!behaviorGate('openwop-trigger-bridge', await isTriggerBridgeProfileAdvertised())) return;
+    const tb = await readCapabilityFamily<{ ingestion?: { externalSources?: unknown } }>('triggerBridge');
+    const sources = Array.isArray(tb?.ingestion?.externalSources) ? (tb!.ingestion!.externalSources as unknown[]) : [];
+    if (!sources.includes('webhook')) {
+      return softSkip('inapplicable', 'triggerBridge.ingestion.externalSources does not list webhook, so the host verifies no inbound webhook event');
+    }
+    if (!(await isEventLogSeamAvailable())) return seamAbsent('host ingests external webhooks but the event-log seam is absent');
+
+    // ---- 1. The refused event -------------------------------------------
+    const refusedRes = await driver.post(SEAM, { scenario: 'refused', source: 'webhook' });
+    if (refusedRes.status === 404 || refusedRes.status === 405) {
+      return seamAbsent('host ingests external webhooks but the trigger-bridge delivery seam is unwired');
+    }
+    if (refusedRes.status === 400) {
+      // Grace window (suite 2.45.3): the `refused` seam value is new in this cycle, so a
+      // host whose existing delivery seam predates it records `inapplicable` with this
+      // reason rather than `blocked` (which would deny its certification for a seam
+      // extension it has not yet shipped). The disposition for an advertised facet whose
+      // fixture or seam value is missing is pending a suite-wide policy decision.
+      return softSkip('inapplicable', 'the trigger-bridge delivery seam predates scenario "refused" (answered 400); grace window for seams extended in 2.45.3');
+    }
+    expect(refusedRes.status, req(ID, 'host-sample-test-seams.md (trigger-bridge delivery seam)', 'scenario "refused" MUST answer 200')).toBe(200);
+    const refused = (refusedRes.json ?? {}) as SeamResult;
+    expect(
+      typeof refused.subscriptionId === 'string' && refused.subscriptionId.length > 0,
+      req(ID, 'host-sample-test-seams.md (trigger-bridge delivery seam)', 'scenario "refused" MUST return the subscriptionId it drove'),
+    ).toBe(true);
+    const subscriptionId = refused.subscriptionId as string;
+    expect(
+      refused.outcome,
+      req(ID, SPEC, 'an event failing a required verification MUST NOT start a run; its delivery is dead-lettered'),
+    ).toBe('dead-lettered');
+
+    const logKey = typeof refused.runId === 'string' && refused.runId.length > 0 ? refused.runId : '__refused__';
+    const attempts = requireEvents(await queryTestEvents(logKey, { type: 'trigger.delivery.attempted' }), 'trigger.delivery.attempted (refused)')
+      .filter((e) => e.payload.subscriptionId === subscriptionId);
+    expect(
+      attempts.some((e) => e.payload.outcome === 'dead-lettered'),
+      req(ID, SPEC, 'the refused delivery MUST be recorded as trigger.delivery.attempted { outcome: "dead-lettered" }'),
+    ).toBe(true);
+    expect(
+      attempts.every((e) => e.payload.outcome !== 'delivered'),
+      req(ID, SPEC, 'an event failing a required verification MUST NOT be delivered'),
+    ).toBe(true);
+    const started = requireEvents(await queryTestEvents(logKey, { type: 'run.started' }), 'run.started (refused)');
+    expect(started.length, req(ID, SPEC, 'an event failing a required verification MUST NOT start a run')).toBe(0);
+
+    // ---- 2. The subscription is untouched --------------------------------
+    const transitions = requireEvents(await queryTestEvents(logKey, { type: 'trigger.subscription.state.changed' }), 'trigger.subscription.state.changed (refused)')
+      .filter((e) => e.payload.subscriptionId === subscriptionId);
+    expect(
+      transitions.map((e) => `${String(e.payload.fromState)}->${String(e.payload.toState)} (${String(e.payload.reason)})`),
+      req(ID, SPEC, 'a refused event MUST NOT emit trigger.subscription.state.changed — one bad post must not disable the integration'),
+    ).toEqual([]);
+    expect(
+      refused.subscriptionState,
+      req(ID, SPEC, 'a refused event MUST NOT change the subscription\'s state: it stays active'),
+    ).toBe('active');
+    const read = await driver.get(`/v1/trigger-subscriptions/${encodeURIComponent(subscriptionId)}`);
+    if (read.status === 200) {
+      const body = read.json as { state?: unknown; subscription?: { state?: unknown } } | undefined;
+      expect(
+        body?.subscription?.state ?? body?.state,
+        req(ID, SPEC, 'the normative subscription read MUST still show state active after a refused event'),
+      ).toBe('active');
+    }
+
+    // ---- 3. A verified event on the same subscription is delivered -------
+    const nextRes = await driver.post(SEAM, { scenario: 'deliver', source: 'webhook', subscriptionId });
+    expect(nextRes.status, req(ID, 'host-sample-test-seams.md (trigger-bridge delivery seam)', 'scenario "deliver" with the refused subscriptionId MUST answer 200')).toBe(200);
+    const next = (nextRes.json ?? {}) as SeamResult;
+    expect(
+      next.subscriptionId,
+      req(ID, 'host-sample-test-seams.md (trigger-bridge delivery seam)', 'scenario "deliver" MUST deliver on the subscriptionId it was given'),
+    ).toBe(subscriptionId);
+    expect(
+      typeof next.runId === 'string' && next.runId.length > 0,
+      req(ID, SPEC, 'after a refused event, a verified event on the same subscription MUST start a run'),
+    ).toBe(true);
+    const delivered = requireEvents(await queryTestEvents(next.runId as string, { type: 'trigger.delivery.attempted' }), 'trigger.delivery.attempted (deliver after refused)');
+    expect(
+      delivered.some((e) => e.payload.subscriptionId === subscriptionId && e.payload.outcome === 'delivered'),
+      req(ID, SPEC, 'after a refused event, the next verified delivery on the subscription MUST be recorded delivered'),
+    ).toBe(true);
+  });
+});

package/src/scenarios/v2-eval-mode-unadvertised-refused.test.ts

@@ -0,0 +1,55 @@
+/**
+ * v2 — `mode: eval` on a host that does not advertise `agents.evalSuite` is
+ * refused `422 capability_not_provided` (`spec/v2/core/runs.md` §Refusals).
+ *
+ * The v1 eval scenarios (`agent-eval-run`, `agent-eval-suite-shape`) run at
+ * major 1 only and return early when the capability is absent, so nothing
+ * measured this refusal at major 2. The leg is unaided: the suite reads
+ * discovery and posts one create.
+ *
+ * The body is a complete eval create (`mode`, `evalSuiteRef`, `agentId`), so a
+ * `400 validation_error` is not an honest answer to it: the only thing wrong
+ * with the request is that the host does not run eval suites.
+ *
+ * A host that advertises `agents.evalSuite` records the leg `inapplicable`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+
+const ID = 'openwop.requirement.runs.eval-mode-unadvertised-refused';
+const DOC = 'spec/v2/core/runs.md §Refusals';
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+describe('v2 eval mode is refused where agents.evalSuite is not advertised (runs.md §Refusals)', () => {
+  it('POST /runs {mode: "eval"} answers 422 capability_not_provided and creates no run', async () => {
+    let doc: Record<string, unknown> | null;
+    try { doc = await v2Discovery(); } catch { doc = null; }
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const agents = doc['agents'];
+    const evalSuite = agents !== null && typeof agents === 'object' && !Array.isArray(agents) ? (agents as Record<string, unknown>)['evalSuite'] : undefined;
+    if (evalSuite !== undefined && evalSuite !== null) return softSkip('inapplicable', 'the host advertises agents.evalSuite — mode: eval is served');
+
+    const res = await http(() => driver.post('/runs', {
+      mode: 'eval',
+      evalSuiteRef: 'https://conformance.openwop.dev/eval-suites/unadvertised-probe',
+      agentId: 'conformance-eval-unadvertised-probe',
+    }));
+    if (res === null) return softSkip('blocked', 'POST /runs unreachable (fetch failed)');
+    if (res.status === 429) return softSkip('blocked', 'POST /runs answered 429 — the run budget, not the wire');
+
+    // A host that accepted the create started something. Stop it before asserting, so a failing row leaves no run behind.
+    const runId = (res.json as { runId?: unknown } | undefined)?.runId;
+    if (res.status === 201 && typeof runId === 'string') await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
+
+    expect(res.status, req(ID, DOC, `a host that does not advertise agents.evalSuite MUST reject mode: eval with 422 (got ${res.status} ${readErrorCode(res.json) ?? ''})`.trim())).toBe(422);
+    expect(readErrorCode(res.json), req(ID, DOC, 'the 422 for an unadvertised eval mode MUST carry the registered code capability_not_provided')).toBe('capability_not_provided');
+  });
+});

package/src/scenarios/v2-fs-sandbox-escape-refused.test.ts

@@ -0,0 +1,161 @@
+/**
+ * `spec/v2/core/storage.md` §`fs` — pack file access never escapes the
+ * sandbox root (target major 2; gated on `fs` + the `conformance-fs-probe`
+ * fixture).
+ *
+ * The rules: "Every `path` MUST be normalized and resolved relative to
+ * `fs.sandboxRoot`. A path that escapes the root, whether absolute, through
+ * `..` segments or through a symlink, MUST be refused. The host MUST NOT follow
+ * such a link partially." And, from §Shared rules (RFC 0228's decision): "A
+ * sandbox escape is `forbidden` with `details.reason: path-outside-sandbox`."
+ * `errors.md` §Host-service refusals adds that a generic code carries
+ * `details.service`, the family key. Until this file the rule had a witness
+ * only at major 1, through the v1 seam `POST /v1/host/sample/fs/read`.
+ *
+ * No seam: each leg runs the `conformance-fs-probe` fixture, whose node calls
+ * the host's own `ctx.fs` with the path unchanged and fails with the
+ * rejection's code and details (conformance/fixtures.md §"The storage probe
+ * fixtures").
+ *
+ *   inside-root       write then read `conformance/probe-<nonce>.txt` — the
+ *                     content round-trips (the positive control: a host whose
+ *                     probe refuses everything cannot pass the escape legs by
+ *                     accident, because this leg fails first);
+ *   absolute-escape   read `/etc/hosts` (outside any root other than `/` or
+ *                     `/etc`) — `forbidden`, `path-outside-sandbox`;
+ *   dotdot-escape     read `conformance/../../../../../../../../etc/hosts` —
+ *                     the same;
+ *   symlink-escape    read `conformance/escape-link`, which the operator points
+ *                     outside the root — the same. A host that normalises `..`
+ *                     but follows links reads the file and fails here.
+ *
+ * Dispositions: `fs` absent from the v2 root ⇒ `inapplicable`. `fs` advertised
+ * without the fixture, or a run that cannot be created ⇒ `blocked`. A root of
+ * `/` or `/etc` (so `/etc/hosts` is inside it) ⇒ that escape leg is
+ * `inapplicable`. The symlink leg answering `not_found` means the operator link
+ * is missing ⇒ `blocked`, never a pass.
+ *
+ * Sabotage (a patched local copy of the v2 reference host): skip the prefix
+ * check for absolute paths, resolve without normalising `..`, or normalise
+ * `..` but follow symlinks — each turns exactly its own leg red.
+ *
+ * @see spec/v2/core/storage.md §fs
+ * @see RFCS/0228-v1-host-service-error-codes.md §Decisions 1
+ */
+
+import { describe, it, expect } from 'vitest';
+import { randomUUID } from 'node:crypto';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const FIXTURE = 'conformance-fs-probe';
+const NODE_ID = 'fs-probe';
+const DOC = 'spec/v2/core/storage.md §fs';
+const DOC_CODE = 'spec/v2/core/storage.md §Shared rules';
+const ID_INSIDE = 'openwop.requirement.storage.fs-inside-root-read';
+const ID_ABSOLUTE = 'openwop.requirement.storage.fs-absolute-escape-refused';
+const ID_DOTDOT = 'openwop.requirement.storage.fs-dotdot-escape-refused';
+const ID_SYMLINK = 'openwop.requirement.storage.fs-symlink-escape-refused';
+const OUTSIDE = '/etc/hosts';
+const DOTDOT = 'conformance/../../../../../../../../etc/hosts';
+const SYMLINK = 'conformance/escape-link';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
+const enc = (id: string): string => encodeURIComponent(id);
+
+interface Outcome {
+  readonly status: string;
+  readonly result: Record<string, unknown> | null;
+  readonly error: { code: string | null; details: Record<string, unknown> } | null;
+}
+
+async function runProbe(inputs: Record<string, unknown>): Promise<Outcome | { reason: string }> {
+  const created = await http(() => driver.post('/runs', { workflowId: FIXTURE, inputs }));
+  if (created === null) return { reason: 'POST /runs unreachable (fetch failed)' };
+  const runId = (created.json as { runId?: unknown } | null)?.runId;
+  if (created.status !== 201 || typeof runId !== 'string') return { reason: `POST /runs {workflowId: ${FIXTURE}} answered ${created.status} ${readErrorCode(created.json) ?? ''} — the fixture run was refused`.trim() };
+  const t0 = Date.now(); let status = '';
+  while (Date.now() - t0 < 30_000) {
+    const snap = await http(() => driver.get(`/runs/${enc(runId)}`));
+    status = String((snap?.json as { status?: unknown } | null)?.status ?? '');
+    if (TERMINAL.has(status)) break;
+    await new Promise((r) => setTimeout(r, 150));
+  }
+  if (!TERMINAL.has(status)) return { reason: `the ${FIXTURE} run did not reach a terminal status within 30 s (last: ${status || 'unreadable'})` };
+  const ev = await http(() => driver.get(`/runs/${enc(runId)}/events/poll?timeout=1`));
+  const events = (ev?.json as { events?: unknown } | null)?.events;
+  if (ev?.status !== 200 || !Array.isArray(events)) return { reason: `GET /runs/{runId}/events/poll answered ${ev?.status ?? 'nothing'}` };
+  const node = (type: string): Record<string, unknown> | undefined => (events as Array<{ type?: unknown; payload?: Record<string, unknown> }>).find((e) => e.type === type && e.payload?.['nodeId'] === NODE_ID)?.payload;
+  const result = ((node('node.completed')?.['outputs'] ?? {}) as Record<string, unknown>)['result'];
+  const err = (node('node.failed')?.['error'] ?? null) as { code?: unknown; details?: unknown } | null;
+  return {
+    status,
+    result: result && typeof result === 'object' && !Array.isArray(result) ? (result as Record<string, unknown>) : null,
+    error: err === null ? null : { code: typeof err.code === 'string' ? err.code : null, details: err.details && typeof err.details === 'object' ? (err.details as Record<string, unknown>) : {} },
+  };
+}
+
+/** The gate, and the advertised `sandboxRoot`, or the recorded reason the leg cannot run. */
+async function gate(): Promise<{ root: string } | { skip: ['inapplicable' | 'blocked', string] }> {
+  if (!(await v2Discovery().catch(() => null))) return { skip: ['blocked', 'v2 discovery unreachable'] };
+  const fs = await familyAdvertised('fs');
+  if (!fs) return { skip: ['inapplicable', 'fs is not advertised in the v2 discovery root — the host exposes no ctx.fs to pack code'] };
+  if (!isFixtureAdvertised(FIXTURE)) return { skip: ['blocked', `the host advertises fs but not the ${FIXTURE} fixture — the sandbox claim is made and cannot be observed without it`] };
+  return { root: typeof fs['sandboxRoot'] === 'string' ? fs['sandboxRoot'] : '' };
+}
+
+/** `/etc/hosts` escapes every root except `/` and `/etc` (and their spellings). */
+const rootContainsOutside = (root: string): boolean => { const r = root.replace(/\/+$/, ''); return r === '' || r === '/etc'; };
+
+describe('v2 fs sandbox (storage.md §fs)', () => {
+  it('a path inside the sandbox root is written and read back', async () => {
+    const g = await gate(); if ('skip' in g) return softSkip(...g.skip);
+    const nonce = randomUUID();
+    const path = `conformance/probe-${nonce}.txt`;
+    const w = await runProbe({ op: 'write', path, content: nonce });
+    if ('reason' in w) return softSkip('blocked', `write: ${w.reason}`);
+    const r = await runProbe({ op: 'read', path });
+    if ('reason' in r) return softSkip('blocked', `read: ${r.reason}`);
+    expect(w.status, req(ID_INSIDE, DOC, `a write inside the root MUST succeed (got ${w.status} ${w.error?.code ?? ''})`)).toBe('completed');
+    expect(r.status, req(ID_INSIDE, DOC, `a read inside the root MUST succeed (got ${r.status} ${r.error?.code ?? ''})`)).toBe('completed');
+    expect(r.result?.['content'], req(ID_INSIDE, 'conformance/fixtures.md §The storage probe fixtures', 'the read MUST return the bytes written')).toBe(nonce);
+  }, 90_000);
+
+  it('an absolute path outside the root is refused forbidden, path-outside-sandbox', async () => {
+    const g = await gate(); if ('skip' in g) return softSkip(...g.skip);
+    if (rootContainsOutside(g.root)) return softSkip('inapplicable', `sandboxRoot ${JSON.stringify(g.root)} contains ${OUTSIDE}, so that absolute path is not an escape`);
+    const o = await runProbe({ op: 'read', path: OUTSIDE });
+    if ('reason' in o) return softSkip('blocked', o.reason);
+    expect(o.status, req(ID_ABSOLUTE, DOC, `an absolute path outside the root MUST be refused — the run ${o.status === 'completed' ? `read it (${String(o.result?.['content'] ?? '').length} chars)` : o.status}`)).toBe('failed');
+    expect(o.error?.code, req(ID_ABSOLUTE, DOC_CODE, 'a sandbox escape is `forbidden`')).toBe('forbidden');
+    expect(o.error?.details['reason'], req(ID_ABSOLUTE, DOC_CODE, 'a sandbox escape carries details.reason: path-outside-sandbox')).toBe('path-outside-sandbox');
+    expect(o.error?.details['service'], req(ID_ABSOLUTE, 'spec/v2/core/errors.md §Host-service refusals', 'a generic code MUST carry details.service, the family key')).toBe('fs');
+  }, 60_000);
+
+  it('a dot-dot path that climbs out of the root is refused forbidden, path-outside-sandbox', async () => {
+    const g = await gate(); if ('skip' in g) return softSkip(...g.skip);
+    if (rootContainsOutside(g.root)) return softSkip('inapplicable', `sandboxRoot ${JSON.stringify(g.root)} contains ${OUTSIDE}, so no dot-dot path reaches outside it`);
+    const o = await runProbe({ op: 'read', path: DOTDOT });
+    if ('reason' in o) return softSkip('blocked', o.reason);
+    expect(o.status, req(ID_DOTDOT, DOC, `a path escaping through .. segments MUST be refused — the run ${o.status === 'completed' ? 'read the file' : o.status}`)).toBe('failed');
+    expect(o.error?.code, req(ID_DOTDOT, DOC_CODE, 'a sandbox escape is `forbidden`')).toBe('forbidden');
+    expect(o.error?.details['reason'], req(ID_DOTDOT, DOC_CODE, 'a sandbox escape carries details.reason: path-outside-sandbox')).toBe('path-outside-sandbox');
+    expect(o.error?.details['service'], req(ID_DOTDOT, 'spec/v2/core/errors.md §Host-service refusals', 'a generic code MUST carry details.service, the family key')).toBe('fs');
+  }, 60_000);
+
+  it('a symlink inside the root that points outside it is refused forbidden, path-outside-sandbox', async () => {
+    const g = await gate(); if ('skip' in g) return softSkip(...g.skip);
+    const o = await runProbe({ op: 'read', path: SYMLINK });
+    if ('reason' in o) return softSkip('blocked', o.reason);
+    if (o.status === 'failed' && o.error?.code === 'not_found') return softSkip('blocked', `${SYMLINK} answered not_found — the operator symlink the fixture contract requires is missing, so the leg observed nothing`);
+    expect(o.status, req(ID_SYMLINK, DOC, `a path escaping through a symlink MUST be refused, never followed — the run ${o.status === 'completed' ? 'read the link target' : o.status}`)).toBe('failed');
+    expect(o.error?.code, req(ID_SYMLINK, DOC_CODE, 'a sandbox escape is `forbidden`')).toBe('forbidden');
+    expect(o.error?.details['reason'], req(ID_SYMLINK, DOC_CODE, 'a sandbox escape carries details.reason: path-outside-sandbox')).toBe('path-outside-sandbox');
+    expect(o.error?.details['service'], req(ID_SYMLINK, 'spec/v2/core/errors.md §Host-service refusals', 'a generic code MUST carry details.service, the family key')).toBe('fs');
+  }, 60_000);
+});

package/src/scenarios/v2-memory-cross-tenant-isolation.test.ts

@@ -0,0 +1,113 @@
+/**
+ * `v2-memory-cross-tenant-isolation` (target major 2; gated on the `memory`
+ * family and the `conformance-agent-memory-cross-tenant` fixture).
+ *
+ * `spec/v2/core/host-services.md` §`memory`, **Tenant isolation**: "A ref MUST
+ * resolve to one tenant's entries, whatever the caller's permissions." No
+ * protocol path serves memory — pack code reads it as `ctx.memory` — so the
+ * observation surface is a run of the EXISTING fixture
+ * `conformance-agent-memory-cross-tenant` (conformance/fixtures.md), whose node
+ * writes one entry at the fixed `memoryRef` `conformance/agent-memory-cti` and
+ * lands `ownerEntryId`, then lists that ref into `ownerProbe`. No seam, no new
+ * fixture.
+ *
+ * The witness is two tenants running the SAME fixture, so both name the SAME
+ * ref string. Tenant A (OPENWOP_API_KEY) runs it first; tenant B
+ * (OPENWOP_TEST_TENANT_B_API_KEY) runs it second, and B's `ownerProbe` — a list
+ * of that ref under B's identity, issued after A's write — MUST hold none of
+ * A's entries. A host that resolves the ref without its tenant returns A's
+ * entry to B here. The major-1 scenario (`agentMemoryCrossTenantIsolation`)
+ * runs under one tenant and probes a ref nobody wrote, so it could not see that
+ * defect; until this file no major-2 scenario cited §`memory` at all
+ * (docs/V2-WITNESS-COVERAGE.md risk #2).
+ *
+ * Not witnessed here: the malformed-ref half (traversal, NUL, oversize ⇒ `[]` /
+ * `null`). The fixture's refs are fixed strings, and a new ref-taking fixture
+ * would be a new host obligation with no implementer to prove it against.
+ *
+ * Dispositions: family not advertised, or advertised without the fixture ⇒
+ * `inapplicable` (the host has not claimed the fixture). Fixture advertised but
+ * the second-tenant key is absent / identical, a run cannot be created, or the
+ * fixture's own positive control (a non-empty `ownerProbe` holding
+ * `ownerEntryId`) is absent ⇒ `blocked`: the host took the obligation on and
+ * the suite could not measure it.
+ */
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { loadEnv } from '../lib/env.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { scaledTimeoutMs } from '../lib/polling.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/host-services.md §memory';
+const FIXTURE = 'conformance-agent-memory-cross-tenant';
+const ID = 'openwop.requirement.0004.memory-ref-one-tenant';
+
+interface Probe { runId: string; status: string; entryId: string | null; ownerIds: string[]; ownerProbe: unknown; crossTenantProbe: unknown }
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+function idsOf(list: unknown): string[] {
+  return Array.isArray(list) ? list.map((e) => (e && typeof e === 'object' ? (e as { id?: unknown }).id : undefined)).filter((x): x is string => typeof x === 'string') : [];
+}
+
+/** One settled run of the fixture as the given caller, with the variables the fixture lands. */
+async function runFixture(as: Record<string, unknown>, who: string): Promise<Probe | { reason: string }> {
+  const res = await http(() => driver.post('/runs', { workflowId: FIXTURE, inputs: {} }, as));
+  const runId = (res?.json as { runId?: unknown } | undefined)?.runId;
+  if (res === null || res.status !== 201 || typeof runId !== 'string') return { reason: `${who}: POST /runs {${FIXTURE}} answered ${res?.status ?? 'nothing'}` };
+  const deadline = Date.now() + scaledTimeoutMs(15_000);
+  while (Date.now() < deadline) {
+    const s = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`, as));
+    const snap = s?.json as { status?: unknown; variables?: Record<string, unknown> } | undefined;
+    const status = String(snap?.status ?? '');
+    if (s?.status === 200 && ['completed', 'failed', 'cancelled'].includes(status)) {
+      const v = snap?.variables ?? {};
+      return { runId, status, entryId: typeof v['ownerEntryId'] === 'string' ? v['ownerEntryId'] : null, ownerIds: idsOf(v['ownerProbe']), ownerProbe: v['ownerProbe'], crossTenantProbe: v['crossTenantProbe'] };
+    }
+    await new Promise((r) => setTimeout(r, 250));
+  }
+  return { reason: `${who}: the ${FIXTURE} run ${runId} did not settle within 15 s` };
+}
+
+/**
+ * The fixture's own positive control: its owner list holds the entry it wrote.
+ * `failed` is allowed — the catalog lets a host fail the run at the fixture's
+ * third step (the probe of a foreign ref), after the owner write and list.
+ */
+function controlled(p: Probe): boolean {
+  return ['completed', 'failed'].includes(p.status) && p.entryId !== null && p.ownerIds.includes(p.entryId);
+}
+
+describe('v2 memory: a ref resolves to one tenant\'s entries (host-services.md §memory)', () => {
+  it('a second tenant listing the same memoryRef sees none of the first tenant\'s entries', async () => {
+    if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0');
+    if (!(await gateFamily('memory'))) return softSkip('inapplicable', 'memory family not advertised (gate recorded under openwop.family.memory)');
+    if (!isFixtureAdvertised(FIXTURE)) return softSkip('inapplicable', `fixture ${FIXTURE} is not advertised — memory has no protocol path, and the host does not claim the fixture that observes it`);
+    const b = process.env['OPENWOP_TEST_TENANT_B_API_KEY']?.trim();
+    if (!b) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set — the cross-tenant leg cannot run');
+    if (b === loadEnv().apiKey) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY equals OPENWOP_API_KEY — the leg needs a second tenant');
+    const asB = { authenticated: false, headers: { Authorization: `Bearer ${b}` } };
+
+    const a = await runFixture({}, 'tenant A');
+    if ('reason' in a) return softSkip('blocked', a.reason);
+    if (!controlled(a)) return softSkip('blocked', `tenant A's run ${a.runId} ended ${a.status} without the fixture's positive control (ownerProbe holding ownerEntryId ${String(a.entryId)}) — the adapter was not observably exercised`);
+    const bRun = await runFixture(asB, 'tenant B');
+    if ('reason' in bRun) return softSkip('blocked', bRun.reason);
+    if (bRun.runId.includes('/') && a.runId.includes('/') && bRun.runId.split('/')[0] === a.runId.split('/')[0]) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY binds the same tenant as OPENWOP_API_KEY (the run ids share a tenant segment) — the leg needs a second tenant');
+    if (!controlled(bRun)) return softSkip('blocked', `tenant B's run ${bRun.runId} ended ${bRun.status} without the fixture's positive control — the list B's run issued was not observed`);
+    if (bRun.entryId === a.entryId) return softSkip('blocked', `both tenants' writes report entry id ${String(a.entryId)} — ids that repeat across tenants cannot tell A's entry from B's`);
+
+    const leaked = a.ownerIds.filter((id) => bRun.ownerIds.includes(id));
+    expect(leaked, req(ID, DOC, `a ref MUST resolve to one tenant's entries: tenant B's list of conformance/agent-memory-cti (run ${bRun.runId}) returned tenant A's entries`)).toEqual([]);
+    expect(bRun.ownerIds, req(ID, DOC, `tenant B's list MUST NOT hold the entry tenant A just wrote (${String(a.entryId)})`)).not.toContain(a.entryId);
+    for (const p of [a, bRun].filter((r) => r.status === 'completed')) {
+      const x = p.crossTenantProbe;
+      expect(x === null || (Array.isArray(x) && x.length === 0), req(ID, DOC, `the fixture's probe of a ref another tenant owns MUST be [] or null (run ${p.runId})`)).toBe(true);
+    }
+  });
+});

package/src/scenarios/v2-queue-cross-tenant-isolation.test.ts

@@ -0,0 +1,118 @@
+/**
+ * `spec/v2/core/host-services.md` §`queueBus` — "A tenant's consumer MUST NOT
+ * receive another tenant's messages, even on the same topic." (target major 2;
+ * gated on the `queueBus` family, the queue-probe fixture pair and a second
+ * tenant's credential).
+ *
+ * Before this file the rule was witnessed at major 1 only
+ * (`queue-cross-tenant-isolation`), through the v1 seam
+ * `POST /v1/host/sample/test/surface`, which names the tenant in the REQUEST
+ * BODY — so it never tested the thing that matters, that the tenant comes from
+ * the credential. Topics are named by pack authors, so two tenants running the
+ * same pack share topic names by default; a host that keys the physical queue
+ * by topic alone hands one tenant's messages to the other.
+ *
+ * No seam (`conformance.md` forbids growing the seam count). The leg drives
+ * `ctx.queueBus` through the normal run surface with two fixtures
+ * (`conformance/fixtures.md` §`conformance-queue-publish` /
+ * §`conformance-queue-consume`): tenant A (`OPENWOP_API_KEY`) publishes a fresh
+ * nonce on a fresh topic T; tenant B (`OPENWOP_TEST_TENANT_B_API_KEY`) consumes
+ * T and MUST NOT receive it; then A consumes T and MUST receive it — the
+ * positive control, without which "B got nothing" would also be what a host
+ * whose queue does nothing at all shows.
+ *
+ * Dispositions: `queueBus` not advertised, or either probe fixture not
+ * advertised ⇒ `inapplicable` (read with `familyAdvertised`, not `gateFamily`:
+ * no host advertises `queueBus` at v2 today, and a strict-mode family gate would
+ * demand a `family.queueBus` opt-out from every one of them). The family and fixtures advertised but no second
+ * tenant key, or the key binds the primary tenant ⇒ `blocked` (the only
+ * observation that convicts a leaking host did not run). A probe run that does
+ * not complete, or a consume that leaves `consumed` unset, fails: the fixture
+ * contract is the host's claim once it advertises the fixture.
+ *
+ * @see spec/v2/core/host-services.md §`queueBus`
+ * @see SECURITY/invariants.yaml `queue-cross-tenant-isolation`
+ */
+
+import { describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { driver, type OpenWOPResponse, type OpenWOPRequestInit } from '../lib/driver.js';
+import { familyAdvertised, v2Discovery } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/host-services.md §queueBus';
+const ID = 'openwop.requirement.queueBus.cross-tenant-isolation';
+const PUBLISH = 'conformance-queue-publish';
+const CONSUME = 'conformance-queue-consume';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+const enc = (id: string): string => encodeURIComponent(id);
+const tenantOf = (runId: string): string => runId.slice(0, Math.max(0, runId.indexOf('/')));
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
+
+/** The `consumed` array the consume node output, wherever the host surfaces it (node.completed, run.completed, the snapshot). */
+function consumedOf(docs: readonly unknown[]): string[] | null {
+  let hit: string[] | null = null;
+  const walk = (v: unknown): void => {
+    if (hit !== null || v === null || typeof v !== 'object') return;
+    if (Array.isArray(v)) { v.forEach(walk); return; }
+    const c = (v as Record<string, unknown>)['consumed'];
+    if (Array.isArray(c)) { hit = c.map((x) => (typeof x === 'string' ? x : JSON.stringify(x))); return; }
+    Object.values(v as Record<string, unknown>).forEach(walk);
+  };
+  docs.forEach(walk);
+  return hit;
+}
+
+interface Ran { readonly runId: string; readonly status: string; readonly docs: unknown[] }
+
+async function run(workflowId: string, inputs: Record<string, unknown>, as: OpenWOPRequestInit, who: string): Promise<Ran | { reason: string }> {
+  const created = await http(() => driver.post('/runs', { workflowId, inputs }, as));
+  if (created === null) return { reason: `${who}: POST /runs unreachable (fetch failed)` };
+  const runId = (created.json as { runId?: unknown } | undefined)?.runId;
+  if (created.status !== 201 || typeof runId !== 'string') return { reason: `${who}: POST /runs {workflowId: ${workflowId}} answered ${created.status} ${readErrorCode(created.json) ?? ''} — the fixture is advertised but did not start`.trim() };
+  const deadline = Date.now() + 20_000;
+  let snap: OpenWOPResponse | null = null;
+  let status = '';
+  while (Date.now() < deadline) {
+    snap = await http(() => driver.get(`/runs/${enc(runId)}`, as));
+    status = snap?.status === 200 ? String((snap.json as { status?: unknown } | undefined)?.status ?? '') : status;
+    if (TERMINAL.has(status)) break;
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  if (!TERMINAL.has(status)) return { reason: `${who}: the ${workflowId} run ${runId} did not settle within 20 s (last status: ${status || 'unreadable'})` };
+  const poll = await http(() => driver.get(`/runs/${enc(runId)}/events/poll?timeout=1`, as));
+  return { runId, status, docs: [snap?.json, poll?.status === 200 ? poll.json : null] };
+}
+
+describe('v2 queue-cross-tenant-isolation (host-services.md §queueBus)', () => {
+  it('a message tenant A publishes on topic T is never consumed by tenant B on T, and A\'s own consumer receives it', async () => {
+    if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 under OpenWOP-Version: 2.0');
+    if (!(await familyAdvertised('queueBus'))) return softSkip('inapplicable', 'queueBus family not advertised — no obligation');
+    for (const f of [PUBLISH, CONSUME]) if (!isFixtureAdvertised(f)) return softSkip('inapplicable', `fixture ${f} is not advertised — the host does not claim the queue-probe fixture pair`);
+    const keyB = process.env['OPENWOP_TEST_TENANT_B_API_KEY'];
+    if (!keyB) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY is not set — the second-tenant consume, the only observation a leaking host fails, cannot run');
+    const asA: OpenWOPRequestInit = {};
+    const asB: OpenWOPRequestInit = { authenticated: false, headers: { Authorization: `Bearer ${keyB}` } };
+
+    const topic = `openwop.conformance.xtenant.${randomBytes(6).toString('hex')}`;
+    const nonce = `openwop-conformance-queue-${randomBytes(12).toString('hex')}`;
+
+    const pub = await run(PUBLISH, { topic, message: nonce }, asA, 'tenant A publish'); if ('reason' in pub) return softSkip('blocked', pub.reason);
+    expect(pub.status, req(ID, `conformance/fixtures.md §${PUBLISH}`, `tenant A's publish run MUST complete (got ${pub.status})`)).toBe('completed');
+
+    const b = await run(CONSUME, { topic }, asB, 'tenant B consume'); if ('reason' in b) return softSkip('blocked', b.reason);
+    if (tenantOf(b.runId) === tenantOf(pub.runId)) return softSkip('blocked', `OPENWOP_TEST_TENANT_B_API_KEY binds the same tenant as OPENWOP_API_KEY (${tenantOf(pub.runId)}) — the leg needs a second tenant`);
+    expect(b.status, req(ID, `conformance/fixtures.md §${CONSUME}`, `tenant B's consume run MUST complete (got ${b.status})`)).toBe('completed');
+    const gotB = consumedOf(b.docs);
+    expect(Array.isArray(gotB), req(ID, `conformance/fixtures.md §${CONSUME}`, 'the consume node MUST output `consumed` as an array ([] when nothing arrived), never leave it unset — an unset output would pass the isolation check vacuously')).toBe(true);
+    expect(gotB ?? [], req(ID, DOC, `a tenant's consumer MUST NOT receive another tenant's messages, even on the same topic — tenant B (${tenantOf(b.runId)}) consumed tenant A's (${tenantOf(pub.runId)}) message on ${topic}`)).not.toContain(nonce);
+
+    const a = await run(CONSUME, { topic }, asA, 'tenant A consume'); if ('reason' in a) return softSkip('blocked', a.reason);
+    expect(a.status, req(ID, `conformance/fixtures.md §${CONSUME}`, `tenant A's consume run MUST complete (got ${a.status})`)).toBe('completed');
+    expect(consumedOf(a.docs) ?? [], req(ID, `conformance/fixtures.md §${CONSUME}`, `positive control: tenant A's own consumer on ${topic} MUST receive the message A published — without it "tenant B received nothing" is also what a queue that delivers nothing shows`)).toContain(nonce);
+  }, 90_000);
+});