@openwop/openwop-conformance 2.45.2 → 2.45.4

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.4] — 2026-10-01 — v2 ports of production-backpressure and budget-enforcement, on a per-major profile
+
+- **The gate runs every host-free scenario** (not packed; no scenario changes). New `scripts/list-host-free-scenarios.mjs` lists the scenarios whose import closure never reaches `lib/driver`, `lib/sse` or `lib/env` and never calls `fetch(`: 70 files today. `scripts/openwop-check.sh` runs them with `OPENWOP_BASE_URL` and `OPENWOP_API_KEY` unset, after the nine hand-listed files.
+  - **Why.** `host-callback-declaration` and `runner-ledger` failed on every host in the 2.45.3 candidate and nothing in CI said so (#1835).
+  - **Proof.** Clean tree: 66 files pass and 4 skip, no failure. With `REQUIRES_HOST_CALLBACK` removed from `v2-tool-authorization-fail-closed`, the step fails on `host-callback-declaration`.
+  - **Limits.** The walk reads static relative imports. `--check` fails if the set is empty or loses a known member. `ai-envelope-shape` is on the hand list and outside the derived set, so the hand list stays.
+- **The 2.45.4 cycle opens.** Two new scenarios and one new fixture change the packed content.
+- **Fix: an unclaimed any-of floor no longer blocks a major-1 bundle** (a 2.45.3 defect). The runner wrote the `openwop.floor.anyof.byok-roundtrip+secrets-run-witness` summary row for every floor in the v1 table, claimed or not. A host that does not advertise secrets records both members `inapplicable`, so it got one `blocked` row for `openwop-secrets`, a profile it never claimed, and a v3 bundle with any `blocked` row certifies nothing (RFC 0168 §E.1). The row is now written only when the profile is claimed. A claimed profile is unchanged: unwitnessed members still record `blocked` and deny it.
+  - **Who was affected:** a major-1 host cutting a v3 bundle on 2.45.3 without claiming `openwop-secrets`. Major-2 bundles never carried the row.
+  - **Proof.** `floor-any-of.test.ts`: the same evidence yields no row unclaimed and a `blocked` row claimed. Found by running the derivation, after reading the code had suggested the row was harmless.
+- **What differs between majors is now data** (`src/lib/major-profile.ts`). One table row per major holds the run path, the version headers, the event names (from the codemap), where retry timing lives, how a family is advertised, and how a run budget rides on `createRun`. A shared witness takes a profile and never names a major, so a port to a later major is one row plus a thin scenario file. A major with no row throws; it never falls back to an older major's rules.
+- **New scenario `v2-production-backpressure`** (major 2, unaided; `conformance.md` §Production profile). Gated on `production.backpressure.inflightCap`. The suite holds that many event streams open, waits for each to open, and sends one more request.
+  - `openwop.requirement.production.backpressure-refusal`: the extra request answers `503 service_unavailable` with `Retry-After`, equal to `retryAfterSeconds` where advertised.
+  - `openwop.requirement.0171.error-registry.no-retry-details`: the refusal carries no `details.retryAfter*`. v1 required `details.retryAfter`; v2 forbids it.
+  - **Dispositions.** No `production`, `backpressure` or `inflightCap`, a cap above 64, or an unadvertised hold or probe fixture: `inapplicable`. A slot that cannot be held, or a probe with no response: `blocked`.
+  - **Not ported:** v1's "discovery is exempt from the cap" leg. No v2 document states it.
+- **New scenario `v2-budget-enforcement`** (major 2, unaided; `runs.md` §`budget` section). At major 2 a budget rides on `createRun` (`configurable.budget`), so no seam is needed. The suite runs the new fixture with `{ maxToolCalls: 2, thresholdPercent: 50, onExhaustion: "fail" }` and reads the log through the poll.
+  - `openwop.requirement.runs.budget-lifecycle`: `budget.reserved`, `budget.threshold-crossed` and `budget.exhausted`, in order.
+  - `openwop.requirement.runs.budget-enforcement`: a `hard` host emits `cap.breached` (`budget-tool-calls`) and fails the run `budget_exhausted`; an `advisory` host does not stop it.
+  - `openwop.requirement.runs.budget-content-free`: no `budget.*` or `cap.breached` payload carries pricing or a credential.
+  - **Dispositions.** No `budget`, no `toolCalls` dimension, or the fixture unadvertised: `inapplicable`. The fixture is the opt-in, so a host that advertises `budget` without seeding it is unwitnessed, not blocked. A refused valid create: `executed-fail`.
+  - **Not ported:** v1's `budget_model_denied` leg. It needs a fixture that resolves a model without a seam.
+- **New fixture `conformance-budget-tool-calls`**: one `core.conformance.mock-agent` with three scripted tool calls.
+- **Proof.** No host serves either family unaided at major 2, so both witnesses are proven against `src/lib/scratch-host.ts`, a profile-driven test double: 29 self-tests, one defect each (`backpressure-witness.test.ts`, `budget-witness.test.ts`, `major-profile.test.ts`). The scenario files were also run end to end against a conforming and a defective scratch host.
+
+## [2.45.3] — 2026-10-01 — RFC 0229 (Active): a production host can witness secret resolution without an oracle; v2 tenant-isolation witnesses for storage, fs, memory, workspace, queues and secrets
+
+- **Two self-checks that failed on every host are fixed before the cut.** Found by running the candidate on openwop-app at major 1 against 2.45.2: four rows went `executed-pass` → `executed-fail`, and both files failed the same way with no host.
+  - `host-callback-declaration`: `v2-tool-authorization-fail-closed` imports `lib/effect-receiver` and now exports `REQUIRES_HOST_CALLBACK`.
+  - `runner-ledger`: the derivation emits the any-of summary row for `openwop-secrets` whatever profile is claimed, as it does the prefix rows. The test's synthetic report holds neither member, so the row is `blocked`; the test now asserts that and excludes it from the claimed floor's pass count. The derivation is unchanged.
+  - The rest of that diff was as intended: no row newly `blocked`, the four `0083.trigger-delivery.*` rows and the any-of row `executed-pass`, `secrets-run-witness` and `trigger-refused-event-keeps-subscription` `inapplicable`.
+- **The 2.45.3 cycle opens.** RFC 0229's gap register changes the packed `spec/v1/gaps.json`.
+- **A lost response is `blocked`, not `executed-fail`** (#1829).
+  - **Bound.** `driver.request` gives each request 20 s (`REQUEST_TIMEOUT_MS`, scaled by `OPENWOP_POLL_TIMEOUT_SCALE`), below vitest's 30 s `testTimeout`. The body read is under the same bound. A caller's own `signal` replaces the bound, and its abort is rethrown as-is.
+  - **Named.** A timeout or a failed connection throws `TransportError` (`transport-loss: <METHOD> <origin+path> got no response …`). The query string is dropped from the message.
+  - **Recorded.** A test that fails on a transport loss before its first assertion records `blocked`; the file row follows when every failure in it is one and nothing was asserted. A loss after an assertion stays `executed-fail`, and an assertion failure is never excused.
+  - **Why.** On MyndHyve's 2.45.2 cut the runner's network dropped for about 9 s. `v2-mcp-client-results` hung to the harness timeout and recorded `executed-fail` with 0 assertions against a host that had answered in 2.6 ms. `blocked` still denies certification, so a flaky runner cannot certify; it can no longer convict the host.
+  - **Proof.** `src/lib/driver-transport-loss.test.ts` (10 cases): a local server that never answers yields a timeout `TransportError` well inside the bound; without the classification the same failure is `executed-fail`.
+- **New scenario `v2-eval-mode-unadvertised-refused`** (major 2, unaided): a host that does not advertise `agents.evalSuite` answers `POST /runs {mode: "eval"}` with `422 capability_not_provided` (`runs.md` §Refusals; `openwop.requirement.runs.eval-mode-unadvertised-refused`). The eval scenarios ran at major 1 only, so nothing measured this at major 2. A host that advertises the facet records `inapplicable`. If a host wrongly accepts the create, the leg cancels the run before asserting.
+  - **Proof.** Passes on the v2 reference host with openwop-examples #143; fails on the host without it, which answered `capability_required`.
+- **`trigger-bridge-delivery`: a normative-surface witness path (RFC 0230), and one requirement per leg.**
+  - **Split.** The single combined `it` becomes four, each with its own requirement id: `openwop.requirement.0083.trigger-delivery.{dedup,dead-letter,causation,runless-content-free}`. The old per-`it` id aliases to the dedup leg.
+  - **Seam path unchanged.** It stays the primary witness whenever the host serves the seams.
+  - **Normative-surface path.** When the seams are absent and the host advertises `triggerBridge.ingestion.inboundSigning: ["standard-webhooks-1"]`, legs 1–3 run it. The suite registers a webhook subscription, then POSTs Standard-Webhooks-signed bodies to its `ingestUrl` with no OpenWOP credential:
+    - dedup: 202, then `200 duplicate` with the same `runId`;
+    - dead-letter: a bad signature gets 401 with no run, the subscription stays `active` (RFC 0230 §C.1), and a signed post then gets 202;
+    - causation: `run.started.causationId` via the run's own event poll.
+  - **Run-less content-freeness** stays seam-only, since those events are on no run's log. It **stays in the floor**, which never narrows: a seam-free host records one honest red row instead of three.
+  - **Proof.** Measured on openwop-app with the RFC 0230 route on and the seams off: legs 1–3 pass in strict mode on the new path. Sabotaged host builds each fail only their own leg:
+    - a duplicate `webhook-id` starting a new run fails dedup;
+    - a bad signature accepted fails dead-letter;
+    - a refused post dead-lettering the subscription fails dead-letter;
+    - a missing `causationId` fails causation.
+- **RFC 0229 `Active`** (the window is waived by steward override of RFC 0147 §A.6). Two new scenarios, `secrets-run-witness` (major 1) and `v2-secrets-run-witness` (major 2), share `lib/run-secrets-witness.ts`. Each draws a fresh 64-character value `C` per run, supplies it as `createRun.runSecrets` under `run:openwop-witness`, and runs the fixture `openwop-secrets-run-witness`. Four rows, the same ids at both majors:
+  - `openwop.requirement.secrets.run-witness-resolves`: `matched: true` for `C`, and `false` when `expectedSha256` names another value;
+  - `openwop.requirement.secrets.run-witness-redacted`: `C` is absent from the create answer, snapshot, polled and `debug`-mode events, the run list and the debug bundle where served. The scan reads raw text and covers every encoding RFC 0229 §F lists. It also covers the digest, wherever the suite did not send that digest itself;
+  - `openwop.requirement.secrets.run-witness-scope-bound`: a non-`run:` ref fails `credential_forbidden`; an unsupplied or earlier run's `run:` ref fails `credential_not_found`; a branch fork, where served, fails `credential_not_found`;
+  - `openwop.requirement.secrets.run-secrets-outside-request-digest`: a same-key retry differing only in `runSecrets` replays with the original `runId` and `OpenWOP-Idempotent-Replay: true`, is never `409 idempotency_key_mismatch`, and its value appears nowhere.
+
+  **Dispositions.** Facet absent: `inapplicable`. Facet without the fixture: `blocked`. A refused well-formed `runSecrets`: `executed-fail`.
+
+  **Sabotage.** Each row failed against a scratch host with its defect: a witness that resolves a stored secret by a non-`run:` name, an echoed value, an emitted digest, a digest-covering idempotency record, a fork that inherits, and a cross-run fallback. The clean host passed all four rows at both majors.
+- **The `openwop-secrets` floor is an any-of group** (`requiredAnyOf`, RFC 0229 §E). It is satisfied by a witnessed pass of `byok-roundtrip` or `secrets-run-witness` with no member failing, and never by an `inapplicable` one. The runner writes one summary row, `openwop.floor.anyof.byok-roundtrip+secrets-run-witness`, and both bundle verifiers and the `--certify` witness count read it. `src/lib/floor-any-of.test.ts` pins this.
+  - `byok-roundtrip` records `inapplicable` instead of `blocked` when the canary fixture is withheld and the host advertises `secrets.runSecrets` and the witness fixture. A host that takes the other path is not denied the bundle over a canary it does not serve.
+  - Otherwise `byok-roundtrip` is unchanged.
+- **Host impact: none today.** No committed bundle and neither live production host advertises `secrets.runSecrets`, so both new files record `inapplicable` everywhere, and `byok-roundtrip` keeps its current disposition.
+- **New v2 tenant-isolation witnesses** from `docs/V2-WITNESS-COVERAGE.md`, each sabotage-proved against a host with the exact defect: `v2-storage-cross-tenant-isolation` (eight families, one id each), `v2-fs-sandbox-escape-refused` (absolute, `..`, symlink), `v2-memory-cross-tenant-isolation`, `v2-workspace-scope-from-identity`, `v2-queue-cross-tenant-isolation`, and `v2-secret-canary-absent` (a host-resolved secret on no readable surface, including after a failure and in a fork). Each is `inapplicable` where its family is not advertised; MyndHyve runs the memory and secret-canary legs.
+- **`memory-attribution-replay-stable` runs on v2 hosts.** `emitsWriteEvents()` (`lib/memoryAttribution.ts`) required `attribution.supported === true`, a field a v2 family record does not have (presence is the claim, RFC 0169 §A.2), so the file recorded `inapplicable` on every v2 host, including the two that advertise `memory.attribution.emitsWriteEvents: true`. At major 2 it now reads `emitsWriteEvents` on the present record; major 1 still requires `supported`. `memoryWrittenEvents()` read `GET /runs/{runId}/events` at major 2, which is the SSE stream, so once the gate opened every leg would have recorded `blocked` ("run wrote no memory"). It now reads `GET /runs/{runId}/events/poll` and pages on `afterSequence`. No other `conformance/src/lib` helper that a major-2 scenario imports has the same bug (`toolCatalog`, `context-budget` and `run-secrets-witness` were already major-aware). Sabotage: against a loopback v2 stub, the clean host passes, and a replay that re-mints ids, one that suppresses them, and one that adds a fresh id each fail. A host without the facet records `inapplicable`. Self-test: `lib/memoryAttribution.test.ts`.
+- **New scenario `trigger-refused-event-keeps-subscription` (major 1), for the §F.2 Class 3 correction (RFC 0230 risk R3).** Row `openwop.requirement.trigger-bridge.refused-event-keeps-subscription`. The row is gated on the `openwop-trigger-bridge` profile and on `webhook` in `triggerBridge.ingestion.externalSources`. It drives the delivery seam's new OPTIONAL `scenario: "refused"`, then `deliver` on the same `subscriptionId`, and asserts three things:
+  - the refused event is a dead-lettered `trigger.delivery.attempted` and starts no run;
+  - no `trigger.subscription.state.changed` is emitted, and the subscription reads back `active`;
+  - the next verified event on that subscription is delivered.
+
+  **Dispositions.** Seam without `refused` (`400`): `blocked` (fails under strict mode). No `webhook` ingestion: `inapplicable`.
+
+  **Sabotage.** Proved against a loopback stub. The corrected host passes (default and strict). Each defective variant fails: the old subscription-level transition with its `state.changed`; the same transition with no event (the read shows `dead-lettered`); a refused event that starts a run. **Host impact:** trigger scenarios are major-1 only and no committed bundle carries one; a major-1 host that derives the profile with `webhook` ingestion records `blocked` until its seam serves `refused`.
+
 ## [2.45.2] — 2026-09-30 — a run-failure code must be registered or a vendor code (no longer advisory)
 
 - **`errors.event-code-registered` is required** (#1698). The leg in `v2-error-registry` shipped ADVISORY in 2.43.1: an unregistered, non-vendor code on `run.failed`, `node.failed` or the snapshot's `error` recorded a partial witness naming the codes, while hosts remapped. That branch is removed, so such a code now fails the row, which names each `where=code`.

package/README.md

@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 575 scenario files under `src/scenarios/`.
+The current suite has 589 scenario files under `src/scenarios/`.
 - 2026-09-29 (suite 2.45.0, openwop#1763): NEW `v2-cors-preflight.test.ts` — `headers.md` §Cross-origin preflight. For every operation it preflights with `Origin`, the method, and the operation's declared request headers (plus `authorization` / `content-type` where they apply, from `spec/v2/path-manifest.json`), and reads the answer as the Fetch standard's CORS-preflight check does. Self-gated: `inapplicable` when no operation's preflight grants `OPENWOP_CORS_ORIGIN` (default `https://conformance.invalid`).
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
@@ -482,7 +482,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 575 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 589 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -646,7 +646,7 @@ async function runCertify(args, baseUrl, apiKey) {
             const floor = PROFILE_FLOOR_SCENARIOS[profile];
             if (!floor)
                 return 0;
-            const onFloor = (scenario) => floor.required.includes(scenario) || (floor.requiredAnyPrefix ?? []).some((pre) => scenario.startsWith(pre));
+            const onFloor = (scenario) => floor.required.includes(scenario) || (floor.requiredAnyPrefix ?? []).some((pre) => scenario.startsWith(pre)) || (floor.requiredAnyOf ?? []).some((g) => g.includes(scenario));
             return derived.requirements.filter((r) => r.disposition === 'executed-pass' && onFloor(r.scenarioId)).length;
         };
         // `certified` IS the verdict (RFC 0148 §A; RFC 0168 §E.1 adds the bundle-wide

package/dist/lib/certification-bundle-verify.js

@@ -26,7 +26,7 @@
 import { createHash } from 'node:crypto';
 import { PROFILE_FLOOR_SCENARIOS, profileDerivable, } from './profiles.js';
 import { CERTIFIABLE, DISPOSITIONS } from './requirement-ledger.js';
-import { floorFilesFor, requirementIdForPrefix, requirementIdForScenario } from './requirement-registry.js';
+import { floorFilesFor, requirementIdForAnyOf, requirementIdForPrefix, requirementIdForScenario } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 /**
  * The BYOK conformance canary (`fixtures.md` §conformance-secrets-roundtrip;
@@ -84,6 +84,7 @@ function requiredFor(profile, document) {
     return {
         files: [...files],
         prefixes: [...(floor.requiredAnyPrefix ?? [])],
+        anyOf: [...(floor.requiredAnyOf ?? [])],
         discoveryOnly: floor.discoveryOnly === true,
     };
 }
@@ -192,6 +193,26 @@ export function verifyBundleV2(bundle) {
             if (!considered.some((r) => isWitnessedPass(r)))
                 notCertifiable.push(id);
         }
+        for (const group of req.anyOf) {
+            // RFC 0229 §E: one requirement, satisfied by a WITNESSED pass of any
+            // member with no member failing. The emitter writes a summary row under
+            // the group id; member rows are read when it is absent.
+            const id = requirementIdForAnyOf(group);
+            required.push(id);
+            const summary = byId.get(id)?.[0];
+            const members = group.map((f) => byId.get(requirementIdForScenario(scenarioBasename(f)))?.[0]).filter((r) => r !== undefined);
+            if (summary === undefined && members.length === 0) {
+                profileRejections.push({ kind: 'unwitnessed-requirement', profile, requirementId: id, detail: `${id}: no alternative (${group.join(', ')}) recorded a row` });
+                continue;
+            }
+            const considered = summary !== undefined ? [summary] : members;
+            if (considered.some((r) => r.disposition === 'executed-pass' && !isWitnessedPass(r))) {
+                profileRejections.push({ kind: 'vacuous-pass', profile, requirementId: id, detail: `${id}: executed-pass with no witnessed assertion` });
+                continue;
+            }
+            if (considered.some((r) => r.disposition === 'executed-fail') || !considered.some((r) => isWitnessedPass(r)))
+                notCertifiable.push(id);
+        }
         const evidenceValid = profileRejections.length === 0;
         const certified = derivable && evidenceValid && notCertifiable.length === 0 && (req.discoveryOnly || required.length > 0);
         return { profile, derivable, floorUnspecified: false, required, rejections: profileRejections, notCertifiable, evidenceValid, certified };

package/dist/lib/profiles.js

@@ -462,6 +462,10 @@ export function hasProfile(c, profile) {
             return isTriggerBridge(c);
     }
 }
+/** Every scenario FILE a floor names: `required`, every `conditional` branch, and every `requiredAnyOf` member. */
+export function floorMemberFiles(floor) {
+    return [...floor.required, ...(floor.conditional ?? []).flatMap((c) => c.required), ...(floor.requiredAnyOf ?? []).flat()];
+}
 export const PROFILE_FLOOR_SCENARIOS = {
     'openwop-core-standard': {
         required: [
@@ -531,7 +535,11 @@ export const PROFILE_FLOOR_SCENARIOS = {
     // `profiles.md` §`openwop-secrets`: credential resolution per `run-options.md`
     // §"Credential references" — the BYOK canary round-trip (`fixtures.md`
     // §conformance-secrets-roundtrip, SR-1) is the profile's proof.
-    'openwop-secrets': { required: ['byok-roundtrip.test.ts'] },
+    // RFC 0229 §E (2026-09-30): a SECOND floor path, as an any-of group. The
+    // canary fixture's node is an oracle over whatever its name reaches, so a
+    // production host rightly withholds it; the run-witness reads only a value
+    // the caller supplied with the same run and outputs only `matched`.
+    'openwop-secrets': { required: [], requiredAnyOf: [['byok-roundtrip.test.ts', 'secrets-run-witness.test.ts']] },
     // `profiles.md` §`openwop-provider-policy`: the four-mode taxonomy shape and
     // its enforcement on the wire.
     'openwop-provider-policy': { required: ['policies.test.ts', 'providerPolicyEnforcement.test.ts'] },
@@ -650,9 +658,16 @@ export function verifyBundleProfile(bundle, profile) {
     }
     const missingFloor = requiredFiles.filter((r) => !passed.has(scenarioBasename(r)));
     const prefixOk = (floor.requiredAnyPrefix ?? []).every((p) => [...passed].some((s) => s.startsWith(p)));
+    // RFC 0229 §E any-of groups: a v1 bundle lists only what passed, so a group
+    // holds when one member is in `results.passed`; an unmet group is reported
+    // as missing, spelled as its alternatives.
+    const groups = floor.requiredAnyOf ?? [];
+    for (const g of groups)
+        if (!g.some((f) => passed.has(scenarioBasename(f))))
+            missingFloor.push(g.join(' | '));
     // A conditional floor none of whose branches matched requires nothing — that
     // is unprovable for a non-discovery-only profile, not proven.
-    const evaluable = floor.discoveryOnly === true || requiredFiles.length > 0 || (floor.requiredAnyPrefix ?? []).length > 0;
+    const evaluable = floor.discoveryOnly === true || requiredFiles.length > 0 || (floor.requiredAnyPrefix ?? []).length > 0 || groups.length > 0;
     const floorProven = evaluable && missingFloor.length === 0 && prefixOk;
     return {
         profile,

package/dist/lib/requirement-registry.js

@@ -32,6 +32,14 @@ export function requirementIdForScenario(scenarioFile) {
 export function requirementIdForPrefix(prefix) {
     return `openwop.floor.any.${prefix}`;
 }
+/**
+ * Any-of groups (RFC 0229 §E) become one requirement:
+ * `['byok-roundtrip.test.ts', 'secrets-run-witness.test.ts']` →
+ * `openwop.floor.anyof.byok-roundtrip+secrets-run-witness`.
+ */
+export function requirementIdForAnyOf(files) {
+    return `openwop.floor.anyof.${files.map((f) => f.replace(/\.test\.ts$/, '')).join('+')}`;
+}
 /**
  * The requirement IDs a profile's certification rests on.
  *
@@ -121,6 +129,7 @@ export function requirementsFor(profile, document) {
     return [
         ...files.map(requirementIdForScenario),
         ...(floor.requiredAnyPrefix ?? []).map(requirementIdForPrefix),
+        ...(floor.requiredAnyOf ?? []).map(requirementIdForAnyOf),
     ];
 }
 /** Every registered requirement ID across every profile with a runtime floor. */
@@ -137,6 +146,12 @@ export function allRequirements() {
                 ids.add(requirementIdForScenario(f));
         for (const p of floor.requiredAnyPrefix ?? [])
             ids.add(requirementIdForPrefix(p));
+        // an any-of group is one requirement, and each member file records under its own floor id
+        for (const g of floor.requiredAnyOf ?? []) {
+            ids.add(requirementIdForAnyOf(g));
+            for (const f of g)
+                ids.add(requirementIdForScenario(f));
+        }
         void profile;
     }
     return [...ids].sort();

package/dist/lib/scenario-disposition.js

@@ -26,24 +26,20 @@
  * host or a vitest subprocess.
  */
 import { scenarioFileOfItId } from './requirement-ids.js';
-import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
+import { DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, floorMemberFiles } from './profiles.js';
 import { targetMajor } from './seams.js';
 import { PKG_ROOT_PATH } from './paths.js';
 import { v2ProfileFloorFiles } from './requirement-registry.js';
-import { requirementIdForScenario, requirementIdForPrefix, requirementsFor, v2FloorsActive } from './requirement-registry.js';
+import { requirementIdForScenario, requirementIdForPrefix, requirementIdForAnyOf, requirementsFor, v2FloorsActive } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
 import { CERTIFIABLE } from './requirement-ledger.js';
 /** All scenario basenames that appear in some profile's runtime floor. */
 export function floorScenarioFiles() {
     const out = new Set();
-    for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) {
-        for (const f of floor.required)
+    for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS))
+        for (const f of floorMemberFiles(floor))
             out.add(f);
-        for (const c of floor.conditional ?? [])
-            for (const f of c.required)
-                out.add(f);
-    }
     // At target major 2 the floors come from the declaration, not the v1 hand
     // table. The ledger and --certify MUST agree on this set, or a floor file is
     // minted `openwop.scenario.*` and looked up as `openwop.floor.*` — which is
@@ -77,10 +73,13 @@ export function requirementIdForFile(basename) {
  * the thing that passed.
  */
 export const PARTIAL_WITNESS_PREFIX = 'partial-witness: ';
+/** `driver.ts`'s `TRANSPORT_LOSS_PREFIX`, restated so this module stays free of the driver (a test pins the two equal). */
+export const TRANSPORT_LOSS_MARK = 'transport-loss: ';
 /**
  * The per-`it` record (RFC 0148 §A at test granularity), as `setup.ts`
  * computes it in `afterEach`. Pure so a lib test can pin it:
  *   - fail                         ⇒ executed-fail (detail = the first error message)
+ *   - fail on a driver transport loss, 0 assertions ⇒ blocked (#1829: nothing was observed)
  *   - pass with ≥ 1 assertion      ⇒ executed-pass
  *   - a behaviorGate entry journaled during the test ⇒ that gate's disposition
  *   - pass with 0 assertions       ⇒ the softSkip note written DURING THIS TEST
@@ -114,6 +113,15 @@ blockedStands = false,
 /** The `it` title, so a failed row says WHICH leg of the requirement failed. */
 testName) {
     if (state === 'fail') {
+        // #1829: the driver got no response (`TransportError`) before the test
+        // asserted anything. Nothing about the host was observed, so this is not a
+        // verdict on it. `blocked` still denies certification, so a flaky runner
+        // cannot certify; it just cannot convict the host either. A loss AFTER an
+        // assertion stays `executed-fail`: the test was mid-measurement, and a host
+        // that stops answering part-way is a finding.
+        if (assertionCalls === 0 && firstError !== undefined && firstError.includes(TRANSPORT_LOSS_MARK)) {
+            return { disposition: 'blocked', detail: firstError.slice(firstError.indexOf(TRANSPORT_LOSS_MARK), firstError.indexOf(TRANSPORT_LOSS_MARK) + 300) };
+        }
         const where = testName === undefined || testName.trim() === '' ? '' : ` in "${testName.slice(0, 120)}"`;
         return { disposition: 'executed-fail', detail: `the test executed and failed${where}: ${(firstError ?? 'no message').slice(0, 300)}` };
     }
@@ -198,6 +206,11 @@ export function failureDetail(failures, failedCount) {
  *  the ONE disposition the file records. */
 export function fileDisposition(states, gateReason, assertionCount, failures = []) {
     const failed = states.filter((s) => s === 'fail').length;
+    // #1829, the file-level half of `resolveItRecord`'s rule: every failure was a
+    // driver transport loss and the file asserted nothing, so nothing was observed.
+    if (failed > 0 && assertionCount === 0 && failures.length === failed && failures.every((f) => f.message?.includes(TRANSPORT_LOSS_MARK) === true)) {
+        return { disposition: 'blocked', detail: `no response reached the suite in ${failed} test(s); first: ${failures[0].message.slice(failures[0].message.indexOf(TRANSPORT_LOSS_MARK)).slice(0, 300)}` };
+    }
     if (failed > 0)
         return { disposition: 'executed-fail', detail: failureDetail(failures, failed) };
     if (states.some((s) => s === 'pass')) {
@@ -381,6 +394,44 @@ document) {
         }
         rows.push(row);
     }
+    // Any-of requirements (RFC 0229 §E): one summary row per group, derived from
+    // its member files. Satisfied only by a WITNESSED pass (assertions > 0) with
+    // no member failing; `inapplicable`/`skipped` members never satisfy it. v1
+    // hand table only, like the prefix groups (the major-2 floors have none).
+    const groups = new Map();
+    //
+    // Only for a CLAIMED profile's floor (2.45.4). The row is `blocked` when no
+    // member was witnessed, and a v1 floor reads `inapplicable` as certifiable, so
+    // the row cannot simply say `inapplicable`. But 2.45.3 wrote it for every
+    // floor in the table: a host that does not advertise secrets records both
+    // members `inapplicable`, got one `blocked` row for a profile it never
+    // claimed, and a bundle with any `blocked` row certifies nothing (RFC 0168
+    // §E.1). A group nobody claims is not a requirement on this host.
+    const claimed = new Set(claimedProfiles.map((p) => DEPRECATED_PROFILE_ALIASES[p] ?? p));
+    if (!v2FloorsActive())
+        for (const [profile, floor] of Object.entries(PROFILE_FLOOR_SCENARIOS))
+            if (claimed.has(profile))
+                for (const g of floor.requiredAnyOf ?? [])
+                    groups.set(requirementIdForAnyOf(g), g);
+    for (const [id, members] of [...groups.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+        const scenarioId = `anyof:${members.join('|')}`;
+        const matching = members.map((f) => perFile.get(f)).filter((r) => r !== undefined);
+        const witnessed = matching.filter((r) => r.disposition === 'executed-pass' && (r.assertionCount ?? 0) > 0);
+        let row;
+        if (matching.some((r) => r.disposition === 'executed-fail')) {
+            row = { requirementId: id, scenarioId, disposition: 'executed-fail', detail: `an alternative failed: ${matching.filter((r) => r.disposition === 'executed-fail').map((r) => r.scenarioId).join(', ')}` };
+        }
+        else if (witnessed.length > 0) {
+            row = { requirementId: id, scenarioId, disposition: 'executed-pass', assertionCount: witnessed.reduce((n, r) => n + (r.assertionCount ?? 0), 0) };
+        }
+        else if (matching.length === 0) {
+            row = { requirementId: id, scenarioId, disposition: 'blocked', detail: `none of ${members.join(', ')} ran — unclassified return` };
+        }
+        else {
+            row = { requirementId: id, scenarioId, disposition: 'blocked', detail: `no alternative recorded a witnessed pass (${matching.map((r) => `${r.scenarioId}: ${r.disposition}`).join(', ')})` };
+        }
+        rows.push(row);
+    }
     // Per-`it` rows (suite 1.153.0): every ledger entry keyed `openwop.it.<file>.<slug>`
     // becomes its own bundle row, attributed to its scenario file. Additive — the
     // file-level and prefix rows above are unchanged, and the floors still key on
@@ -440,7 +491,7 @@ document) {
         const atMajor2 = v2FloorsActive();
         for (const id of ids) {
             const r = rowById.get(id);
-            const fromLedger = byId.has(id) || (r !== undefined && r.scenarioId.endsWith('*'));
+            const fromLedger = byId.has(id) || (r !== undefined && (r.scenarioId.endsWith('*') || r.scenarioId.startsWith('anyof:')));
             if (r !== undefined && r.disposition === 'executed-pass' && (r.assertionCount ?? 0) > 0)
                 witnessedPasses += 1;
             // Unclassified: no row, or a report-derived blocked (nothing recorded), or a

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.2",
-  "stampSha256": "30b580360e19f8ecdc72c058e20bdca2ba5cd054b5c6b98145b4086871ac73de"
+  "version": "2.45.4",
+  "stampSha256": "1b559bef6691e393c6dc1cdd29e661a8bbec495e43529135d56aba30e1d0a704"
 }

package/fixtures/conformance-budget-tool-calls.json

@@ -0,0 +1,81 @@
+{
+  "id": "conformance-budget-tool-calls",
+  "name": "Conformance: Budget (tool calls)",
+  "version": "1.0",
+  "description": "Spends a run budget without a model or a seam. One `core.conformance.mock-agent` node makes three scripted tool calls, so a run created with `budget.maxToolCalls: 2` crosses its threshold on the first call and is exhausted before the third. See v2-budget-enforcement.test.ts.",
+  "nodes": [
+    {
+      "id": "spender",
+      "typeId": "core.conformance.mock-agent",
+      "name": "Budget Spender",
+      "position": {
+        "x": 0,
+        "y": 0
+      },
+      "config": {
+        "mockToolCalls": [
+          {
+            "toolId": "openwop.echo:echo",
+            "arguments": {
+              "x": 1
+            },
+            "result": {
+              "x": 1
+            },
+            "durationMs": 1
+          },
+          {
+            "toolId": "openwop.echo:echo",
+            "arguments": {
+              "x": 2
+            },
+            "result": {
+              "x": 2
+            },
+            "durationMs": 1
+          },
+          {
+            "toolId": "openwop.echo:echo",
+            "arguments": {
+              "x": 3
+            },
+            "result": {
+              "x": 3
+            },
+            "durationMs": 1
+          }
+        ],
+        "mockDecision": {
+          "decision": {
+            "next": "done"
+          },
+          "confidence": 1
+        }
+      },
+      "inputs": {},
+      "agent": {
+        "agentId": "core.conformance.budget-spender",
+        "modelClass": "reasoning"
+      }
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    {
+      "id": "manual",
+      "type": "manual",
+      "enabled": true
+    }
+  ],
+  "variables": [],
+  "metadata": {
+    "tags": [
+      "conformance",
+      "budget",
+      "rfc-0084"
+    ]
+  },
+  "settings": {
+    "timeout": 15000
+  }
+}

package/fixtures/conformance-fs-probe.json

@@ -0,0 +1,25 @@
+{
+  "id": "conformance-fs-probe",
+  "name": "Conformance: v2 fs sandbox probe",
+  "version": "1.0",
+  "description": "Fixture for `v2-fs-sandbox-escape-refused.test.ts` (spec/v2/core/storage.md §`fs`). One node, `core.conformance.fs-probe` (conformance-RESERVED): a host that advertises `fs` maps it to a node that calls its OWN `ctx.fs` with the run's inputs and nothing else. `op: write` calls `write(path, utf8(content), \"text/plain\")` and completes with `outputs.result` = the resolved `{ path, sizeBytes }`; `op: read` calls `read(path)` and completes with `outputs.result = { content }`, the bytes decoded as UTF-8. The node passes `path` through UNCHANGED (no normalisation of its own, so the host's sandbox check is what is exercised). A rejection fails the node with the rejection's code and details, unchanged. Operator contract: `<sandboxRoot>/conformance/escape-link` is a symbolic link to a readable file OUTSIDE the root. A host that does not advertise `fs` MUST NOT advertise this fixture.",
+  "nodes": [
+    {
+      "id": "fs-probe",
+      "typeId": "core.conformance.fs-probe",
+      "name": "Probe ctx.fs",
+      "position": { "x": 0, "y": 0 },
+      "config": {},
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [{ "id": "manual", "type": "manual", "enabled": true }],
+  "variables": [
+    { "name": "op", "type": "string", "defaultValue": "read" },
+    { "name": "path", "type": "string" },
+    { "name": "content", "type": "string" }
+  ],
+  "metadata": { "tags": ["conformance", "storage", "fs", "security"] },
+  "settings": { "timeout": 0 }
+}

package/fixtures/conformance-queue-consume.json

@@ -0,0 +1,27 @@
+{
+  "id": "conformance-queue-consume",
+  "name": "Conformance: Queue Consume",
+  "version": "1.0",
+  "description": "host-services.md §queueBus — node 'consume' (conformance.queue.probe, action 'consume') calls ctx.queueBus.consume on `topic` under the run's own tenant for up to config.waitMs, acks every message it receives, and outputs { consumed: [<payload.message of each, in order>] } — [] when none arrived, never unset. Paired with conformance-queue-publish. See v2-queue-cross-tenant-isolation.test.ts.",
+  "nodes": [
+    {
+      "id": "consume",
+      "typeId": "conformance.queue.probe",
+      "name": "Consume",
+      "position": { "x": 0, "y": 0 },
+      "config": { "action": "consume", "waitMs": 1000 },
+      "inputs": {
+        "topic": { "type": "variable", "variableName": "topic" }
+      }
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    { "name": "topic", "type": "string", "description": "Topic to consume from.", "required": true }
+  ],
+  "metadata": { "tags": ["conformance", "queue", "security"] },
+  "settings": { "timeout": 10000, "maxRetries": 0 }
+}

package/fixtures/conformance-queue-publish.json

@@ -0,0 +1,29 @@
+{
+  "id": "conformance-queue-publish",
+  "name": "Conformance: Queue Publish",
+  "version": "1.0",
+  "description": "host-services.md §queueBus — node 'publish' (conformance.queue.probe, action 'publish') calls ctx.queueBus.publish({ topic, payload: { message } }) under the run's own tenant and outputs { published: true }. Paired with conformance-queue-consume. See v2-queue-cross-tenant-isolation.test.ts.",
+  "nodes": [
+    {
+      "id": "publish",
+      "typeId": "conformance.queue.probe",
+      "name": "Publish",
+      "position": { "x": 0, "y": 0 },
+      "config": { "action": "publish" },
+      "inputs": {
+        "topic": { "type": "variable", "variableName": "topic" },
+        "message": { "type": "variable", "variableName": "message" }
+      }
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    { "name": "topic", "type": "string", "description": "Topic to publish on.", "required": true },
+    { "name": "message", "type": "string", "description": "Opaque message string carried as payload.message.", "required": true }
+  ],
+  "metadata": { "tags": ["conformance", "queue", "security"] },
+  "settings": { "timeout": 10000, "maxRetries": 0 }
+}

package/fixtures/conformance-safefetch-probe.json

@@ -0,0 +1,23 @@
+{
+  "id": "conformance-safefetch-probe",
+  "name": "Conformance: v2 safeFetch SSRF probe",
+  "version": "1.0",
+  "description": "Fixture for `v2-safefetch-ssrf-refused.test.ts` (spec/v2/core/host-services.md §`httpClient`). One node, `core.conformance.safefetch-probe` (conformance-RESERVED): a host that advertises `httpClient.safeFetch` maps it to a node that calls its OWN `ctx.http.safeFetch(url)` with the run's `url` input, unchanged, and nothing else (method GET, no headers, no body). On success it completes with `outputs.result = { status }`, the response status only (never the body, so the fixture is not a read proxy). A rejection fails the node with the rejection's code and details, unchanged (a refused target is `egress_denied`, `details.reason: ssrf-blocked`; an unreachable one `upstream_unavailable`). A host that does not advertise `httpClient.safeFetch` MUST NOT advertise this fixture.",
+  "nodes": [
+    {
+      "id": "safefetch-probe",
+      "typeId": "core.conformance.safefetch-probe",
+      "name": "Probe ctx.http.safeFetch",
+      "position": { "x": 0, "y": 0 },
+      "config": {},
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [{ "id": "manual", "type": "manual", "enabled": true }],
+  "variables": [
+    { "name": "url", "type": "string" }
+  ],
+  "metadata": { "tags": ["conformance", "httpClient", "safeFetch", "ssrf", "security"] },
+  "settings": { "timeout": 0 }
+}

package/fixtures/conformance-secret-resolve-then-fail.json

@@ -0,0 +1,33 @@
+{
+  "id": "conformance-secret-resolve-then-fail",
+  "name": "Conformance: Secret Resolve Then Fail",
+  "version": "1.0",
+  "description": "host-services.md §secrets — node 'resolve-secret' (conformance.secret.echo) resolves the host-provisioned canary 'openwop-conformance-canary-secret' exactly as openwop-smoke-byok-roundtrip does and outputs only {secretSha256, secretLength}; node 'fail' (core.fail) then fails the run. The canary MUST appear on no readable surface of the failed run: snapshot, error, events, or any error envelope. See v2-secret-canary-absent.test.ts.",
+  "nodes": [
+    {
+      "id": "resolve-secret",
+      "typeId": "conformance.secret.echo",
+      "name": "Resolve Canary Secret",
+      "position": { "x": 0, "y": 0 },
+      "config": { "secretId": "openwop-conformance-canary-secret" },
+      "inputs": {}
+    },
+    {
+      "id": "fail",
+      "typeId": "core.fail",
+      "name": "Fail After Resolve",
+      "position": { "x": 200, "y": 0 },
+      "config": { "message": "Intentional failure after resolving the conformance canary" },
+      "inputs": {}
+    }
+  ],
+  "edges": [
+    { "id": "resolve-then-fail", "sourceNodeId": "resolve-secret", "targetNodeId": "fail" }
+  ],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [],
+  "metadata": { "tags": ["conformance", "byok", "secrets", "security"] },
+  "settings": { "timeout": 10000, "maxRetries": 0 }
+}