@openwop/openwop-conformance 2.45.2 → 2.45.4

package/src/lib/scenario-disposition.ts

@@ -27,11 +27,11 @@
  */
 
 import { scenarioFileOfItId } from './requirement-ids.js';
-import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
+import { DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, floorMemberFiles } from './profiles.js';
 import { targetMajor } from './seams.js';
 import { PKG_ROOT_PATH } from './paths.js';
 import { v2ProfileFloorFiles } from './requirement-registry.js';
-import { requirementIdForScenario, requirementIdForPrefix, requirementsFor, v2FloorsActive } from './requirement-registry.js';
+import { requirementIdForScenario, requirementIdForPrefix, requirementIdForAnyOf, requirementsFor, v2FloorsActive } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
 import { CERTIFIABLE, type Disposition, type LedgerEntry } from './requirement-ledger.js';
@@ -39,10 +39,7 @@ import { CERTIFIABLE, type Disposition, type LedgerEntry } from './requirement-l
 /** All scenario basenames that appear in some profile's runtime floor. */
 export function floorScenarioFiles(): ReadonlySet<string> {
   const out = new Set<string>();
-  for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) {
-    for (const f of floor.required) out.add(f);
-    for (const c of floor.conditional ?? []) for (const f of c.required) out.add(f);
-  }
+  for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) for (const f of floorMemberFiles(floor)) out.add(f);
   // At target major 2 the floors come from the declaration, not the v1 hand
   // table. The ledger and --certify MUST agree on this set, or a floor file is
   // minted `openwop.scenario.*` and looked up as `openwop.floor.*` — which is
@@ -77,12 +74,16 @@ export function requirementIdForFile(basename: string): string {
  */
 export const PARTIAL_WITNESS_PREFIX = 'partial-witness: ';
 
+/** `driver.ts`'s `TRANSPORT_LOSS_PREFIX`, restated so this module stays free of the driver (a test pins the two equal). */
+export const TRANSPORT_LOSS_MARK = 'transport-loss: ';
+
 export type FileTestState = 'pass' | 'fail' | 'skip';
 
 /**
  * The per-`it` record (RFC 0148 §A at test granularity), as `setup.ts`
  * computes it in `afterEach`. Pure so a lib test can pin it:
  *   - fail                         ⇒ executed-fail (detail = the first error message)
+ *   - fail on a driver transport loss, 0 assertions ⇒ blocked (#1829: nothing was observed)
  *   - pass with ≥ 1 assertion      ⇒ executed-pass
  *   - a behaviorGate entry journaled during the test ⇒ that gate's disposition
  *   - pass with 0 assertions       ⇒ the softSkip note written DURING THIS TEST
@@ -122,6 +123,15 @@ export function resolveItRecord(
   testName?: string,
 ): { disposition: Disposition; detail?: string } {
   if (state === 'fail') {
+    // #1829: the driver got no response (`TransportError`) before the test
+    // asserted anything. Nothing about the host was observed, so this is not a
+    // verdict on it. `blocked` still denies certification, so a flaky runner
+    // cannot certify; it just cannot convict the host either. A loss AFTER an
+    // assertion stays `executed-fail`: the test was mid-measurement, and a host
+    // that stops answering part-way is a finding.
+    if (assertionCalls === 0 && firstError !== undefined && firstError.includes(TRANSPORT_LOSS_MARK)) {
+      return { disposition: 'blocked', detail: firstError.slice(firstError.indexOf(TRANSPORT_LOSS_MARK), firstError.indexOf(TRANSPORT_LOSS_MARK) + 300) };
+    }
     const where = testName === undefined || testName.trim() === '' ? '' : ` in "${testName.slice(0, 120)}"`;
     return { disposition: 'executed-fail', detail: `the test executed and failed${where}: ${(firstError ?? 'no message').slice(0, 300)}` };
   }
@@ -225,6 +235,11 @@ export function fileDisposition(
   failures: readonly TestFailure[] = [],
 ): { disposition: Disposition; detail?: string } {
   const failed = states.filter((s) => s === 'fail').length;
+  // #1829, the file-level half of `resolveItRecord`'s rule: every failure was a
+  // driver transport loss and the file asserted nothing, so nothing was observed.
+  if (failed > 0 && assertionCount === 0 && failures.length === failed && failures.every((f) => f.message?.includes(TRANSPORT_LOSS_MARK) === true)) {
+    return { disposition: 'blocked', detail: `no response reached the suite in ${failed} test(s); first: ${failures[0]!.message!.slice(failures[0]!.message!.indexOf(TRANSPORT_LOSS_MARK)).slice(0, 300)}` };
+  }
   if (failed > 0) return { disposition: 'executed-fail', detail: failureDetail(failures, failed) };
   if (states.some((s) => s === 'pass')) {
     // A test that early-returned through `behaviorGate` is reported by vitest
@@ -458,6 +473,38 @@ export function deriveRequirementDispositions(
     rows.push(row);
   }
 
+  // Any-of requirements (RFC 0229 §E): one summary row per group, derived from
+  // its member files. Satisfied only by a WITNESSED pass (assertions > 0) with
+  // no member failing; `inapplicable`/`skipped` members never satisfy it. v1
+  // hand table only, like the prefix groups (the major-2 floors have none).
+  const groups = new Map<string, readonly string[]>();
+  //
+  // Only for a CLAIMED profile's floor (2.45.4). The row is `blocked` when no
+  // member was witnessed, and a v1 floor reads `inapplicable` as certifiable, so
+  // the row cannot simply say `inapplicable`. But 2.45.3 wrote it for every
+  // floor in the table: a host that does not advertise secrets records both
+  // members `inapplicable`, got one `blocked` row for a profile it never
+  // claimed, and a bundle with any `blocked` row certifies nothing (RFC 0168
+  // §E.1). A group nobody claims is not a requirement on this host.
+  const claimed = new Set(claimedProfiles.map((p) => DEPRECATED_PROFILE_ALIASES[p] ?? p));
+  if (!v2FloorsActive()) for (const [profile, floor] of Object.entries(PROFILE_FLOOR_SCENARIOS)) if (claimed.has(profile)) for (const g of floor.requiredAnyOf ?? []) groups.set(requirementIdForAnyOf(g), g);
+  for (const [id, members] of [...groups.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    const scenarioId = `anyof:${members.join('|')}`;
+    const matching = members.map((f) => perFile.get(f)).filter((r): r is DerivedRequirement => r !== undefined);
+    const witnessed = matching.filter((r) => r.disposition === 'executed-pass' && (r.assertionCount ?? 0) > 0);
+    let row: DerivedRequirement;
+    if (matching.some((r) => r.disposition === 'executed-fail')) {
+      row = { requirementId: id, scenarioId, disposition: 'executed-fail', detail: `an alternative failed: ${matching.filter((r) => r.disposition === 'executed-fail').map((r) => r.scenarioId).join(', ')}` };
+    } else if (witnessed.length > 0) {
+      row = { requirementId: id, scenarioId, disposition: 'executed-pass', assertionCount: witnessed.reduce((n, r) => n + (r.assertionCount ?? 0), 0) };
+    } else if (matching.length === 0) {
+      row = { requirementId: id, scenarioId, disposition: 'blocked', detail: `none of ${members.join(', ')} ran — unclassified return` };
+    } else {
+      row = { requirementId: id, scenarioId, disposition: 'blocked', detail: `no alternative recorded a witnessed pass (${matching.map((r) => `${r.scenarioId}: ${r.disposition}`).join(', ')})` };
+    }
+    rows.push(row);
+  }
+
   // Per-`it` rows (suite 1.153.0): every ledger entry keyed `openwop.it.<file>.<slug>`
   // becomes its own bundle row, attributed to its scenario file. Additive — the
   // file-level and prefix rows above are unchanged, and the floors still key on
@@ -513,7 +560,7 @@ export function deriveRequirementDispositions(
     const atMajor2 = v2FloorsActive();
     for (const id of ids) {
       const r = rowById.get(id);
-      const fromLedger = byId.has(id) || (r !== undefined && r.scenarioId.endsWith('*'));
+      const fromLedger = byId.has(id) || (r !== undefined && (r.scenarioId.endsWith('*') || r.scenarioId.startsWith('anyof:')));
       if (r !== undefined && r.disposition === 'executed-pass' && (r.assertionCount ?? 0) > 0) witnessedPasses += 1;
       // Unclassified: no row, or a report-derived blocked (nothing recorded), or a
       // VACUOUS pass — executed-pass with assertionCount 0 is a witness of nothing

package/src/lib/scratch-host.ts

@@ -0,0 +1,130 @@
+/**
+ * A scratch host: the smallest HTTP server a shared witness can be proven
+ * against, in both directions, inside the suite's own self-tests.
+ *
+ * Some families are advertised by no reference host, so a new witness for them
+ * cannot be sabotage-proved against a real one. A witness that was never seen
+ * to fail is not a witness. The scratch host serves a discovery document and a
+ * scripted run surface, and each self-test turns on ONE defect to show the
+ * witness convicts it.
+ *
+ * It is a test double, not a host: it executes nothing, and nothing it does is
+ * evidence about any implementation. It takes a {@link MajorProfile}, so the
+ * same double proves the next major's port.
+ */
+
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import type { MajorProfile } from './major-profile.js';
+
+export interface ScriptedEvent { readonly type: string; readonly payload?: Record<string, unknown> | undefined }
+export interface ScriptedRun {
+  readonly status: 'completed' | 'failed' | 'running';
+  readonly error?: { readonly code: string; readonly message: string };
+  readonly events: readonly ScriptedEvent[];
+}
+export interface ScratchRefusal {
+  readonly status: number;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly body: Record<string, unknown>;
+}
+export interface ScratchOptions {
+  readonly profile: MajorProfile;
+  /** The discovery document, served as given. */
+  readonly discovery: Readonly<Record<string, unknown>>;
+  /** What a created run looks like, by workflowId and request body. Default: an empty running run. */
+  readonly script?: ((workflowId: string, body: Readonly<Record<string, unknown>>) => ScriptedRun) | undefined;
+  /** Concurrent in-flight requests admitted before {@link refusal} answers. Unset: no cap. */
+  readonly inflightCap?: number | undefined;
+  readonly refusal?: ScratchRefusal | undefined;
+}
+
+interface StoredRun { readonly id: string; run: ScriptedRun }
+
+export class ScratchHost {
+  private server: Server | undefined;
+  private readonly runs = new Map<string, StoredRun>();
+  private inflight = 0;
+  private seq = 0;
+  url = '';
+
+  constructor(private opts: ScratchOptions) {}
+
+  /** Swap behaviour between cases. The address stays the same, since the driver caches its base URL per file. */
+  reconfigure(next: Partial<ScratchOptions>): void {
+    this.opts = { ...this.opts, ...next };
+    this.runs.clear();
+  }
+
+  async start(): Promise<string> {
+    this.server = createServer((req, res) => { void this.handle(req, res); });
+    await new Promise<void>((r) => this.server!.listen(0, '127.0.0.1', r));
+    this.url = `http://127.0.0.1:${(this.server.address() as AddressInfo).port}`;
+    return this.url;
+  }
+
+  async stop(): Promise<void> {
+    const s = this.server;
+    if (s === undefined) return;
+    s.closeAllConnections();
+    await new Promise<void>((r) => s.close(() => r()));
+  }
+
+  private send(res: ServerResponse, status: number, body: unknown, headers: Readonly<Record<string, string>> = {}): void {
+    res.writeHead(status, { 'content-type': 'application/json', ...headers });
+    res.end(JSON.stringify(body));
+  }
+
+  private async body(req: IncomingMessage): Promise<Record<string, unknown>> {
+    const chunks: Buffer[] = [];
+    for await (const c of req) chunks.push(c as Buffer);
+    try {
+      const v: unknown = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+      return v !== null && typeof v === 'object' && !Array.isArray(v) ? (v as Record<string, unknown>) : {};
+    } catch { return {}; }
+  }
+
+  private async handle(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    const path = (req.url ?? '/').split('?')[0] ?? '/';
+    const runs = this.opts.profile.runsPath;
+    // Discovery is never counted against the cap.
+    if (req.method === 'GET' && path === '/.well-known/openwop') return this.send(res, 200, this.opts.discovery);
+
+    const cap = this.opts.inflightCap;
+    if (cap !== undefined && this.inflight >= cap) {
+      const r = this.opts.refusal ?? { status: 503, headers: { 'retry-after': '1' }, body: { error: 'service_unavailable', message: 'at capacity' } };
+      return this.send(res, r.status, r.body, r.headers);
+    }
+    this.inflight++;
+    res.on('close', () => { this.inflight--; });
+
+    if (req.method === 'POST' && path === runs) {
+      const body = await this.body(req);
+      const workflowId = String(body['workflowId'] ?? '');
+      const id = `scratch/run-${++this.seq}`;
+      this.runs.set(id, { id, run: this.opts.script?.(workflowId, body) ?? { status: 'running', events: [] } });
+      return this.send(res, 201, { runId: id, status: 'running' });
+    }
+    if (req.method === 'POST' && path === `${runs}:bulk-cancel`) return this.send(res, 200, { results: [] });
+
+    const m = new RegExp(`^${runs}/([^/]+)(/events/poll|/events|/cancel)?$`).exec(path);
+    const stored = m ? this.runs.get(decodeURIComponent(m[1] as string)) : undefined;
+    if (!m || stored === undefined) return this.send(res, 404, { error: 'not_found', message: 'no such route or run' });
+    const tail = m[2];
+    if (tail === '/cancel') return this.send(res, 200, { status: 'cancelled' });
+    if (tail === '/events') {
+      // Held open until the client aborts: this is what occupies a slot.
+      res.writeHead(200, { 'content-type': 'text/event-stream' });
+      res.write(': held\n\n');
+      return;
+    }
+    if (tail === '/events/poll') {
+      const after = Number(new URL(req.url ?? '/', 'http://x').searchParams.get('afterSequence') ?? '0');
+      const events = stored.run.events
+        .map((e, i) => ({ eventId: `e${i + 1}`, runId: stored.id, type: e.type, payload: e.payload ?? {}, sequence: i + 1, schemaVersion: 2, timestamp: new Date(0).toISOString() }))
+        .filter((e) => e.sequence > after);
+      return this.send(res, 200, { events });
+    }
+    return this.send(res, 200, { runId: stored.id, workflowId: 'scratch', status: stored.run.status, ...(stored.run.error === undefined ? {} : { error: stored.run.error }) });
+  }
+}

package/src/lib/secret-scan.ts

@@ -0,0 +1,141 @@
+/**
+ * Find a resolved secret on a readable surface — `host-services.md` §`secrets`:
+ * "Raw key material MUST NOT appear in any event, log, trace, prompt, error,
+ * export or screenshot".
+ *
+ * Two detectors, because the suite does not always know the secret:
+ *
+ *   - **value** — the operator told the runner the canary's plaintext
+ *     (`OPENWOP_CANARY_SECRET_VALUE`, the same agreement
+ *     `secret-leakage-otel-attribute` uses). The text is searched for the value
+ *     in every common encoding: raw, JSON-string-escaped, percent-encoded,
+ *     standard and URL-safe base64 with and without padding, lower- and
+ *     upper-case hex.
+ *   - **digest** — the runner does not know the value, but the
+ *     `openwop-smoke-byok-roundtrip` node surfaced `{secretSha256,
+ *     secretLength}` (fixtures.md). Every window of `secretLength` bytes in
+ *     every string of the surface — and in every base64 / hex / percent-decoded
+ *     token inside it — is hashed and compared with the digest. A match is a
+ *     preimage of the secret's digest on the surface: the secret itself.
+ *
+ * The digest itself is NOT a finding here: the byok fixture's contract emits it
+ * (fixtures.md §`openwop-smoke-byok-roundtrip`). RFC 0229's run witness, which
+ * forbids a digest, owns that stricter rule for the values it supplies.
+ */
+
+import { createHash } from 'node:crypto';
+
+export interface SecretDetector {
+  /** What the detector knows, for the failure message — never the secret. */
+  readonly label: string;
+  /** The encoding in which the secret was found in `text`, or null. */
+  find(text: string): string | null;
+}
+
+/** Upper bound on hashed window positions per surface, so a huge body cannot stall a leg. */
+const MAX_WINDOWS = 4_000_000;
+
+function b64(buf: Buffer): string { return buf.toString('base64'); }
+function b64url(buf: Buffer): string { return b64(buf).replace(/\+/g, '-').replace(/\//g, '_'); }
+
+/** The known-value detector. `value` MUST be non-empty. */
+export function valueDetector(value: string): SecretDetector {
+  const bytes = Buffer.from(value, 'utf8');
+  const forms: Array<[string, string]> = [
+    ['raw', value],
+    ['JSON-string-escaped', JSON.stringify(value).slice(1, -1)],
+    ['percent-encoded', encodeURIComponent(value)],
+    ['base64', b64(bytes)],
+    ['base64 (unpadded)', b64(bytes).replace(/=+$/, '')],
+    ['base64url', b64url(bytes)],
+    ['base64url (unpadded)', b64url(bytes).replace(/=+$/, '')],
+    ['hex', bytes.toString('hex')],
+    ['HEX', bytes.toString('hex').toUpperCase()],
+  ];
+  return {
+    label: `the operator-supplied canary value (OPENWOP_CANARY_SECRET_VALUE, ${bytes.length} bytes)`,
+    find(text) {
+      for (const [name, form] of forms) if (form.length > 0 && text.includes(form)) return name;
+      return null;
+    },
+  };
+}
+
+/** Every string (keys and values) of a parsed JSON document; the raw text when it is not JSON. */
+function stringsOf(text: string): string[] {
+  let doc: unknown;
+  try { doc = JSON.parse(text); } catch { return [text]; }
+  const out: string[] = [];
+  const walk = (v: unknown): void => {
+    if (typeof v === 'string') out.push(v);
+    else if (Array.isArray(v)) v.forEach(walk);
+    else if (v !== null && typeof v === 'object') for (const [k, x] of Object.entries(v as Record<string, unknown>)) { out.push(k); walk(x); }
+  };
+  walk(doc);
+  return out;
+}
+
+/** The byte sequences a string can carry the secret in: itself, and its decodable tokens. */
+function candidatesOf(s: string, minBytes: number): Array<[string, Buffer]> {
+  const out: Array<[string, Buffer]> = [['raw', Buffer.from(s, 'utf8')]];
+  if (s.includes('%')) { try { out.push(['percent-decoded', Buffer.from(decodeURIComponent(s), 'utf8')]); } catch { /* not percent-encoded */ } }
+  const minB64 = Math.max(4, Math.floor((minBytes * 4) / 3));
+  for (const tok of s.match(new RegExp(`[A-Za-z0-9+/_-]{${minB64},}={0,2}`, 'g')) ?? []) {
+    const buf = Buffer.from(tok.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+    if (buf.length >= minBytes) out.push(['base64-decoded', buf]);
+  }
+  for (const tok of s.match(new RegExp(`(?:[0-9a-fA-F]{2}){${minBytes},}`, 'g')) ?? []) out.push(['hex-decoded', Buffer.from(tok, 'hex')]);
+  return out;
+}
+
+/** The digest detector: a preimage of `sha256Hex` of exactly `length` bytes anywhere on the surface. */
+export function digestDetector(sha256Hex: string, length: number): SecretDetector {
+  const want = sha256Hex.toLowerCase();
+  return {
+    label: `a preimage of the secretSha256 the byok fixture surfaced (${length}-byte windows)`,
+    find(text) {
+      let budget = MAX_WINDOWS;
+      for (const s of stringsOf(text)) {
+        if (Buffer.byteLength(s, 'utf8') < length) continue; // no encoding makes a string longer than its decoding
+        for (const [enc, buf] of candidatesOf(s, length)) {
+          for (let i = 0; i + length <= buf.length; i += 1) {
+            if (budget-- <= 0) return null;
+            if (createHash('sha256').update(buf.subarray(i, i + length)).digest('hex') === want) return enc;
+          }
+        }
+      }
+      return null;
+    },
+  };
+}
+
+/** A named readable surface of a run, as the host answered it. */
+export interface Surface { readonly name: string; readonly text: string }
+
+/** The surfaces (by name) on which any detector finds the secret, with the encoding. */
+export function leaks(surfaces: readonly Surface[], detectors: readonly SecretDetector[]): string[] {
+  const out: string[] = [];
+  for (const s of surfaces) {
+    for (const d of detectors) {
+      const enc = d.find(s.text);
+      if (enc !== null) { out.push(`${s.name} (${enc}, found by ${d.label})`); break; }
+    }
+  }
+  return out;
+}
+
+/** `{secretSha256, secretLength}` wherever a surface carries it (the byok node's outputs), or null. */
+export function findSecretDigest(docs: readonly unknown[]): { sha256: string; length: number } | null {
+  let hit: { sha256: string; length: number } | null = null;
+  const walk = (v: unknown): void => {
+    if (hit !== null || v === null || typeof v !== 'object') return;
+    if (Array.isArray(v)) { v.forEach(walk); return; }
+    const o = v as Record<string, unknown>;
+    const sha = o['secretSha256'];
+    const len = o['secretLength'];
+    if (typeof sha === 'string' && /^[0-9a-f]{64}$/i.test(sha) && typeof len === 'number' && Number.isInteger(len) && len > 0) { hit = { sha256: sha, length: len }; return; }
+    Object.values(o).forEach(walk);
+  };
+  docs.forEach(walk);
+  return hit;
+}

package/src/lib/timeout-scale.ts

@@ -0,0 +1,25 @@
+/**
+ * The `OPENWOP_POLL_TIMEOUT_SCALE` knob, in its own module so `driver.ts` can
+ * scale its request bound without importing `polling.ts` (which imports the
+ * driver). `polling.ts` re-exports `scaledTimeoutMs`; its docstring explains
+ * the knob.
+ */
+
+/**
+ * Multiplier applied to every poll bound (see the module docstring). Invalid,
+ * non-positive, or non-finite values fall back to `1` rather than silently
+ * producing a zero or negative deadline — a mis-set knob must not turn every
+ * poll into an instant failure that looks like a host defect.
+ */
+function pollTimeoutScale(): number {
+  const raw = process.env.OPENWOP_POLL_TIMEOUT_SCALE;
+  if (raw === undefined || raw === '') return 1;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : 1;
+}
+
+/** Apply the scale to a bound, rounding up so a scale of 1 is exactly a no-op. */
+export function scaledTimeoutMs(timeoutMs: number): number {
+  const scale = pollTimeoutScale();
+  return scale === 1 ? timeoutMs : Math.ceil(timeoutMs * scale);
+}

package/src/lib/triggerBridge.ts

@@ -20,7 +20,7 @@
  * @see spec/v1/trigger-bridge.md
  * @see spec/v1/profiles.md (§openwop-trigger-bridge)
  */
-import { randomBytes, randomInt } from 'node:crypto';
+import { createHmac, randomBytes, randomInt } from 'node:crypto';
 import { driver } from './driver.js';
 import { deriveProfiles, type DiscoveryPayload } from './profiles.js';
 
@@ -121,3 +121,71 @@ export function freshStreamDedupKey(topic = 'events', partition = 3): string {
 
 export const SUBSCRIPTION_STATES = ['active', 'paused', 'failed', 'dead-lettered'];
 export const DELIVERY_OUTCOMES = ['delivered', 'retrying', 'dead-lettered'];
+
+// ---------------------------------------------------------------------------
+// RFC 0230 — the normative-surface (seam-free) ingest path.
+// ---------------------------------------------------------------------------
+
+/** Does discovery advertise `triggerBridge.ingestion.inboundSigning` ∋ `standard-webhooks-1`? */
+export async function inboundSigningAdvertised(): Promise<boolean> {
+  const disco = await driver.get('/.well-known/openwop');
+  if (disco.status !== 200 || !disco.json) return false;
+  const d = disco.json as Record<string, any>;
+  const tb = d.triggerBridge ?? d.capabilities?.triggerBridge;
+  const s = tb?.ingestion?.inboundSigning;
+  return Array.isArray(s) && s.includes('standard-webhooks-1');
+}
+
+export interface SignedWebhookSubscription {
+  subscriptionId: string;
+  ingestUrl: string;
+  signingSecret: string;
+}
+
+/**
+ * Register a `webhook` subscription bound to the `conformance-noop` fixture
+ * (RFC 0230 §B). Returns null (with a reason) when the registration does not
+ * yield the §B binding — the caller records that as a host defect, not a skip.
+ */
+export async function registerSignedWebhook(mode: 'none' | 'required'): Promise<SignedWebhookSubscription | { reason: string }> {
+  const res = await driver.post('/v1/trigger-subscriptions', { source: 'webhook', workflowId: 'conformance-noop', verification: { mode } });
+  const body = res.json as { subscription?: { subscriptionId?: string }; binding?: { ingestUrl?: string; signingSecret?: string } } | undefined;
+  const subscriptionId = body?.subscription?.subscriptionId;
+  const ingestUrl = body?.binding?.ingestUrl;
+  const signingSecret = body?.binding?.signingSecret;
+  if (res.status !== 201 || !subscriptionId || !ingestUrl || !signingSecret) {
+    return { reason: `POST /v1/trigger-subscriptions answered ${res.status} without the RFC 0230 §B binding (subscriptionId, ingestUrl, signingSecret)` };
+  }
+  return { subscriptionId, ingestUrl, signingSecret };
+}
+
+/** A Standard Webhooks `webhook-id` (RFC 0201 grammar). */
+export function freshWebhookId(): string {
+  return `msg_${randomBytes(12).toString('hex')}`;
+}
+
+/** `v1,<base64 HMAC-SHA256(key, "{id}.{ts}.{body}")>`, key = base64-decode after `whsec_`. */
+export function standardWebhooksSignature(secret: string, id: string, ts: string, body: string): string {
+  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
+  return `v1,${createHmac('sha256', key).update(`${id}.${ts}.${body}`).digest('base64')}`;
+}
+
+/**
+ * POST a raw body to `ingestUrl` with NO OpenWOP credential and the three
+ * Standard Webhooks headers (RFC 0230 §C). `signature` overrides the computed one
+ * (a bad-signature probe); `timestamp` overrides the current second (a skew probe).
+ */
+export async function signedIngest(
+  sub: SignedWebhookSubscription,
+  body: string,
+  opts: { webhookId?: string; timestamp?: string; signature?: string } = {},
+): Promise<{ status: number; json: Record<string, unknown> | undefined }> {
+  const id = opts.webhookId ?? freshWebhookId();
+  const ts = opts.timestamp ?? String(Math.floor(Date.now() / 1000));
+  const sig = opts.signature ?? standardWebhooksSignature(sub.signingSecret, id, ts, body);
+  const res = await driver.post(sub.ingestUrl, body, {
+    authenticated: false,
+    headers: { 'Content-Type': 'application/json', 'webhook-id': id, 'webhook-timestamp': ts, 'webhook-signature': sig },
+  });
+  return { status: res.status, json: res.json as Record<string, unknown> | undefined };
+}

package/src/scenarios/byok-roundtrip.test.ts

@@ -9,7 +9,8 @@
  * This is a FLOOR scenario (`openwop.floor.byok-roundtrip`), so a host that
  * cannot run it has NOT witnessed the floor. When the canary fixture is not
  * advertised, or the start-run call answers 404/422, every test records
- * `blocked` with the reason — never a trivial pass. A production posture that
+ * `blocked` with the reason — never a trivial pass (unless the host takes the
+ * RFC 0229 run-witness floor path instead: then `inapplicable`). A production posture that
  * keeps the `conformance.secret.echo` seam off therefore leaves its claimed
  * `openwop-secrets` profile uncertified, and only that profile: the cut's
  * other claims still certify. Hosts that opt into `OPENWOP_CONFORMANCE_FIXTURES=1`
@@ -39,6 +40,7 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip } from '../lib/soft-skip.js';
+import { WITNESS_FIXTURE, WitnessHost } from '../lib/run-secrets-witness.js';
 
 /** SHA-256 hex regex — 64 lowercase hex chars exactly. */
 const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
@@ -47,9 +49,23 @@ const BYOK_WORKFLOW_ID = 'openwop-smoke-byok-roundtrip';
 const SKIP_NO_FIXTURE = !isFixtureAdvertised(BYOK_WORKFLOW_ID);
 const NO_FIXTURE_REASON = `precondition not met — the \`${BYOK_WORKFLOW_ID}\` fixture is not advertised, so this host cannot witness the BYOK roundtrip floor (the \`conformance.secret.echo\` seam and the \`openwop-conformance-canary-secret\` canary are off)`;
 
+/**
+ * RFC 0229 §E: `openwop-secrets` has a second floor path, `secrets-run-witness`.
+ * A host that withholds the canary but advertises `secrets.runSecrets` and the
+ * `openwop-secrets-run-witness` fixture takes that path, so this file is
+ * `inapplicable` on it, not `blocked` — a `blocked` row would deny the whole
+ * bundle (RFC 0168 §E.1) for a floor the host satisfies the other way.
+ */
+async function noFixture(): Promise<undefined> {
+  if (isFixtureAdvertised(WITNESS_FIXTURE) && (await new WitnessHost(1).gate()).ok) {
+    return softSkip('inapplicable', `the \`${BYOK_WORKFLOW_ID}\` fixture is withheld and the host takes the run-witness floor path instead (secrets.runSecrets and \`${WITNESS_FIXTURE}\` are advertised; RFC 0229 §E, profiles.md §openwop-secrets)`);
+  }
+  return softSkip('blocked', NO_FIXTURE_REASON);
+}
+
 describe('byok: end-to-end credentialRef resolution roundtrip (openwop-byok profile)', () => {
   it('the canary fixture run MUST resolve a host-provisioned secret and emit SHA-256 hex', async () => {
-    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
+    if (SKIP_NO_FIXTURE) return noFixture();
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });
@@ -114,7 +130,7 @@ describe('byok: end-to-end credentialRef resolution roundtrip (openwop-byok prof
   });
 
   it('BYOK fixture run MUST emit a node.completed event for the resolve step', async () => {
-    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
+    if (SKIP_NO_FIXTURE) return noFixture();
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });
@@ -141,7 +157,7 @@ describe('byok: end-to-end credentialRef resolution roundtrip (openwop-byok prof
   });
 
   it('BYOK fixture run event log MUST NOT echo the resolved secret value (redaction)', async () => {
-    if (SKIP_NO_FIXTURE) return softSkip('blocked', NO_FIXTURE_REASON);
+    if (SKIP_NO_FIXTURE) return noFixture();
     const create = await driver.post('/v1/runs', {
       workflowId: 'openwop-smoke-byok-roundtrip',
     });

package/src/scenarios/runner-ledger.test.ts

@@ -135,6 +135,8 @@ describe('RFC 0148 §A (S6) — the runner derivation', () => {
       expect(p.disposition).toBe('executed-pass');
       expect(p.scenarioId).toBe(`${prefix}*`);
     }
+    // An any-of group's summary row is written only for a claimed profile's floor
+    // (2.45.4), so this floor's rows are all there is and every one passed.
     expect(d.totals.executedPass).toBe(d.requirements.length);
   });