@openwop/openwop-conformance 2.45.22 → 2.45.23

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.23] — 2026-10-06 — `0184.mint-no-tilde` also mints under the second-tenant credential; RFC 0237 filed
+
+- **Erratum: `host.announce` is a `ui-plugin/1` request method at v2.** The v2 `ui-plugin-message.schema.json` request enum omitted it, although the manifest `hostApi` enum and the `uiPlugins.hostApi` facet admit it (RFC 0130), so a host advertising it had to refuse it at `dispatchUiPluginRequest`. The schema is now hand-owned (no v1 seed marker). Found by openwop-app (ADR 0840).
+- **New `v2-multi-party-council` (RFC 0239).** Gated on `multiPartyConversation` and the advertised `conformance-multi-party-council` fixtures: `conversation.opened` carries the configured roster; resuming the exchange with a non-member `speakerId` is `422 conversation_speaker_not_participant`, unconsumed, and a member's turn then resolves it; with `maxParticipants` below 64 the 64-member oversize fixture is refused at run creation with `422 conversation_roster_exceeded`. Proof: a 9-case self-test double (`lib/council-roster-witness.test.ts`), each defect failing only its leg.
+- **WASM fixture packs and `v2-wasm-memory-cap`.** `conformance/fixtures/wasm-packs/` ships two operator-installed node packs written in WebAssembly text (`build.mjs` assembles them with `wabt`, so no Rust toolchain is needed): `misbehaving-memory` grows memory until the host refuses, `misbehaving-abi` reports ABI version 999. New `v2-wasm-memory-cap` (`openwop.requirement.node-pack-runtimes.wasm-memory-cap`) runs `conformance-wasm-pack-memory-cap-breach` and expects `cap.breached` `kind: wasm-memory` and a `failed` run; proven by a 7-case double. `src/coherence/wasm-fixture-packs.test.ts` instantiates both modules and checks their exports, ABI version, pack name and typeId against their v2 manifests. The ABI-rejection leg is not written: rejection at load has no protocol observation path yet.
+- **New `v2-ui-plugin-boundary` (RFC 0238).** Gated on `uiPlugins.served` and the operator-installed `ui-plugin-pack-narrow` fixture: the frame's `Content-Security-Policy` sandboxes without `allow-same-origin` and denies egress; the dispatch refuses `artifact.write` and `host.navigate` (undeclared) with `method_not_allowed`, does not execute `host.exec`, and runs `artifact.read`; no response carries canary material. The four `frontend-plugin-*` invariants move from `seam-gated` to `witnessable-gated`. Proof: a 12-case self-test double (`lib/ui-plugin-boundary-witness.test.ts`), each defect failing only its leg. The fixture's shape is a corpus check (`src/coherence/ui-plugin-fixtures.test.ts`).
+- **No scenario change.** RFC 0237 (declared nondeterminism names its sources) is filed `Draft`; its gap rows change the packed `spec/v1/gaps.json`.
+
+- **`0184.mint-no-tilde` also mints under `OPENWOP_TEST_TENANT_B_API_KEY`.** A host can bind tenant B to a non-clean tenant, so the leg bites in a production cut without moving the primary key. Asked by openwop-app, whose primary tenant is clean. A refused tenant-B create skips only that half. Proven against a double.
+
+- **New `v2-purpose-propagation-onward` (seam-gated).** The suite hands the host a `permittedPurposes` label through the §22 `invoke` seam (new optional field; the seam is now in `api/seams-v2.yaml`), and its fake A2A peer checks the onward message: re-emitted, never widened, and nothing sent for `[]`. Proven against a double.
+
+- **RFC 0237 Active: new `v2-nondeterminism-sources` (fixture-gated) and the §C legs.** A host listing `nondeterminismPolicy.sources` runs `conformance-nondeterminism` (reserved typeId `core.conformance.nondeterminism`); a `replay` fork from `fromSeq: 0` must reproduce each listed source's output. The two advertisement scenarios fail `declared: false` / `advertised: false`.
+
 ## [2.45.22] — 2026-10-06 — an empty `dataResidency.regions` still binds the reject leg; RFC 0236's registers close
 
 - **No scenario change.** RFC 0236 goes `Accepted` on the v2 reference host's certified 2.45.21 cut; its gaps G1 and G2 close, which changes the packed `spec/v1/gaps.json`.

package/README.md

@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 644 scenario files under `src/scenarios/`.
+The current suite has 649 scenario files under `src/scenarios/`.
 - 2026-09-29 (suite 2.45.0, openwop#1763): NEW `v2-cors-preflight.test.ts` — `headers.md` §Cross-origin preflight. For every operation it preflights with `Origin`, the method, and the operation's declared request headers (plus `authorization` / `content-type` where they apply, from `spec/v2/path-manifest.json`), and reads the answer as the Fetch standard's CORS-preflight check does. Self-gated: `inapplicable` when no operation's preflight grants `OPENWOP_CORS_ORIGIN` (default `https://conformance.invalid`).
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
@@ -482,7 +482,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 644 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 649 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.22",
-  "stampSha256": "ef94915e768fcf83164913c8fcabb237515e2b7538d2ae93bc7dde8ae7ae79ad"
+  "version": "2.45.23",
+  "stampSha256": "e5dd83c74b66bafc57b6581c3f2640da984c25a7700306294d2728dc721e1dfe"
 }

package/fixtures/conformance-multi-party-council-oversize.json

@@ -0,0 +1,244 @@
+{
+  "id": "conformance-multi-party-council-oversize",
+  "name": "Conformance: Multi-Party Council (oversize roster)",
+  "version": "1.0",
+  "description": "RFC 0239 §E.2. The same gate with a 64-member roster. A host advertising multiPartyConversation.maxParticipants below 64 MUST refuse run creation with 422 conversation_roster_exceeded and open no conversation. See v2-multi-party-council.test.ts.",
+  "nodes": [
+    {
+      "id": "convo",
+      "typeId": "core.conversationGate",
+      "name": "Conversation Gate",
+      "position": {
+        "x": 0,
+        "y": 0
+      },
+      "config": {
+        "lifecycle": "open-exchange-close",
+        "mockAutoResume": false,
+        "participants": [
+          {
+            "agentId": "host:conformance-council-01"
+          },
+          {
+            "agentId": "host:conformance-council-02"
+          },
+          {
+            "agentId": "host:conformance-council-03"
+          },
+          {
+            "agentId": "host:conformance-council-04"
+          },
+          {
+            "agentId": "host:conformance-council-05"
+          },
+          {
+            "agentId": "host:conformance-council-06"
+          },
+          {
+            "agentId": "host:conformance-council-07"
+          },
+          {
+            "agentId": "host:conformance-council-08"
+          },
+          {
+            "agentId": "host:conformance-council-09"
+          },
+          {
+            "agentId": "host:conformance-council-10"
+          },
+          {
+            "agentId": "host:conformance-council-11"
+          },
+          {
+            "agentId": "host:conformance-council-12"
+          },
+          {
+            "agentId": "host:conformance-council-13"
+          },
+          {
+            "agentId": "host:conformance-council-14"
+          },
+          {
+            "agentId": "host:conformance-council-15"
+          },
+          {
+            "agentId": "host:conformance-council-16"
+          },
+          {
+            "agentId": "host:conformance-council-17"
+          },
+          {
+            "agentId": "host:conformance-council-18"
+          },
+          {
+            "agentId": "host:conformance-council-19"
+          },
+          {
+            "agentId": "host:conformance-council-20"
+          },
+          {
+            "agentId": "host:conformance-council-21"
+          },
+          {
+            "agentId": "host:conformance-council-22"
+          },
+          {
+            "agentId": "host:conformance-council-23"
+          },
+          {
+            "agentId": "host:conformance-council-24"
+          },
+          {
+            "agentId": "host:conformance-council-25"
+          },
+          {
+            "agentId": "host:conformance-council-26"
+          },
+          {
+            "agentId": "host:conformance-council-27"
+          },
+          {
+            "agentId": "host:conformance-council-28"
+          },
+          {
+            "agentId": "host:conformance-council-29"
+          },
+          {
+            "agentId": "host:conformance-council-30"
+          },
+          {
+            "agentId": "host:conformance-council-31"
+          },
+          {
+            "agentId": "host:conformance-council-32"
+          },
+          {
+            "agentId": "host:conformance-council-33"
+          },
+          {
+            "agentId": "host:conformance-council-34"
+          },
+          {
+            "agentId": "host:conformance-council-35"
+          },
+          {
+            "agentId": "host:conformance-council-36"
+          },
+          {
+            "agentId": "host:conformance-council-37"
+          },
+          {
+            "agentId": "host:conformance-council-38"
+          },
+          {
+            "agentId": "host:conformance-council-39"
+          },
+          {
+            "agentId": "host:conformance-council-40"
+          },
+          {
+            "agentId": "host:conformance-council-41"
+          },
+          {
+            "agentId": "host:conformance-council-42"
+          },
+          {
+            "agentId": "host:conformance-council-43"
+          },
+          {
+            "agentId": "host:conformance-council-44"
+          },
+          {
+            "agentId": "host:conformance-council-45"
+          },
+          {
+            "agentId": "host:conformance-council-46"
+          },
+          {
+            "agentId": "host:conformance-council-47"
+          },
+          {
+            "agentId": "host:conformance-council-48"
+          },
+          {
+            "agentId": "host:conformance-council-49"
+          },
+          {
+            "agentId": "host:conformance-council-50"
+          },
+          {
+            "agentId": "host:conformance-council-51"
+          },
+          {
+            "agentId": "host:conformance-council-52"
+          },
+          {
+            "agentId": "host:conformance-council-53"
+          },
+          {
+            "agentId": "host:conformance-council-54"
+          },
+          {
+            "agentId": "host:conformance-council-55"
+          },
+          {
+            "agentId": "host:conformance-council-56"
+          },
+          {
+            "agentId": "host:conformance-council-57"
+          },
+          {
+            "agentId": "host:conformance-council-58"
+          },
+          {
+            "agentId": "host:conformance-council-59"
+          },
+          {
+            "agentId": "host:conformance-council-60"
+          },
+          {
+            "agentId": "host:conformance-council-61"
+          },
+          {
+            "agentId": "host:conformance-council-62"
+          },
+          {
+            "agentId": "host:conformance-council-63"
+          },
+          {
+            "agentId": "host:conformance-council-64"
+          }
+        ]
+      },
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    {
+      "id": "manual",
+      "type": "manual",
+      "enabled": true
+    }
+  ],
+  "variables": [],
+  "channels": {
+    "conversation": {
+      "schema": {
+        "type": "array"
+      },
+      "reducer": "message"
+    }
+  },
+  "metadata": {
+    "tags": [
+      "conformance",
+      "multi-agent",
+      "conversation",
+      "rfc-0239"
+    ]
+  },
+  "settings": {
+    "timeout": 20000
+  }
+}

package/fixtures/conformance-multi-party-council.json

@@ -0,0 +1,61 @@
+{
+  "id": "conformance-multi-party-council",
+  "name": "Conformance: Multi-Party Council",
+  "version": "1.0",
+  "description": "RFC 0239 §E.1. One core.conversationGate with a three-member roster (host:conformance-council-a/-b/-c) and mockAutoResume false: the run waits on a conversation.exchange interrupt the suite resumes. conversation.opened MUST carry the roster; a turn from a non-member is refused 422 conversation_speaker_not_participant and left unconsumed. See v2-multi-party-council.test.ts.",
+  "nodes": [
+    {
+      "id": "convo",
+      "typeId": "core.conversationGate",
+      "name": "Conversation Gate",
+      "position": {
+        "x": 0,
+        "y": 0
+      },
+      "config": {
+        "lifecycle": "open-exchange-close",
+        "mockAutoResume": false,
+        "participants": [
+          {
+            "agentId": "host:conformance-council-a"
+          },
+          {
+            "agentId": "host:conformance-council-b"
+          },
+          {
+            "agentId": "host:conformance-council-c"
+          }
+        ]
+      },
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    {
+      "id": "manual",
+      "type": "manual",
+      "enabled": true
+    }
+  ],
+  "variables": [],
+  "channels": {
+    "conversation": {
+      "schema": {
+        "type": "array"
+      },
+      "reducer": "message"
+    }
+  },
+  "metadata": {
+    "tags": [
+      "conformance",
+      "multi-agent",
+      "conversation",
+      "rfc-0239"
+    ]
+  },
+  "settings": {
+    "timeout": 20000
+  }
+}

package/fixtures/conformance-nondeterminism.json

@@ -0,0 +1,23 @@
+{
+  "id": "conformance-nondeterminism",
+  "name": "Conformance: Nondeterminism Sources",
+  "version": "1.0",
+  "description": "RFC 0237 §D. One core.conformance.nondeterminism node that draws one value per source the host lists in nondeterminismPolicy.sources into the run outputs. A replay fork MUST reproduce them. See conformance/fixtures.md.",
+  "nodes": [
+    {
+      "id": "draw",
+      "typeId": "core.conformance.nondeterminism",
+      "name": "Draw declared sources",
+      "position": { "x": 0, "y": 0 },
+      "config": {},
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [],
+  "metadata": { "tags": ["conformance"] },
+  "settings": { "timeout": 10000 }
+}

package/fixtures/conformance-wasm-pack-memory-cap-breach.json

@@ -2,22 +2,40 @@
   "id": "conformance-wasm-pack-memory-cap-breach",
   "name": "Conformance: WASM Pack Memory-Cap Breach (Positive Path)",
   "version": "1.0",
-  "description": "RFC 0008 §K fixture. Invokes the deliberately-misbehaving Rust pack (`vendor.openwop.misbehaving.memory-bomb`) which attempts a 1 GiB allocation beyond the host's `memoryPagesMax` ceiling. Hosts MUST trap or terminate the instance and emit `cap.breached` with `kind: 'wasm-memory'`, then terminate the run as `failed`. The misbehaving pack lives at `examples/packs/rust-misbehaving-memory/`; build it with `cargo build --target wasm32-unknown-unknown --release` before running the scenario end-to-end. Fixture-only — the pack is NOT signed for the registry.",
+  "description": "RFC 0008 §K fixture. Invokes `vendor.openwop.misbehaving.memory-bomb`, whose module grows linear memory until the host refuses. A host advertising nodePackRuntimes.wasm.maxMemoryBytes MUST stop it, emit `cap.breached` with `kind: 'wasm-memory'`, and end the run `failed`. The operator installs the pack from `conformance/fixtures/wasm-packs/misbehaving-memory/` (hand-written WebAssembly, no Rust toolchain needed). Fixture-only; not signed for the registry.",
   "nodes": [
     {
       "id": "bomb",
       "typeId": "vendor.openwop.misbehaving.memory-bomb",
       "name": "Memory bomb",
-      "position": { "x": 0, "y": 0 },
+      "position": {
+        "x": 0,
+        "y": 0
+      },
       "config": {},
       "inputs": {}
     }
   ],
   "edges": [],
   "triggers": [
-    { "id": "manual", "type": "manual", "enabled": true }
+    {
+      "id": "manual",
+      "type": "manual",
+      "enabled": true
+    }
   ],
   "variables": [],
-  "metadata": { "tags": ["conformance", "wasm", "node-pack", "rfc-0008", "cap-breach", "misbehaving"] },
-  "settings": { "timeout": 0 }
+  "metadata": {
+    "tags": [
+      "conformance",
+      "wasm",
+      "node-pack",
+      "rfc-0008",
+      "cap-breach",
+      "misbehaving"
+    ]
+  },
+  "settings": {
+    "timeout": 0
+  }
 }

package/fixtures/frontend-plugin-packs/ui/narrow.html

@@ -0,0 +1,4 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>ui-plugin-pack-narrow</title>
+<p>RFC 0238 conformance fixture. It renders nothing and calls only <code>artifact.read</code>.</p>

package/fixtures/frontend-plugin-packs/ui-plugin-pack-narrow.json

@@ -0,0 +1,16 @@
+{
+  "name": "core.openwop.conformance.ui-plugin-narrow",
+  "version": "1.0.0",
+  "kind": "frontend-plugin",
+  "engines": {
+    "openwop": ">=2.0.0 <3.0.0"
+  },
+  "uiPlugins": [
+    {
+      "pluginId": "narrow",
+      "surface": "artifact-viewer",
+      "entry": "ui/narrow.html",
+      "hostApi": ["artifact.read"]
+    }
+  ]
+}

package/fixtures/wasm-packs/build.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+/**
+ * Builds the two operator-installed WASM fixture packs from their WebAssembly
+ * text sources, so no Rust toolchain is needed (RFC 0008 §B exports, hand-written).
+ *
+ *   misbehaving-memory/   `vendor.openwop.misbehaving.memory-bomb` grows linear
+ *                         memory until the host refuses, then traps (RFC 0008 §K;
+ *                         node-pack-runtimes.md §WASM: cap.breached kind wasm-memory).
+ *   misbehaving-abi/      `vendor.openwop.misbehaving.abi-bomb` reports ABI version
+ *                         999, which no host lists, so a conforming host refuses it
+ *                         at load (node-pack-runtimes.md §WASM).
+ *
+ * The built `module.wasm` files are committed. `--check` rebuilds in memory and
+ * fails when a committed binary does not match its source.
+ *
+ *   node conformance/fixtures/wasm-packs/build.mjs [--check]
+ *
+ * Needs the `wabt` package only to build: `npx -y -p wabt@1.0.36 node build.mjs`.
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const check = process.argv.includes('--check');
+const require = createRequire(import.meta.url);
+const wabt = await require('wabt')();
+let bad = 0;
+for (const dir of ['misbehaving-memory', 'misbehaving-abi']) {
+  const src = readFileSync(join(HERE, dir, 'module.wat'), 'utf8');
+  const bin = Buffer.from(wabt.parseWat(`${dir}/module.wat`, src).toBinary({}).buffer);
+  const out = join(HERE, dir, 'module.wasm');
+  if (check) {
+    let committed = Buffer.alloc(0);
+    try { committed = readFileSync(out); } catch { /* missing */ }
+    if (!committed.equals(bin)) { console.error(`${dir}/module.wasm does not match module.wat — run build.mjs`); bad++; }
+  } else {
+    writeFileSync(out, bin);
+    console.log(`wrote ${dir}/module.wasm (${bin.length} bytes)`);
+  }
+}
+process.exit(bad ? 1 : 0);

package/fixtures/wasm-packs/misbehaving-abi/module.wat

@@ -0,0 +1,24 @@
+;; vendor.openwop.misbehaving-abi — reports ABI version 999, which no host lists.
+;; RFC 0008 §B exports, hand-written so no Rust toolchain is needed. Strings are
+;; returned packed as (len << 32) | ptr. Built by ../build.mjs.
+(module
+  (memory (export "memory") 16)
+  (global $heap (mut i32) (i32.const 1120))
+  (data (i32.const 1024) "vendor.openwop.misbehaving-abi")
+  (data (i32.const 1062) "vendor.openwop.misbehaving.abi-bomb")
+  (func (export "openwop_abi_version") (result i32) (i32.const 999))
+  (func (export "openwop_pack_name") (result i64) (i64.or (i64.shl (i64.const 30) (i64.const 32)) (i64.const 1024)))
+  (func (export "openwop_node_count") (result i32) (i32.const 1))
+  (func (export "openwop_node_id_at") (param $i i32) (result i64)
+    (if (result i64) (i32.eqz (local.get $i)) (then (i64.or (i64.shl (i64.const 35) (i64.const 32)) (i64.const 1062))) (else (i64.const 0))))
+  (func (export "openwop_alloc") (param $size i32) (result i32)
+    (local $p i32)
+    (local.set $p (global.get $heap))
+    (global.set $heap (i32.add (global.get $heap) (i32.and (i32.add (local.get $size) (i32.const 15)) (i32.const -16))))
+    (local.get $p))
+  (func (export "openwop_free") (param $ptr i32) (param $size i32))
+  (func (export "openwop_node_invoke") (param $node i32) (param $ptr i32) (param $len i32) (result i64)
+    ;; Never reached: a conforming host refuses the pack at load because ABI
+    ;; version 999 is not in its advertised nodePackRuntimes.wasm.abiVersions.
+    unreachable)
+)

package/fixtures/wasm-packs/misbehaving-abi/pack.json

@@ -0,0 +1,27 @@
+{
+  "kind": "node",
+  "name": "vendor.openwop.misbehaving-abi",
+  "version": "2.0.0",
+  "description": "Conformance fixture, operator-installed only: reports openwop_abi_version 999, which no host lists, so a conforming host refuses it at load (node-pack-runtimes.md \u00a7WASM). Not for registry publication.",
+  "author": "openwop project",
+  "license": "Apache-2.0",
+  "engines": {
+    "openwop": ">=2.0.0 <3.0.0"
+  },
+  "nodes": [
+    {
+      "typeId": "vendor.openwop.misbehaving.abi-bomb",
+      "version": "1.0.0",
+      "category": "data",
+      "role": "transform",
+      "label": "ABI bomb",
+      "description": "Conformance fixture, operator-installed only: reports openwop_abi_version 999, which no host lists, so a conforming host refuses it at load (node-pack-runtimes.md \u00a7WASM). Not for registry publication."
+    }
+  ],
+  "runtime": {
+    "language": "wasm",
+    "entry": "module.wasm",
+    "format": "wasm",
+    "minRuntimeVersion": "1"
+  }
+}

package/fixtures/wasm-packs/misbehaving-memory/module.wat

@@ -0,0 +1,30 @@
+;; vendor.openwop.misbehaving — memory bomb (RFC 0008 §K).
+;; RFC 0008 §B exports, hand-written so no Rust toolchain is needed. Strings are
+;; returned packed as (len << 32) | ptr. Built by ../build.mjs.
+(module
+  (memory (export "memory") 16)
+  (global $heap (mut i32) (i32.const 1104))
+  (data (i32.const 1024) "vendor.openwop.misbehaving")
+  (data (i32.const 1058) "vendor.openwop.misbehaving.memory-bomb")
+  (func (export "openwop_abi_version") (result i32) (i32.const 1))
+  (func (export "openwop_pack_name") (result i64) (i64.or (i64.shl (i64.const 26) (i64.const 32)) (i64.const 1024)))
+  (func (export "openwop_node_count") (result i32) (i32.const 1))
+  (func (export "openwop_node_id_at") (param $i i32) (result i64)
+    (if (result i64) (i32.eqz (local.get $i)) (then (i64.or (i64.shl (i64.const 38) (i64.const 32)) (i64.const 1058))) (else (i64.const 0))))
+  (func (export "openwop_alloc") (param $size i32) (result i32)
+    (local $p i32)
+    (local.set $p (global.get $heap))
+    (global.set $heap (i32.add (global.get $heap) (i32.and (i32.add (local.get $size) (i32.const 15)) (i32.const -16))))
+    (local.get $p))
+  (func (export "openwop_free") (param $ptr i32) (param $size i32))
+  (func (export "openwop_node_invoke") (param $node i32) (param $ptr i32) (param $len i32) (result i64)
+    ;; Grow 1024 pages (64 MiB) at a time until the host refuses (memory.grow
+    ;; returns -1), then trap. A host enforcing maxMemoryBytes refuses at its
+    ;; ceiling; one that does not is stopped only by the wasm32 4 GiB limit,
+    ;; and emits no cap.breached, which the leg catches.
+    (block $refused
+      (loop $grow
+        (br_if $refused (i32.eq (memory.grow (i32.const 1024)) (i32.const -1)))
+        (br $grow)))
+    unreachable)
+)

package/fixtures/wasm-packs/misbehaving-memory/pack.json

@@ -0,0 +1,27 @@
+{
+  "kind": "node",
+  "name": "vendor.openwop.misbehaving",
+  "version": "2.0.0",
+  "description": "Conformance fixture, operator-installed only: grows linear memory until the host refuses, so a host enforcing nodePackRuntimes.wasm.maxMemoryBytes emits cap.breached kind wasm-memory (RFC 0008 \u00a7K). Not for registry publication.",
+  "author": "openwop project",
+  "license": "Apache-2.0",
+  "engines": {
+    "openwop": ">=2.0.0 <3.0.0"
+  },
+  "nodes": [
+    {
+      "typeId": "vendor.openwop.misbehaving.memory-bomb",
+      "version": "1.0.0",
+      "category": "data",
+      "role": "transform",
+      "label": "Memory bomb",
+      "description": "Conformance fixture, operator-installed only: grows linear memory until the host refuses, so a host enforcing nodePackRuntimes.wasm.maxMemoryBytes emits cap.breached kind wasm-memory (RFC 0008 \u00a7K). Not for registry publication."
+    }
+  ],
+  "runtime": {
+    "language": "wasm",
+    "entry": "module.wasm",
+    "format": "wasm",
+    "minRuntimeVersion": "1"
+  }
+}