@openwop/openwop-conformance 2.45.22 → 2.45.24

package/src/scenarios/v2-bound-id-path-projection.test.ts

@@ -38,6 +38,11 @@
  * harness (`conformance/run.ts`) overwrites `OPENWOP_API_KEYS` with a `:*` key, so
  * moving the tenant needs that line edited, not just the env var.
  *
+ * Since 2.45.23 the leg also mints one run under `OPENWOP_TEST_TENANT_B_API_KEY`
+ * when it is set, so a host can bind tenant B to a non-clean tenant and make the
+ * leg bite in a production cut without moving the primary key (asked by
+ * openwop-app, whose primary production tenant is clean).
+ *
  * The codec's own edge cases (marker escaping, UTF-8 vs UTF-16, malformed
  * decode) are a unit concern and live in `src/lib/bound-id.test.ts`, which is
  * sabotage-checked. This file asserts only what needs a HOST to answer.
@@ -166,5 +171,20 @@ describe('v2 bound-id path projection (identity.md §5)', () => {
       runId.includes('~'),
       req(ID_MINT, DOC, `a host MUST NOT mint a tenant-bound id containing ~ (RFC 0184 §A.2) — the created runId is ${runId}. A literal ~ is ambiguous with the path projection's escape marker; map the tenant key to a clean segment instead of projecting it`),
     ).toBe(false);
+
+    // The second-tenant credential, when configured, mints one more run, so a
+    // host can put tenant B in a non-clean tenant without moving the primary key
+    // every other scenario depends on. A refused create here skips only this half.
+    const other = process.env['OPENWOP_TEST_TENANT_B_API_KEY']?.trim();
+    if (other && other !== process.env['OPENWOP_API_KEY']?.trim()) {
+      const createdB = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }, { headers: { Authorization: `Bearer ${other}` } }));
+      const runIdB = (createdB?.json as { runId?: unknown } | null | undefined)?.runId;
+      if (createdB?.status === 201 && typeof runIdB === 'string') {
+        expect(
+          runIdB.includes('~'),
+          req(ID_MINT, DOC, `a host MUST NOT mint a tenant-bound id containing ~ (RFC 0184 §A.2) — the runId created under the second-tenant credential is ${runIdB}`),
+        ).toBe(false);
+      }
+    }
   });
 });

package/src/scenarios/v2-envelope-contracts-advertisement.test.ts

@@ -37,4 +37,12 @@ describe('v2 envelopeContracts advertisement (events.md §Envelope contracts)',
     if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
     for (const x of out.findings) expect(x.ok, req(ID_RECORD, x.doc, x.message)).toBe(true);
   });
+
+  it('envelopeContracts.advertised is not false: a host that does not offer the family omits it', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const rec = await familyAdvertised('envelopeContracts');
+    if (!rec) return softSkip('inapplicable', 'the host does not advertise envelopeContracts');
+    expect(rec['advertised'], req('openwop.requirement.0237.no-false-advertisement', 'RFC 0237 §C; capabilities.md §2', 'envelopeContracts.advertised: false is not a v2 state; a host that does not offer the family MUST omit it')).not.toBe(false);
+  });
 });

package/src/scenarios/v2-multi-party-council.test.ts

@@ -0,0 +1,56 @@
+/**
+ * v2 — a council's roster has an input seat and its refusals have codes
+ * (RFC 0239; `spec/v2/core/conversation.md` §multiPartyConversation). Gated on
+ * `multiPartyConversation` and the advertised council fixtures.
+ *
+ * The three roster MUSTs were witnessed only by the v1 seam
+ * `/v1/host/sample/conversation/multi-party/*`. Here every leg uses normative
+ * operations: run creation, the snapshot and event poll, and `resolveInterrupt`.
+ *
+ *   roster-carried    `conversation.opened.participants` equals the
+ *                     `core.conversationGate` roster of `conformance-multi-party-council`;
+ *   speaker-refused   resuming the exchange with a non-member `speakerId` is
+ *                     `422 conversation_speaker_not_participant`, unconsumed (the run
+ *                     still waits, no `conversation.exchanged`); a member's turn then
+ *                     resolves it (the control);
+ *   roster-exceeded   with `maxParticipants` below 64, creating a run of
+ *                     `conformance-multi-party-council-oversize` is
+ *                     `422 conversation_roster_exceeded`.
+ *
+ * The legs live in `lib/council-roster-witness.ts`, proven against a double in
+ * `lib/council-roster-witness.test.ts`.
+ *
+ * Dispositions: no `multiPartyConversation`, or the fixture not advertised ⇒
+ * `inapplicable`. roster-exceeded is `inapplicable` when `maxParticipants` is
+ * absent or 64 or more (RFC 0239 §Decisions 4).
+ *
+ * @see RFCS/0239-council-roster-input.md §A–§F
+ * @see spec/v2/core/conversation.md §multiPartyConversation
+ */
+
+import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { oversizeLeg, rosterLeg, speakerLeg } from '../lib/council-roster-witness.js';
+
+const DOC = 'spec/v2/core/conversation.md §multiPartyConversation';
+
+describe('v2 multi-party council (RFC 0239)', () => {
+  it('the configured roster is carried on conversation.opened', async () => {
+    const out = await rosterLeg();
+    if (out.kind === 'skip') return softSkip(out.skip, out.reason);
+    expect(out.findings.join('; '), req('openwop.requirement.0239.council.roster-carried', DOC, 'a host MUST accept participants in core.conversationGate config and carry them on conversation.opened')).toBe('');
+  });
+
+  it('a turn from outside the roster is refused and left unconsumed', async () => {
+    const out = await speakerLeg();
+    if (out.kind === 'skip') return softSkip(out.skip, out.reason);
+    expect(out.findings.join('; '), req('openwop.requirement.0239.council.speaker-refused', DOC, 'a host MUST refuse a resumed turn whose speakerId is off the roster with conversation_speaker_not_participant, leaving the interrupt open')).toBe('');
+  });
+
+  it('an oversized roster is refused at run creation', async () => {
+    const out = await oversizeLeg();
+    if (out.kind === 'skip') return softSkip(out.skip, out.reason);
+    expect(out.findings.join('; '), req('openwop.requirement.0239.council.roster-exceeded', DOC, 'a host MUST refuse at run creation, never truncate, a roster over maxParticipants, with conversation_roster_exceeded')).toBe('');
+  });
+});

package/src/scenarios/v2-nondeterminism-policy-advertisement.test.ts

@@ -5,7 +5,9 @@
  *
  *   record         the record validates against its capabilities-schema seat;
  *
- * Not here: recording every declared source needs a `sources[]` seat and a named event (TODO §8).
+ *   no-false       `declared: false` is not a v2 state (RFC 0237 §C);
+ *
+ * Not here: the replay of each declared source is `v2-nondeterminism-sources`.
  *
  * Dispositions: discovery unreadable ⇒ `blocked`; `nondeterminismPolicy` absent, or the
  * facet a leg reads absent ⇒ `inapplicable`.
@@ -38,4 +40,12 @@ describe('v2 nondeterminismPolicy advertisement (replay.md §Declared nondetermi
     if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
     for (const x of out.findings) expect(x.ok, req(ID_RECORD, x.doc, x.message)).toBe(true);
   });
+
+  it('nondeterminismPolicy.declared is not false: a host that does not offer the family omits it', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const rec = await familyAdvertised('nondeterminismPolicy');
+    if (!rec) return softSkip('inapplicable', 'the host does not advertise nondeterminismPolicy');
+    expect(rec['declared'], req('openwop.requirement.0237.no-false-advertisement', 'RFC 0237 §C; capabilities.md §2', 'nondeterminismPolicy.declared: false is not a v2 state; a host that does not offer the family MUST omit it')).not.toBe(false);
+  });
 });

package/src/scenarios/v2-nondeterminism-sources.test.ts

@@ -0,0 +1,83 @@
+/**
+ * v2 — declared nondeterminism replays its recorded values (RFC 0237 §B;
+ * `spec/v2/core/replay.md` §Declared nondeterminism; suite 2.45.23, target
+ * major 2; fixture-gated).
+ *
+ * A host listing `nondeterminismPolicy.sources` MUST record each value drawn
+ * from a listed source where it is read, and a `replay` fork MUST reproduce it
+ * rather than draw again. The log entry itself is host-internal; what a client
+ * sees is the fork's output. So the leg runs `conformance-nondeterminism` (one
+ * conformance-reserved node that writes one value per listed source to the run
+ * outputs), forks it in `replay` mode from `fromSeq: 0`, and requires each listed
+ * source's output to be byte-equal.
+ *
+ *   0237.declared-source-replays   for every listed source, the fork's output
+ *                                  equals the source run's.
+ *
+ * Dispositions: discovery unreadable ⇒ `blocked`; `nondeterminismPolicy.sources`
+ * absent, the fixture not advertised, or `replay` mode not served ⇒
+ * `inapplicable`; a create or fork the host refuses ⇒ `blocked`.
+ *
+ * @see RFCS/0237-nondeterminism-sources.md §B, §D
+ * @see spec/v2/core/replay.md §Declared nondeterminism
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { pollUntilTerminal } from '../lib/polling.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+
+const DOC = 'spec/v2/core/replay.md §Declared nondeterminism';
+const ID = 'openwop.requirement.0237.declared-source-replays';
+const FIXTURE = 'conformance-nondeterminism';
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+/** `run.completed.outputs`, read from the run's event log. */
+async function outputsOf(runId: string): Promise<Record<string, unknown> | null> {
+  const r = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`));
+  const events = (r?.json as { events?: Array<{ type?: string; payload?: { outputs?: unknown } }> } | null)?.events ?? [];
+  const done = events.find((e) => e.type === 'run.completed');
+  const out = done?.payload?.outputs;
+  return out !== null && typeof out === 'object' ? (out as Record<string, unknown>) : null;
+}
+
+describe('v2 declared nondeterminism replays (RFC 0237 §B — fixture-gated)', () => {
+  it('a replay fork reproduces every value drawn from a listed source', async () => {
+    let doc: Record<string, unknown> | null;
+    try { doc = await v2Discovery(); } catch { doc = null; }
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable');
+    const policy = await familyAdvertised('nondeterminismPolicy');
+    const sources = Array.isArray(policy?.['sources']) ? (policy['sources'] as unknown[]).filter((s): s is string => typeof s === 'string') : [];
+    if (sources.length === 0) return softSkip('inapplicable', 'the host lists no nondeterminismPolicy.sources');
+    if (!isFixtureAdvertised(FIXTURE)) return softSkip('inapplicable', `the host does not advertise the ${FIXTURE} fixture`);
+    const modes = (await familyAdvertised('replay'))?.['modes'];
+    if (!Array.isArray(modes) || !modes.includes('replay')) return softSkip('inapplicable', 'the host does not serve replay-mode forks');
+
+    const created = await http(() => driver.post('/runs', { workflowId: FIXTURE }));
+    const runId = (created?.json as { runId?: unknown } | null | undefined)?.runId;
+    if (created?.status !== 201 || typeof runId !== 'string') return softSkip('blocked', `POST /runs {workflowId: ${FIXTURE}} answered ${created?.status ?? 'no response'} ${readErrorCode(created?.json) ?? ''}`.trim());
+    const source = await pollUntilTerminal(runId, { timeoutMs: 20_000 });
+    if (source.status !== 'completed') return softSkip('blocked', `the ${FIXTURE} run ended ${source.status}, not completed`);
+    const first = await outputsOf(runId);
+    expect(first !== null, req(ID, DOC, `run.completed MUST carry outputs for ${FIXTURE}`)).toBe(true);
+
+    const fork = await http(() => driver.post(`/runs/${encodeURIComponent(runId)}:fork`, { mode: 'replay', fromSeq: 0 }));
+    const forkId = (fork?.json as { runId?: unknown } | null | undefined)?.runId;
+    if (fork === null || fork.status >= 300 || typeof forkId !== 'string') return softSkip('blocked', `the replay fork answered ${fork?.status ?? 'no response'} ${readErrorCode(fork?.json) ?? ''}`.trim());
+    const forked = await pollUntilTerminal(forkId, { timeoutMs: 20_000 });
+    if (forked.status !== 'completed') return softSkip('blocked', `the replay fork ended ${forked.status}, not completed`);
+    const second = await outputsOf(forkId);
+
+    for (const s of sources) {
+      expect(typeof first?.[s], req(ID, DOC, `the ${FIXTURE} outputs MUST carry a value for the listed source ${s} (got ${JSON.stringify(first)})`)).toBe('string');
+      expect(second?.[s], req(ID, DOC, `a replay fork MUST reproduce the value drawn from the listed source ${s}: the source run drew ${JSON.stringify(first?.[s])}, the fork ${JSON.stringify(second?.[s])}`)).toBe(first?.[s]);
+    }
+  }, 60_000);
+});

package/src/scenarios/v2-purpose-propagation-advertisement.test.ts

@@ -6,7 +6,7 @@
  *   record         the record validates against its capabilities-schema seat;
  *   propagates-onward-boolean purposePropagation.propagatesOnward is a boolean;
  *
- * Not here: propagation itself needs a carrier the suite can receive with a label seat (TODO §8).
+ * Not here: propagation itself is `v2-purpose-propagation-onward`, which observes the host's onward A2A hop through the §22 seam.
  *
  * Dispositions: discovery unreadable ⇒ `blocked`; `purposePropagation` absent, or the
  * facet a leg reads absent ⇒ `inapplicable`.

package/src/scenarios/v2-purpose-propagation-onward.test.ts

@@ -0,0 +1,119 @@
+/**
+ * v2 — purpose labels on the onward hop (`spec/v2/core/security-defaults.md`
+ * §Onward hops; suite 2.45.23, target major 2; seam-gated).
+ *
+ * A host advertising `purposePropagation` MUST re-emit a `permittedPurposes`
+ * label it received on every onward hop of the same data, narrowing and never
+ * widening, and MUST treat `[]` as no onward use. The v1 twin read a
+ * self-reported forward seam; this file observes a real onward hop instead.
+ * The suite plays both ends: it hands the host a label through the §22 `invoke`
+ * seam (`permittedPurposes`), and its fake A2A peer receives what the host's
+ * production A2A client actually sends.
+ *
+ *   onward-reemit-no-widen   the onward message carries
+ *                            `metadata.openwop.permittedPurposes`, a subset of
+ *                            the label sent;
+ *   empty-no-onward          with `[]` the host makes no onward call, while an
+ *                            unlabelled control call through the same seam
+ *                            reaches the peer (non-arrival is evidence, not a
+ *                            dead pipe).
+ *
+ * Not here: the derived-output rule (a merge of labelled inputs carries their
+ * intersection) needs two inputs on one hop; the seam forwards one.
+ *
+ * Dispositions: discovery unreadable ⇒ `blocked`; `purposePropagation` absent,
+ * `propagatesOnward` false, `a2a` absent or no seams profile ⇒ `inapplicable`;
+ * seam unwired ⇒ `seamAbsent`.
+ *
+ * @see spec/v2/core/security-defaults.md §Onward hops
+ * @see spec/v1/host-sample-test-seams.md §22
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
+import { SEAMS_PREFIX, seamsProfileAdvertised } from '../lib/seams.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { A2AFakePeer, type A2APeerInvocation } from '../lib/a2a-fake-peer.js';
+
+export const REQUIRES_HOST_CALLBACK = "the host's A2A client calls the suite's fake A2A peer";
+
+const DOC = 'spec/v2/core/security-defaults.md §Onward hops';
+const ID_REEMIT = 'openwop.requirement.purpose-propagation.onward-reemit-no-widen';
+const ID_EMPTY = 'openwop.requirement.purpose-propagation.empty-no-onward';
+const SEAM = `${SEAMS_PREFIX}/sample/a2a/invoke`;
+const LABEL = ['openwop-conformance-analytics', 'openwop-conformance-support'];
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+type Skip = { kind: 'blocked' | 'inapplicable' | 'seam'; reason: string };
+const skip = (s: Skip): undefined => (s.kind === 'seam' ? seamAbsent(s.reason) : softSkip(s.kind, s.reason));
+
+async function gate(): Promise<Skip | null> {
+  let doc: Record<string, unknown> | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  if (!doc) return { kind: 'blocked', reason: 'v2 discovery unreachable' };
+  const pp = await familyAdvertised('purposePropagation');
+  if (pp === null) return { kind: 'inapplicable', reason: 'the host does not advertise purposePropagation' };
+  if (pp['propagatesOnward'] === false) return { kind: 'inapplicable', reason: 'purposePropagation.propagatesOnward is false — the host has no onward hop' };
+  if (!(await familyAdvertised('a2a'))) return { kind: 'inapplicable', reason: 'a2a not advertised — the onward hop observed here is the host A2A client' };
+  if (!seamsProfileAdvertised(doc)) return { kind: 'inapplicable', reason: 'the onward hop is driven through the §22 invoke seam — the seams profile is not advertised' };
+  return null;
+}
+
+/** The message sends the peer received. */
+const sends = (peer: A2AFakePeer): A2APeerInvocation[] => peer.invocations().filter((i) => i.rpcMethod === 'SendMessage' || i.rpcMethod === 'message/send');
+
+function labelOf(inv: A2APeerInvocation): unknown {
+  const body = inv.body as { params?: { message?: { metadata?: { openwop?: { permittedPurposes?: unknown } } } } } | undefined;
+  return body?.params?.message?.metadata?.openwop?.permittedPurposes;
+}
+
+async function invoke(peer: A2AFakePeer, permittedPurposes?: string[]): Promise<OpenWOPResponse | Skip> {
+  const res = await http(() => driver.post(SEAM, { peerUrl: peer.hostFacingEndpoint(), ...(permittedPurposes ? { permittedPurposes } : {}) }));
+  if (res === null) return { kind: 'blocked', reason: `${SEAM} unreachable (fetch failed)` };
+  if (res.status === 404 || res.status === 405) return { kind: 'seam', reason: `${SEAM} not mounted (${res.status}) — host-sample-test-seams.md §22` };
+  return res;
+}
+
+describe('v2 purpose labels on the onward hop (security-defaults.md §Onward hops — seam-gated)', () => {
+  it('a received label is re-emitted on the onward message, never widened', async () => {
+    const g = await gate();
+    if (g) return skip(g);
+    const peer = new A2AFakePeer({ protocolVersions: ['1.0'] });
+    await peer.start();
+    try {
+      const res = await invoke(peer, LABEL);
+      if (!('status' in res)) return skip(res);
+      const sent = sends(peer)[0];
+      if (sent === undefined) return softSkip('blocked', `the seam answered ${res.status} and the suite peer received no message — the host's A2A client never reached it`);
+      const label = labelOf(sent);
+      expect(Array.isArray(label), req(ID_REEMIT, DOC, `the onward message MUST carry the received label as metadata.openwop.permittedPurposes (got ${JSON.stringify(label)})`)).toBe(true);
+      const widened = (Array.isArray(label) ? label : []).filter((p) => !LABEL.includes(String(p)));
+      expect(widened, req(ID_REEMIT, DOC, `the onward label MUST NOT widen the received one (${JSON.stringify(LABEL)}); it added ${JSON.stringify(widened)}`)).toEqual([]);
+    } finally {
+      await peer.stop();
+    }
+  });
+
+  it('an empty label means no onward call, while an unlabelled control call goes through', async () => {
+    const g = await gate();
+    if (g) return skip(g);
+    const peer = new A2AFakePeer({ protocolVersions: ['1.0'] });
+    await peer.start();
+    try {
+      const control = await invoke(peer);
+      if (!('status' in control)) return skip(control);
+      const before = sends(peer).length;
+      if (before === 0) return softSkip('blocked', `the unlabelled control call answered ${control.status} but reached no peer, so a missing call under [] would prove nothing`);
+      const res = await invoke(peer, []);
+      if (!('status' in res)) return skip(res);
+      expect(sends(peer).length - before, req(ID_EMPTY, DOC, `a host MUST treat [] as no onward use: the seam answered ${res.status}, and the peer received ${sends(peer).length - before} message(s) for the []-labelled data`)).toBe(0);
+    } finally {
+      await peer.stop();
+    }
+  });
+});

package/src/scenarios/v2-ui-plugin-boundary.test.ts

@@ -0,0 +1,68 @@
+/**
+ * v2 — the front-end plugin boundary is observable (RFC 0238; `spec/v2/core/packs.md`
+ * §Front-end plugin packs). Gated on `uiPlugins.served`.
+ *
+ * The four `frontend-plugin-*` SECURITY invariants were witnessed only by the v1
+ * sample seam `POST /v1/host/sample/ui-plugin/rpc`; v2 mounts no plugin seam. This
+ * scenario reads the two normative operations instead, against the operator-installed
+ * `ui-plugin-pack-narrow` fixture (one plugin, `narrow`, declaring only
+ * `artifact.read` and no `connectSrc`):
+ *
+ *   frame-isolated      the frame's Content-Security-Policy `sandbox` admits
+ *                       `allow-scripts` and never `allow-same-origin`
+ *                       (`cross-origin-iframe` hosts only);
+ *   frame-deny-egress   the same policy sets `default-src 'none'` and admits no
+ *                       `connect-src` source;
+ *   rpc-allowlist       `artifact.write` and `host.navigate` (in the enum, not
+ *                       declared) return `method_not_allowed`; `host.exec` (outside
+ *                       the enum) is not executed; `artifact.read` succeeds (control);
+ *   no-byok             no dispatch response carries canary material.
+ *
+ * The legs live in `lib/ui-plugin-boundary-witness.ts`, proven against a double in
+ * `lib/ui-plugin-boundary-witness.test.ts`.
+ *
+ * Dispositions: no `uiPlugins.served` ⇒ every leg `inapplicable`. The fixture not
+ * installed (its frame or dispatch answers 404) ⇒ `inapplicable`: installing it is the
+ * operator's choice (RFC 0238 §D). An isolation other than `cross-origin-iframe` ⇒ the
+ * isolation leg `inapplicable` (RFC 0238 §Decisions 3).
+ *
+ * @see RFCS/0238-ui-plugin-observation-path.md §B, §C, §F
+ * @see spec/v2/core/packs.md §Front-end plugin packs
+ */
+
+import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { allowlistLeg, egressLeg, isolationLeg, noByokLeg } from '../lib/ui-plugin-boundary-witness.js';
+
+const DOC = 'spec/v2/core/packs.md §Front-end plugin packs';
+const ID_ISOLATED = 'openwop.requirement.0238.ui-plugin.frame-isolated';
+const ID_EGRESS = 'openwop.requirement.0238.ui-plugin.frame-deny-egress';
+const ID_ALLOWLIST = 'openwop.requirement.0238.ui-plugin.rpc-allowlist';
+const ID_NO_BYOK = 'openwop.requirement.0238.ui-plugin.no-byok';
+
+describe('v2 ui-plugin boundary (RFC 0238)', () => {
+  it('the frame is sandboxed without same-origin', async () => {
+    const out = await isolationLeg();
+    if (out.kind === 'skip') return softSkip(out.skip, out.reason);
+    expect(out.findings.join('; '), req(ID_ISOLATED, DOC, 'a cross-origin-iframe plugin frame MUST carry a sandbox directive admitting allow-scripts and never allow-same-origin')).toBe('');
+  });
+
+  it('the frame denies egress', async () => {
+    const out = await egressLeg();
+    if (out.kind === 'skip') return softSkip(out.skip, out.reason);
+    expect(out.findings.join('; '), req(ID_EGRESS, DOC, "the frame MUST set default-src 'none' and admit no connect-src source the plugin did not declare")).toBe('');
+  });
+
+  it('the dispatch refuses methods outside the allowlists and runs the declared one', async () => {
+    const out = await allowlistLeg();
+    if (out.kind === 'skip') return softSkip(out.skip, out.reason);
+    expect(out.findings.join('; '), req(ID_ALLOWLIST, DOC, "a method outside the plugin's declared hostApi or the advertised uiPlugins.hostApi MUST return method_not_allowed and MUST NOT execute")).toBe('');
+  });
+
+  it('no dispatch response carries credential material', async () => {
+    const out = await noByokLeg();
+    if (out.kind === 'skip') return softSkip(out.skip, out.reason);
+    expect(out.findings.join('; '), req(ID_NO_BYOK, DOC, 'a ui-plugin/1 response MUST NOT carry credential material across the boundary')).toBe('');
+  });
+});

package/src/scenarios/v2-wasm-memory-cap.test.ts

@@ -0,0 +1,34 @@
+/**
+ * v2 — a host enforcing its advertised WASM memory ceiling
+ * (`spec/v2/core/node-pack-runtimes.md` §WASM: "When it advertises
+ * `maxMemoryBytes` it MUST enforce it and emit `cap.breached` with
+ * `kind: "wasm-memory"` on a breach").
+ *
+ * The v1 twin, `wasm-pack-memory-cap`, runs at major 1 only and needed a
+ * Rust-built pack. Here the operator installs the hand-written fixture pack at
+ * `conformance/fixtures/wasm-packs/misbehaving-memory/` (`vendor.openwop.misbehaving`,
+ * node `vendor.openwop.misbehaving.memory-bomb`, which grows memory until the
+ * host refuses) and advertises `conformance-wasm-pack-memory-cap-breach`.
+ *
+ * The leg lives in `lib/wasm-memory-cap-witness.ts`, proven against a double in
+ * `lib/wasm-memory-cap-witness.test.ts`.
+ *
+ * Dispositions: no `nodePackRuntimes.wasm`, no `maxMemoryBytes`, or the fixture
+ * not advertised ⇒ `inapplicable`.
+ *
+ * @see spec/v2/core/node-pack-runtimes.md §WASM
+ * @see RFCS/0008-wasm-abi.md §K
+ */
+
+import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { memoryCapLeg } from '../lib/wasm-memory-cap-witness.js';
+
+describe('v2 WASM memory ceiling (node-pack-runtimes.md §WASM)', () => {
+  it('a module exceeding maxMemoryBytes produces cap.breached wasm-memory and fails the run', async () => {
+    const out = await memoryCapLeg();
+    if (out.kind === 'skip') return softSkip(out.skip, out.reason);
+    expect(out.findings.join('; '), req('openwop.requirement.node-pack-runtimes.wasm-memory-cap', 'spec/v2/core/node-pack-runtimes.md §WASM', 'a host advertising maxMemoryBytes MUST enforce it and emit cap.breached with kind wasm-memory on a breach')).toBe('');
+  });
+});