@openwop/openwop-conformance 2.45.26 → 2.45.28

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.28] — 2026-10-08 — two more seam-driven legs, and the backoff ratio, on a public seam-free cut
+
+- **Found by the v2 reference host's first public seams-off cut** (2.45.27, RFC 0241's evidence): all seven target rows `executed-pass`, but four other rows kept the bundle from certifying. Neither shows on a loopback cut.
+  - **`0199.mcp-url-mode` (`v2-mcp-mount-map`) and `0199.a2a-auth-required` (`v2-a2a-operation-map`):** both mint a fresh Subject through the credential mint seam, without checking for the seams profile, and recorded `blocked` when it was absent. They run only where `oauth.credentialInterrupt` is advertised, which this host does only with an https public base. Now `inapplicable` without the seams profile.
+  - **`v2-webhook-durable-delivery`, the exponential-backoff check:** it required the second retry gap to be at least 1.5x the first. Each gap also carries a constant, the receiver round trip a host waits on before scheduling the retry, so the gaps are B + c and 2B + c; through a tunnel (c ≈ 270 ms, base 500 ms) a correct host measured 1.43x. The second gap must now exceed the first by at least a quarter of it.
+- Proven on the v2 reference host: seams off with an https base, both 0199 rows `inapplicable`; the backoff leg passes on the host as is, and fails (510 ms after 604 ms) with the backoff made constant.
+
+## [2.45.27] — 2026-10-08 — a seam-free host's seam-driven legs record `inapplicable`, not `blocked`
+
+- **Three scenarios recorded `blocked` on a host without the seams profile**, which denies the bundle certification, where the rest of the suite records a seam-driven leg `inapplicable`. Found by the v2 reference host's first seams-off cut (RFC 0241's evidence): 11 rows `blocked`, all `executed-pass` with the seams profile.
+  - **`v2-pack-isolation` (8 rows):** `invoke` recorded `inapplicable`, then each leg added `blocked` (`seam unavailable`), which outranks it. A leg now returns the kind `invoke` recorded; a seams host whose sandbox seam answers 404 is still `blocked`.
+  - **`v2-negotiation-authenticated` and `v2-minimum-version-refused`, MCP legs:** `blocked` without the seams profile, where their A2A twins say `inapplicable`. Now `inapplicable`.
+  - **`v2-approval-reject-disposition`, the quorum leg:** the resume value's `voter` is a suite convention, not a protocol field, so a seam-free host rightly counts the bearer, and one bearer cannot cause a majority. That is now `inapplicable`; a seams host that ignores `voter` is still `blocked`.
+- Proven on the v2 reference host: seams off, the 11 rows `inapplicable` and none `blocked`; seams on, all 28 rows of the four files `executed-pass`; seams on with `voter` ignored, the quorum row `blocked`.
+
 ## [2.45.26] — 2026-10-08 — RFC 0236's legs run without the seam (RFC 0241 Active)
 
 - **No scenario change.** RFC 0237 goes `Accepted` on the v2 reference host's certified 2.45.25 cut; its gaps G1 and G2 close, which changes the packed `spec/v1/gaps.json`.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.26",
-  "stampSha256": "01d0c29c58bd680baa38517e507d8c14b73ca1bf9aa888d79efc7d78a94d9e1b"
+  "version": "2.45.28",
+  "stampSha256": "0e47a879900333edf1f01645a54edb7935cf263125d4ab3dc90405f81189d8a3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.26",
+  "version": "2.45.28",
   "description": "Black-box conformance suite for OpenWOP hosts (v2 current; v1 scenarios retained for the frozen v1 tree).",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.26"
+    "@openwop/spec-artifacts": "2.45.28"
   }
 }

package/requirements.json

@@ -28193,7 +28193,7 @@
     {
       "id": "openwop.it.v2-approval-reject-disposition.a-rejected-gate-with-no-routing-edge-fails-the-run-with-approval-rejected",
       "file": "v2-approval-reject-disposition.test.ts",
-      "line": 141,
+      "line": 143,
       "title": "a rejected gate with no routing edge fails the run with approval_rejected",
       "explicitId": null,
       "citations": [
@@ -28216,7 +28216,7 @@
     {
       "id": "openwop.it.v2-approval-reject-disposition.interrupt-resolved-records-action-reject-and-decision-rejected",
       "file": "v2-approval-reject-disposition.test.ts",
-      "line": 152,
+      "line": 154,
       "title": "interrupt.resolved records action reject and decision rejected",
       "explicitId": null,
       "citations": [
@@ -28235,7 +28235,7 @@
     {
       "id": "openwop.it.v2-approval-reject-disposition.the-gate-node-fails-with-approval-rejected-not-retryable-and-run-failed-names-it",
       "file": "v2-approval-reject-disposition.test.ts",
-      "line": 165,
+      "line": 167,
       "title": "the gate node fails with approval_rejected, not retryable, and run.failed names it",
       "explicitId": null,
       "citations": [
@@ -28256,7 +28256,7 @@
     {
       "id": "openwop.it.v2-approval-reject-disposition.a-majority-reject-decides-the-quorum-gate-on-the-deciding-vote-and-fails-the-run",
       "file": "v2-approval-reject-disposition.test.ts",
-      "line": 178,
+      "line": 180,
       "title": "a majority reject decides the quorum gate on the deciding vote and fails the run with approval_rejected",
       "explicitId": null,
       "citations": [
@@ -28282,7 +28282,7 @@
     {
       "id": "openwop.it.v2-approval-reject-disposition.a-rejected-gate-routed-over-an-any-failed-edge-fails-as-a-node-its-all-success-s",
       "file": "v2-approval-reject-disposition.test.ts",
-      "line": 201,
+      "line": 207,
       "title": "a rejected gate routed over an any_failed edge fails as a node, its all_success sibling never runs, and the run completes",
       "explicitId": null,
       "citations": [
@@ -28308,7 +28308,7 @@
     {
       "id": "openwop.it.v2-approval-reject-disposition.an-unresolved-gate-past-its-timeoutms-with-no-ontimeout-is-resolved-rejected-by",
       "file": "v2-approval-reject-disposition.test.ts",
-      "line": 220,
+      "line": 226,
       "title": "an unresolved gate past its timeoutMs with no onTimeout is resolved rejected by the host and fails the run naming the gate",
       "explicitId": null,
       "citations": [
@@ -28329,7 +28329,7 @@
     {
       "id": "openwop.it.v2-approval-reject-disposition.a-gate-whose-ontimeout-is-approve-still-resolves-rejected-on-timeout-and-fails-t",
       "file": "v2-approval-reject-disposition.test.ts",
-      "line": 239,
+      "line": 245,
       "title": "a gate whose onTimeout is approve still resolves rejected on timeout and fails the run: a timeout never grants",
       "explicitId": null,
       "citations": [
@@ -28351,7 +28351,7 @@
     {
       "id": "openwop.it.v2-approval-reject-disposition.a-rejected-gate-looped-back-to-itself-is-asked-again-under-a-new-key-and-the-fir",
       "file": "v2-approval-reject-disposition.test.ts",
-      "line": 257,
+      "line": 263,
       "title": "a rejected gate looped back to itself is asked again under a new key, and the first rejection is not replayed",
       "explicitId": null,
       "citations": [
@@ -28377,7 +28377,7 @@
     {
       "id": "openwop.it.v2-approval-reject-disposition.a-replay-fork-of-a-decided-reject-derives-the-rejection-from-the-log-and-never-r",
       "file": "v2-approval-reject-disposition.test.ts",
-      "line": 333,
+      "line": 339,
       "title": "a replay fork of a decided reject derives the rejection from the log and never re-decides it (leg A)",
       "explicitId": null,
       "citations": [
@@ -28390,7 +28390,7 @@
     {
       "id": "openwop.it.v2-approval-reject-disposition.a-replay-fork-of-a-timed-out-gate-derives-the-timeout-rejection-from-the-log-and",
       "file": "v2-approval-reject-disposition.test.ts",
-      "line": 348,
+      "line": 354,
       "title": "a replay fork of a timed-out gate derives the timeout rejection from the log and never re-arms it (leg B)",
       "explicitId": null,
       "citations": [
@@ -32919,7 +32919,7 @@
     {
       "id": "openwop.it.v2-mcp-mount-map.form-mode-is-never-emitted-for-a-nested-schema-or-a-sensitive-format-password-fi",
       "file": "v2-mcp-mount-map.test.ts",
-      "line": 344,
+      "line": 345,
       "title": "form mode is never emitted for a nested schema or a sensitive (format password) field",
       "explicitId": "openwop.requirement.0199.form-mode-no-secret",
       "citations": [
@@ -34062,7 +34062,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.sandbox-isolationmodel-names-a-real-mechanism-never-node-vm",
       "file": "v2-pack-isolation.test.ts",
-      "line": 82,
+      "line": 89,
       "title": "sandbox.isolationModel names a real mechanism, never node:vm",
       "explicitId": "openwop.requirement.0173.pack-isolation",
       "citations": [
@@ -34080,7 +34080,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.the-sandbox-invoke-seam-answers-the-seam-contract",
       "file": "v2-pack-isolation.test.ts",
-      "line": 96,
+      "line": 103,
       "title": "the sandbox-invoke seam answers the seam contract",
       "explicitId": "openwop.requirement.0173.pack-isolation.seam",
       "citations": [
@@ -34094,7 +34094,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-fs-gated-a-host-filesystem-read-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 108,
+      "line": 115,
       "title": "node-pack-sandbox-fs-gated: a host filesystem read is refused",
       "explicitId": null,
       "citations": []
@@ -34102,7 +34102,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-fs-gated-a-host-filesystem-write-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 115,
+      "line": 122,
       "title": "node-pack-sandbox-fs-gated: a host filesystem write is refused",
       "explicitId": null,
       "citations": []
@@ -34110,7 +34110,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-no-env-the-host-environment-does-not-leak",
       "file": "v2-pack-isolation.test.ts",
-      "line": 122,
+      "line": 129,
       "title": "node-pack-sandbox-no-env: the host environment does not leak",
       "explicitId": null,
       "citations": []
@@ -34118,7 +34118,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-network-gated-ungated-network-egress-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 129,
+      "line": 136,
       "title": "node-pack-sandbox-network-gated: ungated network egress is refused",
       "explicitId": null,
       "citations": []
@@ -34126,7 +34126,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-no-process-host-process-access-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 136,
+      "line": 143,
       "title": "node-pack-sandbox-no-process: host process access is refused",
       "explicitId": null,
       "citations": []
@@ -34134,7 +34134,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-timeout-exceeding-wallclocklimitms-fails-with-sandbox-timeout",
       "file": "v2-pack-isolation.test.ts",
-      "line": 143,
+      "line": 150,
       "title": "node-pack-sandbox-timeout: exceeding wallClockLimitMs fails with sandbox_timeout",
       "explicitId": "openwop.requirement.0173.pack-isolation.timeout",
       "citations": [
@@ -34147,7 +34147,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-memory-cap-exceeding-memorylimitbytes-fails-with-sandbox-memor",
       "file": "v2-pack-isolation.test.ts",
-      "line": 150,
+      "line": 157,
       "title": "node-pack-sandbox-memory-cap: exceeding memoryLimitBytes fails with sandbox_memory_exceeded",
       "explicitId": "openwop.requirement.0173.pack-isolation.memory-cap",
       "citations": [
@@ -34160,7 +34160,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-isolated-context-a-pack-cannot-mutate-state-another-invocation",
       "file": "v2-pack-isolation.test.ts",
-      "line": 157,
+      "line": 164,
       "title": "node-pack-sandbox-isolated-context: a pack cannot mutate state another invocation sees",
       "explicitId": "openwop.requirement.0173.pack-isolation.isolated-context",
       "citations": [
@@ -38110,7 +38110,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 430,
+      "line": 435,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
@@ -38149,7 +38149,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 539,
+      "line": 544,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -38162,7 +38162,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.after-unregister-the-dead-letter-read-answers-404-not-found-as-for-a-subscriptio",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 560,
+      "line": 565,
       "title": "after unregister, the dead-letter read answers 404 not_found, as for a subscription that never existed",
       "explicitId": "openwop.requirement.0217.dead-letter-read-after-unregister",
       "citations": [
@@ -38189,7 +38189,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 593,
+      "line": 598,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
@@ -38207,7 +38207,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.every-logged-event-of-a-subscribed-type-reaches-a-healthy-receiver-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 688,
+      "line": 693,
       "title": "every logged event of a subscribed type reaches a healthy receiver at least once within the retry bound",
       "explicitId": "openwop.requirement.0173.webhook-delivery-complete",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.26",
-  "corpusTag": "v2.45.26",
+  "version": "2.45.28",
+  "corpusTag": "v2.45.28",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "d3b59eb1f87f42ba118bdbbdfb74e6f499081d8d5ed5fba3b06d5ae561bc90bd",
-    "api/v2/asyncapi.yaml": "dc2ed7cd47e0ca326e89badc1f0b0c3a64b2030859559786c711230e5e7474f1",
-    "api/v2/openapi.yaml": "3fbb8672105a847d457e13cde09bf65b02b02163cf1082f08b3cec68088a416a",
+    "api/seams-v2.yaml": "1408a344c243a2a54de2f19b839efd2a9ad45ffa94ab72c2b3e352cbce2804f3",
+    "api/v2/asyncapi.yaml": "84aa6ad5580f097da601bb257a859c8c4ef745051c77d39b5de222c59734a89b",
+    "api/v2/openapi.yaml": "3a85fa3b6d637123554921da4e003a69aabe2c1dc3144b0dd090b68cf0301553",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -208,7 +208,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "22444c22bb88c568339ef512553f9fc38146e22b566d11ab8608f655d688d19c",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "cd739e168fa36dd811fd9ed1f506e0716c592e7a61c0d12164f82732ca366177",
+    "spec/v1/core-standard-manifest.json": "54ae669965b91b6526ce05a6dcc4ce7bbf419dba030e9f23edeb174b1806b3c2",
     "spec/v1/deprecations.json": "e723bc11d7272c71789ad1303bb7f21809a8a024abf57594f9d5c35dc199ece9",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
@@ -313,9 +313,9 @@
     "spec/v2/path-manifest.json": "7b5679a4dad98c80d855361d88a98c8a4e045af15e310862a05b285b815dc9fc",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "7ce8ba7234bfe7eff4c767cc0aa4ddea0495fae08212fe98f63ae312cab06c74",
+    "spec/v2/release.json": "1001b6d3376418eda319c7bbd6a1f77f45f39d3574df0b977ca474c1f4f3622c",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "da9da09f5133be09b75820d138c5b4422365b2b8d113597c7fa89c99913069b3"
+    "spec/v2/surface-baseline.json": "9553399d274a2d244ba5ac4de7ccc97b6d7ade51ebb92303938fe684d4cb4d2f"
   },
-  "corpusCommit": "906642cfb7cea6d4be59f0471866f8ffa3e4c702"
+  "corpusCommit": "19b9fd8ea3ae511f8d1b461e99d55564db3857e0"
 }

package/src/scenarios/v2-a2a-operation-map.test.ts

@@ -38,7 +38,7 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
 import { req } from '../lib/requirement-ids.js';
-import { SEAMS_PREFIX } from '../lib/seams.js';
+import { SEAMS_PREFIX, seamsProfileAdvertised } from '../lib/seams.js';
 import { unservedDestination } from '../lib/scoped-receiver.js';
 import { errorInfos, normaliseErrorData, isOpenwopEnvelope, A2A_ERROR_DOMAIN } from '../lib/a2a-error-info.js';
 
@@ -513,6 +513,7 @@ describe('RFC 0208 — v2-a2a-operation-map (host as A2A 1.0 server, gated on a2
     const oauth = await familyAdvertised('oauth');
     if (oauth?.['credentialInterrupt'] !== true) return softSkip('inapplicable', 'oauth.credentialInterrupt is not advertised — the host raises no credential interrupt to project (RFC 0199 §C.1)');
     if (!isFixtureAdvertised('conformance-credential')) return softSkip('blocked', 'fixture conformance-credential is not in the advertised fixtures[]');
+    if (!seamsProfileAdvertised(await v2Discovery().catch(() => null))) return softSkip('inapplicable', 'a fresh Subject is minted through the seams profile (credential mint seam) — conformance.seamsProfile is not openwop-conformance-seams-v2');
     // A fresh Subject, so no credential another scenario acquired satisfies the node.
     const minted = await driver.post(`${SEAMS_PREFIX}/sample/auth/credential/mint`, { lane: 'api-key' }).catch(() => null);
     const bearer = (minted?.json as { credential?: unknown } | undefined)?.credential;

package/src/scenarios/v2-approval-reject-disposition.test.ts

@@ -59,7 +59,8 @@
  * The quorum leg presents distinct votes on one bearer through the resume
  * value's `voter` member, as `interrupt-quorum-resolution` does at major 1. A
  * host that counts both votes as one principal cannot be driven to a majority
- * this way; that records `blocked`, not a failure.
+ * this way: that records `blocked` on a host advertising the seams profile, and
+ * `inapplicable` on one without it, which rightly counts only the bearer.
  *
  * @see spec/v2/core/interrupt.md §Rejection
  * @see spec/v2/errors.json approval_rejected
@@ -68,7 +69,8 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
-import { gateFamily } from '../lib/v2.js';
+import { gateFamily, v2Discovery } from '../lib/v2.js';
+import { seamsProfileAdvertised } from '../lib/seams.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { softSkip } from '../lib/soft-skip.js';
@@ -190,6 +192,10 @@ describe('RFC 0223 — v2-approval-reject-disposition (gated on interrupt + conf
     const terminal = await waitStatus(s.runId, TERMINAL, 10_000);
     if (between === 'waiting-approval' && terminal?.['status'] === 'waiting-approval') {
       await http(() => driver.post(`/runs/${enc(s.runId)}/cancel`, {}));
+      // `voter` is a suite convention, not a protocol field: a host without the
+      // seams profile rightly counts the bearer, and one bearer cannot cause a
+      // majority there. Only a seams host that ignores it is `blocked`.
+      if (!seamsProfileAdvertised(await v2Discovery().catch(() => null))) return softSkip('inapplicable', 'the host counted both votes as one approver: one bearer, and the resume value\'s voter stand-in is a seams-profile convention this seam-free host rightly ignores; a majority needs distinct principals');
       return softSkip('blocked', 'the host counted both votes as one approver (one bearer; the resume value\'s voter was not honoured), so a majority could not be caused');
     }
     expect(between, req(id, DOC, 'one reject of three under majority does not decide the gate: the run MUST stay waiting-approval')).toBe('waiting-approval');

package/src/scenarios/v2-mcp-mount-map.test.ts

@@ -34,7 +34,7 @@ import { loadEnv } from '../lib/env.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
 import { req } from '../lib/requirement-ids.js';
-import { SEAMS_PREFIX } from '../lib/seams.js';
+import { SEAMS_PREFIX, seamsProfileAdvertised } from '../lib/seams.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED = 'the suite is the MCP client: every leg POSTs JSON-RPC to the mount the host advertises in mcp.serverUrls; nothing harness-hosted is handed to the host';
 
@@ -308,6 +308,7 @@ describe('RFC 0208 — v2-mcp-mount-map (host as MCP 2026-07-28 server, gated on
     if (oauth?.['credentialInterrupt'] !== true) return softSkip('inapplicable', 'oauth.credentialInterrupt is not advertised — the host raises no credential interrupt to bridge (RFC 0199 §C.1)');
     const missing = needFixtures(['conformance-credential']);
     if (missing) return softSkip('blocked', missing);
+    if (!seamsProfileAdvertised(await v2Discovery().catch(() => null))) return softSkip('inapplicable', 'a fresh Subject is minted through the seams profile (credential mint seam) — conformance.seamsProfile is not openwop-conformance-seams-v2');
     const minted = await driver.post(`${SEAMS_PREFIX}/sample/auth/credential/mint`, { lane: 'api-key' }).catch(() => null);
     const bearer = (minted?.json as { credential?: unknown } | undefined)?.credential;
     if (typeof bearer !== 'string') return softSkip('blocked', 'the credential mint seam did not mint a fresh Subject — a Subject that may already hold a credential makes the leg vacuous');

package/src/scenarios/v2-minimum-version-refused.test.ts

@@ -116,7 +116,7 @@ describe('RFC 0175 §D.2 — minimum-version-refused (gated on a2a/mcp + seams)'
     if (!doc) return softSkip('blocked', 'discovery unreachable');
     const facet = await familyAdvertised('mcp');
     if (!facet) return softSkip('inapplicable', 'mcp facet not advertised — no floor to enforce');
-    if (!seamsProfileAdvertised(doc)) return softSkip('blocked', 'the below-floor exchange is driven through the seams profile — conformance.seamsProfile is not openwop-conformance-seams-v2');
+    if (!seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'the below-floor exchange is driven through the seams profile — conformance.seamsProfile is not openwop-conformance-seams-v2');
     const floor = String(facet['minimumRevision']);
     if (!(MCP_LOWEST < floor)) {
       return softSkip('blocked', `the advertised mcp.minimumRevision (${floor}) is at or below the lowest revision the suite server can offer (${MCP_LOWEST}) — nothing below the floor can be offered`);

package/src/scenarios/v2-negotiation-authenticated.test.ts

@@ -119,7 +119,7 @@ describe('RFC 0175 §D.1 — negotiation-authenticated (gated on a2a/mcp + seams
     if (!doc) return softSkip('blocked', 'discovery unreachable');
     const facet = await familyAdvertised('mcp');
     if (!facet) return softSkip('inapplicable', 'mcp facet not advertised — no negotiation to authenticate');
-    if (!seamsProfileAdvertised(doc)) return softSkip('blocked', 'the unauthenticated exchange is driven through the seams profile — conformance.seamsProfile is not openwop-conformance-seams-v2');
+    if (!seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'the unauthenticated exchange is driven through the seams profile — conformance.seamsProfile is not openwop-conformance-seams-v2');
     const preferred = String(facet['preferredVersion']);
     if (!(MCP_LOWER < preferred)) return softSkip('blocked', `mcp.preferredVersion is ${preferred}, at or below the lowest revision the suite server can offer (${MCP_LOWER}) — no lower revision can be offered`);
     const server = new McpFakeServer({ protocolVersions: ['2025-06-18'] });

package/src/scenarios/v2-pack-isolation.test.ts

@@ -33,7 +33,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { v2Discovery, gateFamily } from '../lib/v2.js';
 import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
-import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { softSkip, seamAbsent, type SoftSkipKind } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const ISOLATION_MODELS = ['wasm', 'process', 'container', 'vm'];
@@ -55,12 +55,19 @@ async function gated(): Promise<Record<string, unknown> | null> {
   return sandbox;
 }
 
-/** Drive one misbehaving typeId through the sandbox seam; null (reason recorded) when the seam is absent. */
+/**
+ * The kind `invoke` recorded when it returned null. A leg returns this kind, not
+ * a fixed `blocked`: a seam-free host records `inapplicable` here, and a second
+ * `blocked` on top of it outranked that and denied the bundle certification.
+ */
+let invokeSkip: SoftSkipKind = 'blocked';
+
+/** Drive one misbehaving typeId through the sandbox seam; null (reason recorded, kind in `invokeSkip`) when the seam is absent. */
 async function invoke(typeId: string, extra: Record<string, unknown> = {}): Promise<InvokeResult | null> {
   const doc = await discovery();
-  if (!doc || !seamsProfileAdvertised(doc)) { softSkip('inapplicable', `the ${typeId} leg is seam-driven — seams profile (conformance.seamsProfile = openwop-conformance-seams-v2) not advertised`); return null; }
+  if (!doc || !seamsProfileAdvertised(doc)) { invokeSkip = 'inapplicable'; softSkip('inapplicable', `the ${typeId} leg is seam-driven — seams profile (conformance.seamsProfile = openwop-conformance-seams-v2) not advertised`); return null; }
   const res = await driver.post(INVOKE, { typeId, ...extra });
-  if (res.status === 404 || res.status === 403 || res.status === 405) { seamAbsent(`host advertises sandbox but ${INVOKE} answered ${res.status} — the ${typeId} leg is unobservable (host-sample-test-seams.md §8)`); return null; }
+  if (res.status === 404 || res.status === 403 || res.status === 405) { invokeSkip = 'blocked'; seamAbsent(`host advertises sandbox but ${INVOKE} answered ${res.status} — the ${typeId} leg is unobservable (host-sample-test-seams.md §8)`); return null; }
   // The same id is ALSO asserted by its own `it` above, and that is the copy the
   // registry can see: `generate-requirement-registry.mjs` harvests `req(…)` only
   // within an `it`, so this helper-level call alone left the id out of
@@ -108,58 +115,58 @@ describe('RFC 0173 §B — pack-isolation (gated on sandbox)', () => {
   it('node-pack-sandbox-fs-gated: a host filesystem read is refused', async () => {
     if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
     const r = await invoke('misbehave.fs-escape-read');
-    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    if (!r) return softSkip(invokeSkip, 'seam leg not driven (reason recorded above)');
     expectEscape('openwop.requirement.0173.pack-isolation.fs-read', r, 'host-fs-escape', 'node-pack-sandbox-fs-gated');
   });
 
   it('node-pack-sandbox-fs-gated: a host filesystem write is refused', async () => {
     if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
     const r = await invoke('misbehave.fs-escape-write');
-    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    if (!r) return softSkip(invokeSkip, 'seam leg not driven (reason recorded above)');
     expectEscape('openwop.requirement.0173.pack-isolation.fs-write', r, 'host-fs-escape', 'node-pack-sandbox-fs-gated');
   });
 
   it('node-pack-sandbox-no-env: the host environment does not leak', async () => {
     if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
     const r = await invoke('misbehave.env-leak');
-    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    if (!r) return softSkip(invokeSkip, 'seam leg not driven (reason recorded above)');
     expectEscape('openwop.requirement.0173.pack-isolation.no-env', r, 'host-env-leak', 'node-pack-sandbox-no-env');
   });
 
   it('node-pack-sandbox-network-gated: ungated network egress is refused', async () => {
     if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
     const r = await invoke('misbehave.network-escape');
-    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    if (!r) return softSkip(invokeSkip, 'seam leg not driven (reason recorded above)');
     expectEscape('openwop.requirement.0173.pack-isolation.network', r, 'network-escape', 'node-pack-sandbox-network-gated');
   });
 
   it('node-pack-sandbox-no-process: host process access is refused', async () => {
     if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
     const r = await invoke('misbehave.process-escape');
-    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    if (!r) return softSkip(invokeSkip, 'seam leg not driven (reason recorded above)');
     expectEscape('openwop.requirement.0173.pack-isolation.no-process', r, 'host-process-escape', 'node-pack-sandbox-no-process');
   });
 
   it('node-pack-sandbox-timeout: exceeding wallClockLimitMs fails with sandbox_timeout', async () => {
     if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
     const r = await invoke('misbehave.timeout');
-    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    if (!r) return softSkip(invokeSkip, 'seam leg not driven (reason recorded above)');
     expect(r.error?.code, req('openwop.requirement.0173.pack-isolation.timeout', 'security-defaults.md §Sandbox isolation', 'node-pack-sandbox-timeout: a wall-clock overrun MUST fail with sandbox_timeout')).toBe('sandbox_timeout');
   });
 
   it('node-pack-sandbox-memory-cap: exceeding memoryLimitBytes fails with sandbox_memory_exceeded', async () => {
     if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
     const r = await invoke('misbehave.memory-bomb');
-    if (!r) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    if (!r) return softSkip(invokeSkip, 'seam leg not driven (reason recorded above)');
     expect(r.error?.code, req('openwop.requirement.0173.pack-isolation.memory-cap', 'security-defaults.md §Sandbox isolation', 'node-pack-sandbox-memory-cap: a memory overrun MUST fail with sandbox_memory_exceeded')).toBe('sandbox_memory_exceeded');
   });
 
   it('node-pack-sandbox-isolated-context: a pack cannot mutate state another invocation sees', async () => {
     if (!(await gated())) return softSkip('inapplicable', 'gate not met (reason recorded above)');
     const first = await invoke('misbehave.cross-pack-mutate');
-    if (!first) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    if (!first) return softSkip(invokeSkip, 'seam leg not driven (reason recorded above)');
     const second = await invoke('misbehave.cross-pack-mutate');
-    if (!second) return softSkip('blocked', 'seam unavailable (reason recorded above)');
+    if (!second) return softSkip(invokeSkip, 'seam leg not driven (reason recorded above)');
     for (const r of [first, second]) {
       expect(r.error, req('openwop.requirement.0173.pack-isolation.isolated-context', 'host-sample-test-seams.md §8', 'misbehave.cross-pack-mutate is not a failure mode — it MUST return a result')).toBeUndefined();
       expect(

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -403,18 +403,23 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
         // Unfailable-leg audit (2026-09-26): `> 0 ms` alone let a host advertising
         // `backoff: exponential` that retried in a tight loop (any constant
         // spacing, even a few ms) pass. An exponential backoff MUST widen, so with
-        // three or more attempts the second gap is at least 1.5x the first (not
-        // 2x: jitter tolerance). Only the first two gaps are compared, so a host
-        // whose schedule hits its cap later is not convicted. `fixed` gets no
-        // equivalent: its base interval is not on the wire (see the comment above
-        // the `!retried` branch), so there is no floor to measure against.
+        // three or more attempts the second gap is wider than the first by at least
+        // a quarter of it. Not 1.5x: each gap also carries a constant c, the
+        // receiver round trip a host waits on before scheduling the retry, so the
+        // gaps are B + c and 2B + c, and a public cut's tunnel (c ≈ 270 ms
+        // against a 500 ms base, 2026-10-08) put a correct host at 1.43x. A
+        // constant spacing still fails: its gaps differ only by jitter. Only the
+        // first two gaps are compared, so a host whose schedule hits its cap
+        // later is not convicted. `fixed` gets no equivalent: its base interval
+        // is not on the wire (see the comment above the `!retried` branch), so
+        // there is no floor to measure against.
         if (policy.backoff === 'exponential' && times.length >= 3) {
           const gap1 = times[1]! - times[0]!;
           const gap2 = times[2]! - times[1]!;
           expect(
-            gap2,
-            req('openwop.requirement.0173.webhook-durable-delivery', 'webhooks.md §Durability', `retry attempts for ${key} MUST follow the advertised exponential backoff — the second gap (${gap2}ms) MUST be at least 1.5x the first (${gap1}ms); a constant spacing is not exponential`),
-          ).toBeGreaterThanOrEqual(1.5 * gap1);
+            gap2 - gap1,
+            req('openwop.requirement.0173.webhook-durable-delivery', 'webhooks.md §Durability', `retry attempts for ${key} MUST follow the advertised exponential backoff — the second gap (${gap2}ms) MUST exceed the first (${gap1}ms) by at least a quarter of it; a constant spacing is not exponential`),
+          ).toBeGreaterThanOrEqual(0.25 * gap1);
         }
       }
     } else {