@openwop/openwop-conformance 2.45.28 → 2.45.30

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.30] — 2026-10-09 — the seams profile floor is seam-driven
+
+- **`openwop-conformance-seams-v2` no longer certifies on a host that mounts no seams.** Its predicate is a `conformance` block at the discovery root, deliberately necessary and not sufficient: on a host that does not advertise `conformance.seamsProfile`, every floor leg records `inapplicable`, so the profile is claimed with `witnessCount 0` and not certified. But a floor row is recorded per scenario file, and two floor files had a leg that runs without a seam. openwop-app's production bundle `4683d9f89` (suite 2.45.28) carries a `conformance` block holding only `certificationBundleUrl`, and certified the profile on the facet leg alone.
+  - **The facet leg** of `v2-v1-signed-webhook-accepted` (`0176.v1-signed-webhook-accepted.facet`) moves to `v2-webhooks-v1-scheme-listed`.
+  - **The ledger-read leg** of `v2-effect-identity-business-key` (`0173.effect-identity-business-key`) moves to `v2-effect-ledger-keying`.
+  - Requirement ids are unchanged, and so are the profile's floor files. The floor files keep only their seam-driven legs.
+  - **New coherence check** `seams-floor-legs-gated`: every leg of a seams-profile floor file reaches `seamsProfileAdvertised(` or `era2Gate(` before its first assertion. Proven against both files as they were: each fails, naming its seam-free leg.
+  - **What a host's next bundle shows:** a host that doesn't advertise the seams profile but ran these legs sees `openwop.floor.v2-effect-identity-business-key` and `openwop.floor.v2-v1-signed-webhook-accepted` go `executed-pass` to `inapplicable`, while both requirement ids keep passing under the new files. On MyndHyve that costs no certification, since it doesn't claim the profile. On openwop-app the profile is claimed and not certified, which is the correct outcome. A seams host is unaffected. Bundles already published verify as before.
+
+## [2.45.29] — 2026-10-08 — purpose labels witnessed without a seam; RFC 0241 Accepted
+
+- **`v2-purpose-propagation-onward` witnesses purpose labels through normative operations.** New fixture `conformance-purpose-relay`: routed as the only skill of one agent's A2A card, it relays an inbound A2A message's text to the suite's fake peer through `core.conformance.a2a-invoke`. The suite labels the inbound message with `metadata.openwop.permittedPurposes`, finds the agent through `GET /agents` and `GetExtendedAgentCard`, and reads the onward label at its peer; a nonce matches each onward message to its inbound one. The §22 seam stays as the fallback, and each note names the path. A host with the fixture advertised but no card routing it, or with the suite's peer not running, records `blocked`. Self-test double: a widened label, a dropped label and a call made under `[]` each fail their leg (`lib/purpose-relay-witness.test.ts`). Proven on a seams-off v2 reference host (openwop-examples #166): both rows `executed-pass`, and each defect `executed-fail`. This replaces the planned RFC 0240: the label already arrives on a real carrier.
+- **No scenario change.** RFC 0241 goes `Accepted` on the v2 reference host's certified seams-off cut on 2.45.28; its gaps G1 and G2 close, which changes the packed `spec/v1/gaps.json`.
+
 ## [2.45.28] — 2026-10-08 — two more seam-driven legs, and the backoff ratio, on a public seam-free cut
 
 - **Found by the v2 reference host's first public seams-off cut** (2.45.27, RFC 0241's evidence): all seven target rows `executed-pass`, but four other rows kept the bundle from certifying. Neither shows on a loopback cut.

package/README.md

@@ -137,7 +137,7 @@ Each scenario file records its disposition and assertion count in `<report-dir>/
 
 ## What's Covered
 
-The current suite has 650 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 210 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
+The current suite has 652 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 212 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
 
 The v2 scenarios (`src/scenarios/v2-*.test.ts`) cover, by area:
 
@@ -147,7 +147,7 @@ The v2 scenarios (`src/scenarios/v2-*.test.ts`) cover, by area:
 | Runs | Create, read, list, cancel, bulk cancel, pause/resume, run options and limits, outputs on completion, snapshots | `v2-created-run-readable`, `v2-run-cancel`, `v2-run-pause-resume`, `v2-run-options-limits`, `v2-run-completed-outputs` |
 | Events and streaming | Closed event types, SSE projection, `Last-Event-ID` resumption, poll cursors, terminal-event-once | `v2-stream-sse-projection`, `v2-sse-last-event-id-cursor`, `v2-poll-cursor-v2`, `v2-terminal-event-once` |
 | Errors and headers | The error registry and envelope, malformed bodies, CORS preflight, header scheme | `v2-error-registry`, `v2-malformed-body-envelope`, `v2-cors-preflight`, `v2-header-scheme` |
-| Idempotency | Key grammar, in-flight concurrency, effect identity | `v2-idempotency-key-grammar`, `v2-idempotency-in-flight`, `v2-effect-identity-business-key` |
+| Idempotency | Key grammar, in-flight concurrency, effect identity | `v2-idempotency-key-grammar`, `v2-idempotency-in-flight`, `v2-effect-identity-business-key`, `v2-effect-ledger-keying` |
 | Interrupts and approvals | Resolve after terminal, token scheme, approver enforcement, reject disposition, credential interrupts | `v2-interrupt-resolve-terminal`, `v2-approver-enforced`, `v2-credential-interrupt` |
 | Replay and fork | Fork prefix and ancestry, refusals, replay side-effect suppression, forking a v1 run | `v2-run-fork-prefix`, `v2-run-fork-refusals`, `v2-replay-suppression-ordinal` |
 | Identity, auth and OAuth | Auth challenges, bound ids, workspace scope from identity, OIDC audience, protected-resource metadata, PKCE | `v2-auth-challenge`, `v2-bound-id-kinds`, `v2-oidc-id-token-audience`, `v2-oauth-client-pkce-state-iss` |
@@ -166,7 +166,7 @@ Three kinds of scenario share the tree:
 - **Host** checks drive a live host over HTTP.
 - **Gated** checks run only when the host advertises the family, profile or fixture they need, and otherwise record `inapplicable` or `blocked` with a reason. `--require-behavior` turns an advertised-but-unwitnessable behaviour into a failure.
 
-Current source tree: 650 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
+Current source tree: 652 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
 
 ## How the 2.x suite is built
 

package/coverage.md

@@ -39,11 +39,11 @@ Each scenario that targets major 2 is listed once, under the [`spec/v2/core/`](.
 | [`portability.md`](../spec/v2/core/portability.md) | `v2-portability-advertisement.test.ts` |
 | [`replay.md`](../spec/v2/core/replay.md) | `context-summarization-replay.test.ts`, `memory-attribution-replay-stable.test.ts`, `v2-effect-seam-manifest.test.ts`, `v2-effect-seam-no-refire.test.ts`, `v2-fork-a-v1-run.test.ts`, `v2-nondeterminism-policy-advertisement.test.ts`, `v2-nondeterminism-sources.test.ts`, `v2-replay-suppression-ordinal.test.ts`, `v2-run-fork-prefix.test.ts` |
 | [`runs.md`](../spec/v2/core/runs.md) | `v2-artifact-a2a-shape.test.ts`, `v2-budget-enforcement.test.ts`, `v2-budget-exhaustion-facet.test.ts`, `v2-configurable-closed.test.ts`, `v2-conversation-turn-parts.test.ts`, `v2-created-run-readable.test.ts`, `v2-data-residency-admission.test.ts`, `v2-data-residency-advertisement.test.ts`, `v2-dead-letter-advertisement.test.ts`, `v2-eval-mode-unadvertised-refused.test.ts`, `v2-limits-envelope-caps-advertisement.test.ts`, `v2-run-annotation-not-event.test.ts`, `v2-run-bulk-cancel.test.ts`, `v2-run-cancel.test.ts`, `v2-run-diff-identical.test.ts`, `v2-run-execution-bounds.test.ts`, `v2-run-fork-ancestry.test.ts`, `v2-run-fork-refusals.test.ts`, `v2-run-list.test.ts`, `v2-run-options-limits.test.ts`, `v2-run-pause-resume.test.ts`, `v2-run-snapshot-etag.test.ts` |
-| [`security-defaults.md`](../spec/v2/core/security-defaults.md) | `audit-anomaly-shape.test.ts`, `audit-checkpoint-signature.test.ts`, `audit-checkpoint-vectors.test.ts`, `audit-log-integrity.test.ts`, `inbound-credential-no-passthrough.test.ts`, `v2-compensation-read-projection.test.ts`, `v2-effect-identity-business-key.test.ts`, `v2-pack-isolation.test.ts`, `v2-purpose-propagation-advertisement.test.ts`, `v2-purpose-propagation-onward.test.ts`, `v2-relaxation-recorded.test.ts` |
+| [`security-defaults.md`](../spec/v2/core/security-defaults.md) | `audit-anomaly-shape.test.ts`, `audit-checkpoint-signature.test.ts`, `audit-checkpoint-vectors.test.ts`, `audit-log-integrity.test.ts`, `inbound-credential-no-passthrough.test.ts`, `v2-compensation-read-projection.test.ts`, `v2-effect-identity-business-key.test.ts`, `v2-effect-ledger-keying.test.ts`, `v2-pack-isolation.test.ts`, `v2-purpose-propagation-advertisement.test.ts`, `v2-purpose-propagation-onward.test.ts`, `v2-relaxation-recorded.test.ts` |
 | [`storage.md`](../spec/v2/core/storage.md) | `v2-fs-sandbox-escape-refused.test.ts`, `v2-storage-cross-tenant-isolation.test.ts`, `v2-table-schema-enforcement.test.ts` |
 | [`tool-catalog.md`](../spec/v2/core/tool-catalog.md) | `tool-catalog-compact-projection.test.ts`, `tool-catalog-projection.test.ts`, `tool-descriptor-shape.test.ts`, `v2-tool-catalog-annotations.test.ts` |
 | [`versioning.md`](../spec/v2/core/versioning.md) | `v2-advertised-path-space-served.test.ts`, `v2-client-version-header.test.ts`, `v2-dual-stack-negotiation.test.ts`, `v2-malformed-body-envelope.test.ts`, `v2-min-client-version.test.ts`, `v2-preferred-version-default.test.ts`, `v2-version-header-honored.test.ts`, `v2-well-known-one-resource.test.ts` |
-| [`webhooks.md`](../spec/v2/core/webhooks.md) | `v2-trigger-bridge-delivery.test.ts`, `v2-trigger-dead-letter-read.test.ts`, `v2-v1-signed-webhook-accepted.test.ts`, `v2-webhook-delivery-isolation.test.ts`, `v2-webhook-delivery-shape.test.ts`, `v2-webhook-durable-delivery.test.ts`, `v2-webhook-egress-refusal.test.ts`, `v2-webhook-endpoint-verification.test.ts`, `v2-webhook-generated-secret.test.ts`, `v2-webhook-message-id-stable.test.ts`, `v2-webhook-secret-rotation.test.ts`, `v2-webhook-standard-webhooks-delivery.test.ts`, `v2-webhook-unregister-stops-delivery.test.ts` |
+| [`webhooks.md`](../spec/v2/core/webhooks.md) | `v2-trigger-bridge-delivery.test.ts`, `v2-trigger-dead-letter-read.test.ts`, `v2-v1-signed-webhook-accepted.test.ts`, `v2-webhooks-v1-scheme-listed.test.ts`, `v2-webhook-delivery-isolation.test.ts`, `v2-webhook-delivery-shape.test.ts`, `v2-webhook-durable-delivery.test.ts`, `v2-webhook-egress-refusal.test.ts`, `v2-webhook-endpoint-verification.test.ts`, `v2-webhook-generated-secret.test.ts`, `v2-webhook-message-id-stable.test.ts`, `v2-webhook-secret-rotation.test.ts`, `v2-webhook-standard-webhooks-delivery.test.ts`, `v2-webhook-unregister-stops-delivery.test.ts` |
 | [`workflow-chain-packs.md`](../spec/v2/core/workflow-chain-packs.md) | `v2-chain-pin-exact.test.ts` |
 
 `overview.md`, the introduction to the other documents, has no scenario filed under it.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.28",
-  "stampSha256": "0e47a879900333edf1f01645a54edb7935cf263125d4ab3dc90405f81189d8a3"
+  "version": "2.45.30",
+  "stampSha256": "6288136786dfe99c80a73565b1e77f9b2f5e881fa5c1f140c4d826d3aba15f9c"
 }

package/fixtures/conformance-purpose-relay.json

@@ -0,0 +1,26 @@
+{
+  "id": "conformance-purpose-relay",
+  "name": "Conformance: Purpose Relay",
+  "version": "1.0",
+  "description": "security-defaults.md §Onward hops. Routed as the only skill of one agent's A2A card: an inbound A2A message starts it, and one core.conformance.a2a-invoke node sends that message's text parts on to the A2A peer the operator configured. The suite labels the inbound message with metadata.openwop.permittedPurposes and reads the onward message at its peer. See conformance/fixtures.md.",
+  "nodes": [
+    {
+      "id": "relay",
+      "typeId": "core.conformance.a2a-invoke",
+      "name": "Relay the inbound message",
+      "position": { "x": 0, "y": 0 },
+      "config": {
+        "skill": "echo",
+        "forward": "inbound-message"
+      },
+      "inputs": {}
+    }
+  ],
+  "edges": [],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [],
+  "metadata": { "tags": ["conformance", "a2a", "purpose-propagation"] },
+  "settings": { "timeout": 30000 }
+}

package/fixtures.md

@@ -44,6 +44,7 @@ All fixtures MUST advertise:
 | ----------------------------------------- | ----------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | ---------------------------- |
 | Noop                                      | `conformance-noop`                                                                              | Cheapest possible run-lifecycle test                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `completed`                                                                         | ≤ 5s                         |
 | Nondeterminism Sources | `conformance-nondeterminism` | RFC 0237 §D — one `core.conformance.nondeterminism` node draws one value per source the host lists in `nondeterminismPolicy.sources` into the run outputs; a `replay` fork from `fromSeq: 0` MUST reproduce each | `completed`; replay outputs byte-equal per listed source | ≤ 10s |
+| Purpose Relay | `conformance-purpose-relay` | `security-defaults.md` §Onward hops — the only skill of one agent's A2A card; one `core.conformance.a2a-invoke` node sends the inbound message's text on to the configured peer, re-emitting its `permittedPurposes` label | `completed`, or `failed` when the label is `[]` | ≤ 30s |
 | Identity                                  | `conformance-identity`                                                                          | Verifies input/output passthrough                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `completed`                                                                         | ≤ 5s                         |
 | Delay                                     | `conformance-delay`                                                                             | Verifies poll/SSE behavior over time                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `completed`                                                                         | ≤ 30s (input-controlled)     |
 | Failure                                   | `conformance-failure`                                                                           | Verifies error-event surface                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `failed`                                                                            | ≤ 5s                         |
@@ -160,6 +161,14 @@ The `messages`-mode stream fixture (AI token streaming) is covered by the determ
 - **Expected behavior**: the run reaches `completed`, and `run.completed.outputs` carries one string per listed source. A `replay` fork with `fromSeq: 0` reaches `completed` with byte-equal outputs for every listed source.
 - **Advertise only if** the host lists `nondeterminismPolicy.sources` and records the drawn values. Consumed by `v2-nondeterminism-sources`.
 
+### `conformance-purpose-relay`
+
+- **Purpose**: witness `security-defaults.md` §Onward hops through normative operations: the label arrives on a real carrier (an inbound A2A message's `metadata.openwop.permittedPurposes`) and leaves on a real onward hop. No seam.
+- **Shape**: one node, `relay` (`core.conformance.a2a-invoke`, the reserved typeId `conformance-a2a-task-roundtrip` uses), with `config.forward: "inbound-message"`: it sends the text parts of the A2A message that started the run, unchanged, to the A2A peer the operator configured (the suite's fake peer, `OPENWOP_A2A_FAKE_PEER=true`).
+- **Routing**: the host routes this workflow as the only skill (`skills[].id` = `conformance-purpose-relay`) of one agent in the caller's `GET /agents` inventory, reached through that agent's `a2aTenant` (`interop.md` §Per-agent cards). It is never a skill of the host card, which keeps `conformance-approval` as its one skill.
+- **Expected behavior**: an inbound `SendMessage` to that agent starts one run. With no label, or a non-empty one, the peer receives one `SendMessage` whose text parts equal the inbound ones and, when labelled, whose `metadata.openwop.permittedPurposes` is a subset of the received label. With `[]`, the peer receives nothing; the run's terminal status is the host's.
+- **Advertise only if** the host advertises `purposePropagation` with an onward hop, the `a2a-1.0` profile and `a2a.agentCards`, and its A2A client re-emits labels. Consumed by `v2-purpose-propagation-onward`.
+
 ### `conformance-noop`
 
 - **Purpose**: cheapest run-lifecycle test. Used by `runs-lifecycle.test.ts` (v1) and `v2-created-run-readable.test.ts` (v2), and by most run-surface scenarios, to verify create, read and the terminal event end-to-end.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.28",
+  "version": "2.45.30",
   "description": "Black-box conformance suite for OpenWOP hosts (v2 current; v1 scenarios retained for the frozen v1 tree).",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.28"
+    "@openwop/spec-artifacts": "2.45.30"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 737,
-    "tests": 2782,
-    "withStableId": 2782,
+    "files": 740,
+    "tests": 2783,
+    "withStableId": 2783,
     "interpolatedTitles": 0,
-    "explicitIds": 2644
+    "explicitIds": 2645
   },
   "records": [
     {
@@ -30331,85 +30331,85 @@
       ]
     },
     {
-      "id": "openwop.it.v2-effect-identity-business-key.get-runs-runid-effects-validates-and-every-row-is-keyed-on-business-identity-or",
+      "id": "openwop.it.v2-effect-identity-business-key.the-same-provider-key-is-presented-across-two-transport-retries",
       "file": "v2-effect-identity-business-key.test.ts",
-      "line": 59,
-      "title": "GET /runs/{runId}/effects validates and every row is keyed on business identity or the activity recipe",
-      "explicitId": "openwop.requirement.0173.effect-identity-business-key",
+      "line": 48,
+      "title": "the same provider key is presented across two transport retries",
+      "explicitId": "openwop.requirement.0173.effect-identity-business-key.retry",
       "citations": [
         {
-          "section": "runs.md §Create",
-          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "security-defaults.md §Layer-2 effect identity",
-          "requirement": "a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)"
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "effect-ledger-projection.schema.json",
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "effect-ledger-projection.schema.json runId",
-          "requirement": "runId MUST echo the run read"
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "security-defaults.md §Layer-2 effect identity",
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "RFC 0150 §B",
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "effect-ledger-projection.schema.json providerKey",
-          "requirement": "providerKey is a redaction-safe identity, never credential material"
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": "the key the ledger records MUST be the key the provider received — a ledger that disagrees with the wire is not a witness"
         }
       ]
     },
     {
-      "id": "openwop.it.v2-effect-identity-business-key.the-same-provider-key-is-presented-across-two-transport-retries",
-      "file": "v2-effect-identity-business-key.test.ts",
-      "line": 120,
-      "title": "the same provider key is presented across two transport retries",
-      "explicitId": "openwop.requirement.0173.effect-identity-business-key.retry",
+      "id": "openwop.it.v2-effect-ledger-keying.get-runs-runid-effects-validates-and-every-row-is-keyed-on-business-identity-or",
+      "file": "v2-effect-ledger-keying.test.ts",
+      "line": 42,
+      "title": "GET /runs/{runId}/effects validates and every row is keyed on business identity or the activity recipe",
+      "explicitId": "openwop.requirement.0173.effect-identity-business-key",
       "citations": [
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
-          "requirement": null,
-          "interpolated": true
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
-          "requirement": null,
-          "interpolated": true
+          "section": "security-defaults.md §Layer-2 effect identity",
+          "requirement": "a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)"
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "section": "effect-ledger-projection.schema.json",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
-          "requirement": null,
-          "interpolated": true
+          "section": "effect-ledger-projection.schema.json runId",
+          "requirement": "runId MUST echo the run read"
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "section": "security-defaults.md §Layer-2 effect identity",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "section": "RFC 0150 §B",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
-          "requirement": "the key the ledger records MUST be the key the provider received — a ledger that disagrees with the wire is not a witness"
+          "section": "effect-ledger-projection.schema.json providerKey",
+          "requirement": "providerKey is a redaction-safe identity, never credential material"
         }
       ]
     },
@@ -35437,15 +35437,10 @@
     {
       "id": "openwop.it.v2-purpose-propagation-onward.a-received-label-is-re-emitted-on-the-onward-message-never-widened",
       "file": "v2-purpose-propagation-onward.test.ts",
-      "line": 83,
+      "line": 147,
       "title": "a received label is re-emitted on the onward message, never widened",
       "explicitId": "openwop.requirement.purpose-propagation.onward-reemit-no-widen",
       "citations": [
-        {
-          "section": "spec/v2/core/security-defaults.md §Onward hops",
-          "requirement": null,
-          "interpolated": true
-        },
         {
           "section": "spec/v2/core/security-defaults.md §Onward hops",
           "requirement": null,
@@ -35456,7 +35451,7 @@
     {
       "id": "openwop.it.v2-purpose-propagation-onward.an-empty-label-means-no-onward-call-while-an-unlabelled-control-call-goes-throug",
       "file": "v2-purpose-propagation-onward.test.ts",
-      "line": 102,
+      "line": 164,
       "title": "an empty label means no onward call, while an unlabelled control call goes through",
       "explicitId": "openwop.requirement.purpose-propagation.empty-no-onward",
       "citations": [
@@ -37854,27 +37849,10 @@
         }
       ]
     },
-    {
-      "id": "openwop.it.v2-v1-signed-webhook-accepted.the-webhooks-facet-lists-scheme-v1-the-scheme-a-v1-signed-delivery-is-verified-u",
-      "file": "v2-v1-signed-webhook-accepted.test.ts",
-      "line": 79,
-      "title": "the webhooks facet lists scheme \"v1\" — the scheme a v1-signed delivery is verified under",
-      "explicitId": "openwop.requirement.0176.v1-signed-webhook-accepted.facet",
-      "citations": [
-        {
-          "section": "spec/v2/core/webhooks.md §Surfaces",
-          "requirement": "the webhooks facet is { signatureAlgorithms[] }"
-        },
-        {
-          "section": "spec/v2/core/webhooks.md §Surfaces",
-          "requirement": "signatureAlgorithms MUST list \"v1\" — the cut adds no signature scheme (RFC 0176 §D.2)"
-        }
-      ]
-    },
     {
       "id": "openwop.it.v2-v1-signed-webhook-accepted.the-host-s-v2-receiver-path-accepts-an-x-openwop-only-scheme-v1-delivery-and-ref",
       "file": "v2-v1-signed-webhook-accepted.test.ts",
-      "line": 89,
+      "line": 81,
       "title": "the host's v2 receiver path accepts an X-openwop-*-only scheme-v1 delivery and refuses a tampered one",
       "explicitId": "openwop.requirement.0176.v1-signed-webhook-accepted",
       "citations": [
@@ -38627,6 +38605,23 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-webhooks-v1-scheme-listed.the-webhooks-facet-lists-scheme-v1-the-scheme-a-v1-signed-delivery-is-verified-u",
+      "file": "v2-webhooks-v1-scheme-listed.test.ts",
+      "line": 24,
+      "title": "the webhooks facet lists scheme \"v1\" — the scheme a v1-signed delivery is verified under",
+      "explicitId": "openwop.requirement.0176.v1-signed-webhook-accepted.facet",
+      "citations": [
+        {
+          "section": "spec/v2/core/webhooks.md §Surfaces",
+          "requirement": "the webhooks facet is { signatureAlgorithms[] }"
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §Surfaces",
+          "requirement": "signatureAlgorithms MUST list \"v1\" — the cut adds no signature scheme (RFC 0176 §D.2)"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-well-known-one-resource.a-header-less-get-and-an-openwop-version-2-0-get-are-two-representations-of-one",
       "file": "v2-well-known-one-resource.test.ts",
@@ -44704,6 +44699,30 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.seams-floor-legs-gated.every-leg-of-a-seams-profile-floor-file-reaches-a-seams-gate-before-its-first-as",
+      "file": "seams-floor-legs-gated.test.ts",
+      "line": 84,
+      "title": "every leg of a seams-profile floor file reaches a seams gate before its first assertion",
+      "explicitId": "openwop.it.seams-floor-legs-gated.every-leg-of-a-seams-profile-floor-file-reaches-a-seams-gate-before-its-first-a",
+      "citations": [
+        {
+          "section": "spec/v2/profiles.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/profiles.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/profiles.json",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.semantic-digest-v2.the-digest-recipe-section-is-found-at-all",
       "file": "semantic-digest-v2.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 650,
+    "files": 652,
     "v1": 455,
-    "v2": 210
+    "v2": 212
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1431,6 +1431,9 @@
     "v2-effect-identity-business-key.test.ts": [
       2
     ],
+    "v2-effect-ledger-keying.test.ts": [
+      2
+    ],
     "v2-effect-seam-manifest.test.ts": [
       2
     ],
@@ -1854,6 +1857,9 @@
     "v2-webhook-unregister-stops-delivery.test.ts": [
       2
     ],
+    "v2-webhooks-v1-scheme-listed.test.ts": [
+      2
+    ],
     "v2-well-known-one-resource.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.28",
-  "corpusTag": "v2.45.28",
+  "version": "2.45.30",
+  "corpusTag": "v2.45.30",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "1408a344c243a2a54de2f19b839efd2a9ad45ffa94ab72c2b3e352cbce2804f3",
-    "api/v2/asyncapi.yaml": "84aa6ad5580f097da601bb257a859c8c4ef745051c77d39b5de222c59734a89b",
-    "api/v2/openapi.yaml": "3a85fa3b6d637123554921da4e003a69aabe2c1dc3144b0dd090b68cf0301553",
+    "api/seams-v2.yaml": "87950b612a26253dfce8dd55703b32ca164e61c56ba6d038e40626e3e6d69b1e",
+    "api/v2/asyncapi.yaml": "99aef28ec33b361d146d2b176714122f95c444967de4993f416f54b17a37ac81",
+    "api/v2/openapi.yaml": "97ed2c29a064cfce269dc746503e4059c42093e64590ae828de9f392917698dc",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -118,7 +118,7 @@
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
     "schemas/v2/capabilities.schema.json": "d859a413ff463ec39acc32a9cb76f2e8c7419e45683d6b7f886861765a9c36c7",
-    "schemas/v2/certification-bundle.schema.json": "93fcdfe54b1db168b702bfaf632b60c7a8a602be92c3fe48c81cf25408c2332b",
+    "schemas/v2/certification-bundle.schema.json": "5cfa7fb5247160333e33a58b60d42bcd4e5269d8391d6a112d301e14828892ed",
     "schemas/v2/channel-presence-payload.schema.json": "fc03df0c20cc12a25f7ee6a47503a4c5931d79fe3d5ff24815e8fd7c1bcb9a87",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "92a57db2fd4b2463f14ef155fef8e3f18afc78960b646459dcf32efc79ff6bf5",
@@ -208,14 +208,14 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "22444c22bb88c568339ef512553f9fc38146e22b566d11ab8608f655d688d19c",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "54ae669965b91b6526ce05a6dcc4ce7bbf419dba030e9f23edeb174b1806b3c2",
+    "spec/v1/core-standard-manifest.json": "1b343f616416e2b92ae3c085bc147f6fb23aa9d366a4488431207e3d0f86bd97",
     "spec/v1/deprecations.json": "e723bc11d7272c71789ad1303bb7f21809a8a024abf57594f9d5c35dc199ece9",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "a0aec8f5ddf1002d46a461a9c7d930c8f0656a19b68bb1f52d183b97cc1962cf",
+    "spec/v1/gaps.json": "44a1f30d4dd851ac7609fef7dfbd3f7e55404f97130dbe094132f9cd4b71c468",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -254,7 +254,7 @@
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "3a8d93e33865b692d26a3b6bfd3819766e206b2e0c2a69669baa4bf833d05a49",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "396ac924068f25d4a178062a54e244f870c556c3db9fe7a98fcc933fb318ed30",
+    "spec/v2/declaration.json": "22530d99c92b9e0d3ae0dce25507f4cc6350486d560ad8cc01acda054e9face3",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/eos-override.json": "4c72d2f6a658943b01c1de1643cf294642091933af7832f38ee5495df684cb2d",
     "spec/v2/errors.json": "1f0e29455edbd22e28f67f221766209c3c55ac4987beb77993b5702dd7cae131",
@@ -312,10 +312,10 @@
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
     "spec/v2/path-manifest.json": "7b5679a4dad98c80d855361d88a98c8a4e045af15e310862a05b285b815dc9fc",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
-    "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "1001b6d3376418eda319c7bbd6a1f77f45f39d3574df0b977ca474c1f4f3622c",
+    "spec/v2/profiles.json": "3d84d7712e93d1e823e362615d5f4aaba0789ea4e044b3774965876fbb8829a7",
+    "spec/v2/release.json": "b7dea408ef966d034c55aeb0987fe926d88c4009479bd92816c7c87acfb384cf",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "9553399d274a2d244ba5ac4de7ccc97b6d7ade51ebb92303938fe684d4cb4d2f"
+    "spec/v2/surface-baseline.json": "5f58750fdbd55de45cf31c1f7dee09f68c7b1a40c86d20a046f8c2bc52c0c740"
   },
-  "corpusCommit": "19b9fd8ea3ae511f8d1b461e99d55564db3857e0"
+  "corpusCommit": "0f13b5191bd0e29c8b4a8219a059361e27834ea2"
 }

package/src/lib/purpose-relay-witness.ts

@@ -0,0 +1,54 @@
+/**
+ * Purpose labels on the onward hop, judged from what the suite's A2A peer received
+ * (`spec/v2/core/security-defaults.md` §Onward hops; fixture `conformance-purpose-relay`).
+ *
+ * The scenario labels an inbound A2A message, tags its text with a nonce, and reads
+ * the peer's `SendMessage` calls. These functions find the onward message for a nonce
+ * and judge it, so a self-test double can show each defect failing its leg.
+ */
+
+/** One `SendMessage` the peer received: its JSON-RPC body. */
+export interface PeerSend { readonly body: unknown }
+
+type Msg = { parts?: unknown; metadata?: { openwop?: { permittedPurposes?: unknown } } };
+
+function messageOf(body: unknown): Msg | undefined {
+  return (body as { params?: { message?: Msg } } | undefined)?.params?.message;
+}
+
+/** The text parts of a message body, joined. A2A 1.0 `{ text }` and 0.3 `{ kind: 'text', text }` both count. */
+export function textOf(body: unknown): string {
+  const parts = messageOf(body)?.parts;
+  if (!Array.isArray(parts)) return '';
+  return parts.map((p) => (typeof (p as { text?: unknown })?.text === 'string' ? (p as { text: string }).text : '')).join('');
+}
+
+/** The onward sends carrying `nonce` in their text: the relay of one inbound message. */
+export function relaysOf(sends: readonly PeerSend[], nonce: string): PeerSend[] {
+  return sends.filter((s) => textOf(s.body).includes(nonce));
+}
+
+/** The label an onward message carries, as sent. */
+export function labelOf(body: unknown): unknown {
+  return messageOf(body)?.metadata?.openwop?.permittedPurposes;
+}
+
+export type Verdict = { ok: true } | { ok: false; reason: string };
+
+/** A received label MUST be re-emitted on the onward message, narrowing and never widening. */
+export function judgeReemit(received: readonly string[], onward: unknown): Verdict {
+  if (!Array.isArray(onward)) return { ok: false, reason: `the onward message carries no metadata.openwop.permittedPurposes (got ${JSON.stringify(onward)})` };
+  const widened = onward.map(String).filter((p) => !received.includes(p));
+  if (widened.length > 0) return { ok: false, reason: `the onward label widens the received one ${JSON.stringify(received)}: it adds ${JSON.stringify(widened)}` };
+  return { ok: true };
+}
+
+/**
+ * `[]` means no onward use. `controlRelays` is what an unlabelled control message
+ * produced: with none, a missing relay under `[]` proves nothing (`blocked`).
+ */
+export function judgeEmpty(controlRelays: number, emptyRelays: number): Verdict | 'blocked' {
+  if (controlRelays === 0) return 'blocked';
+  if (emptyRelays > 0) return { ok: false, reason: `the peer received ${emptyRelays} message(s) relaying the []-labelled data` };
+  return { ok: true };
+}

package/src/scenarios/v2-effect-identity-business-key.test.ts

@@ -10,20 +10,19 @@
  * state, at }`, content-free of provider payloads (RFC 0150 §B; RFC 0173 §B row
  * C6.7; `spec/v2/core/security-defaults.md` §Layer-2 effect identity).
  *
- * Legs:
- *   1. the ledger read validates on a run of the noop fixture and every row's
- *      `keying` is one of the two documented modes;
- *   2. the "same provider key across two transport retries" leg needs the
- *      suite's fixture provider (RFC 0173 §D.2 G4 — a provider that rejects a
- *      changed key) driven through the seams profile; no such seam is
- *      catalogued, so that leg records `blocked` naming it.
+ * One leg: the "same provider key across two transport retries" leg, driven
+ * through the seams profile (`forceEffectTransportRetry`, RFC 0173 §D.2 G4).
+ * This file is a floor of `openwop-conformance-seams-v2`, so every leg in it
+ * MUST be seam-driven (`coherence/seams-floor-legs-gated.test.ts`). The
+ * seam-free ledger-read leg lives in `v2-effect-ledger-keying.test.ts` since
+ * 2.45.30: here it passed the floor on hosts that mount no seams.
  *
  * @see spec/v2/core/security-defaults.md §Layer-2 effect identity
  */
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
-import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
 import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
 import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { startEffectReceiver } from '../lib/effect-receiver.js';
@@ -38,85 +37,14 @@ import { req } from '../lib/requirement-ids.js';
  */
 export const REQUIRES_HOST_CALLBACK = 'the host makes the retried outbound effect call to the suite-owned effect receiver (OPENWOP_WEBHOOK_RECEIVER_PORT)';
 
-const FIXTURE = 'conformance-noop';
 const KEYING = ['business-identity', 'activity-recipe'];
-const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
 
 async function discovery(): Promise<Record<string, unknown> | null> {
   try { return await v2Discovery(); } catch { return null; }
 }
 
-async function waitTerminal(runId: string, timeoutMs: number): Promise<void> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const res = await driver.get(`/runs/${encodeURIComponent(runId)}`);
-    if (res.status === 200 && TERMINAL.has(String((res.json as { status?: unknown } | null)?.status))) return;
-    await new Promise((r) => setTimeout(r, 250));
-  }
-}
 
 describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)', () => {
-  it('GET /runs/{runId}/effects validates and every row is keyed on business identity or the activity recipe', async () => {
-    const doc = await discovery();
-    if (!doc) return softSkip('blocked', 'discovery unreachable');
-    if (!(await gateFamily('idempotency'))) return softSkip('inapplicable', 'idempotency family not advertised — no Layer-2 obligation (gate recorded under openwop.family.idempotency)');
-    const fixtures = Array.isArray(doc['fixtures']) ? (doc['fixtures'] as unknown[]) : [];
-    if (!fixtures.includes(FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to read`);
-
-    // Unfailable-leg audit (2026-09-26): the noop fixture issues no effects, so
-    // the per-row loop asserted nothing on any host, and the trailing
-    // `softSkip('inapplicable')` (called without `return`, after four passing
-    // setup asserts) recorded `executed-pass` with a `partial-witness:` detail —
-    // a host that mis-keyed every effect passed this row. Now no expect passes
-    // before the empty-ledger check: a failing setup read still fails, and an
-    // empty but well-formed ledger returns `inapplicable` with zero assertions.
-    const create = await driver.post('/runs', { workflowId: FIXTURE });
-    if (create.status !== 201) {
-      expect(create.status, req('openwop.requirement.0173.effect-identity-business-key', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
-    }
-    const runId = (create.json as { runId: string }).runId;
-    await waitTerminal(runId, 10_000);
-
-    const res = await driver.get(`/runs/${encodeURIComponent(runId)}/effects`);
-    const check = v2Validator('effect-ledger-projection')(res.json);
-    const body = res.json as { runId?: unknown; effects?: Array<{ effectId?: unknown; keying?: unknown; providerKey?: unknown }> } | null;
-    const effects = body?.effects ?? [];
-    if (res.status === 200 && check.ok && body?.runId === runId && effects.length === 0) {
-      // partial-witness-ok: no assertion has passed at runtime. The only earlier
-      // expect runs solely when the create is not 201, and then it throws, so this
-      // skip is a zero-assertion `inapplicable` (the gate reads source order).
-      return softSkip('inapplicable', 'the noop fixture issued no external effect — the ledger read is well-formed but the per-row keying leg had no rows (an effect-issuing fixture would exercise it)');
-    }
-    expect(
-      res.status,
-      req('openwop.requirement.0173.effect-identity-business-key', 'security-defaults.md §Layer-2 effect identity', 'a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)'),
-    ).toBe(200);
-    expect(
-      check.ok,
-      req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json', `the ledger projection MUST validate: ${check.errors}`),
-    ).toBe(true);
-    expect(body?.runId, req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json runId', 'runId MUST echo the run read')).toBe(runId);
-    const ids = new Set<string>();
-    for (const e of effects) {
-      expect(
-        KEYING,
-        req('openwop.requirement.0173.effect-identity-business-key', 'security-defaults.md §Layer-2 effect identity', `keying MUST be business-identity or activity-recipe (the documented fallback) — effect ${String(e.effectId)} declares ${String(e.keying)}`),
-      ).toContain(e.keying);
-      // One logical effect id per effect: a duplicate row is a re-assignment.
-      expect(
-        ids.has(String(e.effectId)),
-        req('openwop.requirement.0173.effect-identity-business-key', 'RFC 0150 §B', `effectId ${String(e.effectId)} MUST be assigned once per effect (duplicate ledger row)`),
-      ).toBe(false);
-      ids.add(String(e.effectId));
-      if (typeof e.providerKey === 'string') {
-        expect(
-          /(secret|bearer |sk-[a-z0-9]{8,})/i.test(e.providerKey),
-          req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json providerKey', 'providerKey is a redaction-safe identity, never credential material'),
-        ).toBe(false);
-      }
-    }
-  });
-
   it('the same provider key is presented across two transport retries', async () => {
     const doc = await discovery();
     if (!doc) return softSkip('blocked', 'discovery unreachable');

package/src/scenarios/v2-effect-ledger-keying.test.ts

@@ -0,0 +1,102 @@
+/**
+ * RFC 0173 §B — the effect ledger read and its keying (suite 2.45.30, target
+ * major 2; gated on `idempotency` and the `conformance-noop` fixture).
+ *
+ * A host that advertises `idempotency` serves `GET /runs/{runId}/effects`
+ * (`schemas/v2/effect-ledger-projection.schema.json`); every row's `keying` is
+ * `business-identity` or the documented fallback `activity-recipe`, each
+ * effect id is assigned once, and `providerKey` is never credential material
+ * (RFC 0150 §B; `spec/v2/core/security-defaults.md` §Layer-2 effect identity).
+ *
+ * This leg needs no seam. Until 2.45.30 it was the first leg of
+ * `v2-effect-identity-business-key`, a floor of `openwop-conformance-seams-v2`,
+ * and its pass certified that profile on hosts that mount no seams.
+ *
+ * @see spec/v2/core/security-defaults.md §Layer-2 effect identity
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const FIXTURE = 'conformance-noop';
+const KEYING = ['business-identity', 'activity-recipe'];
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+async function waitTerminal(runId: string, timeoutMs: number): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const res = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+    if (res.status === 200 && TERMINAL.has(String((res.json as { status?: unknown } | null)?.status))) return;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+}
+
+describe('RFC 0173 §B — effect ledger keying (gated on idempotency)', () => {
+  it('GET /runs/{runId}/effects validates and every row is keyed on business identity or the activity recipe', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    if (!(await gateFamily('idempotency'))) return softSkip('inapplicable', 'idempotency family not advertised — no Layer-2 obligation (gate recorded under openwop.family.idempotency)');
+    const fixtures = Array.isArray(doc['fixtures']) ? (doc['fixtures'] as unknown[]) : [];
+    if (!fixtures.includes(FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to read`);
+
+    // Unfailable-leg audit (2026-09-26): the noop fixture issues no effects, so
+    // the per-row loop asserted nothing on any host, and the trailing
+    // `softSkip('inapplicable')` (called without `return`, after four passing
+    // setup asserts) recorded `executed-pass` with a `partial-witness:` detail —
+    // a host that mis-keyed every effect passed this row. Now no expect passes
+    // before the empty-ledger check: a failing setup read still fails, and an
+    // empty but well-formed ledger returns `inapplicable` with zero assertions.
+    const create = await driver.post('/runs', { workflowId: FIXTURE });
+    if (create.status !== 201) {
+      expect(create.status, req('openwop.requirement.0173.effect-identity-business-key', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    }
+    const runId = (create.json as { runId: string }).runId;
+    await waitTerminal(runId, 10_000);
+
+    const res = await driver.get(`/runs/${encodeURIComponent(runId)}/effects`);
+    const check = v2Validator('effect-ledger-projection')(res.json);
+    const body = res.json as { runId?: unknown; effects?: Array<{ effectId?: unknown; keying?: unknown; providerKey?: unknown }> } | null;
+    const effects = body?.effects ?? [];
+    if (res.status === 200 && check.ok && body?.runId === runId && effects.length === 0) {
+      // partial-witness-ok: no assertion has passed at runtime. The only earlier
+      // expect runs solely when the create is not 201, and then it throws, so this
+      // skip is a zero-assertion `inapplicable` (the gate reads source order).
+      return softSkip('inapplicable', 'the noop fixture issued no external effect — the ledger read is well-formed but the per-row keying leg had no rows (an effect-issuing fixture would exercise it)');
+    }
+    expect(
+      res.status,
+      req('openwop.requirement.0173.effect-identity-business-key', 'security-defaults.md §Layer-2 effect identity', 'a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)'),
+    ).toBe(200);
+    expect(
+      check.ok,
+      req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json', `the ledger projection MUST validate: ${check.errors}`),
+    ).toBe(true);
+    expect(body?.runId, req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json runId', 'runId MUST echo the run read')).toBe(runId);
+    const ids = new Set<string>();
+    for (const e of effects) {
+      expect(
+        KEYING,
+        req('openwop.requirement.0173.effect-identity-business-key', 'security-defaults.md §Layer-2 effect identity', `keying MUST be business-identity or activity-recipe (the documented fallback) — effect ${String(e.effectId)} declares ${String(e.keying)}`),
+      ).toContain(e.keying);
+      // One logical effect id per effect: a duplicate row is a re-assignment.
+      expect(
+        ids.has(String(e.effectId)),
+        req('openwop.requirement.0173.effect-identity-business-key', 'RFC 0150 §B', `effectId ${String(e.effectId)} MUST be assigned once per effect (duplicate ledger row)`),
+      ).toBe(false);
+      ids.add(String(e.effectId));
+      if (typeof e.providerKey === 'string') {
+        expect(
+          /(secret|bearer |sk-[a-z0-9]{8,})/i.test(e.providerKey),
+          req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json providerKey', 'providerKey is a redaction-safe identity, never credential material'),
+        ).toBe(false);
+      }
+    }
+  });
+});

package/src/scenarios/v2-purpose-propagation-onward.test.ts

@@ -1,41 +1,53 @@
 /**
  * v2 — purpose labels on the onward hop (`spec/v2/core/security-defaults.md`
- * §Onward hops; suite 2.45.23, target major 2; seam-gated).
+ * §Onward hops; suite 2.45.23, target major 2; relay path suite 2.45.29).
  *
  * A host advertising `purposePropagation` MUST re-emit a `permittedPurposes`
  * label it received on every onward hop of the same data, narrowing and never
- * widening, and MUST treat `[]` as no onward use. The v1 twin read a
- * self-reported forward seam; this file observes a real onward hop instead.
- * The suite plays both ends: it hands the host a label through the §22 `invoke`
- * seam (`permittedPurposes`), and its fake A2A peer receives what the host's
- * production A2A client actually sends.
+ * widening, and MUST treat `[]` as no onward use. The suite plays both ends.
  *
- *   onward-reemit-no-widen   the onward message carries
- *                            `metadata.openwop.permittedPurposes`, a subset of
- *                            the label sent;
- *   empty-no-onward          with `[]` the host makes no onward call, while an
- *                            unlabelled control call through the same seam
- *                            reaches the peer (non-arrival is evidence, not a
- *                            dead pipe).
+ * Two ways in, the first preferred:
  *
- * Not here: the derived-output rule (a merge of labelled inputs carries their
- * intersection) needs two inputs on one hop; the seam forwards one.
+ *   relay   normative operations only. The suite sends an A2A `SendMessage`,
+ *           labelled with `metadata.openwop.permittedPurposes`, to the agent whose
+ *           card routes the fixture `conformance-purpose-relay` (found through
+ *           `GET /agents` and `GetExtendedAgentCard`, `interop.md` §Per-agent
+ *           cards). The fixture relays the message's text to the suite's shared
+ *           fake A2A peer, which reads the onward label. A nonce in the text
+ *           matches each onward message to its inbound one.
+ *   seam    the §22 `invoke` seam takes `permittedPurposes` and a peer URL.
+ *
+ *   onward-reemit-no-widen   the onward message carries the label, a subset of
+ *                            the one received;
+ *   empty-no-onward          with `[]` nothing reaches the peer, while an
+ *                            unlabelled control message does (non-arrival is
+ *                            evidence, not a dead pipe).
+ *
+ * Not here: a merge of labelled inputs carrying their intersection is RFC 0128
+ * §3 text that v2 prose does not state.
  *
  * Dispositions: discovery unreadable ⇒ `blocked`; `purposePropagation` absent,
- * `propagatesOnward` false, `a2a` absent or no seams profile ⇒ `inapplicable`;
- * seam unwired ⇒ `seamAbsent`.
+ * `propagatesOnward` false or `a2a` absent ⇒ `inapplicable`; neither the relay
+ * (`a2a-1.0` + `agentCards` + the fixture advertised) nor the seams profile ⇒
+ * `inapplicable`; the fixture advertised but no card routing it, or the suite's
+ * fake peer not running ⇒ `blocked`; seam unwired ⇒ `seamAbsent`. Each note names
+ * the path used.
  *
  * @see spec/v2/core/security-defaults.md §Onward hops
+ * @see conformance/fixtures.md §conformance-purpose-relay
  * @see spec/v1/host-sample-test-seams.md §22
  */
 
 import { describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery, familyAdvertised } from '../lib/v2.js';
 import { SEAMS_PREFIX, seamsProfileAdvertised } from '../lib/seams.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
-import { A2AFakePeer, type A2APeerInvocation } from '../lib/a2a-fake-peer.js';
+import { A2AFakePeer, getA2AFakePeer, type A2APeerInvocation } from '../lib/a2a-fake-peer.js';
+import { relaysOf, labelOf, judgeReemit, judgeEmpty, type PeerSend } from '../lib/purpose-relay-witness.js';
 
 export const REQUIRES_HOST_CALLBACK = "the host's A2A client calls the suite's fake A2A peer";
 
@@ -43,6 +55,7 @@ const DOC = 'spec/v2/core/security-defaults.md §Onward hops';
 const ID_REEMIT = 'openwop.requirement.purpose-propagation.onward-reemit-no-widen';
 const ID_EMPTY = 'openwop.requirement.purpose-propagation.empty-no-onward';
 const SEAM = `${SEAMS_PREFIX}/sample/a2a/invoke`;
+const RELAY = 'conformance-purpose-relay';
 const LABEL = ['openwop-conformance-analytics', 'openwop-conformance-support'];
 
 async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
@@ -52,68 +65,120 @@ async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse
 type Skip = { kind: 'blocked' | 'inapplicable' | 'seam'; reason: string };
 const skip = (s: Skip): undefined => (s.kind === 'seam' ? seamAbsent(s.reason) : softSkip(s.kind, s.reason));
 
-async function gate(): Promise<Skip | null> {
+/** The relay agent: the host's JSONRPC 1.0 interface and the agent's routing value. */
+interface Relay { kind: 'relay'; rpcUrl: string; tenant: string; peer: A2AFakePeer }
+type Path = Relay | { kind: 'seam' };
+
+async function rpc(url: string, method: string, params: unknown): Promise<{ status: number; result?: Record<string, unknown>; error?: unknown } | null> {
+  const headers: Record<string, string> = { 'content-type': 'application/json', accept: 'application/json', 'A2A-Version': '1.0' };
+  const key = process.env['OPENWOP_API_KEY'];
+  if (key) headers['authorization'] = `Bearer ${key}`;
+  try {
+    const res = await fetch(url, { method: 'POST', headers, body: JSON.stringify({ jsonrpc: '2.0', id: randomBytes(4).readUInt32BE(0), method, params }) });
+    const body = (await res.json().catch(() => ({}))) as { result?: Record<string, unknown>; error?: unknown };
+    return { status: res.status, ...(body.result !== undefined ? { result: body.result } : {}), ...(body.error !== undefined ? { error: body.error } : {}) };
+  } catch {
+    return null;
+  }
+}
+
+/** Find the agent whose card routes the relay fixture; a Skip when the relay cannot be driven. */
+async function relayPath(a2a: Record<string, unknown>): Promise<Relay | Skip> {
+  const peer = getA2AFakePeer();
+  if (peer === null) return { kind: 'blocked', reason: `relay path: the host advertises ${RELAY}, whose onward peer is the suite's fake A2A peer, and OPENWOP_A2A_FAKE_PEER is not enabled` };
+  const cardUrl = a2a['agentCardUrl'];
+  if (typeof cardUrl !== 'string') return { kind: 'blocked', reason: 'relay path: a2a.agentCardUrl is not advertised' };
+  const card = await fetch(cardUrl, { headers: { accept: 'application/json', 'A2A-Version': '1.0' } }).then((r) => r.json() as Promise<{ supportedInterfaces?: Array<{ url?: string; protocolBinding?: string; protocolVersion?: string }> }>).catch(() => null);
+  const rpcUrl = card?.supportedInterfaces?.find((i) => i.protocolBinding === 'JSONRPC' && i.protocolVersion === '1.0')?.url;
+  if (typeof rpcUrl !== 'string') return { kind: 'blocked', reason: `relay path: the public card at ${cardUrl} lists no JSONRPC 1.0 interface` };
+  const inv = await http(() => driver.get('/agents'));
+  const agents = inv?.status === 200 ? ((inv.json as { agents?: Array<{ a2aTenant?: unknown }> } | undefined)?.agents ?? []) : [];
+  for (const a of agents) {
+    if (typeof a.a2aTenant !== 'string') continue;
+    const c = await rpc(rpcUrl, 'GetExtendedAgentCard', { tenant: a.a2aTenant });
+    const skills = (c?.result?.['skills'] as Array<{ id?: unknown }> | undefined) ?? [];
+    if (skills.length === 1 && skills[0]?.id === RELAY) return { kind: 'relay', rpcUrl, tenant: a.a2aTenant, peer };
+  }
+  return { kind: 'blocked', reason: `relay path: the host advertises ${RELAY}, but no agent in the caller's GET /agents has a card whose only skill is ${RELAY}` };
+}
+
+async function gate(): Promise<Path | Skip> {
   let doc: Record<string, unknown> | null;
   try { doc = await v2Discovery(); } catch { doc = null; }
   if (!doc) return { kind: 'blocked', reason: 'v2 discovery unreachable' };
   const pp = await familyAdvertised('purposePropagation');
   if (pp === null) return { kind: 'inapplicable', reason: 'the host does not advertise purposePropagation' };
   if (pp['propagatesOnward'] === false) return { kind: 'inapplicable', reason: 'purposePropagation.propagatesOnward is false — the host has no onward hop' };
-  if (!(await familyAdvertised('a2a'))) return { kind: 'inapplicable', reason: 'a2a not advertised — the onward hop observed here is the host A2A client' };
-  if (!seamsProfileAdvertised(doc)) return { kind: 'inapplicable', reason: 'the onward hop is driven through the §22 invoke seam — the seams profile is not advertised' };
-  return null;
+  const a2a = await familyAdvertised('a2a');
+  if (a2a === null) return { kind: 'inapplicable', reason: 'a2a not advertised — the onward hop observed here is the host A2A client' };
+  const profiles = Array.isArray(a2a['profiles']) ? (a2a['profiles'] as unknown[]) : [];
+  if (profiles.includes('a2a-1.0') && a2a['agentCards'] === true && isFixtureAdvertised(RELAY)) return relayPath(a2a);
+  if (seamsProfileAdvertised(doc)) return { kind: 'seam' };
+  return { kind: 'inapplicable', reason: `neither path is offered: the relay needs the a2a-1.0 profile, a2a.agentCards and the ${RELAY} fixture; the §22 invoke seam needs the seams profile` };
 }
 
 /** The message sends the peer received. */
 const sends = (peer: A2AFakePeer): A2APeerInvocation[] => peer.invocations().filter((i) => i.rpcMethod === 'SendMessage' || i.rpcMethod === 'message/send');
 
-function labelOf(inv: A2APeerInvocation): unknown {
-  const body = inv.body as { params?: { message?: { metadata?: { openwop?: { permittedPurposes?: unknown } } } } } | undefined;
-  return body?.params?.message?.metadata?.openwop?.permittedPurposes;
+/**
+ * Cause one onward hop of `nonce`, labelled or not. Relay: an inbound SendMessage,
+ * which blocks until the run is terminal (interop-map a2a SendMessage). Seam: §22.
+ * Returns the onward sends carrying the nonce, or a Skip.
+ */
+async function cause(path: Path, peer: A2AFakePeer, nonce: string, permittedPurposes?: string[]): Promise<PeerSend[] | Skip> {
+  if (path.kind === 'relay') {
+    const message = { messageId: `purpose-${nonce}`, role: 'ROLE_USER', parts: [{ text: `relay ${nonce}` }], ...(permittedPurposes ? { metadata: { openwop: { permittedPurposes } } } : {}) };
+    const r = await rpc(path.rpcUrl, 'SendMessage', { tenant: path.tenant, message });
+    if (r === null) return { kind: 'blocked', reason: `relay path: SendMessage to ${path.rpcUrl} failed to connect` };
+    if (r.status >= 400 && permittedPurposes?.length !== 0) return { kind: 'blocked', reason: `relay path: SendMessage answered HTTP ${r.status}` };
+  } else {
+    const res = await http(() => driver.post(SEAM, { peerUrl: peer.hostFacingEndpoint(), ...(permittedPurposes ? { permittedPurposes } : {}) }));
+    if (res === null) return { kind: 'blocked', reason: `${SEAM} unreachable (fetch failed)` };
+    if (res.status === 404 || res.status === 405) return { kind: 'seam', reason: `${SEAM} not mounted (${res.status}) — host-sample-test-seams.md §22` };
+    // The seam's onward message carries no nonce: every send after the call is its relay.
+    return sends(peer).map((i) => ({ body: i.body }));
+  }
+  return relaysOf(sends(peer).map((i) => ({ body: i.body })), nonce);
 }
 
-async function invoke(peer: A2AFakePeer, permittedPurposes?: string[]): Promise<OpenWOPResponse | Skip> {
-  const res = await http(() => driver.post(SEAM, { peerUrl: peer.hostFacingEndpoint(), ...(permittedPurposes ? { permittedPurposes } : {}) }));
-  if (res === null) return { kind: 'blocked', reason: `${SEAM} unreachable (fetch failed)` };
-  if (res.status === 404 || res.status === 405) return { kind: 'seam', reason: `${SEAM} not mounted (${res.status}) — host-sample-test-seams.md §22` };
-  return res;
-}
+const nonce = (): string => `n-${randomBytes(6).toString('hex')}`;
 
-describe('v2 purpose labels on the onward hop (security-defaults.md §Onward hops — seam-gated)', () => {
+describe('v2 purpose labels on the onward hop (security-defaults.md §Onward hops)', () => {
   it('a received label is re-emitted on the onward message, never widened', async () => {
     const g = await gate();
-    if (g) return skip(g);
-    const peer = new A2AFakePeer({ protocolVersions: ['1.0'] });
-    await peer.start();
+    if ('reason' in g) return skip(g);
+    const peer = g.kind === 'relay' ? g.peer : new A2AFakePeer({ protocolVersions: ['1.0'] });
+    if (g.kind === 'seam') await peer.start();
     try {
-      const res = await invoke(peer, LABEL);
-      if (!('status' in res)) return skip(res);
-      const sent = sends(peer)[0];
-      if (sent === undefined) return softSkip('blocked', `the seam answered ${res.status} and the suite peer received no message — the host's A2A client never reached it`);
-      const label = labelOf(sent);
-      expect(Array.isArray(label), req(ID_REEMIT, DOC, `the onward message MUST carry the received label as metadata.openwop.permittedPurposes (got ${JSON.stringify(label)})`)).toBe(true);
-      const widened = (Array.isArray(label) ? label : []).filter((p) => !LABEL.includes(String(p)));
-      expect(widened, req(ID_REEMIT, DOC, `the onward label MUST NOT widen the received one (${JSON.stringify(LABEL)}); it added ${JSON.stringify(widened)}`)).toEqual([]);
+      const relayed = await cause(g, peer, nonce(), LABEL);
+      if (!Array.isArray(relayed)) return skip(relayed);
+      const sent = relayed[0];
+      if (sent === undefined) return softSkip('blocked', `${g.kind} path: the labelled data never reached the suite peer, so there is no onward message to read`);
+      const v = judgeReemit(LABEL, labelOf(sent.body));
+      expect(v.ok ? '' : v.reason, req(ID_REEMIT, DOC, `${g.kind} path: the onward message MUST carry the received label as metadata.openwop.permittedPurposes, never widened`)).toBe('');
     } finally {
-      await peer.stop();
+      if (g.kind === 'seam') await peer.stop();
     }
   });
 
   it('an empty label means no onward call, while an unlabelled control call goes through', async () => {
     const g = await gate();
-    if (g) return skip(g);
-    const peer = new A2AFakePeer({ protocolVersions: ['1.0'] });
-    await peer.start();
+    if ('reason' in g) return skip(g);
+    const peer = g.kind === 'relay' ? g.peer : new A2AFakePeer({ protocolVersions: ['1.0'] });
+    if (g.kind === 'seam') await peer.start();
     try {
-      const control = await invoke(peer);
-      if (!('status' in control)) return skip(control);
+      const control = await cause(g, peer, nonce());
+      if (!Array.isArray(control)) return skip(control);
       const before = sends(peer).length;
-      if (before === 0) return softSkip('blocked', `the unlabelled control call answered ${control.status} but reached no peer, so a missing call under [] would prove nothing`);
-      const res = await invoke(peer, []);
-      if (!('status' in res)) return skip(res);
-      expect(sends(peer).length - before, req(ID_EMPTY, DOC, `a host MUST treat [] as no onward use: the seam answered ${res.status}, and the peer received ${sends(peer).length - before} message(s) for the []-labelled data`)).toBe(0);
+      const empty = await cause(g, peer, nonce(), []);
+      if (!Array.isArray(empty)) return skip(empty);
+      // The seam's sends carry no nonce: count what arrived after the control.
+      const emptyRelays = g.kind === 'seam' ? sends(peer).length - before : empty.length;
+      const v = judgeEmpty(control.length, emptyRelays);
+      if (v === 'blocked') return softSkip('blocked', `${g.kind} path: the unlabelled control message reached no peer, so a missing call under [] would prove nothing`);
+      expect(v.ok ? '' : v.reason, req(ID_EMPTY, DOC, `${g.kind} path: a host MUST treat [] as no onward use`)).toBe('');
     } finally {
-      await peer.stop();
+      if (g.kind === 'seam') await peer.stop();
     }
   });
 });

package/src/scenarios/v2-v1-signed-webhook-accepted.test.ts

@@ -7,8 +7,10 @@
  * HMAC-SHA256 with the subscription secret); this adds no signature scheme and
  * per-subscription secrets are unchanged across the cut (`spec/v2/core/webhooks.md`
  * §Dual emission through the overlap; persistence.md §Everything else a v1 host
- * persisted; migration row C9.9). The facet's `signatureAlgorithms[]` MUST list
- * `"v1"` (webhooks.md §Surfaces).
+ * persisted; migration row C9.9). The facet check (`signatureAlgorithms[]` lists
+ * `"v1"`) needs no seam and lives in `v2-webhooks-v1-scheme-listed.test.ts`
+ * since 2.45.30: this file is a floor of `openwop-conformance-seams-v2`, so
+ * every leg in it MUST be seam-driven (`coherence/seams-floor-legs-gated.test.ts`).
  *
  * The receiver under test is the HOST's inbound receiver path — the v2 host as
  * a subscriber (its trigger bridge, its A2A/MCP peer callbacks) — which the
@@ -76,16 +78,6 @@ async function deliver(secret: string, delivery: { headers: Record<string, strin
 }
 
 describe('RFC 0176 §D.2 — v1-signed-webhook-accepted (gated on webhooks + seams)', () => {
-  it('the webhooks facet lists scheme "v1" — the scheme a v1-signed delivery is verified under', async () => {
-    const doc = await discovery();
-    if (!doc) return softSkip('blocked', 'discovery unreachable');
-    const webhooks = await gateFamily('webhooks');
-    if (!webhooks) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
-    const algorithms = webhooks['signatureAlgorithms'];
-    expect(Array.isArray(algorithms), req('openwop.requirement.0176.v1-signed-webhook-accepted.facet', 'spec/v2/core/webhooks.md §Surfaces', 'the webhooks facet is { signatureAlgorithms[] }')).toBe(true);
-    expect(algorithms, req('openwop.requirement.0176.v1-signed-webhook-accepted.facet', 'spec/v2/core/webhooks.md §Surfaces', 'signatureAlgorithms MUST list "v1" — the cut adds no signature scheme (RFC 0176 §D.2)')).toContain('v1');
-  });
-
   it('the host\'s v2 receiver path accepts an X-openwop-*-only scheme-v1 delivery and refuses a tampered one', async () => {
     const doc = await discovery();
     if (!doc) return softSkip('blocked', 'discovery unreachable');

package/src/scenarios/v2-webhooks-v1-scheme-listed.test.ts

@@ -0,0 +1,33 @@
+/**
+ * RFC 0176 §D.2 — the webhooks facet lists scheme `v1` (suite 2.45.30, target
+ * major 2; gated on `webhooks`).
+ *
+ * The facet's `signatureAlgorithms[]` MUST list `"v1"`: the cut adds no
+ * signature scheme, so a v1-signed delivery is verified under it
+ * (`spec/v2/core/webhooks.md` §Surfaces). Until 2.45.30 this was the first leg
+ * of `v2-v1-signed-webhook-accepted`, a floor of `openwop-conformance-seams-v2`,
+ * and its pass certified that profile on hosts that mount no seams.
+ *
+ * @see spec/v2/core/webhooks.md §Surfaces
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+describe('RFC 0176 §D.2 — the webhooks facet lists scheme v1 (gated on webhooks)', () => {
+  it('the webhooks facet lists scheme "v1" — the scheme a v1-signed delivery is verified under', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const webhooks = await gateFamily('webhooks');
+    if (!webhooks) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
+    const algorithms = webhooks['signatureAlgorithms'];
+    expect(Array.isArray(algorithms), req('openwop.requirement.0176.v1-signed-webhook-accepted.facet', 'spec/v2/core/webhooks.md §Surfaces', 'the webhooks facet is { signatureAlgorithms[] }')).toBe(true);
+    expect(algorithms, req('openwop.requirement.0176.v1-signed-webhook-accepted.facet', 'spec/v2/core/webhooks.md §Surfaces', 'signatureAlgorithms MUST list "v1" — the cut adds no signature scheme (RFC 0176 §D.2)')).toContain('v1');
+  });
+});