@openwop/openwop-conformance 2.45.29 → 2.45.30

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.30] — 2026-10-09 — the seams profile floor is seam-driven
+
+- **`openwop-conformance-seams-v2` no longer certifies on a host that mounts no seams.** Its predicate is a `conformance` block at the discovery root, deliberately necessary and not sufficient: on a host that does not advertise `conformance.seamsProfile`, every floor leg records `inapplicable`, so the profile is claimed with `witnessCount 0` and not certified. But a floor row is recorded per scenario file, and two floor files had a leg that runs without a seam. openwop-app's production bundle `4683d9f89` (suite 2.45.28) carries a `conformance` block holding only `certificationBundleUrl`, and certified the profile on the facet leg alone.
+  - **The facet leg** of `v2-v1-signed-webhook-accepted` (`0176.v1-signed-webhook-accepted.facet`) moves to `v2-webhooks-v1-scheme-listed`.
+  - **The ledger-read leg** of `v2-effect-identity-business-key` (`0173.effect-identity-business-key`) moves to `v2-effect-ledger-keying`.
+  - Requirement ids are unchanged, and so are the profile's floor files. The floor files keep only their seam-driven legs.
+  - **New coherence check** `seams-floor-legs-gated`: every leg of a seams-profile floor file reaches `seamsProfileAdvertised(` or `era2Gate(` before its first assertion. Proven against both files as they were: each fails, naming its seam-free leg.
+  - **What a host's next bundle shows:** a host that doesn't advertise the seams profile but ran these legs sees `openwop.floor.v2-effect-identity-business-key` and `openwop.floor.v2-v1-signed-webhook-accepted` go `executed-pass` to `inapplicable`, while both requirement ids keep passing under the new files. On MyndHyve that costs no certification, since it doesn't claim the profile. On openwop-app the profile is claimed and not certified, which is the correct outcome. A seams host is unaffected. Bundles already published verify as before.
+
 ## [2.45.29] — 2026-10-08 — purpose labels witnessed without a seam; RFC 0241 Accepted
 
 - **`v2-purpose-propagation-onward` witnesses purpose labels through normative operations.** New fixture `conformance-purpose-relay`: routed as the only skill of one agent's A2A card, it relays an inbound A2A message's text to the suite's fake peer through `core.conformance.a2a-invoke`. The suite labels the inbound message with `metadata.openwop.permittedPurposes`, finds the agent through `GET /agents` and `GetExtendedAgentCard`, and reads the onward label at its peer; a nonce matches each onward message to its inbound one. The §22 seam stays as the fallback, and each note names the path. A host with the fixture advertised but no card routing it, or with the suite's peer not running, records `blocked`. Self-test double: a widened label, a dropped label and a call made under `[]` each fail their leg (`lib/purpose-relay-witness.test.ts`). Proven on a seams-off v2 reference host (openwop-examples #166): both rows `executed-pass`, and each defect `executed-fail`. This replaces the planned RFC 0240: the label already arrives on a real carrier.

package/README.md

@@ -137,7 +137,7 @@ Each scenario file records its disposition and assertion count in `<report-dir>/
 
 ## What's Covered
 
-The current suite has 650 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 210 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
+The current suite has 652 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 212 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
 
 The v2 scenarios (`src/scenarios/v2-*.test.ts`) cover, by area:
 
@@ -147,7 +147,7 @@ The v2 scenarios (`src/scenarios/v2-*.test.ts`) cover, by area:
 | Runs | Create, read, list, cancel, bulk cancel, pause/resume, run options and limits, outputs on completion, snapshots | `v2-created-run-readable`, `v2-run-cancel`, `v2-run-pause-resume`, `v2-run-options-limits`, `v2-run-completed-outputs` |
 | Events and streaming | Closed event types, SSE projection, `Last-Event-ID` resumption, poll cursors, terminal-event-once | `v2-stream-sse-projection`, `v2-sse-last-event-id-cursor`, `v2-poll-cursor-v2`, `v2-terminal-event-once` |
 | Errors and headers | The error registry and envelope, malformed bodies, CORS preflight, header scheme | `v2-error-registry`, `v2-malformed-body-envelope`, `v2-cors-preflight`, `v2-header-scheme` |
-| Idempotency | Key grammar, in-flight concurrency, effect identity | `v2-idempotency-key-grammar`, `v2-idempotency-in-flight`, `v2-effect-identity-business-key` |
+| Idempotency | Key grammar, in-flight concurrency, effect identity | `v2-idempotency-key-grammar`, `v2-idempotency-in-flight`, `v2-effect-identity-business-key`, `v2-effect-ledger-keying` |
 | Interrupts and approvals | Resolve after terminal, token scheme, approver enforcement, reject disposition, credential interrupts | `v2-interrupt-resolve-terminal`, `v2-approver-enforced`, `v2-credential-interrupt` |
 | Replay and fork | Fork prefix and ancestry, refusals, replay side-effect suppression, forking a v1 run | `v2-run-fork-prefix`, `v2-run-fork-refusals`, `v2-replay-suppression-ordinal` |
 | Identity, auth and OAuth | Auth challenges, bound ids, workspace scope from identity, OIDC audience, protected-resource metadata, PKCE | `v2-auth-challenge`, `v2-bound-id-kinds`, `v2-oidc-id-token-audience`, `v2-oauth-client-pkce-state-iss` |
@@ -166,7 +166,7 @@ Three kinds of scenario share the tree:
 - **Host** checks drive a live host over HTTP.
 - **Gated** checks run only when the host advertises the family, profile or fixture they need, and otherwise record `inapplicable` or `blocked` with a reason. `--require-behavior` turns an advertised-but-unwitnessable behaviour into a failure.
 
-Current source tree: 650 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
+Current source tree: 652 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
 
 ## How the 2.x suite is built
 

package/coverage.md

@@ -39,11 +39,11 @@ Each scenario that targets major 2 is listed once, under the [`spec/v2/core/`](.
 | [`portability.md`](../spec/v2/core/portability.md) | `v2-portability-advertisement.test.ts` |
 | [`replay.md`](../spec/v2/core/replay.md) | `context-summarization-replay.test.ts`, `memory-attribution-replay-stable.test.ts`, `v2-effect-seam-manifest.test.ts`, `v2-effect-seam-no-refire.test.ts`, `v2-fork-a-v1-run.test.ts`, `v2-nondeterminism-policy-advertisement.test.ts`, `v2-nondeterminism-sources.test.ts`, `v2-replay-suppression-ordinal.test.ts`, `v2-run-fork-prefix.test.ts` |
 | [`runs.md`](../spec/v2/core/runs.md) | `v2-artifact-a2a-shape.test.ts`, `v2-budget-enforcement.test.ts`, `v2-budget-exhaustion-facet.test.ts`, `v2-configurable-closed.test.ts`, `v2-conversation-turn-parts.test.ts`, `v2-created-run-readable.test.ts`, `v2-data-residency-admission.test.ts`, `v2-data-residency-advertisement.test.ts`, `v2-dead-letter-advertisement.test.ts`, `v2-eval-mode-unadvertised-refused.test.ts`, `v2-limits-envelope-caps-advertisement.test.ts`, `v2-run-annotation-not-event.test.ts`, `v2-run-bulk-cancel.test.ts`, `v2-run-cancel.test.ts`, `v2-run-diff-identical.test.ts`, `v2-run-execution-bounds.test.ts`, `v2-run-fork-ancestry.test.ts`, `v2-run-fork-refusals.test.ts`, `v2-run-list.test.ts`, `v2-run-options-limits.test.ts`, `v2-run-pause-resume.test.ts`, `v2-run-snapshot-etag.test.ts` |
-| [`security-defaults.md`](../spec/v2/core/security-defaults.md) | `audit-anomaly-shape.test.ts`, `audit-checkpoint-signature.test.ts`, `audit-checkpoint-vectors.test.ts`, `audit-log-integrity.test.ts`, `inbound-credential-no-passthrough.test.ts`, `v2-compensation-read-projection.test.ts`, `v2-effect-identity-business-key.test.ts`, `v2-pack-isolation.test.ts`, `v2-purpose-propagation-advertisement.test.ts`, `v2-purpose-propagation-onward.test.ts`, `v2-relaxation-recorded.test.ts` |
+| [`security-defaults.md`](../spec/v2/core/security-defaults.md) | `audit-anomaly-shape.test.ts`, `audit-checkpoint-signature.test.ts`, `audit-checkpoint-vectors.test.ts`, `audit-log-integrity.test.ts`, `inbound-credential-no-passthrough.test.ts`, `v2-compensation-read-projection.test.ts`, `v2-effect-identity-business-key.test.ts`, `v2-effect-ledger-keying.test.ts`, `v2-pack-isolation.test.ts`, `v2-purpose-propagation-advertisement.test.ts`, `v2-purpose-propagation-onward.test.ts`, `v2-relaxation-recorded.test.ts` |
 | [`storage.md`](../spec/v2/core/storage.md) | `v2-fs-sandbox-escape-refused.test.ts`, `v2-storage-cross-tenant-isolation.test.ts`, `v2-table-schema-enforcement.test.ts` |
 | [`tool-catalog.md`](../spec/v2/core/tool-catalog.md) | `tool-catalog-compact-projection.test.ts`, `tool-catalog-projection.test.ts`, `tool-descriptor-shape.test.ts`, `v2-tool-catalog-annotations.test.ts` |
 | [`versioning.md`](../spec/v2/core/versioning.md) | `v2-advertised-path-space-served.test.ts`, `v2-client-version-header.test.ts`, `v2-dual-stack-negotiation.test.ts`, `v2-malformed-body-envelope.test.ts`, `v2-min-client-version.test.ts`, `v2-preferred-version-default.test.ts`, `v2-version-header-honored.test.ts`, `v2-well-known-one-resource.test.ts` |
-| [`webhooks.md`](../spec/v2/core/webhooks.md) | `v2-trigger-bridge-delivery.test.ts`, `v2-trigger-dead-letter-read.test.ts`, `v2-v1-signed-webhook-accepted.test.ts`, `v2-webhook-delivery-isolation.test.ts`, `v2-webhook-delivery-shape.test.ts`, `v2-webhook-durable-delivery.test.ts`, `v2-webhook-egress-refusal.test.ts`, `v2-webhook-endpoint-verification.test.ts`, `v2-webhook-generated-secret.test.ts`, `v2-webhook-message-id-stable.test.ts`, `v2-webhook-secret-rotation.test.ts`, `v2-webhook-standard-webhooks-delivery.test.ts`, `v2-webhook-unregister-stops-delivery.test.ts` |
+| [`webhooks.md`](../spec/v2/core/webhooks.md) | `v2-trigger-bridge-delivery.test.ts`, `v2-trigger-dead-letter-read.test.ts`, `v2-v1-signed-webhook-accepted.test.ts`, `v2-webhooks-v1-scheme-listed.test.ts`, `v2-webhook-delivery-isolation.test.ts`, `v2-webhook-delivery-shape.test.ts`, `v2-webhook-durable-delivery.test.ts`, `v2-webhook-egress-refusal.test.ts`, `v2-webhook-endpoint-verification.test.ts`, `v2-webhook-generated-secret.test.ts`, `v2-webhook-message-id-stable.test.ts`, `v2-webhook-secret-rotation.test.ts`, `v2-webhook-standard-webhooks-delivery.test.ts`, `v2-webhook-unregister-stops-delivery.test.ts` |
 | [`workflow-chain-packs.md`](../spec/v2/core/workflow-chain-packs.md) | `v2-chain-pin-exact.test.ts` |
 
 `overview.md`, the introduction to the other documents, has no scenario filed under it.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.29",
-  "stampSha256": "3ae08679281573bed1e595dd8abaff668d4ccb267cbe7bef4b3d4a86933552f9"
+  "version": "2.45.30",
+  "stampSha256": "6288136786dfe99c80a73565b1e77f9b2f5e881fa5c1f140c4d826d3aba15f9c"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.29",
+  "version": "2.45.30",
   "description": "Black-box conformance suite for OpenWOP hosts (v2 current; v1 scenarios retained for the frozen v1 tree).",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.29"
+    "@openwop/spec-artifacts": "2.45.30"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 737,
-    "tests": 2782,
-    "withStableId": 2782,
+    "files": 740,
+    "tests": 2783,
+    "withStableId": 2783,
     "interpolatedTitles": 0,
-    "explicitIds": 2644
+    "explicitIds": 2645
   },
   "records": [
     {
@@ -30331,85 +30331,85 @@
       ]
     },
     {
-      "id": "openwop.it.v2-effect-identity-business-key.get-runs-runid-effects-validates-and-every-row-is-keyed-on-business-identity-or",
+      "id": "openwop.it.v2-effect-identity-business-key.the-same-provider-key-is-presented-across-two-transport-retries",
       "file": "v2-effect-identity-business-key.test.ts",
-      "line": 59,
-      "title": "GET /runs/{runId}/effects validates and every row is keyed on business identity or the activity recipe",
-      "explicitId": "openwop.requirement.0173.effect-identity-business-key",
+      "line": 48,
+      "title": "the same provider key is presented across two transport retries",
+      "explicitId": "openwop.requirement.0173.effect-identity-business-key.retry",
       "citations": [
         {
-          "section": "runs.md §Create",
-          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "security-defaults.md §Layer-2 effect identity",
-          "requirement": "a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)"
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "effect-ledger-projection.schema.json",
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "effect-ledger-projection.schema.json runId",
-          "requirement": "runId MUST echo the run read"
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "security-defaults.md §Layer-2 effect identity",
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "RFC 0150 §B",
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "effect-ledger-projection.schema.json providerKey",
-          "requirement": "providerKey is a redaction-safe identity, never credential material"
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": "the key the ledger records MUST be the key the provider received — a ledger that disagrees with the wire is not a witness"
         }
       ]
     },
     {
-      "id": "openwop.it.v2-effect-identity-business-key.the-same-provider-key-is-presented-across-two-transport-retries",
-      "file": "v2-effect-identity-business-key.test.ts",
-      "line": 120,
-      "title": "the same provider key is presented across two transport retries",
-      "explicitId": "openwop.requirement.0173.effect-identity-business-key.retry",
+      "id": "openwop.it.v2-effect-ledger-keying.get-runs-runid-effects-validates-and-every-row-is-keyed-on-business-identity-or",
+      "file": "v2-effect-ledger-keying.test.ts",
+      "line": 42,
+      "title": "GET /runs/{runId}/effects validates and every row is keyed on business identity or the activity recipe",
+      "explicitId": "openwop.requirement.0173.effect-identity-business-key",
       "citations": [
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
-          "requirement": null,
-          "interpolated": true
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
-          "requirement": null,
-          "interpolated": true
+          "section": "security-defaults.md §Layer-2 effect identity",
+          "requirement": "a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)"
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "section": "effect-ledger-projection.schema.json",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
-          "requirement": null,
-          "interpolated": true
+          "section": "effect-ledger-projection.schema.json runId",
+          "requirement": "runId MUST echo the run read"
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "section": "security-defaults.md §Layer-2 effect identity",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "section": "RFC 0150 §B",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
-          "requirement": "the key the ledger records MUST be the key the provider received — a ledger that disagrees with the wire is not a witness"
+          "section": "effect-ledger-projection.schema.json providerKey",
+          "requirement": "providerKey is a redaction-safe identity, never credential material"
         }
       ]
     },
@@ -37849,27 +37849,10 @@
         }
       ]
     },
-    {
-      "id": "openwop.it.v2-v1-signed-webhook-accepted.the-webhooks-facet-lists-scheme-v1-the-scheme-a-v1-signed-delivery-is-verified-u",
-      "file": "v2-v1-signed-webhook-accepted.test.ts",
-      "line": 79,
-      "title": "the webhooks facet lists scheme \"v1\" — the scheme a v1-signed delivery is verified under",
-      "explicitId": "openwop.requirement.0176.v1-signed-webhook-accepted.facet",
-      "citations": [
-        {
-          "section": "spec/v2/core/webhooks.md §Surfaces",
-          "requirement": "the webhooks facet is { signatureAlgorithms[] }"
-        },
-        {
-          "section": "spec/v2/core/webhooks.md §Surfaces",
-          "requirement": "signatureAlgorithms MUST list \"v1\" — the cut adds no signature scheme (RFC 0176 §D.2)"
-        }
-      ]
-    },
     {
       "id": "openwop.it.v2-v1-signed-webhook-accepted.the-host-s-v2-receiver-path-accepts-an-x-openwop-only-scheme-v1-delivery-and-ref",
       "file": "v2-v1-signed-webhook-accepted.test.ts",
-      "line": 89,
+      "line": 81,
       "title": "the host's v2 receiver path accepts an X-openwop-*-only scheme-v1 delivery and refuses a tampered one",
       "explicitId": "openwop.requirement.0176.v1-signed-webhook-accepted",
       "citations": [
@@ -38622,6 +38605,23 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-webhooks-v1-scheme-listed.the-webhooks-facet-lists-scheme-v1-the-scheme-a-v1-signed-delivery-is-verified-u",
+      "file": "v2-webhooks-v1-scheme-listed.test.ts",
+      "line": 24,
+      "title": "the webhooks facet lists scheme \"v1\" — the scheme a v1-signed delivery is verified under",
+      "explicitId": "openwop.requirement.0176.v1-signed-webhook-accepted.facet",
+      "citations": [
+        {
+          "section": "spec/v2/core/webhooks.md §Surfaces",
+          "requirement": "the webhooks facet is { signatureAlgorithms[] }"
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §Surfaces",
+          "requirement": "signatureAlgorithms MUST list \"v1\" — the cut adds no signature scheme (RFC 0176 §D.2)"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-well-known-one-resource.a-header-less-get-and-an-openwop-version-2-0-get-are-two-representations-of-one",
       "file": "v2-well-known-one-resource.test.ts",
@@ -44699,6 +44699,30 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.seams-floor-legs-gated.every-leg-of-a-seams-profile-floor-file-reaches-a-seams-gate-before-its-first-as",
+      "file": "seams-floor-legs-gated.test.ts",
+      "line": 84,
+      "title": "every leg of a seams-profile floor file reaches a seams gate before its first assertion",
+      "explicitId": "openwop.it.seams-floor-legs-gated.every-leg-of-a-seams-profile-floor-file-reaches-a-seams-gate-before-its-first-a",
+      "citations": [
+        {
+          "section": "spec/v2/profiles.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/profiles.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/profiles.json",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.semantic-digest-v2.the-digest-recipe-section-is-found-at-all",
       "file": "semantic-digest-v2.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 650,
+    "files": 652,
     "v1": 455,
-    "v2": 210
+    "v2": 212
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1431,6 +1431,9 @@
     "v2-effect-identity-business-key.test.ts": [
       2
     ],
+    "v2-effect-ledger-keying.test.ts": [
+      2
+    ],
     "v2-effect-seam-manifest.test.ts": [
       2
     ],
@@ -1854,6 +1857,9 @@
     "v2-webhook-unregister-stops-delivery.test.ts": [
       2
     ],
+    "v2-webhooks-v1-scheme-listed.test.ts": [
+      2
+    ],
     "v2-well-known-one-resource.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.29",
-  "corpusTag": "v2.45.29",
+  "version": "2.45.30",
+  "corpusTag": "v2.45.30",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "13a3eb746eb57dad9ffc605ea4e1e0877a0a9064d44294d0d7df892b042de1b5",
-    "api/v2/asyncapi.yaml": "f34721690c724c94a974fdd9e9972e76694900c7a9005d33ec921d3f4e2ff8bf",
-    "api/v2/openapi.yaml": "d5e63eafe148c73173da3f5b5668fa44f81bc74682818c57009a5f9c8821912e",
+    "api/seams-v2.yaml": "87950b612a26253dfce8dd55703b32ca164e61c56ba6d038e40626e3e6d69b1e",
+    "api/v2/asyncapi.yaml": "99aef28ec33b361d146d2b176714122f95c444967de4993f416f54b17a37ac81",
+    "api/v2/openapi.yaml": "97ed2c29a064cfce269dc746503e4059c42093e64590ae828de9f392917698dc",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -118,7 +118,7 @@
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
     "schemas/v2/capabilities.schema.json": "d859a413ff463ec39acc32a9cb76f2e8c7419e45683d6b7f886861765a9c36c7",
-    "schemas/v2/certification-bundle.schema.json": "93fcdfe54b1db168b702bfaf632b60c7a8a602be92c3fe48c81cf25408c2332b",
+    "schemas/v2/certification-bundle.schema.json": "5cfa7fb5247160333e33a58b60d42bcd4e5269d8391d6a112d301e14828892ed",
     "schemas/v2/channel-presence-payload.schema.json": "fc03df0c20cc12a25f7ee6a47503a4c5931d79fe3d5ff24815e8fd7c1bcb9a87",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "92a57db2fd4b2463f14ef155fef8e3f18afc78960b646459dcf32efc79ff6bf5",
@@ -208,14 +208,14 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "22444c22bb88c568339ef512553f9fc38146e22b566d11ab8608f655d688d19c",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "fcfef02287da21d0337db64fa9f5ddef5a940dac8ae0ce1f92b4bb925af59237",
+    "spec/v1/core-standard-manifest.json": "1b343f616416e2b92ae3c085bc147f6fb23aa9d366a4488431207e3d0f86bd97",
     "spec/v1/deprecations.json": "e723bc11d7272c71789ad1303bb7f21809a8a024abf57594f9d5c35dc199ece9",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "d7d2d1ecf668bc5b8ae84b947cc4449f9409d5a5169be97c3740457ee0672dcf",
+    "spec/v1/gaps.json": "44a1f30d4dd851ac7609fef7dfbd3f7e55404f97130dbe094132f9cd4b71c468",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -254,7 +254,7 @@
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "3a8d93e33865b692d26a3b6bfd3819766e206b2e0c2a69669baa4bf833d05a49",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "396ac924068f25d4a178062a54e244f870c556c3db9fe7a98fcc933fb318ed30",
+    "spec/v2/declaration.json": "22530d99c92b9e0d3ae0dce25507f4cc6350486d560ad8cc01acda054e9face3",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/eos-override.json": "4c72d2f6a658943b01c1de1643cf294642091933af7832f38ee5495df684cb2d",
     "spec/v2/errors.json": "1f0e29455edbd22e28f67f221766209c3c55ac4987beb77993b5702dd7cae131",
@@ -312,10 +312,10 @@
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
     "spec/v2/path-manifest.json": "7b5679a4dad98c80d855361d88a98c8a4e045af15e310862a05b285b815dc9fc",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
-    "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "d14466e510b339345c3f2be3ceaecb2b85725823e33f71d08a7262c4d0cf47bf",
+    "spec/v2/profiles.json": "3d84d7712e93d1e823e362615d5f4aaba0789ea4e044b3774965876fbb8829a7",
+    "spec/v2/release.json": "b7dea408ef966d034c55aeb0987fe926d88c4009479bd92816c7c87acfb384cf",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "5bbf069900b52dd544cae741fef714f4107567eb4b21c4e32a032864feec8a46"
+    "spec/v2/surface-baseline.json": "5f58750fdbd55de45cf31c1f7dee09f68c7b1a40c86d20a046f8c2bc52c0c740"
   },
-  "corpusCommit": "ada50d896fc1edad8046f5d75ae7a5c621d689cd"
+  "corpusCommit": "0f13b5191bd0e29c8b4a8219a059361e27834ea2"
 }

package/src/scenarios/v2-effect-identity-business-key.test.ts

@@ -10,20 +10,19 @@
  * state, at }`, content-free of provider payloads (RFC 0150 §B; RFC 0173 §B row
  * C6.7; `spec/v2/core/security-defaults.md` §Layer-2 effect identity).
  *
- * Legs:
- *   1. the ledger read validates on a run of the noop fixture and every row's
- *      `keying` is one of the two documented modes;
- *   2. the "same provider key across two transport retries" leg needs the
- *      suite's fixture provider (RFC 0173 §D.2 G4 — a provider that rejects a
- *      changed key) driven through the seams profile; no such seam is
- *      catalogued, so that leg records `blocked` naming it.
+ * One leg: the "same provider key across two transport retries" leg, driven
+ * through the seams profile (`forceEffectTransportRetry`, RFC 0173 §D.2 G4).
+ * This file is a floor of `openwop-conformance-seams-v2`, so every leg in it
+ * MUST be seam-driven (`coherence/seams-floor-legs-gated.test.ts`). The
+ * seam-free ledger-read leg lives in `v2-effect-ledger-keying.test.ts` since
+ * 2.45.30: here it passed the floor on hosts that mount no seams.
  *
  * @see spec/v2/core/security-defaults.md §Layer-2 effect identity
  */
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
-import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
 import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
 import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { startEffectReceiver } from '../lib/effect-receiver.js';
@@ -38,85 +37,14 @@ import { req } from '../lib/requirement-ids.js';
  */
 export const REQUIRES_HOST_CALLBACK = 'the host makes the retried outbound effect call to the suite-owned effect receiver (OPENWOP_WEBHOOK_RECEIVER_PORT)';
 
-const FIXTURE = 'conformance-noop';
 const KEYING = ['business-identity', 'activity-recipe'];
-const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
 
 async function discovery(): Promise<Record<string, unknown> | null> {
   try { return await v2Discovery(); } catch { return null; }
 }
 
-async function waitTerminal(runId: string, timeoutMs: number): Promise<void> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const res = await driver.get(`/runs/${encodeURIComponent(runId)}`);
-    if (res.status === 200 && TERMINAL.has(String((res.json as { status?: unknown } | null)?.status))) return;
-    await new Promise((r) => setTimeout(r, 250));
-  }
-}
 
 describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)', () => {
-  it('GET /runs/{runId}/effects validates and every row is keyed on business identity or the activity recipe', async () => {
-    const doc = await discovery();
-    if (!doc) return softSkip('blocked', 'discovery unreachable');
-    if (!(await gateFamily('idempotency'))) return softSkip('inapplicable', 'idempotency family not advertised — no Layer-2 obligation (gate recorded under openwop.family.idempotency)');
-    const fixtures = Array.isArray(doc['fixtures']) ? (doc['fixtures'] as unknown[]) : [];
-    if (!fixtures.includes(FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to read`);
-
-    // Unfailable-leg audit (2026-09-26): the noop fixture issues no effects, so
-    // the per-row loop asserted nothing on any host, and the trailing
-    // `softSkip('inapplicable')` (called without `return`, after four passing
-    // setup asserts) recorded `executed-pass` with a `partial-witness:` detail —
-    // a host that mis-keyed every effect passed this row. Now no expect passes
-    // before the empty-ledger check: a failing setup read still fails, and an
-    // empty but well-formed ledger returns `inapplicable` with zero assertions.
-    const create = await driver.post('/runs', { workflowId: FIXTURE });
-    if (create.status !== 201) {
-      expect(create.status, req('openwop.requirement.0173.effect-identity-business-key', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
-    }
-    const runId = (create.json as { runId: string }).runId;
-    await waitTerminal(runId, 10_000);
-
-    const res = await driver.get(`/runs/${encodeURIComponent(runId)}/effects`);
-    const check = v2Validator('effect-ledger-projection')(res.json);
-    const body = res.json as { runId?: unknown; effects?: Array<{ effectId?: unknown; keying?: unknown; providerKey?: unknown }> } | null;
-    const effects = body?.effects ?? [];
-    if (res.status === 200 && check.ok && body?.runId === runId && effects.length === 0) {
-      // partial-witness-ok: no assertion has passed at runtime. The only earlier
-      // expect runs solely when the create is not 201, and then it throws, so this
-      // skip is a zero-assertion `inapplicable` (the gate reads source order).
-      return softSkip('inapplicable', 'the noop fixture issued no external effect — the ledger read is well-formed but the per-row keying leg had no rows (an effect-issuing fixture would exercise it)');
-    }
-    expect(
-      res.status,
-      req('openwop.requirement.0173.effect-identity-business-key', 'security-defaults.md §Layer-2 effect identity', 'a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)'),
-    ).toBe(200);
-    expect(
-      check.ok,
-      req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json', `the ledger projection MUST validate: ${check.errors}`),
-    ).toBe(true);
-    expect(body?.runId, req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json runId', 'runId MUST echo the run read')).toBe(runId);
-    const ids = new Set<string>();
-    for (const e of effects) {
-      expect(
-        KEYING,
-        req('openwop.requirement.0173.effect-identity-business-key', 'security-defaults.md §Layer-2 effect identity', `keying MUST be business-identity or activity-recipe (the documented fallback) — effect ${String(e.effectId)} declares ${String(e.keying)}`),
-      ).toContain(e.keying);
-      // One logical effect id per effect: a duplicate row is a re-assignment.
-      expect(
-        ids.has(String(e.effectId)),
-        req('openwop.requirement.0173.effect-identity-business-key', 'RFC 0150 §B', `effectId ${String(e.effectId)} MUST be assigned once per effect (duplicate ledger row)`),
-      ).toBe(false);
-      ids.add(String(e.effectId));
-      if (typeof e.providerKey === 'string') {
-        expect(
-          /(secret|bearer |sk-[a-z0-9]{8,})/i.test(e.providerKey),
-          req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json providerKey', 'providerKey is a redaction-safe identity, never credential material'),
-        ).toBe(false);
-      }
-    }
-  });
-
   it('the same provider key is presented across two transport retries', async () => {
     const doc = await discovery();
     if (!doc) return softSkip('blocked', 'discovery unreachable');

package/src/scenarios/v2-effect-ledger-keying.test.ts

@@ -0,0 +1,102 @@
+/**
+ * RFC 0173 §B — the effect ledger read and its keying (suite 2.45.30, target
+ * major 2; gated on `idempotency` and the `conformance-noop` fixture).
+ *
+ * A host that advertises `idempotency` serves `GET /runs/{runId}/effects`
+ * (`schemas/v2/effect-ledger-projection.schema.json`); every row's `keying` is
+ * `business-identity` or the documented fallback `activity-recipe`, each
+ * effect id is assigned once, and `providerKey` is never credential material
+ * (RFC 0150 §B; `spec/v2/core/security-defaults.md` §Layer-2 effect identity).
+ *
+ * This leg needs no seam. Until 2.45.30 it was the first leg of
+ * `v2-effect-identity-business-key`, a floor of `openwop-conformance-seams-v2`,
+ * and its pass certified that profile on hosts that mount no seams.
+ *
+ * @see spec/v2/core/security-defaults.md §Layer-2 effect identity
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const FIXTURE = 'conformance-noop';
+const KEYING = ['business-identity', 'activity-recipe'];
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+async function waitTerminal(runId: string, timeoutMs: number): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const res = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+    if (res.status === 200 && TERMINAL.has(String((res.json as { status?: unknown } | null)?.status))) return;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+}
+
+describe('RFC 0173 §B — effect ledger keying (gated on idempotency)', () => {
+  it('GET /runs/{runId}/effects validates and every row is keyed on business identity or the activity recipe', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    if (!(await gateFamily('idempotency'))) return softSkip('inapplicable', 'idempotency family not advertised — no Layer-2 obligation (gate recorded under openwop.family.idempotency)');
+    const fixtures = Array.isArray(doc['fixtures']) ? (doc['fixtures'] as unknown[]) : [];
+    if (!fixtures.includes(FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to read`);
+
+    // Unfailable-leg audit (2026-09-26): the noop fixture issues no effects, so
+    // the per-row loop asserted nothing on any host, and the trailing
+    // `softSkip('inapplicable')` (called without `return`, after four passing
+    // setup asserts) recorded `executed-pass` with a `partial-witness:` detail —
+    // a host that mis-keyed every effect passed this row. Now no expect passes
+    // before the empty-ledger check: a failing setup read still fails, and an
+    // empty but well-formed ledger returns `inapplicable` with zero assertions.
+    const create = await driver.post('/runs', { workflowId: FIXTURE });
+    if (create.status !== 201) {
+      expect(create.status, req('openwop.requirement.0173.effect-identity-business-key', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    }
+    const runId = (create.json as { runId: string }).runId;
+    await waitTerminal(runId, 10_000);
+
+    const res = await driver.get(`/runs/${encodeURIComponent(runId)}/effects`);
+    const check = v2Validator('effect-ledger-projection')(res.json);
+    const body = res.json as { runId?: unknown; effects?: Array<{ effectId?: unknown; keying?: unknown; providerKey?: unknown }> } | null;
+    const effects = body?.effects ?? [];
+    if (res.status === 200 && check.ok && body?.runId === runId && effects.length === 0) {
+      // partial-witness-ok: no assertion has passed at runtime. The only earlier
+      // expect runs solely when the create is not 201, and then it throws, so this
+      // skip is a zero-assertion `inapplicable` (the gate reads source order).
+      return softSkip('inapplicable', 'the noop fixture issued no external effect — the ledger read is well-formed but the per-row keying leg had no rows (an effect-issuing fixture would exercise it)');
+    }
+    expect(
+      res.status,
+      req('openwop.requirement.0173.effect-identity-business-key', 'security-defaults.md §Layer-2 effect identity', 'a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)'),
+    ).toBe(200);
+    expect(
+      check.ok,
+      req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json', `the ledger projection MUST validate: ${check.errors}`),
+    ).toBe(true);
+    expect(body?.runId, req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json runId', 'runId MUST echo the run read')).toBe(runId);
+    const ids = new Set<string>();
+    for (const e of effects) {
+      expect(
+        KEYING,
+        req('openwop.requirement.0173.effect-identity-business-key', 'security-defaults.md §Layer-2 effect identity', `keying MUST be business-identity or activity-recipe (the documented fallback) — effect ${String(e.effectId)} declares ${String(e.keying)}`),
+      ).toContain(e.keying);
+      // One logical effect id per effect: a duplicate row is a re-assignment.
+      expect(
+        ids.has(String(e.effectId)),
+        req('openwop.requirement.0173.effect-identity-business-key', 'RFC 0150 §B', `effectId ${String(e.effectId)} MUST be assigned once per effect (duplicate ledger row)`),
+      ).toBe(false);
+      ids.add(String(e.effectId));
+      if (typeof e.providerKey === 'string') {
+        expect(
+          /(secret|bearer |sk-[a-z0-9]{8,})/i.test(e.providerKey),
+          req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json providerKey', 'providerKey is a redaction-safe identity, never credential material'),
+        ).toBe(false);
+      }
+    }
+  });
+});

package/src/scenarios/v2-v1-signed-webhook-accepted.test.ts

@@ -7,8 +7,10 @@
  * HMAC-SHA256 with the subscription secret); this adds no signature scheme and
  * per-subscription secrets are unchanged across the cut (`spec/v2/core/webhooks.md`
  * §Dual emission through the overlap; persistence.md §Everything else a v1 host
- * persisted; migration row C9.9). The facet's `signatureAlgorithms[]` MUST list
- * `"v1"` (webhooks.md §Surfaces).
+ * persisted; migration row C9.9). The facet check (`signatureAlgorithms[]` lists
+ * `"v1"`) needs no seam and lives in `v2-webhooks-v1-scheme-listed.test.ts`
+ * since 2.45.30: this file is a floor of `openwop-conformance-seams-v2`, so
+ * every leg in it MUST be seam-driven (`coherence/seams-floor-legs-gated.test.ts`).
  *
  * The receiver under test is the HOST's inbound receiver path — the v2 host as
  * a subscriber (its trigger bridge, its A2A/MCP peer callbacks) — which the
@@ -76,16 +78,6 @@ async function deliver(secret: string, delivery: { headers: Record<string, strin
 }
 
 describe('RFC 0176 §D.2 — v1-signed-webhook-accepted (gated on webhooks + seams)', () => {
-  it('the webhooks facet lists scheme "v1" — the scheme a v1-signed delivery is verified under', async () => {
-    const doc = await discovery();
-    if (!doc) return softSkip('blocked', 'discovery unreachable');
-    const webhooks = await gateFamily('webhooks');
-    if (!webhooks) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
-    const algorithms = webhooks['signatureAlgorithms'];
-    expect(Array.isArray(algorithms), req('openwop.requirement.0176.v1-signed-webhook-accepted.facet', 'spec/v2/core/webhooks.md §Surfaces', 'the webhooks facet is { signatureAlgorithms[] }')).toBe(true);
-    expect(algorithms, req('openwop.requirement.0176.v1-signed-webhook-accepted.facet', 'spec/v2/core/webhooks.md §Surfaces', 'signatureAlgorithms MUST list "v1" — the cut adds no signature scheme (RFC 0176 §D.2)')).toContain('v1');
-  });
-
   it('the host\'s v2 receiver path accepts an X-openwop-*-only scheme-v1 delivery and refuses a tampered one', async () => {
     const doc = await discovery();
     if (!doc) return softSkip('blocked', 'discovery unreachable');

package/src/scenarios/v2-webhooks-v1-scheme-listed.test.ts

@@ -0,0 +1,33 @@
+/**
+ * RFC 0176 §D.2 — the webhooks facet lists scheme `v1` (suite 2.45.30, target
+ * major 2; gated on `webhooks`).
+ *
+ * The facet's `signatureAlgorithms[]` MUST list `"v1"`: the cut adds no
+ * signature scheme, so a v1-signed delivery is verified under it
+ * (`spec/v2/core/webhooks.md` §Surfaces). Until 2.45.30 this was the first leg
+ * of `v2-v1-signed-webhook-accepted`, a floor of `openwop-conformance-seams-v2`,
+ * and its pass certified that profile on hosts that mount no seams.
+ *
+ * @see spec/v2/core/webhooks.md §Surfaces
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+describe('RFC 0176 §D.2 — the webhooks facet lists scheme v1 (gated on webhooks)', () => {
+  it('the webhooks facet lists scheme "v1" — the scheme a v1-signed delivery is verified under', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const webhooks = await gateFamily('webhooks');
+    if (!webhooks) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
+    const algorithms = webhooks['signatureAlgorithms'];
+    expect(Array.isArray(algorithms), req('openwop.requirement.0176.v1-signed-webhook-accepted.facet', 'spec/v2/core/webhooks.md §Surfaces', 'the webhooks facet is { signatureAlgorithms[] }')).toBe(true);
+    expect(algorithms, req('openwop.requirement.0176.v1-signed-webhook-accepted.facet', 'spec/v2/core/webhooks.md §Surfaces', 'signatureAlgorithms MUST list "v1" — the cut adds no signature scheme (RFC 0176 §D.2)')).toContain('v1');
+  });
+});