@openwop/openwop-conformance 2.46.34 → 2.46.35

package/CHANGELOG.md

@@ -1,3 +1,25 @@
+## [2.46.35] — 2026-10-29 — MyndHyve's legacy runtime retired
+
+- **Registers.** MyndHyve's legacy `workflow-runtime` (`api.myndhyve.ai`) retired on 2026-10-29; MyndHyve runs on the openwop-app white-label. Register rows that measured the legacy host close or re-gate, so the packed `spec/v1/gaps.json` changes.
+- **New scenario `v2-deployment-lifecycle` (RFC 0082 §B, §C, §E, §F).** It drives `core.conformance.channel-agent` through `listAgentDeployments` and `transitionAgentDeployment`, plus runs and a replay of the existing fixture `conformance-agent-channel-dispatch`, with no seam. Fourteen legs:
+  - `0082.list-valid`: the list answers 200 and every record validates against `agent-deployment.schema.json`.
+  - `0082.pin-recorded`: the run's `agent.invocation-started` carries `resolvedChannel: stable` and a version active on it.
+  - `0082.scope-fail-closed`: a promote sent with `OPENWOP_TEST_LOW_SCOPE_KEY` (no `deploy:*`) is refused `403 forbidden` and the record does not move. If the key is unset, the leg records `blocked`.
+  - `0082.transition-illegal-refused`: `pause` and `deprecate` of a draft are refused and the record does not move.
+  - `0082.state-unadvertised-refused`: an otherwise legal transition into a state missing from `states` is `400 validation_error`.
+  - `0082.transition-legal`: the promotion path answers 200 at each step with a valid record in the target state.
+  - `0082.replay-pin-reread`: after that promote moves `stable`, a replay of the first run still records its original version.
+  - `0082.canary-adjusted` (with `canary`) and `0082.canary-unsupported-refused` (without it): `adjust-canary` to 50.
+  - `0082.rollback-pointer` (with `rollback`): the version ends `rolled-back`, and its `rollbackPointer` names the restored version.
+- **RFC 0254 rulings.** An illegal edge must be `409 deployment_state_conflict` with `details.state` and `details.transition`. Absent `states` means all seven, so the walk runs. `promote` moves one step over the advertised states, the first without `toState`. A rollback must restore the incumbent.
+- **Scope challenge.** `0082.scope-fail-closed` also requires code `forbidden`, and a `WWW-Authenticate` challenge, when sent, must name `scope="deploy:*"`.
+- **Four new legs.** `0082.promote-skip-refused`: a draft promoted straight to `active` gets the 409. `0082.resume-from-paused` (with `paused`): pause, then `promote` back to `active`. `0082.transition-run-linked`: every 200 record carries `transitionRunId`.
+- **The management run.** `0082.transition-event-recorded`: the `transitionRunId` run's events include the transition's `deployment.*` event, valid against `run-event-payloads`. It is the first behavioural witness of `deployment-event-no-content-leak`.
+- **Resume event.** A resume (`promote` of a paused version) must record `deployment.state.changed`; `deployment.promoted` is for forward steps only (RFC 0254 §A).
+- **Judges.** They are in `lib/deployment-lifecycle-witness.ts`, with self-tests; every new or tightened leg is sabotage-proved on a scratch host.
+- RFC 0253 (`Draft`) adds its gap register, which also lands in the packed `spec/v1/gaps.json`.
+- **Host impact:** opt-in. The legs need `agents.deployment` and the fixture listed in `fixtures`. Listing it at major 2 states the `fixtures.md` preconditions: an incumbent `active` on `stable`, a `draft`, no gate, and `runs:read` on the management run. No host advertises the facet, so every leg is `inapplicable`.
+
 ## [2.46.34] — 2026-10-27 — RFC 0244 G3 closed
 
 - **No assertion changes.** RFC 0244's G3 closes on openwop-app's certified cut `2c8bc27d6` (`0244.trial-memory-isolated` `executed-pass`), so the packed `spec/v1/gaps.json` changes.

package/README.md

@@ -137,7 +137,7 @@ Each scenario file records its disposition and assertion count in `<report-dir>/
 
 ## What's Covered
 
-The current suite has 664 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 224 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
+The current suite has 665 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 225 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
 
 The v2 scenarios (`src/scenarios/v2-*.test.ts`) cover, by area:
 
@@ -166,7 +166,7 @@ Three kinds of scenario share the tree:
 - **Host** checks drive a live host over HTTP.
 - **Gated** checks run only when the host advertises the family, profile or fixture they need, and otherwise record `inapplicable` or `blocked` with a reason. `--require-behavior` turns an advertised-but-unwitnessable behaviour into a failure.
 
-Current source tree: 664 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
+Current source tree: 665 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
 
 ## How the 2.x suite is built
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.46.34",
-  "stampSha256": "3cb7f774d49a6d4674e08f2751e9ec64301f66edb2ca0c29b4342c1464260b5a"
+  "version": "2.46.35",
+  "stampSha256": "5cb533414c9111da403eecf8554a3559823601abe1537f91ae796733cce87f31"
 }

package/fixtures.md

@@ -723,6 +723,31 @@ Hosts that don't ship a BYOK SecretResolver MAY return `404` / `422` on the star
   3. **Replay** via `POST /runs/{runId}:fork {mode:"replay"}`; **assert** the fork's `agent.invocation.started` re-reads the SAME `resolvedAgentVersion`.
   4. **(Seam-guarded)** Move the `stable` channel via the deployment seam; **assert** a replay of the original run STILL carries the original pin — never re-resolving the moved channel.
 
+### At major 2: the deployment lifecycle (`v2-deployment-lifecycle`)
+
+At major 2, `v2-deployment-lifecycle.test.ts` drives `core.conformance.channel-agent` through `listAgentDeployments` and `transitionAgentDeployment` (`GET` / `POST /agents/core.conformance.channel-agent/deployments`), under the transition rules RFC 0254 adds to the `agents.deployment` facet. It moves the `stable` channel itself, so it needs no seam. A host that advertises `agents.deployment` and lists `conformance-agent-channel-dispatch` in discovery `fixtures` states that, at the start of every cut:
+
+- it holds exactly one record of `core.conformance.channel-agent` that is `active` on `stable`, at `canaryPercent` 100 or absent (the incumbent);
+- it holds at least one `draft` record of that agent (the candidate);
+- both are readable by the conformance credential at the `GET` above, and that credential holds the `deploy:*` scope and `runs:read`;
+- no approval gate and no `requiredEval` applies to that credential's transitions of this agent, so a legal transition answers `200` with the updated record, never `202`;
+- every `200` record carries `transitionRunId`, and the conformance credential can read that run through `GET /runs/{runId}/events/poll`; the run's events include the transition's `deployment.*` event;
+- the run's `agent.invocation-started` carries `resolvedChannel` and `resolvedAgentVersion`, as above.
+
+The suite, in order:
+
+1. sends refused transitions, each of which must leave the records unchanged: a promote with `OPENWOP_TEST_LOW_SCOPE_KEY`, `pause` and `deprecate` of the candidate, a promote of the candidate with `toState: "active"`, and on a host advertising a subset of `states`, one transition into an unadvertised state;
+2. promotes the candidate one step at a time over the advertised states to `active`, the last step with `channel: "stable"` and `canaryPercent: 100`; the first step omits `toState`;
+3. runs this fixture again and replays the first run; a run started after that promote must resolve `stable` to the candidate, or the replay leg records `blocked`;
+4. adjusts the candidate's canary share to 50, then rolls it back, which must restore the incumbent to `active`;
+5. with `paused` advertised, pauses the version then `active` on `stable` (the incumbent after a rollback) and promotes it back to `active`.
+
+A refused transition that the host applies instead moves the candidate, and later legs then record `blocked`.
+
+**Restoring the preconditions between cuts.** A clean cut leaves the candidate `rolled-back` (or `active` on a host without `rollback`) and the incumbent `active` on `stable`. Before the next cut the host restores both preconditions, for example by minting a fresh `draft` version and resetting the incumbent to the only `active` record on `stable`. The suite does not reset them. A host whose records do not meet the preconditions records `blocked`, never a failure.
+
+The scope leg sends a promote with `OPENWOP_TEST_LOW_SCOPE_KEY`, a key with no `deploy:*` scope. It expects `403` with code `forbidden`; a `WWW-Authenticate` challenge, if sent, names `scope="deploy:*"`. If that variable is unset, the leg records `blocked`.
+
 ---
 
 ## `conformance-artifact-emit` (RFC 0205 — an artifact the suite can read back)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.46.34",
+  "version": "2.46.35",
   "description": "Black-box conformance suite for OpenWOP hosts (v2 current; v1 scenarios retained for the frozen v1 tree).",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.46.34"
+    "@openwop/spec-artifacts": "2.46.35"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 752,
-    "tests": 2863,
-    "withStableId": 2863,
+    "files": 753,
+    "tests": 2877,
+    "withStableId": 2877,
     "interpolatedTitles": 0,
-    "explicitIds": 2736
+    "explicitIds": 2750
   },
   "records": [
     {
@@ -30198,6 +30198,118 @@
       "explicitId": "openwop.requirement.0082.eval-gate-unmet-unchanged",
       "citations": []
     },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.lists-valid-deployment-records-of-the-fixture-agent",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 379,
+      "title": "lists valid deployment records of the fixture agent",
+      "explicitId": "openwop.requirement.0082.list-valid",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.a-channel-bound-run-records-the-channel-and-the-version-it-resolved",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 386,
+      "title": "a channel-bound run records the channel and the version it resolved",
+      "explicitId": "openwop.requirement.0082.pin-recorded",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.a-transition-without-the-deploy-scope-is-refused-403-forbidden-and-moves-nothing",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 394,
+      "title": "a transition without the deploy:* scope is refused 403 forbidden and moves nothing",
+      "explicitId": "openwop.requirement.0082.scope-fail-closed",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.a-pause-or-deprecate-of-a-draft-is-409-deployment-state-conflict-and-moves-nothi",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 403,
+      "title": "a pause or deprecate of a draft is 409 deployment_state_conflict and moves nothing",
+      "explicitId": "openwop.requirement.0082.transition-illegal-refused",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.a-promote-of-a-draft-straight-to-active-is-409-deployment-state-conflict-and-mov",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 412,
+      "title": "a promote of a draft straight to active is 409 deployment_state_conflict and moves nothing",
+      "explicitId": "openwop.requirement.0082.promote-skip-refused",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.a-transition-into-a-state-the-host-does-not-advertise-is-a-validation-error",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 424,
+      "title": "a transition into a state the host does not advertise is a validation_error",
+      "explicitId": "openwop.requirement.0082.state-unadvertised-refused",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.a-draft-promotes-one-step-at-a-time-over-the-advertised-states-to-active-on-a-ch",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 437,
+      "title": "a draft promotes one step at a time over the advertised states to active on a channel",
+      "explicitId": "openwop.requirement.0082.transition-legal",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.a-replay-re-reads-the-recorded-version-after-the-channel-moved",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 453,
+      "title": "a replay re-reads the recorded version after the channel moved",
+      "explicitId": "openwop.requirement.0082.replay-pin-reread",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.adjust-canary-sets-the-share-on-a-canary-host",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 464,
+      "title": "adjust-canary sets the share on a canary host",
+      "explicitId": "openwop.requirement.0082.canary-adjusted",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.a-host-without-canary-refuses-a-share-below-100",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 476,
+      "title": "a host without canary refuses a share below 100",
+      "explicitId": "openwop.requirement.0082.canary-unsupported-refused",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.a-rollback-restores-the-incumbent-and-points-at-it",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 488,
+      "title": "a rollback restores the incumbent and points at it",
+      "explicitId": "openwop.requirement.0082.rollback-pointer",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.a-paused-version-resumes-to-active-by-promote",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 500,
+      "title": "a paused version resumes to active by promote",
+      "explicitId": "openwop.requirement.0082.resume-from-paused",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.every-accepted-transition-names-its-deployment-management-run",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 509,
+      "title": "every accepted transition names its deployment-management run",
+      "explicitId": "openwop.requirement.0082.transition-run-linked",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-deployment-lifecycle.the-management-run-records-the-transition-s-content-free-deployment-event",
+      "file": "v2-deployment-lifecycle.test.ts",
+      "line": 517,
+      "title": "the management run records the transition's content-free deployment event",
+      "explicitId": "openwop.requirement.0082.transition-event-recorded",
+      "citations": []
+    },
     {
       "id": "openwop.it.v2-discovery-etag.the-discovery-document-carries-an-etag",
       "file": "v2-discovery-etag.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 664,
+    "files": 665,
     "v1": 455,
-    "v2": 224
+    "v2": 225
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1428,6 +1428,9 @@
     "v2-deployment-eval-gate.test.ts": [
       2
     ],
+    "v2-deployment-lifecycle.test.ts": [
+      2
+    ],
     "v2-discovery-etag.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.46.34",
-  "corpusTag": "v2.46.34",
+  "version": "2.46.35",
+  "corpusTag": "v2.46.35",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "2df673d9cd32cb9776bddea5b1a2f08c27eb16fef6d358dcd2414c776923e4b3",
-    "api/v2/asyncapi.yaml": "434ab9613f9372677089c92a9fa3c9e2e0f01c0ef4f0c8d48f193899e786fed0",
-    "api/v2/openapi.yaml": "15515285b03b4e9e4415deccb01eaf5b412b2d83f1c595253717a6a7ddf593cf",
+    "api/seams-v2.yaml": "9e0e957200bc2f2eab4da5d2ffde610468cbaa47386c503e19d94a2d6b7f078e",
+    "api/v2/asyncapi.yaml": "11128d5b4632d020ce4b5aa8dd6178d56ac02d4ebb60a9163533e8d263eb7feb",
+    "api/v2/openapi.yaml": "454b15732dcab236e8027618c5ffe7985248005156a35b4d08125301b2b597e6",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -101,8 +101,8 @@
     "schemas/ui-plugin-message.schema.json": "346638babf1f8ea7b161cde75c0038b518cd2cc5bf0631772e20a9b74c96b5dd",
     "schemas/v2/a2a-task-state.schema.json": "1810363e2d9bddb5997923bdac4044cc17c6f46ec5a40515d2ff21d9c82c1ad9",
     "schemas/v2/a2ui-surface-delta-frame.schema.json": "6889c5da3fe7e76cb614038c0eea6774776fa640448558b258eb87fb50cb9b64",
-    "schemas/v2/agent-deployment-transition.schema.json": "93a334ff042d51378c89fdd7134664271bf9592419bb5e3e00821ed06bc1904e",
-    "schemas/v2/agent-deployment.schema.json": "d59b43fb62b522005ee22bc3bc53775a6777493e5e42d71812abc347625fa7fe",
+    "schemas/v2/agent-deployment-transition.schema.json": "fe2d56f9d8ccb5503c94f1f4dff8af5a7286cc304802b089d42d665ddefcf111",
+    "schemas/v2/agent-deployment.schema.json": "64d5f2848419b6ff797bcf34c0e5f4b05a612c3237d2cf0a034fb41f8b8ebc6b",
     "schemas/v2/agent-eval-suite.schema.json": "a49ad7a232ec781512375001f8d8c70ab073b69ca094f5251dbb30a0bbd972a7",
     "schemas/v2/agent-inventory-response.schema.json": "5f74c3da946dfc3114624567a989717748081ab947b4d2af3f49034d67f4306b",
     "schemas/v2/agent-manifest.schema.json": "004ff150e955deebb9e64273de5093f5144b9b3895b09953e65aa74b61140778",
@@ -117,7 +117,7 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
-    "schemas/v2/capabilities.schema.json": "e580833bd80ce894ce610290de8766f15b9007642456a7404470ca81e0bf3170",
+    "schemas/v2/capabilities.schema.json": "3c494e0914f766209017bf1d876852c3e4daa9f0d7e7e840f6cad23ad00d769d",
     "schemas/v2/certification-bundle.schema.json": "5cfa7fb5247160333e33a58b60d42bcd4e5269d8391d6a112d301e14828892ed",
     "schemas/v2/channel-presence-payload.schema.json": "fc03df0c20cc12a25f7ee6a47503a4c5931d79fe3d5ff24815e8fd7c1bcb9a87",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -144,7 +144,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "e92a2548ba65454c9e0a34f72ea6768d18f59e61fa5da7668d0b2d5baddaddc8",
-    "schemas/v2/error-envelope.schema.json": "f8eff3b5affa29513935632d99ad2d717e76791dc853152d03afa9d907cd5338",
+    "schemas/v2/error-envelope.schema.json": "0e9fe379d2f37d928f247dcca89e7b946a8b90b61a68efa5f3e73deb7d1237db",
     "schemas/v2/eval-summary.schema.json": "d07f4d116c5410997a81d0bc5387545fb61933a6333c360a26ab8a71c749336b",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "a1942a124e250a6e9fbdb6b811c5a125e78fbcbcaa46dfc71d0636f24710a339",
@@ -212,14 +212,14 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "22444c22bb88c568339ef512553f9fc38146e22b566d11ab8608f655d688d19c",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "8265f6e4c7f82088df61d5515d4be27cd194b5e89de87f97969162c6850a3c33",
+    "spec/v1/core-standard-manifest.json": "e64402d125ca8da121b7595b1dbaa580d72cd915e45b80b79d309c38a492c075",
     "spec/v1/deprecations.json": "e723bc11d7272c71789ad1303bb7f21809a8a024abf57594f9d5c35dc199ece9",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "6137fc926b07a94ca4be3e86eb522365410b8c05f3ec03954b31528deac5e37f",
+    "spec/v1/gaps.json": "1c495d62d144e2ce1b0e9282df38c92cdd96015c55a986a047aa8a1c9612d6ac",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -231,7 +231,7 @@
     "spec/v2/core/conformance.md": "3ca291e63bc70a6ef829ae8759ad0ded3741ea7aa507bbbdffc57de443ab2ae2",
     "spec/v2/core/connection-packs.md": "c80f95bd6a03698f35c72cdb2b46bd973f49203bbd786c26760e35fa86e6f23d",
     "spec/v2/core/conversation.md": "8d6abedf6af408a74577753bfca24719d318e2632e10b45ff5d63bdcf31a8aaa",
-    "spec/v2/core/errors.md": "39845bf7a65f9accaae63f84091eee5978b61bbe35d753e35138a9bbc0a2ad98",
+    "spec/v2/core/errors.md": "53b63a7cfafb9801614fad4ecfa1e2859cff4d142639d7bf6eab5027ed392b74",
     "spec/v2/core/events.md": "fd1d95f77565b0b0a747544f4f2126bd02ae4f7cf837ead1da4d89e580b7f694",
     "spec/v2/core/execution.md": "4218dbb397534940f83ca5d46561f02bf8f3fdf68d2ae7fefe7f2eb2ed771103",
     "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
@@ -261,31 +261,31 @@
     "spec/v2/declaration.json": "c914e17b8be18ffd186dbd63556c5a06816562b949029413ba46f556e1cd0d54",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/eos-override.json": "4c72d2f6a658943b01c1de1643cf294642091933af7832f38ee5495df684cb2d",
-    "spec/v2/errors.json": "6ae05aec11be85711f207122d2b978a27f1b06cb3ba5a31b6b9b0fc5af4776e5",
+    "spec/v2/errors.json": "98be280804a0efaa279243cab79edb657f3f262829ee53f10e01d005c32fea41",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
-    "spec/v2/ext/README.md": "e2731ebb5156ece1840ed3b96e7a347f6345e73071ff4e54df0f21c1585c5027",
+    "spec/v2/ext/README.md": "3f3b5f09f961b65514cea6880c303470d4b133a3615c734ad7f3c28ba2da8117",
     "spec/v2/ext/a2uiSurface/README.md": "5518c7f355262eb7cc584422f4ff8e548f066b211878f969274a3a578127622d",
-    "spec/v2/ext/brand/README.md": "82989c018d7965bab029bcce7a67b1d76ffc433d08971a4cac91befcccc09438",
-    "spec/v2/ext/canvas/README.md": "00ca0856e3a0146f1eeaec87209d450e2900ed2748dc7520cc60250a0d3ffbeb",
-    "spec/v2/ext/chat/README.md": "f59b6706162abbfff96f8bccd4c0e1aeed721047cf62e9af58c875727a38d716",
-    "spec/v2/ext/coordination/README.md": "7185af14aa0a2b554095ddbf10b0443b535fd28311a1836c6aa733b203030a9a",
-    "spec/v2/ext/dataIntegration/README.md": "286dec8aa29e4d3225cbd8b3a361f5a438c3288e759966b9415ecbb99c576e70",
-    "spec/v2/ext/entities/README.md": "956d4a9a2aedb8cb9c79ce8145580480920474cc6943f0e33ede32d7b20414dc",
+    "spec/v2/ext/brand/README.md": "aa64eeaa7d091110ff4378842e2a72eaa19feed0016a41fbce5ffb7d9959b4a0",
+    "spec/v2/ext/canvas/README.md": "6829ee68ea4fec4dc97990a13289155fd5bb3940aeb4d3a98301c06cee763e51",
+    "spec/v2/ext/chat/README.md": "6bcd56f7927f635853c6e6ffc67386ad6cb2f80c7d954197467ba34b3db11b96",
+    "spec/v2/ext/coordination/README.md": "13d5a9f64ee3edd6ac532785d18c461c1f0eac6f4ba5a548644df05ab3898592",
+    "spec/v2/ext/dataIntegration/README.md": "4a3a03815bfba5fa59356e27b8a0b4feb1622a9e23f2d4f9b2792182851fe894",
+    "spec/v2/ext/entities/README.md": "899baab987333273609d58d7a2f01fc14967bcd1b1b8748c3eeaad1da3f3d40e",
     "spec/v2/ext/grpc-transport/README.md": "6ba378e3c6d1f2e3269b392cfdf0c40565ee9bfa259d1baaa9ee1d350e38e792",
-    "spec/v2/ext/kanban/README.md": "bfc386dc0f874a4afa1e3ec6a2f99084b547dcce9bd363da3b8ebd8786b9c184",
-    "spec/v2/ext/knowledge/README.md": "cbe1f945a757791dedac0fd542a68c86c5b457778b831d58d9ae44a2baa270f2",
-    "spec/v2/ext/launchStudio/README.md": "a941ef1d2401438a412eaea48d2d6ca807a032b44ea08719fea33120daf088a0",
-    "spec/v2/ext/messaging/README.md": "ee2d19fb6f6c2de11d889e966a41e6d1ff34272771689a81d7de039105a5be03",
+    "spec/v2/ext/kanban/README.md": "1b9f7dfc2171bedf71a94a26f9f5c8d0f4ee190912a2ac0c19256b08cff1a4d8",
+    "spec/v2/ext/knowledge/README.md": "bec06e526730142425cb9cf04d977e5c95b2b69f913b87d4399483490b75ae76",
+    "spec/v2/ext/launchStudio/README.md": "2654738ee36acb3451f3180b9019c7c625857aa9eaa9d559dd0f44dbad38d4e5",
+    "spec/v2/ext/messaging/README.md": "4ad1071e853733e4a39247375b0c323ecd9b530b139d488a73ccda012d60ff6c",
     "spec/v2/ext/portability/README.md": "c59423ee446638b748a911b9e97e803c4786157be6120f656f0a060586bc7b82",
     "spec/v2/ext/provider-idempotency/README.md": "9d1bccef0ec16a19a3370ae79c2f5a1726ce0d1d25a51352907f288a2ccb15d7",
     "spec/v2/ext/provider-idempotency/registry.json": "5b5fecad604fb4ab38da39f5abe697a4e57b05406c398f8afeb377331b2bd965",
-    "spec/v2/ext/restTransport/README.md": "bd7207683b2fbcead78bdb7d474fa723e08adad500185ea10804fd4e99541c0c",
+    "spec/v2/ext/restTransport/README.md": "a301c4eaa36022ee9257a9176adbfd7ffa0d28f1dcaa0a8fec85ebf30e55a5d5",
     "spec/v2/ext/sandbox-runtime-notes/README.md": "0d1290fb1e20b2e35c0b15051541ab6546e4e2a6f693b4f912cb3f7d6a65e92c",
-    "spec/v2/ext/webResearch/README.md": "b675e6f6646128d781b661f754c2393eed86e5935d16c3a22df582a5ce025b9b",
+    "spec/v2/ext/webResearch/README.md": "2771686719161b811c2a50361815a334c58f09e442528fb8e23e4fcdcd42d630",
     "spec/v2/facets/a2a.schema.json": "b68bf5e29e455e46c2ad7cfcccf5963730ec2310ff9db81884550d8df30fd6ef",
-    "spec/v2/facets/agents.schema.json": "cd6bf5cd1d3d9b61646e0232027f078113e44dd4d0beec3283318fb6c5a5e296",
+    "spec/v2/facets/agents.schema.json": "cc9abae19f500b8a2c6f2b3494284f6f9bb782cde7eec13e4f2f5363a1b44ad5",
     "spec/v2/facets/aiProviders.schema.json": "6e4327bcd48110686cc1adfd26ddd6fbbf4ff529c476dcc74eeff8c5ae9965ce",
     "spec/v2/facets/auditLogIntegrity.schema.json": "9a7f81320c8f940c6f4129bc7dd895a4063231c5458a717a08c2cbf9bb886c46",
     "spec/v2/facets/auth.schema.json": "7d98bc81a0f7d307460d039eebfebd21388091bfe1d538762583940f94c0bd2a",
@@ -307,10 +307,10 @@
     "spec/v2/facets/uiPlugins.schema.json": "1fd3f8440cfb6e4422553a7c4b5f091eb3e10a40da0d43e8b977a18929116758",
     "spec/v2/facets/webhooks.schema.json": "54b576f1d150e28e1642693d846ce471c118e9c521bdf3924185305fbd1d0de4",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
-    "spec/v2/generated/error-codes.md": "c024fb18264724cd0d88f33d9b3d509b8fc8c3f16a18f120f2fea069dc04a43d",
+    "spec/v2/generated/error-codes.md": "a184067ea983f7398001b7461732767e0773d7c8a820fc769efa7e4e858cc943",
     "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
     "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
-    "spec/v2/id-field-bindings.json": "97e96b6c35c405d0408b5a877c5859714dbbf4507853de9aab381163371ac098",
+    "spec/v2/id-field-bindings.json": "a7f5d03f5684c02d5792cc52bb1d310c123840e338a499aec4e9b82faf4d3708",
     "spec/v2/interop-map.json": "02255dafe7eb55f61ca7f9ae7c21f079d1848a6756991343088975ac9d184b8d",
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
     "spec/v2/migrations.json": "651954938a1e154c0b6f1e3dd6e105889d30de3bb65789f21de7f77a12869e9e",
@@ -318,9 +318,9 @@
     "spec/v2/path-manifest.json": "20f598f56df460ad3ed50aba3d6bc2933ea16a3c96ce125da1c5dd6989d4155c",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "b382b261c7844798575f7c1b37c934f0da19846016a2337d883d4f5ef6e05479",
-    "spec/v2/release.json": "39b074d857fa0d2c60229007d3d9bd37792636a53ad226b8d69d61c8515e3ee3",
+    "spec/v2/release.json": "28c53661beb7a649be7c474d495832d8920cdae8d1c17f9022fa14f11421d61b",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "e96bd16a6cd4a3f33dd884a76eea35d3923a90cf951285a3712fd8b9f3d74da8"
+    "spec/v2/surface-baseline.json": "9b2275c5649b410381590509f1a60b827f8d1915a429e05c0318e1f473851829"
   },
-  "corpusCommit": "dad8f621a6994e04bf90af420b42af37d49d860f"
+  "corpusCommit": "cddc595c6fcea6ff052ff1cfa199293737e04d53"
 }

package/src/lib/deployment-lifecycle-witness.ts

@@ -0,0 +1,308 @@
+/**
+ * RFC 0082 at major 2: the deployment lifecycle. Pure judges for
+ * `v2-deployment-lifecycle.test.ts`, over answers from `listAgentDeployments`
+ * and `transitionAgentDeployment` and over the event logs of the
+ * `conformance-agent-channel-dispatch` fixture's runs.
+ *
+ * The rules are the `agents.deployment` facet description in
+ * `spec/v2/facets/agents.schema.json`, `schemas/v2/agent-deployment.schema.json`
+ * (the record and its legal transitions), `agent-deployment-transition.schema.json`
+ * and the two operations in `api/v2/openapi.yaml`, with the transition rules
+ * RFC 0254 adds to that facet text. Each judge returns findings and asserts
+ * nothing; the scenario maps them to `req()` ids.
+ *
+ * @see RFCS/0082-agent-deployment-lifecycle.md §B, §C, §E, §F
+ * @see RFCS/0254-deployment-transitions-at-v2.md
+ */
+
+import { readErrorCode } from './error-envelope.js';
+
+export interface DeployFinding { readonly ok: boolean; readonly message: string }
+export interface Answer {
+  readonly status: number;
+  readonly json: unknown;
+  /** The `WWW-Authenticate` header, when the answer carried one. */
+  readonly wwwAuthenticate?: string | undefined;
+}
+export type Validate = (doc: unknown) => { ok: boolean; errors: string };
+type Rec = Record<string, unknown>;
+const isRec = (v: unknown): v is Rec => typeof v === 'object' && v !== null && !Array.isArray(v);
+const f = (ok: boolean, message: string): DeployFinding => ({ ok, message });
+const shown = (a: Answer | null): string => (a === null ? 'no answer' : `${a.status} ${readErrorCode(a.json) ?? ''}`.trim());
+
+/** The forward promotion path `agent-deployment.schema.json` names. */
+export const PROMOTION_PATH = ['draft', 'test', 'staged', 'active'] as const;
+export const ALL_STATES = ['draft', 'test', 'staged', 'active', 'paused', 'deprecated', 'rolled-back'] as const;
+
+/**
+ * The promotion path over the advertised states: absent `states` means all
+ * seven, and over a subset `promote` moves to the next advertised state in
+ * draft→test→staged→active order (RFC 0254).
+ */
+export function promotionPath(states: readonly string[] | null): string[] {
+  return PROMOTION_PATH.filter((s) => states === null || states.includes(s));
+}
+
+/** `details` of an error body: the canonical root `details`, else the legacy nested `error.details`. */
+export function errorDetails(body: unknown): Rec {
+  if (!isRec(body)) return {};
+  if (isRec(body['details'])) return body['details'];
+  return isRec(body['error']) && isRec(body['error']['details']) ? body['error']['details'] : {};
+}
+
+/** The record for `version` in a list body, or undefined. */
+export function recordOf(list: unknown, version: string): Rec | undefined {
+  return Array.isArray(list) ? list.find((r): r is Rec => isRec(r) && r['version'] === version) : undefined;
+}
+
+/** The versions listed `active` with `channel` in `channels`. */
+export function activeOn(list: unknown, channel: string): string[] {
+  if (!Array.isArray(list)) return [];
+  return list.filter((r): r is Rec => isRec(r) && r['state'] === 'active' && Array.isArray(r['channels']) && (r['channels'] as unknown[]).includes(channel) && typeof r['version'] === 'string')
+    .map((r) => r['version'] as string);
+}
+
+/** The first `draft` record's version, or undefined. */
+export function pickDraft(list: unknown): string | undefined {
+  if (!Array.isArray(list)) return undefined;
+  const r = list.find((x): x is Rec => isRec(x) && x['state'] === 'draft' && typeof x['version'] === 'string');
+  return r === undefined ? undefined : (r['version'] as string);
+}
+
+/** `listAgentDeployments` answers 200 with an array of valid records of the agent. */
+export function judgeList(a: Answer | null, agentId: string, validate: Validate): DeployFinding[] {
+  if (a === null || a.status !== 200) return [f(false, `GET /agents/{agentId}/deployments MUST answer 200 for an advertised facet (got ${shown(a)})`)];
+  if (!Array.isArray(a.json)) return [f(false, 'the 200 body MUST be an array of deployment records')];
+  const out: DeployFinding[] = [f(a.json.length > 0, 'the fixture agent MUST have at least one listed deployment record')];
+  a.json.forEach((r, i) => {
+    const v = validate(r);
+    out.push(f(v.ok, `record [${i}] MUST validate against agent-deployment.schema.json (${v.errors})`));
+    out.push(f(isRec(r) && r['agentId'] === agentId, `record [${i}] MUST belong to ${agentId} (got ${JSON.stringify(isRec(r) ? r['agentId'] : r)})`));
+  });
+  return out;
+}
+
+const KEPT = ['state', 'channels', 'canaryPercent', 'rollbackPointer'] as const;
+function unchanged(before: Rec, after: unknown, why: string): DeployFinding[] {
+  const version = String(before['version']);
+  const now = recordOf(after, version);
+  if (now === undefined) return [f(false, `the record for ${version} MUST still be listed after ${why}`)];
+  return KEPT.map((k) => f(JSON.stringify(before[k]) === JSON.stringify(now[k]), `${why} MUST NOT change ${k} (was ${JSON.stringify(before[k])}, now ${JSON.stringify(now[k])})`));
+}
+
+/**
+ * A transition the record's state allows no edge for, or a `promote` past the
+ * next state: `409 deployment_state_conflict` naming the current state and the
+ * transition, and the record does not move (RFC 0254).
+ */
+export function judgeStateConflict(label: string, transition: string, a: Answer | null, before: Rec, after: unknown): DeployFinding[] {
+  const d = errorDetails(a?.json);
+  return [
+    f(a?.status === 409, `${label} is not a legal edge from ${JSON.stringify(before['state'])} and MUST be refused 409 (got ${shown(a)})`),
+    f(readErrorCode(a?.json) === 'deployment_state_conflict', `${label} MUST carry deployment_state_conflict (got ${JSON.stringify(readErrorCode(a?.json))})`),
+    f(d['state'] === before['state'], `details.state MUST be the record's current state ${JSON.stringify(before['state'])} (got ${JSON.stringify(d['state'])})`),
+    f(d['transition'] === transition, `details.transition MUST name the refused transition ${JSON.stringify(transition)} (got ${JSON.stringify(d['transition'])})`),
+    ...unchanged(before, after, `the refused ${label}`),
+  ];
+}
+
+/** The scopes a `WWW-Authenticate` challenge names in `scope="…"`, or undefined when it names none. */
+export function challengeScopes(header: string): string[] | undefined {
+  const m = /\bscope="([^"]*)"/i.exec(header);
+  return m === null ? undefined : (m[1] ?? '').split(/\s+/).filter((x) => x.length > 0);
+}
+
+/**
+ * A transition by a principal without `deploy:*` is refused `403 forbidden`
+ * and moves nothing. `deploy:*` is one literal scope: a `WWW-Authenticate`
+ * challenge, when present, names it in `scope=` (RFC 0254).
+ */
+export function judgeScopeRefused(a: Answer | null, before: Rec, after: unknown): DeployFinding[] {
+  const out = [
+    f(a?.status === 403, `a transition by a principal without the deploy:* scope MUST be refused 403, fail-closed (got ${shown(a)})`),
+    f(readErrorCode(a?.json) === 'forbidden', `the 403 MUST carry forbidden (got ${JSON.stringify(readErrorCode(a?.json))})`),
+  ];
+  const h = a?.wwwAuthenticate;
+  if (typeof h === 'string' && h.length > 0) {
+    const scopes = challengeScopes(h);
+    out.push(f(scopes !== undefined && scopes.includes('deploy:*'), `a WWW-Authenticate challenge on the 403 MUST name scope="deploy:*" (got ${JSON.stringify(h)})`));
+  }
+  return [...out, ...unchanged(before, after, 'the unauthorized transition')];
+}
+
+/** `400 validation_error`, the record unchanged: a transition the advertised `states` or `canary` cannot satisfy. */
+export function judgeValidationRefused(label: string, a: Answer | null, before: Rec, after: unknown): DeployFinding[] {
+  return [
+    f(a?.status === 400, `${label} MUST be refused 400 (got ${shown(a)})`),
+    f(readErrorCode(a?.json) === 'validation_error', `${label} MUST carry validation_error (got ${JSON.stringify(readErrorCode(a?.json))})`),
+    ...unchanged(before, after, `the refused ${label}`),
+  ];
+}
+
+/** One legal step answers 200 with the valid record in the target state. */
+export function judgeStep(a: Answer | null, version: string, toState: string, validate: Validate): DeployFinding[] {
+  if (a === null || a.status !== 200) return [f(false, `promote ${version} to ${toState} is a legal transition and MUST answer 200 (got ${shown(a)})`)];
+  const v = validate(a.json);
+  const r = isRec(a.json) ? a.json : {};
+  return [
+    f(v.ok, `the record returned for ${toState} MUST validate against agent-deployment.schema.json (${v.errors})`),
+    f(r['version'] === version, `the returned record MUST be version ${version} (got ${JSON.stringify(r['version'])})`),
+    f(r['state'] === toState, `the returned record MUST be in ${toState} (got ${JSON.stringify(r['state'])})`),
+  ];
+}
+
+/** After the walk the list shows the version `active` on the channel the last promote named. */
+export function judgeBound(after: unknown, version: string, channel: string): DeployFinding[] {
+  const r = recordOf(after, version);
+  return [
+    f(r?.['state'] === 'active', `after the walk ${version} MUST be listed active (got ${JSON.stringify(r?.['state'])})`),
+    f(Array.isArray(r?.['channels']) && (r['channels'] as unknown[]).includes(channel), `a promote naming channel ${channel} MUST bind it (channels ${JSON.stringify(r?.['channels'])})`),
+  ];
+}
+
+/** The payload of the first `agent.invocation-started`, or undefined. */
+export function firstInvocation(events: ReadonlyArray<{ type: string; payload: Rec }>, type: string): Rec | undefined {
+  return events.find((e) => e.type === type)?.payload;
+}
+
+/** A channel-bound run records the channel and a version active on it when the run started. */
+export function judgePinned(payload: Rec | undefined, channel: string, activeVersions: readonly string[]): DeployFinding[] {
+  if (payload === undefined) return [f(false, 'a channel-bound agent run MUST emit agent.invocation-started')];
+  const v = payload['resolvedAgentVersion'];
+  return [
+    f(payload['resolvedChannel'] === channel, `agent.invocation-started MUST carry resolvedChannel ${JSON.stringify(channel)} (got ${JSON.stringify(payload['resolvedChannel'])})`),
+    f(typeof v === 'string' && activeVersions.includes(v), `resolvedAgentVersion MUST be a version active on ${channel} at run start, ${JSON.stringify(activeVersions)} (got ${JSON.stringify(v)})`),
+  ];
+}
+
+/** A replay of the source run re-reads its recorded version, not the moved channel. */
+export function judgeReplayPinned(source: string, moved: string, payload: Rec | undefined): DeployFinding[] {
+  if (payload === undefined) return [f(false, 'the replay MUST emit agent.invocation-started')];
+  const v = payload['resolvedAgentVersion'];
+  return [f(v === source, `a replay MUST re-read the recorded resolvedAgentVersion ${source}, not re-resolve the channel now serving ${moved} (got ${JSON.stringify(v)})`)];
+}
+
+/** `adjust-canary` answers 200 with the record at the requested share, and the list agrees. */
+export function judgeCanaryAdjusted(a: Answer | null, version: string, percent: number, after: unknown, validate: Validate): DeployFinding[] {
+  if (a === null || a.status !== 200) return [f(false, `adjust-canary of active ${version} to ${percent} on a canary host MUST answer 200 (got ${shown(a)})`)];
+  const v = validate(a.json);
+  const r = isRec(a.json) ? a.json : {};
+  return [
+    f(v.ok, `the adjusted record MUST validate against agent-deployment.schema.json (${v.errors})`),
+    f(r['canaryPercent'] === percent, `the returned record MUST carry canaryPercent ${percent} (got ${JSON.stringify(r['canaryPercent'])})`),
+    f(recordOf(after, version)?.['canaryPercent'] === percent, `the list MUST then show canaryPercent ${percent} (got ${JSON.stringify(recordOf(after, version)?.['canaryPercent'])})`),
+  ];
+}
+
+/**
+ * A rollback leaves the version `rolled-back`, and restores the version that
+ * was `active` on the channel immediately before it: the incumbent, which
+ * `rollbackPointer` names and which is listed `active` afterwards (RFC 0254).
+ */
+export function judgeRolledBack(a: Answer | null, version: string, incumbent: readonly string[], after: unknown, validate: Validate): DeployFinding[] {
+  if (a === null || a.status !== 200) return [f(false, `rollback of active ${version} on a rollback host MUST answer 200 (got ${shown(a)})`)];
+  const v = validate(a.json);
+  const r = isRec(a.json) ? a.json : {};
+  const ptr = r['rollbackPointer'];
+  const restored = typeof ptr === 'string' ? recordOf(after, ptr) : undefined;
+  return [
+    f(v.ok, `the rolled-back record MUST validate against agent-deployment.schema.json (${v.errors})`),
+    f(r['state'] === 'rolled-back', `the returned record MUST be rolled-back (got ${JSON.stringify(r['state'])})`),
+    f(typeof ptr === 'string' && incumbent.includes(ptr), `rollbackPointer MUST name the version active on the channel immediately before ${version}, ${JSON.stringify(incumbent)} (got ${JSON.stringify(ptr)})`),
+    f(restored?.['state'] === 'active', `the version rollbackPointer names MUST be listed active (got ${JSON.stringify(restored?.['state'])})`),
+    f(recordOf(after, version)?.['state'] === 'rolled-back', `the list MUST then show ${version} rolled-back (got ${JSON.stringify(recordOf(after, version)?.['state'])})`),
+  ];
+}
+
+/** A `pause` then a `promote` of a paused version: each 200, ending `paused` then `active` (RFC 0254). */
+export function judgeResumed(pause: Answer | null, resume: Answer | null, version: string, after: unknown, validate: Validate): DeployFinding[] {
+  if (pause === null || pause.status !== 200) return [f(false, `pause of active ${version} is a legal edge and MUST answer 200 (got ${shown(pause)})`)];
+  const p = isRec(pause.json) ? pause.json : {};
+  const vp = validate(pause.json);
+  const out = [
+    f(vp.ok, `the paused record MUST validate against agent-deployment.schema.json (${vp.errors})`),
+    f(p['state'] === 'paused', `the pause MUST return the record paused (got ${JSON.stringify(p['state'])})`),
+  ];
+  if (resume === null || resume.status !== 200) return [...out, f(false, `promote of paused ${version} is the paused→active edge and MUST answer 200 (got ${shown(resume)})`)];
+  const r = isRec(resume.json) ? resume.json : {};
+  const vr = validate(resume.json);
+  return [
+    ...out,
+    f(vr.ok, `the resumed record MUST validate against agent-deployment.schema.json (${vr.errors})`),
+    f(r['state'] === 'active', `promote of a paused version MUST return it active (got ${JSON.stringify(r['state'])})`),
+    f(recordOf(after, version)?.['state'] === 'active', `the list MUST then show ${version} active (got ${JSON.stringify(recordOf(after, version)?.['state'])})`),
+  ];
+}
+
+/** One transition the host accepted with 200: what was asked, and the record it returned. */
+export interface Accepted {
+  readonly label: string;
+  readonly transition: string;
+  readonly version: string;
+  /** The record's state before the transition. */
+  readonly fromState: string;
+  readonly answer: Answer;
+}
+
+/** Every 200 transition answer names its deployment-management run in `transitionRunId` (RFC 0254). */
+export function judgeRunLinked(accepted: readonly Accepted[]): DeployFinding[] {
+  return accepted.map((x) => {
+    const id = isRec(x.answer.json) ? x.answer.json['transitionRunId'] : undefined;
+    return f(typeof id === 'string' && id.length > 0, `the record ${x.label} returned MUST carry transitionRunId naming its deployment-management run (got ${JSON.stringify(id)})`);
+  });
+}
+
+/** The `transitionRunId` of an accepted answer, or undefined. */
+export function runIdOf(x: Accepted): string | undefined {
+  const id = isRec(x.answer.json) ? x.answer.json['transitionRunId'] : undefined;
+  return typeof id === 'string' && id.length > 0 ? id : undefined;
+}
+
+/** A `deployment.*` event the transition must have recorded: its v1 name (the codemap key), its payload $def, and how it names this transition. */
+export interface Expected { readonly v1: string; readonly def: string; readonly matches: (p: Rec) => boolean }
+
+/**
+ * The `deployment.*` event a transition must record. A resume (`promote` of a
+ * paused version) records `deployment.state.changed`, as pause and deprecate
+ * do; `deployment.promoted` records only a forward step (RFC 0254 §A).
+ */
+export function expectedEvents(x: Accepted): Expected[] {
+  const r = isRec(x.answer.json) ? x.answer.json : {};
+  const state = r['state'];
+  const promoted: Expected = { v1: 'deployment.promoted', def: 'deploymentPromoted', matches: (p) => p['toVersion'] === x.version && p['toState'] === state };
+  const changed: Expected = { v1: 'deployment.state.changed', def: 'deploymentStateChanged', matches: (p) => p['version'] === x.version && p['fromState'] === x.fromState && p['toState'] === state };
+  switch (x.transition) {
+    case 'promote': return x.fromState === 'paused' ? [changed] : [promoted];
+    case 'pause':
+    case 'deprecate': return [changed];
+    case 'adjust-canary': return [{ v1: 'deployment.canary.adjusted', def: 'deploymentCanaryAdjusted', matches: (p) => p['version'] === x.version && p['toPercent'] === r['canaryPercent'] }];
+    case 'rollback': return [{ v1: 'deployment.rolled-back', def: 'deploymentRolledBack', matches: (p) => p['fromVersion'] === x.version && p['toVersion'] === r['rollbackPointer'] }];
+    default: return [];
+  }
+}
+
+/**
+ * The management run's events include the `deployment.*` event matching the
+ * transition, and its payload validates against its `run-event-payloads` $def.
+ * `typeOf` maps a v1 name to the major's wire name; `validators` are keyed by $def.
+ */
+export function judgeEventRecorded(
+  x: Accepted,
+  events: ReadonlyArray<{ type: string; payload: Rec }> | undefined,
+  typeOf: (v1: string) => string,
+  validators: Readonly<Record<string, Validate>>,
+): DeployFinding[] {
+  const runId = runIdOf(x);
+  if (runId === undefined) return [f(false, `${x.label}: no transitionRunId, so its deployment.* event cannot be read`)];
+  if (events === undefined) return [f(false, `${x.label}: the events of management run ${runId} MUST be readable by a caller with runs:read in the same tenant`)];
+  const want = expectedEvents(x);
+  const names = want.map((w) => typeOf(w.v1));
+  const hit = want.flatMap((w) => events.filter((e) => e.type === typeOf(w.v1) && w.matches(e.payload)).map((e) => ({ w, e })))[0];
+  if (hit === undefined) {
+    const seen = events.filter((e) => e.type.startsWith('deployment.')).map((e) => `${e.type} ${JSON.stringify(e.payload)}`);
+    return [f(false, `${x.label}: management run ${runId} MUST record ${names.join(' or ')} for this transition (deployment.* seen: ${seen.length === 0 ? 'none' : seen.join('; ')})`)];
+  }
+  const validate = validators[hit.w.def];
+  const v = validate === undefined ? { ok: false, errors: `no validator for ${hit.w.def}` } : validate(hit.e.payload);
+  return [f(v.ok, `${x.label}: the ${hit.e.type} payload MUST validate against run-event-payloads#/$defs/${hit.w.def}, content-free (${v.errors})`)];
+}

package/src/scenarios/v2-deployment-lifecycle.test.ts

@@ -0,0 +1,526 @@
+/**
+ * v2 — the agent deployment lifecycle on the wire (RFC 0082 §B, §C, §E, §F;
+ * the transition rules of RFC 0254). The rules are the `agents.deployment`
+ * facet description in `spec/v2/facets/agents.schema.json` ("Transitions
+ * (RFC 0254)"), `schemas/v2/agent-deployment.schema.json`,
+ * `agent-deployment-transition.schema.json`, `listAgentDeployments` /
+ * `transitionAgentDeployment` in `api/v2/openapi.yaml` and the registered
+ * `409 deployment_state_conflict` in `spec/v2/errors.json`.
+ *
+ * Gated on `agents.deployment` and on the fixture `conformance-agent-channel-dispatch`
+ * in discovery `fixtures`. At major 2, listing it states that the host holds an
+ * `active` record of `core.conformance.channel-agent` on `stable` and a `draft`
+ * one, and that the conformance credential's transitions of that agent pass no
+ * approval or eval gate (contract in `conformance/fixtures.md`). Absent `states`
+ * means all seven. The suite then, once per worker:
+ *   list → run the fixture (R1) → unscoped promote → illegal pause / deprecate →
+ *   promote draft straight to active → a transition into an unadvertised state →
+ *   promote one step at a time to active on `stable` at 100 (the first step
+ *   without `toState`) → run the fixture again (R2) → replay R1 → adjust-canary →
+ *   rollback → pause and resume the version active on `stable` → read each
+ *   accepted transition's management run.
+ * Judges in `lib/deployment-lifecycle-witness.ts`.
+ *   - `0082.list-valid` — the list is 200 and every record validates.
+ *   - `0082.pin-recorded` — R1's `agent.invocation-started` carries
+ *     `resolvedChannel: stable` and a version active on it.
+ *   - `0082.scope-fail-closed` — `OPENWOP_TEST_LOW_SCOPE_KEY` (no `deploy:*`)
+ *     is refused `403 forbidden`, a `WWW-Authenticate` challenge if present
+ *     names `scope="deploy:*"`, and the record does not move. Unset key: `blocked`.
+ *   - `0082.transition-illegal-refused` — `pause` and `deprecate` of a draft
+ *     (each when its target state is advertised; else `adjust-canary` at 100)
+ *     are `409 deployment_state_conflict` with `details.state` and
+ *     `details.transition`, record unchanged.
+ *   - `0082.promote-skip-refused` — promote of the draft with `toState: active`
+ *     when `active` is not the next state is the same 409, record unchanged.
+ *   - `0082.state-unadvertised-refused` — an otherwise legal transition into a
+ *     state outside `states` is `400 validation_error`, record unchanged.
+ *     Every state advertised, or `states` absent: `inapplicable`.
+ *   - `0082.transition-legal` — each step over the advertised states is 200
+ *     with a valid record in the next state, and the version ends `active` on
+ *     `stable`. An advertised subset without `draft` and `active` fails here.
+ *   - `0082.replay-pin-reread` — after the walk moved `stable` (R2 resolves the
+ *     new version), a replay of R1 still records R1's version.
+ *   - `0082.canary-adjusted` / `0082.canary-unsupported-refused` — by `canary`.
+ *   - `0082.rollback-pointer` — with `rollback`, the version ends `rolled-back`
+ *     and its `rollbackPointer` names the incumbent, listed `active` again.
+ *   - `0082.resume-from-paused` — with `paused`, a pause then a `promote` of the
+ *     version active on `stable` (the incumbent after a rollback) each answer
+ *     200, ending `paused` then `active`.
+ *   - `0082.transition-run-linked` — every 200 transition record carries
+ *     `transitionRunId`.
+ *   - `0082.transition-event-recorded` — that run's events include the
+ *     transition's `deployment.*` event, valid against `run-event-payloads`
+ *     (content-free: SECURITY `deployment-event-no-content-leak`).
+ *
+ * Not witnessed here: `authorization.decided` on the management run, the 202 of
+ * a gated transition (no gated fixture), that a refused transition creates no
+ * run (not portably observable), and a rollback with no prior version.
+ *
+ * @see RFCS/0082-agent-deployment-lifecycle.md
+ * @see RFCS/0254-deployment-transitions-at-v2.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPRequestInit } from '../lib/driver.js';
+import { v2Discovery, v2RefValidator, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { isRecord, pollTerminal, readEvents, type Ev } from '../lib/fixture-run-observer.js';
+import {
+  ALL_STATES, activeOn, expectedEvents, firstInvocation, judgeBound, judgeCanaryAdjusted, judgeEventRecorded, judgeList,
+  judgePinned, judgeReplayPinned, judgeResumed, judgeRolledBack, judgeRunLinked, judgeScopeRefused, judgeStateConflict, judgeStep,
+  judgeValidationRefused, pickDraft, promotionPath, recordOf, runIdOf, type Accepted, type Answer, type DeployFinding, type Validate,
+} from '../lib/deployment-lifecycle-witness.js';
+
+const PROFILE = majorProfile(2);
+const DOC = 'agents.schema.json §deployment, agent-deployment.schema.json, transitionAgentDeployment (RFC 0082, RFC 0254)';
+const FIXTURE = 'conformance-agent-channel-dispatch';
+const AGENT = 'core.conformance.channel-agent';
+const CHANNEL = 'stable';
+const CANARY = 50;
+const DEPLOYMENTS = `/agents/${encodeURIComponent(AGENT)}/deployments`;
+const INVOCATION_STARTED = PROFILE.eventType('agent.invocation.started') ?? 'agent.invocation-started';
+const ID_LIST = 'openwop.requirement.0082.list-valid';
+const ID_PIN = 'openwop.requirement.0082.pin-recorded';
+const ID_SCOPE = 'openwop.requirement.0082.scope-fail-closed';
+const ID_ILLEGAL = 'openwop.requirement.0082.transition-illegal-refused';
+const ID_SKIP = 'openwop.requirement.0082.promote-skip-refused';
+const ID_UNADVERTISED = 'openwop.requirement.0082.state-unadvertised-refused';
+const ID_LEGAL = 'openwop.requirement.0082.transition-legal';
+const ID_REPLAY = 'openwop.requirement.0082.replay-pin-reread';
+const ID_CANARY = 'openwop.requirement.0082.canary-adjusted';
+const ID_CANARY_REFUSED = 'openwop.requirement.0082.canary-unsupported-refused';
+const ID_ROLLBACK = 'openwop.requirement.0082.rollback-pointer';
+const ID_RESUME = 'openwop.requirement.0082.resume-from-paused';
+const ID_RUN_LINKED = 'openwop.requirement.0082.transition-run-linked';
+const ID_EVENT = 'openwop.requirement.0082.transition-event-recorded';
+
+type Rec = Record<string, unknown>;
+type Skip = { skip: [Parameters<typeof softSkip>[0], string] };
+interface Gate { facet: Rec; states: readonly string[] | null; replay: boolean }
+/** A refusal and the list read after it. */
+interface Refusal { readonly before: Rec; readonly answer: Answer | null; readonly after: unknown }
+
+interface Drive {
+  list0: Answer | null;
+  draft?: string | undefined;
+  activeAtR1: readonly string[];
+  r1?: { runId: string; pin: Rec | undefined } | string | undefined;
+  scope?: Refusal | string | undefined;
+  illegal?: Array<{ label: string; transition: string } & Refusal> | undefined;
+  skip?: Refusal | string | undefined;
+  unadvertised?: ({ state: string } & Refusal) | string | undefined;
+  walk?: { steps: Array<{ toState: string; answer: Answer | null }>; after: unknown } | string | undefined;
+  replay?: { source: string; moved: string; pin: Rec | undefined } | string | undefined;
+  canary?: { answer: Answer | null; before: Rec; after: unknown } | string | undefined;
+  rollback?: { answer: Answer | null; after: unknown } | string | undefined;
+  resume?: { version: string; pause: Answer | null; resume: Answer | null; after: unknown } | string | undefined;
+  /** Every transition answered 200, in order. */
+  accepted: Accepted[];
+}
+
+async function ask(method: string, path: string, body?: unknown, bearer?: string): Promise<Answer | null> {
+  const init: OpenWOPRequestInit = {
+    ...(body === undefined ? {} : { body }),
+    ...(bearer === undefined ? {} : { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } }),
+  };
+  try {
+    const r = await driver.request(method, path, init);
+    return { status: r.status, json: r.json, wwwAuthenticate: r.headers.get('www-authenticate') ?? undefined };
+  } catch {
+    return null;
+  }
+}
+const list = async (): Promise<unknown> => { const a = await ask('GET', DEPLOYMENTS); return a?.status === 200 ? a.json : undefined; };
+const transition = (body: Rec, bearer?: string): Promise<Answer | null> => ask('POST', DEPLOYMENTS, body, bearer);
+
+async function gate(): Promise<Skip | Gate> {
+  let doc: Rec | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  if (!doc) return { skip: ['blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0'] };
+  const agents = doc['agents'];
+  if (!isRecord(agents) || !isRecord(agents['deployment'])) return { skip: ['inapplicable', 'the host does not advertise agents.deployment'] };
+  if (!isFixtureAdvertised(FIXTURE)) return { skip: ['inapplicable', `the host does not advertise fixture ${FIXTURE}`] };
+  const facet = agents['deployment'];
+  const states = Array.isArray(facet['states']) ? facet['states'].filter((s): s is string => typeof s === 'string') : null;
+  const replay = isRecord(doc['replay']) && Array.isArray(doc['replay']['modes']) && (doc['replay']['modes'] as unknown[]).includes('replay');
+  return { facet, states, replay };
+}
+
+/** Absent `states` means all seven (RFC 0254 §B). */
+const advertises = (g: Gate, state: string): boolean => g.states === null || g.states.includes(state);
+
+/** The §B violation of an advertised subset without `draft` and `active`, or null. */
+function subsetInvalid(g: Gate): string | null {
+  const missing = ['draft', 'active'].filter((s) => !advertises(g, s));
+  return missing.length === 0 ? null : `agents.deployment.states ${JSON.stringify(g.states)} omits ${missing.join(' and ')}; an advertised subset MUST include draft and active`;
+}
+
+/** Why the forward walk cannot run on this host, or null. */
+function walkInapplicable(g: Gate): string | null {
+  const invalid = subsetInvalid(g);
+  if (invalid !== null) return invalid;
+  const channels = Array.isArray(g.facet['channels']) ? g.facet['channels'] : [];
+  if (!channels.includes(CHANNEL)) return `agents.deployment.channels does not list ${CHANNEL}`;
+  return null;
+}
+const rollbackServed = (g: Gate): boolean => g.facet['rollback'] === true && advertises(g, 'rolled-back');
+/** The state a promote of a draft moves to over the advertised states. */
+const nextAfterDraft = (g: Gate): string | undefined => promotionPath(g.states)[1];
+
+/**
+ * Transitions a draft has no edge for, whose target the host advertises (an
+ * unadvertised target is the 400 checked first): `pause` and `deprecate`, or,
+ * when neither state is advertised, `adjust-canary` at 100.
+ */
+function illegalProbes(g: Gate): Array<{ label: string; body: { transition: string } & Rec }> {
+  const out = (['pause', 'deprecate'] as const)
+    .filter((t) => advertises(g, t === 'pause' ? 'paused' : 'deprecated'))
+    .map((t) => ({ label: `${t} of a draft`, body: { transition: t } }));
+  return out.length > 0 ? out : [{ label: 'adjust-canary of a draft', body: { transition: 'adjust-canary', canaryPercent: 100 } }];
+}
+
+/**
+ * A transition that the state machine allows but whose target state is not
+ * advertised, so the only ground for refusing it is `states`: promote a draft
+ * into `test`, or pause, deprecate or roll back the active incumbent.
+ */
+const PROBES = [
+  { state: 'test', on: 'draft', transition: 'promote' },
+  { state: 'paused', on: 'active', transition: 'pause' },
+  { state: 'deprecated', on: 'active', transition: 'deprecate' },
+  { state: 'rolled-back', on: 'active', transition: 'rollback' },
+] as const;
+function unadvertisedProbe(states: readonly string[] | null): (typeof PROBES)[number] | undefined {
+  return states === null ? undefined : PROBES.find((p) => !states.includes(p.state));
+}
+
+async function runFixture(): Promise<{ runId: string; pin: Rec | undefined } | string> {
+  const created = await ask('POST', PROFILE.runsPath, { workflowId: FIXTURE });
+  const runId = isRecord(created?.json) && typeof created.json['runId'] === 'string' ? created.json['runId'] : undefined;
+  if ((created?.status !== 201 && created?.status !== 202) || runId === undefined) return `createRun of ${FIXTURE} answered ${created?.status ?? 'nothing'}`;
+  const end = await pollTerminal(PROFILE, runId, { timeoutMs: 30_000 });
+  if (end.snapshot['status'] !== 'completed') return `run ${runId} of ${FIXTURE} ended ${String(end.snapshot['status'])}, not completed`;
+  return { runId, pin: firstInvocation(await readEvents(PROFILE, runId), INVOCATION_STARTED) };
+}
+
+async function replayOf(runId: string): Promise<Rec | undefined | string> {
+  const fork = await ask('POST', `${PROFILE.runsPath}/${PROFILE.idSegment(runId)}:fork`, { mode: 'replay' });
+  const forkId = isRecord(fork?.json) && typeof fork.json['runId'] === 'string' ? fork.json['runId'] : undefined;
+  if (fork?.status !== 201 || forkId === undefined) return `POST /runs/{runId}:fork {mode: replay} answered ${fork?.status ?? 'nothing'}`;
+  await pollTerminal(PROFILE, forkId, { timeoutMs: 30_000 });
+  return firstInvocation(await readEvents(PROFILE, forkId), INVOCATION_STARTED);
+}
+
+async function refuse(version: string, body: Rec, bearer?: string): Promise<Refusal | string> {
+  const before = recordOf(await list(), version);
+  if (before === undefined) return `the record for ${version} is no longer listed`;
+  const answer = await transition(body, bearer);
+  return { before, answer, after: await list() };
+}
+
+const typeOf = (v1: string): string => PROFILE.eventType(v1) ?? v1;
+
+/** A management run's events, read until the transition's `deployment.*` event appears or 10 s pass. */
+async function managementEvents(x: Accepted, runId: string): Promise<Ev[] | undefined> {
+  const want = expectedEvents(x);
+  const deadline = Date.now() + 10_000;
+  for (;;) {
+    const r = await ask('GET', `${PROFILE.runsPath}/${PROFILE.idSegment(runId)}/events/poll`);
+    if (r?.status !== 200) return undefined;
+    const events = await readEvents(PROFILE, runId);
+    if (want.some((w) => events.some((e) => e.type === typeOf(w.v1) && w.matches(e.payload))) || Date.now() > deadline) return events;
+    await new Promise((res) => setTimeout(res, 250));
+  }
+}
+
+let once: Promise<Drive> | undefined;
+/** One lifecycle per worker: every leg judges a slice of it. */
+function lifecycle(g: Gate): Promise<Drive> {
+  once ??= drive(g);
+  return once;
+}
+
+async function drive(g: Gate): Promise<Drive> {
+  const list0 = await ask('GET', DEPLOYMENTS);
+  const records = list0?.status === 200 ? list0.json : undefined;
+  const activeAtR1 = activeOn(records, CHANNEL);
+  const d: Drive = { list0, draft: pickDraft(records), activeAtR1, accepted: [] };
+  d.r1 = activeAtR1.length === 0 ? `the host lists ${FIXTURE} but no ${AGENT} record is active on ${CHANNEL}` : await runFixture();
+
+  /** Send a transition by the conformance credential; a 200 joins `accepted`. */
+  const send = async (label: string, body: Rec & { version: string; transition: string }): Promise<Answer | null> => {
+    const fromState = recordOf(await list(), body.version)?.['state'];
+    const answer = await transition(body);
+    if (answer?.status === 200) d.accepted.push({ label, transition: body.transition, version: body.version, fromState: String(fromState), answer });
+    return answer;
+  };
+
+  if (d.draft !== undefined) await forward(g, d, d.draft, send);
+  d.resume = await resume(g, d, send);
+  return d;
+}
+
+let eventsOnce: Promise<Map<string, Ev[] | undefined>> | undefined;
+/** The events of every accepted transition's management run, read concurrently, once. */
+function managementRuns(d: Drive): Promise<Map<string, Ev[] | undefined>> {
+  eventsOnce ??= (async () => {
+    const linked = d.accepted.flatMap((x) => { const id = runIdOf(x); return id === undefined ? [] : [{ x, id }]; });
+    const read = await Promise.all(linked.map(async ({ x, id }) => [id, await managementEvents(x, id)] as const));
+    return new Map(read);
+  })();
+  return eventsOnce;
+}
+
+type Send = (label: string, body: Rec & { version: string; transition: string }) => Promise<Answer | null>;
+
+/** The refusals, the walk, the replay, canary and rollback, on the fixture's draft. */
+async function forward(g: Gate, d: Drive, draft: string, send: Send): Promise<void> {
+  const low = process.env['OPENWOP_TEST_LOW_SCOPE_KEY']?.trim();
+  d.scope = !low
+    ? 'OPENWOP_TEST_LOW_SCOPE_KEY (a key without any deploy:* scope) is not set'
+    : await refuse(draft, { version: draft, transition: 'promote' }, low);
+
+  d.illegal = [];
+  for (const p of illegalProbes(g)) {
+    const r = await refuse(draft, { version: draft, ...p.body });
+    if (typeof r !== 'string') d.illegal.push({ label: p.label, transition: p.body.transition, ...r });
+  }
+
+  if (walkInapplicable(g) === null && nextAfterDraft(g) !== 'active') {
+    d.skip = await refuse(draft, { version: draft, transition: 'promote', toState: 'active' });
+  }
+
+  const probe = unadvertisedProbe(g.states);
+  if (probe !== undefined) {
+    const version = probe.on === 'draft' ? draft : d.activeAtR1[0];
+    if (version === undefined) d.unadvertised = `no ${AGENT} record is active on ${CHANNEL} to ${probe.transition}`;
+    else {
+      const r = await refuse(version, { version, transition: probe.transition, ...(probe.on === 'draft' ? { toState: probe.state } : {}) });
+      d.unadvertised = typeof r === 'string' ? r : { state: probe.state, ...r };
+    }
+  }
+
+  const why = walkInapplicable(g);
+  if (why !== null) { d.walk = why; return; }
+  const current = recordOf(await list(), draft)?.['state'];
+  if (current !== 'draft') { d.walk = `${draft} is no longer listed as a draft (now ${JSON.stringify(current)})`; return; }
+  const path = promotionPath(g.states).slice(1);
+  const steps: Array<{ toState: string; answer: Answer | null }> = [];
+  for (const [i, toState] of path.entries()) {
+    const last = toState === 'active';
+    // The first step omits toState: absent means the next state.
+    const body = { version: draft, transition: 'promote', ...(i === 0 ? {} : { toState }), ...(last ? { channel: CHANNEL, canaryPercent: 100 } : {}) };
+    const answer = await send(`promote ${draft} to ${toState}`, body);
+    steps.push({ toState, answer });
+    if (answer?.status !== 200) break;
+  }
+  d.walk = { steps, after: await list() };
+  if (steps.length < path.length || steps.some((s) => s.answer?.status !== 200)) return;
+
+  if (!g.replay) d.replay = 'the host does not advertise replay.modes including "replay"';
+  else if (typeof d.r1 !== 'object') d.replay = d.r1 ?? 'R1 did not run';
+  else if (typeof d.r1.pin?.['resolvedAgentVersion'] !== 'string') d.replay = 'R1 recorded no resolvedAgentVersion to re-read';
+  else {
+    const source = d.r1.pin['resolvedAgentVersion'] as string;
+    const r2 = await runFixture();
+    const moved = typeof r2 === 'string' ? undefined : r2.pin?.['resolvedAgentVersion'];
+    if (typeof r2 === 'string') d.replay = r2;
+    else if (moved !== draft || moved === source) d.replay = `the channel move is not observable: a fresh run resolved ${JSON.stringify(moved)} after ${draft} went active on ${CHANNEL} at 100`;
+    else {
+      const pin = await replayOf(d.r1.runId);
+      d.replay = typeof pin === 'string' ? pin : { source, moved: draft, pin };
+    }
+  }
+
+  const beforeCanary = recordOf(await list(), draft);
+  if (beforeCanary === undefined) d.canary = `the record for ${draft} is no longer listed`;
+  else {
+    const answer = await send(`adjust-canary of ${draft} to ${CANARY}`, { version: draft, transition: 'adjust-canary', canaryPercent: CANARY });
+    d.canary = { answer, before: beforeCanary, after: await list() };
+  }
+
+  if (!rollbackServed(g)) d.rollback = 'the host does not advertise agents.deployment.rollback with rolled-back in states';
+  else if (d.activeAtR1.length === 0) d.rollback = `no version was active on ${CHANNEL} before the walk, so there is nothing to restore`;
+  else {
+    const answer = await send(`rollback of ${draft}`, { version: draft, transition: 'rollback', reason: 'conformance' });
+    d.rollback = { answer, after: await list() };
+  }
+}
+
+/**
+ * Pause, then promote, the version active on `stable`: the incumbent when it
+ * is active again (after a rollback, or never displaced), else the walked
+ * version. Runs last, so no later leg depends on what it leaves.
+ */
+async function resume(g: Gate, d: Drive, send: Send): Promise<Drive['resume']> {
+  if (!advertises(g, 'paused')) return 'agents.deployment.states does not advertise paused';
+  const active = activeOn(await list(), CHANNEL);
+  const version = active.find((v) => d.activeAtR1.includes(v)) ?? active[0];
+  if (version === undefined) return `no ${AGENT} record is active on ${CHANNEL} to pause`;
+  const pause = await send(`pause of ${version}`, { version, transition: 'pause' });
+  const back = pause?.status === 200 ? await send(`promote of paused ${version}`, { version, transition: 'promote' }) : null;
+  return { version, pause, resume: back, after: await list() };
+}
+
+function expectAll(id: string, findings: readonly DeployFinding[]): void {
+  for (const x of findings) expect(x.ok, req(id, DOC, x.message)).toBe(true);
+}
+const NO_DRAFT = `the host lists ${FIXTURE} but holds no draft record of ${AGENT}`;
+const record = v2Validator('agent-deployment');
+const PAYLOADS: Record<string, Validate> = Object.fromEntries(
+  ['deploymentPromoted', 'deploymentStateChanged', 'deploymentCanaryAdjusted', 'deploymentRolledBack']
+    .map((def) => [def, v2RefValidator(`run-event-payloads.schema.json#/$defs/${def}`)]),
+);
+
+describe('v2 RFC 0082 — the agent deployment lifecycle (host)', () => {
+  it('lists valid deployment records of the fixture agent', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const d = await lifecycle(g);
+    expectAll(ID_LIST, judgeList(d.list0, AGENT, record));
+  });
+
+  it('a channel-bound run records the channel and the version it resolved', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const d = await lifecycle(g);
+    if (d.r1 === undefined || typeof d.r1 === 'string') return softSkip('blocked', d.r1 ?? 'the fixture run did not start');
+    expectAll(ID_PIN, judgePinned(d.r1.pin, CHANNEL, d.activeAtR1));
+  });
+
+  it('a transition without the deploy:* scope is refused 403 forbidden and moves nothing', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const d = await lifecycle(g);
+    if (d.draft === undefined) return softSkip('blocked', NO_DRAFT);
+    if (d.scope === undefined || typeof d.scope === 'string') return softSkip('blocked', d.scope ?? 'the unscoped transition was not sent');
+    expectAll(ID_SCOPE, judgeScopeRefused(d.scope.answer, d.scope.before, d.scope.after));
+  });
+
+  it('a pause or deprecate of a draft is 409 deployment_state_conflict and moves nothing', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const d = await lifecycle(g);
+    if (d.draft === undefined) return softSkip('blocked', NO_DRAFT);
+    if (d.illegal === undefined || d.illegal.length === 0) return softSkip('blocked', `the draft ${d.draft} was not listed when the illegal transitions were sent`);
+    expectAll(ID_ILLEGAL, d.illegal.flatMap((x) => judgeStateConflict(x.label, x.transition, x.answer, x.before, x.after)));
+  });
+
+  it('a promote of a draft straight to active is 409 deployment_state_conflict and moves nothing', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const why = walkInapplicable(g);
+    if (why !== null) return softSkip('inapplicable', why);
+    if (nextAfterDraft(g) === 'active') return softSkip('inapplicable', 'the host advertises neither test nor staged, so active is the next state after draft and the promote is legal');
+    const d = await lifecycle(g);
+    if (d.draft === undefined) return softSkip('blocked', NO_DRAFT);
+    if (d.skip === undefined || typeof d.skip === 'string') return softSkip('blocked', d.skip ?? 'the skipping promote was not sent');
+    expectAll(ID_SKIP, judgeStateConflict('promote of a draft straight to active', 'promote', d.skip.answer, d.skip.before, d.skip.after));
+  });
+
+  it('a transition into a state the host does not advertise is a validation_error', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const states = g.states;
+    if (states === null) return softSkip('inapplicable', 'agents.deployment.states is absent, which means all seven, so no state is unadvertised');
+    if (ALL_STATES.every((s) => states.includes(s))) return softSkip('inapplicable', 'the host advertises all seven states, so no state is unadvertised');
+    if (unadvertisedProbe(states) === undefined) return softSkip('inapplicable', 'every unadvertised state is one no legal transition from a draft or the active incumbent enters, so a refusal could not be told apart from an illegal-transition refusal');
+    const d = await lifecycle(g);
+    if (d.draft === undefined) return softSkip('blocked', NO_DRAFT);
+    if (d.unadvertised === undefined || typeof d.unadvertised === 'string') return softSkip('blocked', d.unadvertised ?? 'the probe was not sent');
+    expectAll(ID_UNADVERTISED, judgeValidationRefused(`a transition into unadvertised ${d.unadvertised.state}`, d.unadvertised.answer, d.unadvertised.before, d.unadvertised.after));
+  });
+
+  it('a draft promotes one step at a time over the advertised states to active on a channel', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const invalid = subsetInvalid(g);
+    expectAll(ID_LEGAL, invalid === null ? [] : [{ ok: false, message: invalid }]);
+    const why = walkInapplicable(g);
+    if (why !== null) return softSkip('inapplicable', why);
+    const d = await lifecycle(g);
+    if (d.draft === undefined) return softSkip('blocked', NO_DRAFT);
+    if (d.walk === undefined || typeof d.walk === 'string') return softSkip('blocked', d.walk ?? 'the walk did not run');
+    const version = d.draft;
+    const findings = d.walk.steps.flatMap((s) => judgeStep(s.answer, version, s.toState, record));
+    const done = d.walk.steps.length === promotionPath(g.states).length - 1 && d.walk.steps.every((s) => s.answer?.status === 200);
+    expectAll(ID_LEGAL, done ? [...findings, ...judgeBound(d.walk.after, version, CHANNEL)] : findings);
+  });
+
+  it('a replay re-reads the recorded version after the channel moved', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    if (!g.replay) return softSkip('inapplicable', 'the host does not advertise replay.modes including "replay"');
+    const why = walkInapplicable(g);
+    if (why !== null) return softSkip('inapplicable', `the channel cannot be moved: ${why}`);
+    const d = await lifecycle(g);
+    if (d.replay === undefined || typeof d.replay === 'string') return softSkip('blocked', d.replay ?? (d.draft === undefined ? NO_DRAFT : 'the walk did not reach active, so the channel never moved'));
+    expectAll(ID_REPLAY, judgeReplayPinned(d.replay.source, d.replay.moved, d.replay.pin));
+  });
+
+  it('adjust-canary sets the share on a canary host', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    if (g.facet['canary'] !== true) return softSkip('inapplicable', 'the host does not advertise agents.deployment.canary');
+    const why = walkInapplicable(g);
+    if (why !== null) return softSkip('inapplicable', `no active version to adjust: ${why}`);
+    const d = await lifecycle(g);
+    if (d.draft === undefined) return softSkip('blocked', NO_DRAFT);
+    if (d.canary === undefined || typeof d.canary === 'string') return softSkip('blocked', d.canary ?? 'the walk did not reach active');
+    expectAll(ID_CANARY, judgeCanaryAdjusted(d.canary.answer, d.draft, CANARY, d.canary.after, record));
+  });
+
+  it('a host without canary refuses a share below 100', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    if (g.facet['canary'] === true) return softSkip('inapplicable', 'the host advertises agents.deployment.canary');
+    const why = walkInapplicable(g);
+    if (why !== null) return softSkip('inapplicable', `no active version to adjust: ${why}`);
+    const d = await lifecycle(g);
+    if (d.draft === undefined) return softSkip('blocked', NO_DRAFT);
+    if (d.canary === undefined || typeof d.canary === 'string') return softSkip('blocked', d.canary ?? 'the walk did not reach active');
+    expectAll(ID_CANARY_REFUSED, judgeValidationRefused(`adjust-canary to ${CANARY} without canary`, d.canary.answer, d.canary.before, d.canary.after));
+  });
+
+  it('a rollback restores the incumbent and points at it', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    if (!rollbackServed(g)) return softSkip('inapplicable', 'the host does not advertise agents.deployment.rollback with rolled-back in states');
+    const why = walkInapplicable(g);
+    if (why !== null) return softSkip('inapplicable', `no active version to roll back: ${why}`);
+    const d = await lifecycle(g);
+    if (d.draft === undefined) return softSkip('blocked', NO_DRAFT);
+    if (d.rollback === undefined || typeof d.rollback === 'string') return softSkip('blocked', d.rollback ?? 'the walk did not reach active');
+    expectAll(ID_ROLLBACK, judgeRolledBack(d.rollback.answer, d.draft, d.activeAtR1, d.rollback.after, record));
+  });
+
+  it('a paused version resumes to active by promote', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    if (!advertises(g, 'paused')) return softSkip('inapplicable', 'agents.deployment.states does not advertise paused');
+    const d = await lifecycle(g);
+    if (d.resume === undefined || typeof d.resume === 'string') return softSkip('blocked', d.resume ?? 'the pause was not sent');
+    expectAll(ID_RESUME, judgeResumed(d.resume.pause, d.resume.resume, d.resume.version, d.resume.after, record));
+  });
+
+  it('every accepted transition names its deployment-management run', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const d = await lifecycle(g);
+    if (d.accepted.length === 0) return softSkip('blocked', 'no transition answered 200, so no record to read transitionRunId from');
+    expectAll(ID_RUN_LINKED, judgeRunLinked(d.accepted));
+  });
+
+  it('the management run records the transition\'s content-free deployment event', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const d = await lifecycle(g);
+    const linked = d.accepted.filter((x) => runIdOf(x) !== undefined);
+    if (linked.length === 0) return softSkip('blocked', 'no 200 transition record named a transitionRunId, so there is no management run to read');
+    const events = await managementRuns(d);
+    expectAll(ID_EVENT, linked.flatMap((x) => judgeEventRecorded(x, events.get(runIdOf(x) ?? ''), typeOf, PAYLOADS)));
+  });
+});