@openwop/openwop-conformance 2.46.34 → 2.46.36

package/src/scenarios/v2-interrupt-form-rules.test.ts

@@ -0,0 +1,143 @@
+/**
+ * v2-interrupt-form-rules — RFC 0255 §E, `spec/v2/core/interrupt.md` §Forms
+ * (target major 2; gated on fixtures, no capability or seam).
+ *
+ * A `clarification` MAY carry `data.form`, a closed declarative form
+ * (`schemas/v2/interrupt-form.schema.json`). The suite cannot make a node invent
+ * a form, so every leg runs a fixture whose `core.clarificationGate` node passes
+ * `config.form` verbatim as `data.form` (fixtures.md §conformance-interrupt-form).
+ *
+ * Legs:
+ *   1. the positive fixture suspends `waiting-input`, and its `interrupt.requested`
+ *      validates against `InterruptPayload` and carries the form unchanged beside
+ *      `questions`;
+ *   2. `{ answers: [{ id, answer }] }` resolves it and the run completes;
+ *   3. neither probe is raised with its form: `-refused` fails the schema (an
+ *      obscured TextField solicits a secret), `-unbound` is schema-valid but its
+ *      input names no `questions[].id`. The positive fixture is the control in the
+ *      same leg, so a host that raises no form at all cannot pass.
+ *
+ * Forms are OPTIONAL: a host advertising none of the fixtures records every leg
+ * `inapplicable`. A host advertising the positive fixture but not both probes
+ * records leg 3 `blocked`, so it cannot claim forms without the refusal.
+ * Rendering (closed catalog, no code execution, no fetch) is render-side and is
+ * witnessed by the reference-impl invariants `interrupt-form-no-code-exec` and
+ * `interrupt-form-no-network-egress`, not here.
+ *
+ * @see spec/v2/core/interrupt.md §Forms
+ * @see RFCS/0255-delete-the-ai-envelope.md §E
+ * @see SECURITY/invariants.yaml id: interrupt-form-action-confinement
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { FIXTURES_DIR } from '../lib/paths.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+type Json = Record<string, unknown>;
+interface Ev { type?: string; payload?: Json }
+
+const DOC = 'spec/v2/core/interrupt.md §Forms (RFC 0255 §E)';
+const R = (slug: string): string => `openwop.requirement.0255.${slug}`;
+const POSITIVE = 'conformance-interrupt-form';
+const PROBES = ['conformance-interrupt-form-refused', 'conformance-interrupt-form-unbound'] as const;
+const NODE = 'ask';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+const validInterrupt = v2Validator('suspend-request');
+
+const formOf = (fixture: string): Json => (JSON.parse(readFileSync(join(FIXTURES_DIR, `${fixture}.json`), 'utf8')) as { nodes: Array<{ config: { form: Json } }> }).nodes[0]!.config.form;
+const enc = (id: string): string => encodeURIComponent(id);
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
+async function discovery(): Promise<Json | null> { try { return await v2Discovery(); } catch { return null; } }
+
+async function statusOf(runId: string): Promise<string | null> {
+  const r = await http(() => driver.get(`/runs/${enc(runId)}`));
+  return r?.status === 200 ? String((r.json as { status?: unknown } | null)?.status ?? '') : null;
+}
+/** Wait until the run is terminal or suspended (any `waiting-*`), or `ms` elapses. */
+async function settle(runId: string, ms = 10_000): Promise<string | null> {
+  const end = Date.now() + ms;
+  for (;;) {
+    const s = await statusOf(runId);
+    if (s !== null && (TERMINAL.has(s) || s.startsWith('waiting-'))) return s;
+    if (Date.now() > end) return s;
+    await new Promise((ok) => setTimeout(ok, 200));
+  }
+}
+async function events(runId: string): Promise<Ev[]> {
+  const r = await http(() => driver.get(`/runs/${enc(runId)}/events/poll?timeout=1`));
+  return (r?.json as { events?: Ev[] } | null)?.events ?? [];
+}
+const requested = (evs: Ev[]): Ev[] => evs.filter((e) => e.type === 'interrupt.requested');
+const dataOf = (e: Ev | undefined): Json | undefined => (e?.payload?.['data'] as Json | undefined);
+
+/** Start `fixture` and return its runId, or why it could not be started. */
+async function start(fixture: string): Promise<{ runId: string } | { reason: string }> {
+  const r = await http(() => driver.post('/runs', { workflowId: fixture }));
+  if (r === null) return { reason: 'POST /runs unreachable (fetch failed)' };
+  const runId = (r.json as { runId?: unknown } | null)?.runId;
+  if (r.status !== 201 || typeof runId !== 'string') return { reason: `POST /runs (${fixture}) answered ${r.status} ${readErrorCode(r.json) ?? ''}`.trim() };
+  return { runId };
+}
+/** The positive fixture, suspended, with its `interrupt.requested`. */
+async function raised(): Promise<{ runId: string; ev: Ev | undefined } | { reason: string }> {
+  const s = await start(POSITIVE);
+  if ('reason' in s) return s;
+  const status = await settle(s.runId);
+  if (status !== 'waiting-input') return { reason: `the ${POSITIVE} run did not suspend waiting-input (status ${String(status)})` };
+  return { runId: s.runId, ev: requested(await events(s.runId)).find((e) => e.payload?.['kind'] === 'clarification') };
+}
+
+describe('v2 interrupt-form-rules (interrupt.md §Forms, RFC 0255 §E)', () => {
+  it('a clarification raised with a form carries it unchanged, beside questions, in a valid InterruptPayload', async () => {
+    if (!isFixtureAdvertised(POSITIVE)) return softSkip('inapplicable', `${POSITIVE} is not advertised — forms are OPTIONAL and this host claims none`);
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable');
+    const r = await raised();
+    if ('reason' in r) return softSkip('blocked', r.reason);
+    expect(r.ev, req(R('interrupt-form-rules'), DOC, 'the suspended run MUST record interrupt.requested { kind: "clarification" }')).toBeDefined();
+    const v = validInterrupt(r.ev?.payload);
+    expect(v.ok, req(R('interrupt-form-rules'), DOC, `interrupt.requested MUST validate against InterruptPayload, form included: ${v.errors}`)).toBe(true);
+    const data = dataOf(r.ev);
+    expect((data?.['questions'] as Array<{ id?: unknown }> | undefined)?.map((q) => q.id), req(R('interrupt-form-rules'), DOC, 'questions MUST stay beside the form as its fallback')).toEqual(['q1']);
+    expect(data?.['form'], req(R('interrupt-form-rules'), DOC, 'data.form MUST be the fixture\'s form, unchanged')).toEqual(formOf(POSITIVE));
+  }, 45_000);
+
+  it('a form resolves with { answers: [{ id, answer }] } and the run completes', async () => {
+    if (!isFixtureAdvertised(POSITIVE)) return softSkip('inapplicable', `${POSITIVE} is not advertised — forms are OPTIONAL and this host claims none`);
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable');
+    const r = await raised();
+    if ('reason' in r) return softSkip('blocked', r.reason);
+    const resumeValue = { answers: [{ id: 'q1', answer: 'blue' }] };
+    const res = await http(() => driver.post(`/runs/${enc(r.runId)}/interrupts/${NODE}`, { resumeValue }));
+    if (res === null) return softSkip('blocked', 'the resolve was unreachable (fetch failed)');
+    expect(res.status, req(R('interrupt-form-resume-answers'), DOC, `a resolve carrying { answers: [{ id, answer }] } MUST be accepted (got ${res.status} ${readErrorCode(res.json) ?? ''})`)).toBeGreaterThanOrEqual(200);
+    expect(res.status, req(R('interrupt-form-resume-answers'), DOC, 'the resolve MUST be a 2xx')).toBeLessThan(300);
+    expect(await settle(r.runId), req(R('interrupt-form-resume-answers'), DOC, 'the resolved run MUST complete')).toBe('completed');
+  }, 45_000);
+
+  it('a form that fails the schema or binds an input to no question is never raised', async () => {
+    if (!isFixtureAdvertised(POSITIVE)) return softSkip('inapplicable', `${POSITIVE} is not advertised — forms are OPTIONAL and this host claims none`);
+    const missing = PROBES.filter((p) => !isFixtureAdvertised(p));
+    if (missing.length > 0) return softSkip('blocked', `${POSITIVE} is advertised but ${missing.join(', ')} is not — a host claiming forms MUST also advertise the refusal probes`);
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable');
+    const control = await raised();
+    if ('reason' in control) return softSkip('blocked', `control: ${control.reason}`);
+    expect(dataOf(control.ev)?.['form'], req(R('interrupt-form-refused'), DOC, 'control: the positive fixture MUST raise its form, or a host raising none would pass')).toEqual(formOf(POSITIVE));
+    for (const probe of PROBES) {
+      const s = await start(probe);
+      // Refusing the run at creation also never raises the form; only a non-answer is undecidable.
+      if ('reason' in s) { if (/answered 4\d\d/.test(s.reason)) continue; return softSkip('blocked', `${probe}: ${s.reason}`); }
+      const status = await settle(s.runId);
+      const carrying = requested(await events(s.runId)).filter((e) => dataOf(e)?.['form'] !== undefined);
+      expect(carrying.map((e) => dataOf(e)?.['form']), req(R('interrupt-form-refused'), DOC, `${probe}: no interrupt.requested may carry the form (run status ${String(status)})`)).toEqual([]);
+      await http(() => driver.post(`/runs/${enc(s.runId)}/cancel`, {}));
+    }
+    await http(() => driver.post(`/runs/${enc(control.runId)}/cancel`, {}));
+  }, 60_000);
+});

package/src/scenarios/v2-limits-clarification-rounds-advertisement.test.ts

@@ -0,0 +1,42 @@
+/**
+ * v2 — `limits.clarificationRounds` (`spec/v2/core/runs.md` §Limits: "`limits`
+ * always carries `clarificationRounds` (per task)"). The two envelope caps that
+ * sat beside it, `schemaRounds` and `envelopesPerTurn`, were deleted with the AI
+ * Envelope (RFC 0255 §C); `maxToolRounds` and `maxRepairRounds` replace them as
+ * OPTIONAL facets. The leg lives in `lib/family-advert-witness.ts`. The other
+ * `limits` facets (`maxRunDurationMs`, `maxLoopIterations`) are `v2-run-execution-bounds`.
+ *
+ * The cap MUST be present and validate against its subschema in
+ * `schemas/v2/capabilities.schema.json` (a non-negative integer).
+ *
+ * Dispositions: discovery unreadable ⇒ `blocked`; `limits` absent ⇒
+ * `inapplicable` (at v2 presence of the record is the claim; the root schema
+ * requires only `protocolVersions` and `preferredVersion`).
+ *
+ * @see spec/v2/core/runs.md §Limits
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { limitsCapLeg } from '../lib/family-advert-witness.js';
+
+const PROFILE = majorProfile(2);
+const UNREADABLE = 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0';
+const ID_CLARIFICATION = 'openwop.requirement.limits.clarification-rounds-advertised';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+describe('v2 limits.clarificationRounds (runs.md §Limits)', () => {
+  it('limits.clarificationRounds is present and a non-negative integer', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = limitsCapLeg(PROFILE, doc, 'clarificationRounds');
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_CLARIFICATION, x.doc, x.message)).toBe(true);
+  });
+});

package/src/scenarios/v2-peer-dependency-declared.test.ts

@@ -126,7 +126,7 @@ describe('v2-peer-dependency-declared (RFC 0177 §B.1/§B.2)', () => {
     const skip = await preflight();
     if (skip) return softSkip(skip.kind, skip.reason);
     if (!existsSync(ALIASES)) return softSkip('blocked', 'spec/v2/peer-dependency-aliases.json is not present in this layout — the alias row cannot be chosen');
-    const rows = (JSON.parse(readFileSync(ALIASES, 'utf8')) as { rows: AliasRow[] }).rows.filter((r) => !r.facets || r.facets.length === 0);
+    const rows = (JSON.parse(readFileSync(ALIASES, 'utf8')) as { rows: AliasRow[] }).rows.filter((r) => Boolean(r.family) && (!r.facets || r.facets.length === 0));
     let chosen: AliasRow | null = null;
     const fs = rows.find((r) => r.alias === 'host.fs');
     if (fs && (await familyAdvertised(fs.family))) chosen = fs;

package/src/scenarios/v2-provider-output-reliability.test.ts

@@ -0,0 +1,94 @@
+/**
+ * v2 — structured-output reliability through the mock provider
+ * (`spec/v2/core/host-services.md` §Structured output; RFC 0255 §A, which moved
+ * these rules unchanged from the deleted `envelopes` family).
+ *
+ * Unaided, through the `conformance-callai-attempt-accounting` fixture: its node
+ * makes one `ctx.callAI` call with `responseSchema`, and the host's conformance
+ * mock serves the case's script (`lib/callai-attempts-witness.ts`). The suite
+ * wrote the script, so it knows what every provider request returned.
+ *
+ *   truncation  truncated, then valid → the host emits `envelope.truncated` and
+ *               the call completes (gated on `reliability.completion.distinguishesTruncation`);
+ *   exhaustion  every reply violates the schema, `retry.maxAttempts: 2` → the
+ *               node fails `envelope_invalid`, after `envelope.retry-exhausted`
+ *               and `cap.breached` `kind: "schema"`;
+ *   refusal     the provider refuses → the node fails `envelope_refusal` after
+ *               `envelope.refusal`, with no `envelope.retry-attempted`: a refusal
+ *               is never retried.
+ *
+ * Dispositions: discovery unreadable ⇒ `blocked`; `aiProviders.reliability` not
+ * advertised, or the fixture not listed ⇒ `inapplicable`. A run that cannot be
+ * created or read ⇒ `blocked`. A refusal script the host's mock refuses as input
+ * (`validation_error`) ⇒ `blocked`.
+ *
+ * @see RFCS/0255-delete-the-ai-envelope.md §Conformance
+ * @see conformance/fixtures.md §The ctx.callAI attempt-accounting fixture
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { runCase, type CaseRun } from '../lib/callai-attempts-witness.js';
+
+const SECTION = 'host-services.md §Structured output';
+const ID_TRUNCATION = 'openwop.requirement.0255.provider-output-truncation';
+const ID_EXHAUSTION = 'openwop.requirement.0255.provider-output-exhaustion';
+const ID_REFUSAL = 'openwop.requirement.0255.provider-output-refusal';
+const UNREADABLE = 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0';
+
+type Skip = readonly ['inapplicable' | 'blocked', string];
+const isRec = (v: unknown): v is Record<string, unknown> => typeof v === 'object' && v !== null && !Array.isArray(v);
+
+/** The advertised `aiProviders.reliability`, or why the legs cannot run. */
+async function reliability(): Promise<{ skip: Skip } | { rel: Record<string, unknown> }> {
+  const doc = await v2Discovery().catch(() => null);
+  if (!doc) return { skip: ['blocked', UNREADABLE] };
+  const ai = doc['aiProviders'];
+  const rel = isRec(ai) && isRec(ai['reliability']) ? ai['reliability'] : undefined;
+  if (!rel) return { skip: ['inapplicable', 'the host does not advertise aiProviders.reliability'] };
+  return { rel };
+}
+
+async function drive(name: 'truncation' | 'exhaustion' | 'refusal'): Promise<{ skip: Skip } | { run: CaseRun }> {
+  const d = await runCase(name);
+  if (d.kind === 'skip') return { skip: [d.disposition, d.reason] };
+  return { run: d.run };
+}
+
+describe('v2-provider-output-reliability (RFC 0255 §A)', () => {
+  it('a truncated reply emits envelope.truncated and the retried call completes', async () => {
+    const g = await reliability();
+    if ('skip' in g) return softSkip(...g.skip);
+    const completion = g.rel['completion'];
+    if (!isRec(completion) || completion['distinguishesTruncation'] !== true) return softSkip('inapplicable', 'the host does not advertise aiProviders.reliability.completion.distinguishesTruncation');
+    const o = await drive('truncation');
+    if ('skip' in o) return softSkip(...o.skip);
+    expect(o.run.types.filter((t) => t === 'envelope.truncated').length, req(ID_TRUNCATION, SECTION, 'a truncated reply MUST emit envelope.truncated')).toBeGreaterThanOrEqual(1);
+    expect(o.run.status, req(ID_TRUNCATION, SECTION, `the call MUST complete once the retry returns valid output (got ${o.run.status}, ${o.run.errorCode ?? 'no code'})`)).toBe('completed');
+  });
+
+  it('when the repair budget runs out the node fails envelope_invalid after retry-exhausted and cap.breached schema', async () => {
+    const g = await reliability();
+    if ('skip' in g) return softSkip(...g.skip);
+    const o = await drive('exhaustion');
+    if ('skip' in o) return softSkip(...o.skip);
+    expect(o.run.status, req(ID_EXHAUSTION, SECTION, 'a call whose every reply violates the schema MUST fail')).toBe('failed');
+    expect(o.run.errorCode, req(ID_EXHAUSTION, SECTION, 'the node MUST fail with envelope_invalid')).toBe('envelope_invalid');
+    expect(o.run.types.includes('envelope.retry-exhausted'), req(ID_EXHAUSTION, SECTION, 'exhaustion MUST emit envelope.retry-exhausted')).toBe(true);
+    expect(o.run.capBreachedKinds.includes('schema'), req(ID_EXHAUSTION, SECTION, `exhaustion MUST emit cap.breached kind "schema" (got ${JSON.stringify(o.run.capBreachedKinds)})`)).toBe(true);
+  });
+
+  it('a refusal fails the node envelope_refusal after envelope.refusal and is never retried', async () => {
+    const g = await reliability();
+    if ('skip' in g) return softSkip(...g.skip);
+    const o = await drive('refusal');
+    if ('skip' in o) return softSkip(...o.skip);
+    if (o.run.errorCode === 'validation_error') return softSkip('blocked', 'the host mock refused the `refusal` script kind as input (fixtures.md), so no refusal reached the call');
+    expect(o.run.status, req(ID_REFUSAL, SECTION, `a refusal MUST fail the node, never fall through to the scripted valid reply (got ${o.run.status})`)).toBe('failed');
+    expect(o.run.errorCode, req(ID_REFUSAL, SECTION, 'the node MUST fail with envelope_refusal')).toBe('envelope_refusal');
+    expect(o.run.types.includes('envelope.refusal'), req(ID_REFUSAL, SECTION, 'a refusal MUST emit envelope.refusal')).toBe(true);
+    expect(o.run.types.includes('envelope.retry-attempted'), req(ID_REFUSAL, SECTION, 'a host MUST NOT retry a refusal')).toBe(false);
+  });
+});

package/src/scenarios/v2-structured-output-advertisement.test.ts

@@ -0,0 +1,82 @@
+/**
+ * v2 — the structured-output facets of `aiProviders`
+ * (`spec/v2/core/host-services.md` §Structured output; RFCs 0030, 0032, 0033).
+ * RFC 0255 §A moved them here from the deleted `envelopes` family, unchanged
+ * except that `reliability.events[]` takes the v2 names only. A claims-check
+ * reading: what the host says about its posture is what is witnessed. The legs
+ * live in `lib/family-advert-witness.ts`.
+ *
+ *   record       the `aiProviders` record validates against its capabilities-schema seat;
+ *   reasoning    `reasoning.promptDirective` is mandatory | advisory | off;
+ *   tier-one     `tierOneSubsetCompliance` is strict | warn | off;
+ *   reliability  `reliability.events[]` names only reliability events and lists
+ *                the two MUST-tier events `envelope.retry-exhausted` and `envelope.refusal`;
+ *   completion   `reliability.completion.distinguishesTruncation` is a boolean
+ *                and `truncationBudgetMultiplier` is in [1, 8].
+ *
+ * Dispositions: discovery unreadable ⇒ `blocked`; `aiProviders` absent, or the
+ * facet a leg reads absent ⇒ `inapplicable`.
+ *
+ * @see spec/v2/core/host-services.md §Structured output
+ */
+
+import { describe, it, expect } from 'vitest';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { structuredOutputCompletionLeg, structuredOutputReasoningLeg, structuredOutputReliabilityLeg, structuredOutputTierOneLeg, recordSchemaLeg } from '../lib/family-advert-witness.js';
+
+const PROFILE = majorProfile(2);
+const ID_RECORD = 'openwop.requirement.aiProviders.structured-output-record';
+const ID_REASONING = 'openwop.requirement.aiProviders.reasoning-advert-shape';
+const ID_TIER_ONE = 'openwop.requirement.aiProviders.tier-one-subset-compliance-value';
+const ID_RELIABILITY = 'openwop.requirement.aiProviders.reliability-events-advert';
+const ID_COMPLETION = 'openwop.requirement.aiProviders.completion-advert-shape';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+const UNREADABLE = 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0';
+
+describe('v2 structured-output advertisement (host-services.md §Structured output)', () => {
+  it('the aiProviders record validates against its capabilities-schema seat', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = recordSchemaLeg(PROFILE, doc, 'aiProviders', 'host-services.md §Structured output');
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_RECORD, x.doc, x.message)).toBe(true);
+  });
+
+  it('aiProviders.reasoning.promptDirective is mandatory, advisory or off', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = structuredOutputReasoningLeg(PROFILE, doc);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_REASONING, x.doc, x.message)).toBe(true);
+  });
+
+  it('aiProviders.tierOneSubsetCompliance is strict, warn or off', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = structuredOutputTierOneLeg(PROFILE, doc);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_TIER_ONE, x.doc, x.message)).toBe(true);
+  });
+
+  it('aiProviders.reliability.events lists only reliability events and includes retry-exhausted and refusal', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = structuredOutputReliabilityLeg(PROFILE, doc);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_RELIABILITY, x.doc, x.message)).toBe(true);
+  });
+
+  it('aiProviders.reliability.completion.distinguishesTruncation is a boolean', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREADABLE);
+    const out = structuredOutputCompletionLeg(PROFILE, doc);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(ID_COMPLETION, x.doc, x.message)).toBe(true);
+  });
+});

package/src/lib/envelope-schema-static.ts

@@ -1,167 +0,0 @@
-/**
- * Static walkers over envelope payload schemas, shared by the v2 static twins:
- * the scenario `v2-envelope-tier-one-subset-static` and the corpus gates
- * `v2-envelope-tier-one-universal-static` and `v2-envelope-variant-discriminator-static`.
- *
- * The walk rules are the v1 rules unchanged (RFC 0030 §B, RFC 0031 §A); what
- * moved at major 2 is where the schemas live (`schemas/v2/envelopes/`) and
- * where a host's kind catalog is advertised (`supportedEnvelopes.kinds`, a
- * family record, instead of a root `string[]`).
- *
- * Every function here is pure and is proven in both directions in
- * `envelope-schema-static.test.ts`: a conforming schema yields no violation,
- * and each defect yields the one it names.
- */
-
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { SCHEMAS_DIR } from './paths.js';
-
-export interface SchemaViolation { readonly path: string; readonly rule: string; readonly detail?: string }
-
-const isRecord = (v: unknown): v is Record<string, unknown> => v !== null && typeof v === 'object' && !Array.isArray(v);
-
-/** The v2 envelope payload schema directory. */
-export const V2_ENVELOPES_DIR = join(SCHEMAS_DIR, 'v2', 'envelopes');
-
-/** The four kinds every engine recognizes (`events.md` §"AI envelopes"). */
-export const UNIVERSAL_KINDS = ['clarification.request', 'schema.request', 'schema.response', 'error'] as const;
-
-/** A v2 envelope payload schema by kind, or `null` when the corpus has none. */
-export function loadV2EnvelopeSchema(kind: string): Record<string, unknown> | null {
-  const p = join(V2_ENVELOPES_DIR, `${kind}.schema.json`);
-  if (!existsSync(p)) return null;
-  const v: unknown = JSON.parse(readFileSync(p, 'utf8'));
-  return isRecord(v) ? v : null;
-}
-
-/** Every kind with a payload schema under `schemas/v2/envelopes/`. */
-export function listV2EnvelopeKinds(): string[] {
-  if (!existsSync(V2_ENVELOPES_DIR)) return [];
-  return readdirSync(V2_ENVELOPES_DIR).filter((f) => f.endsWith('.schema.json')).map((f) => f.replace(/\.schema\.json$/, '')).sort();
-}
-
-// ---------------------------------------------------------------------------
-// RFC 0030 §B — the Tier-1 structured-output subset.
-// ---------------------------------------------------------------------------
-
-/** Keywords that fail across more than one Tier-1 vendor (Gemini drops `oneOf` silently). Checked in both modes. */
-const LOAD_BEARING_KEYWORDS = ['oneOf', 'allOf', 'not', 'if', 'then', 'else', 'dependencies', 'prefixItems', 'propertyNames'] as const;
-export const MAX_DEPTH = 5;
-export const MAX_PROPERTIES = 100;
-
-const hasType = (schema: Record<string, unknown>, t: string): boolean => schema['type'] === t || (Array.isArray(schema['type']) && (schema['type'] as unknown[]).includes(t));
-
-/**
- * Walk a payload schema for Tier-1 subset violations.
- *
- * `load-bearing`: only the rules that fail across several vendors — the floor
- * every corpus schema is held to. `strict`: every rule of the OpenAI-strict ∩
- * Anthropic-strict ∩ Gemini intersection, applied only when a host advertises
- * `envelopes.tierOneSubsetCompliance: "strict"`.
- */
-export function tierOneViolations(schema: Record<string, unknown>, mode: 'load-bearing' | 'strict'): SchemaViolation[] {
-  const out: SchemaViolation[] = [];
-  const count = { n: 0 };
-  walkTierOne(schema, '#', 0, count, out, mode);
-  if (count.n > MAX_PROPERTIES) out.push({ path: '#', rule: 'max-property-count-100-exceeded', detail: `count=${count.n}` });
-  return out;
-}
-
-function walkTierOne(schema: Record<string, unknown>, path: string, depth: number, count: { n: number }, out: SchemaViolation[], mode: 'load-bearing' | 'strict'): void {
-  if (depth > MAX_DEPTH) { out.push({ path, rule: 'max-nesting-depth-5', detail: `depth=${depth}` }); return; }
-  for (const kw of LOAD_BEARING_KEYWORDS) if (kw in schema) out.push({ path, rule: 'forbidden-keyword', detail: kw });
-  if (Array.isArray(schema['anyOf'])) {
-    (schema['anyOf'] as unknown[]).forEach((b, i) => { if (isRecord(b)) walkTierOne(b, `${path}/anyOf/${i}`, depth + 1, count, out, mode); });
-  }
-  if (hasType(schema, 'object')) {
-    if (mode === 'strict' && schema['additionalProperties'] !== false) out.push({ path, rule: 'additionalProperties-must-be-false-on-object-strict-only' });
-    const props = isRecord(schema['properties']) ? schema['properties'] : {};
-    const required = Array.isArray(schema['required']) ? (schema['required'] as unknown[]) : [];
-    for (const [name, sub] of Object.entries(props)) {
-      count.n++;
-      if (mode === 'strict' && !required.includes(name)) out.push({ path: `${path}/properties/${name}`, rule: 'property-not-in-required-strict-mode-only' });
-      if (isRecord(sub)) walkTierOne(sub, `${path}/properties/${name}`, depth + 1, count, out, mode);
-    }
-  }
-  if (mode === 'strict') {
-    const bounded: Array<[boolean, readonly string[], string]> = [
-      [hasType(schema, 'string'), ['minLength', 'maxLength', 'pattern', 'format'], 'forbidden-string-constraint-strict-only'],
-      [hasType(schema, 'number') || hasType(schema, 'integer'), ['minimum', 'maximum', 'multipleOf'], 'forbidden-number-constraint-strict-only'],
-      [hasType(schema, 'array'), ['minItems', 'maxItems', 'uniqueItems'], 'forbidden-array-constraint-strict-only'],
-    ];
-    for (const [applies, kws, rule] of bounded) if (applies) for (const kw of kws) if (kw in schema) out.push({ path, rule, detail: kw });
-  }
-  if (hasType(schema, 'array') && isRecord(schema['items'])) walkTierOne(schema['items'], `${path}/items`, depth + 1, count, out, mode);
-  const defs = isRecord(schema['$defs']) ? schema['$defs'] : {};
-  for (const [name, sub] of Object.entries(defs)) if (isRecord(sub)) walkTierOne(sub, `${path}/$defs/${name}`, depth + 1, count, out, mode);
-}
-
-// ---------------------------------------------------------------------------
-// RFC 0031 §A — variant payloads: no `oneOf`; every `anyOf` branch discriminated.
-// ---------------------------------------------------------------------------
-
-/** `oneOf` anywhere in a payload schema. */
-export function oneOfViolations(schema: unknown, path = '#'): SchemaViolation[] {
-  const out: SchemaViolation[] = [];
-  const walk = (s: unknown, p: string): void => {
-    if (Array.isArray(s)) { s.forEach((x, i) => walk(x, `${p}/${i}`)); return; }
-    if (!isRecord(s)) return;
-    if ('oneOf' in s) out.push({ path: p, rule: 'oneOf-forbidden', detail: 'use anyOf with a single-string-enum discriminator (RFC 0031 §A)' });
-    for (const [k, v] of Object.entries(s)) walk(v, `${p}/${k}`);
-  };
-  walk(schema, path);
-  return out;
-}
-
-/**
- * A branch is discriminated when one of its `required` properties is
- * `type: string` with an `enum` of exactly one value. A `$ref` branch is
- * accepted unresolved, as at v1: the referenced shape is walked where it is
- * defined, and a version-selected union (one branch per `schemaVersion`, as
- * `ui.a2ui-surface` declares) is not a payload-field discrimination at all.
- */
-export function branchDiscriminated(branch: unknown): boolean {
-  if (!isRecord(branch)) return false;
-  if ('$ref' in branch) return true;
-  const required = Array.isArray(branch['required']) ? (branch['required'] as unknown[]) : [];
-  const props = isRecord(branch['properties']) ? branch['properties'] : {};
-  return required.some((name) => {
-    const p = typeof name === 'string' ? props[name] : undefined;
-    return isRecord(p) && p['type'] === 'string' && Array.isArray(p['enum']) && (p['enum'] as unknown[]).length === 1;
-  });
-}
-
-/** Whether a branch can match a JSON object: an explicit object type, a `$ref`, or object keywords with no type. */
-function admitsObject(branch: unknown): boolean {
-  if (!isRecord(branch)) return false;
-  if ('$ref' in branch) return true;
-  const t = branch['type'];
-  if (t === undefined) return 'properties' in branch || 'required' in branch;
-  return t === 'object' || (Array.isArray(t) && t.includes('object'));
-}
-
-/**
- * Every `anyOf` branch, at any depth, that carries no single-string-enum
- * discriminator — in a VARIANT union, one where two or more branches can be
- * objects. A union with at most one object branch (`string | binding`,
- * `string | number | boolean | array | binding`, as `ui.a2ui-surface`
- * payload v2 declares) is a type union: JSON type alone selects the branch, no
- * field is inspected, and a scalar branch has no property to discriminate on.
- * RFC 0031 §A governs variant payloads; it is not read as forbidding these.
- */
-export function anyOfDiscriminatorViolations(schema: unknown, path = '#'): SchemaViolation[] {
-  const out: SchemaViolation[] = [];
-  const walk = (s: unknown, p: string): void => {
-    if (Array.isArray(s)) { s.forEach((x, i) => walk(x, `${p}/${i}`)); return; }
-    if (!isRecord(s)) return;
-    if (Array.isArray(s['anyOf']) && (s['anyOf'] as unknown[]).filter(admitsObject).length >= 2) {
-      (s['anyOf'] as unknown[]).forEach((b, i) => {
-        if (admitsObject(b) && !branchDiscriminated(b)) out.push({ path: `${p}/anyOf/${i}`, rule: 'anyOf-branch-missing-discriminator', detail: 'a branch MUST declare a single-string-enum discriminator property in required (RFC 0031 §A)' });
-      });
-    }
-    for (const [k, v] of Object.entries(s)) walk(v, `${p}/${k}`);
-  };
-  walk(schema, path);
-  return out;
-}