@openwop/openwop-conformance 2.46.38 → 2.46.40

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## [2.46.40] — 2026-11-01 — No suite change
+
+- **Version only.** Ships with corpus 2.46.40, which closes two gap-register rows; no scenario, fixture or library changed.
+
+## [2.46.39] — 2026-10-31 — Read back an installed pack (RFC 0253)
+
+- **New scenario `v2-proposal-pack-readback` (RFC 0253).** A server-free leg (`0253.shape`) and eleven host legs gated per pack kind on `agents.proposals` with `clientDrafts` and the kind in `artifactKinds` and `readback`: inertness, apply, byte-match, §D refusals, install conflict, cross-tenant reads.
+- **Judges** in `lib/proposal-pack-readback-witness.ts` with eight self-tests. A §D refusal at submit counts when nothing installs. Before merge every host leg failed its targeted sabotage on a fake host and passed a conforming one.
+- **`v2-unadvertised-operation-not-found`** gains `0253.unadvertised-not-found`: `GET /installed-packs/{packName}` is `404 not_found` when `readback` lists no pack kind.
+
 ## [2.46.38] — 2026-10-31 — Last AI Envelope names out of v2 descriptions
 
 - **No suite change.** The cycle carries description-only edits to six v2 schemas and facets, which change the packed `@openwop/spec-artifacts`.

package/README.md

@@ -137,7 +137,7 @@ Each scenario file records its disposition and assertion count in `<report-dir>/
 
 ## What's Covered
 
-The current suite has 664 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 224 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
+The current suite has 665 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 225 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
 
 The v2 scenarios (`src/scenarios/v2-*.test.ts`) cover, by area:
 
@@ -166,7 +166,7 @@ Three kinds of scenario share the tree:
 - **Host** checks drive a live host over HTTP.
 - **Gated** checks run only when the host advertises the family, profile or fixture they need, and otherwise record `inapplicable` or `blocked` with a reason. `--require-behavior` turns an advertised-but-unwitnessable behaviour into a failure.
 
-Current source tree: 664 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
+Current source tree: 665 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
 
 ## How the 2.x suite is built
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.46.38",
-  "stampSha256": "7c1c63b2ee12b7a0437c970de613d04e1e003fb4d495641256d8a6cdc1782211"
+  "version": "2.46.40",
+  "stampSha256": "681c2972a462f2bb843619c0774e2dd6e26d2c957534138c5ca69f9b2af8b3ca"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.46.38",
+  "version": "2.46.40",
   "description": "Black-box conformance suite for OpenWOP hosts (v2 current; v1 scenarios retained for the frozen v1 tree).",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.46.38"
+    "@openwop/spec-artifacts": "2.46.40"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 747,
-    "tests": 2855,
-    "withStableId": 2855,
+    "files": 748,
+    "tests": 2868,
+    "withStableId": 2868,
     "interpolatedTitles": 0,
-    "explicitIds": 2725
+    "explicitIds": 2738
   },
   "records": [
     {
@@ -36063,6 +36063,128 @@
       "explicitId": "openwop.requirement.0249.cross-tenant-not-found",
       "citations": []
     },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.installedartifact-names-getinstalledpack-with-a-version-the-fresh-artifacts-are",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 209,
+      "title": "installedArtifact names getInstalledPack with a version; the fresh artifacts are valid and admissible; the negatives break §D",
+      "explicitId": "openwop.requirement.0253.shape",
+      "citations": [
+        {
+          "section": "proposal.schema.json installedArtifact, the two manifest schemas, agents.schema.json §proposals.readback (RFC 0253 §B–§D)",
+          "requirement": "an installedArtifact naming getInstalledPack with a version MUST validate"
+        },
+        {
+          "section": "proposal.schema.json installedArtifact, the two manifest schemas, agents.schema.json §proposals.readback (RFC 0253 §B–§D)",
+          "requirement": "the fresh chain pack MUST validate against workflow-chain-pack-manifest"
+        },
+        {
+          "section": "proposal.schema.json installedArtifact, the two manifest schemas, agents.schema.json §proposals.readback (RFC 0253 §B–§D)",
+          "requirement": "the fresh agent pack MUST validate against node-pack-manifest"
+        },
+        {
+          "section": "proposal.schema.json installedArtifact, the two manifest schemas, agents.schema.json §proposals.readback (RFC 0253 §B–§D)",
+          "requirement": "the fresh chain pack MUST satisfy §D"
+        },
+        {
+          "section": "proposal.schema.json installedArtifact, the two manifest schemas, agents.schema.json §proposals.readback (RFC 0253 §B–§D)",
+          "requirement": "the fresh agent pack MUST satisfy §D"
+        },
+        {
+          "section": "proposal.schema.json installedArtifact, the two manifest schemas, agents.schema.json §proposals.readback (RFC 0253 §B–§D)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.an-unapplied-workflow-chain-pack-is-not-served",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 235,
+      "title": "an unapplied workflow-chain-pack is not served",
+      "explicitId": "openwop.requirement.0253.chain-draft-inert",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.an-authorized-apply-of-a-workflow-chain-pack-names-getinstalledpack-the-name-and",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 241,
+      "title": "an authorized apply of a workflow-chain-pack names getInstalledPack, the name and the version",
+      "explicitId": "openwop.requirement.0253.chain-apply-installs",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.the-installed-workflow-chain-pack-is-the-reviewed-revision-byte-for-byte",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 247,
+      "title": "the installed workflow-chain-pack is the reviewed revision, byte for byte",
+      "explicitId": "openwop.requirement.0253.chain-readback-byte-match",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.an-unapplied-agent-pack-is-not-served-and-its-agent-is-not-resolvable-or-listed",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 255,
+      "title": "an unapplied agent-pack is not served, and its agent is not resolvable or listed",
+      "explicitId": "openwop.requirement.0253.agent-draft-inert",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.an-authorized-apply-of-an-agent-pack-names-getinstalledpack-the-name-and-the-ver",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 261,
+      "title": "an authorized apply of an agent-pack names getInstalledPack, the name and the version, and resolves the agent",
+      "explicitId": "openwop.requirement.0253.agent-apply-installs",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.the-installed-agent-pack-is-the-reviewed-revision-byte-for-byte",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 267,
+      "title": "the installed agent-pack is the reviewed revision, byte for byte",
+      "explicitId": "openwop.requirement.0253.agent-readback-byte-match",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.an-agent-pack-with-a-file-reference-or-with-nodes-is-refused-and-installs-nothin",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 275,
+      "title": "an agent pack with a file reference, or with nodes, is refused and installs nothing",
+      "explicitId": "openwop.requirement.0253.agent-file-ref-refused",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.a-pack-named-outside-private-is-refused-and-installs-nothing",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 294,
+      "title": "a pack named outside private.* is refused and installs nothing",
+      "explicitId": "openwop.requirement.0253.namespace-refused",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.a-pack-carrying-signing-is-refused-and-installs-nothing",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 304,
+      "title": "a pack carrying signing is refused and installs nothing",
+      "explicitId": "openwop.requirement.0253.signing-refused",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.a-second-apply-at-the-installed-name-and-version-is-an-install-conflict",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 314,
+      "title": "a second apply at the installed name and version is an install conflict",
+      "explicitId": "openwop.requirement.0253.install-conflict",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-proposal-pack-readback.another-tenant-sees-the-installed-pack-and-agent-as-unknown-names",
+      "file": "v2-proposal-pack-readback.test.ts",
+      "line": 323,
+      "title": "another tenant sees the installed pack and agent as unknown names",
+      "explicitId": "openwop.requirement.0253.cross-tenant-not-found",
+      "citations": []
+    },
     {
       "id": "openwop.it.v2-protected-resource-metadata.serves-rfc-9728-metadata-unauthenticated-at-the-uri-derived-from-its-resource-id",
       "file": "v2-protected-resource-metadata.test.ts",
@@ -38674,7 +38796,7 @@
     {
       "id": "openwop.it.v2-unadvertised-operation-not-found.get-prompts-answers-404-not-found-when-prompts-endpointssupported-is-not-adverti",
       "file": "v2-unadvertised-operation-not-found.test.ts",
-      "line": 45,
+      "line": 47,
       "title": "GET /prompts answers 404 not_found when prompts.endpointsSupported is not advertised",
       "explicitId": "openwop.requirement.0228.unadvertised-prompts-not-found",
       "citations": [
@@ -38692,7 +38814,7 @@
     {
       "id": "openwop.it.v2-unadvertised-operation-not-found.get-content-settings-answers-404-not-found-when-content-is-not-advertised",
       "file": "v2-unadvertised-operation-not-found.test.ts",
-      "line": 56,
+      "line": 58,
       "title": "GET /content/settings answers 404 not_found when content is not advertised",
       "explicitId": "openwop.requirement.0228.unadvertised-content-not-found",
       "citations": [
@@ -38710,7 +38832,7 @@
     {
       "id": "openwop.it.v2-unadvertised-operation-not-found.get-proposals-answers-404-not-found-when-agents-proposals-is-not-advertised-rfc",
       "file": "v2-unadvertised-operation-not-found.test.ts",
-      "line": 66,
+      "line": 68,
       "title": "GET /proposals answers 404 not_found when agents.proposals is not advertised (RFC 0249)",
       "explicitId": "openwop.requirement.0249.unadvertised-not-found",
       "citations": [
@@ -38725,6 +38847,24 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-unadvertised-operation-not-found.get-installed-packs-packname-answers-404-not-found-when-readback-lists-no-pack-k",
+      "file": "v2-unadvertised-operation-not-found.test.ts",
+      "line": 80,
+      "title": "GET /installed-packs/{packName} answers 404 not_found when readback lists no pack kind (RFC 0253)",
+      "explicitId": "openwop.requirement.0253.unadvertised-not-found",
+      "citations": [
+        {
+          "section": "spec/v2/core/errors.md §Unadvertised operations",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md §Unadvertised operations",
+          "requirement": "the 404 for an unadvertised gated operation MUST carry the registered code not_found"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-unmapped-type-refused.poll-over-a-log-with-an-unmapped-unprefixed-type-fails-with-500-event-type-unmap",
       "file": "v2-unmapped-type-refused.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 664,
+    "files": 665,
     "v1": 455,
-    "v2": 224
+    "v2": 225
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1695,6 +1695,9 @@
     "v2-proposal-lifecycle.test.ts": [
       2
     ],
+    "v2-proposal-pack-readback.test.ts": [
+      2
+    ],
     "v2-protected-resource-metadata.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.46.38",
-  "corpusTag": "v2.46.38",
+  "version": "2.46.40",
+  "corpusTag": "v2.46.40",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "27a3edfe025994989a2296f3d5d4a0c52d8e1ce924a8f450a0dddc5ad736d8ff",
-    "api/v2/asyncapi.yaml": "9f06497fcd4d96f96aacb59d43e88f6f1126c5f52846c9d3d0704bce458de6ae",
-    "api/v2/openapi.yaml": "46bbe19ff9bc87b9c3155dc6fd49a9af6bb8a154edf40df9edb6aeaf26f7b770",
+    "api/seams-v2.yaml": "07047393b4d55b90cfca9d2ac70c2f57bd5ae82b08eb0180e0dcb072aa8e76fd",
+    "api/v2/asyncapi.yaml": "f7823f811bc889b2f9c1db6a63c2ffbd9a5291456e527b1f61fdcc856c38088a",
+    "api/v2/openapi.yaml": "9b70b5b52fb57fc074552c741c15a8d7a81c979e9c2ef82bc80cf6a393be4eb4",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -115,7 +115,7 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
-    "schemas/v2/capabilities.schema.json": "4ec06ca94cc9314aa2331916738c12f329bd28c7efb7d3ddfde75b2055bbb05c",
+    "schemas/v2/capabilities.schema.json": "93cd1f6f4ffbd98ec5439e4d014233b1ed5e96a0e6d1a166cc2fa4d85ae028fc",
     "schemas/v2/certification-bundle.schema.json": "29d2ff33d8256d8729cd4914e2ecff5ff07afc310264e2db483a9c0ae13df2a6",
     "schemas/v2/channel-presence-payload.schema.json": "fc03df0c20cc12a25f7ee6a47503a4c5931d79fe3d5ff24815e8fd7c1bcb9a87",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -164,7 +164,7 @@
     "schemas/v2/proposal-list-response.schema.json": "1b5e78fc1e4256dbe6bc866487879deb8f7b9cc18f5bc875db3fde46d79bea02",
     "schemas/v2/proposal-revise.schema.json": "065e75cccd01fcc619e63c25f2a1775adcc24b0467689dca42462ace6bfa1146",
     "schemas/v2/proposal-submit.schema.json": "00fb91a4a76ebcee530295f5262b8b369ed024055cd29a47aa520db03a7fc6c9",
-    "schemas/v2/proposal.schema.json": "52a1e54cfce966a07e2588d5e323a4fa896470ccd3a3a21d2ed19d977d2922b7",
+    "schemas/v2/proposal.schema.json": "b820928a6a2acb09a6d5044acd6b217268e23bbd045ee0b7f2d6c1184a3b2dc5",
     "schemas/v2/registry-version-manifest.schema.json": "940cfd82511690cd6f2539e5676b185e7812628d0707c283fd7ffb33b6e54afd",
     "schemas/v2/residency.schema.json": "3fd23c9732beb140504e81560fc426eb6764d547e56da5fb92c5a5c7bf04db3a",
     "schemas/v2/run-ancestry-response.schema.json": "334c17f2062dea62726ca1d07b8be3f169cdc422af843c1def5fb317039814c9",
@@ -203,14 +203,14 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "202a443678e592a515e33aad7f6ab679a07d8408809f2d4b0f59d156c84ffc65",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "3fcea0739a3d914b30dcbc2f001c25d3fee12aea5402369522bad7bfc5c8b691",
+    "spec/v1/core-standard-manifest.json": "9024c5b7ba78638ccca217619fd2a1a1a1034e8aacea5a78a081e2f58834a877",
     "spec/v1/deprecations.json": "901fdab0a7212627f1838cbb06ae7b7204f0dff528299e56d3d938deecea27c1",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "b984976759acb1b8d329a49acfa2425938d7d86cd1433f43c48ab22a6c51e9ca",
+    "spec/v1/gaps.json": "142a92c571e6e4762a910889fcd31a249556be69bc54dc6ae75949b1987a2f5a",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -226,7 +226,7 @@
     "spec/v2/core/events.md": "5834308616f2e722e217db776edea37338c283196b6d2a7c241256575ccca825",
     "spec/v2/core/execution.md": "d6e1ab7336a88b7a598a192434f584e6787e60aeeb56fcdbc32fa548cde3086a",
     "spec/v2/core/form-content-packs.md": "d56022c207c8406fed4b2e9501bd14e70a4300e371c0cfc371787899ae0bd997",
-    "spec/v2/core/headers.md": "c86c56868db64724ca8e7afd34bff33740deb2612bf77fa09d412a1d6c65f3c6",
+    "spec/v2/core/headers.md": "71f5024adfa754789cf751001308baa87decff6a3afd514c75d573674cbf50ee",
     "spec/v2/core/host-services.md": "68fbe359ec9efc453105a225998b8d0dada07ae61bfd05e324dd8649af31261d",
     "spec/v2/core/i18n.md": "19aea08290a7604f36fa8b416ad270cf84e193cc8fa39d85e52015e312a95565",
     "spec/v2/core/idempotency.md": "adbd317a6ebb57c2759c076297b31f67def9e391576bccd0bbea787b13e85872",
@@ -275,7 +275,7 @@
     "spec/v2/ext/sandbox-runtime-notes/README.md": "0d1290fb1e20b2e35c0b15051541ab6546e4e2a6f693b4f912cb3f7d6a65e92c",
     "spec/v2/ext/webResearch/README.md": "2771686719161b811c2a50361815a334c58f09e442528fb8e23e4fcdcd42d630",
     "spec/v2/facets/a2a.schema.json": "b68bf5e29e455e46c2ad7cfcccf5963730ec2310ff9db81884550d8df30fd6ef",
-    "spec/v2/facets/agents.schema.json": "cc9abae19f500b8a2c6f2b3494284f6f9bb782cde7eec13e4f2f5363a1b44ad5",
+    "spec/v2/facets/agents.schema.json": "2bbd9188c7cecb8cc63d1584609bb1627a4ee5d55ea1a4e4e3b0d1ff8ccfcb11",
     "spec/v2/facets/aiProviders.schema.json": "cb2638174c233835203408f78a18da72a9e7aaa240a29220fc709dd43c6930c4",
     "spec/v2/facets/auditLogIntegrity.schema.json": "9a7f81320c8f940c6f4129bc7dd895a4063231c5458a717a08c2cbf9bb886c46",
     "spec/v2/facets/auth.schema.json": "7d98bc81a0f7d307460d039eebfebd21388091bfe1d538762583940f94c0bd2a",
@@ -302,12 +302,12 @@
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
     "spec/v2/migrations.json": "651954938a1e154c0b6f1e3dd6e105889d30de3bb65789f21de7f77a12869e9e",
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
-    "spec/v2/path-manifest.json": "20f598f56df460ad3ed50aba3d6bc2933ea16a3c96ce125da1c5dd6989d4155c",
+    "spec/v2/path-manifest.json": "3720e502614f301efc7556e0bfcbfa7b7ad8a37c579256ba6bca82417a2728f1",
     "spec/v2/peer-dependency-aliases.json": "cbf62f551f9295b0ac7ba6cc0466abb153563354a57b0622f3ec6e6689cba47e",
     "spec/v2/profiles.json": "b382b261c7844798575f7c1b37c934f0da19846016a2337d883d4f5ef6e05479",
-    "spec/v2/release.json": "7e083fce19c55779cca6f89f30a511127519b4da544c488b83075ba23fc58e18",
+    "spec/v2/release.json": "1ed31f6349b7b4cf948b9826f9541edaf78c9508dcd76438410b2b99204aa5e5",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "bf4bfd1310b78e3307534a0867f7601c39fc988d1659979753188f35fd627f62"
+    "spec/v2/surface-baseline.json": "c7ae2c8adc508e30b969bd28786b2d3576663165cc5def0abacf816cb432e4b5"
   },
-  "corpusCommit": "8dd71a2ff82f90e1369b8aac9132d1bd1b9d27c6"
+  "corpusCommit": "e9e319e699ca8b6cb0cd4a299bd329ea90f151bb"
 }

package/src/lib/proposal-pack-readback-witness.ts

@@ -0,0 +1,171 @@
+/**
+ * RFC 0253 — pure judges for `v2-proposal-pack-readback.test.ts`. The scenario
+ * drives a client-submitted `workflow-chain-pack` and `agent-pack` proposal
+ * through submit → revise → apply and records every response; these functions
+ * decide each leg from those records, so the self-tests can fail every wrong
+ * host answer without a host.
+ *
+ * The rules are the `getInstalledPack` operation in `api/v2/openapi.yaml`, the
+ * `agents.proposals.readback` description in `spec/v2/facets/agents.schema.json`
+ * and `activation.installedArtifact` in `proposal.schema.json`. For the two pack
+ * kinds no field is host-owned, so the byte-match is plain JCS equality.
+ *
+ * @see RFCS/0253-installed-pack-readback.md
+ */
+
+import { canonicalJSON } from './jcs.js';
+import { readErrorCode } from './error-envelope.js';
+import type { Exchange, ProposalFinding } from './proposal-lifecycle-witness.js';
+
+export type PackKind = 'workflow-chain-pack' | 'agent-pack';
+
+type Rec = Record<string, unknown>;
+const isRec = (v: unknown): v is Rec => typeof v === 'object' && v !== null && !Array.isArray(v);
+const f = (ok: boolean, message: string): ProposalFinding => ({ ok, message });
+const code = (x: Exchange): string | undefined => readErrorCode(x?.json);
+const details = (x: Exchange): Rec => {
+  const body = isRec(x?.json) ? x.json : {};
+  if (isRec(body['details'])) return body['details'];
+  const nested = body['error'];
+  return isRec(nested) && isRec(nested['details']) ? nested['details'] : {};
+};
+const shown = (x: Exchange): string => (x === null ? 'no answer' : `${x.status}${code(x) ? ` ${code(x)}` : ''}`);
+const stateOf = (x: Exchange): unknown => (isRec(x?.json) ? x.json['state'] : undefined);
+
+/** RFC 8785 (JCS) equality; the host-owned field set is empty for both pack kinds. */
+export function packMatches(served: unknown, artifact: unknown): boolean {
+  return canonicalJSON(served) === canonicalJSON(artifact);
+}
+
+const ENGINES = { openwop: '>=2.0 <3.0.0' };
+
+/** A fresh one-chain `private.*` chain pack the host has never seen. */
+export function freshChainPack(nonce: string, description: string): Rec {
+  const name = `private.conformance.c${nonce}`;
+  return {
+    name, version: '1.0.0', kind: 'workflow-chain', engines: ENGINES,
+    chains: [{
+      chainId: `${name}.passthrough`, version: '1.0.0', label: 'Pass through', description,
+      parameters: { type: 'object', properties: {} },
+      dag: { nodes: [{ id: 'n1', typeId: 'core.noop' }] },
+    }],
+  };
+}
+
+/**
+ * A fresh pure-agent `private.*` pack with one inline-prompt agent. The entry is
+ * under `.invalid` (RFC 6761), so a host that wrongly dereferences it gains nothing.
+ */
+export function freshAgentPack(nonce: string, systemPrompt: string): Rec {
+  const name = `private.conformance.a${nonce}`;
+  return {
+    name, version: '1.0.0', kind: 'node', engines: ENGINES,
+    runtime: { language: 'remote', entry: 'https://conformance.invalid/agents' },
+    agents: [{ agentId: `${name}.triage`, persona: 'Conformance triage', modelClass: 'general', systemPrompt }],
+  };
+}
+
+/** The first agent's id in an agent pack. */
+export function agentIdOf(pack: Rec): string {
+  const agents = Array.isArray(pack['agents']) ? pack['agents'] : [];
+  const first = agents[0];
+  return isRec(first) && typeof first['agentId'] === 'string' ? first['agentId'] : '';
+}
+
+/**
+ * The §D content rules, as violations (empty = admissible). Schema validity is
+ * checked separately; these are the rules a valid manifest can still break.
+ */
+export function packContentViolations(kind: PackKind, pack: Rec): string[] {
+  const out: string[] = [];
+  if (typeof pack['name'] !== 'string' || !pack['name'].startsWith('private.')) out.push('name outside private.*');
+  if ('signing' in pack) out.push('carries signing');
+  if (kind === 'agent-pack') {
+    if (Array.isArray(pack['nodes']) && pack['nodes'].length > 0) out.push('carries nodes');
+    const rt = isRec(pack['runtime']) ? pack['runtime'] : {};
+    if (rt['language'] !== 'remote') out.push('runtime.language is not remote');
+    const agents = Array.isArray(pack['agents']) ? pack['agents'].filter(isRec) : [];
+    if (agents.length === 0) out.push('no agents');
+    for (const a of agents) {
+      if (typeof a['systemPrompt'] !== 'string') out.push(`${String(a['agentId'])}: no inline systemPrompt`);
+      for (const k of ['systemPromptRef', 'evalSuiteRef']) if (k in a) out.push(`${String(a['agentId'])}: carries ${k}`);
+      const h = isRec(a['handoff']) ? a['handoff'] : {};
+      for (const k of ['taskSchemaRef', 'returnSchemaRef']) if (k in h) out.push(`${String(a['agentId'])}: carries handoff.${k}`);
+    }
+  }
+  return out;
+}
+
+const listed = (list: Exchange, agentId: string): boolean | null => {
+  const items = isRec(list?.json) && Array.isArray(list.json['agents']) ? (list.json['agents'] as unknown[]).filter(isRec) : null;
+  return items === null ? null : items.some((a) => a['agentId'] === agentId);
+};
+
+/** An unapplied pack is not served; for an agent pack, its agent is not resolvable or listed. */
+export function judgePackInert(pack: Exchange, agent?: { get: Exchange; list: Exchange; agentId: string }): ProposalFinding[] {
+  const out = [f(pack?.status === 404, `getInstalledPack MUST answer 404 for an unapplied proposal's name (got ${shown(pack)})`)];
+  if (agent !== undefined) {
+    const inList = listed(agent.list, agent.agentId);
+    out.push(
+      f(agent.get?.status === 404, `getAgent MUST answer 404 for an unapplied proposal's agent (got ${shown(agent.get)})`),
+      f(agent.list?.status === 200 && inList !== null, `listAgents MUST answer 200 with agents (got ${shown(agent.list)})`),
+      f(inList === false, 'listAgents MUST NOT list an unapplied proposal\'s agent'),
+    );
+  }
+  return out;
+}
+
+/** A successful apply names `getInstalledPack`, the artifact's own name, and its version. */
+export function judgePackApplied(apply: Exchange, kind: PackKind, artifact: Rec, agentGet?: Exchange): ProposalFinding[] {
+  const p = isRec(apply?.json) ? apply.json : {};
+  const act = isRec(p['activation']) ? p['activation'] : {};
+  const ia = isRec(act['installedArtifact']) ? act['installedArtifact'] : {};
+  const out = [
+    f(apply?.status === 200 && p['state'] === 'applied', `an authorized apply MUST answer 200 with state applied (got ${shown(apply)}, state ${JSON.stringify(p['state'])})`),
+    f(ia['kind'] === kind && ia['operationId'] === 'getInstalledPack', `activation.installedArtifact MUST name kind ${kind} and operationId getInstalledPack (got ${JSON.stringify(ia)})`),
+    f(ia['id'] === artifact['name'], `installedArtifact.id MUST be the artifact's name, never a minted one (got ${JSON.stringify(ia['id'])})`),
+    f(ia['version'] === artifact['version'], `installedArtifact.version MUST be the artifact's version (got ${JSON.stringify(ia['version'])})`),
+  ];
+  if (agentGet !== undefined) out.push(f(agentGet?.status === 200, `getAgent MUST resolve an applied agent pack's agent for the applying caller (got ${shown(agentGet)})`));
+  return out;
+}
+
+/** The installed pack is the reviewed revision, byte for byte, with nothing removed. */
+export function judgePackReadback(served: Exchange, revised: Rec, original: Rec): ProposalFinding[] {
+  return [
+    f(served?.status === 200, `getInstalledPack MUST serve the installed pack after apply (got ${shown(served)})`),
+    f(served?.status === 200 && packMatches(served.json, revised), 'the read-back MUST be JCS-equal to the last-persisted (revised) artifact, with no field removed or added'),
+    f(served?.status === 200 && !packMatches(served.json, original), 'the read-back MUST NOT be the pre-revision artifact: that is a silent re-synthesis'),
+  ];
+}
+
+/** An apply of an artifact §D forbids is `422`, installs nothing and leaves `state` unchanged. */
+export function judgePackRefused(what: string, apply: Exchange, after: Exchange, pack: Exchange, agentGet?: Exchange): ProposalFinding[] {
+  const out = [
+    f(apply?.status === 422, `${what}: the apply MUST be refused 422 (got ${shown(apply)})`),
+    f(stateOf(after) === 'draft', `${what}: a refused apply MUST leave state unchanged (got ${JSON.stringify(stateOf(after))})`),
+    f(pack?.status === 404, `${what}: a refused apply MUST install nothing (getInstalledPack ${shown(pack)})`),
+  ];
+  if (agentGet !== undefined) out.push(f(agentGet?.status === 404, `${what}: a refused apply MUST install no agent (getAgent ${shown(agentGet)})`));
+  return out;
+}
+
+/**
+ * RFC 0249 §B lets a host validate an artifact at submit. A §D violation refused
+ * there (`400` or `422`) is as good as one refused at apply, if nothing installed.
+ */
+export function judgePackRefusedAtSubmit(what: string, submit: Exchange, pack: Exchange): ProposalFinding[] {
+  return [
+    f(submit?.status === 400 || submit?.status === 422, `${what}: a submit refused for its content MUST answer 400 or 422 (got ${shown(submit)})`),
+    f(pack?.status === 404, `${what}: a refused submit MUST install nothing (getInstalledPack ${shown(pack)})`),
+  ];
+}
+
+/** A second apply at the installed name and version is `409 proposal_install_conflict` `version-not-greater`. */
+export function judgeInstallConflict(apply: Exchange, after: Exchange): ProposalFinding[] {
+  return [
+    f(apply?.status === 409 && code(apply) === 'proposal_install_conflict', `an apply at an equal installed version MUST be refused 409 proposal_install_conflict (got ${shown(apply)})`),
+    f(details(apply)['reason'] === 'version-not-greater', `the refusal MUST name details.reason "version-not-greater" (got ${JSON.stringify(details(apply)['reason'])})`),
+    f(stateOf(after) === 'draft', `a refused install MUST leave state unchanged (got ${JSON.stringify(stateOf(after))})`),
+  ];
+}

package/src/scenarios/v2-proposal-pack-readback.test.ts

@@ -0,0 +1,336 @@
+/**
+ * v2 — an applied `workflow-chain-pack` or `agent-pack` proposal is read back
+ * through `getInstalledPack`, and is inert until applied (RFC 0253, completing
+ * RFC 0249 §D for the two pack kinds; the rules are the `getInstalledPack`
+ * operation in `api/v2/openapi.yaml`, the `agents.proposals.readback`
+ * description in `spec/v2/facets/agents.schema.json` and
+ * `activation.installedArtifact` in `proposal.schema.json`).
+ *
+ * Server-free (always on):
+ *   1. `0253.shape` — an `installedArtifact` naming `getInstalledPack` with a
+ *      `version` validates; the two fresh artifacts validate against their
+ *      manifest schemas and satisfy §D; the §Examples negatives break §D.
+ *
+ * Host legs — gated per kind on `agents.proposals` with `clientDrafts: true`
+ * and the kind in both `artifactKinds` and `readback`; legs that apply also
+ * need `activation: direct-rbac`. One proposal per kind is driven once per
+ * worker with a fresh `private.conformance.*` name: submit P → read → revise
+ * to P' → apply → read back → a second proposal at the same name and version
+ * → foreign reads. Judges in `lib/proposal-pack-readback-witness.ts`.
+ *   2. `0253.chain-draft-inert` / `0253.agent-draft-inert` — the unapplied
+ *      pack is `404`; for an agent pack its agent is `404` and unlisted
+ *      (`proposal-inert-until-applied`).
+ *   3. `0253.chain-apply-installs` / `0253.agent-apply-installs` — the apply
+ *      names `getInstalledPack`, the artifact's `name` and `version`.
+ *   4. `0253.chain-readback-byte-match` / `0253.agent-readback-byte-match` —
+ *      the installed pack is JCS-equal to P' and not to P
+ *      (`proposal-no-resynthesis`).
+ *   5. `0253.agent-file-ref-refused` — an agent with `systemPromptRef`, then a
+ *      pack with `nodes`, is refused `422` and installs nothing.
+ *   6. `0253.namespace-refused` — a `vendor.*` name is refused `422`.
+ *   7. `0253.signing-refused` — a pack carrying `signing` is refused `422`.
+ *   8. `0253.install-conflict` — a second apply at the installed version is
+ *      `409 proposal_install_conflict` `version-not-greater`.
+ *   9. `0253.cross-tenant-not-found` — `OPENWOP_TEST_TENANT_B_API_KEY` reads
+ *      the installed pack (and agent) exactly as unknown names.
+ *
+ * Legs 5–7 accept a refusal at submit (RFC 0249 §B lets a host validate there)
+ * when nothing installs. A harness key that is unset records `blocked`. The
+ * unadvertised case is in `v2-unadvertised-operation-not-found`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { driver, type OpenWOPRequestInit } from '../lib/driver.js';
+import { v2Discovery, v2Validator, v2RefValidator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { artifactDigest, judgeForeign, type Exchange, type ProposalFinding } from '../lib/proposal-lifecycle-witness.js';
+import {
+  agentIdOf, freshAgentPack, freshChainPack, judgeInstallConflict, judgePackApplied, judgePackInert, judgePackReadback,
+  judgePackRefused, judgePackRefusedAtSubmit, packContentViolations, type PackKind,
+} from '../lib/proposal-pack-readback-witness.js';
+
+const DOC = 'api/v2 getInstalledPack, agents.schema.json §proposals.readback, proposal.schema.json installedArtifact (RFC 0253)';
+const UNREADABLE = 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0';
+const ID_SHAPE = 'openwop.requirement.0253.shape';
+const ID_CHAIN_DRAFT_INERT = 'openwop.requirement.0253.chain-draft-inert';
+const ID_CHAIN_APPLY_INSTALLS = 'openwop.requirement.0253.chain-apply-installs';
+const ID_CHAIN_READBACK_BYTE_MATCH = 'openwop.requirement.0253.chain-readback-byte-match';
+const ID_AGENT_DRAFT_INERT = 'openwop.requirement.0253.agent-draft-inert';
+const ID_AGENT_APPLY_INSTALLS = 'openwop.requirement.0253.agent-apply-installs';
+const ID_AGENT_READBACK_BYTE_MATCH = 'openwop.requirement.0253.agent-readback-byte-match';
+const ID_AGENT_FILE_REF_REFUSED = 'openwop.requirement.0253.agent-file-ref-refused';
+const ID_NAMESPACE_REFUSED = 'openwop.requirement.0253.namespace-refused';
+const ID_SIGNING_REFUSED = 'openwop.requirement.0253.signing-refused';
+const ID_INSTALL_CONFLICT = 'openwop.requirement.0253.install-conflict';
+const ID_CROSS_TENANT_NOT_FOUND = 'openwop.requirement.0253.cross-tenant-not-found';
+
+type Rec = Record<string, unknown>;
+const isRec = (v: unknown): v is Rec => typeof v === 'object' && v !== null && !Array.isArray(v);
+
+async function ask(method: string, path: string, body?: unknown, bearer?: string): Promise<Exchange> {
+  const init: OpenWOPRequestInit = {
+    ...(body === undefined ? {} : { body }),
+    ...(bearer === undefined ? {} : { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } }),
+  };
+  try {
+    const r = await driver.request(method, path, init);
+    return { status: r.status, json: r.json };
+  } catch {
+    return null;
+  }
+}
+const packPath = (name: string): string => `/installed-packs/${encodeURIComponent(name)}`;
+const agentPath = (agentId: string): string => `/agents/${encodeURIComponent(agentId)}`;
+
+type Skip = { skip: [Parameters<typeof softSkip>[0], string] };
+async function gate(kind: PackKind, needsApply: boolean): Promise<Skip | { facet: Rec }> {
+  let doc: Rec | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  if (!doc) return { skip: ['blocked', UNREADABLE] };
+  const agents = doc['agents'];
+  const facet = isRec(agents) && isRec(agents['proposals']) ? agents['proposals'] : null;
+  if (facet === null) return { skip: ['inapplicable', 'the host does not advertise agents.proposals'] };
+  if (facet['clientDrafts'] !== true) return { skip: ['inapplicable', 'the host does not advertise agents.proposals.clientDrafts'] };
+  const rb = Array.isArray(facet['readback']) ? facet['readback'] : [];
+  const kinds = Array.isArray(facet['artifactKinds']) ? facet['artifactKinds'] : [];
+  if (!rb.includes(kind) || !kinds.includes(kind)) return { skip: ['inapplicable', `the host does not advertise ${kind} in both agents.proposals.artifactKinds and readback`] };
+  if (needsApply && facet['activation'] !== 'direct-rbac') return { skip: ['inapplicable', 'agents.proposals.activation is not direct-rbac — the apply is gated by an approval run'] };
+  return { facet };
+}
+
+/** The first pack kind the host reads back, for the kind-neutral refusal legs. */
+async function anyKind(): Promise<Skip | { kind: PackKind }> {
+  let last: Skip | undefined;
+  for (const kind of ['workflow-chain-pack', 'agent-pack'] as const) {
+    const g = await gate(kind, true);
+    if (!('skip' in g)) return { kind };
+    last = g;
+  }
+  return last ?? { skip: ['inapplicable', 'the host reads back no pack kind'] };
+}
+
+interface Lifecycle {
+  readonly blockedAt?: string;
+  readonly p: Rec; readonly p2: Rec; readonly name: string; readonly agentId?: string;
+  readonly inertPack?: Exchange; readonly inertAgent?: { get: Exchange; list: Exchange; agentId: string };
+  readonly apply?: Exchange; readonly agentAfter?: Exchange;
+  readonly readback?: Exchange;
+  readonly conflict?: { apply: Exchange; after: Exchange } | string;
+  readonly foreign?: Array<{ what: string; foreign: Exchange; unknown: Exchange }> | string;
+}
+
+const runs = new Map<PackKind, Promise<Lifecycle>>();
+/** One lifecycle per kind per worker: every host leg judges a slice of the same records. */
+function lifecycle(kind: PackKind): Promise<Lifecycle> {
+  let r = runs.get(kind);
+  if (r === undefined) { r = drive(kind); runs.set(kind, r); }
+  return r;
+}
+
+async function drive(kind: PackKind): Promise<Lifecycle> {
+  const nonce = randomBytes(6).toString('hex');
+  const p = kind === 'agent-pack' ? freshAgentPack(nonce, 'You triage the input into one of three queues.') : freshChainPack(nonce, 'Passes its input through unchanged.');
+  const p2 = kind === 'agent-pack'
+    ? { ...p, agents: [{ ...(p['agents'] as Rec[])[0], systemPrompt: 'You triage the input into exactly one of three queues.' }] }
+    : { ...p, description: 'A one-node chain that passes its input through.' };
+  const name = p['name'] as string;
+  const agentId = kind === 'agent-pack' ? agentIdOf(p) : undefined;
+  const base = { p, p2, name, ...(agentId === undefined ? {} : { agentId }) };
+
+  const submit = await ask('POST', '/proposals', { kind, artifact: p, title: 'conformance pack proposal' });
+  const pid = isRec(submit?.json) && typeof submit.json['id'] === 'string' ? submit.json['id'] : undefined;
+  if (submit?.status !== 201 || pid === undefined) return { ...base, blockedAt: `submitProposal answered ${submit?.status ?? 'nothing'}; no proposal to drive` };
+  const path = `/proposals/${encodeURIComponent(pid)}`;
+
+  const inertPack = await ask('GET', packPath(name));
+  const inertAgent = agentId === undefined ? undefined : { get: await ask('GET', agentPath(agentId)), list: await ask('GET', '/agents'), agentId };
+  const revise = await ask('PATCH', path, { artifact: p2 });
+  if (revise?.status !== 200) return { ...base, inertPack, ...(inertAgent ? { inertAgent } : {}), blockedAt: `reviseProposal answered ${revise?.status ?? 'nothing'}` };
+
+  const apply = await ask('POST', `${path}:apply`, { artifactDigest: artifactDigest(p2) });
+  const readback = await ask('GET', packPath(name));
+  const agentAfter = agentId === undefined ? undefined : await ask('GET', agentPath(agentId));
+
+  let conflict: Lifecycle['conflict'];
+  const again = await ask('POST', '/proposals', { kind, artifact: p2, title: 'conformance pack proposal (same version)' });
+  const pid2 = isRec(again?.json) && typeof again.json['id'] === 'string' ? again.json['id'] : undefined;
+  if (again?.status !== 201 || pid2 === undefined) conflict = `a second submitProposal at the same name answered ${again?.status ?? 'nothing'}`;
+  else {
+    const path2 = `/proposals/${encodeURIComponent(pid2)}`;
+    conflict = { apply: await ask('POST', `${path2}:apply`, { artifactDigest: artifactDigest(p2) }), after: await ask('GET', path2) };
+  }
+
+  const tenantB = process.env['OPENWOP_TEST_TENANT_B_API_KEY']?.trim();
+  let foreign: Lifecycle['foreign'];
+  if (!tenantB) foreign = 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set';
+  else if (tenantB === process.env['OPENWOP_API_KEY']) foreign = 'OPENWOP_TEST_TENANT_B_API_KEY equals OPENWOP_API_KEY — the leg needs a second tenant';
+  else {
+    foreign = [{ what: 'getInstalledPack for the installed pack', foreign: await ask('GET', packPath(name), undefined, tenantB),
+      unknown: await ask('GET', packPath(`private.conformance.u${nonce}`), undefined, tenantB) }];
+    if (agentId !== undefined) {
+      foreign.push({ what: 'getAgent for the installed agent', foreign: await ask('GET', agentPath(agentId), undefined, tenantB),
+        unknown: await ask('GET', agentPath(`private.conformance.u${nonce}.triage`), undefined, tenantB) });
+    }
+  }
+  return { ...base, inertPack, ...(inertAgent ? { inertAgent } : {}), apply, readback, ...(agentAfter ? { agentAfter } : {}), conflict, foreign };
+}
+
+/** Submit a forbidden artifact and try to apply it; judge the refusal wherever it lands. */
+async function refused(what: string, kind: PackKind, artifact: Rec): Promise<ProposalFinding[] | string> {
+  const name = artifact['name'] as string;
+  const agentId = kind === 'agent-pack' ? agentIdOf(artifact) : undefined;
+  const submit = await ask('POST', '/proposals', { kind, artifact, title: `conformance ${what}` });
+  if (submit?.status === 400 || submit?.status === 422) return judgePackRefusedAtSubmit(what, submit, await ask('GET', packPath(name)));
+  const pid = isRec(submit?.json) && typeof submit.json['id'] === 'string' ? submit.json['id'] : undefined;
+  if (submit?.status !== 201 || pid === undefined) return `submitProposal for ${what} answered ${submit?.status ?? 'nothing'}`;
+  const path = `/proposals/${encodeURIComponent(pid)}`;
+  const apply = await ask('POST', `${path}:apply`, { artifactDigest: artifactDigest(artifact) });
+  return judgePackRefused(what, apply, await ask('GET', path), await ask('GET', packPath(name)),
+    agentId === undefined ? undefined : await ask('GET', agentPath(agentId)));
+}
+
+function expectAll(id: string, findings: readonly ProposalFinding[]): void {
+  for (const x of findings) expect(x.ok, req(id, DOC, x.message)).toBe(true);
+}
+
+type Leg = Skip | { l: Lifecycle };
+/** Gate, then drive (or reuse) the kind's lifecycle; `blocked` when it stopped before `has`. */
+async function legFor(kind: PackKind, needsApply: boolean, has: (l: Lifecycle) => boolean, stage: string): Promise<Leg> {
+  const g = await gate(kind, needsApply);
+  if ('skip' in g) return g;
+  const l = await lifecycle(kind);
+  if (!has(l)) return { skip: ['blocked', l.blockedAt ?? `the lifecycle did not reach ${stage}`] };
+  return { l };
+}
+
+describe('v2 RFC 0253 — pack read-back wire shape (server-free)', () => {
+  it('installedArtifact names getInstalledPack with a version; the fresh artifacts are valid and admissible; the negatives break §D', () => {
+    const S = 'proposal.schema.json installedArtifact, the two manifest schemas, agents.schema.json §proposals.readback (RFC 0253 §B–§D)';
+    const installed = v2RefValidator('proposal.schema.json#/properties/activation/properties/installedArtifact');
+    expect(installed({ kind: 'agent-pack', operationId: 'getInstalledPack', id: 'private.acme.triage-agents', version: '1.0.0' }).ok,
+      req(ID_SHAPE, S, 'an installedArtifact naming getInstalledPack with a version MUST validate')).toBe(true);
+    const chain = freshChainPack('s1', 'shape');
+    const agent = freshAgentPack('s1', 'You triage.');
+    expect(v2Validator('workflow-chain-pack-manifest')(chain).ok, req(ID_SHAPE, S, 'the fresh chain pack MUST validate against workflow-chain-pack-manifest')).toBe(true);
+    expect(v2Validator('node-pack-manifest')(agent).ok, req(ID_SHAPE, S, 'the fresh agent pack MUST validate against node-pack-manifest')).toBe(true);
+    expect(packContentViolations('workflow-chain-pack', chain), req(ID_SHAPE, S, 'the fresh chain pack MUST satisfy §D')).toEqual([]);
+    expect(packContentViolations('agent-pack', agent), req(ID_SHAPE, S, 'the fresh agent pack MUST satisfy §D')).toEqual([]);
+    const a0 = (agent['agents'] as Rec[])[0] as Rec;
+    const { systemPrompt: _sp, ...noInline } = a0;
+    const negatives: Array<[PackKind, Rec, string]> = [
+      ['agent-pack', { ...agent, agents: [{ ...noInline, systemPromptRef: 'prompts/a.md' }] }, 'an agent carrying systemPromptRef'],
+      ['agent-pack', { ...agent, nodes: [{ typeId: `${String(agent['name'])}.n`, version: '1.0.0', category: 'data', role: 'pure' }] }, 'an agent pack with nodes'],
+      ['workflow-chain-pack', { ...chain, signing: { keyId: 'conformance-key', scheme: 'ed25519-canonical-json' } }, 'a chain pack carrying signing'],
+      ['agent-pack', { ...agent, name: 'vendor.acme.triage' }, 'a vendor.* name'],
+    ];
+    for (const [kind, doc, what] of negatives) {
+      expect(packContentViolations(kind, doc).length, req(ID_SHAPE, S, `${what} MUST break §D`)).toBeGreaterThan(0);
+    }
+  });
+});
+
+describe('v2 RFC 0253 — workflow-chain-pack read-back (host)', () => {
+  it('an unapplied workflow-chain-pack is not served', async () => {
+    const r = await legFor('workflow-chain-pack', false, (l) => l.inertPack !== undefined, 'the draft');
+    if ('skip' in r) return softSkip(...r.skip);
+    expectAll(ID_CHAIN_DRAFT_INERT, judgePackInert(r.l.inertPack ?? null));
+  });
+
+  it('an authorized apply of a workflow-chain-pack names getInstalledPack, the name and the version', async () => {
+    const r = await legFor('workflow-chain-pack', true, (l) => l.apply !== undefined, 'the apply');
+    if ('skip' in r) return softSkip(...r.skip);
+    expectAll(ID_CHAIN_APPLY_INSTALLS, judgePackApplied(r.l.apply ?? null, 'workflow-chain-pack', r.l.p2));
+  });
+
+  it('the installed workflow-chain-pack is the reviewed revision, byte for byte', async () => {
+    const r = await legFor('workflow-chain-pack', true, (l) => l.readback !== undefined, 'the read-back');
+    if ('skip' in r) return softSkip(...r.skip);
+    expectAll(ID_CHAIN_READBACK_BYTE_MATCH, judgePackReadback(r.l.readback ?? null, r.l.p2, r.l.p));
+  });
+});
+
+describe('v2 RFC 0253 — agent-pack read-back (host)', () => {
+  it('an unapplied agent-pack is not served, and its agent is not resolvable or listed', async () => {
+    const r = await legFor('agent-pack', false, (l) => l.inertPack !== undefined, 'the draft');
+    if ('skip' in r) return softSkip(...r.skip);
+    expectAll(ID_AGENT_DRAFT_INERT, judgePackInert(r.l.inertPack ?? null, r.l.inertAgent));
+  });
+
+  it('an authorized apply of an agent-pack names getInstalledPack, the name and the version, and resolves the agent', async () => {
+    const r = await legFor('agent-pack', true, (l) => l.apply !== undefined, 'the apply');
+    if ('skip' in r) return softSkip(...r.skip);
+    expectAll(ID_AGENT_APPLY_INSTALLS, judgePackApplied(r.l.apply ?? null, 'agent-pack', r.l.p2, r.l.agentAfter ?? null));
+  });
+
+  it('the installed agent-pack is the reviewed revision, byte for byte', async () => {
+    const r = await legFor('agent-pack', true, (l) => l.readback !== undefined, 'the read-back');
+    if ('skip' in r) return softSkip(...r.skip);
+    expectAll(ID_AGENT_READBACK_BYTE_MATCH, judgePackReadback(r.l.readback ?? null, r.l.p2, r.l.p));
+  });
+});
+
+describe('v2 RFC 0253 — refusals, conflicts and tenancy (host)', () => {
+  it('an agent pack with a file reference, or with nodes, is refused and installs nothing', async () => {
+    const g = await gate('agent-pack', true);
+    if ('skip' in g) return softSkip(...g.skip);
+    const nonce = randomBytes(6).toString('hex');
+    const withRef = freshAgentPack(`r${nonce}`, 'unused');
+    const { systemPrompt: _sp, ...a0 } = (withRef['agents'] as Rec[])[0] as Rec;
+    const withNodes = freshAgentPack(`n${nonce}`, 'You triage.');
+    const findings: ProposalFinding[] = [];
+    for (const [what, artifact] of [
+      ['an agent carrying systemPromptRef', { ...withRef, agents: [{ ...a0, systemPromptRef: 'prompts/a.md' }] }],
+      ['an agent pack with nodes', { ...withNodes, nodes: [{ typeId: `${String(withNodes['name'])}.n`, version: '1.0.0', category: 'data', role: 'pure' }] }],
+    ] as const) {
+      const r = await refused(what, 'agent-pack', artifact);
+      if (typeof r === 'string') return softSkip('blocked', r);
+      findings.push(...r);
+    }
+    expectAll(ID_AGENT_FILE_REF_REFUSED, findings);
+  });
+
+  it('a pack named outside private.* is refused and installs nothing', async () => {
+    const g = await anyKind();
+    if ('skip' in g) return softSkip(...g.skip);
+    const nonce = randomBytes(6).toString('hex');
+    const base = g.kind === 'agent-pack' ? freshAgentPack(nonce, 'You triage.') : freshChainPack(nonce, 'namespace');
+    const r = await refused('a vendor.* name', g.kind, { ...base, name: `vendor.conformance.v${nonce}` });
+    if (typeof r === 'string') return softSkip('blocked', r);
+    expectAll(ID_NAMESPACE_REFUSED, r);
+  });
+
+  it('a pack carrying signing is refused and installs nothing', async () => {
+    const g = await anyKind();
+    if ('skip' in g) return softSkip(...g.skip);
+    const nonce = randomBytes(6).toString('hex');
+    const base = g.kind === 'agent-pack' ? freshAgentPack(nonce, 'You triage.') : freshChainPack(nonce, 'signing');
+    const r = await refused('a pack carrying signing', g.kind, { ...base, signing: { keyId: 'conformance-key', scheme: 'ed25519-canonical-json' } });
+    if (typeof r === 'string') return softSkip('blocked', r);
+    expectAll(ID_SIGNING_REFUSED, r);
+  });
+
+  it('a second apply at the installed name and version is an install conflict', async () => {
+    const g = await anyKind();
+    if ('skip' in g) return softSkip(...g.skip);
+    const l = await lifecycle(g.kind);
+    if (l.conflict === undefined) return softSkip('blocked', l.blockedAt ?? 'the lifecycle did not reach the second proposal');
+    if (typeof l.conflict === 'string') return softSkip('blocked', l.conflict);
+    expectAll(ID_INSTALL_CONFLICT, judgeInstallConflict(l.conflict.apply, l.conflict.after));
+  });
+
+  it('another tenant sees the installed pack and agent as unknown names', async () => {
+    const g = await anyKind();
+    if ('skip' in g) return softSkip(...g.skip);
+    const pairs: Array<{ what: string; foreign: Exchange; unknown: Exchange }> = [];
+    for (const kind of ['workflow-chain-pack', 'agent-pack'] as const) {
+      if ('skip' in (await gate(kind, true))) continue;
+      const l = await lifecycle(kind);
+      if (l.foreign === undefined) return softSkip('blocked', l.blockedAt ?? 'the lifecycle did not reach the foreign reads');
+      if (typeof l.foreign === 'string') return softSkip('blocked', l.foreign);
+      pairs.push(...l.foreign);
+    }
+    expectAll(ID_CROSS_TENANT_NOT_FOUND, judgeForeign(pairs));
+  });
+});

package/src/scenarios/v2-unadvertised-operation-not-found.test.ts

@@ -16,6 +16,8 @@
  *             answers `404 not_found`.
  *   proposals (hosts that do not advertise `agents.proposals`) `GET /proposals`
  *             answers `404 not_found` (RFC 0249).
+ *   installed-packs (hosts whose `agents.proposals.readback` lists no pack kind)
+ *             `GET /installed-packs/{packName}` answers `404 not_found` (RFC 0253).
  *
  * A host that advertises the facet records the leg `inapplicable`.
  */
@@ -74,4 +76,18 @@ describe('v2 unadvertised operations answer 404 not_found (RFC 0228 §H)', () =>
     expect(res.status, req(ID, DOC, `an operation gated on agents.proposals, which the host does not advertise, MUST answer 404 (got ${res.status})`)).toBe(404);
     expect(readErrorCode(res.json), req(ID, DOC, 'the 404 for an unadvertised gated operation MUST carry the registered code not_found')).toBe('not_found');
   });
+
+  it('GET /installed-packs/{packName} answers 404 not_found when readback lists no pack kind (RFC 0253)', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREACHABLE);
+    const agents = record(doc, 'agents');
+    const proposals = agents === null ? null : record(agents, 'proposals');
+    const rb = Array.isArray(proposals?.['readback']) ? (proposals['readback'] as unknown[]) : [];
+    if (rb.includes('workflow-chain-pack') || rb.includes('agent-pack')) return softSkip('inapplicable', 'the host reads back a pack kind — getInstalledPack is served');
+    const res = await get('/installed-packs/private.conformance.unadvertised');
+    if (res === null) return softSkip('blocked', 'GET /installed-packs/{packName} unreachable (fetch failed)');
+    const ID = 'openwop.requirement.0253.unadvertised-not-found';
+    expect(res.status, req(ID, DOC, `getInstalledPack, gated on a pack kind in agents.proposals.readback, which the host does not advertise, MUST answer 404 (got ${res.status})`)).toBe(404);
+    expect(readErrorCode(res.json), req(ID, DOC, 'the 404 for an unadvertised gated operation MUST carry the registered code not_found')).toBe('not_found');
+  });
 });