@openwop/openwop-conformance 2.5.0 → 2.6.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.6.0] — 2026-09-18 — a relaxed profile cannot certify, and five corpus ids for the umbrella
+
+### Fixed
+
+- **`--certify` wrote `certified: true` for a profile carrying a relaxation.**
+  `security-defaults.md` §Relaxations and RFC 0173 §A.2 both say it MUST NOT.
+  The predicate had no relaxation term and parsed relaxations on the next line;
+  the emitter then excluded `relaxed-profile-certified` from its self-check and
+  exited 0, so only `--verify` disagreed with the shipped file. Relaxations are
+  now parsed first and folded into the verdict, matched exactly as the verifier
+  matches them.
+
+### Added
+
+- Five `src/coherence/` wrappers minting `openwop.requirement.0167.*`, so the v2
+  umbrella's falsifiability table stops passing rule 4 on zero ids. One spawns
+  `check-codemods.mjs --at-active`, which the merge gate never ran.
+- `apps/workflow-engine` added to the public-docs banned-pattern scan.
+
 ## [2.5.0] — 2026-09-18 — `--verify`, for auditing a bundle you did not cut
 
 ### Added

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.5.0 @openwop/spec-artifacts@2.5.0
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.6.0 @openwop/spec-artifacts@2.6.0
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -99,6 +99,8 @@ Run `npm run test` for normal CI cadence; `npm run test:strict` when claiming fu
 
 | Variable                                  | Effect                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `OPENWOP_HOST_RELAXATIONS`                | Sets `host.relaxations[]` in the bundle. **It relaxes nothing in the suite** — it is your declaration that the HOST runs relaxed, and the suite cannot detect an undeclared one. A profile carrying a relaxation **cannot certify** (`security-defaults.md` §Relaxations, RFC 0173 §A.2), and since 2.6.0 the emitter enforces that rather than writing `certified: true` and leaving the contradiction to `--verify`. JSON array of `{obligation, durability, reason}`; `durability` is `session \| deployment \| persisted` — **not** `permanent`. Unparseable JSON exits 2; a wrong enum value exits 2 later, at schema validation. |
+| `OPENWOP_TARGET_MAJOR`                    | Selects the scenario lane. **Only the literal `"2"` selects major 2** — unlike `--target-major`, which validates and exits 2 on a bad value, the env var falls back to major 1 for `"1"`, `"3"`, `"two"` or empty. The runner and every vitest worker MUST see the same value: when they disagreed, the worker minted `openwop.floor.*` while the runner looked up `openwop.scenario.*`, producing a vacuous-pass emitter defect and **no bundle at all**. Prefer `--target-major`; set this only when driving `vitest` directly. |
 | `OPENWOP_REQUIRE_BEHAVIOR=true`           | Capability-gated scenarios (audit-log integrity, rate-limit envelope, multi-region idempotency, `configurableSchema`, webhook sig versioning, etc.) FAIL instead of skipping when the host doesn't advertise the profile. Lets a host claim "full coverage" mechanically. See [`coverage.md`](./coverage.md) §"Capability-gated scenarios".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `OPENWOP_TEST_PUBLIC_REGISTRY=true`       | Runs `registry-public.test.ts` against the hosted registry at `packs.openwop.dev`. Skipped by default so the suite doesn't depend on outbound connectivity.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `OPENWOP_OTEL_COLLECTOR=true`             | Boots the in-suite OTLP collector for `otel-emission.test.ts`, `otel-trace-propagation.test.ts`, `metric-emission.test.ts`, and `otel-emission-grpc.test.ts`. The collector accepts OTLP/HTTP-JSON (`application/json`), OTLP/HTTP-protobuf (`application/x-protobuf` — hand-rolled decoder at `src/lib/otlp-protobuf.ts`), and OTLP/gRPC (when `OPENWOP_OTEL_COLLECTOR_GRPC=true` — h2c HTTP/2 + hand-rolled framing at `src/lib/grpc-framing.ts`). Zero new npm deps. Hosts may emit via `OTEL_EXPORTER_OTLP_PROTOCOL=http/json`, `http/protobuf`, or `grpc`. Skipped by default. **Run OTel scenarios with `--no-file-parallelism`** — each vitest worker spawns its own collector and only one can bind the same port, so concurrent file execution causes ephemeral-port fallbacks that don't receive the host's OTLP traffic. |

package/dist/cli.js

@@ -640,7 +640,16 @@ async function runCertify(args, baseUrl, apiKey) {
         // `certified` IS the verdict (RFC 0148 §A; RFC 0168 §E.1 adds the bundle-wide
         // blocked rule). Until rc.45 it was `!notHeld && !rejected && blocked === 0`
         // and never read `certifiable` — an empty v2 floor certified on no evidence.
-        const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
+        // Relaxations are parsed BEFORE the verdict, because they are part of it.
+        // `security-defaults.md` §Relaxations is explicit: "A bundle that records a
+        // relaxation MUST NOT certify the profile the relaxed obligation belongs to"
+        // (RFC 0173 §A.2). The emitter computed `certified` with no relaxation term —
+        // and parsed relaxations on the NEXT line, so it was structurally impossible
+        // for one to affect the verdict — then excluded `relaxed-profile-certified`
+        // from its own self-check. The shipped artifact asserted `certified: true`
+        // for a profile that cannot certify, and only `--verify` disagreed with the
+        // file. A reader who parses `.certified` — the obvious thing to do — got the
+        // wrong answer.
         let relaxations;
         if (process.env['OPENWOP_HOST_RELAXATIONS']) {
             try {
@@ -651,6 +660,12 @@ async function runCertify(args, baseUrl, apiKey) {
                 process.exit(2);
             }
         }
+        // RFC 0173 §A.2: a recorded relaxation denies the profile its obligation
+        // belongs to. Matched the same way the verifier matches it, so the emitter
+        // and `verifyBundleV3` cannot disagree about the same bundle.
+        const relaxedObligations = new Set((relaxations ?? []).map((r) => r.obligation));
+        const relaxedProfile = (p) => [...relaxedObligations].some((o) => p.includes(o));
+        const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !relaxedProfile(p) && (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
         const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
         const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')) : undefined;
         const nonPass = rows3.filter((r) => r.result !== 'executed-pass');
@@ -688,7 +703,10 @@ async function runCertify(args, baseUrl, apiKey) {
         const scrubbed3 = scrubEvidence(v3, secrets3);
         const v3Out = scrubbed3.value;
         const audit3 = verifyBundleV3(v3Out, { hostPublicKeyPem: publicKeyFromPrivate(signingKeyPem) });
-        const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'relaxed-profile-certified', 'independent-unverifiable'].includes(r.kind));
+        // `relaxed-profile-certified` is no longer excused: the emitter now computes
+        // the relaxation into `certified`, so if the verifier still finds that
+        // contradiction the bundle is genuinely malformed and MUST NOT be written.
+        const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'independent-unverifiable'].includes(r.kind));
         if (emitterDefects.length > 0) {
             // Keep the rejected bundle: a self-verification failure with nothing to
             // inspect sent a host patching a scratch copy of this CLI to see it.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.5.0",
-  "stampSha256": "6f34c35c619eccc3b472a465b4c0233e56872a2bd48d04e045fc173a70148aaf"
+  "version": "2.6.0",
+  "stampSha256": "68531a1a3ebfe85e53f55273ab72f627ab8730218fd8557395633bef0a0c8338"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.5.0"
+    "@openwop/spec-artifacts": "2.6.0"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 571,
-    "tests": 2174,
-    "withStableId": 2174,
+    "files": 576,
+    "tests": 2179,
+    "withStableId": 2179,
     "interpolatedTitles": 0,
-    "explicitIds": 2127
+    "explicitIds": 2132
   },
   "records": [
     {
@@ -35390,7 +35390,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.scans-public-docs-and-schemas",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1397,
+      "line": 1406,
       "title": "scans public docs and schemas",
       "explicitId": "openwop.it.spec-corpus-validity.scans-public-docs-and-schemas",
       "citations": [
@@ -35403,7 +35403,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.has-no-private-implementation-or-pre-v1-breadcrumbs",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1403,
+      "line": 1412,
       "title": null,
       "explicitId": "openwop.it.spec-corpus-validity.has-no-private-implementation-or-pre-v1-breadcrumbs",
       "citations": [
@@ -35417,7 +35417,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-fixture-id-mentioned-in-fixtures-md-has-a-corresponding-json",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1432,
+      "line": 1441,
       "title": "every fixture id mentioned in fixtures.md has a corresponding JSON",
       "explicitId": "openwop.it.spec-corpus-validity.every-fixture-id-mentioned-in-fixtures-md-has-a-corresponding-json",
       "citations": [
@@ -35431,7 +35431,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-fixture-json-file-is-referenced-by-fixtures-md",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1474,
+      "line": 1483,
       "title": "every fixture JSON file is referenced by fixtures.md",
       "explicitId": "openwop.it.spec-corpus-validity.every-fixture-json-file-is-referenced-by-fixtures-md",
       "citations": [
@@ -35445,7 +35445,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.a-sample-bundle-validates-against-conformance-certification-bundle-schema-json",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1527,
+      "line": 1536,
       "title": "a sample bundle validates against conformance-certification-bundle.schema.json",
       "explicitId": "openwop.it.spec-corpus-validity.a-sample-bundle-validates-against-conformance-certification-bundle-schema-json",
       "citations": [
@@ -35459,7 +35459,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-accepts-a-claim-that-is-discovery-derivable-and-floor-proven-b",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1533,
+      "line": 1542,
       "title": "verifyBundle ACCEPTS a claim that is discovery-derivable AND floor-proven (§B)",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-accepts-a-claim-that-is-discovery-derivable-and-floor-proven-b",
       "citations": [
@@ -35472,7 +35472,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-profile-its-discovery-document-does-not-derive-b-1",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1540,
+      "line": 1549,
       "title": "verifyBundle REJECTS a profile its discovery document does not derive (§B(1))",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-profile-its-discovery-document-does-not-derive-b-1",
       "citations": [
@@ -35485,7 +35485,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-bundle-missing-a-floor-scenario-b-2",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1550,
+      "line": 1559,
       "title": "verifyBundle REJECTS a bundle missing a floor scenario (§B(2))",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-bundle-missing-a-floor-scenario-b-2",
       "citations": [
@@ -35498,7 +35498,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-committed-bundle-file-exists-generated-by-certify",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1587,
+      "line": 1596,
       "title": "the committed bundle file exists (generated by --certify)",
       "explicitId": "openwop.it.spec-corpus-validity.the-committed-bundle-file-exists-generated-by-certify",
       "citations": [
@@ -35512,7 +35512,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-committed-reference-bundle-validates-against-the-bundle-schema-a",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1591,
+      "line": 1600,
       "title": "the committed reference bundle validates against the bundle schema (§A)",
       "explicitId": "openwop.it.spec-corpus-validity.the-committed-reference-bundle-validates-against-the-bundle-schema-a",
       "citations": [
@@ -35526,7 +35526,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-rejects-the-committed-reference-bundle-it-is-invalidated-rfc-0148-d",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1598,
+      "line": 1607,
       "title": "verifyBundle REJECTS the committed reference bundle — it is `invalidated` (RFC 0148 §D)",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-rejects-the-committed-reference-bundle-it-is-invalidated-rfc-0148-d",
       "citations": [
@@ -35547,7 +35547,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.discovery-sha256-is-the-canonical-json-sha-256-of-the-captured-discovery-documen",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1624,
+      "line": 1633,
       "title": "discovery.sha256 is the canonical-JSON SHA-256 of the captured discovery.document",
       "explicitId": "openwop.it.spec-corpus-validity.discovery-sha256-is-the-canonical-json-sha-256-of-the-captured-discovery-documen",
       "citations": [
@@ -35560,7 +35560,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-requestbody-closes-at-the-composition-unevaluatedproperties-not-inside-a-bra",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1685,
+      "line": 1694,
       "title": "the requestBody closes at the composition (unevaluatedProperties), not inside a branch",
       "explicitId": "openwop.it.spec-corpus-validity.the-requestbody-closes-at-the-composition-unevaluatedproperties-not-inside-a-bra",
       "citations": [
@@ -35573,7 +35573,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.canonical-createrun-bodies-pass-the-composed-schema-an-undeclared-property-fails",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1700,
+      "line": 1709,
       "title": "canonical createRun bodies PASS the composed schema; an undeclared property FAILS",
       "explicitId": "openwop.it.spec-corpus-validity.canonical-createrun-bodies-pass-the-composed-schema-an-undeclared-property-fails",
       "citations": [
@@ -36221,6 +36221,81 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-umbrella-alias-covered.the-corpus-gate-script-exits-0",
+      "file": "v2-umbrella-alias-covered.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0167.alias-covered",
+      "citations": [
+        {
+          "section": "RFC 0167 §E.2",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-umbrella-child-parts.the-corpus-gate-script-exits-0",
+      "file": "v2-umbrella-child-parts.test.ts",
+      "line": 33,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0167.child-parts",
+      "citations": [
+        {
+          "section": "RFC 0167 §C",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0167 §C",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-umbrella-codemod-at-active.the-corpus-gate-script-exits-0",
+      "file": "v2-umbrella-codemod-at-active.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0167.codemod-at-active",
+      "citations": [
+        {
+          "section": "RFC 0167 §D.3",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-umbrella-codemod-legs.the-corpus-gate-script-exits-0",
+      "file": "v2-umbrella-codemod-legs.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0167.codemod-legs",
+      "citations": [
+        {
+          "section": "RFC 0167 §D.3",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-umbrella-migration-deprecation.the-corpus-gate-script-exits-0",
+      "file": "v2-umbrella-migration-deprecation.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0167.migration-deprecation-bound",
+      "citations": [
+        {
+          "section": "RFC 0167 §D.1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-witness-required.the-corpus-gate-script-exits-0",
       "file": "v2-witness-required.test.ts",

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.5.0",
-  "corpusTag": "v2.5.0",
+  "version": "2.6.0",
+  "corpusTag": "v2.6.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "f35db54139898b07150e0a2a40ce6ef380aac3768b1bd72e41ac2e32dc102daf",
-    "api/v2/asyncapi.yaml": "b5d7c42d6d2b7aa3b392762b4544e90017fe9ab53cfbcb28488c96f1b2ede93d",
-    "api/v2/openapi.yaml": "a026b36f9228b5216b544c105e99bc1d0eb27e4702fb05c696576ce79d52c9cc",
+    "api/seams-v2.yaml": "7f6637d38e3c4e6abd26486045250e49510e47f88c369d182c4c58f9100e641b",
+    "api/v2/asyncapi.yaml": "8cbc0edc6dbf62726ff48e1a1d5f6ac90e2eecee42b005ab5b3d093aa2d11f81",
+    "api/v2/openapi.yaml": "ea0138814ca4766e2575ab5964ff03c7dba0a41ba7041897f5f1d1ac5808680b",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -116,7 +116,7 @@
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "fa9b80a9107fc322ecadbac808e7fbe5e16ccf0af1a6bf673181faa8379dde33",
-    "schemas/v2/certification-bundle.schema.json": "d2cbc5cadddff13630a528dc9673162f582c035c6a6663ca02c1ac53e8fec40c",
+    "schemas/v2/certification-bundle.schema.json": "0bcf8f297266505ca39d30eea8100e3c0fb048f2651717fd746da8129fcb7920",
     "schemas/v2/channel-presence-payload.schema.json": "1c20ad810cb311d47aa0b95d928490826b2468fd161f884cd29e867053e6782f",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "8df0d9d273ae22efc6876d5586833f1d4c2e551edc3ac6cf6e8f0719329f03dd",
@@ -200,7 +200,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "e90916db12d2297e2e560b2d54d2c4702d6cb3bef7179a575844687a7ec17262",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "c1b2629f9d2a374fd9121c1f5ce906e7c4225798c49373cb66f9064050b23bb7",
+    "spec/v1/core-standard-manifest.json": "de1f6bd9dc3f602b6893d66cbfb79a055457e18d0be5ff70a2611ee69f672727",
     "spec/v1/deprecations.json": "c81c8f71460936c8d489d8270477c7661cf4a5d7b7bad86c98899750b5656027",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -213,26 +213,26 @@
     "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
     "spec/v1/spec-gaps.json": "eb3bfcb9c7d05c9a6845d4a40ec9493cfaa5a671932daf1af561310136fdabe8",
     "spec/v2/README.md": "5d49f56f41e06b44312c61ad8144b786c9a90ec42fd0660a40d89520ef206137",
-    "spec/v2/core/capabilities.md": "c5107a4964e487c20bbb5254cfe1f706e0d9ba7e34da9070bc43b50b385e7948",
-    "spec/v2/core/conformance.md": "b8d7dae142e3708a7597533cb77827363b6cfc91b89538081a9afe5e23c975f4",
-    "spec/v2/core/connection-packs.md": "1d759681e2962f5103228c52c45f24607ed4bb9ae73e30605f690c1d5a59e9ee",
-    "spec/v2/core/errors.md": "ad85fc830139e587f20deabf88297b91b1fb6ce31e80d5442624a650246ab16e",
-    "spec/v2/core/events.md": "f1bac16419740f3b722febb6f5caaabed8838e092cba3d080fe9184024049dcf",
-    "spec/v2/core/form-content-packs.md": "6ffaae85d4550be48dd53fb6e2959af8aceb35bd87c5343b722885084f197713",
-    "spec/v2/core/headers.md": "cc60370c7443752d462d032478bf23d976ec2efc2e9730cf76542a1d8be4cfc7",
-    "spec/v2/core/idempotency.md": "b86c352d964aebad532727f314e26ed2177d49de382076fa64d3162e2f56118d",
-    "spec/v2/core/identity.md": "9d2b823eb899463807452fe5721dcf09881837c161be024175957db27870b243",
-    "spec/v2/core/interop.md": "d4c404e469e1d9d9be88bc2c939d777e7d7c1d0419b1251c18770f039838a401",
-    "spec/v2/core/interrupt.md": "548c7a7bdfcab56db33dfad3d397cae2ed5f9828a63418021936eb392395e3e4",
-    "spec/v2/core/overview.md": "69377c90bbb87b6bfe4b8be4f1b65810094b0759c8d4f93ca6df92cc530ea023",
-    "spec/v2/core/packs.md": "8b3e1587270bb1aec814befbd287181a05b7f76aeb0802787ee7ebdc85901205",
-    "spec/v2/core/persistence.md": "898dc929d021a03d245691148fe4fdec4582b4faa9237aa32037bbd3a2993b7d",
-    "spec/v2/core/replay.md": "bd191a2565aa7ad0df9b35a0716f3de53be34b8722f1807c5e5b02859404a9b9",
-    "spec/v2/core/runs.md": "f7a95fc82fda5b7c0c613de6e5edd376bbd6d8ba4c665a500c94eacbe42b86f2",
-    "spec/v2/core/security-defaults.md": "d69a8dfc9057e189caa61f14810e3090b3b053e8fde419d09db84729a42b84c7",
-    "spec/v2/core/versioning.md": "fd6564879cf043b68338db20b20de93755a1e7147000afb4738c07770deeddaf",
-    "spec/v2/core/webhooks.md": "969c367650e5e93beb090242bcbec59f43b95bdf646fa6c512f6c7fa1f05912e",
-    "spec/v2/core/workflow-chain-packs.md": "ef2b07d2d99334eaec0cc370314e2ad2f84ea58deb699e5d92e6e52d6056613f",
+    "spec/v2/core/capabilities.md": "35696991582729c86b5760f292251734e37cee45398fa5179764cefa5a91037f",
+    "spec/v2/core/conformance.md": "a451c0a2ba79d93c55e540ccef480eba7de9602d59bbb03eead05daafde0beac",
+    "spec/v2/core/connection-packs.md": "2e53c92476f68304139faf0c370874dc27bbba56a127a07e0906ff06edbb8ff1",
+    "spec/v2/core/errors.md": "c3ac131dff970ab7574629d72735ace52cc56cd4a7ab5d1206ce91f382bc9a68",
+    "spec/v2/core/events.md": "6ab8c727df3ebc5a60de3837c82a0075b4357d6f7e28435c6f80585687d41a76",
+    "spec/v2/core/form-content-packs.md": "d4c5295dfd28972be205c87c34d0d34ced64f4a2561ebff7f9d24b436d83df25",
+    "spec/v2/core/headers.md": "6c5eb48d998c141b5f0cb61fea926833a072748fdc4034e1a90a4dfe5448659c",
+    "spec/v2/core/idempotency.md": "803cd85947b1b2151cd2fb42cf0e0c52c9bcd19cdc6c23dcf34b1eddc600921a",
+    "spec/v2/core/identity.md": "ae24870df315b527dfe9ecf7a4c26582bcc1113da7954f44acf69bf463ac390d",
+    "spec/v2/core/interop.md": "8d8f4b040cb3625044c6aa586c8dcf5e9d15797de3d3b1cea631f44b8924701c",
+    "spec/v2/core/interrupt.md": "bdb2879a52a2504d84146e46108c4a4c2dd3a6f27865a295c80375b331cced21",
+    "spec/v2/core/overview.md": "7dc00ace32d4e4ce929a383651f0029fc4b7091ec87487b1bf26ead1be209e0e",
+    "spec/v2/core/packs.md": "3254fd060c2b690cea70ef2b1b1a119711bb04fb5f13bf8936d4d718df9b2322",
+    "spec/v2/core/persistence.md": "e75c6d8cc6a31747f8559931c420ed0debbdec16ae01fed28df5aa79a51e5899",
+    "spec/v2/core/replay.md": "dee513b6ca313a0647c853e713af94a3e077f3e58f71851ddb0ef8adcb3b0afe",
+    "spec/v2/core/runs.md": "b4c0bb2869077fcbf26e15bc6bbac06819f68b8241944b903a275a37db1c71fa",
+    "spec/v2/core/security-defaults.md": "9ab1d1a88ccd0929f354422b151ec6d3164e8cd3784f8e58bb6f11cb7ee1e7d5",
+    "spec/v2/core/versioning.md": "27b88cde88f9060567ef7e46f4897b6be8892ade9f4a46c2ab16e314c515eabd",
+    "spec/v2/core/webhooks.md": "ecec4d22a35aeafd34276bb0579ae28610e79ab8850ebf42188cb51bc946a093",
+    "spec/v2/core/workflow-chain-packs.md": "26bb65721f826285b7d90c3cb62fa7e9fb2414c1bc6e0fd25b33209168c3102e",
     "spec/v2/declaration.json": "a09bac61c1b825e4a77b5abc0f86f1f8c20c381e0650eb08c2f6d0ef0aaec1dc",
     "spec/v2/declaration.schema.json": "c86e3083fb9789c1958ecb4576cc6f71aa90e6f339521139238543ed08211dd4",
     "spec/v2/errors.json": "4ff032033f02d7e3fb4204581456408ba5e7642b438c1f349bbd1c264e63e419",
@@ -271,8 +271,8 @@
     "spec/v2/path-manifest.json": "a6f4e652e866889e8bde815874062f62929aee95dc8e58e7152c56adee262163",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "6d251f6f5ea4ce8478b97bcb6eb278c5d74539503696f0dc5c27b00cce9374f0",
+    "spec/v2/release.json": "2c0e277e6ef93e5f439947c546f3ec10696d1f3a7235dedaf5d6973954d1652d",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "61d4b171eb376eb754e27b681d5aaf79fd92e46d"
+  "corpusCommit": "dff4852f36271da77a30a88494cde1e027199d7c"
 }

package/src/cli.ts

@@ -677,9 +677,24 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     // `certified` IS the verdict (RFC 0148 §A; RFC 0168 §E.1 adds the bundle-wide
     // blocked rule). Until rc.45 it was `!notHeld && !rejected && blocked === 0`
     // and never read `certifiable` — an empty v2 floor certified on no evidence.
-    const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
+    // Relaxations are parsed BEFORE the verdict, because they are part of it.
+    // `security-defaults.md` §Relaxations is explicit: "A bundle that records a
+    // relaxation MUST NOT certify the profile the relaxed obligation belongs to"
+    // (RFC 0173 §A.2). The emitter computed `certified` with no relaxation term —
+    // and parsed relaxations on the NEXT line, so it was structurally impossible
+    // for one to affect the verdict — then excluded `relaxed-profile-certified`
+    // from its own self-check. The shipped artifact asserted `certified: true`
+    // for a profile that cannot certify, and only `--verify` disagreed with the
+    // file. A reader who parses `.certified` — the obvious thing to do — got the
+    // wrong answer.
     let relaxations: BundleV3['host']['relaxations'];
     if (process.env['OPENWOP_HOST_RELAXATIONS']) { try { relaxations = JSON.parse(process.env['OPENWOP_HOST_RELAXATIONS']) as BundleV3['host']['relaxations']; } catch { process.stderr.write('openwop-conformance --certify: OPENWOP_HOST_RELAXATIONS is not JSON\n'); process.exit(2); } }
+    // RFC 0173 §A.2: a recorded relaxation denies the profile its obligation
+    // belongs to. Matched the same way the verifier matches it, so the emitter
+    // and `verifyBundleV3` cannot disagree about the same bundle.
+    const relaxedObligations = new Set((relaxations ?? []).map((r) => r.obligation));
+    const relaxedProfile = (p: string): boolean => [...relaxedObligations].some((o) => p.includes(o));
+    const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !relaxedProfile(p) && (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
     const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
     const lock = existsSync(lockPath) ? (JSON.parse(readFileSync(lockPath, 'utf8')) as { version: string; stampSha256: string }) : undefined;
     const nonPass = rows3.filter((r) => r.result !== 'executed-pass');
@@ -714,7 +729,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     const scrubbed3 = scrubEvidence(v3, secrets3);
     const v3Out = scrubbed3.value as BundleV3;
     const audit3 = verifyBundleV3(v3Out, { hostPublicKeyPem: publicKeyFromPrivate(signingKeyPem) });
-    const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'relaxed-profile-certified', 'independent-unverifiable'].includes(r.kind));
+    // `relaxed-profile-certified` is no longer excused: the emitter now computes
+    // the relaxation into `certified`, so if the verifier still finds that
+    // contradiction the bundle is genuinely malformed and MUST NOT be written.
+    const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'independent-unverifiable'].includes(r.kind));
     if (emitterDefects.length > 0) {
       // Keep the rejected bundle: a self-verification failure with nothing to
       // inspect sent a host patching a scratch copy of this CLI to see it.