Conformance leaderboard

Last updated: 2026-06-09. A live record of OpenWOP-compatible hosts — their advertised compatibility profiles and the conformance evidence behind each claim. A row is a claim plus evidence: the claim is the host's advertised profile; the evidence is the conformance result published with the host (or under conformance.md).

Hosts

Agent Platform profile (RFC 0085 — openwop-agent-platform)

The aggregate platform profile defined in spec/v1/agent-platform-profile.md (RFC 0085, Accepted 2026-06-01). A host populates the status column when it reaches partial/full. MyndHyve — the steward-affiliated sibling host whose graduation evidence accepted the RFC — derives full; no example reference host claims it yet (honest).

Connection packs (RFC 0095 — capabilities.connections.packsSupported)

The portable provider-definition pack kind defined in spec/v1/connection-packs.md (RFC 0095, Accepted 2026-06-12). A host populates the status column when it advertises connections.packsSupported: true and implements the §Manifest clause 6 resolution contract; verification is the two capability-gated behavioral scenarios (connection-provider-resolution + connection-pack-write-reconsent) run non-vacuously against the published suite.

Multi-party group conversation (RFC 0101 — capabilities.multiPartyConversation)

The shared-transcript / speaker-attribution surface defined in RFC 0101 (Accepted 2026-06-22). A host populates the status column when it advertises multiPartyConversation.supported: true, emits the optional participants: AgentRef[] on conversation.opened, stamps speakerId on role:'agent' turns, and rejects a turn from a non-participant. The always-on leg of multi-party-conversation-shape.test.ts verifies the schema shapes server-free; the capability-gated behavioral leg (isMultiPartyConversationSupported()) verifies live roster + attribution + non-participant rejection against an advertising host.

Localized content surface (RFC 0103 — capabilities.content.supported)

The capability-gated authored-content surface defined in spec/v1/localized-content.md (RFC 0103, Accepted 2026-06-17). A host populates the status column when it advertises content.supported: true (requires i18n.supported) and serves GET /v1/content/pages/{slug} with the §C resolveSection merge; the always-on legs of localized-content-delivery.test.ts verify the schemas + merge + capability coherence server-free, and the gated legs verify live delivery + tenant isolation.

Multi-turn conversation primitive (RFC 0005 — capabilities.conversationPrimitive)

The multi-turn conversation suspend variant defined in RFC 0005 (Accepted 2026-05-11), wiring the core.conversationGate typeId + the conversation.start / conversation.exchange / conversation.close suspend variants (normative surface in spec/v1/interrupt.md + spec/v1/capabilities.md). A host populates the status column when it advertises conversationPrimitive: true and takes the conversation path over the clarification.requested fallback; verification is the capability-gated conversationLifecycle / conversationReplayDeterminism / conversationVsLegacySuspend scenarios run non-vacuously, with conversationCapabilityNegotiation covering the negative refusal contract on hosts that do not advertise.

Self-hosted / OpenAI-compatible provider class (RFC 0108 — aiProviders.selfHosted[])

The operator-/tenant-configured OpenAI-compatible endpoint class defined in spec/v1/capabilities.md §aiProviders.selfHosted (RFC 0108, Active 2026-06-24). A host populates the status column when it advertises aiProviders.selfHosted: string[] (a subset of supported[]) for a configured, reachable endpoint — honestly (§A.2, under OPENWOP_REQUIRE_BEHAVIOR), with an opaque non-URL id (§A.3), keeping the endpoint location off every wire surface (self-hosted-endpoint-no-disclosure). The always-on aiproviders-selfhosted-shape.test.ts verifies the §A field shape + the §A.1 subset / §A.3 no-URL rules server-free; the gated aiproviders-selfhosted-honesty.test.ts (lands at Active → Accepted) verifies a real dispatch against a selfHosted id with no endpoint-URL leak.

Parallel sub-workflow fan-out and join (RFC 0118 — capabilities.dispatch.fanOutSupported)

RFC 0118 graduated Active → Accepted on 2026-06-28. Both legs are now dual-witness and steward-verified (2026-06-28): the discovery/advertisement leg by /.well-known/openwop curl of each host, and the behavioral leg by a direct steward probe of each host's seam-enabled POST /v1/host/sample/dispatch/fanout returning a real, non-vacuous coordinator+fold. (At the original flip the behavioral leg was single-witness host-self-reported with a steward cross-check deferred; the deferred cross-check was subsequently run once both hosts stood up auth-exempt conf-fanout seam revisions — see the rows below. The full @openwop/openwop-conformance harness against openwop-app's tag URL tripped that host's per-IP 429 read budget during its multi-file discovery burst and soft-skipped the gated legs, so the direct seam probe is the steward behavioral artifact, alongside each host's own harness runs.) Per GOVERNANCE.md §"Acceptance evidence tiers" this remains a tier-2 (steward-affiliated sibling) + reference-host graduation — not independent-organization dual-witness.

The joinModes / onChildFailureModes divergence between the two witnesses (["wait-all"] + ["collect","absorb"] vs the full four-mode + three-mode sets) is the intended, discoverable outcome of the capability gating — a portable workflow pinning joinPolicy.mode:'quorum' or onChildFailure:'fail-fast' registers on MyndHyve and is honestly rejected at registration on openwop-app, and the author can see exactly that from each host's /.well-known/openwop at edit time (the gap RFC 0118's joinModes + openwop#789's onChildFailureModes descriptors close).

Subscription-reuse provider auth mode (RFC 0121 — aiProviders.authModes: "subscription")

The subscription auth mode defined in spec/v1/capabilities.md §aiProviders.authModes (RFC 0121, Active 2026-07-01; conformance 1.47.0). A host advertises subscription when it accepts a credential derived from reusing the caller's personal consumer subscription (Claude Pro/Max, ChatGPT Plus) — the mode is a BYOK path (§B.7, MUST be in byok), its credential MUST bind at host.credentials scope:"user" and MUST reject a tenant/workspace binding with credential_scope_forbidden (§B.8, the protocol-tier subscription-credential-user-scope-only invariant), and it MUST be advertised only when a real acquisition mechanism is configured (§B.9, truthful-advertisement). The always-on aiproviders-subscription-scope.test.ts verifies the enum shape server-free; the §B.7 leg is advertisement-gated; the §B.8 leg is bind-seam-gated (POST /v1/host/sample/credentials/bind, soft-skip on 404) so the user-scope safety rail is witnessable without a live subscription advertisement.

Partial graduation (2026-07-01): scope-safety rail only; 0121 stays Active. UQ1 (does any provider's consumer ToS permit third-party API-shaped reuse?) is UNRESOLVED — no citation exists; the steward issued an at-own-risk waiver (RFC 0121 Status history) of the acquisition-bearing gate. No host advertises subscription on a live discovery doc — the reference host is the scope-safety / reference-impl witness, not a full-advertisement witness. A full Active → Accepted graduation remains open, pending a deploy-model-compatible + UQ1-cleared advertising host (candidate: MyndHyve tier-2, per steward direction).

Anonymous-actor authorization (RFC 0132 — capabilities.anonymousActor)

The anonymous-actor model defined in spec/v1/capabilities.md §anonymousActor + spec/v1/auth.md §"Anonymous actors" (RFC 0132, Active 2026-07-22). A host advertises anonymousActor { supported:true, tiers, writeEgressControls?, failClosed:true } when it honors authorization for a caller on a public agent surface who authenticated no identity: an opaque, origin-bound, ephemeral, non-cross-linkable, non-PII principal (owner.principalKind:"anonymous") whose authority is a default-deny, explicit per-surface tool grant — never a role, never the ADR 0315-style default-on tool baseline. The read tier is tenant-scoped with no egress and no secret/BYOK reach; the bounded-write-egress tier is permitted only behind a mandatory HITL/approval (RFC 0051) or rate-limit + per-session cap, over the RFC 0076/0079 SSRF-guarded, audience-bound egress path. Every anon tool call audits via the existing RFC 0049 authorization.decided event (no new event type). The always-on anonymous-actor-shape.test.ts verifies the advert shape + the §B.2 conditional + owner.principalKind + the audit reuse server-free; the five gated behavioral scenarios (anonymous-actor-default-deny, -no-secret-reach, -egress-guarded, -write-gated, -audit-opaque) drive the POST /v1/host/sample/anon-surface/dispatch + GET /v1/host/sample/anon-surface/tools seam and soft-skip until a host wires a tool-enabled public surface.

Graduated Active → Accepted 2026-07-22 on the openwop-app tier-1 reference witness. The five SECURITY invariants landed at reference-impl tier at Active and GRADUATED to protocol tier at Active → Accepted once openwop-app wired the surface and passed all five behavioral scenarios non-vacuously under OPENWOP_REQUIRE_BEHAVIOR=true (RFC 0079 egress-credential-audience-bound precedent). The host ships the surface gated behind OPENWOP_ANON_ACTOR_ENABLED (default OFF) — honest-off, not advertised on the live production discovery doc until an operator opts in.

Self-hosted runner (RFC 0122 — capabilities.selfHostedRunner)

The runner↔host channel defined in spec/v1/self-hosted-runner.md (RFC 0122, Accepted 2026-07-02; conformance 1.48.0). A host advertises selfHostedRunner { supported:true, dispatchKinds? } when it routes a run's per-step model/tool dispatch to a user-controlled runner that dials OUT (SSE receive + POST result, no inbound exposure) and holds local credentials the host cannot reach. The host stays the sole orchestration/persistence/replay authority; dispatch is per-step ({runId, stepId, seq, kind, provider?/model?/tool?, inputs}), results persist as normal step records (replay never re-dispatches), subject-first match rejects a cross-subject dispatch with a retriable runner_unavailable, and a redelivered {runId, stepId} is dropped at-most-once (deduped:true). The always-on self-hosted-runner.test.ts schema legs verify the frame/registration/capability shape server-free (the closed frames are the runner-credential-non-transit rail); the gated behavioral legs drive the POST /v1/host/sample/runner/{register,dispatch} seam (host-sample-test-seams.md §19) to assert subject-first runner_unavailable+retriable and at-most-once dedup non-vacuously. The runner_unavailable numeric HTTP status is host-chosen (any >= 400) — the witness asserts the envelope { error: { code, retriable:true } }, not a fixed status (mirrors run_forbidden / capability_required; registered in rest-endpoints.md §"Common error codes" per #815).

Graduated on dual-witness evidence vs suite 1.48.0 — per GOVERNANCE.md §"Acceptance evidence tiers" a tier-1 reference (openwop-app) + tier-2 (MyndHyve steward-affiliated sibling) graduation, not independent-organization dual-witness. Both invariants (runner-credential-non-transit, runner-output-untrusted-transport) are protocol-tier.

Data-parallel dispatch per-item input (RFC 0126 — capabilities.dispatch.perItemInput)

RFC 0126 graduated Active → Accepted on 2026-07-04 on a single-witness bootstrap steward waiver (0120/0121/0125 precedent); it is now dual-witness live (2026-07-05) — openwop-app (tier-1) + MyndHyve workflow-runtime (tier-2 steward-affiliated sibling), both advertising dispatch.perItemInput: true on live-deployed hosts, steward-curl-verified. The nextWorkerInputs[] array on NextWorkerDecision (orchestrator-decision.schema.json) lets a next-worker decision fan ONE childWorkflowId over N runtime items with distinct per-item inputs, projected over the RFC 0022 inputMapping (per-item wins on collision). A host advertises capabilities.dispatch.perItemInput: true (a prose descriptor in capabilities.md §dispatch, alongside the prose-only RFC 0118 dispatch.* family) when it honors per-index projection, the length-equality + fail-closed runtime validation_error gates, and the replay-freeze re-read of the recorded runOrchestrator.decided decision. The always-on dispatch-per-item-input.test.ts schema legs verify the nextWorkerInputs shape + the additionalProperties:false fail-closed rail server-free; the capability-gated behavioral legs (projection, merge-precedence, length-mismatch, replay-freeze, fail-closed) drive the POST /v1/host/sample/dispatch/per-item seam and soft-skip until a host wires it.

Portable per-run parameter deferral (RFC 0124 — capabilities.workflowChainPacks.deferredParameters)

RFC 0124 graduated Active → Accepted on 2026-07-04 on a single-witness bootstrap steward waiver (0120/0121/0125/0126 precedent; the dual-witness path is a tracked follow-up per gap G6 — MyndHyve workflow-runtime and the in-memory host both lack a chain-expansion / PromptTemplate-compose path). Deferred mode materializes a workflow-chain pack's parameters into top-level variables[] and rewrites {{params.}} into spec'd runtime bindings (PromptTemplate {{varName}} source:"variable", or a variable-sourced PortValue), keeping parameters overridable per run via configurable while the persisted definition holds ZERO {{params.}} tokens. A host advertises workflowChainPacks.deferredParameters.supported: true when it implements this AND the §Security handling for x-openwop-sensitive params (materialize source:"secret", prompt-body-only, fail-closed sensitive_param_not_deferrable 422 elsewhere, per-run supply = credentialRef not plaintext). The always-on workflow-chain-deferred-parameters.test.ts legs verify deferred expansion + the §Security fail-closed/no-plaintext MUSTs server-free against the reference expandChainDeferred; the capability-gated host legs drive the POST /v1/host/sample/chain/deferred-expand seam (override / :fork replay / untrusted-fence / [REDACTED] compose) and soft-skip until a host wires it.

Streaming & CDC trigger sources (RFC 0127 — triggerBridge.sources: "stream" | "change")

RFC 0127 graduated Active → Accepted on 2026-07-06 on a single-witness bootstrap steward waiver (tier-1 reference host). It additively extends the RFC 0083/0099 trigger source enum with stream (a Kafka/Kinesis/Pub-Sub broker message) and change (a warehouse/DB CDC row; op insert|update|delete REQUIRED in the ChangeEvent sub-object). Both reuse the RFC 0099 TriggerEvent envelope, SSRF posture, SR-1 content-free trigger.* events, and the RFC 0083 ≥24h dedup floor unchanged. A host advertises stream/change in triggerBridge.sources[] + ingestion.externalSources[] only when it operates a real broker/CDC consumer (RFC 0099 honesty rule). The always-on trigger-stream-cdc-sources.test.ts schema legs verify the envelope shape (op-required negative, exactly-one rule, vocabulary pins) server-free; the capability-gated behavioral legs drive the POST /v1/host/sample/trigger-bridge/{ingest,deliver} seams.

Purpose-propagation permitted-use labels (RFC 0128 — capabilities.purposePropagation)

RFC 0128 graduated Active → Accepted on 2026-07-06 on a single-witness bootstrap steward waiver + maintainer call. Gap G4 (a real onward label-carrying egress, steward-witnessed) — CLOSED 2026-07-06: tier-1 openwop-app built the openwop-app.cdp.sync-to-openwop-host reference workflow (prepare-onward node → the sanctioned core.openwop.http.fetch node → a steward capture bin) and fired the four onward legs local-on-origin/main; the steward independently read the bin and verified ⊆received / never-widen (marketing dropped on the real send) / []-drop with an unlabelled positive control. openwop-app is now the first host with a real onward label-carrying OpenWOP-envelope egress. An OPTIONAL permittedPurposes: string[] label (opaque purpose categories; absent = unlabelled, [] = no onward use) rides the A2A metadata.openwop.permittedPurposes extension + the top-level TriggerEvent.permittedPurposes field; a host advertising purposePropagation {supported, propagatesOnward} MUST re-emit the label on onward OpenWOP-envelope hops (MAY narrow, MUST NOT widen), a derived output MUST NOT carry a purpose absent from any contributing labelled input, and []-labelled data MUST NOT be forwarded onward. Non-OpenWOP destinations are a field-mapping SHOULD (untestable); internal use is §4 declared-intent (not gated). The always-on schema legs verify the label + family shape; the seam-gated purpose-propagation.test.ts behavioral legs drive the POST /v1/host/sample/purpose-propagation/forward two-hop seam.

Front-end plugin packs (RFC 0117 + 0119 — capabilities.uiPlugins)

RFC 0117 (+ 0119 isolation mechanism-neutrality) graduated Active → Accepted on 2026-07-06 on a single-witness bootstrap steward waiver + maintainer autonomy grant. A host advertising uiPlugins {supported:true, isolation} loads SIGNED, SANDBOXED kind:"frontend-plugin" packs in an origin/execution-isolated boundary and talks to them over the closed ui-plugin/1 host-RPC allowlist. Four protocol-tier SECURITY invariants: frontend-plugin-isolation / -egress / -rpc-allowlist / -no-byok. Witness ruling: isolation + egress are serve/apply-control MUSTs — the host MUST apply a sandboxed cross-origin iframe (no allow-same-origin) and serve the plugin under a deny-egress CSP; those controls are falsifiable by the steward on the wire + the reference host's FE unit tests, while the browser's runtime enforcement of correctly-applied controls is a platform guarantee (the §4-parallel unobservable-runtime split). rpc-allowlist + no-byok are wire-observable and steward-curl-verified.

Portable prompt-prefix cache (RFC 0116 — aiProviders.promptPrefixCache)

RFC 0116 graduated Active → Accepted on 2026-07-06 on a single-witness bootstrap steward waiver. A supporting host MAY route a stable, tenant-namespaced, secret-free cachePrefixId label to its provider's context cache; the outcome is cost-hint-only + replay-invariant (a hit/miss MUST NOT change the recorded envelope or inputTokens/outputTokens), witnessed by the cost-only provider.usage.cacheReadTokens/cacheWriteTokens. Protocol-tier invariant prompt-prefix-cache-cross-tenant-isolation mandates a (tenant, cachePrefixId) cache key.

A2UI surface deltas (RFC 0114 — a2uiSurface.deltaTransport)

RFC 0114 graduated Active → Accepted on 2026-07-06 on a single-witness bootstrap steward waiver. A host MAY deliver RFC 6902 (JSON-Patch) delta frames over the run event stream to subscribers that negotiate ?a2uiDelta=1; the RECORDED envelope stays the FULL ui.a2ui-surface (replay-pinned, unchanged) and the consumer re-validates the post-patch surface against the closed A2UI catalog fail-closed.

Connection-pack provider vendor grouping (RFC 0123 — provider.vendor)

RFC 0123 graduated Active → Accepted on 2026-07-06 on a single-witness bootstrap steward waiver — an OPTIONAL presentational vendor string on the RFC 0095 connection-pack provider object, so a host/registry groups pack-delivered connectors by commercial vendor. It gates no capability and carries no wire behavior, so the observable contract is the schema shape (accept string / accept-absent / reject non-string), witnessed by three conformance legs; the rendering MUSTs (SHOULD-group / MUST-fallback-to-displayName) are the 0128/0129 §4 unobservable-runtime class. Evidence UPGRADE 2026-07-07 (CARRIED-FORWARD → host-served real grouping): the flip was steward-only on the schema-shape witness, but a tier-1 host now serves pack-delivered vendor grouping on the wire — lifting the host row from "schema-shape witnessed" to "host-served real grouping witnessed." Tier-2 (a second host) is carried forward.

Agent-manifest role + the Skill profile (RFC 0131 — AgentManifest.role)

RFC 0131 graduated Draft → Accepted on 2026-07-07 via the bootstrap single-maintainer comment-window waiver (steward architect-reviewed). It adds an additive OPTIONAL AgentManifest.role ("skill" | "assistant") plus a schema-encoded Skill profile (if role==="skill" then {required:["handoff"], memoryShape.{conversation,longTerm} !== true}). Enforcement is universal JSON-Schema validation at publish/install — it introduces **no capabilities.* advertisement and no host runtime behavior — so, unlike a capability-gated surface, there is no per-host interop variance to track: every conformant validator rejects a stateful/handoff-less skill manifest identically, and an absent role (or role:"assistant") is unconstrained on every host. The witness is therefore the always-on, server-free** agent-manifest-role-profile.test.ts (validate skill/assistant/no-role; reject the stateful skill, the handoff-less skill, and a bad enum value) — no host-witness table applies. SECURITY invariant agent-skill-profile-stateless. Reference host: openwop-app ADR 0312 (Phase-0 marketplace "Skill" label; Phase-2 worker-memory normalization).

Conformance pass rates

Measured against @openwop/openwop-conformance@1.22.0 (the published suite has since advanced to 1.46.0 — 1.23.0 added the +5 RFC 0095 connection-pack scenarios, 1.24.0 the RFC 0096/0097/0098 scenarios, 1.25.0 the RFC 0099/0100 scenarios, 1.26.0 the RFC 0102 A2UI scenarios, 1.27.0 the RFC 0103 localized-content scenario, 1.28.0 the RFC 0104 approver-routing scenario, and 1.29.0–1.46.0 a further sequence of capability-gated scenarios (1.29.0 RFC 0105 speech-synthesis through 1.46.0 RFC 0120 connection-pack apiHosts egress allow-list); all are capability-gated and soft-skip on these reference hosts (which advertise none of those surfaces), so applicable rates are unchanged, and the table below re-measures on the next suite cycle) — all five hosts measured 2026-06-11, then re-measured the same day after the gap-closure fixes landed (openwop-examples#7 + openwop-app#164): the morning run's findings — the RFC 0093 §A3 webhook-tenant-isolation registration-gate gap on SQLite/Postgres/Python, the Python RFC 0058 runTimeoutMs gap, and the workflow-engine's 12 long-carried pre-existing failures — were all root-cause fixed and verified. Current posture: zero deterministic failures on the workflow-engine, Postgres, SQLite, and Python hosts; the in-memory host's 45 failures remain its documented honest-non-claim set (advertised-fixture surfaces the minimal host doesn't implement). Modes: in-memory/python/postgres default (Postgres via pglite), SQLite strict with honest profile/fixture opt-outs, workflow-engine in-process serial. Suite total 1963. Measurement basis: full 82-fixture catalog (fixture resolution now env-overridable + sibling-probing and loud on fallback — the silent degraded loading of pre-1.22.0 readings is fixed). Pass rate is passed/total.

Workflow-engine row re-measured 2026-06-21 at suite 1.29.0 (in-process, serial via --no-file-parallelism, full repo corpus via OPENWOP_CONFORMANCE_ROOT, OPENWOP_TEST_SEAM_ENABLED=true, memory://): 2059 / 0 / 89 / 2148, zero deterministic failures. The total rises 1963 → 2148 because the 1.23.0–1.29.0 scenarios now register (and the repo corpus carries the spec-corpus-validity prose/link/index cases the published package omits by design — so the repo-corpus total is the apples-to-apples basis the other reference rows are also measured on). The 89 skips are honest-non-claims: capability-gated families this host advertises none of (RFC 0104 approver-routing, RFC 0105 speech-synthesis, the unadvertised-profile families) soft-skip in default mode. The other four reference rows remain at the 1.22.0 basis pending their next re-measure cycle.

Composition partners — interop evidence

The conformance suite's MCP and A2A probes run against live reference implementations of the adjacent protocols. See A2A vs MCP vs OpenWOP for how the three layers compose.

Reading Rows

• Compatibility profile claim is derived from /.well-known/openwop according to spec/v1/profiles.md.
• Scale claim follows spec/v1/scale-profiles.md.
• Production profile claim follows spec/v1/production-profile.md and is recorded separately because durability, retention, backpressure, and observability are operational evidence, not discovery-payload predicates.
• Conformance evidence should name the suite version, command used, target URL class, and pass/fail/skip counts. Do not include private deployment identifiers, secrets, or internal result paths.

Add A Host

1. Implement the openwop v1 wire contract. 2. Run @openwop/openwop-conformance against the host. 3. Publish a result file or Markdown summary in a public repository. 4. Add a row above with compatibility, scale, production-profile, and evidence claims.

See Also

• conformance/README.md — how to run the suite.
• spec/v1/profiles.md — compatibility profile predicates.
• spec/v1/scale-profiles.md — scale tier definitions.
• spec/v1/production-profile.md — public-release operational profile.