@openwop/openwop-conformance 1.101.0 → 1.103.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.101.0",
+  "version": "1.103.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.101.0",
-  "corpusCommit": "be303ce1c692847339ea5bb05f569af72d962cda"
+  "suiteVersion": "1.103.0",
+  "corpusCommit": "c6f779513a26705a5d9fd8958ec1cd75ab8f6fdb"
 }

package/src/scenarios/replay-side-effect-suppression.test.ts

@@ -48,6 +48,9 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { V1_DIR } from '../lib/paths.js';
 
 const WORKFLOW_ID = 'conformance-replay-side-effect';
 const EFFECT_NODE = 'effect';
@@ -182,3 +185,65 @@ describe.skipIf(SKIP_NO_FIXTURE)('replay-side-effect-suppression: a replay does
     ).toBe(true);
   });
 });
+
+/**
+ * `replay.md` requirement 4 — the manifest declaration is a classification FLOOR.
+ *
+ * A pack manifest may declare `role: "side-effect"`. Until 2026-08-14 the only
+ * stated purpose of that field was that it "drives engine scheduling", so a host
+ * was free to classify side-effecting nodes from a private list and never read
+ * it. A tier-1 host did exactly that and a shipped `core.storage.blob-put` node
+ * performed real object-store `PUT`s **during a replay**, past two independent
+ * guards, because neither consulted the manifest that had declared the node
+ * side-effecting all along.
+ *
+ * Requirement 4 makes the declaration binding: a host's own classifier is a floor
+ * ABOVE it and never a substitute — more nodes may be treated as side-effecting,
+ * never fewer.
+ *
+ * **This is a coherence gate, not a behavioral witness, and the distinction
+ * matters.** Proving a host honours requirement 4 needs that host advertising
+ * `recorded-outcome`, a pack node declaring the role, and an observable external
+ * effect across a replay — none of which the suite can synthesize. What it CAN
+ * do is ensure the declaration and the obligation cannot drift apart: if someone
+ * renames the role value, or drops the requirement, this fails. RFC 0148 §A
+ * resolves the behavioral half to `blocked`, not to a pass.
+ */
+describe.skipIf(V1_DIR === null)('replay.md req 4 — the manifest role is a classification floor', () => {
+  const dir = V1_DIR as string;
+  const replay = () => readFileSync(join(dir, 'replay.md'), 'utf8');
+  const manifest = () =>
+    readFileSync(join(dir, '..', '..', 'schemas', 'node-pack-manifest.schema.json'), 'utf8');
+
+  it('the manifest still offers the role value the requirement binds', () => {
+    // If `side-effect` is renamed or dropped from the taxonomy, requirement 4
+    // binds a value nothing can declare — a rule with no reachable trigger.
+    expect(
+      manifest().includes('side-effect'),
+      'node-pack-manifest.schema.json §role MUST still describe the `side-effect` value that ' +
+        'replay.md requirement 4 makes binding. A requirement whose trigger no longer exists is ' +
+        'not enforcement, it is decoration.',
+    ).toBe(true);
+  });
+
+  it('replay.md binds that declaration, naming the schema it comes from', () => {
+    const doc = replay();
+    expect(
+      /MUST\*{0,2} be treated as side-effecting/.test(doc) && doc.includes('node-pack-manifest.schema.json'),
+      'replay.md §"Requirements when a host declares `sideEffectSuppression: \\"recorded-outcome\\"`" ' +
+        'MUST bind a manifest-declared `role: "side-effect"` to the suppression obligation, and MUST ' +
+        'name the schema the declaration comes from so a reader can find it.',
+    ).toBe(true);
+  });
+
+  it('the floor direction is stated, not left to inference', () => {
+    // The dangerous reading is symmetric: "my classifier disagrees, so the
+    // manifest is wrong." The requirement is one-directional and says so.
+    expect(
+      replay().includes('MUST NOT classify fewer'),
+      'replay.md requirement 4 MUST state the direction: a host classifier may treat MORE nodes as ' +
+        'side-effecting and never fewer. Without the direction, a host that trusts its own list over ' +
+        'the manifest can read the clause as permission to disagree.',
+    ).toBe(true);
+  });
+});

package/src/scenarios/run-execution-bounds-shape.test.ts

@@ -122,11 +122,54 @@ describe.skipIf(SKIP_TIMEOUT)('run-execution-bounds: run-duration breach (RFC 00
       'run-event-payloads.schema.json §capBreached.kind',
       'cap.breached payload MUST carry kind="run-duration"',
     )).toBe('run-duration');
+    // Three distinct failure modes, asserted separately and WITH THE VALUES.
+    //
+    // The previous form ANDed all three into one boolean over a message that
+    // named none of them, so a failure said only "MUST be strictly greater" —
+    // you could not tell whether `observed` was missing, equal, or smaller. A
+    // tier-1 host hit this intermittently and had to reason out the mechanism
+    // from first principles, because the assertion about observed values did
+    // not report the observed values.
     expect(
-      typeof payload?.observed === 'number' && typeof payload?.limit === 'number' && payload!.observed > payload!.limit,
+      typeof payload?.observed,
       driver.describe(
         'run-event-payloads.schema.json §capBreached.observed',
-        'observed (elapsedMs) MUST be strictly greater than limit (resolved timeout)',
+        `cap.breached MUST carry a numeric \`observed\`; got ${JSON.stringify(payload?.observed)}`,
+      ),
+    ).toBe('number');
+    expect(
+      typeof payload?.limit,
+      driver.describe(
+        'run-event-payloads.schema.json §capBreached.limit',
+        `cap.breached MUST carry a numeric \`limit\`; got ${JSON.stringify(payload?.limit)}`,
+      ),
+    ).toBe('number');
+
+    // `capabilities.md` §"Engine-enforced limits": *"Always strictly greater
+    // than limit."* This is satisfiable and it constrains the host's comparison:
+    // breach when elapsed EXCEEDS the deadline, not when it reaches it. A host
+    // testing `elapsed >= limit` emits `observed === limit` exactly when the
+    // clock lands on the boundary — which is rare, machine-dependent, and
+    // therefore reads as flake rather than as the deterministic defect it is.
+    //
+    // That asymmetry is why the diagnosis belongs in the message: system load
+    // makes elapsed LARGER, so it makes this assertion easier to satisfy, not
+    // harder. An `observed === limit` failure is not a loaded box — it is a
+    // `>=` comparison in the host.
+    const { observed = NaN, limit = NaN } = payload ?? {};
+    expect(
+      observed > limit,
+      driver.describe(
+        'run-event-payloads.schema.json §capBreached.observed',
+        `observed (elapsedMs) MUST be strictly greater than limit (resolved timeout). ` +
+          `Got observed=${observed}, limit=${limit}` +
+          (observed === limit
+            ? '. They are EQUAL, which means the host breached at `elapsed >= limit` rather than ' +
+              '`elapsed > limit`. The limit is not breached until it has been passed. This is ' +
+              'deterministic in the host and only surfaces when the clock lands exactly on the ' +
+              'boundary, so it presents as an intermittent failure — load makes elapsed larger and ' +
+              'therefore makes this assertion PASS more often, not less.'
+            : '.'),
       ),
     ).toBe(true);
   });