@openwop/openwop-conformance 1.125.0 → 1.127.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.125.0",
+  "version": "1.127.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.125.0",
-  "corpusCommit": "13ab2a545d4e2a30c8da66354e39d4db7233acae"
+  "suiteVersion": "1.127.0",
+  "corpusCommit": "5e2aefe837a81b82004c12c308cb1c3973c0233c"
 }

package/src/scenarios/a2a-1-0-task-roundtrip.test.ts

@@ -53,7 +53,9 @@ async function claims10(): Promise<boolean> {
 async function jsonrpc10Url(): Promise<string | null> {
   const caps = await a2a();
   if (typeof caps?.agentCardUrl !== 'string') return null;
-  const res = await fetch(caps.agentCardUrl, { headers: { accept: 'application/json' } });
+  // S18 (#1028): a header-less card GET returns the 0.3 shape while `a2a-0.3-legacy`
+  // is advertised; a 1.0 client asks for the 1.0 card explicitly (a2a-integration.md §C).
+  const res = await fetch(caps.agentCardUrl, { headers: { accept: 'application/json', 'A2A-Version': '1.0' } });
   if (res.status !== 200) return null;
   const card = (await res.json()) as { supportedInterfaces?: Array<{ url?: string; protocolBinding?: string; protocolVersion?: string }> };
   const iface = (card.supportedInterfaces ?? []).find((i) => i.protocolBinding === 'JSONRPC' && i.protocolVersion === '1.0');

package/src/scenarios/capability-example-root-layout.test.ts

@@ -21,6 +21,27 @@
  * otherwise legal unknown server-emitted property, and nothing here reads a
  * host.
  *
+ * **Canonical-typo leg (RFC 0149 §B, second bullet; UQ2 decided 2026-08-16).** A
+ * root key within edit distance ONE of a canonical family, in a discovery-shaped
+ * example, that is not itself canonical and not vendor-namespaced, is a typo
+ * (`compensaton`, `interupts`) — an implementer copying it advertises nothing.
+ * UQ2 asked what rule avoids false positives on legitimate extension names; the
+ * answer was measured, not guessed. Over every fenced root object in `spec/v1` +
+ * `RFCS/` (218 on 2026-08-16), plain distance-one produced six near-misses —
+ * `ts`/`fs`, `agent`/`agents`, `secret`/`secrets`, `context`/`content`,
+ * `prompt`/`prompts`, `schemaVersion`/`schemaVersions` — every one of them a key
+ * of an EVENT or RUN object, not a discovery document. So the predicate is
+ * *discovery-shaped*: every root key is canonical, vendor-namespaced
+ * (`host-extensions.md` §"Canonical prefixes"), the legacy `capabilities`
+ * wrapper, or within distance one of a canonical family — and at least one key
+ * is canonical-or-near. That excludes events (`ts`/`type`/`payload` are none of
+ * those) while still catching a typo-only snippet whose single key is misspelt.
+ * Scope: `spec/v1` and RFCs numbered >= 0149 (the rule's own RFC); older RFCs
+ * are the dated record, on the same boundary logic as the wrapper leg's 0073.
+ * Under that predicate and scope the corpus measured 53 discovery-shaped
+ * objects and 0 findings; the one out-of-scope near-miss is RFC 0109's
+ * `{ "agent": … }` payload fragment.
+ *
  * `spec/v1/` and `RFCS/` ship in the repository, NOT in the published tarball,
  * so this self-skips under the published layout. That asymmetry has produced
  * three defects in this corpus — the `CORPUS-STAMP` gate, the link-checker's
@@ -66,6 +87,97 @@ function fencedExamples(dir: string): FencedExample[] {
   return found;
 }
 
+/** RFC 0149 introduced the typo lint; examples in earlier RFCs are historical record. */
+const TYPO_LINT_RFC = 149;
+
+const SCHEMA_PATH =
+  V1_DIR === null ? null : pathResolve(V1_DIR, '..', '..', 'schemas', 'capabilities.schema.json');
+
+/** The canonical families, read from the schema rather than hand-listed. */
+function canonicalFamilies(): Set<string> {
+  if (SCHEMA_PATH === null) return new Set();
+  const schema = JSON.parse(readFileSync(SCHEMA_PATH, 'utf8')) as { properties?: Record<string, unknown> };
+  return new Set(Object.keys(schema.properties ?? {}));
+}
+
+/** `host-extensions.md` §"Canonical prefixes". */
+function isVendorKey(key: string): boolean {
+  return /^x-host-/.test(key) || /^(vendor|private)\./.test(key);
+}
+
+/** Levenshtein distance exactly one (one substitution, insertion, or deletion). */
+export function withinOne(a: string, b: string): boolean {
+  if (a === b) return false;
+  if (Math.abs(a.length - b.length) > 1) return false;
+  if (a.length === b.length) {
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) if (a[i] !== b[i] && ++diff > 1) return false;
+    return diff === 1;
+  }
+  const [short, long] = a.length < b.length ? [a, b] : [b, a];
+  let i = 0;
+  let j = 0;
+  let skipped = false;
+  while (i < short.length && j < long.length) {
+    if (short[i] === long[j]) {
+      i++;
+      j++;
+    } else if (skipped) {
+      return false;
+    } else {
+      skipped = true;
+      j++;
+    }
+  }
+  return true;
+}
+
+export interface TypoFinding {
+  readonly key: string;
+  readonly near: readonly string[];
+}
+
+/**
+ * The UQ2 rule. Returns the near-miss root keys of a DISCOVERY-SHAPED object, or
+ * `null` when the object is not discovery-shaped (and so is out of scope: an
+ * event, a run body, a manifest). Exported so the predicate is pinned below.
+ */
+export function canonicalTypos(value: unknown, families: Set<string>): TypoFinding[] | null {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return null;
+  const keys = Object.keys(value as Record<string, unknown>);
+  if (keys.length === 0) return null;
+  const near = new Map<string, string[]>();
+  for (const k of keys) {
+    if (families.has(k) || isVendorKey(k) || k === 'capabilities') continue;
+    const n = [...families].filter((f) => withinOne(k, f));
+    if (n.length === 0) return null; // a key that is none of the four kinds ⇒ not discovery-shaped
+    near.set(k, n);
+  }
+  if (!keys.some((k) => families.has(k) || near.has(k))) return null;
+  return [...near.entries()].map(([key, n]) => ({ key, near: n }));
+}
+
+/** Every parseable fenced json/jsonc root object under `dir`, with its source line. */
+function fencedObjects(dir: string): { file: string; line: number; value: unknown }[] {
+  const out: { file: string; line: number; value: unknown }[] = [];
+  for (const name of readdirSync(dir).filter((f) => f.endsWith('.md')).sort()) {
+    const lines = readFileSync(join(dir, name), 'utf8').split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      if (!/^```(json|jsonc)\s*$/.test(lines[i]!.trim())) continue;
+      const body: string[] = [];
+      let j = i + 1;
+      while (j < lines.length && lines[j]!.trim() !== '```') body.push(lines[j++]!);
+      try {
+        out.push({ file: name, line: i + 2, value: JSON.parse(body.join('\n')) });
+      } catch {
+        // Unparseable blocks are RFC 0150 §D's problem, not this gate's.
+      }
+      i = j;
+    }
+  }
+  return out;
+}
+
 describe.skipIf(V1_DIR === null)('RFC 0149 §B — discovery examples use the document-root layout', () => {
   const v1Dir = V1_DIR as string;
 
@@ -110,4 +222,51 @@ describe.skipIf(V1_DIR === null)('RFC 0149 §B — discovery examples use the do
         late.join('\n  '),
     ).toEqual([]);
   });
+  it('the UQ2 predicate is pinned: a typo-only snippet is flagged, an event object is out of scope, a vendor key is exempt', () => {
+    const fams = new Set(['compensation', 'interrupts', 'fs', 'agents', 'content']);
+    // A misspelt single-key discovery snippet: all keys near-canonical ⇒ in scope, flagged.
+    expect(canonicalTypos({ compensaton: { supported: true } }, fams)).toEqual([{ key: 'compensaton', near: ['compensation'] }]);
+    // Canonical + a typo ⇒ flagged.
+    expect(canonicalTypos({ compensation: {}, interupts: {} }, fams)).toEqual([{ key: 'interupts', near: ['interrupts'] }]);
+    // An event: `ts` is one from `fs` but `type`/`payload` are none of the four kinds ⇒ not discovery-shaped.
+    expect(canonicalTypos({ ts: 1, type: 'x', payload: {} }, fams)).toBeNull();
+    // Vendor-namespaced keys are exempt (RFC 0149 §B) and the legacy wrapper is the wrapper leg's business.
+    expect(canonicalTypos({ compensation: {}, 'x-host-acme-agent': {} }, fams)).toEqual([]);
+    expect(canonicalTypos({ capabilities: {} }, fams)).toBeNull();
+    // Distance exactly one, both directions.
+    expect(withinOne('agent', 'agents')).toBe(true);
+    expect(withinOne('agents', 'agent')).toBe(true);
+    expect(withinOne('agent', 'agentz')).toBe(true);
+    expect(withinOne('agent', 'agenzs')).toBe(false);
+    expect(withinOne('agents', 'agents')).toBe(false);
+  });
+
+  it('no discovery-shaped example in spec/v1 or a post-0149 RFC has a root key within one edit of a canonical family', () => {
+    const families = canonicalFamilies();
+    expect(families.size, 'capabilities.schema.json MUST declare families').toBeGreaterThan(50);
+    const findings: string[] = [];
+    let shaped = 0;
+    const scan = (dir: string, rel: string, minRfc: number | null): void => {
+      for (const { file, line, value } of fencedObjects(dir)) {
+        if (minRfc !== null) {
+          const n = Number.parseInt(file.slice(0, 4), 10);
+          if (!Number.isFinite(n) || n < minRfc) continue;
+        }
+        const typos = canonicalTypos(value, families);
+        if (typos === null) continue;
+        shaped++;
+        for (const t of typos) findings.push(`${rel}/${file}:${line} → \`${t.key}\` (did you mean ${t.near.map((x) => '`' + x + '`').join(' / ')}?)`);
+      }
+    };
+    scan(v1Dir, 'spec/v1', null);
+    if (RFCS_DIR !== null && existsSync(RFCS_DIR)) scan(RFCS_DIR, 'RFCS', TYPO_LINT_RFC);
+    expect(shaped, 'the scan MUST find discovery-shaped examples, or the leg is vacuous').toBeGreaterThan(20);
+    expect(
+      findings,
+      'RFC 0149 §B: a root key within one edit of a canonical family, in a discovery-shaped example, is a ' +
+        'typo — an implementer copying it advertises nothing. Vendor surface goes under `x-host-*` / ' +
+        '`vendor.*` / `private.*` (host-extensions.md).\n  ' +
+        findings.join('\n  '),
+    ).toEqual([]);
+  });
 });

package/src/scenarios/core-manifest-and-extension-registry.test.ts

@@ -24,7 +24,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { V1_DIR } from '../lib/paths.js';
 import { PROFILE_FLOOR_SCENARIOS } from '../lib/profiles.js';
@@ -36,7 +36,7 @@ type Maturity = (typeof MATURITIES)[number];
 interface Extension {
   readonly id: string;
   readonly maturity: Maturity;
-  readonly owningRfc: string;
+  readonly owningRfc: string | null;
   readonly capabilityPath: string;
   readonly dependsOn: readonly string[];
   readonly securityTier: string;
@@ -190,35 +190,61 @@ describe.skipIf(V1_DIR === null)('RFC 0155 §C — extension registry', () => {
     // either a core predicate field, covered by a record's capabilityPath, or
     // listed as uncovered — and nothing is in two buckets.
     const reg = registry as unknown as {
-      coverage?: { familiesTotal: number; coreFields: string[]; covered: string[]; uncovered: string[] };
+      coverage?: {
+        familiesTotal: number;
+        coreFields: string[];
+        metadataFields?: string[];
+        metadataRationale?: Record<string, string>;
+        covered: string[];
+        uncovered: string[];
+      };
       extensions: Extension[];
     };
     expect(reg.coverage, 'RFC 0155 §C: the registry MUST carry a derived `coverage` block').toBeDefined();
     const cov = reg.coverage as NonNullable<typeof reg.coverage>;
+    const metadata = cov.metadataFields ?? [];
     const families = Object.keys((caps().properties as Record<string, unknown>) ?? {}).sort();
     expect(cov.familiesTotal).toBe(families.length);
-    const all = [...cov.coreFields, ...cov.covered, ...cov.uncovered].sort();
-    expect(all, 'core + covered + uncovered MUST partition the family set exactly').toEqual(families);
+    const all = [...cov.coreFields, ...metadata, ...cov.covered, ...cov.uncovered].sort();
+    expect(all, 'core + metadata + covered + uncovered MUST partition the family set exactly').toEqual(families);
     expect(new Set(all).size, 'no family may sit in two buckets').toBe(all.length);
     const reached = new Set(reg.extensions.map((e) => e.capabilityPath.split('.')[0]));
     for (const f of cov.covered) expect(reached.has(f), `${f} listed as covered MUST be reached by a record`).toBe(true);
     for (const f of cov.uncovered) expect(reached.has(f), `${f} listed as uncovered MUST NOT be reached by a record`).toBe(false);
+    // Metadata is the one bucket a family can be moved INTO by hand, so it is
+    // the one that could hide an extension: every entry MUST carry a stated
+    // rationale, and no metadata key may carry a `supported` flag — a key that
+    // gates behaviour is a family, not a description of the document.
+    for (const f of metadata) {
+      expect(typeof cov.metadataRationale?.[f], `${f}: a metadata field MUST state why it is not an extension`).toBe('string');
+      const props = (caps().properties as Record<string, { properties?: Record<string, unknown> }>)[f]?.properties ?? {};
+      expect('supported' in props, `${f} is listed as metadata but carries a \`supported\` flag — that is an extension family`).toBe(false);
+    }
     // The honest number, asserted so it cannot silently shrink by deletion of the
     // uncovered list rather than by adding records.
-    expect(cov.uncovered.length + cov.covered.length + cov.coreFields.length).toBe(families.length);
+    expect(cov.uncovered.length + cov.covered.length + cov.coreFields.length + metadata.length).toBe(families.length);
   });
 
-  it('every record names the RFC that owns it', () => {
+  it('every record names the RFC — or, for a v1 base advertisement, the spec document — that owns it', () => {
     // Vendor extensions may not use an `openwop-*` id without an accepted RFC
-    // (§F). The owning RFC is what makes that checkable.
+    // (§F). The owning RFC is what makes that checkable. Six advertisements
+    // predate the RFC process (they shipped in the v1 base corpus: `secrets`,
+    // `webhooks`, `i18n`, `aiProviders`, `envelopeContracts`, `envelopeStrictness`);
+    // those carry `owningRfc: null` and an `owningDoc` under spec/v1/ that MUST
+    // exist — the steward's own corpus is the RFC-equivalent authority for them.
     for (const e of (registry as NonNullable<typeof registry>).extensions) {
-      expect(e.owningRfc, `${e.id} MUST name an owning RFC`).toMatch(/^\d{4}$/);
-      if (e.id.startsWith('openwop-')) {
-        expect(
-          e.owningRfc.length,
-          `${e.id}: an \`openwop-*\` id requires an accepted RFC (§F)`,
-        ).toBeGreaterThan(0);
+      const rec = e as Extension & { owningDoc?: string; securityTier?: string };
+      if (rec.owningRfc === null) {
+        expect(typeof rec.owningDoc, `${e.id}: \`owningRfc: null\` requires an \`owningDoc\``).toBe('string');
+        expect(rec.owningDoc, `${e.id}: owningDoc MUST be a spec/v1 document`).toMatch(/^spec\/v1\/[a-z0-9-]+\.md$/);
+        if (V1_DIR !== null) {
+          const file = join(V1_DIR, (rec.owningDoc as string).replace(/^spec\/v1\//, ''));
+          expect(existsSync(file), `${e.id}: owningDoc ${rec.owningDoc} MUST exist`).toBe(true);
+        }
+      } else {
+        expect(e.owningRfc, `${e.id} MUST name an owning RFC`).toMatch(/^\d{4}$/);
       }
+      expect(['high', 'medium', 'low'], `${e.id}: securityTier is a closed enum`).toContain(rec.securityTier);
     }
   });
 });