@openwop/openwop-conformance 1.129.0 → 1.131.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.129.0",
+  "version": "1.131.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.129.0",
-  "corpusCommit": "edd6a891da09af801b04e750c0219ee7cb401137"
+  "suiteVersion": "1.131.0",
+  "corpusCommit": "b2a25cf7013d21838b8b5abeaea7dff12355bfc5"
 }

package/schemas/workflow-chain-pack-manifest.schema.json

@@ -490,9 +490,20 @@
               "description": "RFC 0151 §C — an inverse action can itself be harmful (RFC 0147 R9), so it may be gated behind the same approval surface as a forward effect."
             }
           }
+        },
+        "irreversibleEffect": {
+          "type": "boolean",
+          "description": "RFC 0151 §B UQ4 (resolved 2026-08-16), mirrored into chain fragments per RFC 0157 — the fragment author states that this node's committed effect HAS NO INVERSE. Mutually exclusive with `compensation` (host MUST reject both at pack install / chain expansion); expansion copies it onto the expanded `WorkflowNode` unchanged. See `workflow-definition.schema.json` `WorkflowNode.irreversibleEffect`."
         }
       },
-      "additionalProperties": false
+      "additionalProperties": false,
+      "if": {
+        "properties": { "irreversibleEffect": { "const": true } },
+        "required": ["irreversibleEffect"]
+      },
+      "then": {
+        "not": { "required": ["compensation"] }
+      }
     },
     "FragmentEdge": {
       "type": "object",

package/schemas/workflow-definition.schema.json

@@ -293,9 +293,20 @@
               "description": "RFC 0151 \u00a7C \u2014 an inverse action can itself be harmful (RFC 0147 R9), so it may be gated behind the same approval surface as a forward effect."
             }
           }
+        },
+        "irreversibleEffect": {
+          "type": "boolean",
+          "description": "RFC 0151 \u00a7B (UQ4, resolved 2026-08-16) \u2014 the author states that this node's committed effect HAS NO INVERSE. OPTIONAL; absent or false means nothing (an undeclared compensator is still not implied). Mutually exclusive with `compensation`: a node declaring both is contradictory and a host MUST reject it at registration (`validation_error`). When true and the node's effect committed before an unwind starts, the plan records the node as `irreversible` (never completed) so the \u00a7D rollup caps at `partial` \u2014 a reader can no longer infer a full undo from a `completed` that quietly skipped it."
         }
       },
-      "additionalProperties": false
+      "additionalProperties": false,
+      "if": {
+        "properties": { "irreversibleEffect": { "const": true } },
+        "required": ["irreversibleEffect"]
+      },
+      "then": {
+        "not": { "required": ["compensation"] }
+      }
     },
     "WorkflowEdge": {
       "type": "object",

package/src/lib/workflow-chain-expansion.ts

@@ -353,10 +353,31 @@ export interface ChainCompensationPolicy {
 /** A chain as RFC 0157 sees it: the RFC 0013 shape plus the two optional
  *  compensation surfaces. */
 export type WorkflowChainWithCompensation = Omit<WorkflowChain, 'dag'> & {
-  dag: { nodes: ReadonlyArray<FragmentNode & { compensation?: FragmentNodeCompensation }>; edges?: ReadonlyArray<FragmentEdge> };
+  dag: {
+    nodes: ReadonlyArray<FragmentNode & { compensation?: FragmentNodeCompensation; irreversibleEffect?: boolean }>;
+    edges?: ReadonlyArray<FragmentEdge>;
+  };
   compensation?: ChainCompensationPolicy;
 };
 
+/** Thrown when a fragment node declares BOTH `irreversibleEffect: true` and a
+ *  `compensation` (RFC 0151 UQ4 / `compensation.md` §B): a contradiction the
+ *  schema also rejects; expansion refuses it fail-closed rather than pick one.
+ *  Wire code `chain_irreversible_with_compensation`. */
+export class ChainIrreversibleWithCompensationError extends Error {
+  readonly code = 'chain_irreversible_with_compensation' as const;
+  constructor(
+    public readonly nodeId: string,
+    public readonly chainId: string,
+  ) {
+    super(
+      `chain_irreversible_with_compensation: fragment node "${nodeId}" in chain "${chainId}" declares both ` +
+        'irreversibleEffect: true and a compensation — an effect cannot both have and lack an inverse',
+    );
+    this.name = 'ChainIrreversibleWithCompensationError';
+  }
+}
+
 /** Thrown when the parent already carries a `settings.compensation` policy that
  *  is not deep-equal to the chain's. Wire code
  *  `chain_compensation_policy_conflict` (`workflow-chain-packs.md` §"Error
@@ -412,8 +433,9 @@ function canonicalJson(v: unknown): string {
 
 export interface CarriedCompensation {
   /** The expanded fragment with `compensation` carried onto each node that
-   *  declared one (typeIds validated, params substituted, id refs rewritten). */
-  nodes: ReadonlyArray<ExpandedFragment['nodes'][number] & { compensation?: FragmentNodeCompensation }>;
+   *  declared one (typeIds validated, params substituted, id refs rewritten)
+   *  and `irreversibleEffect` copied verbatim where declared. */
+  nodes: ReadonlyArray<ExpandedFragment['nodes'][number] & { compensation?: FragmentNodeCompensation; irreversibleEffect?: boolean }>;
   /** The `settings.compensation` the registered definition MUST carry after
    *  this expansion: the parent's when the chain declares none; the chain's
    *  when the parent had none; the (equal) shared policy when both agree.
@@ -433,11 +455,15 @@ export interface CarriedCompensation {
  *       literals; the recorded-facts rule is unaffected);
  *   6b. fragment node-id references inside `inputMapping` are rewritten with
  *       the expansion prefix, exactly as edge refs are;
+ *   6c. `irreversibleEffect: true` (RFC 0151 UQ4) is copied onto the expanded
+ *       node unchanged; a fragment node declaring both it and a `compensation`
+ *       is refused (`chain_irreversible_with_compensation`) — the schema rejects
+ *       the shape too, and expansion does not pick a side;
  *   9b. the chain-level policy becomes the definition's `settings.compensation`
  *       — copied when the parent has none, accepted when equal, otherwise
  *       `chain_compensation_policy_conflict`.
  *
- * @throws ChainUnresolvableTypeIdError, ChainCompensationPolicyConflictError
+ * @throws ChainUnresolvableTypeIdError, ChainCompensationPolicyConflictError, ChainIrreversibleWithCompensationError
  */
 export function carryCompensation(
   chain: WorkflowChainWithCompensation,
@@ -450,17 +476,21 @@ export function carryCompensation(
   const fragmentNodeIds = new Set(srcNodes.map((n) => n.id));
   const byOriginalId = new Map(srcNodes.map((n) => [n.id, n] as const));
 
-  // 3b
+  // 3b (+ 6c's contradiction check, before any node is emitted)
   for (const n of srcNodes) {
+    if (n.irreversibleEffect === true && n.compensation !== undefined) {
+      throw new ChainIrreversibleWithCompensationError(n.id, chain.chainId);
+    }
     if (n.compensation !== undefined && !ctx.isTypeIdResolvable(n.compensation.nodeTypeId)) {
       throw new ChainUnresolvableTypeIdError(n.compensation.nodeTypeId, chain.chainId);
     }
   }
 
-  // 5b + 6b
+  // 5b + 6b + 6c
   const nodes = expanded.nodes.map((en) => {
     const originalId = en.id.startsWith(prefix) ? en.id.slice(prefix.length) : en.id;
     const src = byOriginalId.get(originalId);
+    if (src?.irreversibleEffect === true) return { ...en, irreversibleEffect: true };
     if (src?.compensation === undefined) return en;
     const c: FragmentNodeCompensation = { nodeTypeId: src.compensation.nodeTypeId };
     if (src.compensation.inputMapping !== undefined) {

package/src/scenarios/chain-compensation-expansion.test.ts

@@ -49,6 +49,7 @@ import {
   expandChainWithCompensation,
   ChainUnresolvableTypeIdError,
   ChainCompensationPolicyConflictError,
+  ChainIrreversibleWithCompensationError,
   type WorkflowChainWithCompensation,
   type ChainCompensationPolicy,
   type FragmentNodeCompensation,
@@ -162,6 +163,33 @@ describe('RFC 0157 — schema: the chain manifest mirrors the compensation shape
     noTriggers.compensation = {};
     expect(validate(manifestWith(noTriggers)), 'a policy without triggers is not a policy').toBe(false);
   });
+
+  it('FragmentNode.irreversibleEffect (RFC 0151 UQ4) is a sibling boolean, mutually exclusive with compensation — in the manifest and in expansion', () => {
+    const validate = manifestValidator();
+    // The `notify` node declares no compensation; stating its effect is irreversible is valid.
+    const irreversible = structuredClone(CHAIN) as unknown as { dag: { nodes: Array<Record<string, unknown>> } };
+    const notifyIdx = irreversible.dag.nodes.findIndex((n) => n['id'] === 'notify');
+    expect(notifyIdx).toBeGreaterThanOrEqual(0);
+    irreversible.dag.nodes[notifyIdx]!['irreversibleEffect'] = true;
+    expect(validate(manifestWith(irreversible)), JSON.stringify(validate.errors)).toBe(true);
+    // Expansion copies it verbatim onto the expanded node (6c) and touches nothing else.
+    const out = expandChainWithCompensation(irreversible as unknown as typeof CHAIN, CTX);
+    const notify = out.nodes.find((n) => n.id.endsWith('_notify')) as { irreversibleEffect?: boolean; compensation?: unknown } | undefined;
+    expect(notify?.irreversibleEffect).toBe(true);
+    expect(notify?.compensation).toBeUndefined();
+    // Both on one node: the schema rejects it AND expansion refuses fail-closed before emitting.
+    const both = structuredClone(CHAIN) as unknown as { dag: { nodes: Array<Record<string, unknown>> } };
+    both.dag.nodes[0]!['irreversibleEffect'] = true; // node 0 (`reserve`) declares a compensation
+    expect(validate(manifestWith(both)), 'compensation.md §B: irreversibleEffect: true + compensation is contradictory').toBe(false);
+    let thrown: unknown;
+    try {
+      expandChainWithCompensation(both as unknown as typeof CHAIN, CTX);
+    } catch (e) {
+      thrown = e;
+    }
+    expect(thrown).toBeInstanceOf(ChainIrreversibleWithCompensationError);
+    expect((thrown as ChainIrreversibleWithCompensationError).code).toBe('chain_irreversible_with_compensation');
+  });
 });
 
 describe('RFC 0157 — expansion carries the declaration and the policy', () => {

package/src/scenarios/compensation-profile.test.ts

@@ -130,6 +130,20 @@ describe('RFC 0151 §B — node compensation declaration', () => {
     expect(validate({ ...base }), JSON.stringify(validate.errors)).toBe(true);
   });
 
+  it('irreversibleEffect (RFC 0151 UQ4) is a sibling boolean, mutually exclusive with a compensation declaration', () => {
+    // A statement that the effect HAS NO INVERSE. Sibling of `compensation`, so
+    // `nodeTypeId` stays required and COMPATIBILITY §2.2 is not engaged.
+    expect(validate({ ...base, irreversibleEffect: true }), JSON.stringify(validate.errors)).toBe(true);
+    expect(validate({ ...base, irreversibleEffect: false, compensation: { nodeTypeId: 'vendor.shop.release' } }), JSON.stringify(validate.errors)).toBe(true);
+    // Both = an effect that both has and lacks an inverse. The schema rejects it
+    // (`if irreversibleEffect === true then not required compensation`).
+    expect(
+      validate({ ...base, irreversibleEffect: true, compensation: { nodeTypeId: 'vendor.shop.release' } }),
+      'compensation.md §B: a node declaring both irreversibleEffect: true and compensation is contradictory and MUST be rejected',
+    ).toBe(false);
+    expect(validate({ ...base, irreversibleEffect: 'yes' }), 'irreversibleEffect is a boolean').toBe(false);
+  });
+
   it('the declaration is closed — an unknown key is rejected', () => {
     expect(
       validate({ ...base, compensation: { nodeTypeId: 'x', onFailure: 'ignore' } }),

package/src/scenarios/compensation-recovery.test.ts

@@ -34,6 +34,14 @@
  * extension is `blocked` here (named as such via `seamAbsent`) and keeps its
  * `compensation-behavior` witness — the base and the extension are different
  * claims and are recorded separately.
+ *
+ * Mode matters, and the first host to advertise pointed it out: `seamAbsent`
+ * records `blocked` in DEFAULT mode but THROWS under
+ * `OPENWOP_REQUIRE_BEHAVIOR=true` (RFC 0148 §B — an advertised capability
+ * whose witness seam is missing is a failure in strict certification, not a
+ * disposition). So a host that flips `compensation.supported` on without the
+ * §21 recovery extension is honest-red here in strict runs. Wire the extension
+ * with the advert, or run default mode and read the `blocked` rows.
  */
 
 import { describe, it, expect } from 'vitest';

package/src/scenarios/org-position-no-authority-escalation.test.ts

@@ -55,6 +55,15 @@ describe('org-position-no-authority-escalation (RFC 0087 §B, behavioral)', () =
     const chart = await getOrgChart();
     if (chart === null) return seamAbsent('host advertises org-position authority but GET /v1/agents/org-chart is not served');
 
+    // An EMPTY chart has nothing that could carry authority: the invariant is
+    // unobservable, and RFC 0148 §A says unobservable is `blocked`, not a
+    // zero-assertion pass (which is what this leg recorded on such a host).
+    if ((chart.members ?? []).length === 0 && (chart.departments ?? []).length === 0) {
+      return seamAbsent('host advertises org-position authority but the org chart is EMPTY — no member or department to check; the invariant is unobservable until the host seeds one');
+    }
+    // The chart root is a wire object too.
+    expectNoAuthority(chart as unknown as Record<string, unknown>, 'the org-chart root');
+
     for (const m of chart.members ?? []) {
       expectNoAuthority(m as Record<string, unknown>, 'an org-chart member');
     }

package/src/scenarios/workspace-behavior.test.ts

@@ -22,6 +22,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 interface DiscoveryWorkspace {
@@ -49,7 +50,7 @@ interface WorkspaceFile {
 
 describe('workspace-behavior: §C CRUD round-trip (RFC 0059)', () => {
   it('PUT creates v1, GET returns it, list omits content, DELETE removes it', async () => {
-    if (!(await workspaceCap())) return;
+    if (!(await workspaceCap())) return softSkip('inapplicable', 'optional advertisement — `capabilities.workspace` not advertised by this host (RFC 0059 §A)');
     const path = 'behavior/CRUD.md';
 
     const created = await driver.put(`${FILES}/${encodeURIComponent(path)}`, { content: 'first body' });
@@ -78,7 +79,7 @@ describe('workspace-behavior: §C CRUD round-trip (RFC 0059)', () => {
 
 describe('workspace-behavior: §C optimistic concurrency (RFC 0059)', () => {
   it('stale If-Match → 409 workspace_conflict; matching If-Match bumps version', async () => {
-    if (!(await workspaceCap())) return;
+    if (!(await workspaceCap())) return softSkip('inapplicable', 'optional advertisement — `capabilities.workspace` not advertised by this host (RFC 0059 §A)');
     const path = 'behavior/ETAG.md';
 
     const v1 = await driver.put(`${FILES}/${encodeURIComponent(path)}`, { content: 'v1' });
@@ -101,7 +102,7 @@ describe('workspace-behavior: §C optimistic concurrency (RFC 0059)', () => {
 describe('workspace-behavior: §C size ceiling (RFC 0059)', () => {
   it('content beyond maxFileBytes returns workspace_too_large', async () => {
     const cap = await workspaceCap();
-    if (cap === null) return;
+    if (cap === null) return softSkip('inapplicable', 'optional advertisement — `capabilities.workspace` not advertised by this host (RFC 0059 §A)');
     const max = typeof cap.maxFileBytes === 'number' ? cap.maxFileBytes : 1_048_576;
     const tooBig = 'x'.repeat(max + 1);
     const res = await driver.put(`${FILES}/${encodeURIComponent('behavior/TOOBIG.md')}`, { content: tooBig });
@@ -112,14 +113,14 @@ describe('workspace-behavior: §C size ceiling (RFC 0059)', () => {
 
 describe('workspace-behavior: §D run-start snapshot (RFC 0059)', () => {
   it('a run started after a write exposes the workspace snapshot', async () => {
-    if (!(await workspaceCap())) return;
+    if (!(await workspaceCap())) return softSkip('inapplicable', 'optional advertisement — `capabilities.workspace` not advertised by this host (RFC 0059 §A)');
     const path = 'behavior/SNAPSHOT.md';
     await driver.put(`${FILES}/${encodeURIComponent(path)}`, { content: 'snapshot body' });
 
     const create = await driver.post('/v1/runs', { workflowId: 'conformance-noop' });
-    if (create.status !== 201 && create.status !== 200) return; // host lacks the noop fixture — skip
+    if (create.status !== 201 && create.status !== 200) return seamAbsent(`host advertises workspace but the noop fixture run could not be created (POST /v1/runs → ${create.status})`);
     const runId = (create.json as { runId?: string }).runId;
-    if (runId === undefined) return;
+    if (runId === undefined) return seamAbsent('host advertises workspace but the created run carried no runId');
 
     const snap = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
     const ws = (snap.json as { workspace?: Array<{ path: string }> }).workspace;

package/src/scenarios/workspace-capability-shape.test.ts

@@ -23,6 +23,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { softSkip } from '../lib/soft-skip.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 interface DiscoveryWorkspace {
@@ -48,7 +49,7 @@ const POSITIVE_INT_FIELDS = ['maxFileBytes', 'maxFiles', 'maxVersions'] as const
 describe('workspace-capability-shape: advertisement shape (RFC 0059 §A)', () => {
   it('capabilities.workspace is either absent or well-formed', async () => {
     const ws = await readWorkspace();
-    if (ws === null) return; // host doesn't advertise workspace at all
+    if (ws === null) return softSkip('inapplicable', 'optional advertisement — `capabilities.workspace` not advertised by this host (RFC 0059 §A)');
     expect(
       typeof ws.supported,
       driver.describe(
@@ -60,7 +61,7 @@ describe('workspace-capability-shape: advertisement shape (RFC 0059 §A)', () =>
 
   it('maxFileBytes / maxFiles / maxVersions are positive integers when present', async () => {
     const ws = await readWorkspace();
-    if (ws === null) return;
+    if (ws === null) return softSkip('inapplicable', 'optional advertisement — `capabilities.workspace` not advertised by this host (RFC 0059 §A)');
     for (const field of POSITIVE_INT_FIELDS) {
       const v = ws[field];
       if (v === undefined) continue;