@openwop/openwop-conformance 1.135.1 → 1.135.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.135.1",
+  "version": "1.135.3",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.135.1",
-  "corpusCommit": "821921ce3b4a6cbbc20fe1aafe81a7413e10c9d9"
+  "suiteVersion": "1.135.3",
+  "corpusCommit": "ed19aa8aafa8c43e55a174abaa2010b82698f572"
 }

package/src/lib/webhook-receiver.ts

@@ -138,11 +138,14 @@ export function signPayload(
 
 /**
  * Discover a tenant the calling bearer provably OWNS, by creating a probe run
- * and reading `owner.tenantId` off its snapshot (RFC 0048). A host that scopes
+ * and reading `owner.tenant` off its snapshot (RFC 0048; `run-snapshot.schema.json`
+ * §owner — the triple is `{ tenant, workspace, principal }`, and `tenantId` was
+ * never the spec name: S29, 2026-08-17, found by the second sibling host, whose
+ * schema-correct `owner.tenant` this helper silently ignored). A host that scopes
  * webhook subscriptions by tenant membership (RFC 0093) 403s a `tenantId` the
  * bearer is not a member of — so a hard-coded tenant is wrong; the only portable
  * owned tenant is the one on a run the bearer just created. Returns `undefined`
- * for a single-tenant host (which omits `owner.tenantId`) or when no probe
+ * for a single-tenant host (which omits `owner`) or when no probe
  * fixture is available — callers then omit `tenantId`, which single-tenant hosts
  * accept. (RFC 0093 / webhooks.md §Register; suite defect fixed 2026-08-09.)
  */
@@ -155,6 +158,8 @@ export async function discoverOwnedTenant(
   const runId = (create.json as { runId?: string } | null)?.runId;
   if (typeof runId !== 'string') return undefined;
   const snap = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
-  const owner = (snap.json as { owner?: { tenantId?: unknown } } | null)?.owner;
-  return typeof owner?.tenantId === 'string' ? owner.tenantId : undefined;
+  const owner = (snap.json as { owner?: { tenant?: unknown; tenantId?: unknown } } | null)?.owner;
+  if (typeof owner?.tenant === 'string' && owner.tenant.length > 0) return owner.tenant;
+  // Pre-S29 hosts that copied the suite's misnamed field: tolerated, never asserted.
+  return typeof owner?.tenantId === 'string' && owner.tenantId.length > 0 ? owner.tenantId : undefined;
 }

package/src/scenarios/a2a-version-negotiation.test.ts

@@ -28,6 +28,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { getA2AFakePeer } from '../lib/a2a-fake-peer.js';
+import { readErrorCode } from '../lib/error-envelope.js';
 
 /**
  * Callback-shaped: the host issues A2A calls to the suite's fake peer, which records the negotiated version header.
@@ -153,9 +154,10 @@ describe('RFC 0152 §B — A2A version negotiation', () => {
     });
     if (drive.status === 404 || drive.status === 403) return;
     expect(drive.status >= 400, driver.describe('RFCS/0152 §B', 'an unsupported version MUST fail')).toBe(true);
-    const err = (drive.json as { error?: { code?: string; retriable?: boolean } }).error;
+    // S28: canonical envelope is FLAT (`error: "<code>"`, error-envelope.schema.json);
+    // the nested `error.code` is tolerated by the lib only through the deprecation window.
     expect(
-      err?.code,
+      readErrorCode(drive.json),
       driver.describe(
         'RFCS/0152 §B',
         'the upstream version error MUST be projected through the canonical OpenWOP interop error ' +

package/src/scenarios/mcp-version-negotiation.test.ts

@@ -26,6 +26,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { readErrorCode } from '../lib/error-envelope.js';
 import { seamAbsent } from '../lib/soft-skip.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
@@ -154,8 +155,10 @@ describe('RFC 0153 §A/§B — MCP revision negotiation', () => {
       drive.status >= 400,
       driver.describe('RFCS/0153 §B', 'an unsupported revision MUST fail rather than silently proceed'),
     ).toBe(true);
+    // S28: canonical envelope is FLAT (`error: "<code>"`, error-envelope.schema.json);
+    // the nested `error.code` is tolerated by the lib only through the deprecation window.
     expect(
-      (drive.json as { error?: { code?: string } }).error?.code,
+      readErrorCode(drive.json),
       driver.describe(
         'RFCS/0153 §B',
         'the upstream error MUST be projected through the canonical OpenWOP interop envelope — a ' +

package/src/scenarios/self-hosted-runner.test.ts

@@ -35,6 +35,7 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
+import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
 
 const GATE = 'openwop-self-hosted-runner';
 
@@ -51,23 +52,14 @@ function readSchema(name: string): JsonSchema {
   return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as JsonSchema;
 }
 
-/** Read the canonical error code from a response body (tolerant of shapes). */
-function errCode(json: unknown): string | undefined {
-  const j = json as { error?: unknown; code?: unknown };
-  if (typeof j?.code === 'string') return j.code;
-  if (typeof j?.error === 'string') return j.error;
-  const e = j?.error as { code?: unknown } | undefined;
-  if (e && typeof e.code === 'string') return e.code;
-  return undefined;
-}
-
-/** Read a boolean `retriable` flag from either `{retriable}` or `{error:{retriable}}`. */
-function retriable(json: unknown): boolean | undefined {
-  const j = json as { retriable?: unknown; error?: { retriable?: unknown } };
-  if (typeof j?.retriable === 'boolean') return j.retriable;
-  if (j?.error && typeof j.error.retriable === 'boolean') return j.error.retriable;
-  return undefined;
-}
+// S28 (2026-08-17): the HTTP error envelope is READ through lib/error-envelope.ts —
+// flat `{ error: "<code>", message, details.retriable }` per error-envelope.schema.json
+// (S22), with the pre-S22 nested `{ error: { code, retriable } }` tolerated only through
+// the deprecation window. The local readers this replaced accepted top-level `retriable`
+// or nested `error.retriable` and never `details.retriable`, so a schema-valid host could
+// not pass the retriable-flag leg at all (openwop-app H27 → S28).
+const errCode = readErrorCode;
+const retriable = readRetriable;
 
 interface SelfHostedRunner {
   supported?: boolean;