@openwop/openwop-conformance 1.136.3 → 1.136.5

package/dist/cli.js

@@ -12,6 +12,7 @@
  *   openwop-conformance --filter discovery               # category filter
  *   openwop-conformance --base-url ... --api-key ... --filter "interrupt|cancellation"
  *   openwop-conformance --base-url ... --api-key ... --certify out.json   # RFC 0089 bundle
+ *   openwop-conformance --base-url ... --api-key ... --max-workers 4    # cap parallel scenario files
  *
  * Environment variables override flags (per the conformance harness's
  * existing convention):
@@ -46,6 +47,7 @@ function parseArgs(argv) {
     let implVersion;
     let certify;
     let bundleVersion = '1';
+    let maxWorkers = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i] ?? '';
         if (arg === '-h' || arg === '--help') {
@@ -99,13 +101,42 @@ function parseArgs(argv) {
             case '--certify':
                 certify = nextValue();
                 break;
+            case '--max-workers':
+                maxWorkers = parseMaxWorkers(nextValue(), '--max-workers');
+                break;
             default:
                 if (arg.startsWith('-')) {
                     // Unknown flag — pass through to vitest by ignoring here.
                 }
         }
     }
-    return { baseUrl, apiKey, offline, filter, help, impl, implVersion, certify, bundleVersion };
+    return {
+        baseUrl,
+        apiKey,
+        offline,
+        filter,
+        help,
+        impl,
+        implVersion,
+        certify,
+        bundleVersion,
+        maxWorkers,
+    };
+}
+/** Parse a `--max-workers` / `OPENWOP_MAX_WORKERS` value: a positive integer, else exit 2. */
+function parseMaxWorkers(raw, source) {
+    if (raw === undefined || raw === '')
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 1) {
+        process.stderr.write(`${source} must be a positive integer (got '${raw}')\n`);
+        process.exit(2);
+    }
+    return n;
+}
+/** The vitest argv fragment for the resolved worker cap (empty when uncapped). */
+function maxWorkersArgs(maxWorkers) {
+    return maxWorkers === undefined ? [] : ['--maxWorkers', String(maxWorkers)];
 }
 const HELP_TEXT = `openwop-conformance — run the openwop conformance suite against a server
 
@@ -129,6 +160,10 @@ Certification (RFC 0089):
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.
+  --max-workers <n>     Cap concurrently running scenario files (vitest --maxWorkers).
+                        Default: one worker per CPU. Use a small number against a
+                        rate-limited production origin so 429s don't read as failures.
+                        (env: OPENWOP_MAX_WORKERS)
   --certify <out.json>  Generate a machine-readable conformance certification
                         bundle: fetch /.well-known/openwop (captured verbatim +
                         SHA-256), derive claimedProfiles from it, run the suite
@@ -271,6 +306,7 @@ async function runCertify(args, baseUrl, apiKey) {
         resolvePath(conformanceRoot, 'vitest.config.ts'),
         '--reporter=json',
         `--outputFile=${reportFile}`,
+        ...maxWorkersArgs(args.maxWorkers),
     ];
     const runResult = spawnSync('npx', vitestArgs, { cwd: conformanceRoot, env, stdio: 'inherit' });
     if (runResult.error) {
@@ -528,6 +564,7 @@ async function main() {
     if (args.filter) {
         vitestArgs.push('--testNamePattern', args.filter);
     }
+    vitestArgs.push(...maxWorkersArgs(args.maxWorkers));
     const result = spawnSync('npx', ['vitest', ...vitestArgs], {
         cwd: conformanceRoot,
         env,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.136.3",
+  "version": "1.136.5",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.136.3",
-  "corpusCommit": "54f29548af7c1b388553b982a6819ecd7d7ae4d9"
+  "suiteVersion": "1.136.5",
+  "corpusCommit": "d1107230a2b68b61a854b340a054f3770b40f783"
 }

package/src/cli.ts

@@ -12,6 +12,7 @@
  *   openwop-conformance --filter discovery               # category filter
  *   openwop-conformance --base-url ... --api-key ... --filter "interrupt|cancellation"
  *   openwop-conformance --base-url ... --api-key ... --certify out.json   # RFC 0089 bundle
+ *   openwop-conformance --base-url ... --api-key ... --max-workers 4    # cap parallel scenario files
  *
  * Environment variables override flags (per the conformance harness's
  * existing convention):
@@ -55,6 +56,13 @@ interface ParsedArgs {
   /** RFC 0089 — emit a conformance certification bundle to this path. */
   readonly certify: string | undefined;
   readonly bundleVersion: '1' | '2';
+  /**
+   * S43 (2026-08-18) — cap on concurrently running scenario FILES, forwarded to
+   * vitest `--maxWorkers`. Unset = vitest's default (one worker per CPU), which
+   * hammers a rate-limited production origin with ~460 files at once and turns
+   * `429`s into spurious reds. Env: `OPENWOP_MAX_WORKERS`.
+   */
+  readonly maxWorkers: number | undefined;
 }
 
 function parseArgs(argv: readonly string[]): ParsedArgs {
@@ -67,6 +75,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
   let implVersion: string | undefined;
   let certify: string | undefined;
   let bundleVersion: '1' | '2' = '1';
+  let maxWorkers: number | undefined = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
 
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i] ?? '';
@@ -121,6 +130,9 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
       case '--certify':
         certify = nextValue();
         break;
+      case '--max-workers':
+        maxWorkers = parseMaxWorkers(nextValue(), '--max-workers');
+        break;
       default:
         if (arg.startsWith('-')) {
           // Unknown flag — pass through to vitest by ignoring here.
@@ -128,7 +140,34 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
     }
   }
 
-  return { baseUrl, apiKey, offline, filter, help, impl, implVersion, certify, bundleVersion };
+  return {
+    baseUrl,
+    apiKey,
+    offline,
+    filter,
+    help,
+    impl,
+    implVersion,
+    certify,
+    bundleVersion,
+    maxWorkers,
+  };
+}
+
+/** Parse a `--max-workers` / `OPENWOP_MAX_WORKERS` value: a positive integer, else exit 2. */
+function parseMaxWorkers(raw: string | undefined, source: string): number | undefined {
+  if (raw === undefined || raw === '') return undefined;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1) {
+    process.stderr.write(`${source} must be a positive integer (got '${raw}')\n`);
+    process.exit(2);
+  }
+  return n;
+}
+
+/** The vitest argv fragment for the resolved worker cap (empty when uncapped). */
+function maxWorkersArgs(maxWorkers: number | undefined): string[] {
+  return maxWorkers === undefined ? [] : ['--maxWorkers', String(maxWorkers)];
 }
 
 const HELP_TEXT = `openwop-conformance — run the openwop conformance suite against a server
@@ -153,6 +192,10 @@ Certification (RFC 0089):
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.
+  --max-workers <n>     Cap concurrently running scenario files (vitest --maxWorkers).
+                        Default: one worker per CPU. Use a small number against a
+                        rate-limited production origin so 429s don't read as failures.
+                        (env: OPENWOP_MAX_WORKERS)
   --certify <out.json>  Generate a machine-readable conformance certification
                         bundle: fetch /.well-known/openwop (captured verbatim +
                         SHA-256), derive claimedProfiles from it, run the suite
@@ -306,6 +349,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     resolvePath(conformanceRoot, 'vitest.config.ts'),
     '--reporter=json',
     `--outputFile=${reportFile}`,
+    ...maxWorkersArgs(args.maxWorkers),
   ];
   const runResult = spawnSync('npx', vitestArgs, { cwd: conformanceRoot, env, stdio: 'inherit' });
   if (runResult.error) {
@@ -605,6 +649,7 @@ async function main(): Promise<never> {
   if (args.filter) {
     vitestArgs.push('--testNamePattern', args.filter);
   }
+  vitestArgs.push(...maxWorkersArgs(args.maxWorkers));
 
   const result = spawnSync('npx', ['vitest', ...vitestArgs], {
     cwd: conformanceRoot,

package/src/scenarios/pack-registry-publish.test.ts

@@ -21,6 +21,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { gzipSync } from 'node:zlib';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { recordRequirement } from '../lib/requirement-ledger.js';
@@ -81,6 +82,14 @@ function freshPackName(scope: string = 'core'): string {
  *  impl PR will likely extend the driver with an octet-stream variant.
  *  The shape-only error-catalog tests below only need the host's first
  *  validation step (URL pattern, body-presence, etc.) to fire. */
+/**
+ * S45 — a VALID gzip stream whose decompressed size (64 MiB of zeros) exceeds
+ * the recommended registry cap (50 MB) while the wire body stays ~64 KB, so no
+ * proxy body limit is reached and the host's own decompressed-bytes cap is the
+ * only thing that can refuse it. Built once per file.
+ */
+const OVERSIZED_GZIP: Buffer = gzipSync(Buffer.alloc(64 * 1024 * 1024, 0));
+
 async function putTest(name: string, version: string, body: unknown, extraHeaders: Record<string, string> = {}) {
   const res = await driver.put(`/v1/packs-test/${encodeURIComponent(name)}/-/${encodeURIComponent(version)}.tgz`, body, {
     headers: { 'Content-Type': 'application/octet-stream', ...extraHeaders },
@@ -196,14 +205,29 @@ describe('pack-registry-publish: tarball extraction error catalog (RFC 0025)', (
 
   it('PUT with decompressed bytes exceeding the registry\'s cap MUST return 400 tarball_too_large', async () => {
     if (!(await isTestModeAdvertised())) return;
-    // A real test would build a huge gzip; for shape-only assertion we
-    // send a body large enough that any reasonable cap fires.
-    const big = Buffer.alloc(60 * 1024 * 1024, 0x1f); // 60MB
-    big[0] = 0x1f; big[1] = 0x8b; // gzip magic so it gets past body-shape check
-    const res = await putTest(freshPackName(), '1.0.0', big);
+    // S45 (2026-08-18): the cap is on DECOMPRESSED bytes (node-packs.md
+    // §"Tarball extraction", recommended default 50 MB), so the probe is a
+    // small VALID gzip stream that inflates past it — 64 MiB of zeros gzips
+    // to ~64 KB on the wire. The previous probe was a 60 MB body of fake
+    // gzip magic: a load balancer in front of the host (Cloud Run's front
+    // end caps HTTP/1 bodies at 32 MiB) answered its own HTML 413 before the
+    // host saw the request, the leg blew the 30 s budget on a normal uplink,
+    // and — because `tarball_gunzip_failed` was also accepted — a host with
+    // NO cap at all passed it. Measured by MyndHyve on `api.myndhyve.ai`.
+    // Only `tarball_too_large` is accepted now: a real gzip that inflates to
+    // 64 MiB either trips the cap or reaches the tar layer, and reaching the
+    // tar layer means the cap is absent or above 64 MiB (> the recommended
+    // default) — say so in the run record if that is a deliberate host choice.
+    const res = await putTest(freshPackName(), '1.0.0', OVERSIZED_GZIP);
     if (res.status === 404) return;
-    expect(res.status).toBe(400);
-    expect(['tarball_too_large', 'tarball_gunzip_failed'].includes(errorCode(res.json) ?? '')).toBe(true);
+    expect(
+      res.status,
+      driver.describe('node-packs.md §"Tarball extraction"', 'a valid gzip inflating past the decompressed cap MUST be refused with 400 (a 413 here means a proxy refused the wire body — this probe is ~64 KB on the wire, so that is a host/proxy misconfiguration, not the cap)'),
+    ).toBe(400);
+    expect(
+      errorCode(res.json),
+      driver.describe('node-packs.md §"Tarball extraction"', 'decompressed bytes exceeding the registry cap MUST surface tarball_too_large (recommended default cap 50 MB; this probe inflates to 64 MiB)'),
+    ).toBe('tarball_too_large');
   });
 
   it('PUT with no `pack.json` at the tarball root MUST return 400 tarball_manifest_missing', async () => {

package/src/scenarios/redaction.test.ts

@@ -152,7 +152,7 @@ describe('redaction: 401 response MUST NOT echo invalid Bearer token (NFR-7)', (
       // are observable surfaces and MUST be canary-clean.
       const res = await driver.post(
         '/v1/runs',
-        { workflowId: NOOP_WORKFLOW_ID, tenantId: 'conformance-tenant' },
+        { workflowId: NOOP_WORKFLOW_ID },
         {
           authenticated: false,
           headers: { Authorization: `Bearer ${canaryValue}` },
@@ -170,7 +170,7 @@ describe('redaction: 401 response MUST NOT echo invalid Bearer token (NFR-7)', (
   it('the marker substring alone never appears in a 401 body (universal)', async () => {
     const res = await driver.post(
       '/v1/runs',
-      { workflowId: NOOP_WORKFLOW_ID, tenantId: 'conformance-tenant' },
+      { workflowId: NOOP_WORKFLOW_ID },
       {
         authenticated: false,
         headers: { Authorization: `Bearer ${CANARY_MARKER}-direct-marker` },
@@ -204,9 +204,11 @@ describe.skipIf(SKIP_NO_NOOP)('redaction: credentialRef value MUST NOT appear in
     // §configurable echo) — but per capabilities.md §"aiProviders"
     // it MUST NOT appear in any RunEvent payload.
     const c = getCanary('byok-credential-ref');
+    // S46 (2026-08-18): no fabricated `tenantId` — the run belongs to the
+    // credential's own tenant (S41 rule). A tenant-enforcing host answered
+    // 403 to the made-up id and this leg then `return`ed, vacuously.
     const create = await driver.post('/v1/runs', {
       workflowId: NOOP_WORKFLOW_ID,
-      tenantId: 'conformance-tenant',
       configurable: { ai: { credentialRef: c.value } },
     });
     if (create.status !== 201) {

package/src/scenarios/self-hosted-runner.test.ts

@@ -30,6 +30,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { readFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { join } from 'node:path';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
@@ -39,6 +40,17 @@ import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
 
 const GATE = 'openwop-self-hosted-runner';
 
+// S40 (2026-08-18): every registration / dispatch id carries a per-run nonce. The
+// seam drives the host's REAL runner registry + `{runId, stepId}` result store
+// (host-sample-test-seams.md §19), so fixed ids (`runner_a_1`, `run_idem`/`step_1`)
+// collide with the previous certification run on any host whose store outlives
+// the process: the second run's FIRST dispatch is already `deduped:true` and the
+// at-most-once leg no longer proves anything, and re-registering a fixed runnerId
+// may be refused. Fresh ids per run keep both legs non-vacuous on a durable host.
+const NONCE = randomUUID().slice(0, 8);
+const SUBJECT_A = `subject_A_${NONCE}`;
+const SUBJECT_B = `subject_B_${NONCE}`;
+
 interface JsonSchema {
   properties?: Record<string, JsonSchema>;
   required?: string[];
@@ -155,15 +167,15 @@ describe('self-hosted-runner: behavioral (seam-gated, soft-skip 404)', () => {
     // MUST NOT fall back to B's runner (subject-first isolation); with no runner
     // for A the dispatch MUST fail with the retriable `runner_unavailable`.
     const reg = await driver.post(REGISTER, {
-      runnerId: 'runner_b_1',
-      subject: 'subject_B',
+      runnerId: `runner_b_${NONCE}`,
+      subject: SUBJECT_B,
       capabilities: { providers: ['anthropic'] },
     });
     if (reg.status === 404) return; // seam unwired — soft-skip
 
     const res = await driver.post(DISPATCH, {
-      subject: 'subject_A',
-      runId: 'run_iso',
+      subject: SUBJECT_A,
+      runId: `run_iso_${NONCE}`,
       stepId: 'step_0',
       seq: 0,
       kind: 'model',
@@ -189,15 +201,15 @@ describe('self-hosted-runner: behavioral (seam-gated, soft-skip 404)', () => {
 
   it('a redelivered {runId, stepId} dispatch is dropped, not re-executed (at-most-once)', async () => {
     const reg = await driver.post(REGISTER, {
-      runnerId: 'runner_a_1',
-      subject: 'subject_A',
+      runnerId: `runner_a_${NONCE}`,
+      subject: SUBJECT_A,
       capabilities: { providers: ['anthropic'] },
     });
     if (reg.status === 404) return;
 
     const frame = {
-      subject: 'subject_A',
-      runId: 'run_idem',
+      subject: SUBJECT_A,
+      runId: `run_idem_${NONCE}`,
       stepId: 'step_1',
       seq: 0,
       kind: 'model',