@openwop/openwop-conformance 1.136.5 → 1.136.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.136.5",
+  "version": "1.136.7",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.136.5",
-  "corpusCommit": "d1107230a2b68b61a854b340a054f3770b40f783"
+  "suiteVersion": "1.136.7",
+  "corpusCommit": "b71c4c7c3a3d368c98ef97fd4bed097d16a3fbdd"
 }

package/src/lib/workflow-chain-expansion.ts

@@ -306,6 +306,26 @@ export function expandChain(chain: WorkflowChain, ctx: ExpansionContext): Expand
 // If it is gated on an advertised capability, it goes below.
 // ─────────────────────────────────────────────────────────────────────────────
 
+// ─── Begin the MIRRORED COMPENSATION pass ───────────────────────────────────
+//
+// SP-01 (2026-08-18): this pass is a SECOND byte-mirrored region, gated by
+// `scripts/check-workflow-chain-expansion-sync.mjs` alongside the core above.
+//
+// It sits below "End of the MIRRORED CORE" because it composes on the core's
+// OUTPUT rather than editing it — but unlike the capability-gated surfaces that
+// follow (RFC 0124 deferred parameters, RFC 0133 sub-chains, which a host that
+// does not advertise them MUST REFUSE rather than implement), carrying a
+// chain's compensation declaration is UNCONDITIONAL: `compensation.md`
+// §"Workflow policy" makes the declaration descriptive, so a host that does not
+// advertise `capabilities.compensation` still MUST carry it verbatim and refuse
+// only a chain-level POLICY (`capability_required`). Unconditional ⇒ genuinely
+// mirrorable ⇒ gated. RFC 0157's own commit claimed this pass was already
+// "CI-gated against the reference host"; it was not — the gate stopped at the
+// core sentinel — so the mirror never received it. Anything added between the
+// two sentinels below MUST be mirrored in the reference host — that is the
+// whole RFC 0157 unit: the types, the two error classes, the helpers, and
+// `carryCompensation` / `expandChainWithCompensation`.
+
 // ---------------------------------------------------------------------------
 // RFC 0157 (RFC 0013 revision × RFC 0151 §B) — chain fragments carry
 // compensation.
@@ -525,6 +545,8 @@ export function expandChainWithCompensation(
   return { ...expanded, nodes: carried.nodes, settingsCompensation: carried.settingsCompensation };
 }
 
+// ─── End of the MIRRORED COMPENSATION pass ──────────────────────────────────
+
 // ---------------------------------------------------------------------------
 // RFC 0124 (WCP4) — Portable per-run parameter deferral.
 //

package/src/scenarios/idempotency.test.ts

@@ -17,6 +17,7 @@
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { readErrorCode } from '../lib/error-envelope.js';
 
 const WORKFLOW_ID = 'conformance-idempotent';
 const SKIP_NO_FIXTURE = !isFixtureAdvertised(WORKFLOW_ID);
@@ -85,5 +86,44 @@ describe.skipIf(SKIP_NO_FIXTURE)('idempotency: same key + different body conflic
       'idempotency.md §Layer 1',
       'same Idempotency-Key with a different body MUST return 409',
     )).toBe(409);
+
+    // SP-03 (2026-08-18): the code, not just the status. `idempotency.md`
+    // named NO mismatch error until v1.5, and implementations diverged exactly
+    // as an unnamed error invites: `grpc-transport.md` mapped BOTH
+    // `idempotency_key_conflict` and `idempotency_key_mismatch` in one row, the
+    // published TypeScript SDK's `HTTP_ERROR_CODES` carried
+    // `idempotency_key_mismatch`, the SQLite reference host emitted
+    // `idempotency_key_conflict`, and a tier-1 host emitted
+    // `idempotency_key_replay_mismatch` — a spelling in no corpus artifact at
+    // all. This leg asserted the status alone, so every one of them passed.
+    //
+    // `idempotency_key_mismatch` is canonical (idempotency.md §"Record shape,
+    // digest, and lease"): the only spelling already in more than one shipped
+    // artifact. The two legacy spellings are TOLERATED here through the first
+    // minor after 2026-11-10 so a converging host is not red on a rename it is
+    // mid-flight on — the same deprecation shape S22 used for the error
+    // envelope. Remove the tolerance then; the canonical assertion stays.
+    const code = readErrorCode(conflict.json);
+    const LEGACY = ['idempotency_key_conflict', 'idempotency_key_replay_mismatch'];
+    expect(
+      code === 'idempotency_key_mismatch' || LEGACY.includes(code ?? ''),
+      driver.describe(
+        'idempotency.md §"Record shape, digest, and lease"',
+        `a different request digest under the same scoped key MUST fail with the canonical ` +
+          `\`idempotency_key_mismatch\` (legacy \`${LEGACY.join('` / `')}\` tolerated through the ` +
+          `first minor after 2026-11-10); got \`${code ?? '<none>'}\``,
+      ),
+    ).toBe(true);
+
+    // …and MUST NOT hand back the first run's body. Answering a question the
+    // caller did not ask is the read half of the same confusion.
+    const conflictRunId = (conflict.json as { runId?: unknown } | undefined)?.runId;
+    expect(
+      conflictRunId,
+      driver.describe(
+        'idempotency.md §"Record shape, digest, and lease"',
+        'a digest mismatch MUST NOT return the cached body (no runId on the 409)',
+      ),
+    ).toBeUndefined();
   });
 });

package/src/scenarios/memory-attribution-replay-stable.test.ts

@@ -3,8 +3,26 @@
  * immutable recorded fact: a `replay`-mode fork MUST NOT mint a new
  * `memoryId` for a write the source run already recorded. This asserts the
  * "MUST NOT regenerate" half — every `memory.written` on a replayed run
- * reuses a `memoryId` the source run recorded (a compliant host that
- * suppresses re-mint on replay satisfies this vacuously with zero events).
+ * reuses a `memoryId` the source run recorded.
+ *
+ * H2 (2026-08-18): this file used to say, in this docstring, that "a
+ * compliant host that suppresses re-mint on replay satisfies this vacuously
+ * with zero events" — and it did: the assertion is a `for` loop over the
+ * replayed events, so a host that emits NONE passed trivially. Two hosts
+ * diverged under it and both stayed green (openwop-app re-emits the source's
+ * events; a tier-2 host suppressed them, which leaves the replayed log SHORT
+ * of the source's and breaks RFC 0041 §C byte-equivalence).
+ *
+ * The divergence is the spec's, not the hosts': RFC 0057 §D says the host
+ * "MUST re-emit the recorded events from the log" and then, in a
+ * non-normative implementation note in the same section, blesses the
+ * reference host for "suppress[ing] rather than re-emit[ting]". Resolving
+ * that contradiction is a normative decision (it plausibly makes one shipped
+ * host non-conformant), so this leg does NOT pick a side. What it stops
+ * doing is passing silently: an empty replay now records `blocked` naming
+ * the contradiction, per RFC 0148 §A — a leg that cannot observe MUST NOT
+ * read as a pass. Once §D is resolved, the winning side becomes an assertion
+ * here.
  *
  * Gated on `capabilities.memory.attribution.emitsWriteEvents`; soft-skips
  * when unadvertised, when the seeded run wrote no memory, or when the host
@@ -50,6 +68,19 @@ describe('memory-attribution-replay-stable (RFC 0057 §D)', () => {
     }
 
     const replayed = await memoryWrittenEvents(forkId);
+    if (replayed.length === 0) {
+      // NOT a pass. The source run recorded `memory.written` events and the
+      // replay carries none, so this host is on the "suppress" side of the
+      // RFC 0057 §D contradiction. Whether that is conformant is undecided;
+      // that it is unobserved here is not (RFC 0148 §A).
+      return softSkip(
+        'blocked',
+        `replay emitted no memory.written while the source recorded ${recordedIds.size} — ` +
+          'the host suppresses rather than re-emits. RFC 0057 §D requires re-emission in its ' +
+          'normative half and blesses suppression in its implementation note; until that ' +
+          'contradiction is resolved this leg records the divergence instead of passing on it.',
+      );
+    }
     for (const e of replayed) {
       const id = memoryIdOf(e.payload);
       expect(