@openwop/openwop-conformance 1.136.8 → 1.136.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.136.8",
+  "version": "1.136.10",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.136.8",
-  "corpusCommit": "b8114f3d820af7f377c332c977d5cac93fe7bb05"
+  "suiteVersion": "1.136.10",
+  "corpusCommit": "0d8fd3fde8cca5785c23d4b7e64281f1876ab342"
 }

package/src/scenarios/compensation-behavior.test.ts

@@ -40,6 +40,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
@@ -224,4 +225,74 @@ describe('RFC 0151 §C — compensation lifecycle (capability-gated behavior)',
       }
     }
   });
+
+  it('a healthy run that DECLARES a compensator reports compensationStatus `none` (SP-11a)', async () => {
+    if (!behaviorGate(PROFILE, await advertised())) return;
+
+    // The rollup folds over the PLAN, and no plan exists until a trigger fires
+    // (`compensation.md` §"Run rollup"). So a run that completes successfully while
+    // declaring compensable nodes reads `none` — it has nothing to unwind.
+    //
+    // Nothing observed this. Every other leg of the §21 seam drives a FAILURE, so a
+    // host that derived the rollup from the existence of obligation rows — minted per
+    // compensable node, healthy or not — reported `pending` on every successful run
+    // that declared a compensator and passed all of them. A tier-1 host shipped exactly
+    // that (SP-11a / their AP-03). This leg is the healthy case, and it needs no failure:
+    // `fail: false` on the unwind seam runs the same compensator-declaring workflow to
+    // completion.
+    const seam = await driver.post('/v1/host/sample/test/compensation/unwind', { fail: false });
+    if (seam.status === 404) {
+      return softSkip('blocked', 'the §21 unwind seam is not wired — the healthy-run rollup has no black-box witness');
+    }
+    if (seam.status >= 400) {
+      // The host mounts the seam but rejects `fail: false`. That is the pre-extension
+      // shape, not a pass: without it the healthy-run rollup stays unobservable.
+      return softSkip(
+        'blocked',
+        `the §21 unwind seam does not honour \`fail: false\` (HTTP ${seam.status}) — the healthy-run ` +
+          'rollup is unobservable until it does (host-sample-test-seams.md §21)',
+      );
+    }
+
+    const body = seam.json as { runId?: string; events?: { type: string }[] };
+    expect(
+      typeof body.runId === 'string' && body.runId.length > 0,
+      driver.describe('host-sample-test-seams.md §21', '`fail: false` MUST still return the runId it created'),
+    ).toBe(true);
+
+    // Positive control: the seam really did run a healthy compensator-declaring
+    // workflow. If it emitted a `compensation.requested`, it failed the node anyway and
+    // this is not the healthy case — say so rather than assert `none` against a run
+    // that legitimately has a plan.
+    const types = (body.events ?? []).map((e) => e.type);
+    if (types.includes('compensation.requested')) {
+      return softSkip(
+        'blocked',
+        `the seam emitted ${JSON.stringify(types)} under \`fail: false\` — a trigger fired, so this run ` +
+          'is not the healthy case the leg needs',
+      );
+    }
+
+    const snap = await driver.get(`/v1/runs/${encodeURIComponent(body.runId ?? '')}`);
+    expect(snap.status, driver.describe('rest-endpoints.md', 'GET /v1/runs/{runId} for the healthy seam run')).toBe(200);
+    const snapshot = snap.json as { status?: unknown; compensationStatus?: unknown };
+
+    expect(
+      snapshot.compensationStatus,
+      driver.describe(
+        'compensation.md §"Run rollup: compensationStatus"',
+        'a host advertising `compensation` MUST carry the field on EVERY snapshot — presence is the wire witness of the advert',
+      ),
+    ).toBeDefined();
+
+    expect(
+      snapshot.compensationStatus,
+      driver.describe(
+        'compensation.md §"Run rollup: compensationStatus"',
+        'a run that completed while declaring compensable nodes has nothing to unwind: no `compensation.requested` ' +
+          'was recorded, so the fold is `none`. `pending` here means the rollup was derived from obligation ROWS ' +
+          `rather than from plan state — got \`${String(snapshot.compensationStatus)}\``,
+      ),
+    ).toBe('none');
+  });
 });

package/src/scenarios/memory-attribution-replay-stable.test.ts

@@ -13,16 +13,21 @@
  * events; a tier-2 host suppressed them, which leaves the replayed log SHORT
  * of the source's and breaks RFC 0041 §C byte-equivalence).
  *
- * The divergence is the spec's, not the hosts': RFC 0057 §D says the host
- * "MUST re-emit the recorded events from the log" and then, in a
- * non-normative implementation note in the same section, blesses the
- * reference host for "suppress[ing] rather than re-emit[ting]". Resolving
- * that contradiction is a normative decision (it plausibly makes one shipped
- * host non-conformant), so this leg does NOT pick a side. What it stops
- * doing is passing silently: an empty replay now records `blocked` naming
- * the contradiction, per RFC 0148 §A — a leg that cannot observe MUST NOT
- * read as a pass. Once §D is resolved, the winning side becomes an assertion
- * here.
+ * The spec was never actually ambiguous, and an earlier revision of this file
+ * said it was — that was wrong. `replay.md` §"Determinism guarantees"
+ * caveat 5 (Stable, unchanged since v1.2) names this exact case: recorded-fact
+ * events such as `memory.written` "are fixed history. On replay against a
+ * checkpoint a host MUST re-emit them from the event log and MUST NOT
+ * regenerate their identifiers or timestamps." RFC 0041 §C independently
+ * requires caching "emitted events" so a replay reproduces the observable
+ * sequence. RFC 0057 §D's implementation note appeared to bless suppression
+ * and conceded in its own words that it satisfied only the "MUST NOT
+ * regenerate" half; that note is retired (RFC 0057, Correction 2026-08-18).
+ *
+ * So this asserts BOTH halves — every replayed id is a recorded id, AND the
+ * source's recorded ids all reappear. A suppressing host fails, and always
+ * should have: nothing normative changed, the instrument just could not see
+ * it before.
  *
  * Gated on `capabilities.memory.attribution.emitsWriteEvents`; soft-skips
  * when unadvertised, when the seeded run wrote no memory, or when the host
@@ -68,19 +73,26 @@ describe('memory-attribution-replay-stable (RFC 0057 §D)', () => {
     }
 
     const replayed = await memoryWrittenEvents(forkId);
-    if (replayed.length === 0) {
-      // NOT a pass. The source run recorded `memory.written` events and the
-      // replay carries none, so this host is on the "suppress" side of the
-      // RFC 0057 §D contradiction. Whether that is conformant is undecided;
-      // that it is unobserved here is not (RFC 0148 §A).
-      return softSkip(
-        'blocked',
-        `replay emitted no memory.written while the source recorded ${recordedIds.size} — ` +
-          'the host suppresses rather than re-emits. RFC 0057 §D requires re-emission in its ' +
-          'normative half and blesses suppression in its implementation note; until that ' +
-          'contradiction is resolved this leg records the divergence instead of passing on it.',
-      );
-    }
+    // Half 1 — MUST re-emit. The source's recorded ids all reappear on the
+    // replay. This is the half that went unasserted for months: the loop below
+    // is vacuously true on an empty array, so a host that suppressed the
+    // re-emission entirely passed.
+    const replayedIds = new Set(
+      replayed.map((e) => memoryIdOf(e.payload)).filter((x): x is string => x !== null),
+    );
+    const missing = [...recordedIds].filter((id) => !replayedIds.has(id));
+    expect(
+      missing,
+      driver.describe(
+        'replay.md §"Determinism guarantees" caveat 5',
+        'recorded-fact events are fixed history: a replay MUST re-emit the source run\'s ' +
+          '`memory.written` events from the log. A replay whose log is SHORT of the source\'s is not ' +
+          'a reproduction of the observable sequence (RFC 0041 §C). Suppressing the write is not ' +
+          'enough — that satisfies only the MUST-NOT-regenerate half',
+      ),
+    ).toEqual([]);
+
+    // Half 2 — MUST NOT regenerate. Every id on the replay is one the source recorded.
     for (const e of replayed) {
       const id = memoryIdOf(e.payload);
       expect(