@openwop/openwop-conformance 1.136.9 → 1.136.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.136.9",
+  "version": "1.136.11",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.136.9",
-  "corpusCommit": "6d2c33ba0be0e4d6934f5f9471600c66e8c5c183"
+  "suiteVersion": "1.136.11",
+  "corpusCommit": "d52dd83825840335271db2bd1696476b4bbcb634"
 }

package/src/scenarios/certification-floor-enforcement.test.ts

@@ -20,7 +20,10 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { verifyBundle, verifyBundleProfile, PROFILE_FLOOR_SCENARIOS } from '../lib/profiles.js';
+import { SCENARIOS_DIR } from '../lib/paths.js';
 
 /** Derives `openwop-core` and `openwop-stream-sse` (transports omitted ⇒ all). */
 const streamingDiscovery = {
@@ -135,5 +138,67 @@ describe('RFC 0148 §C — floor enforcement is not vacuous', () => {
     for (const { profile, scenario } of all) {
       expect(scenario, `${profile} floor cites a non-scenario filename`).toMatch(/\.test\.ts$/);
     }
+
+    // 2026-08-18: this leg's NAME promised "files that exist" and it only
+    // matched the `.test.ts` suffix — a string check wearing an existence
+    // check's name. The phantom `audit-log-verification.test.ts` floor row sat
+    // in `openwop-core-standard` until `--certify` hit it against a live host,
+    // because nothing here opened the directory.
+    if (SCENARIOS_DIR === null) return; // published layout ships src/, but stay honest if it ever does not
+    const dir = SCENARIOS_DIR as string;
+    const missing = all
+      .filter(({ scenario }) => !existsSync(join(dir, scenario)))
+      .map(({ profile, scenario }) => `${profile} → ${scenario}`);
+    expect(
+      missing,
+      'a floor cites a scenario file that does not exist — that requirement can never be satisfied, ' +
+        'so the profile can never certify, for a reason unrelated to any host',
+    ).toEqual([]);
+  });
+
+  it('no floor scenario is corpus-only — a floor must be provable from the published package', () => {
+    // openwop-app's suggestion, and it is right that this be a red test rather
+    // than a paragraph: the failure mode is SOMEONE LATER adding a corpus
+    // self-check to a floor, and prose in a PR body will not be in front of
+    // them.
+    //
+    // A scenario that can only run in a repo checkout (it reads `spec/` or
+    // `RFCS/` through `V1_DIR`) records `blocked` in the published layout,
+    // where the package ships no corpus by design. `blocked` is correct there
+    // — RFC 0148 §A defines it as a missing dependency — but a `blocked`
+    // requirement in a claimed profile invalidates that profile. So a
+    // corpus-only scenario in a floor makes the profile UNCERTIFIABLE from the
+    // npm tarball, permanently, for a reason no host can fix. It is the mirror
+    // of the phantom-row trap above: that one named a file that does not
+    // exist, this one names a file that cannot execute where certification is
+    // measured.
+    if (SCENARIOS_DIR === null) return;
+    const dir = SCENARIOS_DIR as string;
+
+    /** Every `it`/`test` in the file is V1_DIR-guarded, or every `describe` is. */
+    const isCorpusOnly = (source: string): boolean => {
+      if (!source.includes('V1_DIR')) return false;
+      const guard = /\(V1_DIR === null\)/;
+      const its = [...source.matchAll(/\b(?:it|test)(\.skipIf\([^)]*\))?\s*\(/g)];
+      const describes = [...source.matchAll(/\bdescribe(\.skipIf\([^)]*\))?\s*\(/g)];
+      const allItsGuarded = its.length > 0 && its.every((m) => guard.test(m[1] ?? ''));
+      const allDescribesGuarded = describes.length > 0 && describes.every((m) => guard.test(m[1] ?? ''));
+      return allItsGuarded || allDescribesGuarded;
+    };
+
+    const offenders = Object.entries(PROFILE_FLOOR_SCENARIOS)
+      .flatMap(([profile, floor]) => floor.required.map((scenario) => ({ profile, scenario })))
+      .filter(({ scenario }) => {
+        const path = join(dir, scenario);
+        return existsSync(path) && isCorpusOnly(readFileSync(path, 'utf8'));
+      })
+      .map(({ profile, scenario }) => `${profile} → ${scenario}`);
+
+    expect(
+      offenders,
+      'a profile floor cites a CORPUS-ONLY scenario (all of its tests are guarded on `V1_DIR === null`). ' +
+        'It records `blocked` in the published layout, so that profile can never certify from the npm ' +
+        'tarball — no host can fix it. Keep corpus self-checks out of floors.',
+    ).toEqual([]);
   });
 });

package/src/scenarios/memory-attribution-replay-stable.test.ts

@@ -13,16 +13,21 @@
  * events; a tier-2 host suppressed them, which leaves the replayed log SHORT
  * of the source's and breaks RFC 0041 §C byte-equivalence).
  *
- * The divergence is the spec's, not the hosts': RFC 0057 §D says the host
- * "MUST re-emit the recorded events from the log" and then, in a
- * non-normative implementation note in the same section, blesses the
- * reference host for "suppress[ing] rather than re-emit[ting]". Resolving
- * that contradiction is a normative decision (it plausibly makes one shipped
- * host non-conformant), so this leg does NOT pick a side. What it stops
- * doing is passing silently: an empty replay now records `blocked` naming
- * the contradiction, per RFC 0148 §A — a leg that cannot observe MUST NOT
- * read as a pass. Once §D is resolved, the winning side becomes an assertion
- * here.
+ * The spec was never actually ambiguous, and an earlier revision of this file
+ * said it was — that was wrong. `replay.md` §"Determinism guarantees"
+ * caveat 5 (Stable, unchanged since v1.2) names this exact case: recorded-fact
+ * events such as `memory.written` "are fixed history. On replay against a
+ * checkpoint a host MUST re-emit them from the event log and MUST NOT
+ * regenerate their identifiers or timestamps." RFC 0041 §C independently
+ * requires caching "emitted events" so a replay reproduces the observable
+ * sequence. RFC 0057 §D's implementation note appeared to bless suppression
+ * and conceded in its own words that it satisfied only the "MUST NOT
+ * regenerate" half; that note is retired (RFC 0057, Correction 2026-08-18).
+ *
+ * So this asserts BOTH halves — every replayed id is a recorded id, AND the
+ * source's recorded ids all reappear. A suppressing host fails, and always
+ * should have: nothing normative changed, the instrument just could not see
+ * it before.
  *
  * Gated on `capabilities.memory.attribution.emitsWriteEvents`; soft-skips
  * when unadvertised, when the seeded run wrote no memory, or when the host
@@ -68,19 +73,26 @@ describe('memory-attribution-replay-stable (RFC 0057 §D)', () => {
     }
 
     const replayed = await memoryWrittenEvents(forkId);
-    if (replayed.length === 0) {
-      // NOT a pass. The source run recorded `memory.written` events and the
-      // replay carries none, so this host is on the "suppress" side of the
-      // RFC 0057 §D contradiction. Whether that is conformant is undecided;
-      // that it is unobserved here is not (RFC 0148 §A).
-      return softSkip(
-        'blocked',
-        `replay emitted no memory.written while the source recorded ${recordedIds.size} — ` +
-          'the host suppresses rather than re-emits. RFC 0057 §D requires re-emission in its ' +
-          'normative half and blesses suppression in its implementation note; until that ' +
-          'contradiction is resolved this leg records the divergence instead of passing on it.',
-      );
-    }
+    // Half 1 — MUST re-emit. The source's recorded ids all reappear on the
+    // replay. This is the half that went unasserted for months: the loop below
+    // is vacuously true on an empty array, so a host that suppressed the
+    // re-emission entirely passed.
+    const replayedIds = new Set(
+      replayed.map((e) => memoryIdOf(e.payload)).filter((x): x is string => x !== null),
+    );
+    const missing = [...recordedIds].filter((id) => !replayedIds.has(id));
+    expect(
+      missing,
+      driver.describe(
+        'replay.md §"Determinism guarantees" caveat 5',
+        'recorded-fact events are fixed history: a replay MUST re-emit the source run\'s ' +
+          '`memory.written` events from the log. A replay whose log is SHORT of the source\'s is not ' +
+          'a reproduction of the observable sequence (RFC 0041 §C). Suppressing the write is not ' +
+          'enough — that satisfies only the MUST-NOT-regenerate half',
+      ),
+    ).toEqual([]);
+
+    // Half 2 — MUST NOT regenerate. Every id on the replay is one the source recorded.
     for (const e of replayed) {
       const id = memoryIdOf(e.payload);
       expect(