@openwop/openwop-conformance 1.148.0 → 1.149.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +4 -0
- package/coverage.md +1 -1
- package/package.json +1 -1
- package/schemas/CORPUS-STAMP.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,9 @@
|
|
|
1
1
|
# `@openwop/openwop-conformance` Changelog
|
|
2
2
|
|
|
3
|
+
## [1.149.0] — 2026-09-02 — RFC 0163 `Active → Accepted` (tier-1 witness)
|
|
4
|
+
|
|
5
|
+
No scenario change; `coverage.md` (packed) moves the `auth-subject-link-key-class.test.ts` behaviour grade from `host-pending` to host-pass, so the published tarball content changes and the identity gate asks for a bump. The reference host (openwop-app #3614, `2f6ca969d`, ADR 0620) emits `subjectLinkKey: "opaque-idp"` from the same gate as `subjectLinking`, reconstructs the suite's signed `<saml:Issuer>` in its validator, binds the SCIM connection to an IdP entityID (`idpUrl` accepted on the provision seam, SSRF-guarded), and refuses a cross-IdP identifier collision with `401 subject_link_trust_root_mismatch` on the validate seam and with no session on the production ACS. The host widened its seam SSRF allowlist to the second synthetic IdP first, so the cross-root negative is refused on trust root rather than on origin — sabotage-verified. Single-witness under the bootstrap waiver; no tier-2/3 host advertises `subjectLinking`.
|
|
6
|
+
|
|
3
7
|
## [1.148.0] — 2026-09-01 — RFC 0163 `Draft → Active`: classes not attributes, schema conditional, fixture proof out of the scenario
|
|
4
8
|
|
|
5
9
|
No new scenario file (suite file count unchanged); published content changes, so the identity bump is a minor. Three things move.
|
package/coverage.md
CHANGED
|
@@ -118,7 +118,7 @@ The scenario groups in the table below (one row per group; count the rows — th
|
|
|
118
118
|
| `auth-saml-profile.test.ts` | `openwop-auth-saml` (RFC 0050, `auth-profiles.md` §`openwop-auth-saml`) | A+B (profile-advertisement shape always; **1-positive + 6-negative reference suite runs server-free** via the bundled synthetic IdP `conformance/src/lib/saml-idp.ts` — `alg:none`/unsigned/bad-sig/expired/not-yet-valid/wrapping; host-ACS validation opt-in via `OPENWOP_TEST_SAML_IDP_URL` + the `auth/saml/validate` seam) | host-pass (server-free reference) | Synthetic IdP bundled (`node:crypto`, no deps). Host-ACS pass is the remaining graduation gate. |
|
|
119
119
|
| `auth-scim-profile.test.ts` | `openwop-auth-scim` (RFC 0050, `auth-profiles.md` §`openwop-auth-scim`) | B (profile-advertisement shape always; SCIM user/group provisioning → principal/role roundtrip opt-in via `OPENWOP_TEST_SCIM_URL` + the `auth/scim/provision` seam) | `host-pending` | Behavior opt-in (operator-supplied SCIM endpoint); deactivate ⇒ subsequent-deny assertion deferred to a host. |
|
|
120
120
|
| `auth-subject-link.test.ts` | `openwop-auth-saml` + `openwop-auth-scim` with `capabilities.auth.subjectLinking: true` (RFC 0159, `auth-profiles.md` §Subject linking) | B (advertisement gate always — `subjectLinking:true` only alongside both profiles; cross-lane leaver deny + mutable-key negative opt-in via `OPENWOP_TEST_SAML_IDP_URL` + `OPENWOP_TEST_SCIM_URL` and the `auth/scim/provision` + `auth/saml/validate` seams) | host-pass (tier-1 in-process witness, openwop-app #3581) | Invariant `subject-link-leaver-deny`. No production host advertises `subjectLinking`. |
|
|
121
|
-
| `auth-subject-link-key-class.test.ts` | as above (RFC 0163) | B (`subjectLinkKey` ∈ `{opaque-idp, configured-immutable}` when `subjectLinking:true`, unaided; same-IdP control + cross-IdP collision negative opt-in via `OPENWOP_TEST_SAML_IDP_URL` + `OPENWOP_TEST_SAML_IDP_URL_B` + `OPENWOP_TEST_SCIM_URL`) |
|
|
121
|
+
| `auth-subject-link-key-class.test.ts` | as above (RFC 0163) | B (`subjectLinkKey` ∈ `{opaque-idp, configured-immutable}` when `subjectLinking:true`, unaided; same-IdP control + cross-IdP collision negative opt-in via `OPENWOP_TEST_SAML_IDP_URL` + `OPENWOP_TEST_SAML_IDP_URL_B` + `OPENWOP_TEST_SCIM_URL`) | host-pass (tier-1 in-process witness, openwop-app #3614) | Invariants `subject-link-key-class-declared`, `subject-link-same-trust-root`. Fixture self-test lives in `src/lib/saml-idp.test.ts`, not here (G8). |
|
|
122
122
|
| `runtime-requires-shape.test.ts` | `node-pack-manifest.schema.json` `$defs/Runtime.requires` (RFC 0076 §A, `node-packs.md` §"Runtime platform requirements") | Server-free (closed-vocabulary validation: 8 tokens validate; raw builtin `node:dns/promises` rejected → `invalid_manifest`; empty-array≡omission; `uniqueItems`) | host-pass (server-free) | Always runs; no host needed. The install-time GATE behavior is in `runtime-requires-install-gate.test.ts`. |
|
|
123
123
|
| `runtime-requires-install-gate.test.ts` | RFC 0076 §A install gate (no capability flag; seam `POST /v1/host/sample/packs/install-gate`) | A (install-grant; install-refuse → `pack_runtime_requirement_unmet { unmet, manifest, advice? }`; non-sandbox SHOULD-projection — all via the optional seam) | `host-pending` | Seam-gated; soft-skips on 404. First adopter: MyndHyve's install-time gate against `core.openwop.http` declaring `["net.dns","net.outbound"]`. |
|
|
124
124
|
| `safefetch-behavior.test.ts` | `capabilities.httpClient.safeFetch` (RFC 0076 §B, `host-capabilities.md` §host.http) + `SECURITY/invariants.yaml` `http-client-ssrf-guard` | A (SSRF block + DNS-rebinding defeat + `Connection: upgrade` refusal + tool-hooks audit-when-`prePostEvents`, via the optional `POST /v1/host/sample/http/safe-fetch` seam) | in-memory ✅ | **5/5 PASS against the in-memory reference host** (2026-05-29, `OPENWOP_REQUIRE_BEHAVIOR=true`); seam-gated, soft-skips on 404 elsewhere. Reuses the existing `http-client-ssrf-guard` invariant (no new invariant). Advertisement contract in `http-client-ssrf.test.ts`. §B → Accepted still awaits `core.openwop.http@2.0.0` consumer + non-steward adoption. |
|
package/package.json
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
2
|
"_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
|
|
3
|
-
"suiteVersion": "1.
|
|
4
|
-
"corpusCommit": "
|
|
3
|
+
"suiteVersion": "1.149.0",
|
|
4
|
+
"corpusCommit": "6cdf17d36ce5856f9ba775fd393ee02a6da3eded"
|
|
5
5
|
}
|