@openwop/openwop-conformance 1.156.0 → 1.159.0

package/README.md

@@ -103,7 +103,8 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 472 scenario files under `src/scenarios/`.
+The current suite has 473 scenario files under `src/scenarios/`.
+- 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
 - 2026-08-18 (suite `1.136.7 → 1.136.8`, SP-04): NEW `spec-section-citations.test.ts` — server-free; a `<doc>.md §"<Section>"` citation of a checked doc MUST resolve to a heading that exists. `storage-adapters.md §"Claim acquisition"` was cited by four artifacts, including a normative MUST in `production-profile.md` §Durability, and the section did not exist for the life of RFC 0009. Scoped to the docs whose section citations carry the durability contract; a corpus-wide sweep finds ~260 unresolved citations that need triage before they can gate.
@@ -447,7 +448,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 472 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 473 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.156.0",
+  "version": "1.159.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/requirements.json

@@ -2,9 +2,9 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 472,
-    "tests": 1971,
-    "withStableId": 1948,
+    "files": 473,
+    "tests": 1974,
+    "withStableId": 1951,
     "interpolatedTitles": 23,
     "explicitIds": 0
   },
@@ -11445,6 +11445,65 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.idempotency-concurrent-claim.every-executor-mints-the-same-logicalinvocationid-without-this-one-delivery-prov",
+      "file": "idempotency-concurrent-claim.test.ts",
+      "line": 81,
+      "title": "every executor mints the SAME logicalInvocationId — without this, one delivery proves nothing",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "host-sample-test-seams.md §25",
+          "requirement": "the seam MUST report mintedIds, one per executor"
+        },
+        {
+          "section": "host-sample-test-seams.md §25",
+          "requirement": "mintedIds length MUST equal the executors that reached the chokepoint"
+        },
+        {
+          "section": "host-sample-test-seams.md §25",
+          "requirement": "fewer than two executors is not a race and cannot witness the rule"
+        },
+        {
+          "section": "idempotency.md §\"Idempotency key composition\" (Across a recovery boundary)",
+          "requirement": "all executors MUST mint one identity — differing ids mean they never collided, so a single delivery is a vacuous pass rather than a working claim"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.idempotency-concurrent-claim.exactly-one-effect-escapes-however-many-executors-attempt-it",
+      "file": "idempotency-concurrent-claim.test.ts",
+      "line": 110,
+      "title": "exactly one effect escapes, however many executors attempt it",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "host-sample-test-seams.md §25",
+          "requirement": "the seam MUST report how many executors attempted the effect"
+        },
+        {
+          "section": "idempotency.md §\"Concurrent duplicates (Layer 2)\"",
+          "requirement": "the engine MUST ensure at most one concurrent executor performs the external effect — the guarding persist MUST be an atomic claim, not a read-then-write"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.idempotency-concurrent-claim.the-race-is-real-at-higher-concurrency-too-a-claim-that-only-holds-at-2-is-not-a",
+      "file": "idempotency-concurrent-claim.test.ts",
+      "line": 127,
+      "title": "the race is real at higher concurrency too — a claim that only holds at 2 is not a claim",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "idempotency.md §\"Concurrent duplicates (Layer 2)\"",
+          "requirement": "exactly one effect regardless of how many executors race — at most one wins the compare-and-set, the rest observe the hit"
+        },
+        {
+          "section": "idempotency.md §\"Idempotency key composition\"",
+          "requirement": "one identity across all executors at any concurrency"
+        }
+      ]
+    },
     {
       "id": "openwop.it.idempotency-key-determinism.skips-cleanly-when-packs-is-not-bundled",
       "file": "idempotency-key-determinism.test.ts",
@@ -14608,7 +14667,7 @@
     {
       "id": "openwop.it.owner-subject-echo.subject-is-consistent-with-the-owner-triple-b-2-and-the-actor-chain-is-bounded-b",
       "file": "owner-subject-echo.test.ts",
-      "line": 77,
+      "line": 84,
       "title": "subject is consistent with the owner triple (§B.2) and the actor chain is bounded (§B.5)",
       "explicitId": null,
       "citations": [
@@ -14641,7 +14700,7 @@
     {
       "id": "openwop.it.owner-subject-echo.run-started-echoes-the-snapshot-subject-verbatim-b-2-rfc-0048-c",
       "file": "owner-subject-echo.test.ts",
-      "line": 99,
+      "line": 106,
       "title": "run.started echoes the snapshot subject verbatim (§B.2, RFC 0048 §C)",
       "explicitId": null,
       "citations": [
@@ -14658,7 +14717,7 @@
     {
       "id": "openwop.it.owner-subject-echo.a-fork-copies-owner-tenant-and-owner-subject-verbatim-onto-the-child-b-4",
       "file": "owner-subject-echo.test.ts",
-      "line": 110,
+      "line": 123,
       "title": "a fork copies owner.tenant and owner.subject verbatim onto the child (§B.4)",
       "explicitId": null,
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md §\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.156.0",
-  "corpusCommit": "de4bba1f255a49995789dfd12ed7fe4c4a1dab90",
+  "suiteVersion": "1.159.0",
+  "corpusCommit": "1be7b47172478567f8690acb23d570d135bf8a40",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",

package/src/scenarios/idempotency-concurrent-claim.test.ts

@@ -0,0 +1,154 @@
+/**
+ * RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" — the
+ * atomic-claim witness. Gap **G17**.
+ *
+ * The rule: the persist that guards a side effect MUST be an **atomic claim** —
+ * a compare-and-set / insert-if-absent that at most one executor can win — not a
+ * read-then-write. It is unconditional, and the spec says it MUST hold *within a
+ * single-instance deployment*, naming the case where an orphan sweeper
+ * re-dispatches a run whose owner is stalled but still alive.
+ *
+ * It had no witness of any kind. `layer2-invocation-claim-atomic` was registered
+ * reference-impl tier with an EMPTY `tests` list, because driving the rule needs
+ * two executors of one run concurrently reaching one effect chokepoint and the
+ * black-box suite cannot cause that. Per RFC 0148 §A an unobservable requirement
+ * resolves to `blocked` — and a wire probe asserting it would pass on a host that
+ * has the defect, which is the vacuous-witness pattern §A exists to close.
+ *
+ * `host-sample-test-seams.md` §25 is what makes it drivable. This file drives it.
+ *
+ * **Two assertions, and the second is the point.** `delivered === 1` alone is not
+ * evidence: a host passes it by minting DIFFERENT identities per executor and
+ * never colliding — one effect, because nothing raced. So the seam reports the
+ * id each executor minted and this scenario asserts they are identical BEFORE
+ * asserting the delivery count. That is the observable projection of
+ * `idempotency.md` §"Idempotency key composition" → "Across a recovery boundary":
+ * the ordinal reproduces iff the resumed unit re-executes the node's logical
+ * activities from the start, and a host that resumes mid-node shifts every
+ * downstream identity and defeats Layer-2 dedup on exactly the crash it most
+ * needs to survive.
+ *
+ * Reproducing the race is the hard part, and a true statement can stand in the
+ * way of it: a tier-1 host carried the note "the shared ordinal counter hands the
+ * second emit a DIFFERENT identity, so it is not reproducible single-instance" —
+ * true of two SEQUENTIAL emits, and it became a reason nobody tried. Identity
+ * minting runs synchronously before the first `await`, so two un-awaited calls
+ * both mint the same ordinal. That host then measured 2 effects without the
+ * claim and 1 with it.
+ *
+ * A host that does not mount the seam records `blocked` (unwitnessed), never
+ * `inapplicable`: the requirement binds every host, so absence is missing
+ * evidence rather than a requirement that does not apply.
+ *
+ * **Deliberately NOT `behaviorGate`, and therefore not opt-out-able.** A profile
+ * gate exists to separate "host claims X and fails" from "host does not claim X",
+ * and it lets an operator flip strict-mode failure into pass-by-opt-out. Neither
+ * move is available here: this obligation is UNCONDITIONAL, so no host may
+ * declare it does not apply, and converting an unwitnessed MUST into a pass is
+ * precisely the dishonesty the opt-out list must never be used for. `blocked` is
+ * already the correct RFC 0148 §A disposition — it applies, it was not witnessed,
+ * and it is NOT certifiable. That keeps the reference-host soak green without
+ * anyone claiming the requirement was met.
+ */
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { softSkip } from '../lib/soft-skip.js';
+
+const SEAM = '/v1/host/sample/test/idempotency/concurrent-claim';
+
+type ClaimResult = {
+  logicalInvocationId?: unknown;
+  mintedIds?: unknown;
+  attempted?: unknown;
+  delivered?: unknown;
+};
+
+/** Is the §25 seam mounted? 404/403/501 mean not mounted — anything else is a real answer. */
+async function seamPresent(): Promise<ClaimResult | null> {
+  const res = await driver.post(SEAM, { executors: 2 });
+  if (res.status === 404 || res.status === 403 || res.status === 501) return null;
+  expect(
+    res.status,
+    driver.describe(
+      'host-sample-test-seams.md §25',
+      'a mounted concurrent-claim seam MUST answer 200; a non-200 that is not 404/403/501 is a broken seam, not an absent one',
+    ),
+  ).toBe(200);
+  return res.json as ClaimResult;
+}
+
+describe('idempotency-concurrent-claim: two executors of one run, one effect (RFC 0150 §B, G17)', () => {
+  it('every executor mints the SAME logicalInvocationId — without this, one delivery proves nothing', async () => {
+    const out = await seamPresent();
+    if (out === null) return softSkip('blocked', `${SEAM} not mounted (host-sample-test-seams.md §25)`);
+
+    const minted = out.mintedIds;
+    expect(
+      Array.isArray(minted),
+      driver.describe('host-sample-test-seams.md §25', 'the seam MUST report mintedIds, one per executor'),
+    ).toBe(true);
+    const ids = minted as unknown[];
+    expect(
+      ids.length,
+      driver.describe('host-sample-test-seams.md §25', 'mintedIds length MUST equal the executors that reached the chokepoint'),
+    ).toBe(out.attempted);
+    expect(
+      ids.length >= 2,
+      driver.describe('host-sample-test-seams.md §25', 'fewer than two executors is not a race and cannot witness the rule'),
+    ).toBe(true);
+
+    const unique = new Set(ids.map((x) => JSON.stringify(x)));
+    expect(
+      unique.size,
+      driver.describe(
+        'idempotency.md §"Idempotency key composition" (Across a recovery boundary)',
+        'all executors MUST mint one identity — differing ids mean they never collided, so a single delivery is a vacuous pass rather than a working claim',
+      ),
+    ).toBe(1);
+  });
+
+  it('exactly one effect escapes, however many executors attempt it', async () => {
+    const out = await seamPresent();
+    if (out === null) return softSkip('blocked', `${SEAM} not mounted (host-sample-test-seams.md §25)`);
+
+    expect(
+      typeof out.attempted === 'number' && (out.attempted as number) >= 2,
+      driver.describe('host-sample-test-seams.md §25', 'the seam MUST report how many executors attempted the effect'),
+    ).toBe(true);
+    expect(
+      out.delivered,
+      driver.describe(
+        'idempotency.md §"Concurrent duplicates (Layer 2)"',
+        'the engine MUST ensure at most one concurrent executor performs the external effect — the guarding persist MUST be an atomic claim, not a read-then-write',
+      ),
+    ).toBe(1);
+  });
+
+  it('the race is real at higher concurrency too — a claim that only holds at 2 is not a claim', async () => {
+    const probe = await seamPresent();
+    if (probe === null) return softSkip('blocked', `${SEAM} not mounted (host-sample-test-seams.md §25)`);
+
+    const res = await driver.post(SEAM, { executors: 5 });
+    // A host MAY cap `executors`; what it MUST NOT do is deliver more than once.
+    // Say so — an unclassified return records `blocked` with no reason, which is
+    // the same thing this file exists to stop happening to the requirement.
+    if (res.status !== 200) {
+      return softSkip('skipped', `${SEAM} declined executors: 5 (status ${res.status}) — a host MAY cap concurrency`);
+    }
+    const out = res.json as ClaimResult;
+    expect(
+      out.delivered,
+      driver.describe(
+        'idempotency.md §"Concurrent duplicates (Layer 2)"',
+        'exactly one effect regardless of how many executors race — at most one wins the compare-and-set, the rest observe the hit',
+      ),
+    ).toBe(1);
+    const ids = Array.isArray(out.mintedIds) ? (out.mintedIds as unknown[]) : [];
+    if (ids.length >= 2) {
+      expect(
+        new Set(ids.map((x) => JSON.stringify(x))).size,
+        driver.describe('idempotency.md §"Idempotency key composition"', 'one identity across all executors at any concurrency'),
+      ).toBe(1);
+    }
+  });
+});

package/src/scenarios/owner-subject-echo.test.ts

@@ -18,6 +18,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { softSkip } from '../lib/soft-skip.js';
+import { pollUntil } from '../lib/polling.js';
 
 const NOOP_WORKFLOW_ID = 'conformance-noop';
 const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);
@@ -62,7 +63,13 @@ async function snapshot(runId: string): Promise<Snapshot> {
 }
 
 async function events(runId: string): Promise<readonly RawEvent[]> {
-  const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events/poll?lastSequence=0&timeout=1`);
+  // Suite 1.159.0 — NO cursor. `lastSequence` names the highest sequence the
+  // caller has ALREADY observed (version-negotiation.md §"events/poll"), and
+  // run-event.schema.json numbers the first event 0, so `lastSequence=0` asks
+  // a conforming host to SKIP `run.started` (MyndHyve does exactly that).
+  // Omitting the cursor is the only spec-expressible "nothing observed yet"
+  // read; the gap (no cursor value for the empty prefix) is RFC 0165 G7.
+  const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`);
   if (res.status !== 200) throw new Error(`events for ${runId}: ${res.status}`);
   return (res.json as { events?: RawEvent[] })?.events ?? [];
 }
@@ -102,6 +109,12 @@ describe.skipIf(SKIP_NO_NOOP)('owner-subject-echo: consistency, echo, fork (RFC
     if (snap.owner?.subject === undefined) {
       return softSkip('inapplicable', 'host does not emit owner.subject on new runs (RFC 0165 §B — optional in v1.x)');
     }
+    // Suite 1.157.0 — `run.started` is appended when the host STARTS the run,
+    // which a conforming host may do asynchronously after the 201 (openwop-app
+    // dispatches on the next tick). Reading the log straight after the POST
+    // raced that append and failed a conforming host; wait for the run to
+    // leave `pending` first, then the event is a fact, not a timing.
+    await pollUntil(runId, (s) => s.status !== 'pending', { label: 'run left pending (run.started appended)' });
     const started = (await events(runId)).find((e) => e.type === 'run.started');
     expect(started, driver.describe('RFC 0048 §C', 'run.started MUST be present in the event log')).toBeDefined();
     expect(started?.payload?.owner?.subject, driver.describe('RFC 0165 §B.2', 'run.started owner.subject MUST equal RunSnapshot.owner.subject')).toEqual(snap.owner.subject);