@openwop/openwop-conformance 1.71.0 → 1.71.1

package/README.md

@@ -202,6 +202,14 @@ import caps from './vendor/capabilities.schema.json';
 import caps from '@openwop/openwop-conformance/schemas/capabilities.schema.json';
 ```
 
+**If you must vendor a copy, the copy now carries its own provenance.** The tarball's `schemas/` contains `CORPUS-STAMP.json`:
+
+```jsonc
+{ "suiteVersion": "1.71.1", "corpusCommit": "984ced5f…" }
+```
+
+It lives **inside** `schemas/` on purpose: `package.json`'s version is what a `cp -R schemas/ vendor/` throws away, and the stamp is what survives it. Comparing your vendored stamp against the one in your installed `@openwop/openwop-conformance` is a plain file read — no network, no sibling checkout, no pinning a branch. The stamp exists only in the published tarball, never in the repo tree, and carries no timestamp so the tarball stays reproducible.
+
 **What this does not fix.** A host that keeps hand-copying gets no warning, and the corpus cannot see a host's local files — so this narrows the failure rather than eliminating it. Tracked as RFC 0145 G2.
 
 The presence of these files at stable paths in the tarball is enforced by `scripts/check-npm-pack-contents.sh`, so a packaging change cannot quietly withdraw the contract copy a host depends on.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -0,0 +1,5 @@
+{
+  "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
+  "suiteVersion": "1.71.1",
+  "corpusCommit": "6103a20d4ba6fbab32e7c6e0dac5acaebf93887e"
+}

package/src/scenarios/spec-corpus-validity.test.ts

@@ -515,8 +515,20 @@ function extractLocalMarkdownLinks(markdown: string): string[] {
 
 // ── Scenarios ───────────────────────────────────────────────────────────
 
+/**
+ * Provenance stamp written into the VENDORED `schemas/` at prepack (RFC 0145 G2).
+ * It never exists in the repo tree, but it DOES exist when this suite runs from the
+ * published package — where `SCHEMAS_DIR` points at the vendored copy that carries it.
+ * "Written only into the tarball" and "invisible to this gate" are therefore NOT the
+ * same claim, and the difference only shows up for a consumer, never locally.
+ * It is data about the contract, not a schema, so it is excluded by name rather than
+ * by extension — the `.json` suffix is what makes it readable, and what would
+ * otherwise feed it to Ajv.
+ */
+const CORPUS_STAMP = 'CORPUS-STAMP.json';
+
 describe('spec-corpus: JSON Schemas compile under Ajv2020', () => {
-  const schemaFiles = listJsonFiles(SCHEMAS_DIR);
+  const schemaFiles = listJsonFiles(SCHEMAS_DIR).filter((f) => f !== CORPUS_STAMP);
   const ajv = new Ajv2020({ allErrors: true, strict: false });
   addFormats(ajv);