@openwop/openwop-conformance 1.72.2 → 1.98.0

package/api/asyncapi.yaml

@@ -456,6 +456,64 @@ components:
       payload:
         $ref: '#/components/schemas/RunEventDoc'
 
+    CompensationRequested:
+      name: compensation.requested
+      title: Compensation plan persisted (RFC 0151 §C/§D)
+      summary: >-
+        The unwind plan is durable. §C requires this BEFORE the first inverse
+        action executes — a host that starts unwinding first cannot resume after
+        a crash, and the crash is when resumption matters.
+      contentType: application/json
+      payload:
+        $ref: '#/components/schemas/RunEventDoc'
+
+    CompensationStarted:
+      name: compensation.started
+      title: First inverse action started (RFC 0151 §D)
+      summary: Compensation began executing. MUST follow compensation.requested.
+      contentType: application/json
+      payload:
+        $ref: '#/components/schemas/RunEventDoc'
+
+    CompensationCompleted:
+      name: compensation.completed
+      title: Compensation completed (RFC 0151 §D)
+      summary: Every inverse action in the plan succeeded.
+      contentType: application/json
+      payload:
+        $ref: '#/components/schemas/RunEventDoc'
+
+    CompensationFailed:
+      name: compensation.failed
+      title: Compensation failed (RFC 0151 §D)
+      summary: >-
+        An inverse action exhausted its retries. Compensation is a second effect,
+        not an undo — it can fail, and the run's compensationStatus records that
+        rather than the run silently reporting success.
+      contentType: application/json
+      payload:
+        $ref: '#/components/schemas/RunEventDoc'
+
+    CompensationPaused:
+      name: compensation.paused
+      title: Compensation paused for authorized intervention (RFC 0151 §C)
+      summary: >-
+        Cancelling the parent MUST NOT silently abandon an active compensation.
+        It continues, pauses here, or records manual intervention required.
+      contentType: application/json
+      payload:
+        $ref: '#/components/schemas/RunEventDoc'
+
+    CompensationManualInterventionRequired:
+      name: compensation.manual_intervention_required
+      title: Compensation needs an operator (RFC 0151 §C/§E)
+      summary: >-
+        The host cannot proceed unaided. Recorded explicitly because an unwind
+        that stops without saying so is indistinguishable from one that finished.
+      contentType: application/json
+      payload:
+        $ref: '#/components/schemas/RunEventDoc'
+
     RunPaused:
       name: run.paused
       title: Run paused

package/api/openapi.yaml

@@ -38,7 +38,10 @@ externalDocs:
   url: https://openwop.dev/spec/v1/
 
 servers:
-  - url: https://{host}/v1
+  # No `/v1` here: the version segment lives in the path keys below, so a
+  # server base carrying it too resolves every operation to `/v1/v1/*` and
+  # the unversioned discovery route to `/v1/.well-known/openwop` (RFC 0149 §A).
+  - url: https://{host}
     description: openwop-compliant server
     variables:
       host:

package/dist/cli.js

@@ -42,6 +42,7 @@ function parseArgs(argv) {
     let impl;
     let implVersion;
     let certify;
+    let bundleVersion = '1';
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i] ?? '';
         if (arg === '-h' || arg === '--help') {
@@ -83,6 +84,15 @@ function parseArgs(argv) {
             case '--implementation-version':
                 implVersion = nextValue();
                 break;
+            case '--bundle-version': {
+                const v = nextValue();
+                if (v !== '1' && v !== '2') {
+                    process.stderr.write(`--bundle-version must be 1 or 2 (got '${v}')\n`);
+                    process.exit(2);
+                }
+                bundleVersion = v;
+                break;
+            }
             case '--certify':
                 certify = nextValue();
                 break;
@@ -92,7 +102,7 @@ function parseArgs(argv) {
                 }
         }
     }
-    return { baseUrl, apiKey, offline, filter, help, impl, implVersion, certify };
+    return { baseUrl, apiKey, offline, filter, help, impl, implVersion, certify, bundleVersion };
 }
 const HELP_TEXT = `openwop-conformance — run the openwop conformance suite against a server
 
@@ -112,6 +122,10 @@ Implementation labels (cosmetic — surface in failure messages):
   --impl-version <version>  Implementation version     (env: OPENWOP_IMPLEMENTATION_VERSION)
 
 Certification (RFC 0089):
+  --bundle-version <1|2>  Certification bundle format. Default 1. Version 2 (RFC 0148
+                        §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
+                        file lists, so "we could not check" stops being indistinguishable
+                        from "checked and it holds". See the note it prints.
   --certify <out.json>  Generate a machine-readable conformance certification
                         bundle: fetch /.well-known/openwop (captured verbatim +
                         SHA-256), derive claimedProfiles from it, run the suite
@@ -310,6 +324,98 @@ async function runCertify(args, baseUrl, apiKey) {
             skipped,
         },
     };
+    // (d2) RFC 0148 §C — bundle v2.
+    //
+    // v1's `{passed, failed, skipped}` file lists cannot express the distinction
+    // this program exists for. A file counted as `passed` whether its assertions
+    // ran or its runner returned early, and `skipped` flattened three different
+    // claims — operator-excluded, not-applicable, and could-not-check — of which
+    // only the first two are certifiable.
+    //
+    // THE HONEST LIMIT, stated because it changes what a v2 bundle from this
+    // runner means: the runner reads vitest's per-FILE outcome. It does not read
+    // the RFC 0148 §A requirement ledger, because scenarios do not yet record
+    // into it. So a skipped file cannot be split into `skipped` /`inapplicable` /
+    // `blocked` here, and §A's rule is that an unclassifiable requirement resolves
+    // to `blocked` — never to a pass. That is what this emits.
+    //
+    // The consequence is deliberate and correct: a v2 bundle produced today shows
+    // a large `blocked` count and therefore does NOT certify. That is not a defect
+    // in the emitter. It is the true state of the evidence, which v1 was unable to
+    // represent and therefore reported as a clean skip.
+    if (args.bundleVersion === '2') {
+        const scenarioIds = [...passed, ...failed, ...skipped].sort();
+        const manifestSha = createHash('sha256').update(scenarioIds.join('\n'), 'utf8').digest('hex');
+        // Configuration identity per RFC 0147 §A.4: what the run was pointed at, and
+        // the discovery it saw. Two runs against differently-configured hosts are
+        // different evidence, and this is what says so.
+        const configSha = createHash('sha256')
+            .update(`${args.baseUrl}\n${sha256}\n${process.env['OPENWOP_REQUIRE_BEHAVIOR'] ?? ''}`, 'utf8')
+            .digest('hex');
+        const requirements = [
+            ...passed.map((f) => ({
+                requirementId: `openwop.scenario.${f.replace(/\.test\.ts$/, '')}`,
+                scenarioId: f,
+                disposition: 'executed-pass',
+            })),
+            ...failed.map((f) => ({
+                requirementId: `openwop.scenario.${f.replace(/\.test\.ts$/, '')}`,
+                scenarioId: f,
+                disposition: 'executed-fail',
+                detail: 'the scenario executed and failed',
+            })),
+            ...skipped.map((f) => ({
+                requirementId: `openwop.scenario.${f.replace(/\.test\.ts$/, '')}`,
+                scenarioId: f,
+                disposition: 'blocked',
+                detail: 'runner cannot classify a skipped file: the RFC 0148 §A requirement ledger is not ' +
+                    'populated during a run, so skipped/inapplicable/blocked are indistinguishable here. ' +
+                    '§A resolves an unclassifiable requirement to `blocked`, never to a pass.',
+            })),
+        ];
+        const v2 = {
+            bundleVersion: '2',
+            generatedAt: new Date().toISOString(),
+            generator: { name: '@openwop/openwop-conformance --certify', version },
+            suite: { package: '@openwop/openwop-conformance', version },
+            host,
+            discovery: { url: discoveryUrl, sha256, document },
+            claimedProfiles,
+            results: {
+                totals: {
+                    executedPass: passed.length,
+                    executedFail: failed.length,
+                    skipped: 0,
+                    inapplicable: 0,
+                    blocked: skipped.length,
+                },
+                requirements,
+            },
+            scenarioManifestSha256: manifestSha,
+            targetConfigurationSha256: configSha,
+        };
+        const v2Schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'certification-bundle-v2.schema.json'), 'utf8'));
+        const v2Ajv = new Ajv2020({ allErrors: true, strict: false });
+        addFormats(v2Ajv);
+        const v2Validate = v2Ajv.compile(v2Schema);
+        if (!v2Validate(v2)) {
+            process.stderr.write('openwop-conformance --certify: assembled v2 bundle FAILED schema validation:\n' +
+                `${JSON.stringify(v2Validate.errors, null, 2)}\n`);
+            process.exit(2);
+        }
+        writeFileSync(outPath, `${JSON.stringify(v2, null, 2)}\n`);
+        process.stdout.write(`openwop-conformance --certify: wrote bundle v2 to ${outPath}\n` +
+            `  host: ${host.name}@${host.version}\n` +
+            `  executed-pass ${passed.length} / executed-fail ${failed.length} / blocked ${skipped.length}\n` +
+            (skipped.length > 0
+                ? `  NOTE: ${skipped.length} requirement(s) are 'blocked', not 'skipped'. The runner cannot\n` +
+                    `  classify a skipped file until scenarios record into the RFC 0148 §A ledger, and §A\n` +
+                    `  resolves an unclassifiable requirement to 'blocked' rather than to a pass. A bundle\n` +
+                    `  with blocked > 0 does NOT certify — that is the true state of the evidence, not a\n` +
+                    `  defect in this emitter.\n`
+                : ''));
+        process.exit(failed.length > 0 ? 1 : 0);
+    }
     // (e) Validate against the bundle schema BEFORE writing.
     const schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'conformance-certification-bundle.schema.json'), 'utf8'));
     const ajv = new Ajv2020({ allErrors: true, strict: false });

package/dist/lib/profiles.js

@@ -38,6 +38,13 @@ function isStringArray(value) {
 function isNonNegativeInteger(value) {
     return typeof value === 'number' && Number.isInteger(value) && value >= 0;
 }
+/**
+ * RFC 0149 §C — `protocolVersion` is ASCII `<major>.<minor>`, no leading zero
+ * except zero itself. Kept identical to the `pattern` in
+ * `schemas/capabilities.schema.json`; `protocol-version-grammar.test.ts` asserts
+ * the two agree, so this cannot drift into being the looser of the pair again.
+ */
+const PROTOCOL_VERSION_GRAMMAR = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
 /**
  * `openwop-core` predicate. Every other profile implies `openwop-core`. A host
  * that fails this predicate is not openwop-compatible.
@@ -47,7 +54,14 @@ function isNonNegativeInteger(value) {
 export function isCore(c) {
     if (typeof c.protocolVersion !== 'string')
         return false;
-    if (!c.protocolVersion.startsWith('1.'))
+    // RFC 0149 §C. `startsWith('1.')` admitted `1.0.0` and `1.banana` while
+    // rejecting `1`, so the predicate deciding whether a host is openwop-compatible
+    // at all was looser than the schema every host validates against. The major is
+    // the hard boundary; a higher minor stays core under v1 additive rules.
+    const version = PROTOCOL_VERSION_GRAMMAR.exec(c.protocolVersion);
+    if (version === null)
+        return false;
+    if (version[1] !== '1')
         return false;
     if (!Array.isArray(c.supportedEnvelopes))
         return false;
@@ -437,6 +451,42 @@ export const PROFILE_FLOOR_SCENARIOS = {
         ],
         requiredAnyPrefix: ['interrupt-'],
     },
+    // ── Floors TRANSCRIBED from `profiles.md`, not invented here ────────────────
+    // `profiles.md` §"Claiming vs passing" already states the rule normatively:
+    // "A host CLAIMS a profile by satisfying its predicate AND passing the
+    // conformance scenarios labelled with the profile tag." Each per-profile
+    // section then names its scenarios. This map was an incomplete transcription
+    // of that prose, and every profile it omitted verified as floor-proven
+    // against nothing (RFC 0148 §C, gap G6).
+    // `profiles.md` §`openwop-core` is a pure discovery-payload predicate — it
+    // names no runtime scenario, so the predicate IS the whole claim.
+    'openwop-core': { required: [], discoveryOnly: true },
+    // `profiles.md` §`openwop-fixtures`: "The profile is discovery-payload-only —
+    // it confirms the host claims SOME fixture, not that any specific fixture is
+    // wired."
+    'openwop-fixtures': { required: [], discoveryOnly: true },
+    // `profiles.md` §`openwop-stream-sse`: "A host passes `openwop-stream-sse`
+    // when discovery passes the predicate AND those scenarios pass."
+    'openwop-stream-sse': {
+        required: ['stream-modes.test.ts', 'stream-modes-buffer.test.ts', 'stream-modes-mixed.test.ts'],
+    },
+    // `profiles.md` §`openwop-stream-poll`: "Conformance scenarios in
+    // `stream-modes.test.ts` exercise polling."
+    'openwop-stream-poll': { required: ['stream-modes.test.ts'] },
+    // `profiles.md` §`openwop-node-packs`: "a host passes `openwop-node-packs`
+    // when it passes those scenarios."
+    'openwop-node-packs': { required: ['pack-registry.test.ts', 'pack-registry-publish.test.ts'] },
+    // ── Deliberately NOT transcribed ───────────────────────────────────────────
+    // `openwop-replay-fork` cannot be expressed by this model. `profiles.md`
+    // §`openwop-replay-fork` says "Hosts MAY support either or both modes; the
+    // conformance scenarios pass on whichever mode the host advertises" — a floor
+    // conditional on the advertised mode, which a flat `required[]` cannot state.
+    // Forcing it would either over-require (failing an honest single-mode host) or
+    // under-require (the vacuity this fix removes). It stays unspecified, and is
+    // therefore unprovable, until the model can express a discovery-conditional
+    // floor. Same for `openwop-interrupts`, `openwop-secrets`,
+    // `openwop-provider-policy`, `openwop-memory`, and `openwop-trigger-bridge`,
+    // whose prose sections do not yet name a settled floor set.
 };
 /** Is `profile` derivable from a discovery document? Maps a profile name to its predicate (RFC 0089 §B(1)). */
 export function profileDerivable(c, profile) {
@@ -457,11 +507,27 @@ const scenarioBasename = (id) => id.split('/').pop() ?? id;
 export function verifyBundleProfile(bundle, profile) {
     const derivable = profileDerivable(bundle.discovery.document, profile);
     const floor = PROFILE_FLOOR_SCENARIOS[profile];
+    // An UNDEFINED floor set makes §B(2) unevaluable, so the claim is unprovable —
+    // never proven. Reading the old code, `missingFloor` fell to `[]` and
+    // `prefixOk` to `[].every(...)` === true, so `floorProven` came out TRUE for
+    // every profile this map omitted: the verifier reported a claim as floor-proven
+    // having checked nothing. An empty floor that is a real decision says so with
+    // `discoveryOnly` (RFC 0148 §C, gap G6).
+    if (floor === undefined) {
+        return { profile, derivable, floorProven: false, valid: false, missingFloor: [], floorUnspecified: true };
+    }
     const passed = new Set(bundle.results.passed.map(scenarioBasename));
-    const missingFloor = floor ? floor.required.filter((r) => !passed.has(scenarioBasename(r))) : [];
-    const prefixOk = (floor?.requiredAnyPrefix ?? []).every((p) => [...passed].some((s) => s.startsWith(p)));
+    const missingFloor = floor.required.filter((r) => !passed.has(scenarioBasename(r)));
+    const prefixOk = (floor.requiredAnyPrefix ?? []).every((p) => [...passed].some((s) => s.startsWith(p)));
     const floorProven = missingFloor.length === 0 && prefixOk;
-    return { profile, derivable, floorProven, valid: derivable && floorProven, missingFloor };
+    return {
+        profile,
+        derivable,
+        floorProven,
+        valid: derivable && floorProven,
+        missingFloor,
+        floorUnspecified: false,
+    };
 }
 /** Verify every profile in `bundle.claimedProfiles`; the bundle is valid iff all claims are valid. */
 export function verifyBundle(bundle) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.72.2",
+  "version": "1.98.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -20,6 +20,7 @@
     "coverage.md",
     "api",
     "schemas",
+    "vectors",
     "vitest.config.ts",
     "README.md",
     "CHANGELOG.md",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.72.2",
-  "corpusCommit": "e58d3553617279966cb010b68d7ac4caf8110ec7"
+  "suiteVersion": "1.98.0",
+  "corpusCommit": "74e2402caae98a97d16a2d8d56f1b46aae759741"
 }

package/schemas/README.md

@@ -87,6 +87,8 @@
 | `suspend-request.schema.json` | `interrupt.md` | `InterruptPayload` with 8 `kind` discriminators (approval, clarification, external-event, custom, conversation.start, conversation.exchange, conversation.close, low-confidence) |
 | `workflow-chain-pack-manifest.schema.json` | `workflow-chain-packs.md` + RFC 0013 | Manifest for workflow-chain packs (`kind: "workflow-chain"`) — pre-configured DAG fragments expanded inline at workflow-author time. Peer to `node-pack-manifest.schema.json`; disjoint via the `kind` discriminator. |
 | `workflow-definition.schema.json` | `channels-and-reducers.md` + `node-packs.md` | DAG of nodes + edges + triggers + variables + channels |
+| `certification-bundle-v2.schema.json` | `profiles.md` + RFC 0148 §C | Certification bundle v2 — per-requirement dispositions instead of pass/fail/skip file lists. `blocked` is a REQUIRED total because `blocked: 0` asserted differs from `blocked` unstated, and `assertionCount` makes an `executed-pass` that ran nothing visible in the artifact |
+| `workload-identity.schema.json` | `auth.md` + RFC 0154 §A/§B | Verified workload identity + delegated actor chain. Closed by design: raw certificates, tokens, proofs, and credentials MUST NOT enter these objects — `subject` is opaque and `proofRef`/`thumbprintRef` are digest references, because these objects reach events, spans, and audit records |
 | `workspace-file.schema.json` | `agent-workspace.md` + `RFCS/0059` | RFC 0059 — a versioned workspace file (`{path, content, version, etag, updatedAt}`); response of `GET/PUT /v1/host/workspace/files/{path}`. |
 | `workspace-file-create.schema.json` | `agent-workspace.md` + `RFCS/0059` | RFC 0059 — `PUT /v1/host/workspace/files/{path}` request body (content + optional contentType; path from the URL, version/etag host-assigned). |