@openwop/openwop-conformance 2.0.0-rc.12 → 2.0.0-rc.13

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.12",
-  "stampSha256": "cda7124d9d13d004d4ff83279fefe6e4a9852b2c9ef566ae438f0eb1e70ea440"
+  "version": "2.0.0-rc.13",
+  "stampSha256": "70588d48596c9141975f89d3116b8fdc93d61d5faf5a93a7be6b9100d4e7311c"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.12",
+  "version": "2.0.0-rc.13",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.12"
+    "@openwop/spec-artifacts": "2.0.0-rc.13"
   }
 }

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.12",
+  "version": "2.0.0-rc.13",
   "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -9,9 +9,9 @@
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "4e443d61b3466da934f5afea3253f5dff0f8131f7201eb9f6102aebcf9d9b238",
-    "api/v2/asyncapi.yaml": "39862fff36dcc6bafe779c56b4b1b7e5147bf5cc213a8ebee99320cefe41fe81",
-    "api/v2/openapi.yaml": "8ac2bf487ab382ce9063ede04daa0bdcbf14da28af6aceb5fa9daa10024795da",
+    "api/seams-v2.yaml": "fd9b0ac5fad1dbcde81c072480ab1b2054dfac801620f4b0a56cce293dd55ecf",
+    "api/v2/asyncapi.yaml": "17c9e96919f050e77a290025ae77f69420a835790e8a434fadea242445f6bdca",
+    "api/v2/openapi.yaml": "d187a8e648c4db4981dd8b73abbc7b10346febaa30124c7413de7d4f78f56b04",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -198,7 +198,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "2fcd8083ac9a1ebf8ef0b83aebbcb9c19e4d217d54e46fa4db2c020494964da1",
+    "spec/v1/core-standard-manifest.json": "10b5c192827884300f77b1bd481fdb70e8fccf0b636c2e37d0a3834497ce508a",
     "spec/v1/deprecations.json": "520d79927a8ed43ccf62c207a7cf6cf7b19b16e00bbbbdf0410667e939c19d85",
     "spec/v1/deprecations.schema.json": "4cdbbb8eb9c0092913a5704c943880f0c8581bcf0f640a7df5a84105d53c8aee",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -228,7 +228,7 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "1f0ee40491131cf561ef19a0394c47ba476b4567514fe16befb6cada4a10a5a4",
-    "spec/v2/release.json": "4f2df9ae2dc2975624da0cd2be429b4c6d4575de1c97bb860144f458063cc8ee"
+    "spec/v2/release.json": "c5a7d6f086e6d9bce497e2c21fe5a1f11d96533f30b5596f3332ad1a77898a9b"
   },
-  "corpusCommit": "88ee26171cb6c6e2f4d74576e09a559099b5f284"
+  "corpusCommit": "ef6f06aafc7265609229411a104d00546fe25074"
 }

package/src/global-setup.ts

@@ -75,6 +75,17 @@ export function setup(): void {
   // Suite 2.0.0: in the published layout the contract is the spec-artifacts peer (RFC 0168 §D.2).
   const stamp = LAYOUT === 'published' ? verifyPeerContract(PKG_ROOT_PATH) : verifyCorpusStamp(PKG_ROOT_PATH, LAYOUT);
   process.stderr.write(`${describeVerdict(stamp)}\n`);
+  // A version skew and a digest mismatch both have to refuse, but they are
+  // different faults with different fixes, and reporting them in the same words
+  // sends the reader to debug a corrupt install when nothing is corrupt.
+  if (stamp.kind === 'peer-version') {
+    throw new Error(
+      `openwop-conformance: refusing to run — this suite was packed against @openwop/spec-artifacts@${stamp.lockVersion}, ` +
+      `but @openwop/spec-artifacts@${stamp.peerVersion} is installed. They are declared EXACT peers. ` +
+      `Install both at the same explicit version; do NOT install at a dist-tag such as \`next\`, which moves per package ` +
+      `and can name a pair that was never published together.`,
+    );
+  }
   if (stamp.kind === 'mismatch') {
     throw new Error('openwop-conformance: refusing to run — schemas/CORPUS-STAMP.json digests do not match the vendored api/ + schemas/ files. Reinstall the package; do not hand-patch vendored contract files.');
   }

package/src/lib/corpus-stamp.ts

@@ -39,7 +39,17 @@ export interface CorpusStamp {
 export type StampVerdict =
   | { readonly kind: 'verified'; readonly files: number }
   | { readonly kind: 'not-applicable'; readonly reason: string }
-  | { readonly kind: 'mismatch'; readonly missing: readonly string[]; readonly altered: readonly string[]; readonly extra: readonly string[] };
+  | { readonly kind: 'mismatch'; readonly missing: readonly string[]; readonly altered: readonly string[]; readonly extra: readonly string[] }
+  /**
+   * The peer is INSTALLED and INTACT but is a different version than the suite
+   * was packed against. Its own kind because the remedy is completely different
+   * from a digest mismatch — nothing is corrupt, two versions are simply out of
+   * step — and because the generic message sends readers to debug a broken
+   * install. Reported by a tier-2 host that hit it through the `next` dist-tag:
+   * the tag moves per package, so `@next` can name an exact-peer PAIR that was
+   * never published together.
+   */
+  | { readonly kind: 'peer-version'; readonly peerVersion: string; readonly lockVersion: string };
 
 export const STAMP_RELATIVE_PATH = join('schemas', 'CORPUS-STAMP.json');
 
@@ -94,7 +104,11 @@ export function verifyPeerContract(pkgRoot: string): StampVerdict {
   if (!existsSync(stampPath)) return { kind: 'mismatch', missing: ['@openwop/spec-artifacts/CORPUS-STAMP.json'], altered: [], extra: [] };
   const stamp = JSON.parse(readFileSync(stampPath, 'utf8')) as { package: string; version: string; files: Record<string, string> };
   const digest = createHash('sha256').update(JSON.stringify({ package: stamp.package, version: stamp.version, files: stamp.files })).digest('hex');
-  if (stamp.version !== lock.version || digest !== lock.stampSha256) return { kind: 'mismatch', missing: [], altered: [`@openwop/spec-artifacts ${stamp.version} (digest ${digest.slice(0, 12)}) ≠ the suite's lock ${lock.version} (${lock.stampSha256.slice(0, 12)})`], extra: [] };
+  // A plain version difference is NOT corruption; report it as itself so the
+  // message names the two versions and the fix, instead of sending the reader
+  // to hunt a damaged install.
+  if (stamp.version !== lock.version) return { kind: 'peer-version', peerVersion: stamp.version, lockVersion: lock.version };
+  if (digest !== lock.stampSha256) return { kind: 'mismatch', missing: [], altered: [`@openwop/spec-artifacts ${stamp.version} stamp digest ${digest.slice(0, 12)} ≠ the suite's lock ${lock.stampSha256.slice(0, 12)} — same version, different contents`], extra: [] };
   const missing: string[] = []; const altered: string[] = [];
   for (const [rel, d] of Object.entries(stamp.files)) { const p = join(peerRoot, ...rel.split('/')); if (!existsSync(p)) missing.push(rel); else if (sha256File(p) !== d) altered.push(rel); }
   if (missing.length || altered.length) return { kind: 'mismatch', missing, altered, extra: [] };
@@ -143,6 +157,14 @@ export function describeVerdict(v: StampVerdict): string {
       return `[openwop-conformance] corpus stamp VERIFIED — ${v.files} vendored api/ + schemas/ files match their SHA-256 digests`;
     case 'not-applicable':
       return `[openwop-conformance] corpus stamp not checked — ${v.reason}`;
+    case 'peer-version':
+      return (
+        `[openwop-conformance] peer version MISMATCH — this suite was packed against ` +
+        `@openwop/spec-artifacts@${v.lockVersion} but @openwop/spec-artifacts@${v.peerVersion} is installed. ` +
+        `Nothing is corrupt: the two are declared EXACT peers and are simply out of step. ` +
+        `Install both at the same explicit version — never at a dist-tag such as \`next\`, which moves per package ` +
+        `and can therefore name a pair that was never published together.`
+      );
     case 'mismatch':
       return (
         `[openwop-conformance] corpus stamp MISMATCH — the vendored contract is not the one this suite shipped ` +