@openwop/openwop-conformance 2.0.0-rc.3 → 2.0.0-rc.32

package/README.md

@@ -112,7 +112,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 495 scenario files under `src/scenarios/`.
+The current suite has 500 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -457,7 +457,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 495 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 500 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.3",
-  "stampSha256": "b34c4d48c32a17887eee8a62841993f3fb19565c97ce602f35d682ed26ff0709"
+  "version": "2.0.0-rc.32",
+  "stampSha256": "d41a3ce46221d2c4f89352e86d67e3d700e104a6fd7416faaf219bbbac334e6d"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.3",
+  "version": "2.0.0-rc.32",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.3"
+    "@openwop/spec-artifacts": "2.0.0-rc.32"
   }
 }

package/requirements.json

@@ -2,9 +2,9 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 539,
-    "tests": 2108,
-    "withStableId": 2108,
+    "files": 547,
+    "tests": 2123,
+    "withStableId": 2123,
     "interpolatedTitles": 0,
     "explicitIds": 2057
   },
@@ -12262,6 +12262,58 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.era-key-stamped-v1.a-run-the-host-just-created-carries-eventlogschemaversion",
+      "file": "era-key-stamped-v1.test.ts",
+      "line": 75,
+      "title": "a run the host just created carries eventLogSchemaVersion",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "every persisted run document MUST carry an eventLogSchemaVersion — the field is prose-only (run-snapshot.schema.json requires just runId, workflowId and status), so a snapshot without it validates cleanly and only this check can see its absence",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.era-key-stamped-v1.a-freshly-created-run-is-not-classified-legacy-by-the-host-s-own-rule",
+      "file": "era-key-stamped-v1.test.ts",
+      "line": 98,
+      "title": "a freshly created run is not classified legacy by the host's own rule",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v1/version-negotiation.md §Legacy detection",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.era-key-stamped-v1.a-run-the-host-just-created-carries-engineversion-the-legacy-escape-cannot-reach",
+      "file": "era-key-stamped-v1.test.ts",
+      "line": 124,
+      "title": "a run the host just created carries engineVersion — the legacy escape cannot reach it",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "every persisted run document MUST carry engineVersion; the \"MAY omit\" escape applies only to legacy runs that predate the contract, and this run was created moments ago",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.errors.get-v1-runs-nonexistentid-returns-canonical-envelope",
       "file": "errors.test.ts",
@@ -25741,6 +25793,39 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-advertised-fixtures-exist.a-sampled-advertised-fixture-is-actually-creatable-not-just-listed",
+      "file": "v2-advertised-fixtures-exist.test.ts",
+      "line": 62,
+      "title": "a sampled advertised fixture is actually creatable, not just listed",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-advertised-path-space-served.a-host-advertising-major-2-reaches-the-surfaces-it-already-serves-under-v1",
+      "file": "v2-advertised-path-space-served.test.ts",
+      "line": 87,
+      "title": "a host advertising major 2 reaches the surfaces it already serves under /v1",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "at least one non-well-known surface MUST be reachable under major 2, or the advertisement rests entirely on the one resource the header selects",
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-approver-enforced.a-resolver-outside-approverslist-is-refused-at-resolve-time",
       "file": "v2-approver-enforced.test.ts",
@@ -26243,7 +26328,8 @@
         },
         {
           "section": "spec/v2/core/versioning.md §5",
-          "requirement": "the v2 read MUST name the same run"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "spec/v2/core/versioning.md §1.4",
@@ -26254,7 +26340,7 @@
     {
       "id": "openwop.it.v2-dual-stack-negotiation.an-unlisted-major-is-406-protocol-version-unsupported-with-details-protocolversi",
       "file": "v2-dual-stack-negotiation.test.ts",
-      "line": 83,
+      "line": 111,
       "title": "an unlisted major is 406 protocol_version_unsupported with details.protocolVersions[]",
       "explicitId": "openwop.requirement.0172.dual-stack-negotiation.unlisted-major",
       "citations": [
@@ -26278,7 +26364,7 @@
     {
       "id": "openwop.it.v2-dual-stack-negotiation.openwop-version-2-0-on-a-v1-path-is-400-protocol-version-mismatch",
       "file": "v2-dual-stack-negotiation.test.ts",
-      "line": 94,
+      "line": 122,
       "title": "OpenWOP-Version: 2.0 on a /v1/ path is 400 protocol_version_mismatch",
       "explicitId": "openwop.requirement.0172.dual-stack-negotiation.v1-path-mismatch",
       "citations": [
@@ -26297,7 +26383,7 @@
     {
       "id": "openwop.it.v2-dual-stack-negotiation.every-response-reports-the-contract-that-produced-it",
       "file": "v2-dual-stack-negotiation.test.ts",
-      "line": 103,
+      "line": 131,
       "title": "every response reports the contract that produced it",
       "explicitId": "openwop.requirement.0172.dual-stack-negotiation.response-header",
       "citations": [
@@ -26533,7 +26619,7 @@
     {
       "id": "openwop.it.v2-era-2-append-vocabulary.the-run-keeps-the-era-it-was-created-with-an-append-does-not-promote-it-to-era-3",
       "file": "v2-era-2-append-vocabulary.test.ts",
-      "line": 119,
+      "line": 128,
       "title": "the run keeps the era it was created with; an append does not promote it to era 3",
       "explicitId": null,
       "citations": [
@@ -26587,6 +26673,44 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-era-stamp-universal.discovery-advertises-an-era-the-host-actually-writes-and-a-new-run-carries-it",
+      "file": "v2-era-stamp-universal.test.ts",
+      "line": 40,
+      "title": "discovery advertises an era the host actually writes, and a new run carries it",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-era-stamp-universal.a-v2-era-host-stamps-3-so-its-new-runs-are-never-read-as-the-v1-era",
+      "file": "v2-era-stamp-universal.test.ts",
+      "line": 80,
+      "title": "a v2-era host stamps 3, so its new runs are never read as the v1 era",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a host advertising era 3 MUST stamp 3 on every run it creates — an unstamped run made after the cut is indistinguishable from a pre-cut run and every reader translates it as era 2, which is a silent wrong read rather than an error",
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-error-registry.an-error-response-is-the-closed-envelope-with-a-registered-code-at-its-registere",
       "file": "v2-error-registry.test.ts",
@@ -28058,6 +28182,49 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-version-header-honored.openwop-version-is-honored-or-refused-never-ignored",
+      "file": "v2-version-header-honored.test.ts",
+      "line": 61,
+      "title": "OpenWOP-Version is honored or refused — never ignored",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a host that does not serve major 2 MUST refuse with 406 protocol_version_unsupported, which it did",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "answering 200 to OpenWOP-Version: 2.0 with a body byte-identical to the header-less fetch means the header was IGNORED, not honored — the host served v1 and called it v2. Refusing with 406 is the correct answer for a host that does not implement major 2; silently returning v1 is the one answer that no presence-gated scenario can detect, because an absent v2 shape records `inapplicable` whether the host refused or ignored",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-version-header-honored.a-host-advertising-two-majors-serves-two-different-representations",
+      "file": "v2-version-header-honored.test.ts",
+      "line": 92,
+      "title": "a host advertising two majors serves two different representations",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the v1 document and the closed v2 root differ by construction (capabilities.md §1), so a host advertising both majors returning identical bytes for both has advertised a major it does not actually serve",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
@@ -28311,7 +28478,7 @@
     {
       "id": "openwop.it.version-negotiation.get-well-known-openwop-returns-capabilities-with-protocolversion-string",
       "file": "version-negotiation.test.ts",
-      "line": 46,
+      "line": 68,
       "title": "GET /.well-known/openwop returns Capabilities with protocolVersion (string)",
       "explicitId": "openwop.it.version-negotiation.get-well-known-openwop-returns-capabilities-with-protocolversion-string",
       "citations": [
@@ -28324,7 +28491,7 @@
     {
       "id": "openwop.it.version-negotiation.every-event-has-the-6-required-runeventdoc-fields-per-run-event-schema-json",
       "file": "version-negotiation.test.ts",
-      "line": 60,
+      "line": 82,
       "title": "every event has the 6 required RunEventDoc fields per run-event.schema.json",
       "explicitId": "openwop.it.version-negotiation.every-event-has-the-6-required-runeventdoc-fields-per-run-event-schema-json",
       "citations": [
@@ -28365,7 +28532,7 @@
     {
       "id": "openwop.it.version-negotiation.event-sequences-within-a-run-are-strictly-monotonic",
       "file": "version-negotiation.test.ts",
-      "line": 104,
+      "line": 126,
       "title": "event sequences within a run are strictly monotonic",
       "explicitId": "openwop.it.version-negotiation.event-sequences-within-a-run-are-strictly-monotonic",
       "citations": [
@@ -28379,7 +28546,7 @@
     {
       "id": "openwop.it.version-negotiation.events-poll-with-lastsequence-past-current-end-returns-empty-events-iscomplete",
       "file": "version-negotiation.test.ts",
-      "line": 132,
+      "line": 154,
       "title": "events/poll with lastSequence past current end returns empty events + isComplete",
       "explicitId": "openwop.it.version-negotiation.events-poll-with-lastsequence-past-current-end-returns-empty-events-iscomplete",
       "citations": [
@@ -34426,6 +34593,82 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-v2-discovery-root-publishes-signingkeys-the-surface-the-rfc-named",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 103,
+      "title": "the v2 discovery root publishes signingKeys[] — the surface the RFC named",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the v2 discovery root MUST carry signingKeys[] — RFC 0168 disposed of \"an Ed25519 attestation without a key registry is a signature nobody can check\" by naming this surface, so if it is absent the disposition names a place that does not exist and every bundle signature is unattributable",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a signingKeys[] entry MUST be closed; an open key record lets a host attach meaning the verifier does not read",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a signingKeys[] entry MUST be able to record retirement, because a retired key has to stay listed — dropping it silently invalidates every bundle it already signed, which is the opposite of what an evidence trail is for",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-front-door-gate-verifies-the-attestation-instead-of-inspecting-the-string",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 134,
+      "title": "the Front-door gate verifies the attestation instead of inspecting the string",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the gate MUST NOT accept a bundle signature by presence: `typeof signature.sig === 'string'` is satisfied by any string, so it cannot distinguish a host key from a keypair minted seconds earlier by whoever wrote the bundle",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the gate MUST resolve signature.keyId against the host's published signingKeys[] and verify the Ed25519 attestation under it — resolving without verifying, or verifying against a key the bundle supplied itself, both leave the signature unaccountable",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-four-signature-outcomes-stay-distinct-collapsing-any-two-restores-the-defect",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 149,
+      "title": "the four signature outcomes stay distinct — collapsing any two restores the defect",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.signingkeys-is-reachable-from-a-v1-root-too-a-bundle-is-v3-regardless-of-major",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 170,
+      "title": "signingKeys[] is reachable from a v1 root too — a bundle is v3 regardless of major",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the v1 discovery root MUST also carry signingKeys[]: a certification bundle is v3 regardless of major, and a v1-only host has only this document to resolve signature.keyId against — putting the key on the v2 root alone leaves every v1 host bundle unattributable",
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-corpus-tag-pinned.every-vendoring-consumer-in-the-cross-repo-inventory-records-a-published-corpus",
       "file": "v2-corpus-tag-pinned.test.ts",
@@ -34454,6 +34697,30 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-error-registry-prose-parity.errors-md-states-the-registry-count-it-was-generated-from-and-renders-every-code",
+      "file": "v2-error-registry-prose-parity.test.ts",
+      "line": 26,
+      "title": "errors.md states the registry count it was generated from and renders every code",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "errors.md states the registry size at least once, so the claim is checkable",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-event-naming-rule.every-closed-enum-v2-event-type-is-two-kebab-segments-and-every-recorded-artifac",
       "file": "v2-event-naming-rule.test.ts",
@@ -34533,6 +34800,20 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-id-kinds-bound.every-v2-id-field-refs-its-kind-and-every-id-property-is-triaged",
+      "file": "v2-id-kinds-bound.test.ts",
+      "line": 57,
+      "title": "every v2 id field $refs its kind, and every *Id property is triaged",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/identity.md §5",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-one-signing-scheme.registry-version-manifest-signing-has-exactly-one-scheme-ed25519-canonical-json",
       "file": "v2-one-signing-scheme.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 495,
-    "v1": 444,
-    "v2": 52
+    "files": 500,
+    "v1": 445,
+    "v2": 56
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -564,6 +564,9 @@
     "envelope-variant-discriminator-static.test.ts": [
       1
     ],
+    "era-key-stamped-v1.test.ts": [
+      1
+    ],
     "errors.test.ts": [
       1
     ],
@@ -1228,6 +1231,12 @@
     "trigger-stream-cdc-sources.test.ts": [
       1
     ],
+    "v2-advertised-fixtures-exist.test.ts": [
+      2
+    ],
+    "v2-advertised-path-space-served.test.ts": [
+      2
+    ],
     "v2-approver-enforced.test.ts": [
       2
     ],
@@ -1273,6 +1282,9 @@
     "v2-era-key.test.ts": [
       2
     ],
+    "v2-era-stamp-universal.test.ts": [
+      2
+    ],
     "v2-error-registry.test.ts": [
       2
     ],
@@ -1375,6 +1387,9 @@
     "v2-v1-signed-webhook-accepted.test.ts": [
       2
     ],
+    "v2-version-header-honored.test.ts": [
+      2
+    ],
     "v2-webhook-durable-delivery.test.ts": [
       2
     ],