@openwop/openwop-conformance 2.0.0-rc.36 → 2.0.0-rc.38

package/README.md

@@ -112,7 +112,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 501 scenario files under `src/scenarios/`.
+The current suite has 502 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -457,7 +457,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 501 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 502 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.36",
-  "stampSha256": "afc57592632f2df6e2952a1660ce309ee26f53ec80a250ad54cef8e4ef7deb5b"
+  "version": "2.0.0-rc.38",
+  "stampSha256": "3fe6266c2542cbeb718b22938297cba87b0deb4567b213dbef983a51d2b35155"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.36",
+  "version": "2.0.0-rc.38",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.36"
+    "@openwop/spec-artifacts": "2.0.0-rc.38"
   }
 }

package/requirements.json

@@ -2,9 +2,9 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 548,
-    "tests": 2124,
-    "withStableId": 2124,
+    "files": 549,
+    "tests": 2125,
+    "withStableId": 2125,
     "interpolatedTitles": 0,
     "explicitIds": 2057
   },
@@ -28038,6 +28038,35 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-stream-sse-projection.every-data-frame-on-the-major-2-stream-carries-the-tenant-bound-runid-of-the-run",
+      "file": "v2-stream-sse-projection.test.ts",
+      "line": 52,
+      "title": "every data: frame on the major-2 stream carries the tenant-bound runId of the run it belongs to",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/identity.md §5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-subject-link-record.the-link-formed-across-scim-and-saml-is-a-closed-subjectlink-record",
       "file": "v2-subject-link-record.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 501,
+    "files": 502,
     "v1": 445,
-    "v2": 57
+    "v2": 58
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1378,6 +1378,9 @@
     "v2-run-completed-outputs.test.ts": [
       2
     ],
+    "v2-stream-sse-projection.test.ts": [
+      2
+    ],
     "v2-subject-link-record.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.36",
+  "version": "2.0.0-rc.38",
   "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -9,9 +9,9 @@
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "af0bc199ac9384a6ff0bc2dda73dcb8a8176763330756cc46f7d389126c2e513",
-    "api/v2/asyncapi.yaml": "2974d731f5d92653cc26dacdfe35104c8e74cab123da584fb2d685640c1bf0b8",
-    "api/v2/openapi.yaml": "dee5db929108e50fc9433fdcabb8c7665daea20f714e49e887b114235e8099f3",
+    "api/seams-v2.yaml": "6a9d80a1b6e0854f31a49d3cf24b74c9f9d7fb3bf667fa4fafbad0b6d5587cfc",
+    "api/v2/asyncapi.yaml": "593e3bbe491f22b16e814feba6612e3bbdf94b95bbec9257fbf68eb0e5ae185f",
+    "api/v2/openapi.yaml": "975bdab57e6ce837a615e32f4284b1de9701155dcdf208b89da28cc9a9839330",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "af48f700b3e6c2acf63677287bf9527dbe529283e9aef3232c2a11a45162c609",
+    "spec/v1/core-standard-manifest.json": "3ac636a1fa387e3aede5648e1d002873c74ebb90f14aa23cc766fb293c24b38f",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -230,7 +230,7 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "1f0ee40491131cf561ef19a0394c47ba476b4567514fe16befb6cada4a10a5a4",
-    "spec/v2/release.json": "3225ad9993591b0a14ecc529fedceb65d85416cc163489be6d4db6add9f496ba"
+    "spec/v2/release.json": "fa794ab0e06c4a574b7bbd8a207dc131c024ce8ca460e1add3a48659bd35e146"
   },
-  "corpusCommit": "97c824c195cf1dc78436599eedf1fdb455f04584"
+  "corpusCommit": "16c4d2ac92f8af03452ab80880211bbd274eda0d"
 }

package/src/scenarios/v2-stream-sse-projection.test.ts

@@ -0,0 +1,79 @@
+/**
+ * `spec/v2/core/events.md` §SSE frames + `identity.md` §5 — every `data:` frame
+ * on the major-2 run stream names the run by its tenant-bound id (suite 2.0.0,
+ * target major 2; unaided).
+ *
+ * This scenario exists because both production hosts shipped the same defect
+ * and the suite could not see it. Each built one projection seam for the
+ * tenant-bound `runId` and each found an emitter outside it on the stream
+ * path: one host's SSE route had three `res.write` sites and no per-frame
+ * projector at all; the other's per-frame path projected while its `batch`
+ * flush wrote the raw array. Sixteen green mount tests on one host all used
+ * `res.json` handlers. Of the 56 `v2-*` files, none read a stream frame —
+ * `grep -E '^v2-.*(sse|stream)'` was empty — so both defects were invisible to
+ * the suite by construction and were found by a live witness and by a peer's
+ * report. A tier-1 host asked for this file by name.
+ *
+ * The assertion is one line: every frame's `runId` is the bound id the create
+ * returned. It is asserted per frame rather than on the first, because the
+ * batch-flush variant projects the first frame and not the rest.
+ *
+ * @see spec/v2/core/events.md §SSE frames
+ * @see spec/v2/core/identity.md §5
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, v2Validator } from '../lib/v2.js';
+import { streamEvents } from '../lib/era2-seed.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0171.stream-sse-projection';
+const DOC = 'spec/v2/core/events.md §SSE frames';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+const RUN_ID = /^[A-Za-z0-9._~-]{1,128}\/[A-Za-z0-9._~-]{16,128}$/;
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+async function createRun(): Promise<{ runId: string } | { reason: string }> {
+  try { if (!(await v2Discovery())) return { reason: 'v2 discovery unreachable' }; } catch { return { reason: 'v2 discovery unreachable' }; }
+  const res = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }));
+  if (res === null) return { reason: 'POST /runs unreachable (fetch failed)' };
+  const runId = (res.json as { runId?: unknown } | undefined)?.runId;
+  if (res.status !== 201 || typeof runId !== 'string') return { reason: `POST /runs {workflowId: ${NOOP_WORKFLOW_ID}} answered ${res.status} ${readErrorCode(res.json) ?? ''} — the smallest valid create was refused (fixture not seeded?)`.trim() };
+  return { runId };
+}
+
+describe('v2 stream-sse-projection (events.md §SSE frames)', () => {
+  it('every data: frame on the major-2 stream carries the tenant-bound runId of the run it belongs to', async () => {
+    const c = await createRun();
+    if ('reason' in c) return softSkip('blocked', c.reason);
+    expect(RUN_ID.test(c.runId), req(ID, 'spec/v2/core/identity.md §5', `the created runId MUST be tenant-bound before the stream can be held to it (got ${c.runId})`)).toBe(true);
+
+    const s = await streamEvents(c.runId);
+    if (s === null) return softSkip('blocked', 'GET /runs/{runId}/events (SSE, OpenWOP-Version: 2.0) unreachable (fetch failed)');
+    if (s.status !== 200) return softSkip('blocked', `GET /runs/{runId}/events (SSE) answered ${s.status} for the run just created`);
+    if (s.events.length === 0) return softSkip('blocked', 'the stream delivered no data: frames within the window — nothing to hold to the grammar');
+
+    const validate = v2Validator('run-event');
+    let i = 0;
+    for (const ev of s.events) {
+      i += 1;
+      const rid = (ev as { runId?: unknown }).runId;
+      expect(
+        typeof rid === 'string' && RUN_ID.test(rid),
+        req(ID, DOC, `frame ${i} (${String((ev as { type?: unknown }).type)}): data.runId MUST be tenant-bound <tenantId>/<opaque> (identity.md §5) — a stream frame is a rendering of the run event and every rendering of a v2 runId uses the same grammar; a bare storage id here is the projection seam missing the stream path (got ${JSON.stringify(rid)})`),
+      ).toBe(true);
+      expect(
+        rid,
+        req(ID, DOC, `frame ${i}: data.runId MUST be the run's own bound id — asserted on EVERY frame, not the first, because a batch flush that skips the per-frame projector projects frame 1 and not the rest`),
+      ).toBe(c.runId);
+      const r = validate(ev);
+      expect(r.ok, req(ID, DOC, `frame ${i}: data MUST be a valid RunEventDoc (run-event.schema.json) — ${r.errors}`)).toBe(true);
+    }
+  });
+});

package/src/setup.ts

@@ -40,6 +40,8 @@ import { softSkipDisposition } from './lib/soft-skip.js';
 import { ItIdAllocator, takeExplicitRequirementId } from './lib/requirement-ids.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './lib/spec-coherence.js';
 import type { DiscoveryPayload } from './lib/profiles.js';
+import { targetMajor } from './lib/seams.js';
+import { softSkip } from './lib/soft-skip.js';
 
 const SUITE_INIT_TIMEOUT_MS = 5_000;
 
@@ -277,6 +279,62 @@ function _fileOf(task: { file?: { filepath?: string; name?: string } } | undefin
   const f = task?.file?.filepath ?? task?.file?.name;
   return typeof f === 'string' && f.length > 0 ? basename(f) : null;
 }
+// ---------------------------------------------------------------------------
+// The applicability check and the assertion MUST run under the same contract.
+//
+// A scenario's registration in scenario-majors.json says which target majors it
+// is written for. The driver reads OPENWOP_TARGET_MAJOR to decide which header
+// and path space every probe uses. Nothing connected the two: a lane that ran
+// vitest directly over all 501 files at the default (major 1) executed every
+// major-2 scenario with major-1 requests. The scenarios' own gates call
+// v2Discovery(), which sets the header EXPLICITLY, so the gate passed and the
+// probe went out as v1 — a check that proved the host speaks v2 with one
+// request, then tested a v2 requirement with a request that did not.
+//
+// Measured on a tier-1 host 2026-09-04: three "host defects" reported from that
+// lane, all of which evaporated at major 2; the host was one edit from "fixing"
+// correct behaviour. And in the other direction: 4 of 56 v2 files fail on every
+// host forever under a major-1 driver, so a gate that runs them that way is red
+// by construction and gets reasoned past. Both are the same defect: a scoped
+// signal read as unscoped, with the scope nowhere in the output.
+//
+// So: a file whose registered majors do not include the driver's target major
+// is INAPPLICABLE to this lane, recorded as such with the reason, and never
+// probes. Files not in the registry (coherence checks, lib tests) are untouched.
+// ---------------------------------------------------------------------------
+const SCENARIO_MAJORS: Record<string, number[]> = (() => {
+  try {
+    const p = join(PKG_ROOT_PATH, 'scenario-majors.json');
+    if (!existsSync(p)) return {};
+    return (JSON.parse(readFileSync(p, 'utf8')) as { majors?: Record<string, number[]> }).majors ?? {};
+  } catch {
+    return {};
+  }
+})();
+
+beforeEach((ctx) => {
+  const p = (expect.getState() as { testPath?: string }).testPath;
+  if (!p) return;
+  const file = basename(p);
+  const majors = SCENARIO_MAJORS[file];
+  if (!majors) return;
+  const lane = targetMajor();
+  if (majors.includes(lane)) return;
+  const detail = `registered for target major ${majors.join('/')} and this lane runs at major ${lane} (OPENWOP_TARGET_MAJOR) — the probe would go out under a contract the scenario's gate does not use; select files with --target-major or set the variable`;
+  // Two records, one per resolver. The per-TEST disposition is read from the
+  // requirement journal (the same entry behaviorGate writes), so the row lands
+  // as `inapplicable` with this reason rather than `skipped`, which under RFC
+  // 0148 would claim the operator opted out. The per-FILE note covers the
+  // all-skipped fallback in resolveFileRecord.
+  try {
+    recordRequirement('openwop.family.lane-target-major', 'inapplicable', detail, { scenarioFile: file });
+  } catch {
+    /* never fail a test for bookkeeping */
+  }
+  softSkip('inapplicable', detail);
+  ctx.skip();
+});
+
 beforeAll(({}, suite) => {
   // Mark the ledger journal BEFORE the file's tests run, so a behaviorGate
   // decision made by the very first test is inside the file's window.