@openwop/openwop-conformance 2.0.0-rc.38 → 2.0.0-rc.39

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.38",
-  "stampSha256": "3fe6266c2542cbeb718b22938297cba87b0deb4567b213dbef983a51d2b35155"
+  "version": "2.0.0-rc.39",
+  "stampSha256": "48fe38e1460f068bcfbfd25df16894cca8ad480378f66bc1c8ef154e9c6c412c"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.38",
+  "version": "2.0.0-rc.39",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.38"
+    "@openwop/spec-artifacts": "2.0.0-rc.39"
   }
 }

package/requirements.json

@@ -25810,7 +25810,7 @@
     {
       "id": "openwop.it.v2-advertised-path-space-served.a-host-advertising-major-2-reaches-the-surfaces-it-already-serves-under-v1",
       "file": "v2-advertised-path-space-served.test.ts",
-      "line": 87,
+      "line": 107,
       "title": "a host advertising major 2 reaches the surfaces it already serves under /v1",
       "explicitId": null,
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.38",
+  "version": "2.0.0-rc.39",
   "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -9,9 +9,9 @@
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "6a9d80a1b6e0854f31a49d3cf24b74c9f9d7fb3bf667fa4fafbad0b6d5587cfc",
-    "api/v2/asyncapi.yaml": "593e3bbe491f22b16e814feba6612e3bbdf94b95bbec9257fbf68eb0e5ae185f",
-    "api/v2/openapi.yaml": "975bdab57e6ce837a615e32f4284b1de9701155dcdf208b89da28cc9a9839330",
+    "api/seams-v2.yaml": "23904b23283a4ee111c5289eff8902bf22319dfd804310e47a9f2928ef669aac",
+    "api/v2/asyncapi.yaml": "40b9caf405de92acdfb57952809b77585f61a8696ef369afcdb675e6cad5b4ad",
+    "api/v2/openapi.yaml": "348a67f3bc5813f0ec2553338fc40829695b5aad2dc512a21ac0dca048ec15a7",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "3ac636a1fa387e3aede5648e1d002873c74ebb90f14aa23cc766fb293c24b38f",
+    "spec/v1/core-standard-manifest.json": "5a18865afd4cce904be3cf41f9f3d3f408806a7310015f91fe8b740db4050817",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -230,7 +230,7 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "1f0ee40491131cf561ef19a0394c47ba476b4567514fe16befb6cada4a10a5a4",
-    "spec/v2/release.json": "fa794ab0e06c4a574b7bbd8a207dc131c024ce8ca460e1add3a48659bd35e146"
+    "spec/v2/release.json": "1b7a260912de2445ebf11ec2a88be4e16f0ca19b64a297ced18dce1088fe1d95"
   },
-  "corpusCommit": "16c4d2ac92f8af03452ab80880211bbd274eda0d"
+  "corpusCommit": "29863c56a13b476152ced906d14396ce143ecbe9"
 }

package/src/scenarios/v2-advertised-path-space-served.test.ts

@@ -54,7 +54,7 @@ const DOC = 'spec/v2/core/versioning.md §1.2';
 /** The well-known resource is the one the HEADER selects; it has no /v1 twin to pair against. */
 const NOT_PAIRABLE = new Set(['/.well-known/openwop']);
 
-interface Probe { readonly status: number | null }
+interface Probe { readonly status: number | null; readonly version: string | null; readonly html: boolean }
 
 async function get(path: string, major2: boolean): Promise<Probe> {
   const { baseUrl, apiKey } = loadEnv();
@@ -63,12 +63,32 @@ async function get(path: string, major2: boolean): Promise<Probe> {
   if (apiKey) headers['authorization'] = `Bearer ${apiKey}`;
   try {
     const res = await fetch(`${baseUrl.replace(/\/$/, '')}${path}`, { headers });
-    return { status: res.status };
+    const ct = res.headers.get('content-type') ?? '';
+    return { status: res.status, version: res.headers.get('openwop-version'), html: /text\/html/i.test(ct) };
   } catch {
-    return { status: null };
+    return { status: null, version: null, html: false };
   }
 }
 
+/**
+ * "Reached under major 2" is NOT "any status but 404". A hosting layer in
+ * front of the host answers every unrouted path with `200 text/html` — the
+ * SPA shell — and no `OpenWOP-Version` header, and that satisfied the first
+ * version of this check. Measured 2026-09-05 on a tier-1 host's public origin:
+ * `/.well-known/openwop` and `/v1/**` were rewritten to the backend and every
+ * unversioned major-2 path fell through to `index.html` with a 200, while the
+ * Cloud Run URL one hop behind answered every one correctly. The scenario was
+ * green on production for ten hours because a shell and a mount produced the
+ * same status code. `versioning.md` §1.4 requires `OpenWOP-Version` on every
+ * response; a response without it did not come from the host.
+ */
+function reachedUnderMajor2(p: Probe): boolean {
+  if (p.status === null || p.status === 404) return false;
+  if (p.version === null) return false;
+  if (p.html) return false;
+  return true;
+}
+
 function parameterlessGets(): string[] {
   try {
     const manifest = JSON.parse(
@@ -117,10 +137,15 @@ describe('v2-advertised-path-space-served (RFC 0172 §A.1)', () => {
 
       const v2 = await get(path, true);
       if (v2.status === null) return softSkip('blocked', `the host became unreachable while probing ${path}`);
-      // Any status but 404 means the route is MOUNTED — 401/403/422 all answer
-      // "this path exists". Only 404 says major 2 cannot reach it.
-      if (v2.status === 404) overstated.push(`${path} (/v1 → ${v1.status}, major 2 → 404)`);
-      else served.push(path);
+      // 401/403/422 all answer "this path exists" and count as reached. A 404
+      // does not — and neither does a 200 that did not come from the host: no
+      // OpenWOP-Version header, or an HTML body, is a hosting fallback wearing
+      // a success code (see reachedUnderMajor2).
+      if (!reachedUnderMajor2(v2)) {
+        overstated.push(`${path} (/v1 → ${v1.status}, major 2 → ${v2.status}${v2.version === null ? ', no OpenWOP-Version header' : ''}${v2.html ? ', text/html body' : ''})`);
+      } else {
+        served.push(path);
+      }
     }
 
     if (pairable === 0) {