@openwop/openwop-conformance 2.0.0-rc.59 → 2.0.0-rc.60

package/README.md

@@ -117,7 +117,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 515 scenario files under `src/scenarios/`.
+The current suite has 516 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -462,7 +462,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 515 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 516 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.59",
-  "stampSha256": "4c5c8d7ef06d876ffd86f942a929aad2c6efda0d896d5fc64fb755a3660d09d5"
+  "version": "2.0.0-rc.60",
+  "stampSha256": "a8d45fba2fd662735347d91b9dda9e16486b50896a866a54b679a7a0f7129cae"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.59",
+  "version": "2.0.0-rc.60",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.59"
+    "@openwop/spec-artifacts": "2.0.0-rc.60"
   }
 }

package/requirements.json

@@ -2,9 +2,9 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 564,
-    "tests": 2149,
-    "withStableId": 2148,
+    "files": 565,
+    "tests": 2150,
+    "withStableId": 2149,
     "interpolatedTitles": 1,
     "explicitIds": 2058
   },
@@ -28355,6 +28355,30 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-run-fork-prefix.a-replay-fork-inherits-exactly-0-fromseq-the-event-at-fromseq-is-re-executed-nev",
+      "file": "v2-run-fork-prefix.test.ts",
+      "line": 86,
+      "title": "a replay fork inherits exactly [0, fromSeq): the event at fromSeq is re-executed, never carried over",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/runs.md §Fork",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-run-fork-refusals.replay-overlay-400-a-fromseq-outside-the-log-422-fork-point-invalid-a-valid-repl",
       "file": "v2-run-fork-refusals.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 515,
+    "files": 516,
     "v1": 445,
-    "v2": 71
+    "v2": 72
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1399,6 +1399,9 @@
     "v2-run-diff-identical.test.ts": [
       2
     ],
+    "v2-run-fork-prefix.test.ts": [
+      2
+    ],
     "v2-run-fork-refusals.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.59",
+  "version": "2.0.0-rc.60",
   "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -9,9 +9,9 @@
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "4b474e22774660b14a66fdb680fca1c9c4a7402517009f751facf5bb7de97faf",
-    "api/v2/asyncapi.yaml": "af8558829c54d427de29cde3eb99e8aac0a4ede445aa68cd9b85440370e22896",
-    "api/v2/openapi.yaml": "c81590887da0826f56f9ee8995f28a1f2054eb59e9cf8faf791a3ffaf5710787",
+    "api/seams-v2.yaml": "924663b683aeb5374ffbac82b7daab78e98a30794eccf2ac38fd88bbb0e32412",
+    "api/v2/asyncapi.yaml": "82ae49c3c446692c64fcebc7057542d2e36d1ebd3e70a577e22bedd5bccf9211",
+    "api/v2/openapi.yaml": "a06f82c9046bcc7f21638e5dcf83603957898e3fb687a9711bf2d7d47e9dad31",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "36ed772c70e35139274debb759f218c8580474417c8fe96af7b1b5918d3bad21",
+    "spec/v1/core-standard-manifest.json": "2f4d9846f6167092189acb28db6c5035df6ebdd404ddf2e09ff5ebfb5c58b5a4",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -230,8 +230,8 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "bf38fc9c5ad32212385ad798c0744de33837ea80c0ef9bec86ecefb4ea914f27",
-    "spec/v2/release.json": "aa06fce026ea767c43b8840b26eb61551436dc58dd33187d2e07a1c0df5af322",
+    "spec/v2/release.json": "21de6736f0658c0d652d87d260967660aeea460fd5defbb097eb748715c23a38",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "bd43e1d1a83d9ee3fccf78501104fe0ed77da095"
+  "corpusCommit": "7042d0481198995c594dd9d8dc47ce2b774c782a"
 }

package/src/scenarios/v2-run-fork-prefix.test.ts

@@ -0,0 +1,140 @@
+/**
+ * `spec/v2/core/replay.md` §Endpoint — the fork prefix boundary is EXCLUSIVE
+ * (suite 2.0.0, target major 2; unaided; gated on `replay`; two runs created).
+ *
+ * "Events with `sequence < fromSeq` are fixed history; events `>= fromSeq` are
+ * re-executed." A host that copies `sequence <= fromSeq` inherits one event too
+ * many and re-executes from one event too late.
+ *
+ * Why this file exists. Until rc.60 the only major-2 witness of that boundary
+ * was `v2-fork-a-v1-run`, which is driven through the conformance seam and sits
+ * on the seams floor — so a host that does not advertise the seams profile was
+ * never measured on it, and `v2-run-fork-refusals` (the unaided fork scenario)
+ * asserts only the refusals and never reads the forked log. A tier-1 host
+ * shipped `<= fromSeq` and passed every unaided major-2 scenario; it found the
+ * defect only when fixing 1-based sequence numbering made the off-by-one
+ * visible — two errors cancelling. The v1 scenarios that do check the prefix
+ * (`replay-fork`, `replay-fork-arbitrary`, `feedback-fork-not-copied`) are
+ * `majors: [1]` and never run here.
+ *
+ * The falsifiable shape, chosen to be race-free and implementation-agnostic.
+ * `fromSeq` is placed on a `node.completed` that is not the run's last, so the
+ * source's event AT `fromSeq` is one re-execution cannot honestly reproduce at
+ * that same sequence: an exclusive host restarts that node, and its event at
+ * `fromSeq` is the fresh `node.started`; an inclusive host inherited the
+ * `node.completed` and re-executes from `fromSeq + 1`, so its event at
+ * `fromSeq` is the source's, verbatim. Both logs are read after they settle.
+ *
+ * Measured on the reference host (exclusive) at `fromSeq: 4` of an 8-event
+ * `conformance-multi-node` log: source `4 node.completed b`, fork
+ * `4 node.started b`, fork 9 events to the source's 8 — the fork is LONGER,
+ * because node `b` had started inside the prefix and its completion is
+ * re-executed. Length is therefore not the discriminator and this file does not
+ * assert on it; the event at the boundary is.
+ *
+ * What this file deliberately does NOT assert: the CONTENT of the re-executed
+ * tail, determinism across two forks, timing, and effect re-fire suppression.
+ * Those are `replay.md` §Replay determinism and the seams floor's, witnessed in
+ * `replay-fork-arbitrary` (major 1) and `v2-effect-seam-no-refire` (seams).
+ *
+ * @see spec/v2/core/replay.md §Endpoint
+ * @see spec/v2/core/runs.md §Fork
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0170.fork-prefix-boundary';
+const DOC = 'spec/v2/core/replay.md §Endpoint';
+const MULTI = 'conformance-multi-node';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+interface Ev { readonly sequence?: unknown; readonly type?: unknown }
+
+async function discovery(): Promise<Record<string, unknown> | null> { try { return await v2Discovery(); } catch { return null; } }
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
+const enc = (id: string): string => encodeURIComponent(id);
+
+/** Every event of a run, in sequence order, read through the poll surface. */
+async function logOf(runId: string): Promise<Ev[] | null> {
+  const res = await http(() => driver.get(`/runs/${enc(runId)}/events/poll?timeout=1&streamMode=debug`));
+  if (res === null || res.status !== 200) return null;
+  const events = (res.json as { events?: unknown } | undefined)?.events;
+  if (!Array.isArray(events)) return null;
+  return (events as Ev[]).filter((e) => typeof e.sequence === 'number').sort((a, b) => (a.sequence as number) - (b.sequence as number));
+}
+
+/** Poll until the run is terminal or the bound elapses; returns the last status seen. */
+async function settle(runId: string, ms = 20_000): Promise<string | null> {
+  const deadline = Date.now() + ms;
+  let status: string | null = null;
+  while (Date.now() < deadline) {
+    const res = await http(() => driver.get(`/runs/${enc(runId)}`));
+    status = res?.status === 200 ? String((res.json as { status?: unknown } | undefined)?.status ?? '') : status;
+    if (status !== null && TERMINAL.has(status)) return status;
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  return status;
+}
+
+describe('v2 run-fork-prefix (replay.md §Endpoint — the boundary is exclusive)', () => {
+  it('a replay fork inherits exactly [0, fromSeq): the event at fromSeq is re-executed, never carried over', async () => {
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable');
+    if (!(await gateFamily('replay'))) return softSkip('inapplicable', 'replay family not advertised (gate recorded under openwop.family.replay) — forkRun is gated on replay (runs.md §Surface)');
+    if (!isFixtureAdvertised(MULTI)) return softSkip('inapplicable', `${MULTI} fixture not advertised — no multi-event deterministic run to fork at a mid-log point`);
+
+    const created = await http(() => driver.post('/runs', { workflowId: MULTI }));
+    if (created === null || created.status !== 201) return softSkip('blocked', `POST /runs {workflowId: ${MULTI}} answered ${created?.status ?? 'no response'} ${readErrorCode(created?.json) ?? ''}`.trim());
+    const runId = (created.json as { runId?: unknown }).runId;
+    if (typeof runId !== 'string') return softSkip('blocked', 'the 201 carried no runId');
+
+    const sourceStatus = await settle(runId);
+    if (sourceStatus === null || !TERMINAL.has(sourceStatus)) return softSkip('blocked', `the source run did not settle within 20 s (last status: ${sourceStatus ?? 'unreadable'}) — a mid-log fork point cannot be chosen from an unfinished log`);
+    const source = await logOf(runId);
+    if (source === null) return softSkip('blocked', `GET /runs/{runId}/events/poll did not answer 200 with events[] for the source run`);
+
+    // The fork point: a `node.completed` that is not the run's last event, so
+    // the source's event AT fromSeq is one an honest re-execution cannot
+    // reproduce at that sequence (it restarts the node instead).
+    const seqs = source.map((e) => e.sequence as number);
+    const last = Math.max(...seqs);
+    const point = source.find((e) => e.type === 'node.completed' && (e.sequence as number) > 0 && (e.sequence as number) < last);
+    if (point === undefined) return softSkip('inapplicable', `no node.completed sits strictly inside the ${source.length}-event source log (types: ${[...new Set(source.map((e) => String(e.type)))].join(', ')}) — this host's log shape offers no fork point where an inherited row and a re-executed row are distinguishable`);
+    const fromSeq = point.sequence as number;
+
+    const fork = await http(() => driver.post(`/runs/${enc(runId)}:fork`, { mode: 'replay', fromSeq }));
+    if (fork === null) return softSkip('blocked', 'POST /runs/{runId}:fork unreachable (fetch failed)');
+    if (fork.status === 404) return softSkip('blocked', 'POST /runs/{runId}:fork answered 404 — forkRun is served by a host advertising replay (runs.md §Surface)');
+    expect(fork.status, req(ID, 'spec/v2/core/runs.md §Fork', `a replay fork at a sequence in the source log MUST answer 201 — got ${fork.status} ${readErrorCode(fork.json) ?? ''}`.trim())).toBe(201);
+    const forkId = (fork.json as { runId?: unknown }).runId;
+    if (typeof forkId !== 'string') return softSkip('blocked', 'the fork 201 carried no runId');
+
+    const forkStatus = await settle(forkId);
+    if (forkStatus === null || !TERMINAL.has(forkStatus)) return softSkip('blocked', `the fork did not settle within 20 s (last status: ${forkStatus ?? 'unreadable'}) — the inherited-prefix length is only comparable on a finished log`);
+    const forked = await logOf(forkId);
+    if (forked === null) return softSkip('blocked', 'GET /runs/{runId}/events/poll did not answer 200 with events[] for the fork');
+
+    // The prefix itself: every inherited row matches the source by sequence and
+    // type. This is the fixed-history claim, stated positively.
+    const inherited = forked.filter((e) => (e.sequence as number) < fromSeq);
+    expect(
+      inherited.map((e) => `${String(e.sequence)}:${String(e.type)}`),
+      req(ID, DOC, `the fork MUST inherit [0, ${fromSeq}) from the source verbatim by sequence and type`),
+    ).toEqual(source.filter((e) => (e.sequence as number) < fromSeq).map((e) => `${String(e.sequence)}:${String(e.type)}`));
+
+    // The boundary. The source's event at `fromSeq` is re-executed, not fixed
+    // history, so it MUST NOT appear at its own sequence in the fork. An
+    // inclusive host copies [0, fromSeq] and that is exactly what it shows.
+    const at = forked.find((e) => (e.sequence as number) === fromSeq);
+    if (at === undefined) return softSkip('blocked', `the fork's log has no event at sequence ${fromSeq} (last ${Math.max(...forked.map((e) => e.sequence as number))}) — the boundary is unobservable on this log`);
+    expect(
+      String(at.type),
+      req(ID, DOC, `the event at sequence ${fromSeq} is re-executed, not fixed history: the fork MUST NOT carry the source's ${String(point.type)} at that sequence — seeing it means the prefix was copied inclusively ([0, ${fromSeq}] instead of [0, ${fromSeq}))`),
+    ).not.toBe(String(point.type));
+  }, 60_000);
+});