@openwop/openwop-conformance 2.0.0-rc.8 → 2.0.0-rc.9

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.8",
-  "stampSha256": "496861ae55503d03945c4509b57c7eab4e9b3c508c784a919cdd7bbd896b4e95"
+  "version": "2.0.0-rc.9",
+  "stampSha256": "762297c8d8a532eb7c96810677053e8cc47ae012824f6977d307c36dcc90d95f"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.8",
+  "version": "2.0.0-rc.9",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.8"
+    "@openwop/spec-artifacts": "2.0.0-rc.9"
   }
 }

package/requirements.json

@@ -2,9 +2,9 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 543,
-    "tests": 2115,
-    "withStableId": 2115,
+    "files": 544,
+    "tests": 2118,
+    "withStableId": 2118,
     "interpolatedTitles": 0,
     "explicitIds": 2057
   },
@@ -34535,6 +34535,68 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-v2-discovery-root-publishes-signingkeys-the-surface-the-rfc-named",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 85,
+      "title": "the v2 discovery root publishes signingKeys[] — the surface the RFC named",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the v2 discovery root MUST carry signingKeys[] — RFC 0168 disposed of \"an Ed25519 attestation without a key registry is a signature nobody can check\" by naming this surface, so if it is absent the disposition names a place that does not exist and every bundle signature is unattributable",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a signingKeys[] entry MUST be closed; an open key record lets a host attach meaning the verifier does not read",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a signingKeys[] entry MUST be able to record retirement, because a retired key has to stay listed — dropping it silently invalidates every bundle it already signed, which is the opposite of what an evidence trail is for",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-front-door-gate-verifies-the-attestation-instead-of-inspecting-the-string",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 116,
+      "title": "the Front-door gate verifies the attestation instead of inspecting the string",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the gate MUST NOT accept a bundle signature by presence: `typeof signature.sig === 'string'` is satisfied by any string, so it cannot distinguish a host key from a keypair minted seconds earlier by whoever wrote the bundle",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the gate MUST resolve signature.keyId against the host's published signingKeys[] and verify the Ed25519 attestation under it — resolving without verifying, or verifying against a key the bundle supplied itself, both leave the signature unaccountable",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-four-signature-outcomes-stay-distinct-collapsing-any-two-restores-the-defect",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 131,
+      "title": "the four signature outcomes stay distinct — collapsing any two restores the defect",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-corpus-tag-pinned.every-vendoring-consumer-in-the-cross-repo-inventory-records-a-published-corpus",
       "file": "v2-corpus-tag-pinned.test.ts",

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.8",
+  "version": "2.0.0-rc.9",
   "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -9,9 +9,9 @@
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "135f40f745b11c557f69b9b1dc0004f4400df48135964cfa75f3c26036f75a7d",
-    "api/v2/asyncapi.yaml": "1470d4ee12b87b6bd6569f3b6b7f84f5cded66bae920734778cd0bec45144658",
-    "api/v2/openapi.yaml": "352105be576e2c93d18c55272c8604519213e7df9d6582df0fb8382c0a2c66cd",
+    "api/seams-v2.yaml": "1c0444d1bb0a4684d5f9eb0553c0e25305695bb7bbfe36adaa2189bd759b2ed4",
+    "api/v2/asyncapi.yaml": "3c5c5c4c2b4bda63d77b2da0e242c0399758f141aee5a89d5e8285c44b78afe7",
+    "api/v2/openapi.yaml": "d6b6689388d410388dc506dbed4cade59f6f0ef87671dfdfa6af97027e7114c3",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -115,8 +115,8 @@
     "schemas/v2/artifact-type-pack-manifest.schema.json": "c911757562e521cb4f31a47c097f562573b64087efe60c8acb81fd352367d300",
     "schemas/v2/audit-verify-result.schema.json": "cb54c4d89ba5dfb73f49aa8959a980be65c2dc2a87a12f71ba36d3e836fe85da",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
-    "schemas/v2/capabilities.schema.json": "b6191deddf6bee19470eee9a45bb520de0d17385c195de6e3b8c5cb6d9520238",
-    "schemas/v2/certification-bundle.schema.json": "5afcce118ac567d4aee790aebe258bfbb60aa2708c4602b26f835943aa67b2c3",
+    "schemas/v2/capabilities.schema.json": "792669b2cc7b1fd44ce9a4fd3e79696ad1277734e29299a4504b39eda15913ed",
+    "schemas/v2/certification-bundle.schema.json": "d441198893c01cd14d84abe9c5bf591b69f47554db749c01899512f36cea11fa",
     "schemas/v2/channel-presence-payload.schema.json": "9475d46f358d21c19126e78204987a5633979917a2293653354ef5c5e044d54e",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "566982ce509a96d1619d58a72e383eff0773fe43fc65e4bfc85a4fe158f4eaff",
@@ -198,7 +198,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "3bc6be4271442cd38a445c20643be92ec1432d188807d6779cae40bf611adb03",
+    "spec/v1/core-standard-manifest.json": "322b72364fa918dd3d5dd939d947f7a66a410f7c39a9ffd6dd331c1916e38ceb",
     "spec/v1/deprecations.json": "520d79927a8ed43ccf62c207a7cf6cf7b19b16e00bbbbdf0410667e939c19d85",
     "spec/v1/deprecations.schema.json": "4cdbbb8eb9c0092913a5704c943880f0c8581bcf0f640a7df5a84105d53c8aee",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -210,7 +210,7 @@
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
     "spec/v1/spec-gaps.json": "6cc9962c6b969f632e07a78b52a4f61447ff579e2990cbae989866f584a86042",
-    "spec/v2/declaration.json": "892b6fae1e87f279ff75451f67ffab2a63ef883203f8066886bd60f165469348",
+    "spec/v2/declaration.json": "52b8c24a2dd463d44086129bf792ad108746f5102778cbbf0ff469fa534eca48",
     "spec/v2/declaration.schema.json": "b0881a76228dfbd1b85a2ec7b7259a60197f768344535cdb475db6ff719b0e54",
     "spec/v2/errors.json": "ad1725dc7c11002450e8abc682858eb5c11952a0718ea8ef6bdb2fb5ae6e7e21",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
@@ -228,7 +228,7 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "1f0ee40491131cf561ef19a0394c47ba476b4567514fe16befb6cada4a10a5a4",
-    "spec/v2/release.json": "f2ef4468ef76f5da0580bd7ca2b8f2237fb4e4ce82f81afba34b1819bc238e68"
+    "spec/v2/release.json": "d8dc6315c0716621625edad0b150c5daa77e1352984f439ee4d1d8627efeec13"
   },
-  "corpusCommit": "fa9baad71198fd4994360a8331dbbffd41165bd4"
+  "corpusCommit": "e3480a200a224fb906d0c3f54043b6e229c5dff9"
 }