@openwop/openwop-conformance 2.0.2 → 2.0.3

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.0.3] — 2026-09-06 — a selector that asked the wrong question, and a window that convicted a host for its own width
+
+**`v2-effect-seam-no-refire` selected on a branch permission to witness a replay obligation.** The filter was `guarded === true && branchReFires === false`. `replay.md:78`: *"A host MAY suppress branch effects and MUST NOT report that as replay suppression."* Replay suppression is unconditional (§Suppression rule 1) and does not vary with `branchReFires`, which states only what a **branch** re-fires by design. Every `guarded: true` row is a valid target; the filter now selects on `guarded` alone. `branchReFires` is also optional, so `=== false` additionally excluded rows merely silent on it. Found by the reference host, whose ten `branchReFires: true` rows are all honest and which was about to build `fireEffectSeam` for a scenario that would have kept recording `inapplicable` afterwards.
+
+**`v2-webhook-durable-delivery`'s at-least-once leg convicted a host for the suite's window.** The 204 arrives on attempt `FAIL_FIRST + 1`, costing the **sum** of the first `FAIL_FIRST` backoff intervals — `30 + 60 = 90 s` on exponential-from-30s, against a cap of exactly `90_000`. The interval is not advertised (`retryPolicy` is `additionalProperties: false` over `{ maxAttempts, backoff }`), so the wait is underivable and any cap is a guess. The leg now records **`blocked`** with the arithmetic, not `executed-fail`.
+
+**The cost:** a host that retries forever and never succeeds also records `blocked` now. That is a missed detection traded for a false conviction, and it returns only by advertising the interval — an RFC and a 2.1.0.
+
+Both defects encoded a condition the obligation does not have: one a flag the requirement never mentions, one a deadline it never sets.
+
 ## [2.0.2] — 2026-09-06 — 2.0.1's own fix could not run: the derived wait exceeded the harness timeout that governs it
 
 A regression in 2.0.1, measured by the host that reported the defect 2.0.1 fixed. On a 2.0.1 re-cut one row moved, the wrong way: `0173.webhook-durable-delivery.dead-letter` went `executed-pass` → `executed-fail`.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.2",
-  "stampSha256": "ae8640bf298cdf8a4efd624f16424ed1feba41be0f3f919f859bf5a5bbe0432f"
+  "version": "2.0.3",
+  "stampSha256": "cd21cd9edd9233e417635a42460f40ed592ebe459ecadfd52400f8dfbd8435b3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.2"
+    "@openwop/spec-artifacts": "2.0.3"
   }
 }

package/requirements.json

@@ -26623,7 +26623,7 @@
       "explicitId": "openwop.requirement.0173.effect-seam-no-refire",
       "citations": [
         {
-          "section": "spec/v2/core/replay.md §The effect-seam manifest",
+          "section": "spec/v2/core/replay.md §Suppression",
           "requirement": null,
           "interpolated": true
         }
@@ -29006,7 +29006,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 221,
+      "line": 232,
       "title": "a failed attempt is retried and the event is delivered at least once",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery",
       "citations": [
@@ -29023,10 +29023,6 @@
           "requirement": null,
           "interpolated": true
         },
-        {
-          "section": "webhooks.md §Durability",
-          "requirement": "at-least-once: after the failing attempts the retry MUST land (the receiver answered 204 to the third attempt for the key)"
-        },
         {
           "section": "webhooks.md §Durability",
           "requirement": null,
@@ -29041,7 +29037,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 275,
+      "line": 313,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.2",
-  "corpusTag": "v2.0.2",
+  "version": "2.0.3",
+  "corpusTag": "v2.0.3",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "95eccbef6e1f7f51417efe2f307d8950bb520d3b86806bf9d1a316e96aa6b9b5",
-    "api/v2/asyncapi.yaml": "70d1a50b3acdf51763239463efe0336fc80b4eb2f9b4ab50d05860ead0490cf0",
-    "api/v2/openapi.yaml": "e55547a384bb43f8fe21ae93a27dfc7a16df6494f5ae50aca60028968ce039d4",
+    "api/seams-v2.yaml": "371368d382f64c6025b3c328f1c0d8ebbc5f3a3f974b3bf889e281a891af9186",
+    "api/v2/asyncapi.yaml": "3ab2d59c0a9b64bfeb4b1e8eebdb332de83d324ac66bc36a98fd59d7838e574a",
+    "api/v2/openapi.yaml": "6213c7997bc9700077e21096f555688e0be5061a24436bbe972c4d42afb9419f",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "1afaf3936e9d13d5fb71a83fe63a81f8bbb18efb7417c60e523cebf63a5060e7",
+    "spec/v1/core-standard-manifest.json": "0f6e3852415ea4a3dbc9359d78f94bffa28d71a7d21da9271ebe50475b3133e0",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -230,8 +230,8 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "fea7f9b757b226e263b7626d1bfebfb680e7ea853cca86b2426c82435e8fdbd4",
+    "spec/v2/release.json": "02478dd3e9e5ba5fc54e1e14a4e2ee0f8d539a02c99bfa62cd9f4cd78cee7d0d",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "7cf764b47ef3b79ddcf5c6e5dfea9f37f9b60a66"
+  "corpusCommit": "c600da7988e0efab5d3122c33435988dbfb11c4a"
 }

package/src/scenarios/v2-effect-seam-no-refire.test.ts

@@ -56,8 +56,27 @@ describe('RFC 0173 §C.2 — effect-seam-no-refire (gated on replay, seam-driven
     const manifest = await driver.get(MANIFEST_PATH);
     const seamRows: SeamRow[] = manifest.status === 200 && manifest.json && typeof manifest.json === 'object'
       ? ((manifest.json as Manifest).seams ?? []) : [];
-    const target = seamRows.find((r) => r.guarded === true && r.branchReFires === false);
-    if (!target) return softSkip('inapplicable', `no manifest row is both guarded and branchReFires: false — nothing to witness suppression on (${seamRows.length} row(s) at ${MANIFEST_PATH})`);
+    // Select ANY guarded row (suite 2.0.3). Until 2.0.2 this read
+    // `r.guarded === true && r.branchReFires === false` — it selected on a
+    // BRANCH permission to witness a REPLAY obligation, which `replay.md:78`
+    // forbids in one sentence: "A host MAY suppress branch effects and MUST NOT
+    // report that as replay suppression." §Suppression rule 1 is unconditional
+    // ("a node that performs an external side effect … MUST NOT perform it")
+    // and does not vary with `branchReFires`, whose own schema description is
+    // "RFC 0140 G6 — a `branch` fork re-fires this seam by design".
+    //
+    // Two defects in one line. `branchReFires` is also OPTIONAL (`required:
+    // ["seam","kind","guarded","guardedBy"]`), so `=== false` additionally
+    // excluded every row that is merely silent on the permission.
+    //
+    // Found by the reference host, which had ten honest `branchReFires: true`
+    // rows — every seam it owns does re-fire on a branch, by design — and was
+    // about to build `fireEffectSeam` to satisfy a scenario that would have
+    // gone on recording `inapplicable` after the work landed. It asked instead
+    // of inventing a `false` row, which would have made this pass by lying
+    // about the seam.
+    const target = seamRows.find((r) => r.guarded === true);
+    if (!target) return softSkip('inapplicable', `no manifest row is guarded — nothing to witness suppression on (${seamRows.length} row(s) at ${MANIFEST_PATH})`);
     const fired = await driver.post(`${SEAMS_PREFIX}/sample/effect-seams/fire`, { seam: String(target.seam) });
     if (fired.status === 404 || fired.status === 403 || fired.status === 405) {
       return softSkip('blocked', `the host advertises the seams profile but does not serve ${SEAMS_PREFIX}/sample/effect-seams/fire (answered ${fired.status}) — the no-re-fire leg cannot be driven`);
@@ -98,7 +117,7 @@ describe('RFC 0173 §C.2 — effect-seam-no-refire (gated on replay, seam-driven
     if (forkEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${forkEffects.status} on the replay fork`);
     expect(
       countOf(forkEffects),
-      req('openwop.requirement.0173.effect-seam-no-refire', 'spec/v2/core/replay.md §The effect-seam manifest', `seam ${String(target.seam)} states branchReFires: false, so a replay fork MUST NOT issue a further attempt through it — the fork's effect ledger (${countOf(forkEffects)}) cannot exceed the parent's (${countOf(parentEffects)})`),
+      req('openwop.requirement.0173.effect-seam-no-refire', 'spec/v2/core/replay.md §Suppression', `seam ${String(target.seam)} is guarded, so a replay fork MUST NOT issue a further attempt through it — suppression is unconditional for mode: replay (§Suppression rule 1) and does not depend on branchReFires, which states only what a BRANCH may re-fire (§Branch: a host "MUST NOT report that as replay suppression"). The fork's effect ledger (${countOf(forkEffects)}) cannot exceed the parent's (${countOf(parentEffects)})`),
     ).toBeLessThanOrEqual(countOf(parentEffects));
   });
 });

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -194,6 +194,17 @@ function retryWaitMs(doc: Record<string, unknown>): number {
  * constant the delivery loop reads. `WAIT_SLACK_MS` covers `waitTerminal`,
  * registration and the HTTP round trips around the waits.
  */
+/**
+ * How many attempts the receiver refuses before answering 204 (suite 2.0.3).
+ *
+ * The retry leg's success witness lands on attempt `FAIL_FIRST + 1`, so this
+ * number decides how much backoff the scenario has to sit through. It is a
+ * named constant rather than a literal at the `startReceiver` call because the
+ * blocked-reason quotes it: the message a host reads must be computed from the
+ * receiver the suite actually started, not from a number typed twice.
+ */
+const FAIL_FIRST = 2;
+
 const WAIT_SLACK_MS = 30_000;
 /** One `retryWaitMs` wait (the retry leg). */
 const RETRY_TEST_TIMEOUT_MS = RETRY_WAIT_CAP_MS + WAIT_SLACK_MS;
@@ -224,7 +235,7 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
     if (!fixtureAdvertised(doc, FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to deliver`);
 
-    const receiver = await startReceiver(2); // 500, 500, then 204
+    const receiver = await startReceiver(FAIL_FIRST); // 500, 500, then 204
     active = receiver.server;
     const sub = await register(receiver.url);
     if (sub === null) return softSkip('blocked', 'registration refused (reason recorded above)');
@@ -246,10 +257,37 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
       attempts.length,
       req('openwop.requirement.0173.webhook-durable-delivery', 'webhooks.md §Durability', `a 500 from the subscriber MUST be retried — ${failedThenSucceeded} failed attempt(s) were answered and the host made ${attempts.length} attempt(s) in total; one attempt is best-effort delivery, which is not a conforming mode (RFC 0173 §B)`),
     ).toBeGreaterThan(1);
-    expect(
-      retried,
-      req('openwop.requirement.0173.webhook-durable-delivery', 'webhooks.md §Durability', 'at-least-once: after the failing attempts the retry MUST land (the receiver answered 204 to the third attempt for the key)'),
-    ).toBe(true);
+    // At-least-once: the retry MUST eventually land. When it has not landed
+    // inside our window this records `blocked`, NOT `executed-fail` — suite
+    // 2.0.3, and this is the third time this file has had to learn it.
+    //
+    // The receiver answers 204 only on attempt `FAIL_FIRST + 1`, so reaching it
+    // costs the SUM of the first FAIL_FIRST backoff intervals, not the largest
+    // one. On an exponential-from-30s policy that is 30 + 60 = 90 s, which is
+    // exactly RETRY_WAIT_CAP_MS — a host loses by the width of one delivery.
+    // The obvious fix is to derive the wait from the intervals, and it cannot
+    // be built: `spec/v2/facets/webhooks.schema.json` `retryPolicy` is
+    // `additionalProperties: false` over exactly { maxAttempts, backoff }.
+    // THE BASE INTERVAL IS NOT ON THE WIRE, so the suite cannot compute the
+    // time to the Nth attempt, and any cap I pick is 2.0.1's 20-second
+    // deadline again with a bigger literal.
+    //
+    // So the honest disposition is `blocked`: the host took the obligation on
+    // (it advertises webhooks and we observed it retry) and the suite could not
+    // measure the outcome (RFC 0148 §A). Not `inapplicable` — that would claim
+    // it never took the obligation on.
+    //
+    // THE COST, stated rather than hidden: a host that retries forever and
+    // never succeeds now also records `blocked` instead of failing. This trades
+    // a false conviction for a missed detection. Detection comes back by
+    // putting the interval on the wire — an additive `retryPolicy` field so the
+    // sum is derivable — which is normative surface, an RFC and a 2.1.0, not a
+    // patch. Recorded here so the trade is visible at the assertion rather than
+    // only in a changelog.
+    if (!retried) {
+      const policyNote = advertisedRetryPolicy(doc);
+      return softSkip('blocked', `the retry was observed (${attempts.length} attempts) but the receiver's 204 did not land inside the ${retryWaitMs(doc)}ms window: it answers 204 only on attempt ${FAIL_FIRST + 1}, which costs the SUM of the first ${FAIL_FIRST} backoff intervals, and webhooks.retryPolicy carries only { maxAttempts, backoff${policyNote ? `: ${String(policyNote.backoff)}` : ''} } — the base interval is not advertised, so the suite cannot derive how long to wait. Unmeasured, not unmet (RFC 0148 §A).`);
+    }
     // Backoff: the retry MUST NOT be a tight loop — consecutive attempts for one
     // key are spaced. Only asserted when the host advertises a non-`none` backoff.
     const policy = advertisedRetryPolicy(doc);