@openwop/openwop-conformance 2.0.3 → 2.0.4

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.0.4] — 2026-09-06 — a fixture that punished a host for obeying the rule the scenario checks
+
+`v2-provider-conflict` drove `connection-pack-github`. On a host shipping a built-in `github`, RFC 0177 §D.1 requires refusing the later registration — so the fixture never installed and the qualified-form leg recorded **`blocked`** permanently, on a host whose only fault was obeying the rule under test. A production host carried that row across a dozen cuts; any blocked row denies certification (RFC 0168 §E.1).
+
+New fixture **`connection-pack-acme-widgets`** — same shape, a deliberately fictional provider id so no host ships it built-in and both legs are reachable everywhere.
+
+The v1 scenario `connection-provider-resolution` keeps the `github` fixture, checked rather than assumed: v1 settles a collision by **version precedence** (`spec/v1/connection-packs.md:89`) instead of refusing the install, so it is not trapped by the same choice.
+
+**An instrument must not require a host to violate the spec in order to be measured.**
+
 ## [2.0.3] — 2026-09-06 — a selector that asked the wrong question, and a window that convicted a host for its own width
 
 **`v2-effect-seam-no-refire` selected on a branch permission to witness a replay obligation.** The filter was `guarded === true && branchReFires === false`. `replay.md:78`: *"A host MAY suppress branch effects and MUST NOT report that as replay suppression."* Replay suppression is unconditional (§Suppression rule 1) and does not vary with `branchReFires`, which states only what a **branch** re-fires by design. Every `guarded: true` row is a valid target; the filter now selects on `guarded` alone. `branchReFires` is also optional, so `=== false` additionally excluded rows merely silent on it. Found by the reference host, whose ten `branchReFires: true` rows are all honest and which was about to build `fireEffectSeam` for a scenario that would have kept recording `inapplicable` afterwards.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.3",
-  "stampSha256": "cd21cd9edd9233e417635a42460f40ed592ebe459ecadfd52400f8dfbd8435b3"
+  "version": "2.0.4",
+  "stampSha256": "8abb52df9340e47ac5d16d15fb0abe88cc3bd6857e2cb8be269079d6d7ca1530"
 }

package/fixtures/connection-packs/connection-pack-acme-widgets.json

@@ -0,0 +1,31 @@
+{
+  "name": "core.openwop.connections.acme-widgets",
+  "version": "1.0.0",
+  "kind": "connection",
+  "engines": { "openwop": ">=1.0.0" },
+  "provider": {
+    "id": "acme-widgets",
+    "displayName": "Acme Widgets",
+    "category": "dev",
+    "auth": {
+      "kind": "oauth2",
+      "authFlow": "pkce",
+      "scopeModel": "groups",
+      "endpoints": {
+        "authorize": "https://auth.acme-widgets.example.com/oauth/authorize",
+        "token": "https://auth.acme-widgets.example.com/oauth/token"
+      },
+      "scopes": {
+        "read": [
+          { "key": "widget.read", "label": "Read widgets", "scopes": ["widget:read"] }
+        ],
+        "write": [
+          { "key": "widget.write", "label": "Write widgets", "scopes": ["widget:write"] }
+        ]
+      }
+    },
+    "reach": { "mcp": { "server": { "url": "https://mcp.acme-widgets.example.com/mcp/", "transport": "http" } } },
+    "consumerNodes": ["core.openwop.mcp.invoke-tool", "core.openwop.mcp.read-resource"],
+    "docsUrl": "https://docs.acme-widgets.example.com/oauth"
+  }
+}

package/fixtures.md

@@ -516,7 +516,8 @@ The `fixtures/connection-packs/` sub-directory holds canonical connection-pack m
 
 | Fixture                  | `provider.id` | Purpose                                                                                                                                                                |
 | ------------------------ | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `connection-pack-github` | `github`      | Canonical positive manifest (oauth2 + pkce, read/write scope groups, MCP reach, the exempt `provider.auth.endpoints.token` endpoint URL). Drives manifest-valid, no-credential-material, reach-exclusive, provider-resolution, and write-reconsent scenarios. |
+| `connection-pack-github` | `github`      | Canonical positive manifest (oauth2 + pkce, read/write scope groups, MCP reach, the exempt `provider.auth.endpoints.token` endpoint URL). Drives manifest-valid, no-credential-material, reach-exclusive, provider-resolution, and write-reconsent scenarios. **v1 only for the resolution leg:** v1 settles a collision with a built-in by version precedence (`spec/v1/connection-packs.md:89`), so a host shipping a built-in `github` still installs this pack. |
+| `connection-pack-acme-widgets` | `acme-widgets` | Same shape as the `github` pack over a **deliberately fictional** provider. Drives `v2-provider-conflict` (RFC 0177 §D.1). The id is fictional so that no host ships it built-in: at v2 the later registration of a bare id MUST be refused, so a real-world id made the fixture uninstallable on any host that shipped it — and the qualified-form leg recorded `blocked` on a host whose only fault was obeying §D.1. Suite 2.0.4. |
 | `connection-pack-apihosts-valid` | `meta-ads` | Canonical positive `openapi`-reach manifest declaring a `provider.apiHosts` credential-egress allow-list (`["facebook.com"]`) — RFC 0120. Drives `connection-pack-apihosts` (the `apiHosts` schema + conditional-MUST + egress allow-list scenario). Negatives (IP/wildcard/port/single-label/uppercase entries, openapi-without-apiHosts) are inline mutations per suite convention. |
 
 Negative manifests (credential material, mixed kinds, dual reach) are inline test data in the scenario files per suite convention — a deliberately-invalid fixture file would fail the automatic `fixtures-valid.test.ts` sweep.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.3"
+    "@openwop/spec-artifacts": "2.0.4"
   }
 }

package/requirements.json

@@ -27965,7 +27965,7 @@
     {
       "id": "openwop.it.v2-provider-conflict.two-definitions-of-one-bare-provider-id-fail-closed-the-later-registration-is-re",
       "file": "v2-provider-conflict.test.ts",
-      "line": 84,
+      "line": 99,
       "title": "two definitions of one bare provider id fail closed: the later registration is refused with connection_provider_conflict",
       "explicitId": "openwop.requirement.0177.provider-conflict.fail-closed",
       "citations": [
@@ -27987,10 +27987,10 @@
       ]
     },
     {
-      "id": "openwop.it.v2-provider-conflict.the-qualified-form-packname-github-resolves-to-the-named-pack-s-definition",
+      "id": "openwop.it.v2-provider-conflict.the-qualified-form-packname-acme-widgets-resolves-to-the-named-pack-s-definition",
       "file": "v2-provider-conflict.test.ts",
-      "line": 102,
-      "title": "the qualified form <packName>#github resolves to the named pack's definition",
+      "line": 120,
+      "title": "the qualified form <packName>#acme-widgets resolves to the named pack's definition",
       "explicitId": "openwop.requirement.0177.provider-conflict.qualified-form",
       "citations": [
         {

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.3",
-  "corpusTag": "v2.0.3",
+  "version": "2.0.4",
+  "corpusTag": "v2.0.4",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "371368d382f64c6025b3c328f1c0d8ebbc5f3a3f974b3bf889e281a891af9186",
-    "api/v2/asyncapi.yaml": "3ab2d59c0a9b64bfeb4b1e8eebdb332de83d324ac66bc36a98fd59d7838e574a",
-    "api/v2/openapi.yaml": "6213c7997bc9700077e21096f555688e0be5061a24436bbe972c4d42afb9419f",
+    "api/seams-v2.yaml": "7298eee975d901d9356e8893c39d43261d74a76a07955fffa5b21fb9ffdadf1f",
+    "api/v2/asyncapi.yaml": "98f304626ae95d8fef4de49ace6a4422104faf6c5348bff56ce5aafe511c1381",
+    "api/v2/openapi.yaml": "a6ace2a7b2f9adce2374a6a76fe8b62c6cb2530be5689b2343d8876733e9a54c",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "0f6e3852415ea4a3dbc9359d78f94bffa28d71a7d21da9271ebe50475b3133e0",
+    "spec/v1/core-standard-manifest.json": "04f279931a6749086cf24131671a48f9d119eca4c3a611d2c1e19cc909ac4101",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -230,8 +230,8 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "02478dd3e9e5ba5fc54e1e14a4e2ee0f8d539a02c99bfa62cd9f4cd78cee7d0d",
+    "spec/v2/release.json": "2c18f3bb246203a2de3eef9c1e433e10f548ae74d4689c2cd8eb86a2ae14b39b",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "c600da7988e0efab5d3122c33435988dbfb11c4a"
+  "corpusCommit": "87038a29abb5a19f8eb01bece101fe74af81a7e5"
 }

package/src/scenarios/v2-provider-conflict.test.ts

@@ -15,11 +15,26 @@
  * to `/conformance/seams/sample/…` under target major 2), gated on
  * `connections.packsSupported`.
  *
- *   1. install the `connection-pack-github` fixture (engines rewritten to admit
- *      major 2), then a second pack claiming bare `github` → the later one is
- *      refused with connection_provider_conflict. A host that ships a built-in
- *      `github` witnesses the same rule on the FIRST install.
- *   2. `resolve { provider: "<packName>#github" }` → resolved, source: pack.
+ *   1. install the `connection-pack-acme-widgets` fixture (engines rewritten to
+ *      admit major 2), then a second pack claiming bare `acme-widgets` → the
+ *      later one is refused with connection_provider_conflict. A host that
+ *      happens to ship a built-in of the same id witnesses the same rule on the
+ *      FIRST install.
+ *   2. `resolve { provider: "<packName>#acme-widgets" }` → resolved, source: pack.
+ *
+ * **Why a fictional provider id (suite 2.0.4).** Until 2.0.3 this drove
+ * `connection-pack-github`, and a host that ships a built-in `github` could
+ * never witness leg 2: §D.1 says the later registration of a bare id MUST be
+ * refused, so the fixture did not install, and the qualified-form leg recorded
+ * `blocked` — permanently, on a host whose ONLY fault was obeying the rule the
+ * scenario exists to check. Measured on a production host, which carried that
+ * blocked row across a dozen cuts; a bundle with any blocked row does not
+ * certify (RFC 0168 §E.1). `acme-widgets` is fictional precisely so no host
+ * ships it built-in and the fixture always installs. The v1 scenario
+ * `connection-provider-resolution` keeps the `github` fixture: v1 resolves a
+ * collision by VERSION PRECEDENCE (`spec/v1/connection-packs.md:89`) rather
+ * than refusing the install, so it is not trapped by the same choice — checked
+ * rather than assumed.
  *
  * @see RFCS/0177-v2-registry-packs-and-extension-tail.md §D.1
  * @see spec/v2/core/connection-packs.md
@@ -38,7 +53,7 @@ import { targetMajor } from '../lib/seams.js';
 import { v2Discovery, familyAdvertised } from '../lib/v2.js';
 
 const SECTION = 'connection-packs.md §"Provider identity" (RFC 0177 §D.1)';
-const FIXTURE = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-github.json');
+const FIXTURE = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-acme-widgets.json');
 const INSTALL = '/v1/host/sample/connection-packs/install';
 const RESOLVE = '/v1/host/sample/connection-packs/resolve';
 
@@ -69,7 +84,7 @@ async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | nul
   if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
   const connections = await familyAdvertised('connections');
   if (!behaviorGate('connections.packsSupported', connections?.['packsSupported'] === true)) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise connections.packsSupported (RFC 0095 §C)' };
-  if (!existsSync(FIXTURE)) return { kind: 'blocked', reason: 'fixture connection-packs/connection-pack-github.json is absent from this layout' };
+  if (!existsSync(FIXTURE)) return { kind: 'blocked', reason: 'fixture connection-packs/connection-pack-acme-widgets.json is absent from this layout' };
   return null;
 }
 
@@ -86,30 +101,33 @@ describe('v2-provider-conflict (RFC 0177 §D.1)', () => {
     if (skip) return softSkip(skip.kind, skip.reason);
     const first = await installFixture();
     if (!first) return softSkip('blocked', 'RFC 0095 install seam not mounted (404/403) — connections.packsSupported advertised but /conformance/seams/sample/connection-packs/install is absent');
-    // A host that ships a built-in `github` makes the fixture the LATER
-    // registration, so the rule fires on the first install; otherwise the
-    // fixture installs and a second pack claiming bare `github` is the later one.
+    // The branch is kept for a host that somehow ships a built-in of this id:
+    // the fixture is then the LATER registration and the rule fires on the
+    // first install. `acme-widgets` is fictional so the normal path is the
+    // second one — the fixture installs, and a second pack claiming the same
+    // bare id is the later registration. Keeping the branch costs nothing and
+    // means the scenario does not depend on that assumption holding.
     const later = first.res?.installed === false && codes(first.res).includes('connection_provider_conflict')
       ? first.res
       : await (async () => {
-          expect(first.res?.installed, req('openwop.requirement.0177.provider-conflict.fail-closed', SECTION, `the well-formed fixture MUST install when no other definition of github exists (got ${first.status}: ${JSON.stringify(first.res)})`)).toBe(true);
+          expect(first.res?.installed, req('openwop.requirement.0177.provider-conflict.fail-closed', SECTION, `the well-formed fixture MUST install when no other definition of acme-widgets exists (got ${first.status}: ${JSON.stringify(first.res)})`)).toBe(true);
           return (await driver.post(INSTALL, { manifest: conflicting(fixture()) })).json as InstallResult | undefined;
         })();
     expect(later?.installed, req('openwop.requirement.0177.provider-conflict.fail-closed', SECTION, 'the later registration of a bare provider id MUST NOT install (no version precedence)')).toBe(false);
     expect(codes(later), req('openwop.requirement.0177.provider-conflict.fail-closed', SECTION, 'the later registration MUST be refused with connection_provider_conflict')).toContain('connection_provider_conflict');
   });
 
-  it('the qualified form <packName>#github resolves to the named pack\'s definition', async () => {
+  it('the qualified form <packName>#acme-widgets resolves to the named pack\'s definition', async () => {
     const skip = await preflight();
     if (skip) return softSkip(skip.kind, skip.reason);
     const first = await installFixture();
     if (!first) return softSkip('blocked', 'RFC 0095 install seam not mounted (404/403) — connections.packsSupported advertised but /conformance/seams/sample/connection-packs/install is absent');
-    if (first.res?.installed !== true) return softSkip('blocked', `the fixture did not install (${codes(first.res).join(',') || first.status}) — a host with a built-in github cannot exercise the qualified form through the pack`);
+    if (first.res?.installed !== true) return softSkip('blocked', `the fixture did not install (${codes(first.res).join(',') || first.status}) — a host with a built-in acme-widgets cannot exercise the qualified form through the pack`);
     const packName = fixture().name;
-    const hit = await driver.post(RESOLVE, { provider: `${packName}#github` });
+    const hit = await driver.post(RESOLVE, { provider: `${packName}#acme-widgets` });
     if (hit.status === 404) return softSkip('blocked', 'RFC 0095 resolve seam not mounted (404)');
     const resolved = hit.json as ResolveResult | undefined;
-    expect(resolved?.resolved, req('openwop.requirement.0177.provider-conflict.qualified-form', 'connection-packs.md §"The qualified form" (RFC 0177 §D.1)', `${packName}#github MUST resolve (got ${JSON.stringify(resolved)})`)).toBe(true);
+    expect(resolved?.resolved, req('openwop.requirement.0177.provider-conflict.qualified-form', 'connection-packs.md §"The qualified form" (RFC 0177 §D.1)', `${packName}#acme-widgets MUST resolve (got ${JSON.stringify(resolved)})`)).toBe(true);
     expect(resolved?.source, req('openwop.requirement.0177.provider-conflict.qualified-form', 'connection-packs.md §"The qualified form" (RFC 0177 §D.1)', 'a qualified reference resolves only to the named pack\'s definition (source: pack)')).toBe('pack');
   });
 });