@openwop/openwop-conformance 2.0.8 → 2.0.10

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.0.10] — 2026-09-10 — the bare-id leg
+
+One new leg in `v2-id-grammar` (`openwop.requirement.0170.id-grammar.bare-id`):
+the run this caller just created is requested again with its tenant segment
+stripped — the v1 spelling of the same resource. While the host advertises a
+`1.x` member the leg requires 200 with the **bound** id in the body (the
+overlap affordance `v2-dual-stack-negotiation` has required since rc.44, now
+stated in `identity.md` §5); once no `1.x` member is advertised it requires
+`400 validation_error`. The branch is read from live discovery.
+
+For the record: the first draft of this leg required 400 unconditionally, on a
+steward ruling given on the bus the same day. Running it against the reference
+host turned `v2-dual-stack-negotiation` and `v2-compensation-read-projection`
+red — the suite already encoded the admission in six places and the prose had
+never said so. The instrument was right; the ruling was withdrawn and the
+prose now matches the instrument.
+
+No other scenario changes. The pinned `@openwop/spec-artifacts` peer moves to
+`2.0.10` with the corpus (`renderEndpoint` default, off-origin facets, the §5
+paragraph).
+
+## [2.0.9] — 2026-09-09 — the rule this suite measures now says what it measures
+
+No scenario logic changes, no assertion changes, and no host disposition
+changes. `v2-advertised-path-space-served` behaves exactly as it did in 2.0.8.
+What changed is the corpus prose the scenario cites, and this suite ships that
+corpus as its pinned `@openwop/spec-artifacts` peer — so the version moves with
+it.
+
+**`versioning.md` §1.2 quantified wider than this suite has ever measured.** The
+MUST read *"every operation it serves under the other"*, unqualified. This
+scenario has always built its probe set from `spec/v2/path-manifest.json`
+(`parameterlessGets()`), so it measured manifest operations and reported a
+claim about everything a host serves. §1.2 is now scoped to operations **named
+in the manifest** — which is what the instrument does, and what
+`conformance.md` §"Test seams" requires, since that document forbids the
+manifest to name seam operations while the seams profile mounts them.
+
+The narrowing keeps the case the rule exists for: the motivating defect was
+`POST /webhooks` answering `404` under major 2 while `POST /v1/webhooks`
+answered `201`, and `webhooks` is a manifest operation.
+
+**The docblock now states what stays unmeasured.** Non-GET and parameterised
+manifest operations are bound by the prose and probed by nothing here. The
+`POST /webhooks` defect was found by hand, not by this file.
+
+Raised by a tier-2 host asking whether four proprietary `/v1` roots
+(`packs`, `canvas-types`, `_internal`, `packs-test`) were bound. They were not
+— but only because of what the instrument samples, not because the prose said
+so.
+
 ## [2.0.8] — 2026-09-07 — the verifier asked a v1 question about v2 hosts
 
 No host behaviour changes and no wire changes. One defect in the suite's own

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.8",
-  "stampSha256": "3c52e6a451f700ac99aac8aea616d1cf5d26124902b07c9bf00dff039fff2eb0"
+  "version": "2.0.10",
+  "stampSha256": "6958747f86a6caa1edac56ec46696255efeff5f5c4e725d275995203276a7058"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.8",
+  "version": "2.0.10",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.8"
+    "@openwop/spec-artifacts": "2.0.10"
   }
 }

package/requirements.json

@@ -3,10 +3,10 @@
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
     "files": 565,
-    "tests": 2151,
-    "withStableId": 2151,
+    "tests": 2152,
+    "withStableId": 2152,
     "interpolatedTitles": 0,
-    "explicitIds": 2106
+    "explicitIds": 2107
   },
   "records": [
     {
@@ -25811,7 +25811,7 @@
     {
       "id": "openwop.it.v2-advertised-path-space-served.a-host-advertising-major-2-reaches-the-surfaces-it-already-serves-under-v1",
       "file": "v2-advertised-path-space-served.test.ts",
-      "line": 107,
+      "line": 122,
       "title": "a host advertising major 2 reaches the surfaces it already serves under /v1",
       "explicitId": "openwop.requirement.0172.advertised-path-space-served",
       "citations": [
@@ -26911,7 +26911,7 @@
     {
       "id": "openwop.it.v2-id-grammar.every-id-on-the-run-snapshot-matches-its-ids-schema-json-kind",
       "file": "v2-id-grammar.test.ts",
-      "line": 43,
+      "line": 53,
       "title": "every id on the run snapshot matches its ids.schema.json kind",
       "explicitId": "openwop.requirement.0170.id-grammar.snapshot",
       "citations": [
@@ -26930,7 +26930,7 @@
     {
       "id": "openwop.it.v2-id-grammar.every-id-on-the-run-events-matches-its-ids-schema-json-kind",
       "file": "v2-id-grammar.test.ts",
-      "line": 53,
+      "line": 63,
       "title": "every id on the run events matches its ids.schema.json kind",
       "explicitId": "openwop.requirement.0170.id-grammar.events",
       "citations": [
@@ -26948,7 +26948,7 @@
     {
       "id": "openwop.it.v2-id-grammar.a-run-id-whose-tenant-segment-is-not-the-caller-s-is-refused",
       "file": "v2-id-grammar.test.ts",
-      "line": 68,
+      "line": 78,
       "title": "a run id whose tenant segment is not the caller's is refused",
       "explicitId": "openwop.requirement.0170.id-grammar.tenant-binding",
       "citations": [
@@ -26968,6 +26968,33 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-id-grammar.a-bare-unbound-run-id-in-a-major-2-path-admitted-under-the-caller-s-tenant-throu",
+      "file": "v2-id-grammar.test.ts",
+      "line": 88,
+      "title": "a bare (unbound) run id in a major-2 path: admitted under the caller's tenant through the overlap, refused 400 validation_error after it",
+      "explicitId": "openwop.requirement.0170.id-grammar.bare-id",
+      "citations": [
+        {
+          "section": "spec/v2/core/identity.md §5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/identity.md §5",
+          "requirement": "a resource reached by its bare id MUST still be named by its bound projection in the major-2 response body (versioning.md §5) — the affordance is on the path parameter, never in a document"
+        },
+        {
+          "section": "spec/v2/core/identity.md §5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md",
+          "requirement": "the refusal MUST carry validation_error — not id_tenant_mismatch (no segment to mismatch) and not not_found (a form the host no longer admits is not looked up)"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-idempotency-key-grammar.a-22-character-key-inside-the-grammar-is-accepted",
       "file": "v2-idempotency-key-grammar.test.ts",

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.8",
-  "corpusTag": "v2.0.8",
+  "version": "2.0.10",
+  "corpusTag": "v2.0.10",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "86cac3079b27351e7f5e30f63393a25501584b8a38c893d1d7a65802c18fbb24",
-    "api/v2/asyncapi.yaml": "b1b44dac3dd253509b036aaa30cafdac500311ef0f5045646651ddff184fe379",
-    "api/v2/openapi.yaml": "516bf500bb740400b679550439b69996a46d07062c8137fdd95c60c9e81bffb2",
+    "api/seams-v2.yaml": "3417edc9197081b8854d60afd4758f84c86c53e2b9686012ed0f764b0c3150a7",
+    "api/v2/asyncapi.yaml": "bc2c53438cb143d2b98ba96f5470ca182017711715e66b2d00d1b9e797df3c41",
+    "api/v2/openapi.yaml": "a500508bf79ab2fe651ebc74e5fc5f30aaee2c1a6fc29fb7ae698e761e4c0696",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -99,28 +99,28 @@
     "schemas/trigger-subscription.schema.json": "4f7b067f20032073b140c4bb15dc9a9914c4f6421a252ff1ff261cbdd8edf270",
     "schemas/ui-plugin-message.schema.json": "346638babf1f8ea7b161cde75c0038b518cd2cc5bf0631772e20a9b74c96b5dd",
     "schemas/v2/a2a-task-state.schema.json": "aa9bd0c15f653b7ecdb17427d61b1bccaf8156972c4b1a437dd3a8afb717b318",
-    "schemas/v2/a2ui-surface-delta-frame.schema.json": "43c10ebfd13c987520f0448df92fe74b52b846833763dfbbd5d35636bf75e8d9",
-    "schemas/v2/agent-deployment-transition.schema.json": "d9fe6f2fa4dda8598bab4e5c051f68473ac0729dc0ebf31605954dda7abf5a80",
-    "schemas/v2/agent-deployment.schema.json": "dd1293ef8f20678bc36fc95fc4e5fcd135acbb10c61c1ddec8bc023e3f22622c",
-    "schemas/v2/agent-eval-suite.schema.json": "b2875edfc28b39c104fbf6f854ecfb81fe2d90b18f828ffd8d3232ef883cd208",
-    "schemas/v2/agent-inventory-response.schema.json": "bbf19724986a867a59ef51c115a43ece1cc4a003836b2f7f45dfefb3078db8f9",
-    "schemas/v2/agent-manifest.schema.json": "006ca6163ca8f9dc9fb91ca1ce01bd4c523f118680f6cbad971a4ac09e975381",
-    "schemas/v2/agent-org-chart.schema.json": "e64f1bcc6c0e9d3fc39c363e8e5e73b2b1fc49275b92f89b0cb941a7a80d67f2",
+    "schemas/v2/a2ui-surface-delta-frame.schema.json": "6889c5da3fe7e76cb614038c0eea6774776fa640448558b258eb87fb50cb9b64",
+    "schemas/v2/agent-deployment-transition.schema.json": "5fb65556576e3d8705a4834d6ab8ab47389123c40f206d39ba672bc03302c544",
+    "schemas/v2/agent-deployment.schema.json": "5581fea8ed8bf99ff05c8df9d3cc007fa2b94a446e7a37a68ea73a513d55b6cd",
+    "schemas/v2/agent-eval-suite.schema.json": "61b184eea19386243eef6e1d9e50d282ae453d71ed3259243d51d73285a16769",
+    "schemas/v2/agent-inventory-response.schema.json": "3f6ce47bab255391f3f546363bc75b3409175050ca8c3ce214be16d6eb67e338",
+    "schemas/v2/agent-manifest.schema.json": "0e6927f1d19ca404dffeb545faf81fa5b1acbaeb1c99b48dd5179071316407ce",
+    "schemas/v2/agent-org-chart.schema.json": "113b079e1dce95908467cbef7f83e076fdb82aab5b0678fc1a43e32bfc9cbadf",
     "schemas/v2/agent-ref.schema.json": "a86e98f7ffcbc4d7da145633e3010842e05e23e153d53c431d28dd72da0ec9de",
-    "schemas/v2/agent-roster-entry.schema.json": "801c7d7aca7bd497df56fdaa68b671eef5193d2b96eb836a8bf438790cb1f0e2",
-    "schemas/v2/agent-roster-response.schema.json": "682d1d1f4c184b14488a270de54c71a685e400e0184e88564cc01e2400367c5b",
+    "schemas/v2/agent-roster-entry.schema.json": "72132a80a3eb305e83727fbf6e105d7bd1790b481231d6ff864fd18d5554fc27",
+    "schemas/v2/agent-roster-response.schema.json": "f646b8a5af9ee884e1a86a9c84ec29f10dd3dbb275711ce79db27bee981d4a1d",
     "schemas/v2/ai-envelope.schema.json": "0dc7dfbf032a37239ffd81fc2d67f999a40782ff5074866a56e414164cdee809",
-    "schemas/v2/annotation-create.schema.json": "c2fc19d055be29bc499e53c4975a562eb76981e12c521a82f63f5827ac6ff6c7",
-    "schemas/v2/annotation.schema.json": "75c6785775d00e62bc1282626c2c27eafde0f93a01c7e80e4e5e985055907475",
+    "schemas/v2/annotation-create.schema.json": "ec32c22a243b343eeb6956a23be2d76ba5b50c8018ec3ec9d6efa5a1d9b0c792",
+    "schemas/v2/annotation.schema.json": "eb4813cdaa8e325412cfcaeeee5c8a28f3751c946dec64e546c7ba0ad3aad8d4",
     "schemas/v2/artifact-type-pack-manifest.schema.json": "85630d1b760d0b41cf5a6fad2acfada39abaf7f0befd95cc4334e1e883e9615d",
-    "schemas/v2/audit-verify-result.schema.json": "cb54c4d89ba5dfb73f49aa8959a980be65c2dc2a87a12f71ba36d3e836fe85da",
+    "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
-    "schemas/v2/capabilities.schema.json": "792669b2cc7b1fd44ce9a4fd3e79696ad1277734e29299a4504b39eda15913ed",
+    "schemas/v2/capabilities.schema.json": "6219faf634cbd137824b66df3a1c71cc5fd964d56f8fc2f6089f226650dde6b5",
     "schemas/v2/certification-bundle.schema.json": "d2cbc5cadddff13630a528dc9673162f582c035c6a6663ca02c1ac53e8fec40c",
     "schemas/v2/channel-presence-payload.schema.json": "9475d46f358d21c19126e78204987a5633979917a2293653354ef5c5e044d54e",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "8df0d9d273ae22efc6876d5586833f1d4c2e551edc3ac6cf6e8f0719329f03dd",
-    "schemas/v2/compact-tool-descriptor.schema.json": "fc03f20c254c0ddc2cba7e7d5a6c46080ebd2cf9fae36f3c2510cbf88aadebdc",
+    "schemas/v2/compact-tool-descriptor.schema.json": "b5c418d72082d5b713bf318212a83397e5be98e56d25ca056302b41b8dd8273b",
     "schemas/v2/compensation-policy.schema.json": "b3c1142637f5bf980f2b0bb67adb47e8cb7abb99a0405a4b6816ccf5d9c089d6",
     "schemas/v2/compensation-projection.schema.json": "f46977c7076347b5473faa8c4bbe73d8321c33b33c98fff2f26ee7cbada4ed98",
     "schemas/v2/configurable.schema.json": "33a6884047e2490f723733bf8b74d3b9164e00374cfea6dc3eac5a70dc368861",
@@ -142,7 +142,7 @@
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "0a06fbbdc8ba797a6818c79336a98e211ac5ba5747945b4e4098072cd3974d79",
     "schemas/v2/error-envelope.schema.json": "72d3332fad8fa36d07439c830acf352eefc6da2379374faa2ebbe49e98b8cb08",
-    "schemas/v2/eval-summary.schema.json": "bcb165148531d33b7dc01de83da3a049d19ebbef6d12300b17a234c7b03d77d9",
+    "schemas/v2/eval-summary.schema.json": "9d31025752d0f67ad3b8a32e82a5314972c530ef9f780dd82e484ae8c5131198",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "307884e57946703b6f86ec283034bf56beb68bea4a000743ebbc9eebeed31b07",
     "schemas/v2/frontend-plugin-manifest.schema.json": "fed6b8ddb3056c53b1bfc91525410a4445a3c37a8bf9eb9f6f9964ffea26d993",
@@ -151,29 +151,29 @@
     "schemas/v2/heartbeat-state-changed.schema.json": "eb68d0082aa996650e3a6b8ccf32457f959cebc7e6728cc7c331b9d171a4bef6",
     "schemas/v2/ids.schema.json": "05c98e3f8a72fa79be123765bd9c2ea7c6620188d69df8524160399225316cd6",
     "schemas/v2/localized-content-language-settings.schema.json": "92240f19a2b4b2f05ab41a797f703485a28813848035478e72f395edd04c1d35",
-    "schemas/v2/localized-content-page-response.schema.json": "476b5f2775b42e35e679814a4ce846a7be1d5311d3a748c10df4275a78b0fb27",
-    "schemas/v2/localized-content-page.schema.json": "717bb51fbc64d0b34eb0a4b35c8b463d08d505267bf251b4cbc67e0a016a567a",
+    "schemas/v2/localized-content-page-response.schema.json": "ef48329749758afb21e4d3cbc3f017abb911f75726819457f35b9f1390332c75",
+    "schemas/v2/localized-content-page.schema.json": "e0f97660121955d6705d935f34e748adb739ac70f8536a009cd8d6f303735151",
     "schemas/v2/localized-content-section.schema.json": "29c7bad0ad9ebc6c45211282e8afb3fdb35a4ca075ce0404b6e2c29f35fa5313",
     "schemas/v2/memory-entry.schema.json": "290576ae84f4fef4cdf975932b87963283b11c50ea3d2654b32cd96aa6537c3d",
     "schemas/v2/memory-list-options.schema.json": "f66703bccb68efb28391c273abb66aa117ee5b5ce475c477846ed700c336afcd",
     "schemas/v2/node-pack-manifest.schema.json": "0da826ca63a29026f7a9551748048104910e0d9962db6bad2b50b97a24a9ea30",
     "schemas/v2/orchestrator-decision.schema.json": "2da17538e84cfbe70151eb118f1ccf670cff58b8697148e394074d32ac4af6b4",
-    "schemas/v2/org-chart-responsibility-view.schema.json": "ebac7d2889bfd659bcf30311efb0d6eb0c7e940b972b6b62da69c7351b5bb586",
+    "schemas/v2/org-chart-responsibility-view.schema.json": "8a2565e4cdc6737a3946a70799f93642808b92f9c8d56dcdff3a0782053b89a1",
     "schemas/v2/pack-lockfile.schema.json": "2685417702c105146b780cd99154296a46578fbb10d81c8c713348ee26fea898",
     "schemas/v2/prompt-kind.schema.json": "67251c937a5a91fb97c0422050e808dc0c162a9b8561366814cf87b0a7f62e00",
-    "schemas/v2/prompt-pack-manifest.schema.json": "a51667da3d601043d2c33fddaafa572e9dd7e47b8840393742b80eaf6238a1a5",
+    "schemas/v2/prompt-pack-manifest.schema.json": "8e77d23840250640d26f2f99c1c5902e79bf4a6974cae2d6c6637176236bddb9",
     "schemas/v2/prompt-ref.schema.json": "11538fa36a7a652c93100cac4f1857eb4130137b546e3d94890618636d44b729",
     "schemas/v2/prompt-template.schema.json": "494fc83028cb3af5dbb8a943d0e83b2348f7775e9fa02369162bcb58a6f81559",
     "schemas/v2/proposal.schema.json": "cb5ea4fcb54be94fd2a92cf2799357dc73335181a89f5766f432d69e21cc3a80",
     "schemas/v2/registry-version-manifest.schema.json": "270704ebc6bae63be949efbf9503578938b103733db9da3cb8fcbee1cd7684dd",
-    "schemas/v2/residency.schema.json": "af2658a7104cbcacd0e20a91226271c4a77f91ef46ae97612768fe743e6091d8",
-    "schemas/v2/run-ancestry-response.schema.json": "907e36341ba83a2147a5d76963950b6dcd47506b663ecbccae9dfa553f3724d3",
-    "schemas/v2/run-diff-response.schema.json": "6ab6cd265dc7e0a2086c6659c46aa0e7b43e6302949f0adac5d7deb1c7c0ecd3",
-    "schemas/v2/run-event-payloads.schema.json": "3a7161af78b0dd2730309371f5ea8b889d92a37c708db05e4354209f12ffbe30",
+    "schemas/v2/residency.schema.json": "3fd23c9732beb140504e81560fc426eb6764d547e56da5fb92c5a5c7bf04db3a",
+    "schemas/v2/run-ancestry-response.schema.json": "334c17f2062dea62726ca1d07b8be3f169cdc422af843c1def5fb317039814c9",
+    "schemas/v2/run-diff-response.schema.json": "8bdb2045c274580038bd74781f7d062f5049839797c164a89de4ed89edc53a74",
+    "schemas/v2/run-event-payloads.schema.json": "1d3ccffc4e506d3109c17990e01976ba935e61672562684b9635743d56af3f57",
     "schemas/v2/run-event.schema.json": "1a9946374af9323b71635d00fed22abe02c300fa2cf3ae3e9c30f3e553e408ec",
-    "schemas/v2/run-options.schema.json": "ff240805478158cbd2f661979c5eb4f5eda11f9c053b7ba587cb0211a9252d74",
+    "schemas/v2/run-options.schema.json": "f0e9f494d80086c2ed2cf9fe87df54e5b4e66601699c4a1089f4edbc7ba58867",
     "schemas/v2/run-orchestrator-decided-event.schema.json": "bb76e15ff72e669f12938684033b55dc567470e1a378e19ffc3fa0e4034ab5a7",
-    "schemas/v2/run-snapshot.schema.json": "0ee8a50c6be210db415a7c4345298e70a6ae3dd0dd764ccc514bc1c501437586",
+    "schemas/v2/run-snapshot.schema.json": "65a3c82220da2e1a54324665d517dc0e627225f3d37ef75b43bef3fb7e3bac0e",
     "schemas/v2/security-advisory.schema.json": "6a382f737730a738d634266315e9d335e5760020a0cdd9f30727c2f987a01770",
     "schemas/v2/self-hosted-runner-dispatch-frame.schema.json": "d8129f11d4e731d17ea951e66faaea2086081d13958b62ceaaa359fd6637dd7d",
     "schemas/v2/self-hosted-runner-registration.schema.json": "93d60003a668cacb0eeac37699ca2884c6b79332d9494cb9e0a1752ac8f8a16c",
@@ -181,14 +181,14 @@
     "schemas/v2/subject-link.schema.json": "1fc941d6c14af886534009f2ffa6611e2035eb07e30b1df918c50d6bafff026c",
     "schemas/v2/subject.schema.json": "094e981fb20052a911393e219ea5f2065d8b8417b65080a70c5ea99fd960a8fe",
     "schemas/v2/suspend-request.schema.json": "28451d35f4f49a075d26b2be7e0d1cd2287a196b3d41819edf146fdc8c862756",
-    "schemas/v2/tool-descriptor.schema.json": "c7f96ddb5c5a1cda5a40078b9b70dd0026658c42c92394c369c54a0427458527",
+    "schemas/v2/tool-descriptor.schema.json": "658b18ef173e0f12d732f92d4866a9b3daeb8f88b493db8b025a577e09dd681c",
     "schemas/v2/trigger-event.schema.json": "7227fb9a130c33374fa8eab35e4448c4e8f22c962b8f271781cf4dbb5e4288b7",
-    "schemas/v2/trigger-subscription-registration.schema.json": "202f7ab9c29e78249e0ad04341ac53377b506d24a0cbfbb7bb54494e80165832",
+    "schemas/v2/trigger-subscription-registration.schema.json": "04bc314a07c7e8b565577cb8df5821d968ce2af915900dfdccd4a24e928d20db",
     "schemas/v2/trigger-subscription.schema.json": "074bec7f016aa9f4d60359c3a093296cc847045510f01e0a9dceaf4fa5084d12",
     "schemas/v2/ui-plugin-message.schema.json": "879d65867c01656b3962d64283e66364dcb8f626ad26c5fcf2d2d55a79ae0ce9",
     "schemas/v2/webhook-delivery.schema.json": "66025cd7b7899b6897b61c61e99ec2c554e232a6c9742124441adcd81912cef0",
     "schemas/v2/workflow-chain-pack-manifest.schema.json": "22801f14845a3df30660e6f31a41e1a3fbff2425bf56c8a475eab96f1c95882a",
-    "schemas/v2/workflow-definition.schema.json": "da7e565cee6ecf3bcc9d46833bad224f579f8db8a378ae22ff3fbf58b1348f38",
+    "schemas/v2/workflow-definition.schema.json": "9aafddec32b84eb6aec3185be024850f1b9444c6193568771b0b636595fef136",
     "schemas/v2/workload-identity.schema.json": "1f589debfac6d70e0908da511550ec69a27b4bcc8314551cd843b6d923605efc",
     "schemas/v2/workspace-file-create.schema.json": "b6b5260857318c3b67de0231ed15e3a746f525880a763e7b36a7854178dd10d0",
     "schemas/v2/workspace-file.schema.json": "d2ed39e8c229dde33b56905c8df6f8b2ff056c97e1c5f615e3124baa54a6254f",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "c118d81c173a26a9349dba9a9958c310c658f798564540c26c3e614a3fdd3514",
+    "spec/v1/core-standard-manifest.json": "c19060310025c9e5622cf5218f54da8e681c1e7dd84a89f7177aaea295d42a6a",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -211,27 +211,27 @@
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
     "spec/v1/spec-gaps.json": "6cc9962c6b969f632e07a78b52a4f61447ff579e2990cbae989866f584a86042",
-    "spec/v2/README.md": "f56bd8d58be4ac04543c9f7b2fe92b294738d6121a4f21cbd1ce751e72b94c83",
-    "spec/v2/core/capabilities.md": "0f222434bbe58c881362a626ab9db6bce0ae2e54cb858e3d71b662dd1fc13150",
-    "spec/v2/core/conformance.md": "6dda58339117819b77710cd53d25f34cc9e602a35a7958d1afc4e3d4b6b7de23",
-    "spec/v2/core/connection-packs.md": "34e519dbe5b091c9758729787d398b35b1dc41f1e01ebd028e7e6b838ce2f6ee",
-    "spec/v2/core/errors.md": "671895de1b7c987a1dfd53fe0a814159efadae0ffd4c8c06bf1749d345270580",
-    "spec/v2/core/events.md": "7b9207079cede7ec335126b98bcb95d655ae3b7322b18febd1b4df51750b0a33",
-    "spec/v2/core/form-content-packs.md": "976f6e9b05a015f3bfe0748bc4f8bb11bbbd71460d12769f900bcde006b7cbb1",
-    "spec/v2/core/headers.md": "b7fc4f77904653ad47360b20302e3f406973821fb6d74ac86d6e81b674f52c4a",
-    "spec/v2/core/idempotency.md": "0ab68c1e41e81005b560421a3d22f985dda2f7537b2369bff67e40b79c8a581f",
-    "spec/v2/core/identity.md": "e3fa8d2d87c1dec2673e4bf4aec5f2257c684eaf64161c1a1016a634a87509c2",
-    "spec/v2/core/interop.md": "f701fddf15343d878faea31401e25e6ffb3672c2c8a87f30adc13b1e3c5c300c",
-    "spec/v2/core/interrupt.md": "4bd345bccdb8e2762ca95833cc67086158640c27ffa5ef84915a4ab3de348440",
-    "spec/v2/core/overview.md": "8ece6667535d24ed4013a046cb11e1a649f70e39625fc55e09ceb2c02505ed9c",
-    "spec/v2/core/packs.md": "90f32947816b4ec2b045b063ad2914126c73353883514a270ad200205dc8e51b",
-    "spec/v2/core/persistence.md": "e9830ae228bcbc33f03d81a5f2b51e031466feb84387971dd3459bf5e1687701",
-    "spec/v2/core/replay.md": "19b2fcbda4693895d39b99593f498b76376d77472a813bba6c22fca02e106332",
-    "spec/v2/core/runs.md": "f5f24df6da76b1d6e2cf655af3bbe3340195c36ec8d9ce0ca6e357385b1a8771",
-    "spec/v2/core/security-defaults.md": "53a1bc549aaa356a4fcb56cdb1c4f5880d3fb65d5d49dd570a413bb29aff82e5",
-    "spec/v2/core/versioning.md": "2eb4e8e5a1208a026a3d497d1e0fb76a4f7cb97e514d6f41f45dd66b89405abb",
-    "spec/v2/core/webhooks.md": "1d2719335f8fb46cd31dbb836b44ea7d78ed54f98ea181927502814603c5b935",
-    "spec/v2/core/workflow-chain-packs.md": "99ad4aeeeeb05521720dc2ae18ae63e6d604361780ed1b76778ca6d44da70eed",
+    "spec/v2/README.md": "d7af039a68c81af57ac0a91521308f038c71608988edb196a34d9da9d9474f1e",
+    "spec/v2/core/capabilities.md": "95d1eee8d21e66c0c84591f2cf8bc81438bd39d7419f0ca67a589ec6e6cda4d1",
+    "spec/v2/core/conformance.md": "c235144f9a83bd5fcc9d15998e480970f5ac05ea9e57fc0036abe3a21f3d2016",
+    "spec/v2/core/connection-packs.md": "4b3fb729d94842000f0af91e2dcc6f163a910a37de41f3ac07dfcfb03179c3f1",
+    "spec/v2/core/errors.md": "f2ca092dce5d599111c28fb58638a82cc46807a1cefc38e65df454d3f133334e",
+    "spec/v2/core/events.md": "6f76e236b345e0c2a20e5b33e8230ebb73b8d20559fcc67a1c47041b6c633f87",
+    "spec/v2/core/form-content-packs.md": "eb84cda14d567c3d6a81d1806566b7fb20b70cf85bdc534183bf66529e213179",
+    "spec/v2/core/headers.md": "7e522187bac1de477ede8071d2241f8baca6df0909b20b09b01748e618a33685",
+    "spec/v2/core/idempotency.md": "ed6981d0021b101c244d2d4d2222d72bf01ceb6e12622c9b720d4e120c29bd47",
+    "spec/v2/core/identity.md": "ea5a5626aa6189f7cb8949fe5404d213df19f9452b872fa1ed7f1e0449e889d4",
+    "spec/v2/core/interop.md": "4d3aa4aff637edd4f8ae064ac9fcbabb0d650d55b2a95a3a0b021a2e737df616",
+    "spec/v2/core/interrupt.md": "e456eb307d43121baf0f1b6c7d514f11f71c1f3fbd0f36ded99d8d804cf8ba49",
+    "spec/v2/core/overview.md": "7e9ec5f693f59f36139671138050c731abeb1b33eb262abe51554371e0c86991",
+    "spec/v2/core/packs.md": "c0a98373f5d10a1fbc6d6865d9068125eca8983b9bc5d45780776e010c4cf1b4",
+    "spec/v2/core/persistence.md": "fdfc2269ebf63972626654a6907c648aa9b231be65a54679930b6279dd12afeb",
+    "spec/v2/core/replay.md": "793e0256c3d7551e20ccaf9ff51990f1ac9db096508e80ff57dd1bbf9f89f7fb",
+    "spec/v2/core/runs.md": "7fe674de4c54a9f86f00c4fc0f3ff18ea191a2bdd9b048beafc2b93f97857fcc",
+    "spec/v2/core/security-defaults.md": "8bd0a3be854310bb7ec49c757e75914a0c9713e94db25193d5c158e1e3e04ac9",
+    "spec/v2/core/versioning.md": "9da951272cb11a7f66c4f294c8d6dca97408535ea16445cb63f1d9330ae2cdae",
+    "spec/v2/core/webhooks.md": "7a8a5c5eebe3226b5eacecfb222abd91d2e44a20eb201a15b36a7ffced2e1cde",
+    "spec/v2/core/workflow-chain-packs.md": "79f5ea4e52020531fd360868c12ebf0640c2e833f6b6fb207091a063130a68e5",
     "spec/v2/declaration.json": "bd8a1dcee899a4478ac96b52da6ee07e1cb5fce4465939ac32e19e52f4d5c6b2",
     "spec/v2/declaration.schema.json": "eac5f8080bd572f147bd57d0c4ac8ad73b14536d9236222490ae29a33b21e184",
     "spec/v2/errors.json": "f179414a92f30b5dadf26e9e57699649a67324bd7186d5287647d17605d137d3",
@@ -268,8 +268,8 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "5bf850da0ebcc8aaedbc9ded9064a760d4de798061ebeff0d8b890d78dc1d13a",
+    "spec/v2/release.json": "c866befad1b142734532a7bf987ead39497369ee50678b107c1a0c3f5fea6c6d",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "949920131eb3c035a14d6fb1d3e60163949803bb"
+  "corpusCommit": "203d6e8c285fc45875a3f1beca4f4812bb6bbb7e"
 }

package/src/scenarios/v2-advertised-path-space-served.test.ts

@@ -36,6 +36,21 @@
  * need no fixture, mutate nothing, and a route that is not mounted answers 404
  * regardless of auth, so the check is unaided and safe against a live host.
  *
+ * The manifest scoping is the RULE's scope, not just this instrument's budget.
+ * `versioning.md` §1.2 binds "every operation named in
+ * `spec/v2/path-manifest.json` that it serves under the other" — surfaces the
+ * manifest does not name are outside the paragraph. That qualifier was added
+ * after a tier-2 host asked whether its four proprietary `/v1` roots were
+ * bound: the older unqualified wording said "every operation it serves", which
+ * this scenario has never measured and which `conformance.md` §"Test seams"
+ * contradicts by requiring the manifest to omit seam operations. Stating the
+ * scope in both places is deliberate — a rule whose prose quantifies wider than
+ * its only instrument reports a general claim from a sampled one.
+ *
+ * What remains UNMEASURED even so: non-GET and parameterised manifest
+ * operations. The prose binds them; nothing here probes them. The motivating
+ * defect was `POST /webhooks`, found by hand, not by this file.
+ *
  * @see spec/v2/core/versioning.md §1.2
  * @see RFCS/0172-v2-versioning-and-release.md §A.1
  */

package/src/scenarios/v2-id-grammar.test.ts

@@ -9,6 +9,16 @@
  * by hand so a failure names the field). A crafted id whose tenant segment is
  * not the caller's MUST be refused — `403 id_tenant_mismatch`, or `404
  * not_found` where the host chooses not to leak existence.
+ *
+ * Suite 2.0.10 adds the bare-id leg (`identity.md` §5, stated 2026-09-10):
+ * a major-2 request whose tenant-bound path parameter carries only the opaque
+ * segment — the v1 spelling of the run this caller just created — is the
+ * overlap's affordance. While the host advertises a `1.x` member it MUST
+ * resolve the bare id under the caller's tenant and answer 200 with the BOUND
+ * id in the body (the same rule `v2-dual-stack-negotiation` measures for a
+ * `/v1/`-created run); once no `1.x` member is advertised it MUST refuse the
+ * bare form `400 validation_error`. The leg decides which branch applies from
+ * live discovery, so it is the expiry's witness as well as the affordance's.
  */
 
 import { describe, it, expect } from 'vitest';
@@ -74,4 +84,24 @@ describe('v2 id-grammar (RFC 0170 §D.1)', () => {
     expect(code === 'id_tenant_mismatch' || code === 'not_found', req('openwop.requirement.0170.id-grammar.tenant-binding', DOC, `the refusal MUST carry id_tenant_mismatch or not_found (got ${String(code)})`)).toBe(true);
     expect(res.status === 403 ? code === 'id_tenant_mismatch' : code === 'not_found', req('openwop.requirement.0170.id-grammar.tenant-binding', 'spec/v2/core/errors.md', 'the code MUST be answered with its registered HTTP status (id_tenant_mismatch → 403, not_found → 404)')).toBe(true);
   });
+
+  it('a bare (unbound) run id in a major-2 path: admitted under the caller\'s tenant through the overlap, refused 400 validation_error after it', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    const versions = Array.isArray(doc['protocolVersions']) ? (doc['protocolVersions'] as unknown[]).filter((v): v is string => typeof v === 'string') : [];
+    const overlap = versions.some((v) => v.startsWith('1.'));
+    const c = await createRun();
+    if ('reason' in c) return softSkip('blocked', c.reason);
+    if (!RUN_ID.test(c.runId)) return softSkip('blocked', `the created runId is not tenant-bound (${c.runId}) — the snapshot leg reports that; nothing to strip here`);
+    const bare = c.runId.slice(c.runId.indexOf('/') + 1);
+    const res = await http(() => driver.get(`/runs/${encodeURIComponent(bare)}`));
+    if (res === null) return softSkip('blocked', 'GET /runs/{bare runId} unreachable (fetch failed)');
+    if (overlap) {
+      expect(res.status, req('openwop.requirement.0170.id-grammar.bare-id', DOC, `through the overlap (protocolVersions ${versions.join(', ')} carries a 1.x member) a bare run id on a major-2 path MUST resolve under the caller's tenant — 200 for the run this caller just created; got ${res.status} ${readErrorCode(res.json) ?? ''}`)).toBe(200);
+      expect((res.json as { runId?: unknown } | undefined)?.runId, req('openwop.requirement.0170.id-grammar.bare-id', DOC, 'a resource reached by its bare id MUST still be named by its bound projection in the major-2 response body (versioning.md §5) — the affordance is on the path parameter, never in a document')).toBe(c.runId);
+    } else {
+      expect(res.status, req('openwop.requirement.0170.id-grammar.bare-id', DOC, `after the overlap (protocolVersions ${versions.join(', ')} carries no 1.x member) the bare form MUST be refused 400 validation_error — the v1 spelling has nothing left to bridge; got ${res.status} ${readErrorCode(res.json) ?? ''}`)).toBe(400);
+      expect(readErrorCode(res.json), req('openwop.requirement.0170.id-grammar.bare-id', 'spec/v2/core/errors.md', 'the refusal MUST carry validation_error — not id_tenant_mismatch (no segment to mismatch) and not not_found (a form the host no longer admits is not looked up)')).toBe('validation_error');
+    }
+  });
 });