@openwop/openwop-conformance 2.3.1 → 2.3.2

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.3.2] — 2026-09-17 — the webhook reader read the wrong field
+
+**Why a patch.** No scenario is added or removed; one is corrected. The 2.3.1 file asserted `event.owner` on a `run.completed` delivery — the envelope is closed and names no `owner`, and that payload carries none — so leg 1 was unsatisfiable and leg 3 vacuous on every host. Found by the reference host's W4 cut.
+
+### Fixed
+
+- **`v2-webhook-delivery-shape.test.ts`** — subscribes to `run.started`, whose
+  payload is where the owner echo lives (`runStarted.owner`). Leg 1 validates the
+  delivery against `webhook-delivery.schema.json` (v2) and the payload against the
+  v2 `runStarted` definition; the owner carries `subject`, never `principal`.
+  Leg 2 registers at `POST /v1/webhooks` (`versioning.md` §1.4) and validates the
+  payload against the **v1** `runStarted` definition — the owner's keys are not
+  the discriminator (v1 admits `subject`, RFC 0165 §B); the integer-vs-string
+  `engineVersion` is. A host with no 1.x webhook surface records leg 2
+  `inapplicable`. Leg 3 reads the seeded era-2 run's `run.started`; a host that
+  does not fan out seeded history records it `inapplicable`. Two 2.3.1 gates were
+  vacuous and are fixed: leg 2 read `versions.supported` (no such field — it is
+  `protocolVersions`), leg 3 read `era2Gate`'s `null` (= seam advertised) as
+  absence. Same requirement id, same gate.
+
 ## [2.3.1] — 2026-09-17 — the webhook body is finally read
 
 **Why a patch.** One scenario file is added, which `PROTOCOL-STATUS.md` calls a minor — but the previous cut (2.3.0) was a minor ninety minutes ago and this file witnesses a MUST that predates it; cut as a patch alongside the register and ext-rule edits it ships with. If that reads as bending the rule, the rule wins and this becomes 2.4.0 on review.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.3.1",
-  "stampSha256": "a1a2aa236d43d69c8c79578154eb02fad1679816bc8f11052dab46a735f4ea8b"
+  "version": "2.3.2",
+  "stampSha256": "289cdb31636a1924cde0a125d8cd2d5d1ae5d9c590a59ec10dddf0344ebac4a2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.3.1"
+    "@openwop/spec-artifacts": "2.3.2"
   }
 }

package/requirements.json

@@ -29227,51 +29227,69 @@
       ]
     },
     {
-      "id": "openwop.it.v2-webhook-delivery-shape.a-major-2-subscriber-receives-the-v2-payload-the-body-validates-and-owner-is-exa",
+      "id": "openwop.it.v2-webhook-delivery-shape.a-major-2-subscriber-receives-the-v2-rendering-the-delivery-validates-and-run-st",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 107,
-      "title": "a major-2 subscriber receives the v2 payload: the body validates and owner is exactly {tenant, subject}",
+      "line": 172,
+      "title": "a major-2 subscriber receives the v2 rendering: the delivery validates, and run.started.owner carries subject, never principal",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
         {
-          "section": "spec/v2/core/webhooks.md §Deliveries",
+          "section": "spec/v2/core/webhooks.md §Delivery",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §Delivery",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "spec/v2/core/webhooks.md §Deliveries",
-          "requirement": "a major-2 delivery's owner MUST be exactly {tenant, subject} — a v1 owner block (principal, principalKind) on a v2 delivery is the fan-out forwarding the in-process dialect instead of projecting"
+          "section": "spec/v2/core/webhooks.md §Delivery",
+          "requirement": "a major-2 run.started payload MUST carry the owner echo { tenant, subject } (identity.md §1; run-event-payloads runStarted.owner requires both)"
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §Delivery",
+          "requirement": "a major-2 owner echo MUST NOT carry the v1 keys principal / principalKind — that is the fan-out forwarding the in-process dialect instead of projecting"
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §Delivery",
+          "requirement": "a major-2 owner echo carries tenant and subject"
         }
       ]
     },
     {
-      "id": "openwop.it.v2-webhook-delivery-shape.a-major-1-subscriber-still-receives-principal-the-v1-wire-does-not-move-mid-over",
+      "id": "openwop.it.v2-webhook-delivery-shape.a-major-1-subscriber-still-receives-the-v1-rendering-the-v1-wire-does-not-move-m",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 123,
-      "title": "a major-1 subscriber still receives principal — the v1 wire does not move mid-overlap",
+      "line": 191,
+      "title": "a major-1 subscriber still receives the v1 rendering — the v1 wire does not move mid-overlap",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
         {
           "section": "spec/v2/core/versioning.md §1.2",
-          "requirement": "a major-1 subscriber MUST still receive the v1 owner block (principal) — projecting every channel to v2 is as wrong as projecting none; the projection is contract-scoped"
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.2",
+          "requirement": "a v1 owner echo, when present, names the tenant (v1 runStarted.owner requires it)"
         }
       ]
     },
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-seeded-era-2-run-is-delivered-projected-too-the-fan-out-branch-a-fresh-run-can",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 140,
+      "line": 214,
       "title": "a seeded era-2 run is delivered projected too — the fan-out branch a fresh run cannot reach (seam-gated)",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
         {
-          "section": "spec/v2/core/webhooks.md §Deliveries",
+          "section": "spec/v2/core/webhooks.md §Delivery",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": "spec/v2/core/webhooks.md §Deliveries",
-          "requirement": "a projected era-2 delivery MUST NOT carry the v1 owner block"
+          "section": "spec/v2/core/webhooks.md §Delivery",
+          "requirement": "a projected era-2 delivery MUST NOT carry the v1 owner keys"
         }
       ]
     },

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.3.1",
-  "corpusTag": "v2.3.1",
+  "version": "2.3.2",
+  "corpusTag": "v2.3.2",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "435a0973ffffcf4cc97a976d74960f5009a192928024892f16ce3a09032be58f",
-    "api/v2/asyncapi.yaml": "92073792728f18b3f6359c0890e476c7fd8605f4ead64e5ccf2158122be10288",
-    "api/v2/openapi.yaml": "05a0e36372f012ceac51f6a20c757e73d6a61c77c902f2730a886390c7dba545",
+    "api/seams-v2.yaml": "7c79a7846a32c54f4281bf62dc00f7fa98d512da21d5665f29ab1e184eecb07e",
+    "api/v2/asyncapi.yaml": "ca998bb1cfc15d0f43ca113e329eec688fcaf8cfa058d9d146678baa6a7ae88b",
+    "api/v2/openapi.yaml": "107e30840cc96f0ba8ff01bc84614b4e6d5ca59502141b586acc1f9c67fc7ac1",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -141,7 +141,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "0a06fbbdc8ba797a6818c79336a98e211ac5ba5747945b4e4098072cd3974d79",
-    "schemas/v2/error-envelope.schema.json": "72d3332fad8fa36d07439c830acf352eefc6da2379374faa2ebbe49e98b8cb08",
+    "schemas/v2/error-envelope.schema.json": "9c8f747e5bea81943d70e0930bc7d26586a4c3a3d90be77f46359b19b7e56cbe",
     "schemas/v2/eval-summary.schema.json": "9d31025752d0f67ad3b8a32e82a5314972c530ef9f780dd82e484ae8c5131198",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "307884e57946703b6f86ec283034bf56beb68bea4a000743ebbc9eebeed31b07",
@@ -200,7 +200,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "a6fecfb708deb4d6fa5fb65b28fcdaff5101b73f8b9812295ab5c6e44105cd25",
+    "spec/v1/core-standard-manifest.json": "bc852483ed0fe13b8d1898aa146794b05ab370d5c336bd26a8d25b25ae69b464",
     "spec/v1/deprecations.json": "508071308e762c281807b487e8f3840a1a69b978071894593e18f2e2d3e4b5c0",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -216,8 +216,8 @@
     "spec/v2/core/capabilities.md": "c5107a4964e487c20bbb5254cfe1f706e0d9ba7e34da9070bc43b50b385e7948",
     "spec/v2/core/conformance.md": "622084e3c74c4549087f4d861b1bb98cec201a0c5aec23788d27f53a355fde3b",
     "spec/v2/core/connection-packs.md": "1d759681e2962f5103228c52c45f24607ed4bb9ae73e30605f690c1d5a59e9ee",
-    "spec/v2/core/errors.md": "74fdb5862f432a831cf0c2eadbe0c8cca6b2660ec578180ae33db54773a1df28",
-    "spec/v2/core/events.md": "8162bb96730ef8a98b19eb180a0251a107fd629d993fe57345dacf81e53561ca",
+    "spec/v2/core/errors.md": "ad85fc830139e587f20deabf88297b91b1fb6ce31e80d5442624a650246ab16e",
+    "spec/v2/core/events.md": "20112f459e7f1bcab0e93fbfc2e28719ecd1435228e87c5476b9eaa691558603",
     "spec/v2/core/form-content-packs.md": "6ffaae85d4550be48dd53fb6e2959af8aceb35bd87c5343b722885084f197713",
     "spec/v2/core/headers.md": "2dd67d71673539e16612f09f3f2513a384f6566052d7cd8a00885885689854c2",
     "spec/v2/core/idempotency.md": "b86c352d964aebad532727f314e26ed2177d49de382076fa64d3162e2f56118d",
@@ -235,7 +235,7 @@
     "spec/v2/core/workflow-chain-packs.md": "ef2b07d2d99334eaec0cc370314e2ad2f84ea58deb699e5d92e6e52d6056613f",
     "spec/v2/declaration.json": "a09bac61c1b825e4a77b5abc0f86f1f8c20c381e0650eb08c2f6d0ef0aaec1dc",
     "spec/v2/declaration.schema.json": "c86e3083fb9789c1958ecb4576cc6f71aa90e6f339521139238543ed08211dd4",
-    "spec/v2/errors.json": "f179414a92f30b5dadf26e9e57699649a67324bd7186d5287647d17605d137d3",
+    "spec/v2/errors.json": "4ff032033f02d7e3fb4204581456408ba5e7642b438c1f349bbd1c264e63e419",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
     "spec/v2/ext/README.md": "c7dea12c48772047f18b111e73be1c236460e72d9bf98026351d148a2ac4f608",
@@ -271,8 +271,8 @@
     "spec/v2/path-manifest.json": "a6f4e652e866889e8bde815874062f62929aee95dc8e58e7152c56adee262163",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "1538b049aded80392b532e908ad2014d0ffef5332d3e669e96ce67955222d146",
+    "spec/v2/release.json": "7b9a9aa90aa93dcf69076cd0a47c08043f6cf02b104280ab906deb0058c2caad",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "01a0723e291e8ef278530aff82b5d9c66c754781"
+  "corpusCommit": "bad44bb22b53e538ec05e867299c4c2dddbfee5f"
 }

package/src/scenarios/v2-webhook-delivery-shape.test.ts

@@ -1,7 +1,7 @@
 /**
- * `spec/v2/core/webhooks.md` §Deliveries — a major-2 webhook delivery carries the
- * v2 payload, not the host's in-process dialect (suite 2.3.1, target major 2;
- * gated on the `webhooks` family; creates one run per leg).
+ * `spec/v2/core/webhooks.md` §Delivery — a webhook delivery's `event` is the
+ * verbatim run event AS THE SUBSCRIBER'S CONTRACT RENDERS IT (suite 2.3.2,
+ * target major 2; gated on the `webhooks` family; creates one run per leg).
  *
  * `webhooks.md:22`: "The delivery envelope is generated from the same payload
  * definition as the event itself and the CloudEvents mapping — one source,
@@ -14,19 +14,33 @@
  * `principalKind`) — with every webhook scenario green. The wire truth is per
  * channel, and a channel nobody's scenario reads is a channel that can drift.
  *
+ * WHERE THE OWNER LIVES (the 2.3.1 → 2.3.2 correction). The owner echo is a
+ * property of the `run.started` PAYLOAD — `run-event-payloads.schema.json`
+ * `runStarted.owner`, `{ tenant, workspace?, subject }` on the v2 wire and
+ * `{ tenant, workspace?, principal?, principalKind? }` on the v1 wire, both
+ * `additionalProperties: false` — not of the event envelope, which is closed
+ * and names no `owner` in either major. 2.3.1 subscribed to `run.completed`
+ * (whose payload is `{ outputs, durationMs }`) and read `event.owner`: a
+ * predicate no host could satisfy, and a third leg that passed vacuously.
+ * This file subscribes to `run.started` and reads `event.payload.owner`.
+ *
  * Three legs, and the SECOND is the one that keeps the first honest. Leg 1: a
- * major-2 subscription's delivery body validates against `run-event.schema.json`
- * (v2) and `owner` is exactly `{tenant, subject}`. Leg 2: a major-1
- * subscription still receives `principal` — `versioning.md` §1.2 forbids moving
- * the v1 wire mid-overlap, so a host that projects BOTH channels to v2 is also
- * wrong, and a v2-only check would reward it. Sabotage on the reporting host:
- * dropping the fan-out projection reds leg 1 and leaves leg 2 green. Leg 3 is
- * seam-gated: the tier-2 host's fan-out is ERA-aware, not major-aware — an era-3
- * row was projected on write and passes through; only era-2 rows take the read
- * projection — so a single fresh (era-3) run witnesses one branch. A seeded
- * era-2 run witnesses the other.
+ * major-2 subscription's delivery validates against `webhook-delivery.schema.json`
+ * (v2), its `run.started` payload against the v2 `runStarted` definition, and
+ * the owner carries `subject` and never `principal`. Leg 2: a major-1
+ * subscription's `run.started` payload validates against the V1 `runStarted`
+ * definition — `versioning.md` §1.2 forbids moving the v1 wire mid-overlap, so
+ * a host that projects BOTH channels to v2 is also wrong, and a v2-only check
+ * would reward it. The owner's keys are NOT the discriminator: v1's owner admits
+ * `subject` (RFC 0165 §B) beside `principal`, so a v2 owner is a valid v1 owner;
+ * the v2 payload's integer `engineVersion` (string on v1) is what the v1 wire
+ * cannot carry, and the v1 definition catches it. Leg 3 is
+ * seam-gated: the tier-2 host's fan-out is ERA-aware, not major-aware — an
+ * era-3 row was projected on write and passes through; only era-2 rows take the
+ * read projection — so a single fresh (era-3) run witnesses one branch. A
+ * seeded era-2 run witnesses the other.
  *
- * @see spec/v2/core/webhooks.md §Deliveries
+ * @see spec/v2/core/webhooks.md §Delivery
  * @see spec/v2/core/versioning.md §1.2
  */
 import { afterEach, describe, it, expect } from 'vitest';
@@ -45,10 +59,13 @@ import { era2Gate, seedEra2Log, v1FixtureLog } from '../lib/era2-seed.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
 
 const ID = 'openwop.requirement.0171.webhook-delivery-shape';
-const DOC = 'spec/v2/core/webhooks.md §Deliveries';
+const DOC = 'spec/v2/core/webhooks.md §Delivery';
 const FIXTURE = 'conformance-noop';
+/** The one event type whose payload carries the owner echo — the field that differs between the two wires. */
+const EVENT_TYPE = 'run.started';
 
 type Delivery = { body: string; headers: Record<string, string | string[] | undefined> };
+type Validator = (doc: unknown) => { ok: boolean; errors: string };
 
 async function startReceiver(): Promise<{ server: Server; url: string; deliveries: Delivery[] }> {
   const deliveries: Delivery[] = [];
@@ -67,10 +84,20 @@ async function startReceiver(): Promise<{ server: Server; url: string; deliverie
   return { server, url: `http://${advertise}:${port}/hook`, deliveries };
 }
 
-/** Register a subscription; `major` selects the contract the host speaks to this subscriber. */
+/**
+ * Register a subscription; `major` selects the contract the host speaks to this
+ * subscriber. A 1.x registration goes to `/v1/webhooks` — v1 operations keep
+ * their `/v1/` path keys through the overlap (versioning.md §1.4) — and a host
+ * that serves no 1.x webhook surface answers 404 there, which is `inapplicable`
+ * for leg 2, not a failure: there is no v1 wire to keep still.
+ */
 async function register(url: string, major: 1 | 2): Promise<string | null> {
   const registration = resolveRegistrationUrl(url);
-  const reg = await driver.post('/webhooks', { url: registration.url, events: ['run.completed'] }, { headers: { 'OpenWOP-Version': major === 2 ? '2.0' : '1.0' } });
+  const reg = await driver.post(major === 2 ? '/webhooks' : '/v1/webhooks', { url: registration.url, events: [EVENT_TYPE] }, { headers: { 'OpenWOP-Version': major === 2 ? '2.0' : '1.0' } });
+  if (major === 1 && reg.status === 404) {
+    softSkip('inapplicable', 'host serves no 1.x webhook surface (POST /v1/webhooks not_found) — no v1 wire to keep still');
+    return null;
+  }
   if (reg.status === 400 && readErrorCode(reg.json) === 'webhook_url_rejected') {
     softSkip('blocked', 'host SSRF guard rejected the loopback receiver (webhooks.md §Egress requires it); set OPENWOP_WEBHOOK_RECEIVER_URL to a public https receiver to witness');
     return null;
@@ -92,69 +119,119 @@ async function waitFor<T>(fn: () => T | undefined, ms: number): Promise<T | unde
   return fn();
 }
 
-function v2RunEventValidator(): (doc: unknown) => { ok: boolean; errors: string } {
+/**
+ * The delivery for `runId` carrying the subscribed type. A v1 subscriber may
+ * receive the bare opaque id (versioning.md §5), so the match is on the segment
+ * both spellings share.
+ */
+function deliveryFor(deliveries: Delivery[], runId: string): { event: Record<string, unknown>; envelope: Record<string, unknown> } | undefined {
+  const opaque = runId.includes('/') ? runId.slice(runId.indexOf('/') + 1) : runId;
+  for (const d of deliveries) {
+    if (!d.body.includes(opaque)) continue;
+    let parsed: unknown;
+    try { parsed = JSON.parse(d.body); } catch { continue; }
+    if (parsed === null || typeof parsed !== 'object') continue;
+    const envelope = parsed as Record<string, unknown>;
+    const event = (envelope['event'] ?? envelope) as Record<string, unknown>;
+    if (event['type'] === EVENT_TYPE) return { event, envelope };
+  }
+  return undefined;
+}
+
+function ownerOf(event: Record<string, unknown>): Record<string, unknown> | null {
+  const p = event['payload'];
+  if (p === null || typeof p !== 'object' || Array.isArray(p)) return null;
+  const owner = (p as Record<string, unknown>)['owner'];
+  return owner !== null && typeof owner === 'object' && !Array.isArray(owner) ? (owner as Record<string, unknown>) : null;
+}
+
+/** One Ajv per wire: the v2 tree under `schemas/v2/`, the v1 tree at the root — each addressed by its absolute `$id`. */
+function validators(major: 1 | 2): { ref: (id: string) => Validator } {
   const a = new Ajv2020({ strict: false, allErrors: true }); addFormats(a);
-  const dir = join(SCHEMAS_DIR, 'v2');
-  for (const f of readdirSync(dir)) { if (f.endsWith('.schema.json') && !statSync(join(dir, f)).isDirectory()) { try { a.addSchema(JSON.parse(readFileSync(join(dir, f), 'utf8')) as Record<string, unknown>); } catch { /* dup */ } } }
-  const fn = a.compile({ $ref: 'https://openwop.dev/spec/v2/run-event.schema.json' });
-  return (doc) => ({ ok: fn(doc) === true, errors: a.errorsText(fn.errors, { separator: '; ' }) });
+  const dir = major === 2 ? join(SCHEMAS_DIR, 'v2') : SCHEMAS_DIR;
+  for (const f of readdirSync(dir)) {
+    const full = join(dir, f);
+    if (!f.endsWith('.schema.json') || statSync(full).isDirectory()) continue;
+    try { a.addSchema(JSON.parse(readFileSync(full, 'utf8')) as Record<string, unknown>); } catch { /* duplicate $id */ }
+  }
+  return {
+    ref: (id: string): Validator => {
+      const fn = a.compile({ $ref: id });
+      return (doc) => ({ ok: fn(doc) === true, errors: a.errorsText(fn.errors, { separator: '; ' }) });
+    },
+  };
 }
 
-describe('webhook delivery shape is per-contract (webhooks.md §Deliveries, versioning.md §1.2)', () => {
+const V2 = 'https://openwop.dev/spec/v2/';
+const V1 = 'https://openwop.dev/spec/v1/';
+
+describe('webhook delivery shape is per-contract (webhooks.md §Delivery, versioning.md §1.2)', () => {
   let active: Server | null = null;
   afterEach(async () => { const s = active; active = null; if (s) await new Promise<void>((r) => s.close(() => r())); });
 
-  it('a major-2 subscriber receives the v2 payload: the body validates and owner is exactly {tenant, subject}', async () => {
+  it('a major-2 subscriber receives the v2 rendering: the delivery validates, and run.started.owner carries subject, never principal', async () => {
     if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable');
     if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
     const receiver = await startReceiver(); active = receiver.server;
     if ((await register(receiver.url, 2)) === null) return softSkip('blocked', 'registration refused (reason recorded above)');
     const runId = await driveRun();
-    const d = await waitFor(() => receiver.deliveries.find((x) => x.body.includes(runId)), 15_000);
-    if (!d) return softSkip('blocked', 'no delivery for this run arrived inside 15s — durability is v2-webhook-durable-delivery\'s claim, not this file\'s');
-    const parsed = JSON.parse(d.body) as { event?: Record<string, unknown> };
-    const event = parsed.event ?? (parsed as Record<string, unknown>);
-    const v = v2RunEventValidator()(event);
-    expect(v.ok, req(ID, DOC, `a major-2 delivery body MUST validate against run-event.schema.json (v2) — "one source, three renderings" (RFC 0171 §A.4). ${v.errors}`)).toBe(true);
-    const owner = (event as { owner?: Record<string, unknown> }).owner ?? {};
-    expect(Object.keys(owner).sort(), req(ID, DOC, 'a major-2 delivery\'s owner MUST be exactly {tenant, subject} — a v1 owner block (principal, principalKind) on a v2 delivery is the fan-out forwarding the in-process dialect instead of projecting')).toEqual(['subject', 'tenant']);
+    const d = await waitFor(() => deliveryFor(receiver.deliveries, runId), 15_000);
+    if (!d) return softSkip('blocked', `no ${EVENT_TYPE} delivery for this run arrived inside 15s — durability is v2-webhook-durable-delivery's claim, not this file's`);
+    const v2 = validators(2);
+    const envelope = v2.ref(`${V2}webhook-delivery.schema.json`)(d.envelope);
+    expect(envelope.ok, req(ID, DOC, `a major-2 delivery MUST validate against webhook-delivery.schema.json (v2) — { runId, workspaceId?, event } with event the verbatim v2 run event. ${envelope.errors}`)).toBe(true);
+    const payload = v2.ref(`${V2}run-event-payloads.schema.json#/$defs/runStarted`)(d.event['payload']);
+    expect(payload.ok, req(ID, DOC, `a major-2 run.started payload MUST validate against the v2 runStarted definition — "one source, three renderings" (RFC 0171 §A.4). ${payload.errors}`)).toBe(true);
+    const owner = ownerOf(d.event);
+    expect(owner !== null, req(ID, DOC, 'a major-2 run.started payload MUST carry the owner echo { tenant, subject } (identity.md §1; run-event-payloads runStarted.owner requires both)')).toBe(true);
+    expect(Object.keys(owner ?? {}).filter((k) => k === 'principal' || k === 'principalKind'), req(ID, DOC, 'a major-2 owner echo MUST NOT carry the v1 keys principal / principalKind — that is the fan-out forwarding the in-process dialect instead of projecting')).toEqual([]);
+    expect(typeof owner?.['tenant'] === 'string' && owner?.['subject'] !== undefined, req(ID, DOC, 'a major-2 owner echo carries tenant and subject')).toBe(true);
   });
 
-  it('a major-1 subscriber still receives principal — the v1 wire does not move mid-overlap', async () => {
+  it('a major-1 subscriber still receives the v1 rendering — the v1 wire does not move mid-overlap', async () => {
     if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable');
     if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
     const disc = await v2Discovery();
-    const supported = ((disc?.versions as { supported?: unknown[] } | undefined)?.supported ?? []) as string[];
-    if (!supported.some((s) => String(s).startsWith('1.'))) return softSkip('inapplicable', 'host advertises no 1.x contract — there is no v1 wire to keep still');
+    // RFC 0172 §A.1: `protocolVersions` lists every <major>.<minor> the host serves — the 2.3.1 file read a
+    // `versions.supported` that no discovery document has, so this leg was inapplicable on every host.
+    const versions = Array.isArray(disc?.['protocolVersions']) ? (disc?.['protocolVersions'] as unknown[]).map(String) : [];
+    if (!versions.some((v) => v.startsWith('1.'))) return softSkip('inapplicable', `host advertises [${versions.join(', ') || 'no protocolVersions'}] — no 1.x member, so there is no v1 wire to keep still`);
     const receiver = await startReceiver(); active = receiver.server;
-    if ((await register(receiver.url, 1)) === null) return softSkip('blocked', 'registration refused (reason recorded above)');
+    if ((await register(receiver.url, 1)) === null) return softSkip('blocked', 'registration refused or inapplicable (disposition recorded above)');
     const runId = await driveRun();
-    const d = await waitFor(() => receiver.deliveries.find((x) => x.body.includes(runId)), 15_000);
-    if (!d) return softSkip('blocked', 'no delivery for this run arrived inside 15s');
-    const parsed = JSON.parse(d.body) as { event?: Record<string, unknown> };
-    const event = parsed.event ?? (parsed as Record<string, unknown>);
-    const owner = (event as { owner?: Record<string, unknown> }).owner ?? {};
-    expect('principal' in owner, req(ID, 'spec/v2/core/versioning.md §1.2', 'a major-1 subscriber MUST still receive the v1 owner block (principal) — projecting every channel to v2 is as wrong as projecting none; the projection is contract-scoped')).toBe(true);
+    const d = await waitFor(() => deliveryFor(receiver.deliveries, runId), 15_000);
+    if (!d) return softSkip('blocked', `no ${EVENT_TYPE} delivery for this run arrived inside 15s`);
+    // The v1 definition is the discriminator, not the owner's keys: v1's owner admits `subject` (RFC 0165
+    // §B, echoed verbatim when present) alongside `principal`, so a v2 owner is ALSO a valid v1 owner.
+    // What the v1 wire cannot carry is the v2 payload's integer `engineVersion` (string on v1) — a fan-out
+    // that forwards the v2 rendering to a 1.x subscriber fails here, on the field that actually differs.
+    const payload = validators(1).ref(`${V1}run-event-payloads.schema.json#/$defs/runStarted`)(d.event['payload']);
+    expect(payload.ok, req(ID, 'spec/v2/core/versioning.md §1.2', `a major-1 run.started payload MUST validate against the V1 runStarted definition — projecting every channel to v2 is as wrong as projecting none; the projection is contract-scoped. ${payload.errors}`)).toBe(true);
+    const owner = ownerOf(d.event);
+    expect(owner === null || typeof owner['tenant'] === 'string', req(ID, 'spec/v2/core/versioning.md §1.2', 'a v1 owner echo, when present, names the tenant (v1 runStarted.owner requires it)')).toBe(true);
   });
 
   it('a seeded era-2 run is delivered projected too — the fan-out branch a fresh run cannot reach (seam-gated)', async () => {
     const disc = await v2Discovery();
     if (!disc) return softSkip('blocked', 'v2 discovery unreachable');
     if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
-    const seeded = era2Gate(disc);
-    if (seeded === null) return softSkip('inapplicable', 'no era-2 seed seam advertised — the era-2 fan-out branch is unreachable without one (recorded under openwop.family.conformance)');
+    // era2Gate answers null when the seam IS advertised and a disposition when it is not — the 2.3.1 file
+    // read null as absence, so this leg was inapplicable on exactly the hosts that could witness it.
+    const gate = era2Gate(disc);
+    if (gate !== null && !gate.ok) return softSkip(gate.kind, gate.reason);
     const receiver = await startReceiver(); active = receiver.server;
     if ((await register(receiver.url, 2)) === null) return softSkip('blocked', 'registration refused (reason recorded above)');
     const log = await seedEra2Log(v1FixtureLog(FIXTURE), 'completed');
-    if (!('runId' in log) || typeof (log as { runId?: unknown }).runId !== 'string') return softSkip('blocked', 'era-2 seed did not return a runId');
-    const runId = (log as { runId: string }).runId;
-    const d = await waitFor(() => receiver.deliveries.find((x) => x.body.includes(runId)), 15_000);
-    if (!d) return softSkip('blocked', 'no delivery for the seeded era-2 run inside 15s — a host MAY not fan out seeded history; recorded blocked, not failed');
-    const parsed = JSON.parse(d.body) as { event?: Record<string, unknown> };
-    const event = parsed.event ?? (parsed as Record<string, unknown>);
-    const v = v2RunEventValidator()(event);
-    expect(v.ok, req(ID, DOC, `an era-2 row delivered to a major-2 subscriber MUST be projected — the read projection applies at the fan-out as at poll/SSE (events.md §Era-2). ${v.errors}`)).toBe(true);
-    const owner = (event as { owner?: Record<string, unknown> }).owner ?? {};
-    expect('principal' in owner, req(ID, DOC, 'a projected era-2 delivery MUST NOT carry the v1 owner block')).toBe(false);
+    if (!log.ok) return softSkip(log.kind, log.reason);
+    const runId = log.runId;
+    const d = await waitFor(() => deliveryFor(receiver.deliveries, runId), 15_000);
+    // The seam appends HISTORY — rows that already happened — and a host MAY not fan out history (the
+    // reference host's seam appends with fan-out suppressed by design). No delivery inside 15s means the
+    // era-2 fan-out branch is unobservable on this host, not that a measurement failed: inapplicable.
+    if (!d) return softSkip('inapplicable', `no ${EVENT_TYPE} delivery for the seeded era-2 run inside 15s — this host does not fan out seeded history, so the era-2 fan-out branch is unobservable here (recorded under openwop.family.conformance)`);
+    const payload = validators(2).ref(`${V2}run-event-payloads.schema.json#/$defs/runStarted`)(d.event['payload']);
+    expect(payload.ok, req(ID, DOC, `an era-2 row delivered to a major-2 subscriber MUST be projected — the read projection applies at the fan-out as at poll/SSE (events.md §Era-2). ${payload.errors}`)).toBe(true);
+    const owner = ownerOf(d.event);
+    expect(owner === null || !('principal' in owner || 'principalKind' in owner), req(ID, DOC, 'a projected era-2 delivery MUST NOT carry the v1 owner keys')).toBe(true);
   });
 });