@openwop/openwop-conformance 2.37.0 → 2.37.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.37.1] — 2026-09-24 — records that say why, and identities a host must remember minted fresh per run
+
+- **`0213.in-flight-loser-outcome` no longer blocks a host that replays every loser.** `v2-idempotency-in-flight` ended with `softSkip('blocked', …)` when all five same-key creates succeeded. RFC 0213 §B explicitly permits that outcome: a loser MAY wait and receive the winner's final outcome, marked `OpenWOP-Idempotent-Replay: true`. The file's own header already promised `partial-witness`. Blocking denied certification (RFC 0168 §E.1) to every host fast enough, or serial enough, that no loser was ever in flight. It was measured on the v2-reference host with the published 2.37.0 (loopback rehearsal: all 5 answers were successes, 4 of them marked replays). The note is now `inapplicable`, which at major 2 records the row as a partial witness after the leg's assertions. Certification counts it, and the acceptance predicate still refuses it, because the 409 branch was never observed.
+- **A failing assertion reaches the record with its message and its case name, and the per-`it` row of a multi-leg requirement survives.** MEASURED, `v2-run-bulk-cancel.test.ts` on a tier-2 host, both rows from ONE run: `openwop.floor.v2-run-bulk-cancel` `executed-fail`, 10 assertions, detail "one or more assertions in the file failed"; `openwop.requirement.0170.run-bulk-cancel` `executed-pass`, 3 assertions. No case name, no message, nothing else in the record for that file — the host operator could not diagnose it and hand-probed production. Two independent faults. (1) `fileDisposition`'s `executed-fail` detail was that FIXED STRING; it is now `failureDetail(...)` — the failing case titles (first three, then `+N more`) plus the first failure's message — and `resolveItRecord` names the leg in the per-`it` row's detail too. `setup.ts` collects `task.name` + the first error in `afterEach`. (2) The file has two `it`s that both hand `req()` one module-level `const ID`; leg 1 passed with 3 assertions and leg 2 failed on its 7th, and leg 2's row hit `recordRequirement`'s one-disposition-per-run throw, which `setup.ts`'s "never fail a test for bookkeeping" `catch` swallowed — so the verdict reached neither the in-memory ledger nor the JSONL sink. `recordRequirement` gains `fold`, used only by the per-`it` path: the surviving row is the LEAST certifiable leg (the rank `readLedgerFile` already applies across workers), carrying that leg's detail, with the legs' assertion counts summed; a scenario that classifies ITSELF twice still throws. 27 scenario files share one explicit id across several `it`s, so this was never one file's bug — `scripts/check-req-only.mjs` rule (d) now resolves a `const` handed to `req()` (it compared only call-site literals and was blind to the form nearly every scenario uses) and no longer flags the shared-id pattern the fold makes safe. **Why 7 of the 10 assertions looked unattributed, stated rather than gated:** they were not. All ten carry `req(ID, …)`, and attribution is per-`it`, not per-assertion — `req()` sets one `explicitId` that `setup.ts` takes once per test, and `assertionCount` counts `expect` calls whatever their message. The 3-vs-10 was the discarded leg, not a missing id. (The suite does hold 1,281 `expect`s with no message at all, against 4,824 carrying `req(...)`; they cost the reader a sentence, never the row its id, and the case name now carries alongside vitest's own diff. The reasoning is recorded in `check-req-only.mjs` rather than turned into a 1,281-site sweep.) Sabotage, host-free: one assertion flipped in `v2-payload-seats-0186.test.ts` (3 `it`s, one shared `const ID`, same shape as the bulk-cancel file) reproduces the reported pair exactly at `origin/main` — scenario row `executed-fail` / "one or more assertions in the file failed", requirement row `executed-pass`, failing leg absent — and after the fix the requirement row is `executed-fail` naming `"§A.3 ApprovalData.onTimeout is a closed enum and the def stays closed"` with the full `req()` message, and the file row names the case and quotes it.
+- **Four webhook scenarios stop registering one byte-identical destination, and a zero that is provably unmeasured stops convicting the host.** `v2-bound-id-kinds`, `v2-webhook-delivery-shape`, `v2-webhook-durable-delivery` and `webhook-signed-delivery` each bound `OPENWOP_WEBHOOK_RECEIVER_PORT` and registered `resolveRegistrationUrl(...)`, which returns `OPENWOP_WEBHOOK_RECEIVER_URL` VERBATIM — so on a tunnelled cut all four subscriptions pointed at ONE URL. A webhook subscription is durable host-side state that keeps delivering, and RETRYING, after the file that made it has finished, so whichever receiver held the port read the leftovers as its own traffic — and `v2-webhook-durable-delivery` answers 500 BY DESIGN. Both symptoms were already recorded in the tree as workarounds: `v2-webhook-delivery-shape`'s receiver carried "the tunnel forwards to the PINNED port — held by the other receiver, which answers 500 by design — so this file's `deliveries` stays empty, its legs soft-skip, and the rows resolve `executed-pass`", and `v2-webhook-durable-delivery` filters by subscription because "a tier-2 host measured 6 attempts against a maxAttempts of 5". New `src/lib/scoped-receiver.ts` composes the two halves the tree already had rather than reimplementing either: ROUTING is openwop#1520's `front-mux` (each receiver registers its handler under its nonce and calls `routeFronted` first, so several can be alive behind one front), IDENTITY is the nonce made UNCONDITIONAL — `frontedEndpoint` omits it for the pinned-port owner, which is enough for a live listener and not for a subscription that outlives its exercise. A retry for a finished exercise now addresses a nonce nobody serves, is answered 404, and is counted `foreign()` instead of absorbed. `unservedDestination()` does the same for a leg that needs the mint and no delivery (`v2-bound-id-kinds` leg 1). Zeroes: where other traffic DID reach the listener, the path from host to process demonstrably works and the absence is of this exercise's IDENTITY, so the leg records `blocked` with `noDeliveryCause(...)` naming the address, the nonce and the foreign count — `blocked` denies certification exactly as a failure does (RFC 0168 §E.1), and a genuinely mis-wired front produces no traffic at all and still fails. `src/lib/scoped-receiver.test.ts` pins it host-free (8 cases: distinct destinations, the nonce surviving a front, a sibling's traffic routed to the sibling, a finished exercise's retry refused, a nonce-less stranger refused, own traffic delivered prefix-stripped, and both readings of a zero); removing the nonce from the destination reds 3 of them. The `receiverBinding` source guard in `webhook-receiver.test.ts` is rewritten to accept either shape and gains two cases: the shared helper must itself bind through `receiverBinding()`, and no listed scenario may mint its destination with `resolveRegistrationUrl`. Not witnessed against a host: no tunnelled cut was available, and no timeout or window was widened.
+- **Two RFC 0213 requirement ids were cited from one `it()`, so the winner id was recorded on no host.** `v2-idempotency-in-flight.test.ts` cited `0213.in-flight-one-winner` and `0213.in-flight-loser-outcome` from a single `it`. The ledger keys on the id and `setup.ts` takes ONE `explicitId` per test, so only the last one cited got a row: the winner clause — "of concurrent same-key requests a host MUST process exactly one" — was measured on every host that ran the file and recorded on none of them, and nothing said so. Found by `check-req-only.mjs` rule (d) the moment it learned to resolve a `const` handed to `req()`, which is the same sharpening this cycle made for the attribution fix; the rule had compared only call-site literals, so the violation was invisible when the file was written. Split into two `it`s over ONE race: the record is in flight only while the winning create is being handled, so driving the race twice would measure two unrelated races and halve the chance that either overlaps, so it is driven once and memoised and both legs await the same result (the `v2-subject-link-record` pattern). No assertion, gate or timeout changed. The no-overlap soft-skip now lands on the loser id it is ABOUT, so the winner clause keeps its verdict instead of losing it to that return — a strictly better row on a host with no overlap, which is every host that answers create in milliseconds. That soft-skip's DISPOSITION is openwop#1525's, taken verbatim on merge: `inapplicable` (→ `executed-pass` + `partial-witness`), not `blocked`, because §B permits a loser to wait and receive a marked final outcome and `blocked` would deny certification to a host that did nothing wrong. The two changes compose — #1525 fixed what the row says, this one fixed which id says it.
+- **A third fixed dedup key, and the source guard that would have caught it.** `trigger-stream-cdc-sources.test.ts` handed the bridge seam the literal `'events:3:99001'` and then asserted `deliveredCount === 1 || outcome === 'delivered'` — the identical defect as the bullet below, one file over, and it survived that sweep because NOTHING WAS CHECKING. §F.5 reuses §C-1's dedup window verbatim and that window is a >=24h FLOOR, so the second run of the file against the same host, any time that day, hands the bridge broker coordinates it has already delivered; a conformant host collapses the exercise into the first run's outcome and the assertion convicts it. Cold host passes, warm host fails. New `freshStreamDedupKey()` mints the OFFSET and keeps `(topic, partition)` — not `freshDedupKey`, because §F.5 says a stream event's key SHOULD derive from `(topic, partition, offset)` and the leg's own `req()` message asserts over exactly that keying; an opaque token would make the message describe something the call no longer does. The repetition §C-1 is about happens INSIDE the seam's `scenario: 'dedup'`, so the clause is untouched. New `src/lib/trigger-dedup-key.test.ts` pins it host-free and guards the CALL SITES, which is where a regression would reappear: no file that drives `driveDelivery` may spell a `dedupKey` as a literal. Sabotage, both spellings: reintroducing the literal as `dedupKey: 'events:3:99001'` (the original defect) and as `const dedupKey = 'events:3:99001'` each red the guard, naming the file and line. The first draft of that guard matched only the property form and the `const` sabotage PASSED it — the regex is one alternation over `[:=]` for that reason, recorded here because a guard that misses the spelling a reader would reach for is not a guard. Files that mention `dedupKey` without driving the seam are excluded deliberately: in `trigger-bridge-shape` it is a field in an offline AJV sample, durable nowhere.
+- **The identity enumeration, re-run against the merged tree, and what it did NOT find.** Every other class was already per-exercise or is covered elsewhere, so no second mechanism is added for any of them: Layer-1 `Idempotency-Key`s are minted fresh at all four call sites (`idempotency`, `idempotencyRetry`, `v2-idempotency-key-grammar`, `pause-resume`); the whole host-surface family (`kv`, `blob`, `table`, `search`, `vector`, `sql`, `queueBus`) already mints its key / table / index / namespace / stream per exercise; `v2-subject-link-record` already mints its `externalId`; `replay-fanout-suppression` binds an EPHEMERAL port rather than the pinned one, so its destination is distinct by construction; and the scenario-owned A2A peers and MCP servers are `front-mux`'s (openwop#1520), which nonce-paths each fake behind the one public front. One row was rehearsed rather than fixed: `v2-webhook-message-id-stable` came back `executed-pass` on a loopback run against the PUBLISHED 2.37.0 with its `0201.message-id-stable` requirement row classified — no unclassified return. One run is not proof and the single scenario is being re-run before the public cut, but it is consistent with openwop#1513 and #1520 having already covered it, so NO mechanism is added for it here: not reproduced on 2.37.0, plausibly covered by `front-mux` / `effect-receiver`. **Owed, not fixed here:** `lib/oauth-as-double.ts` derives its ISSUER identity from `resolvePublicFront(frontEnv, local)`, and three files — `v2-oauth-mcp-reach-discovery`, `v2-oauth-client-pkce-state-iss`, `v2-credential-interrupt` — start a double on the same default `OPENWOP_OAUTH_AS_URL`, so on a tunnelled cut all three advertise ONE issuer and only the holder of the pinned port is reached. That is the front-mux shape for a fake front-mux does not cover, and it sits on the public-front routing another session is changing in the same cycle (openwop#1524, the per-instance `kid` in `lib/oidc-issuer.ts`), so it is stated rather than touched. Unreproduced: no tunnelled cut was available, so it is read off the code.
+- **Two more fixed identities against state a host is REQUIRED to remember.** `trigger-bridge-delivery` handed the bridge the literal `'conformance-dedup-key'`, and `trigger-bridge.md` §C-1 makes the dedup window a >=24h FLOOR — so the second run of the file against the same host, any time that day, hands it a key already delivered; a conformant host collapses the exercise into the first run's outcome, emits zero `delivered` attempts under this run's id, and the `=== 1` convicts it. Cold host passes, warm host fails. `freshDedupKey()` mints one per exercise; the repetition §C-1 is about happens inside `driveDelivery`'s `scenario: 'dedup'`, so the clause is untouched. `auth-subject-link` provisioned the literal `externalId` `'idp-op-8f3a'` into the OPERATOR's SCIM directory and then DEACTIVATED it, so a second run asserts "authenticates before deactivation" against a subject the host is correct to refuse; minted per exercise now. The SCIM leg is opt-in on two env vars that no cut sets, so it is read off the code and unwitnessed — stated rather than claimed.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.37.1` because `2.37.0` is published. Published on the `v2.37.1` corpus tag.
+
 ## [2.37.0] — 2026-09-23 — rows that measured nothing now measure: a suite fake reachable through the public front, one effect identity per leg, the MRTR key that can tell
 
 - **Every synthetic OIDC issuer publishes its own `kid`, so two scenarios at one issuer URL no longer collide in a host's JWKS cache.** `lib/oidc-issuer.ts` generated a fresh key per `createSyntheticOIDCIssuer` instance but named it `openwop-conformance-key-${rotationCounter}` with a per-instance counter — so EVERY instance published `openwop-conformance-key-1`. `v2-oidc-id-token-audience` and `v2-lane-exp-only-bound` both publish at `OPENWOP_TEST_OIDC_ISSUER_URL`; a host that caches JWKS by `kid` (RFC 7517 §4.5: a kid identifies one key) verified the second scenario's tokens against the first scenario's cached key and refused its VALID control as `invalid_signature`. Reported and measured by openwop-app-ce on openwop-app, suite 2.36.1: `v2-lane-exp-only-bound` 4/4 red in a full run (control included), 4/4 green filtered — an order-dependent red that reads as a host failure on RFC 0210's rows. The kid is now `openwop-conformance-key-<per-instance hex>-<rotation>`. New self-test: a kid-caching verifier (re-fetch only on an unknown kid) must accept both instances' valid tokens at one URL; reverting to the shared kid reds it.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.37.0 @openwop/spec-artifacts@2.37.0
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.37.1 @openwop/spec-artifacts@2.37.1
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/lib/requirement-ledger.js

@@ -47,10 +47,26 @@ const journal = [];
  * dispositions throws: RFC 0148 §A says **exactly one** disposition per
  * requirement, and a silent last-write-wins would let a later soft-skip
  * overwrite an earlier real failure — the failure mode in reverse.
+ *
+ * `extras.fold` is the one exception, for the per-`it` rows `setup.ts` records
+ * when several `it` legs witness ONE requirement id; see its docblock below.
+ */
+/**
+ * How certifiable each disposition is, least first. `readLedgerFile` has always
+ * resolved a cross-worker disagreement this way — "one worker said it failed"
+ * outranks "another said it passed", and an unresolvable disagreement must never
+ * round toward certification. `fold` below applies the SAME rule in-worker.
  */
+const CERTIFIABILITY_RANK = {
+    'executed-fail': 0,
+    blocked: 1,
+    'executed-pass': 2,
+    skipped: 3,
+    inapplicable: 4,
+};
 export function recordRequirement(requirementId, disposition, detail, extras) {
     const prior = ledger.get(requirementId);
-    if (prior !== undefined && prior.disposition !== disposition) {
+    if (prior !== undefined && prior.disposition !== disposition && extras?.fold !== true) {
         throw new Error(`RFC 0148 §A: ${requirementId} already recorded as '${prior.disposition}', now '${disposition}'. ` +
             'Exactly one disposition per requirement per run.');
     }
@@ -58,7 +74,7 @@ export function recordRequirement(requirementId, disposition, detail, extras) {
         throw new Error(`RFC 0148 §A: ${requirementId} recorded as '${disposition}' without a reason. ` +
             'Anything other than executed-pass MUST say why, or the ledger records an outcome nobody can act on.');
     }
-    const entry = {
+    let entry = {
         requirementId,
         disposition,
         ...(detail === undefined ? {} : { detail }),
@@ -66,6 +82,27 @@ export function recordRequirement(requirementId, disposition, detail, extras) {
         ...(extras?.scenarioFile === undefined ? {} : { scenarioFile: extras.scenarioFile }),
         ...(extras?.evidence === undefined || disposition !== 'executed-pass' ? {} : { evidence: extras.evidence }),
     };
+    if (prior !== undefined && extras?.fold === true) {
+        // The least-certifiable leg wins the disposition and keeps its own detail;
+        // a tie keeps whichever side actually said something. Counts sum, because
+        // both legs really did assert against the target for this one requirement.
+        const keepPrior = CERTIFIABILITY_RANK[prior.disposition] <= CERTIFIABILITY_RANK[disposition];
+        const winner = keepPrior ? prior : entry;
+        const loser = keepPrior ? entry : prior;
+        const count = (prior.assertionCount ?? 0) + (extras?.assertionCount ?? 0);
+        const keptDetail = winner.detail ?? loser.detail;
+        const hasCount = prior.assertionCount !== undefined || extras?.assertionCount !== undefined;
+        entry = {
+            requirementId,
+            disposition: winner.disposition,
+            ...(keptDetail === undefined ? {} : { detail: keptDetail }),
+            ...(hasCount ? { assertionCount: count } : {}),
+            ...(winner.scenarioFile === undefined ? {} : { scenarioFile: winner.scenarioFile }),
+            // `evidence` is only meaningful on a pass; a fold that lands anywhere
+            // else drops it, exactly as the constructor above does.
+            ...(winner.disposition === 'executed-pass' && winner.evidence !== undefined ? { evidence: winner.evidence } : {}),
+        };
+    }
     ledger.set(requirementId, entry);
     journal.push(entry);
     // File sink (RFC 0148 acceptance item 2, S6). The in-memory map lives in a
@@ -114,7 +151,11 @@ export function readLedgerFile(path) {
         if (typeof e.requirementId !== 'string' || !DISPOSITIONS.includes(e.disposition))
             continue;
         const prior = merged.get(e.requirementId);
-        if (prior === undefined || rank[e.disposition] < rank[prior.disposition])
+        // `<=`, not `<`: a per-`it` FOLD (2.37.0) appends the cumulative row after
+        // the leg rows it folded, so on an equal disposition the LAST line is the
+        // one carrying the summed `assertionCount`. For genuinely duplicate lines
+        // the two are identical and the choice is a no-op.
+        if (prior === undefined || rank[e.disposition] <= rank[prior.disposition])
             merged.set(e.requirementId, e);
     }
     return [...merged.values()].sort((a, b) => a.requirementId.localeCompare(b.requirementId));

package/dist/lib/scenario-disposition.js

@@ -110,9 +110,13 @@ export function resolveItRecord(state, assertionCalls, gate, noted, firstError,
  * closed), none an optional extra. Scoped to major 2 because the 146 v1-side
  * sites were not measured and v1 bundles are read through its EOS.
  */
-blockedStands = false) {
-    if (state === 'fail')
-        return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
+blockedStands = false, 
+/** The `it` title, so a failed row says WHICH leg of the requirement failed. */
+testName) {
+    if (state === 'fail') {
+        const where = testName === undefined || testName.trim() === '' ? '' : ` in "${testName.slice(0, 120)}"`;
+        return { disposition: 'executed-fail', detail: `the test executed and failed${where}: ${(firstError ?? 'no message').slice(0, 300)}` };
+    }
     if (state === 'pass' && assertionCalls > 0) {
         // `blockedDespiteAssertions` (soft-skip.ts): the leg says its setup
         // assertions are not the requirement, and the requirement went unobserved.
@@ -138,11 +142,34 @@ blockedStands = false) {
         return { disposition: 'blocked', detail: 'unclassified return: the test passed with zero assertions and recorded no reason — RFC 0148 §A resolves it to blocked, never to a pass' };
     return { disposition: 'skipped', detail: 'vitest skipped the test (ctx.skip / it.skip) without a recorded gate reason' };
 }
+/**
+ * The `executed-fail` detail for a file row: WHICH cases failed, and what the
+ * first one said.
+ *
+ * Until 2.37.0 this was the fixed string "one or more assertions in the file
+ * failed". A tier-2 host read exactly that for `v2-run-bulk-cancel` — 10
+ * assertions, no case name, no message, and nothing else in the record for that
+ * file — and had to hand-probe every assertion in the file against production to
+ * find out what had happened. A bundle row whose only detail is that sentence is
+ * undiagnosable by construction, and every future flicker in any scenario had
+ * the same problem.
+ */
+export function failureDetail(failures, failedCount) {
+    if (failures.length === 0) {
+        return `${failedCount} test(s) in the file failed; the runner captured no message`;
+    }
+    const head = failures[0];
+    const named = failures.slice(0, 3).map((f) => `"${f.name.slice(0, 120)}"`).join(', ');
+    const more = failures.length > 3 ? ` (+${failures.length - 3} more)` : '';
+    const msg = head.message === undefined || head.message.trim() === '' ? 'no message' : head.message.slice(0, 400);
+    return `${failures.length} test(s) failed — ${named}${more}; first failure: ${msg}`;
+}
 /** Worker half: fold a file's per-test states (+ any gate-recorded reason) into
  *  the ONE disposition the file records. */
-export function fileDisposition(states, gateReason, assertionCount) {
-    if (states.some((s) => s === 'fail'))
-        return { disposition: 'executed-fail', detail: 'one or more assertions in the file failed' };
+export function fileDisposition(states, gateReason, assertionCount, failures = []) {
+    const failed = states.filter((s) => s === 'fail').length;
+    if (failed > 0)
+        return { disposition: 'executed-fail', detail: failureDetail(failures, failed) };
     if (states.some((s) => s === 'pass')) {
         // A test that early-returned through `behaviorGate` is reported by vitest
         // as a pass with zero assertions. When EVERY passing test in the file did
@@ -182,7 +209,9 @@ export function fileDisposition(states, gateReason, assertionCount) {
  *   - every test `ctx.skip()`ped ⇒ the file's noted reason if it wrote one
  *     BEFORE skipping (`ctx.skip()` throws), else `blocked` + the marker.
  */
-export function resolveFileRecord(states, gateReason, assertionCount, noted, specCoherenceFile) {
+export function resolveFileRecord(states, gateReason, assertionCount, noted, specCoherenceFile, 
+/** The failed cases, so an `executed-fail` row NAMES them (2.37.0). */
+failures = []) {
     // A scenario whose subject is the CORPUS, skipped because the published
     // tarball does not bundle spec/v1/. RFC 0148 §A: `blocked` is defined over
     // ADVERTISED BEHAVIOUR, and there is none here — nothing about the host was
@@ -196,7 +225,7 @@ export function resolveFileRecord(states, gateReason, assertionCount, noted, spe
         && assertionCount === 0) {
         return { disposition: 'inapplicable', detail: SPEC_COHERENCE_DETAIL };
     }
-    let { disposition, detail } = fileDisposition(states, gateReason, assertionCount);
+    let { disposition, detail } = fileDisposition(states, gateReason, assertionCount, failures);
     if (disposition === 'executed-pass' && assertionCount === 0) {
         if (noted !== null) {
             disposition = noted.kind;

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.37.0",
-  "stampSha256": "7122d36a173c88dfe75b1fd136824e9a3601583b9035916a666b49e11010b77e"
+  "version": "2.37.1",
+  "stampSha256": "3f4b0c233c7927e94f4ea521b3d97e8c502de481b6e5d17d5fd58463aff9ad79"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.37.0",
+  "version": "2.37.1",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.37.0"
+    "@openwop/spec-artifacts": "2.37.1"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 628,
-    "tests": 2401,
-    "withStableId": 2401,
+    "files": 629,
+    "tests": 2404,
+    "withStableId": 2404,
     "interpolatedTitles": 0,
-    "explicitIds": 2291
+    "explicitIds": 2294
   },
   "records": [
     {
@@ -5956,7 +5956,7 @@
     {
       "id": "openwop.it.auth-subject-link.subjectlinking-true-is-only-claimed-alongside-both-saml-and-scim-profiles",
       "file": "auth-subject-link.test.ts",
-      "line": 61,
+      "line": 62,
       "title": "subjectLinking:true is only claimed alongside both SAML and SCIM profiles",
       "explicitId": "openwop.it.auth-subject-link.subjectlinking-true-is-only-claimed-alongside-both-saml-and-scim-profiles",
       "citations": [
@@ -5969,7 +5969,7 @@
     {
       "id": "openwop.it.auth-subject-link.advertising-both-profiles-requires-subjectlinking-true-a-subjectlinkkey-rfc-0164",
       "file": "auth-subject-link.test.ts",
-      "line": 76,
+      "line": 77,
       "title": "advertising BOTH profiles REQUIRES subjectLinking:true + a subjectLinkKey (RFC 0164 — the vulnerable shape fails, never inapplicable)",
       "explicitId": "openwop.it.auth-subject-link.advertising-both-profiles-requires-subjectlinking-true-a-subjectlinkkey-rfc-0164",
       "citations": [
@@ -5987,7 +5987,7 @@
     {
       "id": "openwop.it.auth-subject-link.a-scim-deactivation-fail-closes-the-linked-saml-identity",
       "file": "auth-subject-link.test.ts",
-      "line": 106,
+      "line": 107,
       "title": "a SCIM deactivation fail-closes the linked SAML identity",
       "explicitId": "openwop.it.auth-subject-link.a-scim-deactivation-fail-closes-the-linked-saml-identity",
       "citations": [
@@ -6012,7 +6012,7 @@
     {
       "id": "openwop.it.auth-subject-link.a-mutable-pii-link-key-email-never-produces-a-cross-lane-pass",
       "file": "auth-subject-link.test.ts",
-      "line": 152,
+      "line": 169,
       "title": "a mutable/PII link key (email) never produces a cross-lane pass",
       "explicitId": "openwop.it.auth-subject-link.a-mutable-pii-link-key-email-never-produces-a-cross-lane-pass",
       "citations": [
@@ -6029,7 +6029,7 @@
     {
       "id": "openwop.it.auth-subject-link.a-scim-deactivation-does-not-deny-a-saml-login-whose-run-subject-is-legacy-issue",
       "file": "auth-subject-link.test.ts",
-      "line": 202,
+      "line": 219,
       "title": "a SCIM deactivation does not deny a SAML login whose run subject is legacy-issued",
       "explicitId": null,
       "citations": []
@@ -25733,7 +25733,7 @@
     {
       "id": "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 54,
+      "line": 55,
       "title": "de-dups by dedupKey, retries to dead-letter, and links delivery→run causation",
       "explicitId": "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation",
       "citations": [
@@ -27265,7 +27265,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.subscriptionid-the-webhookid-a-host-emits-on-a-delivery-is-the-one-it-minted",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 132,
+      "line": 140,
       "title": "subscriptionId: the webhookId a host EMITS on a delivery is the one it minted",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.webhook-emitted",
       "citations": [
@@ -27284,7 +27284,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.interruptid-the-id-a-suspension-puts-on-the-wire-is-bound",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 179,
+      "line": 192,
       "title": "interruptId: the id a suspension puts on the wire is bound",
       "explicitId": null,
       "citations": []
@@ -27292,7 +27292,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.effectid-every-row-get-runs-runid-effects-serves-is-bound",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 200,
+      "line": 213,
       "title": "effectId: every row GET /runs/{runId}/effects serves is bound",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.per-kind",
       "citations": [
@@ -27305,7 +27305,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.deliveryid-every-record-in-the-dead-letter-read-carries-a-bound-id-in-the-caller",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 215,
+      "line": 228,
       "title": "deliveryId: every record in the dead-letter read carries a bound id in the caller's tenant",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.per-kind",
       "citations": [
@@ -28883,10 +28883,10 @@
       ]
     },
     {
-      "id": "openwop.it.v2-idempotency-in-flight.concurrent-same-key-creates-yield-one-run-each-loser-is-a-marked-replay-of-a-fin",
+      "id": "openwop.it.v2-idempotency-in-flight.concurrent-same-key-creates-yield-exactly-one-run",
       "file": "v2-idempotency-in-flight.test.ts",
-      "line": 47,
-      "title": "concurrent same-key creates yield one run; each loser is a marked replay of a final outcome or 409 idempotency_in_flight with no retry timing in details",
+      "line": 101,
+      "title": "concurrent same-key creates yield exactly one run",
       "explicitId": "openwop.requirement.0213.in-flight-one-winner",
       "citations": [
         {
@@ -28898,7 +28898,16 @@
           "section": "spec/v2/core/idempotency.md Concurrency",
           "requirement": null,
           "interpolated": true
-        },
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-idempotency-in-flight.each-loser-is-a-marked-replay-of-a-final-outcome-or-409-idempotency-in-flight-wi",
+      "file": "v2-idempotency-in-flight.test.ts",
+      "line": 109,
+      "title": "each loser is a marked replay of a final outcome, or 409 idempotency_in_flight with no retry timing in details",
+      "explicitId": "openwop.requirement.0213.in-flight-loser-outcome",
+      "citations": [
         {
           "section": "spec/v2/core/idempotency.md Concurrency",
           "requirement": null,
@@ -32718,7 +32727,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-2-subscriber-receives-the-v2-rendering-the-delivery-validates-and-run-st",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 220,
+      "line": 217,
       "title": "a major-2 subscriber receives the v2 rendering: the delivery validates, and run.started.owner carries subject, never principal",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -32749,7 +32758,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-1-subscriber-still-receives-the-v1-rendering-the-v1-wire-does-not-move-m",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 240,
+      "line": 237,
       "title": "a major-1 subscriber still receives the v1 rendering — the v1 wire does not move mid-overlap",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -32767,7 +32776,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-seeded-era-2-run-is-delivered-projected-too-the-fan-out-branch-a-fresh-run-can",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 264,
+      "line": 261,
       "title": "a seeded era-2 run is delivered projected too — the fan-out branch a fresh run cannot reach (seam-gated)",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -32785,7 +32794,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 235,
+      "line": 238,
       "title": "a failed attempt is retried and the event is delivered at least once",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery",
       "citations": [
@@ -32795,7 +32804,8 @@
         },
         {
           "section": "webhooks.md §Durability",
-          "requirement": "the host MUST attempt delivery of run.completed for THIS run to the registered subscriber"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "webhooks.md §Durability",
@@ -32816,7 +32826,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 323,
+      "line": 339,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
@@ -32850,7 +32860,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 417,
+      "line": 433,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -32863,7 +32873,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 438,
+      "line": 454,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
@@ -33990,7 +34000,7 @@
     {
       "id": "openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature",
       "file": "webhook-signed-delivery.test.ts",
-      "line": 169,
+      "line": 168,
       "title": "host POSTs run events to subscriber with valid X-openwop-Signature",
       "explicitId": "openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature",
       "citations": [
@@ -34041,7 +34051,7 @@
     {
       "id": "openwop.it.webhook-signed-delivery.control-with-a-tunnel-wired-the-host-still-refuses-the-loopback-receiver",
       "file": "webhook-signed-delivery.test.ts",
-      "line": 410,
+      "line": 423,
       "title": "control: with a tunnel wired, the host still refuses the loopback receiver",
       "explicitId": "openwop.it.webhook-signed-delivery.control-with-a-tunnel-wired-the-host-still-refuses-the-loopback-receiver",
       "citations": [
@@ -40412,6 +40422,48 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v1-webhook-unregister-contract.the-tenantid-the-v1-prose-requires-on-unregister-is-a-required-query-parameter-o",
+      "file": "v1-webhook-unregister-contract.test.ts",
+      "line": 68,
+      "title": "the tenantId the v1 prose requires on unregister is a required query parameter of api/openapi.yaml unregisterWebhook",
+      "explicitId": "openwop.requirement.webhooks.v1-unregister-tenantid-in-contract",
+      "citations": [
+        {
+          "section": "spec/v1/webhooks.md §Unregister",
+          "requirement": "spec/v1/webhooks.md §Unregister MUST still require the tenantId query parameter — this leg is only meaningful while it does"
+        },
+        {
+          "section": "spec/v1/webhooks.md §Unregister",
+          "requirement": "api/openapi.yaml MUST define DELETE /v1/webhooks/{webhookId}"
+        },
+        {
+          "section": "spec/v1/webhooks.md §Unregister",
+          "requirement": "the v1 operation is unregisterWebhook"
+        },
+        {
+          "section": "spec/v1/webhooks.md §Unregister",
+          "requirement": "unregisterWebhook MUST declare `tenantId` as a REQUIRED query parameter — the prose requires it, and a client generated from a contract that omits it cannot issue a conforming request"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v1-webhook-unregister-contract.the-v2-twin-carries-the-tenant-in-its-id-and-does-not-grow-the-v1-query-paramete",
+      "file": "v1-webhook-unregister-contract.test.ts",
+      "line": 87,
+      "title": "the v2 twin carries the tenant in its id and does not grow the v1 query parameter",
+      "explicitId": "openwop.requirement.webhooks.v2-unregister-no-tenantid-query",
+      "citations": [
+        {
+          "section": "api/v2/openapi.yaml unregisterWebhook",
+          "requirement": "api/v2/openapi.yaml MUST define DELETE /webhooks/{webhookId}"
+        },
+        {
+          "section": "identity.md §5 (RFC 0187 §A.1)",
+          "requirement": "the v2 unregisterWebhook MUST NOT declare a tenantId parameter — v2 carries the tenant inside the tenant-bound webhookId, and a second tenant source could disagree with it"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-alias-covers-reword.the-corpus-gate-script-exits-0",
       "file": "v2-alias-covers-reword.test.ts",

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.37.0",
-  "corpusTag": "v2.37.0",
+  "version": "2.37.1",
+  "corpusTag": "v2.37.1",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
-    "api/openapi.yaml": "df108919a368e0a593f8f3dc8e2150a07d394e8971e1f91a3d6301e2e19cb132",
+    "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "e60b9ff834b83ebe710a6960a964296186c529b67453c11c263a78dc83e76fe3",
-    "api/v2/asyncapi.yaml": "3f584bb004c0273a20cadf8a3a2fdfd219d1851734faec5c99b0d69022ada529",
-    "api/v2/openapi.yaml": "a0880db46930a58b99c860fe04f17b6b782d31a4cb4f86398446adbf36c062fe",
+    "api/seams-v2.yaml": "02711723089859b95144d788c0caabf215305570c7d48be1da5d2a5e21eff4e1",
+    "api/v2/asyncapi.yaml": "d492342046d1ec3a2dc43a28c4cf6d821d6319c30a8552cbc8fcd13806f7b2df",
+    "api/v2/openapi.yaml": "ba67b61f0e716444308ef7bc00416b8eee5829c28b67c5070358d35c3ca64d36",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -117,7 +117,7 @@
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "79ddbbda4686fe66ec5b0aaf9bafb2385e2f8ccbb1ee39087d75cef9fd1f1628",
-    "schemas/v2/certification-bundle.schema.json": "168a1e79097a755f6da57e4671586f4f2ddfaba26cb4ec2d5de3774517f4ac64",
+    "schemas/v2/certification-bundle.schema.json": "cb8ddf29a008b1c2e731fd61f855bf072790b700e458c702c40434b6fd47ba73",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "f7cf09b30d3e1d2251620d84ea9f65541438d015ab44aec10d1dcfe68d8bd496",
@@ -204,7 +204,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "d624b312258b0299906ed0ace1d6d79e6df4a0a2e5543d55aef06ff81e434da1",
+    "spec/v1/core-standard-manifest.json": "c92119aa65b12b7f670cc59e7768177d20f8f47173e7fbd15c3b0a6ef340810a",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -292,9 +292,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "e6cdd54b2e2b03cc6f8ccb56c977ba94188b66d9cb0a130053429eec219f95b5",
+    "spec/v2/release.json": "9422440ed08e9d8ff3e8190c3e91e862025fa8b5b49d468a536806f5a841ac13",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "c07ff8163c6aadbd8673669ce07aa798ad4c8f99d59e8c33eaf5171f17777b10"
+    "spec/v2/surface-baseline.json": "13cfe5c31c3727a2e36980aa3e5a42f8ce1474b35beb99c5b71f487db006e71a"
   },
-  "corpusCommit": "9b84226d4b9d3e81426065472016a5ef5deee933"
+  "corpusCommit": "0d370019eaaa841491be58d196e6d7a6934c71f0"
 }

package/src/lib/front-mux.ts

@@ -36,7 +36,14 @@ import { resolvePublicFront } from './webhook-receiver.js';
 
 type Handler = (req: IncomingMessage, res: ServerResponse) => void;
 
-const PREFIX = '/fx/';
+/**
+ * The path prefix a fronted nonce lives under. Exported so a caller that mints
+ * its OWN destination (`scoped-receiver.ts`, which needs the nonce
+ * unconditionally rather than only when it loses the pinned port) spells the
+ * path the same way `routeFronted` parses it.
+ */
+export const FRONT_MUX_PREFIX = '/fx/';
+const PREFIX = FRONT_MUX_PREFIX;
 const registry = new Map<string, Map<string, Handler>>();
 
 function pinnedPort(portEnv: string): number {