@openwop/openwop-conformance 2.37.0 → 2.37.1

package/src/lib/requirement-ledger.ts

@@ -87,15 +87,68 @@ const journal: LedgerEntry[] = [];
  * dispositions throws: RFC 0148 §A says **exactly one** disposition per
  * requirement, and a silent last-write-wins would let a later soft-skip
  * overwrite an earlier real failure — the failure mode in reverse.
+ *
+ * `extras.fold` is the one exception, for the per-`it` rows `setup.ts` records
+ * when several `it` legs witness ONE requirement id; see its docblock below.
+ */
+/**
+ * How certifiable each disposition is, least first. `readLedgerFile` has always
+ * resolved a cross-worker disagreement this way — "one worker said it failed"
+ * outranks "another said it passed", and an unresolvable disagreement must never
+ * round toward certification. `fold` below applies the SAME rule in-worker.
  */
+const CERTIFIABILITY_RANK: Record<Disposition, number> = {
+  'executed-fail': 0,
+  blocked: 1,
+  'executed-pass': 2,
+  skipped: 3,
+  inapplicable: 4,
+};
+
 export function recordRequirement(
   requirementId: string,
   disposition: Disposition,
   detail?: string,
-  extras?: { assertionCount?: number; scenarioFile?: string; evidence?: RowEvidence },
+  extras?: {
+    assertionCount?: number;
+    scenarioFile?: string;
+    evidence?: RowEvidence;
+    /**
+     * FOLD instead of throw when this id already has a disposition (2.37.0).
+     *
+     * The strict contract above — one disposition per requirement per run,
+     * contradiction throws — is right for a scenario that classifies ITSELF:
+     * two hand-written verdicts for one id is an authoring bug, and the throw
+     * is how it surfaces.
+     *
+     * It is wrong for the per-`it` rows `setup.ts` records, because the corpus
+     * deliberately witnesses ONE requirement with SEVERAL `it` legs: 27
+     * scenario files hand `req()` a module-level `const ID`, so every leg in
+     * the file records under the same id. There the throw is not a guard —
+     * `setup.ts` wraps the call in `try {} catch {}` ("never fail a test for
+     * bookkeeping"), so the second verdict was silently DISCARDED, and, worse,
+     * discarded before it reached the JSONL sink.
+     *
+     * MEASURED, `v2-run-bulk-cancel.test.ts` on a tier-2 host: leg 1 passed
+     * (3 assertions), leg 2 failed on its 7th. The file row recorded
+     * `executed-fail` with 10 assertions and the detail "one or more assertions
+     * in the file failed"; `openwop.requirement.0170.run-bulk-cancel` recorded
+     * `executed-pass` with 3. The failing leg's message — which names the
+     * requirement AND prints the offending entry — existed, was computed by
+     * `resolveItRecord`, and was thrown away here. The operator had to
+     * hand-probe every assertion in the file against production to find out
+     * what had failed.
+     *
+     * Folding by `CERTIFIABILITY_RANK` makes the surviving row the least
+     * certifiable of the legs, carrying THAT leg's detail, with the legs'
+     * assertion counts summed — the same answer `readLedgerFile` would reach
+     * from the sink lines, so the in-memory ledger and the file agree.
+     */
+    fold?: true;
+  },
 ): void {
   const prior = ledger.get(requirementId);
-  if (prior !== undefined && prior.disposition !== disposition) {
+  if (prior !== undefined && prior.disposition !== disposition && extras?.fold !== true) {
     throw new Error(
       `RFC 0148 §A: ${requirementId} already recorded as '${prior.disposition}', now '${disposition}'. ` +
         'Exactly one disposition per requirement per run.',
@@ -107,7 +160,7 @@ export function recordRequirement(
         'Anything other than executed-pass MUST say why, or the ledger records an outcome nobody can act on.',
     );
   }
-  const entry: LedgerEntry = {
+  let entry: LedgerEntry = {
     requirementId,
     disposition,
     ...(detail === undefined ? {} : { detail }),
@@ -115,6 +168,27 @@ export function recordRequirement(
     ...(extras?.scenarioFile === undefined ? {} : { scenarioFile: extras.scenarioFile }),
     ...(extras?.evidence === undefined || disposition !== 'executed-pass' ? {} : { evidence: extras.evidence }),
   };
+  if (prior !== undefined && extras?.fold === true) {
+    // The least-certifiable leg wins the disposition and keeps its own detail;
+    // a tie keeps whichever side actually said something. Counts sum, because
+    // both legs really did assert against the target for this one requirement.
+    const keepPrior = CERTIFIABILITY_RANK[prior.disposition] <= CERTIFIABILITY_RANK[disposition];
+    const winner = keepPrior ? prior : entry;
+    const loser = keepPrior ? entry : prior;
+    const count = (prior.assertionCount ?? 0) + (extras?.assertionCount ?? 0);
+    const keptDetail = winner.detail ?? loser.detail;
+    const hasCount = prior.assertionCount !== undefined || extras?.assertionCount !== undefined;
+    entry = {
+      requirementId,
+      disposition: winner.disposition,
+      ...(keptDetail === undefined ? {} : { detail: keptDetail }),
+      ...(hasCount ? { assertionCount: count } : {}),
+      ...(winner.scenarioFile === undefined ? {} : { scenarioFile: winner.scenarioFile }),
+      // `evidence` is only meaningful on a pass; a fold that lands anywhere
+      // else drops it, exactly as the constructor above does.
+      ...(winner.disposition === 'executed-pass' && winner.evidence !== undefined ? { evidence: winner.evidence } : {}),
+    };
+  }
   ledger.set(requirementId, entry);
   journal.push(entry);
   // File sink (RFC 0148 acceptance item 2, S6). The in-memory map lives in a
@@ -159,7 +233,11 @@ export function readLedgerFile(path: string): readonly LedgerEntry[] {
     }
     if (typeof e.requirementId !== 'string' || !DISPOSITIONS.includes(e.disposition)) continue;
     const prior = merged.get(e.requirementId);
-    if (prior === undefined || rank[e.disposition] < rank[prior.disposition]) merged.set(e.requirementId, e);
+    // `<=`, not `<`: a per-`it` FOLD (2.37.0) appends the cumulative row after
+    // the leg rows it folded, so on an equal disposition the LAST line is the
+    // one carrying the summed `assertionCount`. For genuinely duplicate lines
+    // the two are identical and the choice is a no-op.
+    if (prior === undefined || rank[e.disposition] <= rank[prior.disposition]) merged.set(e.requirementId, e);
   }
   return [...merged.values()].sort((a, b) => a.requirementId.localeCompare(b.requirementId));
 }

package/src/lib/scenario-disposition.ts

@@ -118,8 +118,13 @@ export function resolveItRecord(
    * sites were not measured and v1 bundles are read through its EOS.
    */
   blockedStands = false,
+  /** The `it` title, so a failed row says WHICH leg of the requirement failed. */
+  testName?: string,
 ): { disposition: Disposition; detail?: string } {
-  if (state === 'fail') return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
+  if (state === 'fail') {
+    const where = testName === undefined || testName.trim() === '' ? '' : ` in "${testName.slice(0, 120)}"`;
+    return { disposition: 'executed-fail', detail: `the test executed and failed${where}: ${(firstError ?? 'no message').slice(0, 300)}` };
+  }
   if (state === 'pass' && assertionCalls > 0) {
     // `blockedDespiteAssertions` (soft-skip.ts): the leg says its setup
     // assertions are not the requirement, and the requirement went unobserved.
@@ -142,14 +147,45 @@ export function resolveItRecord(
   return { disposition: 'skipped', detail: 'vitest skipped the test (ctx.skip / it.skip) without a recorded gate reason' };
 }
 
+/** One failed `it` in a file: its title and its first error message. */
+export interface TestFailure {
+  readonly name: string;
+  readonly message?: string;
+}
+
+/**
+ * The `executed-fail` detail for a file row: WHICH cases failed, and what the
+ * first one said.
+ *
+ * Until 2.37.0 this was the fixed string "one or more assertions in the file
+ * failed". A tier-2 host read exactly that for `v2-run-bulk-cancel` — 10
+ * assertions, no case name, no message, and nothing else in the record for that
+ * file — and had to hand-probe every assertion in the file against production to
+ * find out what had happened. A bundle row whose only detail is that sentence is
+ * undiagnosable by construction, and every future flicker in any scenario had
+ * the same problem.
+ */
+export function failureDetail(failures: readonly TestFailure[], failedCount: number): string {
+  if (failures.length === 0) {
+    return `${failedCount} test(s) in the file failed; the runner captured no message`;
+  }
+  const head = failures[0]!;
+  const named = failures.slice(0, 3).map((f) => `"${f.name.slice(0, 120)}"`).join(', ');
+  const more = failures.length > 3 ? ` (+${failures.length - 3} more)` : '';
+  const msg = head.message === undefined || head.message.trim() === '' ? 'no message' : head.message.slice(0, 400);
+  return `${failures.length} test(s) failed — ${named}${more}; first failure: ${msg}`;
+}
+
 /** Worker half: fold a file's per-test states (+ any gate-recorded reason) into
  *  the ONE disposition the file records. */
 export function fileDisposition(
   states: readonly FileTestState[],
   gateReason: 'inapplicable' | 'skipped' | undefined,
   assertionCount?: number,
+  failures: readonly TestFailure[] = [],
 ): { disposition: Disposition; detail?: string } {
-  if (states.some((s) => s === 'fail')) return { disposition: 'executed-fail', detail: 'one or more assertions in the file failed' };
+  const failed = states.filter((s) => s === 'fail').length;
+  if (failed > 0) return { disposition: 'executed-fail', detail: failureDetail(failures, failed) };
   if (states.some((s) => s === 'pass')) {
     // A test that early-returned through `behaviorGate` is reported by vitest
     // as a pass with zero assertions. When EVERY passing test in the file did
@@ -195,6 +231,8 @@ export function resolveFileRecord(
   assertionCount: number,
   noted: { kind: 'inapplicable' | 'skipped' | 'blocked'; reason: string } | null,
   specCoherenceFile?: string,
+  /** The failed cases, so an `executed-fail` row NAMES them (2.37.0). */
+  failures: readonly TestFailure[] = [],
 ): { disposition: Disposition; detail?: string } {
   // A scenario whose subject is the CORPUS, skipped because the published
   // tarball does not bundle spec/v1/. RFC 0148 §A: `blocked` is defined over
@@ -211,7 +249,7 @@ export function resolveFileRecord(
   ) {
     return { disposition: 'inapplicable', detail: SPEC_COHERENCE_DETAIL };
   }
-  let { disposition, detail } = fileDisposition(states, gateReason, assertionCount);
+  let { disposition, detail } = fileDisposition(states, gateReason, assertionCount, failures);
   if (disposition === 'executed-pass' && assertionCount === 0) {
     if (noted !== null) {
       disposition = noted.kind;

package/src/lib/scoped-receiver.ts

@@ -0,0 +1,223 @@
+/**
+ * A webhook receiver that owns its destination — one exercise, one identity.
+ *
+ * ── Why this file exists (2.37.0) ────────────────────────────────────────────
+ * Five surfaces in this suite bind `OPENWOP_WEBHOOK_RECEIVER_PORT`, and on a
+ * tunnelled cut four of them registered `resolveRegistrationUrl(...)`, which
+ * returns `OPENWOP_WEBHOOK_RECEIVER_URL` VERBATIM — one byte-identical string
+ * for every caller. `v2-bound-id-kinds`, `v2-webhook-delivery-shape`,
+ * `v2-webhook-durable-delivery` and `webhook-signed-delivery` therefore pointed
+ * four subscriptions at ONE destination.
+ *
+ * A webhook subscription is durable host-side state. It keeps delivering, and
+ * RETRYING, after the file that created it has finished, so the collision is not
+ * only between two live listeners — it is between an exercise and the leftovers
+ * of an earlier one. Whichever receiver held the pinned port read those
+ * leftovers as its own traffic, and `v2-webhook-durable-delivery` answers 500 BY
+ * DESIGN for the first attempts of every delivery key, so the exercise it landed
+ * on saw failures it never caused. `v2-webhook-delivery-shape`'s own
+ * `startReceiver` carried a comment describing the symptom from the other end:
+ * "the tunnel forwards to the PINNED port — held by the other receiver, which
+ * answers 500 by design — so this file's `deliveries` stays empty, its legs
+ * soft-skip, and the rows resolve `executed-pass`." A wire-shape scenario that
+ * never opened a delivery body went green.
+ *
+ * This is the class openwop#1513 (two legs, one effect identity) and
+ * openwop#1520 (many fakes, one public front) already opened. Those two supply
+ * the halves, and this composes them rather than reimplementing either:
+ *
+ *   - ROUTING is `front-mux.ts`. Several receivers can be alive behind one
+ *     front; each registers its handler under its nonce and calls `routeFronted`
+ *     first, so a delivery reaches the receiver it was ADDRESSED to whichever
+ *     listener happens to hold the port.
+ *   - IDENTITY is here, and it is why the nonce is UNCONDITIONAL rather than
+ *     `frontedEndpoint`'s "only when this fake does not own the pinned port".
+ *     Routing alone does not close a webhook: a bare front is one identity
+ *     shared ACROSS TIME, so a retry aimed at a finished exercise arrives
+ *     indistinguishable from this one's traffic. With the nonce always present
+ *     that retry addresses a nonce this listener does not serve, `routeFronted`
+ *     answers it 404, and it is counted as `foreign()` — never as a delivery.
+ *
+ * What this does NOT do is relax any gate. The destination is still the
+ * operator's own front or loopback; `resolvePublicFront` still refuses a
+ * non-https or private front; `receiverBinding` still binds loopback unless the
+ * operator declared otherwise. Only the PATH changed.
+ *
+ * @see lib/front-mux.ts (routing), lib/effect-receiver.ts (the same nonce idea
+ *      for an outbound effect's Layer-2 identity)
+ */
+
+import { randomBytes } from 'node:crypto';
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+import { FRONT_MUX_PREFIX, registerBehindFront, routeFronted, unregisterBehindFront } from './front-mux.js';
+import { receiverBinding, resolvePublicFront } from './webhook-receiver.js';
+
+/** The operator's public front for the suite's webhook receiver. */
+export const WEBHOOK_FRONT_ENV = 'OPENWOP_WEBHOOK_RECEIVER_URL';
+
+type HeaderBag = Record<string, string | string[] | undefined>;
+
+/** One request addressed to THIS exercise. */
+export interface ScopedHit {
+  /** The path as this receiver sees it — the `/fx/<nonce>` prefix already stripped. */
+  readonly path: string;
+  readonly method: string;
+  readonly headers: HeaderBag;
+  readonly body: string;
+}
+
+export interface ScopedReceiver {
+  readonly server: Server;
+  /**
+   * The destination to REGISTER with the host: the public front when one is
+   * wired, else this listener's own address — this exercise's nonce path
+   * appended either way.
+   */
+  readonly url: string;
+  readonly tunnelled: boolean;
+  /** The local address this listener actually answers on — for failure detail. */
+  readonly localUrl: string;
+  /** What makes this exercise's destination, and so its subscription, its own. */
+  readonly nonce: string;
+  /** The port this listener bound — the pinned one when the operator pinned it. */
+  readonly port: number;
+  /**
+   * Requests that reached this listener bearing some OTHER exercise's nonce, or
+   * none at all. Reported so a scenario can say WHY it saw nothing; never handed
+   * to the scenario's recorder.
+   */
+  foreign(): number;
+  close(): Promise<void>;
+}
+
+/**
+ * Start a receiver for exactly one exercise.
+ *
+ * `respond` is called ONLY for this exercise's own requests, and sees the path
+ * with the nonce prefix stripped — exactly what it would see on a listener of
+ * its own. It owns the response.
+ */
+export async function startScopedReceiver(
+  respond: (hit: ScopedHit, res: ServerResponse) => void,
+): Promise<ScopedReceiver> {
+  const nonce = randomBytes(9).toString('hex');
+  let foreign = 0;
+  const own = (request: IncomingMessage, res: ServerResponse): void => {
+    const chunks: Buffer[] = [];
+    request.on('data', (c: Buffer) => chunks.push(c));
+    request.on('end', () => {
+      respond(
+        {
+          path: request.url ?? '/',
+          method: request.method ?? '',
+          headers: request.headers,
+          body: Buffer.concat(chunks).toString('utf8'),
+        },
+        res,
+      );
+    });
+  };
+  registerBehindFront(WEBHOOK_FRONT_ENV, nonce, own);
+  const server = createServer((request: IncomingMessage, res: ServerResponse) => {
+    // Counted BEFORE routing: `routeFronted` answers an unknown nonce itself and
+    // cannot report that it did, and a request that is not this exercise's must
+    // still be visible in the failure detail.
+    if (!(request.url ?? '/').startsWith(`${FRONT_MUX_PREFIX}${nonce}`)) foreign += 1;
+    if (routeFronted(WEBHOOK_FRONT_ENV, request, res)) return;
+    // Not an `/fx/` path at all: a stranger, or a host that dropped the path it
+    // was given. Answered, never recorded — a receiver that counts what it was
+    // not addressed to is the defect this helper exists to remove.
+    request.resume();
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'this receiver serves one conformance exercise; address its nonce path' }));
+  });
+  const pinned = Number(process.env['OPENWOP_WEBHOOK_RECEIVER_PORT'] ?? '');
+  const bindPort = Number.isInteger(pinned) && pinned > 0 && pinned < 65536 ? pinned : 0;
+  const binding = receiverBinding();
+  await new Promise<void>((resolve) => server.listen(bindPort, binding.bind, () => resolve()));
+  const addr = server.address();
+  if (typeof addr !== 'object' || addr === null) throw new Error('receiver address unavailable');
+  const origin = `http://${binding.advertise}:${addr.port}`;
+  const front = resolvePublicFront(WEBHOOK_FRONT_ENV, origin);
+  return {
+    server,
+    url: `${front.url.replace(/\/+$/, '')}${FRONT_MUX_PREFIX}${nonce}`,
+    tunnelled: front.tunnelled,
+    localUrl: `${origin}${FRONT_MUX_PREFIX}${nonce}`,
+    nonce,
+    port: addr.port,
+    foreign: () => foreign,
+    close: () =>
+      new Promise<void>((resolve) => {
+        unregisterBehindFront(WEBHOOK_FRONT_ENV, nonce);
+        server.close(() => resolve());
+      }),
+  };
+}
+
+/**
+ * A destination for an exercise that must REGISTER a subscription but wants no
+ * delivery — the mint leg of `v2-bound-id-kinds`, say, which needs a 201 and a
+ * bound id and nothing else.
+ *
+ * Such a leg still has to honour the operator's front, or its registration is
+ * refused by an SSRF guard doing its job and the leg records `blocked` on every
+ * public cut. But handing it the front VERBATIM gives it the same identity as
+ * every other exercise, and a subscription is live from the 201 until the
+ * DELETE: anything the host fans out in that window lands on whichever listener
+ * holds the port and is read as that exercise's traffic.
+ *
+ * So it gets a nonce too. No receiver serves it, which is the point: a delivery
+ * to this destination is answered 404 by whichever scoped receiver owns the
+ * port rather than being absorbed into that exercise's record.
+ */
+export function unservedDestination(fallbackUrl: string): { url: string; tunnelled: boolean; nonce: string } {
+  const nonce = randomBytes(9).toString('hex');
+  const front = resolvePublicFront(WEBHOOK_FRONT_ENV, fallbackUrl);
+  return {
+    url: `${front.url.replace(/\/+$/, '')}${FRONT_MUX_PREFIX}${nonce}`,
+    tunnelled: front.tunnelled,
+    nonce,
+  };
+}
+
+/**
+ * Why a scoped receiver saw NO request of its own — the cause a `blocked` row
+ * must name (RFC 0148 §A: anything other than `executed-pass` MUST say why).
+ *
+ * A zero here is not by itself evidence that the host failed to deliver, and
+ * `foreign()` is what tells the two apart:
+ *
+ *   - `foreign() > 0` — traffic DID reach this listener, addressed to another
+ *     nonce or to no nonce at all. The path between the host and this process
+ *     works, so "the host did not deliver" is not what was observed; what was
+ *     observed is that nothing arrived under THIS exercise's identity. That is
+ *     unmeasured, not unmet, and callers record `blocked`.
+ *   - `foreign() === 0` — nothing reached this listener at all. That is still
+ *     ambiguous (a front not wired to this process, or a host that never called
+ *     out), and callers keep whichever disposition the leg already carried; this
+ *     function only supplies the sentence that says which address was in play.
+ *
+ * Either way the record names the observation rather than a conclusion, so a
+ * reader can act on it without hand-probing production.
+ */
+export function noDeliveryCause(rx: ScopedReceiver, what = 'delivery'): string {
+  const where = rx.tunnelled
+    ? `the registered destination is the public front ${rx.url} (${WEBHOOK_FRONT_ENV}) and this listener answers on ${rx.localUrl}, port ${rx.port}`
+    : `the registered destination is this listener at ${rx.url}, port ${rx.port}`;
+  const strangers = rx.foreign();
+  if (strangers > 0) {
+    return `no ${what} bearing this exercise's nonce ${rx.nonce} arrived, but ${strangers} request(s) DID reach this listener addressed elsewhere — so the path from the host to this process works and the absence is of this exercise's identity, not of traffic (${where})`;
+  }
+  return `no ${what} bearing this exercise's nonce ${rx.nonce} arrived, and nothing else reached this listener either — ${where}`;
+}
+
+/**
+ * True when a zero observation is provably NOT a verdict about the host: other
+ * traffic reached this listener, so the absence is of this exercise's identity
+ * rather than of delivery. Callers record `blocked` (which denies certification
+ * exactly as a failure does, RFC 0168 §E.1) instead of convicting the host.
+ */
+export function absenceIsUnmeasured(rx: ScopedReceiver): boolean {
+  return rx.foreign() > 0;
+}

package/src/lib/triggerBridge.ts

@@ -20,6 +20,7 @@
  * @see spec/v1/trigger-bridge.md
  * @see spec/v1/profiles.md (§openwop-trigger-bridge)
  */
+import { randomBytes, randomInt } from 'node:crypto';
 import { driver } from './driver.js';
 import { deriveProfiles, type DiscoveryPayload } from './profiles.js';
 
@@ -70,5 +71,53 @@ export async function driveDelivery(
   return (res.json as DeliveryResult | undefined) ?? {};
 }
 
+/**
+ * A dedup key that belongs to ONE exercise (2.37.0).
+ *
+ * `trigger-bridge.md` §C-1 makes the dedup window a ≥24h FLOOR, so a LITERAL
+ * dedup key is not a fixture — it is a durable identity the host is required to
+ * remember across runs of this suite. Two exercises that hand the bridge the
+ * same key are ONE delivery by the spec's own rule, and the second one's row
+ * reads zero deliveries on a host doing exactly what it MUST. That is a suite
+ * defect and not a host defect, and it is the same failure the RFC 0158
+ * duplicate-delivery row had when two scenario files shared one effect identity
+ * (`lib/effect-receiver.ts`).
+ *
+ * `prefix` keeps a key readable in a host's own log; the random half is what
+ * makes it this exercise's. `randomBytes`, not `Date.now()`: two vitest workers
+ * can enter the same line in the same millisecond.
+ */
+export function freshDedupKey(prefix: string): string {
+  return `openwop-conformance-${prefix}-${randomBytes(9).toString('hex')}`;
+}
+
+/**
+ * The same per-exercise mint for a `stream` source, in the COORDINATE shape
+ * §F.5 keys on (2.37.0).
+ *
+ * `trigger-stream-cdc-sources.test.ts` handed the seam the literal
+ * `'events:3:99001'` and then asserted `deliveredCount === 1 || outcome ===
+ * 'delivered'` — the identical defect `freshDedupKey` above was written for,
+ * one file over, found when the enumeration was re-run against the merged
+ * tree. §C-1's window is a ≥24h floor and §F.5 reuses it verbatim, so the
+ * second run of that file against the same host, any time that day, hands the
+ * bridge broker coordinates it has already delivered; a CONFORMANT host
+ * collapses the exercise into the first run's outcome and the assertion
+ * convicts it. Cold host passes, warm host fails.
+ *
+ * `freshDedupKey` would not do here, and the difference is not cosmetic: §F.5
+ * says a stream event's dedup key SHOULD derive from
+ * `(topic, partition, offset)`, and the leg's own `req()` message asserts over
+ * exactly that keying. An opaque token would make the message describe
+ * something the call no longer does. So topic and partition stay fixed and the
+ * OFFSET is minted — which is precisely what makes a real broker's message a
+ * different message.
+ */
+export function freshStreamDedupKey(topic = 'events', partition = 3): string {
+  // A 2^44 offset space: distinct across every run this suite will make, and
+  // still a plausible broker offset rather than an opaque token.
+  return `${topic}:${partition}:${randomInt(2 ** 44)}`;
+}
+
 export const SUBSCRIPTION_STATES = ['active', 'paused', 'failed', 'dead-lettered'];
 export const DELIVERY_OUTCOMES = ['delivered', 'retrying', 'dead-lettered'];

package/src/scenarios/auth-subject-link.test.ts

@@ -23,6 +23,7 @@
  * @see spec/v1/auth-profiles.md §"Subject linking (SAML ⟷ SCIM)"
  */
 
+import { randomBytes } from 'node:crypto';
 import { describe, it, expect } from 'vitest';
 import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
@@ -109,7 +110,23 @@ describe('auth-subject-link: cross-lane deactivation (RFC 0159 §A.3 — opt-in)
     if (!idpUrl || !scimUrl) return softSkip('inapplicable', 'opt-in: SAML IdP and/or SCIM endpoint not provided');
 
     // 1. Provision a SCIM user carrying an opaque, IdP-stable externalId.
-    const externalId = 'idp-op-8f3a';
+    //
+    // MINTED PER EXERCISE (2.37.0). This was the literal `'idp-op-8f3a'`, and
+    // the SCIM directory it is provisioned into is the OPERATOR's
+    // (`OPENWOP_TEST_SCIM_URL`) — durable state outside this process. Step 3
+    // DEACTIVATES that user, and deactivation is the whole point of the leg, so
+    // the second run of this file against the same directory provisions an
+    // externalId that is already present and already deactivated. Step 2 then
+    // asserts "a valid linked SAML assertion authenticates before deactivation"
+    // against a subject the host is CORRECT to refuse: cold directory passes,
+    // warm directory fails, nothing about the host having changed. Same shape as
+    // the shared effect identity in `lib/effect-receiver.ts` (openwop#1513) and
+    // the fixed trigger-bridge dedup key.
+    //
+    // Unwitnessed: both opt-in variables are unset in every cut this suite has
+    // run, so the leg has never executed and the collision has never fired. It
+    // is read off the code, and the fix costs nothing if the reading is wrong.
+    const externalId = `idp-op-${randomBytes(6).toString('hex')}`;
     const provision = await driver.post('/v1/host/sample/auth/scim/provision', {
       scimUrl,
       op: 'create-user',

package/src/scenarios/trigger-bridge-delivery.test.ts

@@ -38,6 +38,7 @@ import {
 } from '../lib/triggerBridge.js';
 import { queryTestEvents, requireEvents, isEventLogSeamAvailable, resetTestSeam } from '../lib/event-log-query.js';
 import { req } from '../lib/requirement-ids.js';
+import { freshDedupKey } from '../lib/triggerBridge.js';
 
 const CONTENT_FREE_FORBIDDEN = ['body', 'headers', 'payload', 'secret', 'credentials', 'token', 'apiKey'];
 
@@ -56,7 +57,21 @@ describe('trigger-bridge-delivery (RFC 0083 §C)', () => {
     if (!(await isEventLogSeamAvailable())) return seamAbsent('host advertises openwop-trigger-bridge but the event-log seam is absent');
 
     // ---- Leg 1: dedup → effectively-once (§C-1) ---------------------------
-    const dedup = await driveDelivery({ scenario: 'dedup', dedupKey: 'conformance-dedup-key', source: 'queue' });
+    //
+    // The dedupKey is MINTED PER EXERCISE, and that is load-bearing (2.37.0).
+    // It used to be the literal `'conformance-dedup-key'`, and §C-1's dedup
+    // window is a ≥24h FLOOR — so the second run of this file against the same
+    // host, any time that day, hands the bridge a key it has already delivered.
+    // A CONFORMANT host then collapses the whole exercise into the first run's
+    // outcome and emits ZERO `delivered` attempts under this run's id, and the
+    // `=== 1` below convicts it. Cold host passes, warm host fails, nothing
+    // about the host having changed — the same shape as the RFC 0158 row that
+    // shared one effect identity between two files (`lib/effect-receiver.ts`).
+    // The REPETITION that §C-1 is about happens INSIDE `driveDelivery`'s
+    // `scenario: 'dedup'`, so a fresh key per exercise removes the cross-run
+    // collision without weakening the clause.
+    const dedupKey = freshDedupKey('queue');
+    const dedup = await driveDelivery({ scenario: 'dedup', dedupKey, source: 'queue' });
     if (dedup === null) return seamAbsent('host advertises openwop-trigger-bridge but the delivery seam is unwired');
 
     // The profile is derived AND the seam is wired — missing evidence is a
@@ -68,7 +83,7 @@ describe('trigger-bridge-delivery (RFC 0083 §C)', () => {
       'trigger.delivery.attempted (dedup)',
     );
     const deliveredForKey = dedupEvents.filter(
-      (e) => e.payload.dedupKey === 'conformance-dedup-key' && e.payload.outcome === 'delivered',
+      (e) => e.payload.dedupKey === dedupKey && e.payload.outcome === 'delivered',
     );
     expect(
       deliveredForKey.length === 1,

package/src/scenarios/trigger-stream-cdc-sources.test.ts

@@ -47,7 +47,7 @@ import { SCHEMAS_DIR, FIXTURES_DIR } from '../lib/paths.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
-import { driveDelivery } from '../lib/triggerBridge.js';
+import { driveDelivery, freshStreamDedupKey } from '../lib/triggerBridge.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip } from '../lib/soft-skip.js';
 
@@ -203,7 +203,22 @@ describe.skipIf(HTTP_SKIP)('trigger-stream-cdc: behavioral ingestion + dedup (ca
     const external = tb?.ingestion?.externalSources ?? [];
     if (!behaviorGate('triggerBridge.ingestion', (external.length ?? 0) > 0)) return;
 
-    const first = await driveDelivery({ scenario: 'dedup', dedupKey: 'events:3:99001', source: 'stream' });
+    // The broker coordinates are MINTED PER EXERCISE (2.37.x), and that is
+    // load-bearing. This was the literal `'events:3:99001'`, and §F.5 reuses
+    // §C-1's dedup window — a ≥24h FLOOR — verbatim, so the second run of this
+    // file against the same host, any time that day, hands the bridge an offset
+    // it has already delivered. A CONFORMANT host then collapses the exercise
+    // into the first run's outcome and reports neither a `deliveredCount` of 1
+    // nor `outcome: 'delivered'` under this run, and the assertion below
+    // convicts it: cold host passes, warm host fails, nothing about the host
+    // having changed. The repetition §C-1 is about happens INSIDE the seam's
+    // `scenario: 'dedup'` (it delivers the key TWICE), so a fresh offset per
+    // exercise removes the cross-run collision without weakening the clause.
+    // Same defect and same fix as `trigger-bridge-delivery`'s dedup key; the
+    // offset rather than an opaque token, because the `(topic,partition,offset)`
+    // keying is what the `req()` message below asserts over.
+    const dedupKey = freshStreamDedupKey();
+    const first = await driveDelivery({ scenario: 'dedup', dedupKey, source: 'stream' });
     if (first === null) return softSkip('blocked', 'precondition not met — `first === null` returned early (delivery seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // delivery seam unwired — soft-skip
     if (first.outcome === undefined && !external.includes('stream')) return softSkip('blocked', 'precondition not met — `first.outcome === undefined && !external.includes(\'stream\')` returned early (pre-0127 host — soft-skip) (seam, prior step, or fixture unavailable)'); // pre-0127 host — soft-skip
     expect(