@openwop/openwop-conformance 2.39.0 → 2.39.1

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.39.1] — 2026-09-25 — the RFC 0214 delivery legs survive a tunnel, and each one leaves its own row
+
+- **`v2-a2a-push-delivery` — every requirement now records a row, and the budgets fit a public front.** The 2.39.0 public push-on cut of the v2 reference host lost three legs (§A after-Delete, §B 3xx redirect, §D replay fork) to vitest's per-test timeout, not to an assertion — deliveries were arriving through the front (`no-openwop-signature` passed). Budgets now scale when `OPENWOP_WEBHOOK_RECEIVER_URL` is wired (arrival 60 s, settle 45 s, leg 240 s, fork leg 300 s; loopback unchanged), the #1537 precedent. Separately, `0214.a2a-push-delivery-authenticated` vanished from that bundle because its `it()` also cited `0214.a2a-push-no-openwop-signature` and the ledger keeps the LAST id an `it()` cites: the delivery is now made once and read by two legs, one id each, and when the delivery cannot be made the signature leg records `blocked` with the reason instead of disappearing.
+- **`v2-lane-issuer-advertised` no longer fails a host whose anonymous lane omits `revocation`, as the schema and `identity.md` §2.2 allow.** openwop#1540 (2.38.0) made `revocation` optional on the `anonymous` lane, whose §2.2 row reads "—", but this scenario's `.members` leg still asserted `revocation` on every lane. A host that followed the schema and the prose therefore failed the published suite; openwop-app-ce measured it bumping openwop-app's pin. A "—" lane may now omit `revocation`; if it advertises one, it must still be a known member, so no new failure mode is added. `scripts/check-lane-revocation-rules.mjs` gains a fifth assertion, that the `.members` leg exempts the "—" lanes, which fails against the 2.38.0/2.39.0 scenario.
+
 ## [2.39.0] — 2026-09-24 — an A2A push is measured at a receiver the suite owns
 
 - **RFC 0214 — the push legs land, and a host that advertises `a2a.pushNotifications` is now measured, not just the one that refuses.** `v2-a2a-operation-map` gains three legs gated on `pushNotifications: true`: `0214.a2a-push-register-ssrf` (a non-https, private, loopback or link-local destination is not registered), `0214.a2a-push-config-isolation` (a config read under another tenant's task, another of the caller's tasks, or an unknown id is answered byte-identically; a foreign delete deletes nothing; delete is idempotent) and `0214.a2a-push-secrets-not-returned` (the registered token and credentials are absent from Create/Get/List, `GetTask`, the run snapshot and the event log). New scenario `v2-a2a-push-delivery` measures delivery at a SUITE-OWNED scoped receiver behind the operator's public front (the RFC 0158 receiver): `0214.a2a-push-delivery-authenticated` (§A/§C — at least one POST, `Authorization: {scheme} {credentials}`, `application/a2a+json`, a `StreamResponse` naming the task), `0214.a2a-push-no-openwop-signature`, `0214.a2a-push-no-redirect` (§B — a 307 target receives nothing), `0214.a2a-push-discard-on-delete` (§A, with a live-config positive control) and `0214.a2a-push-fork-no-push` (§D). Every leg suspends its task at INPUT_REQUIRED BEFORE registering, so none can pass on a push nobody owed; without a public https front the legs record `blocked` (a conforming host refuses a loopback destination), never a pass and never a relaxed guard. Stated limit: the delivery-time DNS re-resolve arm is host-unit-tested; the suite does not control the host's resolver.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.0 @openwop/spec-artifacts@2.39.0
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.1 @openwop/spec-artifacts@2.39.1
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.0",
-  "stampSha256": "5b03950dee24be7100ae9005d4f0d36983fe206b250347594b7717a38829c969"
+  "version": "2.39.1",
+  "stampSha256": "d6c870ac95f4efeb1c666248d53ec1c29b55604cf16f1009da4471d1414b8ff6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.39.0",
+  "version": "2.39.1",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.39.0"
+    "@openwop/spec-artifacts": "2.39.1"
   }
 }

package/requirements.json

@@ -3,8 +3,8 @@
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
     "files": 633,
-    "tests": 2422,
-    "withStableId": 2422,
+    "tests": 2423,
+    "withStableId": 2423,
     "interpolatedTitles": 0,
     "explicitIds": 2304
   },
@@ -27072,15 +27072,10 @@
     {
       "id": "openwop.it.v2-a2a-push-delivery.a-c-a-transition-after-registration-is-posted-to-the-registered-destination-with",
       "file": "v2-a2a-push-delivery.test.ts",
-      "line": 140,
-      "title": "§A/§C — a transition after registration is POSTed to the registered destination with the registered Authorization and no OpenWOP signature",
+      "line": 189,
+      "title": "§A/§C — a transition after registration is POSTed to the registered destination with the registered Authorization",
       "explicitId": null,
       "citations": [
-        {
-          "section": "spec/v2/core/interop.md §\"A2A push delivery\" (RFC 0214)",
-          "requirement": null,
-          "interpolated": true
-        },
         {
           "section": null,
           "requirement": null,
@@ -27103,6 +27098,19 @@
           "section": "A2A v1.0.1 §4.3.3 (StreamResponse)",
           "requirement": null,
           "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-a2a-push-delivery.c-an-a2a-push-carries-no-openwop-signature",
+      "file": "v2-a2a-push-delivery.test.ts",
+      "line": 203,
+      "title": "§C — an A2A push carries no OpenWOP signature",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interop.md §\"A2A push delivery\" (RFC 0214)",
+          "requirement": "positive control: at least one push arrived to read headers from"
         },
         {
           "section": null,
@@ -27114,7 +27122,7 @@
     {
       "id": "openwop.it.v2-a2a-push-delivery.b-a-3xx-from-the-destination-is-a-failed-delivery-the-redirect-target-receives-n",
       "file": "v2-a2a-push-delivery.test.ts",
-      "line": 170,
+      "line": 215,
       "title": "§B — a 3xx from the destination is a failed delivery: the redirect target receives nothing, credential or not",
       "explicitId": null,
       "citations": [
@@ -27138,7 +27146,7 @@
     {
       "id": "openwop.it.v2-a2a-push-delivery.a-after-delete-no-further-push-reaches-that-destination-while-a-live-config-on-t",
       "file": "v2-a2a-push-delivery.test.ts",
-      "line": 192,
+      "line": 237,
       "title": "§A — after Delete no further push reaches that destination, while a live config on the same task still receives",
       "explicitId": null,
       "citations": [
@@ -27167,7 +27175,7 @@
     {
       "id": "openwop.it.v2-a2a-push-delivery.d-a-replay-fork-of-a-pushed-run-delivers-nothing-to-the-source-run-s-destination",
       "file": "v2-a2a-push-delivery.test.ts",
-      "line": 218,
+      "line": 263,
       "title": "§D — a replay fork of a pushed run delivers nothing to the source run's destination",
       "explicitId": null,
       "citations": [
@@ -29648,7 +29656,7 @@
     {
       "id": "openwop.it.v2-lane-issuer-advertised.a-windowed-revocation-rule-advertises-revocationwindowseconds",
       "file": "v2-lane-issuer-advertised.test.ts",
-      "line": 85,
+      "line": 93,
       "title": "a windowed revocation rule advertises revocationWindowSeconds",
       "explicitId": "openwop.requirement.0170.lane-issuer-advertised.window",
       "citations": [
@@ -29662,7 +29670,7 @@
     {
       "id": "openwop.it.v2-lane-issuer-advertised.a-lane-advertises-only-a-revocation-rule-its-identity-md-2-2-row-lists",
       "file": "v2-lane-issuer-advertised.test.ts",
-      "line": 96,
+      "line": 104,
       "title": "a lane advertises only a revocation rule its identity.md §2.2 row lists",
       "explicitId": "openwop.requirement.0170.lane-issuer-advertised.lane-rule",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.0",
-  "corpusTag": "v2.39.0",
+  "version": "2.39.1",
+  "corpusTag": "v2.39.1",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "fa7c00470e0e158d0d2fa84e0cf1e21168c767cd5344a83ad6849d6ab8a02649",
-    "api/v2/asyncapi.yaml": "e7569b32ffc06b52dbd4aa767086b99434e0c4ed6e366dd2dc4b0dd679e53cc6",
-    "api/v2/openapi.yaml": "f0c2cfdc20d3df1a60d46924b926d9802aac6aac3354010a255ec6f720eab5fd",
+    "api/seams-v2.yaml": "edff974e28c055f4d3f605078a32315475053cf4aeb4565f461ac6fe65462bdb",
+    "api/v2/asyncapi.yaml": "8dc0060855a0edf49a7f235016657f86ae3ba2d04bed99d0d9579d4f01f65c11",
+    "api/v2/openapi.yaml": "5c673efed4d9c350882b85d88f6c8e934793a2238b2f316ba66278ba7a75d121",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,7 +204,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "5fe5a056765ade4903c1c3d95b9223dc1276e6f89bc6457fb1115c958a6f6479",
+    "spec/v1/core-standard-manifest.json": "ffb07755718c26e734e30cd674469d232bdd9fca4e8743886090ab4a81df90a5",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -292,9 +292,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "ddc2621cd435ca2f65372a6d63757f63a5bb1a10ec81d25d4ca9607315ae1e9a",
+    "spec/v2/release.json": "c1c2d051b65444c959464ce385bf9851f3438a72a17a03405fc492421d454114",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "ec8449a1632606e34c419cc485e1404e1f1cced46a4bda3b2ab519d7c6859490"
+    "spec/v2/surface-baseline.json": "648c5e22fea9eaae6c900d7de1656209af0b5a8f5fa76b64885c0e6ab7cc3089"
   },
-  "corpusCommit": "42388852a5ef45c7dad7575ec50ab36c81eae8f3"
+  "corpusCommit": "64073df2c4d11a5b8a165ead4281d2557495e25b"
 }

package/src/scenarios/v2-a2a-push-delivery.test.ts

@@ -30,7 +30,7 @@
  * @see spec/v2/core/interop.md §"A2A push delivery"
  * @see spec/v2/core/security-defaults.md §"Onward hops"
  */
-import { describe, it, expect } from 'vitest';
+import { afterAll, describe, it, expect } from 'vitest';
 import { randomBytes } from 'node:crypto';
 import type { ServerResponse } from 'node:http';
 import { driver } from '../lib/driver.js';
@@ -103,13 +103,26 @@ async function until(pred: () => boolean, ms: number): Promise<boolean> {
   return pred();
 }
 const wait = (ms: number): Promise<void> => new Promise((ok) => setTimeout(ok, ms));
+
+/**
+ * Budgets. On a public cut every step crosses the operator's tunnel (suite → host
+ * front, host → receiver front), and the 2.39.0 public cut lost three legs to
+ * vitest's per-test timeout — not to an assertion — while deliveries were in
+ * fact arriving (#1537 precedent: the RFC 0199 state leg). Loopback keeps the
+ * tight budgets; a fronted run gets room for the round trips.
+ */
+const FRONTED = Boolean(process.env.OPENWOP_WEBHOOK_RECEIVER_URL);
+const ARRIVAL_MS = FRONTED ? 60_000 : 20_000;
+const SETTLE_MS = FRONTED ? 45_000 : 10_000;
+const LEG_MS = FRONTED ? 240_000 : 60_000;
+const FORK_LEG_MS = FRONTED ? 300_000 : 90_000;
 const header = (h: ScopedHit, name: string): string | undefined => { const v = h.headers[name.toLowerCase()]; return Array.isArray(v) ? v.join(',') : v; };
 
 async function runStatus(taskId: string): Promise<string | undefined> {
   const r = await driver.get(`/runs/${encodeURIComponent(taskId)}`);
   return r.status === 200 ? ((r.json as { status?: string }).status) : undefined;
 }
-async function settle(taskId: string, want: (s: string | undefined) => boolean, ms = 10000): Promise<string | undefined> {
+async function settle(taskId: string, want: (s: string | undefined) => boolean, ms = SETTLE_MS): Promise<string | undefined> {
   const end = Date.now() + ms;
   let s = await runStatus(taskId);
   while (!want(s) && Date.now() < end) { await wait(150); s = await runStatus(taskId); }
@@ -136,36 +149,68 @@ function unmeasurable(rx: ScopedReceiver, created: Rpc): string | null {
   return null;
 }
 
-describe('RFC 0214 — v2-a2a-push-delivery (host POSTs A2A push to a suite-owned receiver)', () => {
-  it('§A/§C — a transition after registration is POSTed to the registered destination with the registered Authorization and no OpenWOP signature', async () => {
-    const id = R('a2a-push-delivery-authenticated');
+/**
+ * One delivery, read by two legs. Each leg cites exactly one requirement id —
+ * the ledger keeps the LAST id an it() cites, so the 2.39.0 cut, whose single
+ * §A/§C it() cited both, recorded `no-openwop-signature` and silently dropped
+ * `delivery-authenticated`. The delivery runs once (lazily, in the first leg)
+ * and the second leg reads the same hits; when the delivery cannot be made the
+ * second leg records `blocked` with the reason instead of vanishing.
+ */
+type Delivery =
+  | { kind: 'measured'; hits: ScopedHit[]; taskId: string; cred: string; rx: ScopedReceiver }
+  | { kind: 'skip'; skip: 'inapplicable' | 'blocked'; reason: string };
+let delivery: Promise<Delivery> | undefined;
+let deliveryRx: ScopedReceiver | undefined;
+function deliverOnce(id: string = R('a2a-push-delivery-authenticated')): Promise<Delivery> {
+  delivery ??= (async (): Promise<Delivery> => {
     const g = await gate();
-    if (!g.ok) return softSkip(g.kind, g.reason);
+    if (!g.ok) return { kind: 'skip', skip: g.kind, reason: g.reason };
     const { rx, hits } = await receiver();
-    try {
-      const taskId = await suspendedTask(g.url, id);
-      const cred = `owpush${randomBytes(12).toString('hex')}`;
-      const created = await create(g.url, taskId, rx.url, { authentication: { scheme: 'Bearer', credentials: cred } });
-      const why = unmeasurable(rx, created);
-      if (why !== null) { await rpc(g.url, 'CancelTask', { id: taskId }); return softSkip('blocked', why); }
-      expect(created.error, req(id, DOC, `Create on a suspended task with the public receiver MUST succeed (got ${JSON.stringify(created.error)})`)).toBeUndefined();
-      await rpc(g.url, 'SendMessage', { message: acceptMessage(taskId) });
-      await settle(taskId, (s) => s !== undefined && TERMINAL.has(s));
-      const arrived = await until(() => hits.length > 0, 20000);
-      if (!arrived && absenceIsUnmeasured(rx)) return softSkip('blocked', noDeliveryCause(rx, 'A2A push'));
-      expect(hits.length, req(id, `${DOC} §C ("at least one attempt")`, `a transition after registration MUST be POSTed at least once to the registered destination — ${noDeliveryCause(rx, 'A2A push')}`)).toBeGreaterThan(0);
-      const h = hits[0]!;
-      expect(h.method, req(id, 'A2A v1.0.1 §4.3.3', 'a push is an HTTP POST')).toBe('POST');
-      expect(header(h, 'authorization'), req(id, `${DOC} §A (A2A v1.0.1 §4.3.3 "MUST include authentication credentials")`, 'the push MUST carry the registered credential as Authorization: {scheme} {credentials}')).toBe(`Bearer ${cred}`);
-      expect((header(h, 'content-type') ?? '').split(';')[0]!.trim(), req(id, 'A2A v1.0.1 §4.3.3', 'the push body is application/a2a+json')).toBe('application/a2a+json');
-      const body = JSON.parse(h.body || '{}') as { statusUpdate?: { taskId?: string; status?: { state?: string } } };
-      expect(body.statusUpdate?.taskId, req(id, 'A2A v1.0.1 §4.3.3 (StreamResponse)', `the push body MUST be a StreamResponse statusUpdate naming the task (got ${h.body.slice(0, 200)})`)).toBe(taskId);
-      const sigId = R('a2a-push-no-openwop-signature');
-      for (const x of hits) {
-        expect(header(x, 'openwop-signature'), req(sigId, `${DOC} §C ("no OpenWOP signature")`, 'an A2A push MUST NOT carry an OpenWOP-Signature — A2A defines no secret exchange to verify it')).toBeUndefined();
-      }
-    } finally { await rx.close(); }
-  }, 60_000);
+    deliveryRx = rx;
+    const taskId = await suspendedTask(g.url, id);
+    const cred = `owpush${randomBytes(12).toString('hex')}`;
+    const created = await create(g.url, taskId, rx.url, { authentication: { scheme: 'Bearer', credentials: cred } });
+    const why = unmeasurable(rx, created);
+    if (why !== null) { await rpc(g.url, 'CancelTask', { id: taskId }); return { kind: 'skip', skip: 'blocked', reason: why }; }
+    expect(created.error, req(id, DOC, `Create on a suspended task with the public receiver MUST succeed (got ${JSON.stringify(created.error)})`)).toBeUndefined();
+    await rpc(g.url, 'SendMessage', { message: acceptMessage(taskId) });
+    await settle(taskId, (s) => s !== undefined && TERMINAL.has(s));
+    const arrived = await until(() => hits.length > 0, ARRIVAL_MS);
+    if (!arrived && absenceIsUnmeasured(rx)) return { kind: 'skip', skip: 'blocked', reason: noDeliveryCause(rx, 'A2A push') };
+    return { kind: 'measured', hits, taskId, cred, rx };
+  })();
+  return delivery;
+}
+
+describe('RFC 0214 — v2-a2a-push-delivery (host POSTs A2A push to a suite-owned receiver)', () => {
+  afterAll(async () => { await deliveryRx?.close(); });
+
+  it('§A/§C — a transition after registration is POSTed to the registered destination with the registered Authorization', async () => {
+    const id = R('a2a-push-delivery-authenticated');
+    const d = await deliverOnce(id);
+    if (d.kind === 'skip') return softSkip(d.skip, d.reason);
+    const { hits, taskId, cred, rx } = d;
+    expect(hits.length, req(id, `${DOC} §C ("at least one attempt")`, `a transition after registration MUST be POSTed at least once to the registered destination — ${noDeliveryCause(rx, 'A2A push')}`)).toBeGreaterThan(0);
+    const h = hits[0]!;
+    expect(h.method, req(id, 'A2A v1.0.1 §4.3.3', 'a push is an HTTP POST')).toBe('POST');
+    expect(header(h, 'authorization'), req(id, `${DOC} §A (A2A v1.0.1 §4.3.3 "MUST include authentication credentials")`, 'the push MUST carry the registered credential as Authorization: {scheme} {credentials}')).toBe(`Bearer ${cred}`);
+    expect((header(h, 'content-type') ?? '').split(';')[0]!.trim(), req(id, 'A2A v1.0.1 §4.3.3', 'the push body is application/a2a+json')).toBe('application/a2a+json');
+    const body = JSON.parse(h.body || '{}') as { statusUpdate?: { taskId?: string; status?: { state?: string } } };
+    expect(body.statusUpdate?.taskId, req(id, 'A2A v1.0.1 §4.3.3 (StreamResponse)', `the push body MUST be a StreamResponse statusUpdate naming the task (got ${h.body.slice(0, 200)})`)).toBe(taskId);
+  }, LEG_MS);
+
+  it('§C — an A2A push carries no OpenWOP signature', async () => {
+    const id = R('a2a-push-no-openwop-signature');
+    let d: Delivery;
+    try { d = await deliverOnce(); }
+    catch (err) { return softSkip('blocked', `the delivery this leg reads was not made — the §A/§C leg failed first: ${err instanceof Error ? err.message.slice(0, 200) : String(err)}`); }
+    if (d.kind === 'skip') return softSkip(d.skip, d.reason);
+    expect(d.hits.length, req(id, DOC, 'positive control: at least one push arrived to read headers from')).toBeGreaterThan(0);
+    for (const x of d.hits) {
+      expect(header(x, 'openwop-signature'), req(id, `${DOC} §C ("no OpenWOP signature")`, 'an A2A push MUST NOT carry an OpenWOP-Signature — A2A defines no secret exchange to verify it')).toBeUndefined();
+    }
+  }, LEG_MS);
 
   it('§B — a 3xx from the destination is a failed delivery: the redirect target receives nothing, credential or not', async () => {
     const id = R('a2a-push-no-redirect');
@@ -181,13 +226,13 @@ describe('RFC 0214 — v2-a2a-push-delivery (host POSTs A2A push to a suite-owne
       expect(created.error, req(id, DOC, `Create MUST succeed (got ${JSON.stringify(created.error)})`)).toBeUndefined();
       await rpc(g.url, 'SendMessage', { message: acceptMessage(taskId) });
       await settle(taskId, (s) => s !== undefined && TERMINAL.has(s));
-      const arrived = await until(() => origin.hits.length > 0, 20000);
+      const arrived = await until(() => origin.hits.length > 0, ARRIVAL_MS);
       if (!arrived && absenceIsUnmeasured(origin.rx)) return softSkip('blocked', noDeliveryCause(origin.rx, 'A2A push'));
       expect(origin.hits.length, req(id, DOC, `positive control: the registered destination MUST receive the push it then redirects — ${noDeliveryCause(origin.rx, 'A2A push')}`)).toBeGreaterThan(0);
       await wait(4000); // any retry or followed redirect lands in this window
       expect(target.hits.length, req(id, `${DOC} §B; webhooks.md §Egress ("refuse to follow redirects")`, 'the redirect target MUST receive nothing: a 3xx is a delivery failure and the credential MUST NOT be sent after a redirect')).toBe(0);
     } finally { await origin.rx.close(); await target.rx.close(); }
-  }, 60_000);
+  }, LEG_MS);
 
   it('§A — after Delete no further push reaches that destination, while a live config on the same task still receives', async () => {
     const id = R('a2a-push-discard-on-delete');
@@ -207,13 +252,13 @@ describe('RFC 0214 — v2-a2a-push-delivery (host POSTs A2A push to a suite-owne
       expect(del.error, req(id, DOC, `Delete of the caller's own config MUST succeed (got ${JSON.stringify(del.error)})`)).toBeUndefined();
       await rpc(g.url, 'SendMessage', { message: acceptMessage(taskId) });
       await settle(taskId, (s) => s !== undefined && TERMINAL.has(s));
-      const arrived = await until(() => kept.hits.length > 0, 20000);
+      const arrived = await until(() => kept.hits.length > 0, ARRIVAL_MS);
       if (!arrived && absenceIsUnmeasured(kept.rx)) return softSkip('blocked', noDeliveryCause(kept.rx, 'A2A push'));
       expect(kept.hits.length, req(id, DOC, `positive control: the config that was NOT deleted MUST still receive the push — ${noDeliveryCause(kept.rx, 'A2A push')}`)).toBeGreaterThan(0);
       await wait(3000);
       expect(dropped.hits.length, req(id, `${DOC} §A ("dropped when the config is deleted")`, 'a deleted config MUST receive nothing further — its destination credential is discarded with it')).toBe(0);
     } finally { await kept.rx.close(); await dropped.rx.close(); }
-  }, 60_000);
+  }, LEG_MS);
 
   it('§D — a replay fork of a pushed run delivers nothing to the source run\'s destination', async () => {
     const id = R('a2a-push-fork-no-push');
@@ -230,7 +275,7 @@ describe('RFC 0214 — v2-a2a-push-delivery (host POSTs A2A push to a suite-owne
       if (why !== null) { await rpc(g.url, 'CancelTask', { id: taskId }); return softSkip('blocked', why); }
       await rpc(g.url, 'SendMessage', { message: acceptMessage(taskId) });
       await settle(taskId, (s) => s !== undefined && TERMINAL.has(s));
-      const arrived = await until(() => hits.length > 0, 20000);
+      const arrived = await until(() => hits.length > 0, ARRIVAL_MS);
       if (!arrived && absenceIsUnmeasured(rx)) return softSkip('blocked', noDeliveryCause(rx, 'A2A push'));
       expect(hits.length, req(id, DOC, `positive control: the source run MUST have pushed before the fork — ${noDeliveryCause(rx, 'A2A push')}`)).toBeGreaterThan(0);
       await wait(3000);
@@ -238,9 +283,9 @@ describe('RFC 0214 — v2-a2a-push-delivery (host POSTs A2A push to a suite-owne
       const fork = await driver.post(`/runs/${encodeURIComponent(taskId)}:fork`, { mode: 'replay' });
       if (fork.status < 200 || fork.status >= 300) return softSkip('blocked', `replay is advertised but forkRun answered ${fork.status} ${JSON.stringify(fork.json)} — the fork leg is unmeasured`);
       const child = (fork.json as { runId?: string } | undefined)?.runId;
-      if (typeof child === 'string') await settle(child, (s) => s !== undefined && TERMINAL.has(s), 15000);
+      if (typeof child === 'string') await settle(child, (s) => s !== undefined && TERMINAL.has(s));
       await wait(4000);
       expect(hits.length, req(id, `${DOC} §D; replay.md §Suppression ("MUST NOT deliver events a replay re-emits")`, `a replay fork MUST NOT push to the source run's destination (deliveries ${before} before the fork, ${hits.length} after)`)).toBe(before);
     } finally { await rx.close(); }
-  }, 90_000);
+  }, FORK_LEG_MS);
 });

package/src/scenarios/v2-lane-issuer-advertised.test.ts

@@ -74,7 +74,15 @@ describe('v2 lane-issuer-advertised (RFC 0170 §B.2–§B.4)', () => {
       expect(LANES.has(name), req('openwop.requirement.0170.lane-issuer-advertised.members', DOC, `auth.lanes[].lane MUST be one of the ten lanes (got ${name})`)).toBe(true);
       const issuers = l['issuers'];
       expect(Array.isArray(issuers) && issuers.length > 0 && issuers.every((i) => typeof i === 'string' && i.length > 0), req('openwop.requirement.0170.lane-issuer-advertised.members', 'spec/v2/core/identity.md §2.2', `lane ${name} MUST advertise its trust root in issuers[] (min 1, non-empty strings)`)).toBe(true);
-      expect(REVOCATION.has(String(l['revocation'])), req('openwop.requirement.0170.lane-issuer-advertised.members', 'spec/v2/core/identity.md §2.2', `lane ${name} MUST name its revocation rule`)).toBe(true);
+      // identity.md §2.2: a lane whose row reads "—" (`anonymous`) has no
+      // revocation rule, so it MAY omit `revocation` — the schema made it
+      // optional there in 2.38.0 (openwop#1540), and until 2.39.1 this leg
+      // still demanded it, failing a host that followed the schema and the
+      // prose (measured on openwop-app). If such a lane does advertise one,
+      // it must still be a known member. Every other lane MUST name its rule.
+      if (!(LANE_RULES[name] === null && l['revocation'] === undefined)) {
+        expect(REVOCATION.has(String(l['revocation'])), req('openwop.requirement.0170.lane-issuer-advertised.members', 'spec/v2/core/identity.md §2.2', `lane ${name} MUST name its revocation rule`)).toBe(true);
+      }
       expect(ASSURANCE.has(String(l['minimumAssurance'])), req('openwop.requirement.0170.lane-issuer-advertised.members', 'spec/v2/core/identity.md §2.3', `lane ${name} MUST advertise minimumAssurance: bearer | sender-constrained | key-bound`)).toBe(true);
       if (l['delegationProofs'] !== undefined) {
         expect(Array.isArray(l['delegationProofs']) && (l['delegationProofs'] as unknown[]).every((p) => PROOFS.has(String(p))), req('openwop.requirement.0170.lane-issuer-advertised.members', 'spec/v2/core/identity.md §2.4', `lane ${name}: delegationProofs[] MUST be drawn from mtls-key-binding | dpop | svid-chain`)).toBe(true);