@openwop/openwop-conformance 2.39.1 → 2.39.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.39.2] — 2026-09-25 — RFC 0208's unreadable-task leg records its own row
+
+- **`0208.a2a-unreadable-not-found` records its own row.** In `v2-a2a-operation-map`, one `it()` cited both RFC 0208's `a2a-unreadable-not-found` and RFC 0211's `a2a-unreadable-not-found-details`. The per-`it` ledger keeps only the last id, so the 0208 row never reached a bundle: it is absent from the certified 2.38.0 v2-reference cut, and it is the one row keeping RFC 0208 from `Accepted` (the other 18 pass). This is the same class as openwop#1552. RFC 0211's detail comparison now has its own `it()` with its own setup, so each id records once. `scripts/check-req-only.mjs` already failed an `it()` citing two LITERAL ids, but it read helper-built ids (`R('x')`, `R11('x')`) as no id at all, which is how this one passed. It now counts each (helper, slug) as an id, fails against the 2.39.1 scenario, and finds no other case in 633 scenario files.
+- **`src/lib/v2-projection.ts`: `stripSupported` is now `stripSupportedFlag`, named for the one thing it does** (TODO S1). It removes the retired `supported` flag and nothing else. The corpus generator's function of the same old name (now `projectV1FacetSchema`) also drops `tier`/`experimentalUntil`, folds `supported`-gated if/then into `required`, closes objects and rewrites prose. Under one name, a host reading either assumed the other matched. Each now documents the other. **`stripSupported` stays as a `@deprecated` alias**, because openwop-app's `whd7-v2-projection-parity.test.ts` imports it by that name; it is removed at the next suite major. `carriesUnspliceablePayload` is unchanged, and a self-test now holds it equal to the generator's copy (`scripts/v2-unspliceable.mjs`) on every node of the v1 capabilities schema.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.39.2` because `2.39.1` is tagged and publishing. Not tagged, not published.
+
 ## [2.39.1] — 2026-09-25 — the RFC 0214 delivery legs survive a tunnel, and each one leaves its own row
 
 - **`v2-a2a-push-delivery` — every requirement now records a row, and the budgets fit a public front.** The 2.39.0 public push-on cut of the v2 reference host lost three legs (§A after-Delete, §B 3xx redirect, §D replay fork) to vitest's per-test timeout, not to an assertion — deliveries were arriving through the front (`no-openwop-signature` passed). Budgets now scale when `OPENWOP_WEBHOOK_RECEIVER_URL` is wired (arrival 60 s, settle 45 s, leg 240 s, fork leg 300 s; loopback unchanged), the #1537 precedent. Separately, `0214.a2a-push-delivery-authenticated` vanished from that bundle because its `it()` also cited `0214.a2a-push-no-openwop-signature` and the ledger keeps the LAST id an `it()` cites: the delivery is now made once and read by two legs, one id each, and when the delivery cannot be made the signature leg records `blocked` with the reason instead of disappearing.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.1 @openwop/spec-artifacts@2.39.1
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.2 @openwop/spec-artifacts@2.39.2
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.1",
-  "stampSha256": "d6c870ac95f4efeb1c666248d53ec1c29b55604cf16f1009da4471d1414b8ff6"
+  "version": "2.39.2",
+  "stampSha256": "d3e9417fe0ae348a07cf66c1167cefe100d1dcd43e053c238b82195c77699e9f"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.39.1",
+  "version": "2.39.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.39.1"
+    "@openwop/spec-artifacts": "2.39.2"
   }
 }

package/requirements.json

@@ -3,8 +3,8 @@
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
     "files": 633,
-    "tests": 2423,
-    "withStableId": 2423,
+    "tests": 2424,
+    "withStableId": 2424,
     "interpolatedTitles": 0,
     "explicitIds": 2304
   },
@@ -26690,6 +26690,30 @@
       "line": 180,
       "title": "an unknown task and another tenant's task are answered by the same TaskNotFoundError",
       "explicitId": null,
+      "citations": [
+        {
+          "section": "identity.md §5; a2a.operations GetTask",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "a2a.errors TaskNotFoundError",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "interop.md §\"The operation mappings\" Isolation",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-a2a-operation-map.an-unknown-task-and-another-tenant-s-task-carry-equivalent-errorinfo-details-rfc",
+      "file": "v2-a2a-operation-map.test.ts",
+      "line": 201,
+      "title": "an unknown task and another tenant's task carry equivalent ErrorInfo details (RFC 0211 §D)",
+      "explicitId": null,
       "citations": [
         {
           "section": "identity.md §5; a2a.operations GetTask",
@@ -26720,7 +26744,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.task-status-state-is-the-map-s-projection-of-the-run-status-at-every-observed-st",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 202,
+      "line": 223,
       "title": "Task.status.state is the map's projection of the run status at every observed state",
       "explicitId": null,
       "citations": [
@@ -26743,7 +26767,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.the-json-rpc-error-codes-the-suite-can-cause-are-the-a2a-1-0-1-codes",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 227,
+      "line": 248,
       "title": "the JSON-RPC error codes the suite can cause are the A2A 1.0.1 codes",
       "explicitId": null,
       "citations": [
@@ -26766,7 +26790,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-row-whose-requires-facet-is-not-advertised-is-refused-with-the-row-s-error",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 241,
+      "line": 262,
       "title": "a row whose requires facet is not advertised is refused with the row's error",
       "explicitId": null,
       "citations": [
@@ -26784,7 +26808,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-host-not-advertising-a2a-pushnotifications-refuses-all-four-push-config-operat",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 254,
+      "line": 275,
       "title": "a host not advertising a2a.pushNotifications refuses all four push-config operations with PushNotificationNotSupportedError",
       "explicitId": null,
       "citations": [
@@ -26808,7 +26832,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.rfc-0214-createtaskpushnotificationconfig-refuses-a-non-https-or-private-destina",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 285,
+      "line": 306,
       "title": "RFC 0214 — CreateTaskPushNotificationConfig refuses a non-https or private destination",
       "explicitId": null,
       "citations": [
@@ -26832,7 +26856,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.rfc-0214-e-a-push-config-of-another-tenant-s-task-of-another-task-or-unknown-is",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 303,
+      "line": 324,
       "title": "RFC 0214 §E — a push config of another tenant's task, of another task, or unknown, is answered identically",
       "explicitId": null,
       "citations": [
@@ -26880,7 +26904,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.rfc-0214-a-a-push-config-s-token-and-credentials-are-never-returned-and-never-re",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 347,
+      "line": 368,
       "title": "RFC 0214 §A — a push config's token and credentials are never returned, and never reach task, events or state",
       "explicitId": null,
       "citations": [
@@ -26904,7 +26928,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.listtasks-returns-only-what-listruns-returns-to-the-same-subject-tenant-and-cont",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 381,
+      "line": 402,
       "title": "ListTasks returns only what listRuns returns to the same Subject; tenant and contextId never select",
       "explicitId": null,
       "citations": [
@@ -26941,7 +26965,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.an-a2a-error-s-data-is-an-array-carrying-one-errorinfo-with-the-map-row-s-reason",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 414,
+      "line": 435,
       "title": "an A2A error's data is an array carrying one ErrorInfo with the map row's reason and the A2A domain",
       "explicitId": null,
       "citations": [
@@ -26975,7 +26999,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.no-response-on-the-card-s-json-rpc-interface-url-is-the-openwop-error-envelope",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 435,
+      "line": 456,
       "title": "no response on the card's JSON-RPC interface URL is the OpenWOP error envelope",
       "explicitId": null,
       "citations": [
@@ -26993,7 +27017,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.versionnotsupportederror-carries-errorinfo-version-not-supported-and-supportedve",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 455,
+      "line": 476,
       "title": "VersionNotSupportedError carries ErrorInfo VERSION_NOT_SUPPORTED, and supportedVersions is a comma-joined subset of the card",
       "explicitId": null,
       "citations": [
@@ -27017,7 +27041,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.an-http-json-interface-answers-an-a2a-error-with-google-rpc-status-carrying-the",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 473,
+      "line": 494,
       "title": "an HTTP+JSON interface answers an A2A error with google.rpc.Status carrying the ErrorInfo",
       "explicitId": null,
       "citations": [
@@ -27036,7 +27060,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-run-suspended-on-a-credential-interrupt-projects-to-task-state-auth-required-n",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 488,
+      "line": 509,
       "title": "a run suspended on a credential interrupt projects to TASK_STATE_AUTH_REQUIRED, naming the provider and carrying connectUrl",
       "explicitId": null,
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.1",
-  "corpusTag": "v2.39.1",
+  "version": "2.39.2",
+  "corpusTag": "v2.39.2",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "edff974e28c055f4d3f605078a32315475053cf4aeb4565f461ac6fe65462bdb",
-    "api/v2/asyncapi.yaml": "8dc0060855a0edf49a7f235016657f86ae3ba2d04bed99d0d9579d4f01f65c11",
-    "api/v2/openapi.yaml": "5c673efed4d9c350882b85d88f6c8e934793a2238b2f316ba66278ba7a75d121",
+    "api/seams-v2.yaml": "bac1af1953801e2e3e80cf3aa006b168611cb5b20ccb70c52674815437204e85",
+    "api/v2/asyncapi.yaml": "77f9311485f7220c28fb81937670ba415b9a3edc0adf73ad3c77e1e288247548",
+    "api/v2/openapi.yaml": "5bf2dd1dfd7762e0c108ffe51367933108d701d8dd8549aa6e21f1cbece7291b",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,7 +204,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "ffb07755718c26e734e30cd674469d232bdd9fca4e8743886090ab4a81df90a5",
+    "spec/v1/core-standard-manifest.json": "4b144e92eae7afe2e541888d89c5461853f0cf1b929e9dca6a253fbe78d3e591",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -292,9 +292,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "c1c2d051b65444c959464ce385bf9851f3438a72a17a03405fc492421d454114",
+    "spec/v2/release.json": "00fba2903eb7f34d8c98a7cd11fee02590f5390f3109e5bfdba85f9ceeeddf83",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "648c5e22fea9eaae6c900d7de1656209af0b5a8f5fa76b64885c0e6ab7cc3089"
+    "spec/v2/surface-baseline.json": "314e72a7687918b11a89875d0b735ea4ec1589bd6ccb8abcf574d5e2fbba5333"
   },
-  "corpusCommit": "64073df2c4d11a5b8a165ead4281d2557495e25b"
+  "corpusCommit": "57cc8d88f96abb980c605cc386167861b227ff97"
 }

package/src/lib/v2-projection.ts

@@ -1,5 +1,6 @@
 /**
- * Project a v1 capability value into its v2 shape.
+ * Remove the retired `supported` flag from a v1 capability schema fragment
+ * (or an advertised value), and flag payload a v2 record cannot splice.
  *
  * WHY THIS EXISTS, in three measured instances from one week:
  *
@@ -24,17 +25,37 @@
  * It deliberately does NOT invent shape. If a v1 value carries payload a v2
  * record cannot hold, that is RFC 0193's named-seat problem and needs a person
  * to name the seat; this function will not paper over it.
+ *
+ * ── What it is NOT ──────────────────────────────────────────────────────────
+ * It is not the corpus's v2 facet projection. `projectV1FacetSchema` in
+ * scripts/generate-from-declaration.mjs builds schemas/v2/capabilities.schema.json
+ * and does four more things this does not:
+ *
+ *   - drops `tier` and `experimentalUntil` (the record's `status`/`until`
+ *     absorb them — mapping a v1 tier onto a v2 status is a decision, not a strip);
+ *   - folds `supported`-gated if/then into unconditional `required` (RFC 0192 §A);
+ *     here the conditional stays, its `if` reduced to an always-true
+ *     `{ properties: {} }` — the same verdict, but not the same schema;
+ *   - closes objects (`additionalProperties: false`);
+ *   - rewrites `supported` prose in descriptions (RFC 0192 §B).
+ *
+ * So `multiAgent.executionModel` passed through this still carries `tier` and
+ * `experimentalUntil`. Both functions were named `stripSupported` until suite
+ * 2.38.x, which hid that difference (the old name survives as a deprecated
+ * alias for openwop-app's parity test); do not merge them — they have different
+ * contracts. `carriesUnspliceablePayload` IS the same predicate as
+ * scripts/v2-unspliceable.mjs, and a self-test holds the two copies equal.
  */
 
-/** Recursively drop `supported` — at every depth, and out of any `required[]`. */
-export function stripSupported<T>(value: T): T {
-  if (Array.isArray(value)) return value.map((v) => stripSupported(v)) as unknown as T;
+/** Recursively drop `supported` — at every depth, and out of any `required[]`. Nothing else. */
+export function stripSupportedFlag<T>(value: T): T {
+  if (Array.isArray(value)) return value.map((v) => stripSupportedFlag(v)) as unknown as T;
   if (value === null || typeof value !== 'object') return value;
 
   const out: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
     if (k === 'supported') continue;
-    out[k] = stripSupported(v);
+    out[k] = stripSupportedFlag(v);
   }
   // A `required` list naming `supported` keeps a retired field mandatory, which
   // is how a closed v2 record ends up unsatisfiable by any honest host.
@@ -46,6 +67,14 @@ export function stripSupported<T>(value: T): T {
   return out as T;
 }
 
+/**
+ * @deprecated Renamed `stripSupportedFlag` in suite 2.38.x; the old name was shared
+ * with the generator's full schema projection and hid the difference. Kept because
+ * openwop-app's `backend/typescript/test/whd7-v2-projection-parity.test.ts` imports
+ * it by this name. Remove at the next suite major.
+ */
+export const stripSupported = stripSupportedFlag;
+
 /**
  * True when a v1 value carries payload a uniform v2 record cannot splice —
  * an array, a map, an enum or a scalar rather than an object with properties.

package/src/scenarios/v2-a2a-operation-map.test.ts

@@ -190,6 +190,27 @@ describe('RFC 0208 — v2-a2a-operation-map (host as A2A 1.0 server, gated on a2
     const b = await rpc(t.url, 'GetTask', { id: foreign });
     expect(a.error?.code, req(R('a2a-unreadable-not-found'), 'a2a.errors TaskNotFoundError', `an unknown task MUST be TaskNotFoundError -32001 (got ${JSON.stringify(a.error ?? a.result)})`)).toBe(-32001);
     expect(b.error?.code, req(R('a2a-unreadable-not-found'), 'interop.md §"The operation mappings" Isolation', `a task the caller cannot read — here a foreign tenant segment REST refuses 403 — MUST be answered exactly as a nonexistent one, -32001 (got ${JSON.stringify(b.error ?? b.result)}, HTTP ${b.status})`)).toBe(-32001);
+    await rpc(t.url, 'CancelTask', { id });
+  });
+
+  // RFC 0211's detail comparison gets its OWN it(): an it() that cites two ids
+  // records only the LAST one in the ledger, and until 2.39.2 this setup lived in
+  // one it() with 0208's assertions — so `0208.a2a-unreadable-not-found` never
+  // reached a bundle (absent from the certified 2.38.0 v2-reference cut, the only
+  // row keeping RFC 0208 from Accepted). Same class as openwop#1552.
+  it('an unknown task and another tenant\'s task carry equivalent ErrorInfo details (RFC 0211 §D)', async () => {
+    const t = await target(true);
+    if (!t.ok) return skip(t, R11('a2a-unreadable-not-found-details'));
+    const first = await startApprovalTask(t.url);
+    const id = first.task?.id;
+    expect(typeof id === 'string' && id.includes('/'), req(R11('a2a-unreadable-not-found-details'), 'identity.md §5; a2a.operations GetTask', `Task.id is the tenant-bound runId <tenant>/<opaque> (got ${JSON.stringify(id)})`)).toBe(true);
+    const [tenant, opaque] = [id!.slice(0, id!.indexOf('/')), id!.slice(id!.indexOf('/') + 1)];
+    const fabricated = `${tenant}/${randomBytes(16).toString('base64url').replace(/[^A-Za-z0-9]/g, 'x').slice(0, 22)}`;
+    const foreign = `zz-conformance-foreign/${opaque}`;
+    const a = await rpc(t.url, 'GetTask', { id: fabricated });
+    const b = await rpc(t.url, 'GetTask', { id: foreign });
+    expect(a.error?.code, req(R11('a2a-unreadable-not-found-details'), 'a2a.errors TaskNotFoundError', `an unknown task MUST be TaskNotFoundError -32001 (got ${JSON.stringify(a.error ?? a.result)})`)).toBe(-32001);
+    expect(b.error?.code, req(R11('a2a-unreadable-not-found-details'), 'interop.md §"The operation mappings" Isolation', `a task the caller cannot read — here a foreign tenant segment REST refuses 403 — MUST be answered exactly as a nonexistent one, -32001 (got ${JSON.stringify(b.error ?? b.result)}, HTTP ${b.status})`)).toBe(-32001);
     // RFC 0211 §D: compare the details per element. `Object.keys(data)` of a one-element
     // array is ["0"] whatever the element discloses, so a key comparison is vacuous.
     const na = normaliseErrorData(a.error?.data, fabricated);