@openwop/openwop-conformance 2.39.2 → 2.39.4

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.39.4] — 2026-09-25 — RFC 0199 can be witnessed behind a public front, and the pinned-port claim is race-free
+
+- **`0199.credential-interrupt` can be witnessed on a host with a public front: `OPENWOP_HOST_PUBLIC_URL`.** RFC 0199 §C.2 requires `connectUrl` to be an https URL "on the host's own origin". The leg compared it to `--base-url`, but a certification cut drives the host over loopback, which can never be the https origin a user agent is sent to. So the v2 reference host, which implements all of §C, could never advertise `oauth.credentialInterrupt` in a cut, and RFC 0199's four credential rows never ran. New `src/lib/host-public-origin.ts` reads an operator-declared front for the host, validated like every other suite front (https, publicly resolvable). It counts as the host's own origin only once the discovery document fetched through it equals the one over `--base-url`; otherwise the leg records `blocked`, so a front pointing at another host can never let a `connectUrl` on that host's origin pass. Unset, behaviour is unchanged (`--base-url`'s origin, and no fetch). Self-test: 5 cases, including a front that serves a different host.
+- **The synthetic OIDC issuer binds a local port the operator names, not the port parsed from the URL the host trusts.** `v2-lane-exp-only-bound`, `v2-oidc-id-token-audience` and `auth-oidc-user-bearer` bound `127.0.0.1` at the port parsed from `OPENWOP_TEST_OIDC_ISSUER_URL`. For a remote host that URL is a public https front with no port, so the suite bound :80, and a non-root operator got `EACCES`. This was measured by openwop-app-ce on 2026-09-25 against a remote openwop-app instance. No remote host could execute the RFC 0200 / RFC 0210 issuer rows, so none could certify. New `issuerListenPort()` (`lib/oidc-issuer.ts`) reads `OPENWOP_TEST_OIDC_ISSUER_PORT` when set: the local port the front forwards to, the same split the webhook receiver has always had (`_URL` + `_PORT`). Unset, the old rule is unchanged. A malformed value is refused rather than silently falling back. The variable is added to `PINNED_PORT_ENVS`, so a multi-worker `--certify` that pins it is refused. Host-free legs in `oidc-issuer.test.ts` and `pinned-ports.test.ts` go red with the fix removed.
+- **The shared pinned-port listener's claim is taken before the first await.** In 2.39.3 a scoped receiver read the shared listener's promise and awaited it; if the last holder closed in that window it dropped the count to zero and shut the server, and the starting receiver then counted itself onto a closed listener — its deliveries could never arrive. The claim (a per-port entry's `refs`) is now incremented synchronously, and released if the bind fails. New self-test `a sibling that is STARTING while the last holder closes still gets a live listener` reproduces the race (ECONNREFUSED before the fix; sabotage-proven by moving the claim back after the await). Found in review of #1559; it was NOT the cause of the 2.39.3 public-cut failures — a pinned-port loopback A/B on 2.39.3 matched the ephemeral rehearsal exactly (376 / 7 / 4, no new non-pass), which points those at tunnel/load starvation.
+- **`--certify` refuses pinned fixture ports unless `--max-workers 1`.** Every fixture reached through an operator's public front listens on a pinned `*_PORT`, and the registry that routes a nonce-pathed request to its exercise lives in one vitest worker. With more than one worker, only one can own each port, and an exercise in another worker loses the host's traffic. `cut-bundle.sh` always passed `--max-workers 1`, but nothing enforced it: an openwop-app production cut run with 2 workers recorded `0173.webhook-durable-delivery` and `0187.bound-id-kinds.webhook-emitted` as timeouts for deliveries the host had made, and the same host passed both single-worker (measured by openwop-app-ce, 2026-09-25). The CLI now exits 2 before running (`src/lib/pinned-ports.ts`, with a self-test), naming the pinned variables it found, including the OAuth doubles' runtime-derived ports.
+- **`v2-webhook-durable-delivery` refuses only as many attempts as the host's advertised policy allows.** The receiver refused 2 attempts regardless, but `webhooks.retryPolicy.maxAttempts` is schema-valid from 1, so a host honestly advertising `maxAttempts: 2` never reached its 204 and failed a leg it conformed to. It now refuses `maxAttempts − 1`, capped at 2, with a minimum of 1. A host with no policy is measured as before, and `maxAttempts: 1` still refuses the first attempt, so a host that never retries still fails (webhooks.md §Durability: best-effort delivery is not a conforming mode).
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.39.4` because `2.39.3` is tagged and published. Not tagged, not published.
+
+## [2.39.3] — 2026-09-25 — a pinned receiver port is shared, and tenant B really is tenant B
+
+- **A pinned receiver port is shared, never re-bound — the public-cut hang behind three RFC 0214 legs.** On a public cut `OPENWOP_WEBHOOK_RECEIVER_PORT` is pinned (the port the front forwards to), and `lib/scoped-receiver.ts` had every receiver call `server.listen` on it. A second receiver alive at the same time — the §B redirect and §A after-Delete legs start two, and the §A/§C delivery receiver stays open until `afterAll` — hit `EADDRINUSE` with no `error` listener attached, so its `listen` promise never settled and the leg hung to vitest's timeout: `v2-a2a-push-delivery` §A-delete, §B-redirect and §D-fork on both the 2.39.0 and 2.39.2 public cuts of the v2 reference host. Loopback binds ephemeral ports, which is why no rehearsal showed it. All receivers on a pinned port now share one ref-counted listener (routing was already per nonce); a bind failure now rejects at once with a message naming the port; `close()` no longer waits on keep-alive sockets. Three lib self-tests pin it (two concurrent receivers; close one, the sibling keeps serving; a squatted port rejects in < 5 s) — reverting to per-receiver `listen` fails the first two in milliseconds.
+- **A scenario's second credential is the one that gets sent: `workspace-cross-tenant-isolation-blackbox` never authenticated as tenant B.** It passed `OPENWOP_TEST_TENANT_B_API_KEY` as an `Authorization` header without `authenticated: false`. `lib/driver.ts` then overwrote that header with the default `OPENWOP_API_KEY`, so every "tenant B" request was the owner reading its own file. That returns `200`, which the leg records as a cross-tenant leak. openwop-app measured it as a false `executed-fail` on its in-process lane (openwop-app#4107), while a direct HTTP repro with the same two keys answered `404`. The fix is in the driver: a caller-supplied `Authorization` header (any case) is now sent as given and is the only credential on the request. The scenario also passes `authenticated: false` explicitly. It records `blocked` before any assertion when the key is absent, equals `OPENWOP_API_KEY`, or is refused `401`. A sweep of every tenant-B reader found the rest correct: `auth-challenge-no-oracle`, `v2-sse-last-event-id-cursor`, `v2-mcp-mount-map`, `v2-a2a-agent-cards`, `v2-a2a-operation-map` and `v2-oauth-client-pkce-state-iss` (via `bearerInit`) pass `authenticated: false`, and `v2-artifact-a2a-shape` and `v2-mcp-tasks` use raw `fetch`. One scenario outside the tenant-B set had the same defect: `interrupt-auth-required-resume` sent its `OPENWOP_TEST_LOW_SCOPE_KEY` the same way. Its "low-scope" resolve was really a full-scope one, a false miss on the required `403`. That is fixed by the same driver change and made explicit in the scenario. New suite self-test `src/lib/driver-caller-credential.test.ts` stubs `fetch` and pins the rule. It is sabotage-proved: on the old driver its caller-header leg fails.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.39.3` because `2.39.2` is tagged and published, and RFC 0215's six gap rows change `spec/v1/gaps.json`, which `@openwop/spec-artifacts` ships. No scenario change.
+
 ## [2.39.2] — 2026-09-25 — RFC 0208's unreadable-task leg records its own row
 
 - **`0208.a2a-unreadable-not-found` records its own row.** In `v2-a2a-operation-map`, one `it()` cited both RFC 0208's `a2a-unreadable-not-found` and RFC 0211's `a2a-unreadable-not-found-details`. The per-`it` ledger keeps only the last id, so the 0208 row never reached a bundle: it is absent from the certified 2.38.0 v2-reference cut, and it is the one row keeping RFC 0208 from `Accepted` (the other 18 pass). This is the same class as openwop#1552. RFC 0211's detail comparison now has its own `it()` with its own setup, so each id records once. `scripts/check-req-only.mjs` already failed an `it()` citing two LITERAL ids, but it read helper-built ids (`R('x')`, `R11('x')`) as no id at all, which is how this one passed. It now counts each (helper, slug) as an id, fails against the 2.39.1 scenario, and finds no other case in 633 scenario files.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.2 @openwop/spec-artifacts@2.39.2
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.4 @openwop/spec-artifacts@2.39.4
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/cli.js

@@ -31,6 +31,7 @@
  *   1   one or more scenarios failed
  *   2   suite couldn't start (missing required args, etc)
  */
+import { pinnedPortWorkerConflict } from './lib/pinned-ports.js';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath, join } from 'node:path';
@@ -855,6 +856,13 @@ async function runCertify(args, baseUrl, apiKey) {
 }
 async function main() {
     const args = parseArgs(process.argv.slice(2));
+    // Refused before anything runs: a pinned-port certification that is not
+    // single-worker loses the host's traffic to a worker nobody reads (lib/pinned-ports.ts).
+    const pinnedConflict = pinnedPortWorkerConflict(process.env, args.maxWorkers, args.certify !== undefined);
+    if (pinnedConflict !== null) {
+        process.stderr.write(`openwop-conformance: ${pinnedConflict}\n`);
+        process.exit(2);
+    }
     if (args.help) {
         process.stdout.write(HELP_TEXT);
         process.exit(0);

package/dist/lib/pinned-ports.js

@@ -0,0 +1,44 @@
+/**
+ * A certification run with pinned fixture ports MUST be single-worker.
+ *
+ * Every suite fixture reached through an operator's public front listens on a
+ * pinned port (`*_PORT`), and the fixture registry that routes a nonce-pathed
+ * request to the exercise that minted it (`front-mux.ts`, `scoped-receiver.ts`)
+ * lives in ONE vitest worker's memory. With two workers only one can own each
+ * pinned port; an exercise in the other worker is unreachable, or its traffic is
+ * answered by a registry nobody reads. `cut-bundle.sh` has always passed
+ * `--max-workers 1`, and `effect-receiver.ts` assumes it — but nothing enforced
+ * it. Measured 2026-09-25: an openwop-app production cut run with
+ * `--max-workers 2` recorded `0173.webhook-durable-delivery` and
+ * `0187.bound-id-kinds.webhook-emitted` as test timeouts while the host had in
+ * fact delivered; the same host passed both single-worker. A certification that
+ * silently loses the host's traffic convicts the host, so the CLI refuses it.
+ */
+/** Every pinned-port variable a suite fixture honours. The OAuth doubles derive
+ *  theirs from `<FRONT>_URL` at runtime, so they are listed rather than grepped. */
+export const PINNED_PORT_ENVS = [
+    'OPENWOP_WEBHOOK_RECEIVER_PORT',
+    'OPENWOP_A2A_FAKE_PEER_PORT',
+    'OPENWOP_MCP_FAKE_SERVER_PORT',
+    'OPENWOP_OAUTH_AS_PORT',
+    'OPENWOP_OAUTH_AS2_PORT',
+    'OPENWOP_OAUTH_RESOURCE_PORT',
+    'OPENWOP_OTEL_COLLECTOR_PORT',
+    'OPENWOP_OTEL_COLLECTOR_GRPC_PORT',
+    // 2.39.4: the synthetic OIDC issuer's local bind port (`issuerListenPort`,
+    // oidc-issuer.ts). Two scenarios stand an issuer up on it.
+    'OPENWOP_TEST_OIDC_ISSUER_PORT',
+];
+/**
+ * The refusal message when a `--certify` run pins fixture ports without being
+ * single-worker, or `null` when the run is acceptable. `maxWorkers` undefined is
+ * vitest's default — one worker per CPU — so it is refused too.
+ */
+export function pinnedPortWorkerConflict(env, maxWorkers, certifying) {
+    if (!certifying)
+        return null;
+    const pinned = PINNED_PORT_ENVS.filter((k) => (env[k] ?? '').trim() !== '');
+    if (pinned.length === 0 || maxWorkers === 1)
+        return null;
+    return `--certify with pinned fixture ports (${pinned.join(', ')}) requires --max-workers 1 (got ${maxWorkers === undefined ? "vitest's default, one per CPU" : maxWorkers}): a pinned port is owned by one worker, so an exercise in another worker cannot receive the host's traffic and its rows would convict the host of a delivery it made`;
+}

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.2",
-  "stampSha256": "d3e9417fe0ae348a07cf66c1167cefe100d1dcd43e053c238b82195c77699e9f"
+  "version": "2.39.4",
+  "stampSha256": "7f6c8bfaa20466e744bdab3e23ab0b27653b6e74e115ca4dccdfd8a4ba4fa70a"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.39.2",
+  "version": "2.39.4",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.39.2"
+    "@openwop/spec-artifacts": "2.39.4"
   }
 }

package/requirements.json

@@ -5706,7 +5706,7 @@
     {
       "id": "openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields",
       "file": "auth-oidc-user-bearer.test.ts",
-      "line": 92,
+      "line": 93,
       "title": "host claiming OIDC profile advertises required fields",
       "explicitId": "openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields",
       "citations": [
@@ -28290,7 +28290,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.a-node-with-no-credential-suspends-on-a-credential-interrupt-with-a-closed-crede",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 108,
+      "line": 109,
       "title": "a node with no credential suspends on a credential interrupt with a closed CredentialData, status waiting-input",
       "explicitId": null,
       "citations": [
@@ -28327,7 +28327,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.a-caller-resolve-of-authorized-is-refused-while-no-credential-resolves-and-a-res",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 128,
+      "line": 135,
       "title": "a caller resolve of authorized is refused while no credential resolves, and a resume value cannot carry a credential",
       "explicitId": null,
       "citations": [
@@ -28358,7 +28358,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.connecturl-is-not-pre-authenticated-and-begins-the-grant-only-for-the-initiating",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 145,
+      "line": 152,
       "title": "connectUrl is not pre-authenticated and begins the grant only for the initiating Subject",
       "explicitId": null,
       "citations": [
@@ -28391,7 +28391,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.the-grant-completes-through-connecturl-the-host-resolves-the-interrupt-itself-an",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 168,
+      "line": 175,
       "title": "the grant completes through connectUrl, the host resolves the interrupt itself and the run continues",
       "explicitId": null,
       "citations": [
@@ -28423,7 +28423,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.declined-fails-the-node-with-connector-auth-declined",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 188,
+      "line": 195,
       "title": "declined fails the node with connector_auth_declined",
       "explicitId": null,
       "citations": [
@@ -28450,7 +28450,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.a-terminal-refresh-failure-emits-connector-auth-expired-then-suspends-with-reaso",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 203,
+      "line": 210,
       "title": "a terminal refresh failure emits connector.auth-expired, then suspends with reason expired",
       "explicitId": null,
       "citations": [
@@ -28487,7 +28487,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.without-oauth-credentialinterrupt-a-terminal-refresh-failure-fails-the-node-conn",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 231,
+      "line": 238,
       "title": "without oauth.credentialInterrupt, a terminal refresh failure fails the node connector_auth_expired and raises no interrupt",
       "explicitId": null,
       "citations": [
@@ -29585,7 +29585,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-inside-the-advertised-window-is-accepted-the-control-the-two-refusa",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 150,
+      "line": 149,
       "title": "a credential inside the advertised window is accepted — the control the two refusals rest on",
       "explicitId": "openwop.requirement.0210.exp-only-control-accepted",
       "citations": [
@@ -29599,7 +29599,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-whose-total-lifetime-exceeds-the-window-is-refused-401-and-so-is-on",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 165,
+      "line": 164,
       "title": "a credential whose TOTAL lifetime exceeds the window is refused 401, and so is one carrying no iat",
       "explicitId": "openwop.requirement.0210.exp-only-lifetime-bound",
       "citations": [
@@ -29618,7 +29618,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.the-over-lifetime-refusal-names-credential-lifetime-exceeded-not-a-generic-unaut",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 200,
+      "line": 199,
       "title": "the over-lifetime refusal names credential_lifetime_exceeded, not a generic unauthenticated",
       "explicitId": "openwop.requirement.0210.credential-lifetime-code",
       "citations": [
@@ -29632,7 +29632,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-whose-remaining-lifetime-exceeds-the-window-is-refused-though-its-t",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 218,
+      "line": 217,
       "title": "a credential whose REMAINING lifetime exceeds the window is refused, though its total lifetime does not",
       "explicitId": "openwop.requirement.0210.exp-only-remaining-bound",
       "citations": [
@@ -31179,7 +31179,7 @@
     {
       "id": "openwop.it.v2-oidc-id-token-audience.a-same-audience-id-token-is-admissible-and-one-minted-for-another-relying-party",
       "file": "v2-oidc-id-token-audience.test.ts",
-      "line": 75,
+      "line": 74,
       "title": "a same-audience ID token is admissible, and one minted for another relying party is audience_mismatch",
       "explicitId": "openwop.requirement.0200.id-token-aud",
       "citations": [
@@ -33188,7 +33188,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 238,
+      "line": 256,
       "title": "a failed attempt is retried and the event is delivered at least once",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery",
       "citations": [
@@ -33220,7 +33220,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 339,
+      "line": 358,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
@@ -33254,7 +33254,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 433,
+      "line": 452,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -33267,7 +33267,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 454,
+      "line": 473,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
@@ -35854,7 +35854,7 @@
     {
       "id": "openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent",
       "file": "workspace-cross-tenant-isolation-blackbox.test.ts",
-      "line": 46,
+      "line": 52,
       "title": "a file written by owner A is unreadable + un-enumerable by a second-tenant credential",
       "explicitId": "openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.2",
-  "corpusTag": "v2.39.2",
+  "version": "2.39.4",
+  "corpusTag": "v2.39.4",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "bac1af1953801e2e3e80cf3aa006b168611cb5b20ccb70c52674815437204e85",
-    "api/v2/asyncapi.yaml": "77f9311485f7220c28fb81937670ba415b9a3edc0adf73ad3c77e1e288247548",
-    "api/v2/openapi.yaml": "5bf2dd1dfd7762e0c108ffe51367933108d701d8dd8549aa6e21f1cbece7291b",
+    "api/seams-v2.yaml": "4d94700c79e047b6cc215e6fef77fb80d0ffaabf94c23d41b30d17061f4405f6",
+    "api/v2/asyncapi.yaml": "7189ece9f1c5170d53b81b83ddb173173df3c7ddaec650b3edc696896c1aa01a",
+    "api/v2/openapi.yaml": "873705c51c0fe43bc21e88c53b21d9e7689617c7a6e77135a967f642564e7266",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "4b144e92eae7afe2e541888d89c5461853f0cf1b929e9dca6a253fbe78d3e591",
+    "spec/v1/core-standard-manifest.json": "b221f615c14c340e2a17143a75f88256b7ac1f31cf7a3aeb237a277724ff445c",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "c20fe027514c8778b34c8fadde8bc7d1db5c4034638d76d297cc89a5bcae7ba2",
+    "spec/v1/gaps.json": "76b986a5d12be1c5dc9368bc79c6d8aa99a5e916b3cca3fc3eb6a84577f1f32a",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -292,9 +292,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "00fba2903eb7f34d8c98a7cd11fee02590f5390f3109e5bfdba85f9ceeeddf83",
+    "spec/v2/release.json": "8fc2cf9fee817def51a3fc494b3bb602fc80ab270cdc5c94f682851468a65503",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "314e72a7687918b11a89875d0b735ea4ec1589bd6ccb8abcf574d5e2fbba5333"
+    "spec/v2/surface-baseline.json": "68f4a5b6b121d58be3d8baf0d3a58fa7cb4b1c0067e989f036f8f0dd129b46b7"
   },
-  "corpusCommit": "57cc8d88f96abb980c605cc386167861b227ff97"
+  "corpusCommit": "dd6d1218b745d600af9095a0a7458ba6cdeab3d1"
 }

package/src/cli.ts

@@ -32,6 +32,7 @@
  *   2   suite couldn't start (missing required args, etc)
  */
 
+import { pinnedPortWorkerConflict } from './lib/pinned-ports.js';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath, join } from 'node:path';
@@ -907,6 +908,13 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
 
 async function main(): Promise<never> {
   const args = parseArgs(process.argv.slice(2));
+  // Refused before anything runs: a pinned-port certification that is not
+  // single-worker loses the host's traffic to a worker nobody reads (lib/pinned-ports.ts).
+  const pinnedConflict = pinnedPortWorkerConflict(process.env, args.maxWorkers, args.certify !== undefined);
+  if (pinnedConflict !== null) {
+    process.stderr.write(`openwop-conformance: ${pinnedConflict}\n`);
+    process.exit(2);
+  }
 
   if (args.help) {
     process.stdout.write(HELP_TEXT);

package/src/lib/driver.ts

@@ -22,6 +22,8 @@ export interface OpenWOPResponse {
 export interface OpenWOPRequestInit {
   readonly headers?: Record<string, string>;
   readonly body?: unknown;
+  /** `false` sends no default credential. A caller-supplied `Authorization`
+   *  header is always sent as given, whatever this says. */
   readonly authenticated?: boolean;
 }
 
@@ -54,7 +56,14 @@ class OpenWOPDriver {
     if (init.body !== undefined && headers['Content-Type'] === undefined) {
       headers['Content-Type'] = 'application/json';
     }
-    if (init.authenticated !== false) {
+    // A caller-supplied Authorization header (any case) is the credential the
+    // scenario chose — a second tenant's key, a low-scope key — and is sent as
+    // given. Until 2.39.3 the default key overwrote it unless the caller also
+    // passed `authenticated: false`, so "tenant B reads A's file" was really the
+    // owner reading its own file (200 → a false cross-tenant leak), and a
+    // low-scope resolve was really a full-scope one (a false 403 miss).
+    const callerAuth = Object.keys(headers).some((h) => h.toLowerCase() === 'authorization');
+    if (init.authenticated !== false && !callerAuth) {
       headers.Authorization = `Bearer ${env.apiKey}`;
     }
 

package/src/lib/host-public-origin.ts

@@ -0,0 +1,71 @@
+/**
+ * The origin a USER AGENT reaches the host under test on — for rows whose
+ * normative text is about the host's own origin rather than the suite's
+ * transport (RFC 0199 §C.2: `connectUrl` "MUST be an `https` URL on the host's
+ * own origin").
+ *
+ * Until 2.39.4 those rows compared against `--base-url`. A certification cut
+ * drives the host over loopback (`http://127.0.0.1:…`), which can never be the
+ * https origin a user agent is sent to — so a host with a public front could not
+ * pass, and the v2 reference host, which implements all of §C, advertised none of
+ * it (it needs an https public base to advertise `oauth.credentialInterrupt`).
+ *
+ * `OPENWOP_HOST_PUBLIC_URL` names that front, validated like every other suite
+ * front (`resolvePublicFront`: https, publicly resolvable). A declared front is
+ * EVIDENCE only once it is shown to serve THIS host: the discovery document
+ * fetched through it must equal the one fetched over `--base-url`. Otherwise the
+ * rows that depend on it record `blocked` with that cause — a front pointing at
+ * some other host must not let a `connectUrl` on that other origin pass.
+ *
+ * Unset, this returns `--base-url`'s origin exactly as before: no behaviour
+ * changes for a run that does not declare a front.
+ */
+import { resolvePublicFront } from './webhook-receiver.js';
+
+export const HOST_FRONT_ENV = 'OPENWOP_HOST_PUBLIC_URL';
+
+export type HostOrigin =
+  | { readonly ok: true; readonly origin: string; readonly declared: boolean }
+  | { readonly ok: false; readonly reason: string };
+
+type Fetcher = (url: string) => Promise<{ status: number; text: string }>;
+
+const defaultFetch: Fetcher = async (url) => {
+  const res = await fetch(url, { headers: { accept: 'application/json', 'OpenWOP-Version': '2.0' }, signal: AbortSignal.timeout(15_000) });
+  return { status: res.status, text: await res.text() };
+};
+
+/** Key-order-independent JSON equality — the two fetches may serialise differently. */
+function canonical(v: unknown): string {
+  if (Array.isArray(v)) return `[${v.map(canonical).join(',')}]`;
+  if (v !== null && typeof v === 'object') return `{${Object.keys(v as Record<string, unknown>).sort().map((k) => `${JSON.stringify(k)}:${canonical((v as Record<string, unknown>)[k])}`).join(',')}}`;
+  return JSON.stringify(v);
+}
+
+/**
+ * Resolve the host's own origin. `baseUrl` is the suite's `--base-url`; `fetcher`
+ * is injectable so the self-test can run without a host.
+ */
+export async function hostPublicOrigin(baseUrl: string, fetcher: Fetcher = defaultFetch): Promise<HostOrigin> {
+  const base = new URL(baseUrl);
+  const front = resolvePublicFront(HOST_FRONT_ENV, base.origin);
+  if (!front.tunnelled) return { ok: true, origin: base.origin, declared: false };
+  const frontOrigin = new URL(front.url).origin;
+  const path = '/.well-known/openwop';
+  let viaFront: { status: number; text: string };
+  let viaBase: { status: number; text: string };
+  try {
+    [viaFront, viaBase] = await Promise.all([fetcher(`${frontOrigin}${path}`), fetcher(`${base.origin}${path}`)]);
+  } catch (e) {
+    return { ok: false, reason: `${HOST_FRONT_ENV}=${frontOrigin} could not be fetched (${(e as Error).message}) — the declared front is not shown to serve the host under test` };
+  }
+  if (viaFront.status !== 200 || viaBase.status !== 200) {
+    return { ok: false, reason: `discovery answered ${viaFront.status} through ${HOST_FRONT_ENV}=${frontOrigin} and ${viaBase.status} over --base-url — the declared front is not shown to serve the host under test` };
+  }
+  let same = false;
+  try { same = canonical(JSON.parse(viaFront.text)) === canonical(JSON.parse(viaBase.text)); } catch { same = false; }
+  if (!same) {
+    return { ok: false, reason: `the discovery document through ${HOST_FRONT_ENV}=${frontOrigin} differs from the one over --base-url — the front does not serve the host under test, so an origin claim through it would witness some other host` };
+  }
+  return { ok: true, origin: frontOrigin, declared: true };
+}

package/src/lib/oidc-issuer.ts

@@ -152,6 +152,33 @@ function signCompact(
   return base64UrlEncode(signature);
 }
 
+/**
+ * The LOCAL port a scenario binds the synthetic issuer's JWKS/discovery
+ * listener on (2.39.4).
+ *
+ * `OPENWOP_TEST_OIDC_ISSUER_URL` is the URL the HOST is told to trust — for a
+ * remote host a public https front (a tunnel), which carries no port. Until
+ * 2.39.4 every scenario bound `127.0.0.1` at the port PARSED from that URL, so a
+ * tunnelled issuer (`https://x.trycloudflare.com`) bound :80 and a non-root
+ * operator got EACCES: measured by openwop-app-ce on 2026-09-25 against a remote
+ * openwop-app instance. No remote host could then execute the RFC 0200 / 0210
+ * issuer rows, and none could certify. The webhook receiver has always
+ * separated the two (`OPENWOP_WEBHOOK_RECEIVER_URL` + `_PORT`); this is the same
+ * split: `OPENWOP_TEST_OIDC_ISSUER_PORT`, when set, is the local port the
+ * operator's front forwards to. Unset, the old rule stands unchanged (the URL's
+ * port, else 80), so a loopback operator whose URL names its port is unaffected.
+ */
+export function issuerListenPort(issuerUrl: string): number {
+  const raw = process.env['OPENWOP_TEST_OIDC_ISSUER_PORT']?.trim();
+  if (raw !== undefined && raw !== '') {
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 1 || n > 65535) throw new Error(`OPENWOP_TEST_OIDC_ISSUER_PORT must be an integer port 1..65535 (got ${JSON.stringify(raw)})`);
+    return n;
+  }
+  const parsed = new URL(issuerUrl);
+  return parsed.port ? Number.parseInt(parsed.port, 10) : 80;
+}
+
 export function createSyntheticOIDCIssuer(
   opts: SyntheticOIDCIssuerOptions,
 ): SyntheticOIDCIssuer {

package/src/lib/pinned-ports.ts

@@ -0,0 +1,48 @@
+/**
+ * A certification run with pinned fixture ports MUST be single-worker.
+ *
+ * Every suite fixture reached through an operator's public front listens on a
+ * pinned port (`*_PORT`), and the fixture registry that routes a nonce-pathed
+ * request to the exercise that minted it (`front-mux.ts`, `scoped-receiver.ts`)
+ * lives in ONE vitest worker's memory. With two workers only one can own each
+ * pinned port; an exercise in the other worker is unreachable, or its traffic is
+ * answered by a registry nobody reads. `cut-bundle.sh` has always passed
+ * `--max-workers 1`, and `effect-receiver.ts` assumes it — but nothing enforced
+ * it. Measured 2026-09-25: an openwop-app production cut run with
+ * `--max-workers 2` recorded `0173.webhook-durable-delivery` and
+ * `0187.bound-id-kinds.webhook-emitted` as test timeouts while the host had in
+ * fact delivered; the same host passed both single-worker. A certification that
+ * silently loses the host's traffic convicts the host, so the CLI refuses it.
+ */
+
+/** Every pinned-port variable a suite fixture honours. The OAuth doubles derive
+ *  theirs from `<FRONT>_URL` at runtime, so they are listed rather than grepped. */
+export const PINNED_PORT_ENVS = [
+  'OPENWOP_WEBHOOK_RECEIVER_PORT',
+  'OPENWOP_A2A_FAKE_PEER_PORT',
+  'OPENWOP_MCP_FAKE_SERVER_PORT',
+  'OPENWOP_OAUTH_AS_PORT',
+  'OPENWOP_OAUTH_AS2_PORT',
+  'OPENWOP_OAUTH_RESOURCE_PORT',
+  'OPENWOP_OTEL_COLLECTOR_PORT',
+  'OPENWOP_OTEL_COLLECTOR_GRPC_PORT',
+  // 2.39.4: the synthetic OIDC issuer's local bind port (`issuerListenPort`,
+  // oidc-issuer.ts). Two scenarios stand an issuer up on it.
+  'OPENWOP_TEST_OIDC_ISSUER_PORT',
+] as const;
+
+/**
+ * The refusal message when a `--certify` run pins fixture ports without being
+ * single-worker, or `null` when the run is acceptable. `maxWorkers` undefined is
+ * vitest's default — one worker per CPU — so it is refused too.
+ */
+export function pinnedPortWorkerConflict(
+  env: Readonly<Record<string, string | undefined>>,
+  maxWorkers: number | undefined,
+  certifying: boolean,
+): string | null {
+  if (!certifying) return null;
+  const pinned = PINNED_PORT_ENVS.filter((k) => (env[k] ?? '').trim() !== '');
+  if (pinned.length === 0 || maxWorkers === 1) return null;
+  return `--certify with pinned fixture ports (${pinned.join(', ')}) requires --max-workers 1 (got ${maxWorkers === undefined ? "vitest's default, one per CPU" : maxWorkers}): a pinned port is owned by one worker, so an exercise in another worker cannot receive the host's traffic and its rows would convict the host of a delivery it made`;
+}

package/src/lib/scoped-receiver.ts

@@ -97,11 +97,76 @@ export interface ScopedReceiver {
  * with the nonce prefix stripped — exactly what it would see on a listener of
  * its own. It owns the response.
  */
+/**
+ * The listener behind every scoped receiver.
+ *
+ * On a public cut the operator PINS the receiver port (`OPENWOP_WEBHOOK_RECEIVER_PORT`,
+ * the one the front forwards to), so every receiver alive at once must share ONE
+ * server on it: routing is already per-nonce (`routeFronted`), so the listener
+ * only has to exist. Until 2.39.3 each receiver bound the pinned port itself; a
+ * second concurrent receiver hit EADDRINUSE with no `error` listener attached,
+ * its `listen` promise never settled, and the leg hung to vitest's timeout — the
+ * three `v2-a2a-push-delivery` legs lost on the 2.39.0 and 2.39.2 public cuts.
+ * Loopback runs bind ephemeral ports, which is why no rehearsal ever showed it.
+ *
+ * Unpinned, each receiver keeps a listener of its own (ephemeral port).
+ */
+interface Listener { server: Server; port: number; origin: string; members: Set<Member> }
+interface Member { nonce: string; foreign: number }
+/**
+ * A pinned port's shared listener and its claim count. The claim is taken
+ * SYNCHRONOUSLY, before the first await (2.39.4): a sibling that read the entry
+ * and was still awaiting the bind used to be invisible to a closing holder, which
+ * dropped the count to zero and shut the server under it.
+ */
+interface Shared { listening: Promise<Listener>; refs: number }
+const sharedByPort = new Map<string, Shared>();
+
+function handlerFor(members: Set<Member>) {
+  return (request: IncomingMessage, res: ServerResponse): void => {
+    // Counted BEFORE routing, per live receiver: `routeFronted` answers an
+    // unknown nonce itself and cannot report that it did, and a request that is
+    // not an exercise's own must still be visible in that exercise's failure detail.
+    const path = withoutFrontPath(WEBHOOK_FRONT_ENV, request.url ?? '/');
+    for (const m of members) if (!path.startsWith(`${FRONT_MUX_PREFIX}${m.nonce}`)) m.foreign += 1;
+    if (routeFronted(WEBHOOK_FRONT_ENV, request, res)) return;
+    // Not an `/fx/` path at all: a stranger, or a host that dropped the path it
+    // was given. Answered, never recorded — a receiver that counts what it was
+    // not addressed to is the defect this helper exists to remove.
+    request.resume();
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'this receiver serves one conformance exercise; address its nonce path' }));
+  };
+}
+
+async function listen(port: number, binding: { bind: string; advertise: string }): Promise<Listener> {
+  const members = new Set<Member>();
+  const server = createServer(handlerFor(members));
+  await new Promise<void>((resolve, reject) => {
+    const onError = (err: Error): void => {
+      reject(new Error(`scoped receiver could not bind ${binding.bind}:${port} — ${err.message}. A pinned OPENWOP_WEBHOOK_RECEIVER_PORT must be free for this process (another process holds it?)`));
+    };
+    server.once('error', onError);
+    server.listen(port, binding.bind, () => { server.off('error', onError); resolve(); });
+  });
+  const addr = server.address();
+  if (typeof addr !== 'object' || addr === null) throw new Error('receiver address unavailable');
+  return { server, port: addr.port, origin: `http://${binding.advertise}:${addr.port}`, members };
+}
+
+function shut(server: Server): Promise<void> {
+  return new Promise<void>((resolve) => {
+    // A keep-alive socket held open through a tunnel must not keep close() pending.
+    (server as Server & { closeIdleConnections?: () => void }).closeIdleConnections?.();
+    server.close(() => resolve());
+    (server as Server & { closeAllConnections?: () => void }).closeAllConnections?.();
+  });
+}
+
 export async function startScopedReceiver(
   respond: (hit: ScopedHit, res: ServerResponse) => void,
 ): Promise<ScopedReceiver> {
   const nonce = randomBytes(9).toString('hex');
-  let foreign = 0;
   const own = (request: IncomingMessage, res: ServerResponse): void => {
     const chunks: Buffer[] = [];
     request.on('data', (c: Buffer) => chunks.push(c));
@@ -117,41 +182,53 @@ export async function startScopedReceiver(
       );
     });
   };
-  registerBehindFront(WEBHOOK_FRONT_ENV, nonce, own);
-  const server = createServer((request: IncomingMessage, res: ServerResponse) => {
-    // Counted BEFORE routing: `routeFronted` answers an unknown nonce itself and
-    // cannot report that it did, and a request that is not this exercise's must
-    // still be visible in the failure detail.
-    if (!withoutFrontPath(WEBHOOK_FRONT_ENV, request.url ?? '/').startsWith(`${FRONT_MUX_PREFIX}${nonce}`)) foreign += 1;
-    if (routeFronted(WEBHOOK_FRONT_ENV, request, res)) return;
-    // Not an `/fx/` path at all: a stranger, or a host that dropped the path it
-    // was given. Answered, never recorded — a receiver that counts what it was
-    // not addressed to is the defect this helper exists to remove.
-    request.resume();
-    res.writeHead(404, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ error: 'this receiver serves one conformance exercise; address its nonce path' }));
-  });
   const pinned = Number(process.env['OPENWOP_WEBHOOK_RECEIVER_PORT'] ?? '');
-  const bindPort = Number.isInteger(pinned) && pinned > 0 && pinned < 65536 ? pinned : 0;
+  const isPinned = Number.isInteger(pinned) && pinned > 0 && pinned < 65536;
   const binding = receiverBinding();
-  await new Promise<void>((resolve) => server.listen(bindPort, binding.bind, () => resolve()));
-  const addr = server.address();
-  if (typeof addr !== 'object' || addr === null) throw new Error('receiver address unavailable');
-  const origin = `http://${binding.advertise}:${addr.port}`;
-  const front = resolvePublicFront(WEBHOOK_FRONT_ENV, origin);
+  let listener: Listener;
+  let shared: Shared | undefined;
+  let key: string | undefined;
+  if (isPinned) {
+    key = `${binding.bind}:${pinned}`;
+    shared = sharedByPort.get(key);
+    if (!shared) {
+      const listening = listen(pinned, binding);
+      shared = { listening, refs: 0 };
+      sharedByPort.set(key, shared);
+      const entry = shared;
+      listening.catch(() => { if (sharedByPort.get(key!) === entry) sharedByPort.delete(key!); });
+    }
+    shared.refs += 1; // claimed before any await — a closing sibling now sees this receiver
+    try { listener = await shared.listening; }
+    catch (err) { shared.refs -= 1; throw err; }
+  } else {
+    listener = await listen(0, binding);
+  }
+  const member: Member = { nonce, foreign: 0 };
+  listener.members.add(member);
+  registerBehindFront(WEBHOOK_FRONT_ENV, nonce, own);
+  const front = resolvePublicFront(WEBHOOK_FRONT_ENV, listener.origin);
+  let closed = false;
   return {
-    server,
+    server: listener.server,
     url: `${front.url.replace(/\/+$/, '')}${FRONT_MUX_PREFIX}${nonce}`,
     tunnelled: front.tunnelled,
-    localUrl: `${origin}${FRONT_MUX_PREFIX}${nonce}`,
+    localUrl: `${listener.origin}${FRONT_MUX_PREFIX}${nonce}`,
     nonce,
-    port: addr.port,
-    foreign: () => foreign,
-    close: () =>
-      new Promise<void>((resolve) => {
-        unregisterBehindFront(WEBHOOK_FRONT_ENV, nonce);
-        server.close(() => resolve());
-      }),
+    port: listener.port,
+    foreign: () => member.foreign,
+    close: async () => {
+      if (closed) return;
+      closed = true;
+      unregisterBehindFront(WEBHOOK_FRONT_ENV, nonce);
+      listener.members.delete(member);
+      if (shared !== undefined) {
+        shared.refs -= 1;
+        if (shared.refs > 0) return;
+        if (key !== undefined && sharedByPort.get(key) === shared) sharedByPort.delete(key);
+      }
+      await shut(listener.server);
+    },
   };
 }
 

package/src/scenarios/auth-oidc-user-bearer.test.ts

@@ -46,6 +46,7 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import {
   createSyntheticOIDCIssuer,
   type SyntheticOIDCIssuer,
+  issuerListenPort,
 } from '../lib/oidc-issuer.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
@@ -174,8 +175,7 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
 
     // Bind the harness's JWKS + discovery endpoints so the host can
     // fetch them when validating tokens.
-    const parsed = new URL(harnessUrl);
-    const port = parsed.port ? Number.parseInt(parsed.port, 10) : 80;
+    const port = issuerListenPort(harnessUrl);
 
     server = createServer((reqBody, res) => {
       if (!issuer) {

package/src/scenarios/interrupt-auth-required-resume.test.ts

@@ -76,7 +76,8 @@ describe.skipIf(SKIP)('interrupt: auth-required — insufficient scope returns 4
     const resolve = await driver.post(
       `/v1/runs/${encodeURIComponent(runId)}/interrupts/${encodeURIComponent(NODE_ID)}`,
       { resumeValue: { action: 'accept' } },
-      { headers: { Authorization: `Bearer ${lowScopeKey}` } },
+      // `authenticated: false`: the low-scope key alone, never the full-scope default.
+      { authenticated: false, headers: { Authorization: `Bearer ${lowScopeKey}` } },
     );
     expect(resolve.status, req('openwop.it.interrupt-auth-required-resume.bearer-without-approvals-respond-scope-is-rejected', 
       'auth.md §scopes + interrupt-profiles.md §openwop-interrupt-auth-required',

package/src/scenarios/v2-credential-interrupt.test.ts

@@ -27,6 +27,7 @@
 import { describe, it, expect, afterAll } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { loadEnv } from '../lib/env.js';
+import { hostPublicOrigin } from '../lib/host-public-origin.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
@@ -121,7 +122,13 @@ describe('RFC 0199 §C — v2-credential-interrupt (gated on oauth + provider sy
     expect([data['provider'], data['reason']], req(id, DOC, 'data names the provider and reason missing')).toEqual([PROVIDER, 'missing']);
     const connect = new URL(String(data['connectUrl']));
     expect(connect.protocol, req(id, DOC, 'connectUrl MUST be https')).toBe('https:');
-    expect(connect.origin, req(id, `${DOC} (connectUrl is host-owned)`, `connectUrl MUST be on the host's own origin (${new URL(loadEnv().baseUrl).origin})`)).toBe(new URL(loadEnv().baseUrl).origin);
+    // The host's own origin is where a USER AGENT reaches it: --base-url, or the
+    // operator-declared OPENWOP_HOST_PUBLIC_URL once shown to serve this host
+    // (lib/host-public-origin.ts, 2.39.4). A declared front that is not shown to
+    // serve it records `blocked`, never a pass on some other origin.
+    const own = await hostPublicOrigin(loadEnv().baseUrl);
+    if (!own.ok) return softSkip('blocked', own.reason);
+    expect(connect.origin, req(id, `${DOC} (connectUrl is host-owned)`, `connectUrl MUST be on the host's own origin (${own.origin}${own.declared ? ', declared via OPENWOP_HOST_PUBLIC_URL and verified to serve this host' : ''})`)).toBe(own.origin);
     await driver.post(`/runs/${encodeURIComponent(runId)}:cancel`, {}, auth(r.bearer));
   });
 

package/src/scenarios/v2-lane-exp-only-bound.test.ts

@@ -60,7 +60,7 @@ import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { v2Discovery, familyAdvertised } from '../lib/v2.js';
-import { createSyntheticOIDCIssuer, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { createSyntheticOIDCIssuer, issuerListenPort, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED =
   'the suite stands up the synthetic OIDC issuer and the host fetches its JWKS; no request returns to the suite\'s own API, so no host-reachable callback is needed';
@@ -120,7 +120,6 @@ async function gate(): Promise<Gate | { readonly kind: 'inapplicable' | 'blocked
   const audience = process.env['OPENWOP_TEST_OIDC_AUDIENCE']?.trim() ?? 'openwop-conformance';
   if (issuer === null) {
     const made = createSyntheticOIDCIssuer({ issuer: url, audience, algorithm: 'RS256' });
-    const parsed = new URL(url);
     const srv = createServer((r, res) => {
       if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.jwksJson); return; }
       if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.discoveryJson); return; }
@@ -128,7 +127,7 @@ async function gate(): Promise<Gate | { readonly kind: 'inapplicable' | 'blocked
     });
     await new Promise<void>((resolve, reject) => {
       srv.once('error', reject);
-      srv.listen(parsed.port ? Number.parseInt(parsed.port, 10) : 80, '127.0.0.1', () => resolve());
+      srv.listen(issuerListenPort(url), '127.0.0.1', () => resolve());
     });
     server = srv;
     issuer = made;

package/src/scenarios/v2-oidc-id-token-audience.test.ts

@@ -34,7 +34,7 @@ import { driver } from '../lib/driver.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { createSyntheticOIDCIssuer, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { createSyntheticOIDCIssuer, issuerListenPort, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
 import { prmGate } from '../lib/protected-resource.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED =
@@ -56,7 +56,6 @@ async function harness(audience: string): Promise<{ url: string; issuer: Synthet
   if (!url) return null;
   if (issuer !== null) return { url, issuer };
   const made = createSyntheticOIDCIssuer({ issuer: url, audience, algorithm: 'RS256' });
-  const parsed = new URL(url);
   const srv = createServer((r, res) => {
     if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.jwksJson); return; }
     if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.discoveryJson); return; }
@@ -64,7 +63,7 @@ async function harness(audience: string): Promise<{ url: string; issuer: Synthet
   });
   await new Promise<void>((resolve, reject) => {
     srv.once('error', reject);
-    srv.listen(parsed.port ? Number.parseInt(parsed.port, 10) : 80, '127.0.0.1', () => resolve());
+    srv.listen(issuerListenPort(url), '127.0.0.1', () => resolve());
   });
   server = srv;
   issuer = made;

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -208,6 +208,24 @@ function retryWaitMs(doc: Record<string, unknown>): number {
  */
 const FAIL_FIRST = 2;
 
+/**
+ * How many attempts THIS host's advertised policy leaves room to refuse
+ * (suite 2.39.4). The constant above assumed at least three attempts, but
+ * `webhooks.retryPolicy.maxAttempts` is schema-valid from 1, so a host that
+ * honestly advertised `maxAttempts: 2` was refused twice, never reached its
+ * 204, and failed a leg it conformed to. The receiver now refuses
+ * `maxAttempts − 1` attempts, at most FAIL_FIRST and at least 1. A host with no
+ * advertised policy is measured exactly as before (FAIL_FIRST), and
+ * `maxAttempts: 1` still refuses the first attempt, so a host that never
+ * retries still fails: webhooks.md §Durability says best-effort delivery is
+ * not a conforming mode.
+ */
+function failFirstFor(policy: { maxAttempts?: number } | null): number {
+  const m = policy?.maxAttempts;
+  if (typeof m !== 'number' || !Number.isInteger(m)) return FAIL_FIRST;
+  return Math.max(1, Math.min(FAIL_FIRST, m - 1));
+}
+
 const WAIT_SLACK_MS = 30_000;
 /** One `retryWaitMs` wait (the retry leg). */
 const RETRY_TEST_TIMEOUT_MS = RETRY_WAIT_CAP_MS + WAIT_SLACK_MS;
@@ -241,7 +259,8 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
     if (!fixtureAdvertised(doc, FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to deliver`);
 
-    const receiver = await startReceiver(FAIL_FIRST); // 500, 500, then 204
+    const failFirst = failFirstFor(advertisedRetryPolicy(doc));
+    const receiver = await startReceiver(failFirst); // 500 × failFirst, then 204
     active = receiver;
     const sub = await register(receiver);
     if (sub === null) return softSkip('blocked', 'registration refused (reason recorded above)');
@@ -287,8 +306,8 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     // inside our window this records `blocked`, NOT `executed-fail` — suite
     // 2.0.3, and this is the third time this file has had to learn it.
     //
-    // The receiver answers 204 only on attempt `FAIL_FIRST + 1`, so reaching it
-    // costs the SUM of the first FAIL_FIRST backoff intervals, not the largest
+    // The receiver answers 204 only on attempt `failFirst + 1`, so reaching it
+    // costs the SUM of the first failFirst backoff intervals, not the largest
     // one. On an exponential-from-30s policy that is 30 + 60 = 90 s, which is
     // exactly RETRY_WAIT_CAP_MS — a host loses by the width of one delivery.
     // The obvious fix is to derive the wait from the intervals, and it cannot
@@ -312,7 +331,7 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     // only in a changelog.
     if (!retried) {
       const policyNote = advertisedRetryPolicy(doc);
-      return softSkip('blocked', `the retry was observed (${attempts.length} attempts) but the receiver's 204 did not land inside the ${retryWaitMs(doc)}ms window: it answers 204 only on attempt ${FAIL_FIRST + 1}, which costs the SUM of the first ${FAIL_FIRST} backoff intervals, and webhooks.retryPolicy carries only { maxAttempts, backoff${policyNote ? `: ${String(policyNote.backoff)}` : ''} } — the base interval is not advertised, so the suite cannot derive how long to wait. Unmeasured, not unmet (RFC 0148 §A).`);
+      return softSkip('blocked', `the retry was observed (${attempts.length} attempts) but the receiver's 204 did not land inside the ${retryWaitMs(doc)}ms window: it answers 204 only on attempt ${failFirst + 1}, which costs the SUM of the first ${failFirst} backoff intervals, and webhooks.retryPolicy carries only { maxAttempts, backoff${policyNote ? `: ${String(policyNote.backoff)}` : ''} } — the base interval is not advertised, so the suite cannot derive how long to wait. Unmeasured, not unmet (RFC 0148 §A).`);
     }
     // Backoff: the retry MUST NOT be a tight loop — consecutive attempts for one
     // key are spaced. Only asserted when the host advertises a non-`none` backoff.

package/src/scenarios/workspace-cross-tenant-isolation-blackbox.test.ts

@@ -19,6 +19,8 @@
  * Gating: soft-skips unless `capabilities.workspace.supported` AND
  * `OPENWOP_TEST_TENANT_B_API_KEY` (a credential for a SECOND, distinct
  * tenant·workspace) is supplied — the suite cannot mint a second tenant itself.
+ * A key equal to OPENWOP_API_KEY, or one the host refuses 401, is `blocked`
+ * before any assertion: neither can measure a second-tenant read.
  *
  * @see RFCS/0059-agent-workspace.md §E WCT-1
  * @see SECURITY/invariants.yaml workspace-cross-tenant-isolation
@@ -27,6 +29,7 @@ import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { randomUUID } from 'node:crypto';
 import { driver } from '../lib/driver.js';
+import { loadEnv } from '../lib/env.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
 
@@ -40,7 +43,10 @@ async function workspaceSupported(): Promise<boolean> {
 }
 
 const tenantBKey = process.env.OPENWOP_TEST_TENANT_B_API_KEY;
-const asTenantB = { headers: { Authorization: `Bearer ${tenantBKey ?? ''}` } };
+// `authenticated: false` so the driver adds no default (owner-A) credential. Until
+// 2.39.3 it overwrote this header, so every "tenant B" request below was owner A
+// reading its own file — a false leak (200) on any host that set the key.
+const asTenantB = { authenticated: false, headers: { Authorization: `Bearer ${tenantBKey ?? ''}` } };
 
 describe('workspace-cross-tenant-isolation (black-box): a §C file MUST NOT leak across owners (RFC 0059 §E WCT-1)', () => {
   it('a file written by owner A is unreadable + un-enumerable by a second-tenant credential', async () => {
@@ -51,6 +57,13 @@ describe('workspace-cross-tenant-isolation (black-box): a §C file MUST NOT leak
       return softSkip('blocked', '[workspace-cross-tenant-isolation-blackbox] OPENWOP_TEST_TENANT_B_API_KEY not supplied; skipping the production-path cross-tenant assertion');
     }
 
+    if (tenantBKey.trim() === loadEnv().apiKey) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY equals OPENWOP_API_KEY — the second credential must resolve to a DIFFERENT tenant·workspace, or the leg measures nothing');
+
+    // Decided before any assertion: a tenant-B key the host refuses 401 is a
+    // harness precondition, not an isolation verdict either way.
+    const probeB = await driver.get('/v1/host/workspace/files', asTenantB);
+    if (probeB.status === 401) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY was refused 401 — it does not authenticate on this host, so no second-tenant read can be measured');
+
     const path = `wct-blackbox-${randomUUID()}.md`;
     const secret = `WCT1-BLACKBOX-SECRET-${randomUUID()}`;