@openwop/openwop-conformance 2.39.5 → 2.40.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.40.0] — 2026-09-26 — RFC 0215: one subscription's dead receiver cannot hold another's delivery, and unregistering stops the retries
+
+- **Two new scenarios, gated on `webhooks` (RFC 0215, `Active` 2026-09-25).** `v2-webhook-delivery-isolation` (`openwop.requirement.0215.no-head-of-line`) holds 8 subscriptions' attempts unanswered, then checks that a ninth subscription's attempt still starts. The 8 filter `run.started` and the ninth `run.completed` of a 2 s `conformance-delay` run, so contention exists before the healthy delivery falls due and the host's dispatch order cannot decide the row. It fails when the held attempts were still open at the due time and the healthy one waited for the host to release one. It records `partial-witness` when the host's own delivery timeout closed them first. `v2-webhook-unregister-stops-delivery` (`openwop.requirement.0215.unregister-stops-delivery`) answers `500` to two subscriptions on one run, unregisters one after its first attempt, and fails if that one is attempted more than 5 s after the `204`. It passes only when the other, the control, was retried after that point: a silence counts only when a retry demonstrably would have come. Sabotage on the v2 reference host: a sequential worker and a 5-slot pool each fail the first scenario, and an attempt that falls back to a cached subscription after the delete fails the second.
+- **Suite `2.40.0`**: 561 scenario files, a minor because two are added. `@openwop/spec-artifacts` moves in lockstep at the same exact pin, and ships the new `webhooks.md` §Durability text and the two invariant rows' threat-model home.
+
 ## [2.39.5] — 2026-09-26 — RFC 0213 §B has a deterministic witness, and a host front whose URLs follow the request origin verifies
 
 - **RFC 0213 §B has a deterministic witness: `0213.in-flight-refused-under-hold`.** On a host whose create answers in milliseconds the unaided `v2-idempotency-in-flight` leg records `partial-witness` — same-key creates never overlap. The new leg arms the seams-profile seam `armIdempotencyHold` (`POST /conformance/seams/sample/test/idempotency/hold`, host-sample-test-seams.md §26), which holds the caller's next real create's claim in flight; a concurrent same-key create MUST then be refused `409 idempotency_in_flight` by the host's own path (no retry timing in `details`), and the held create still wins. Seams not advertised ⇒ `inapplicable`; advertised but the path unserved ⇒ `blocked`.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.5 @openwop/spec-artifacts@2.39.5
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.40.0 @openwop/spec-artifacts@2.40.0
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 559 scenario files under `src/scenarios/`.
+The current suite has 561 scenario files under `src/scenarios/`.
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
@@ -481,7 +481,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 559 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 561 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.5",
-  "stampSha256": "db86d304e8d1c9042e51cc62a10c3d952826f9f3d8eddbcee08c29128c4e4252"
+  "version": "2.40.0",
+  "stampSha256": "f65c56d3a36eb7301c4baceef9ce0899091151fb12bc72c1508eb7a7d7b4ca4c"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.39.5",
+  "version": "2.40.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.39.5"
+    "@openwop/spec-artifacts": "2.40.0"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 633,
-    "tests": 2425,
-    "withStableId": 2425,
+    "files": 635,
+    "tests": 2427,
+    "withStableId": 2427,
     "interpolatedTitles": 0,
-    "explicitIds": 2305
+    "explicitIds": 2307
   },
   "records": [
     {
@@ -33150,6 +33150,47 @@
         }
       ]
     },
+    {
+      "id": "openwop.requirement.0215.no-head-of-line",
+      "file": "v2-webhook-delivery-isolation.test.ts",
+      "line": 109,
+      "title": null,
+      "explicitId": "openwop.requirement.0215.no-head-of-line",
+      "citations": [
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "POST /webhooks MUST answer 201 { webhookId }"
+        },
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "the 201 body MUST carry `webhookId`"
+        },
+        {
+          "section": "runs.md §Create",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
+          "requirement": "the held subscriptions' attempts MUST have been dispatched"
+        },
+        {
+          "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-2-subscriber-receives-the-v2-rendering-the-delivery-validates-and-run-st",
       "file": "v2-webhook-delivery-shape.test.ts",
@@ -33640,6 +33681,37 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-webhook-unregister-stops-delivery.no-attempt-for-an-unregistered-subscription-starts-after-the-204-while-its-contr",
+      "file": "v2-webhook-unregister-stops-delivery.test.ts",
+      "line": 83,
+      "title": "no attempt for an unregistered subscription starts after the 204, while its control keeps being retried",
+      "explicitId": "openwop.requirement.0215.unregister-stops-delivery",
+      "citations": [
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "POST /webhooks MUST answer 201 { webhookId }"
+        },
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "the 201 body MUST carry `webhookId`"
+        },
+        {
+          "section": "runs.md §Create",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "DELETE /webhooks/{webhookId} MUST answer 204 for the caller's own subscription"
+        },
+        {
+          "section": "webhooks.md §Durability (RFC 0215 §B)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-well-known-one-resource.a-header-less-get-and-an-openwop-version-2-0-get-are-two-representations-of-one",
       "file": "v2-well-known-one-resource.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 559,
+    "files": 561,
     "v1": 449,
-    "v2": 119
+    "v2": 121
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1557,6 +1557,9 @@
     "v2-version-header-honored.test.ts": [
       2
     ],
+    "v2-webhook-delivery-isolation.test.ts": [
+      2
+    ],
     "v2-webhook-delivery-shape.test.ts": [
       2
     ],
@@ -1578,6 +1581,9 @@
     "v2-webhook-standard-webhooks-delivery.test.ts": [
       2
     ],
+    "v2-webhook-unregister-stops-delivery.test.ts": [
+      2
+    ],
     "v2-well-known-one-resource.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.5",
-  "corpusTag": "v2.39.5",
+  "version": "2.40.0",
+  "corpusTag": "v2.40.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "ed925b14e1e3e6f82ec0d0c844c035ae1a3b0dbcf10b3e53b96106327298f5cb",
-    "api/v2/asyncapi.yaml": "a3ba4c688bd4ee33400ef23718eac3d03bc333df2b3d74644adc6f0b2b3a5b2e",
-    "api/v2/openapi.yaml": "e4dd5dafff70be8c64de8344c3ae5dd5525515a069fef6f421a226813a305344",
+    "api/seams-v2.yaml": "acd23b627e68bee6c886f21f4b8252f0dcb49d9deb5d4abc4c19d390f56b426a",
+    "api/v2/asyncapi.yaml": "de935d89b72a1196c0f8f9731f1c3d32cee118e81b4271365e76ffdc5c9fced6",
+    "api/v2/openapi.yaml": "0d12490c1739defdb302ec384d9dd81306d1d865c7023fda040baa846ff35c8b",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "a2f4f866565b5da642b36384a235bf57a293366b7f9faeb0e7f62c3132337932",
+    "spec/v1/core-standard-manifest.json": "ca5a83168c0e6a4d73d22d32acdd4ca37bfc62297ad730df6698134caa99ebbb",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "9424f94441ba5c4d1a8027e1f59be832f46af1a67ff0ca140adca9bb501ee993",
+    "spec/v1/gaps.json": "468d5b60f5e8b276f895833ac072c3984ab104d0ad97c4d31b757290c6077172",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -240,7 +240,7 @@
     "spec/v2/core/security-defaults.md": "500471a8db7af9b776ac40b4a9a278c9f3d45e1c1dead880114e7fadc7bee37d",
     "spec/v2/core/tool-catalog.md": "35f1a3fd509db0fc0490ddf400686fe94dc4b20c98064d5ebe776da516153e60",
     "spec/v2/core/versioning.md": "0aded71d090c8358c3ce17763c120cfc1cc42531a5eaa1b8a2a7016ed9594069",
-    "spec/v2/core/webhooks.md": "9c9169d775875f72982ed3506c1bfe27546ad05806d114af103dd7c28d4d5122",
+    "spec/v2/core/webhooks.md": "95880896e37e5b7096693a75203cf0ed70cefa09959230e17b45aa9193078eff",
     "spec/v2/core/workflow-chain-packs.md": "ee45d3fede3bb6f0cc6abcf0d6c929c7cd213a0fbe862b738a998f929c4d1102",
     "spec/v2/corrections.json": "cc74ffde74384b0f261a4f625871d922e8661d654d647a8534e21036595cb280",
     "spec/v2/corrections.schema.json": "4ac595b9a6d7f66d53de03fe0edbe0dc58de46426932387bfdc0ceb3cf949a3e",
@@ -292,9 +292,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "c3d35fbfae242c3fa3a504edb08fbdbc7ee9dd003250ea7225a0f6641dc614b9",
+    "spec/v2/release.json": "f17a7e0066d7851adfb246c586f12199d14fee60bf7a0eda203a124116dcff9e",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "4273f2b75cfde4c620c995b5a4c334cfc15d936dfa7f5b6fa0aa4bf257e8b8b5"
+    "spec/v2/surface-baseline.json": "2ba53481583261c59008da86d1db82ed9f657675dfe2f8b019ec7d82f5bdb4b4"
   },
-  "corpusCommit": "718fae2de800b73f48a59237cfb843578b0433f1"
+  "corpusCommit": "44b89e1e50f56dd2a0834771225b8e04d2bd9e6f"
 }

package/src/scenarios/v2-webhook-delivery-isolation.test.ts

@@ -0,0 +1,200 @@
+/**
+ * RFC 0215 §A — `webhook-delivery-isolation` (suite 2.40.0, target major 2; gated on `webhooks`).
+ *
+ * `spec/v2/core/webhooks.md` §Durability: a host MUST NOT make the start of an
+ * attempt to one subscription wait for an attempt to a DIFFERENT subscription to
+ * finish, and MUST sustain that while at least 8 subscriptions have attempts
+ * outstanding that their receivers have not answered (§A.1 + §A.2, one
+ * observation at the floor, so one requirement id).
+ *
+ * The shape (architect review, 2026-09-25): contention first, then the healthy
+ * delivery falls due — so the dispatch order the host chooses cannot decide the
+ * row. The RFC's first draft registered 9 subscriptions on one event and read a
+ * healthy attempt that beat the held ones as `partial-witness`; this file
+ * removes that case instead of recording it.
+ *
+ *   - 8 HELD subscriptions filter `run.started`. Their receiver accepts each
+ *     attempt and never answers, until the leg ends.
+ *   - 1 HEALTHY subscription filters `run.completed`, and answers 204.
+ *   - One `conformance-delay` run of `DELAY_MS`. `run.started` makes the held
+ *     attempts due at t0; `run.completed` makes the healthy one due at
+ *     t0 + DELAY_MS, by which time 8 attempts are outstanding.
+ *
+ * Verdicts, each on a positive observation:
+ *   - pass — the healthy attempt ARRIVED while all 8 held attempts were open.
+ *   - fail — the healthy attempt arrived only once fewer than 8 were open (the
+ *     host released one to make room), or never within the window, AND the held
+ *     attempts had stayed open until the run was terminal: the contention the
+ *     floor names existed when the healthy delivery fell due, and it waited.
+ *   - partial-witness — the host's own delivery timeout closed held attempts
+ *     before the run was terminal. Contention was not sustained when the
+ *     healthy delivery fell due, so this run of the leg cannot judge §A. The
+ *     timeout is the host's to choose; a host with a timeout shorter than
+ *     DELAY_MS is simply not measured by this instrument.
+ *   - blocked — fewer than 8 held attempts ever arrived AND the healthy one
+ *     never did either: nothing reached the suite, which says nothing about
+ *     isolation (`noDeliveryCause`).
+ *
+ * A bounded pool of k < 9 opens k held attempts, queues the rest and the
+ * healthy one, and releases a slot only at its timeout — so it FAILS: its held
+ * attempts were open when the run completed, and the healthy attempt waited for
+ * one to close. That is the openwop-app WHD-1 defect (RFC 0215 §Motivation 1).
+ *
+ * @see spec/v2/core/webhooks.md §Durability
+ * @see RFCS/0215-webhook-delivery-isolation.md §A
+ * @see SECURITY/invariants.yaml `webhook-delivery-isolation`
+ */
+
+import { afterEach, describe, it, expect } from 'vitest';
+import type { ServerResponse } from 'node:http';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { absenceIsUnmeasured, noDeliveryCause, startScopedReceiver, type ScopedReceiver } from '../lib/scoped-receiver.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { RETRY_WAIT_FLOOR_MS } from '../lib/webhook-retry-window.js';
+
+const ID = 'openwop.requirement.0215.no-head-of-line';
+const DOC = 'webhooks.md §Durability (RFC 0215 §A.1, §A.2)';
+const FIXTURE = 'conformance-delay';
+/** §A.2's floor. Changing it is a spec change, not a tuning knob. */
+const FLOOR = 8;
+/**
+ * How long after `run.started` the healthy delivery falls due. Short, so a host
+ * whose delivery timeout is a few seconds still holds its 8 attempts open when
+ * it does; long enough that the held attempts are dispatched first on any host
+ * that dispatches at all.
+ */
+const DELAY_MS = 2_000;
+/** How long the leg waits for the healthy attempt once the run is terminal. */
+const WINDOW_MS = RETRY_WAIT_FLOOR_MS;
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+interface Held { readonly webhookId: string; readonly res: ServerResponse; readonly openedAt: number; closedAt: number | null }
+
+let receiver: ScopedReceiver | null = null;
+const registered: string[] = [];
+let release: (() => void) | null = null;
+afterEach(async () => {
+  release?.();
+  release = null;
+  // RFC 0215 §B is what makes this cleanup work on a conforming host; on any
+  // host it stops this file's subscriptions outliving the exercise.
+  for (const id of registered.splice(0)) await driver.delete(`/webhooks/${encodeURIComponent(id)}`).catch(() => undefined);
+  if (receiver) { const rx = receiver; receiver = null; await rx.close(); }
+});
+
+async function waitTerminal(runId: string, timeoutMs: number): Promise<number | null> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const res = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+    const status = res.status === 200 ? String((res.json as { status?: unknown } | null)?.status ?? '') : '';
+    if (TERMINAL.has(status)) return Date.now();
+    if (Date.now() > deadline) return null;
+    await new Promise((r) => setTimeout(r, 100));
+  }
+}
+
+async function waitFor(pred: () => boolean, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (pred()) return true;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  return pred();
+}
+
+describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s delivery (gated on webhooks)', () => {
+  it(`a healthy subscription's attempt starts while ${FLOOR} other subscriptions' attempts are unanswered`, async () => {
+    let doc: Record<string, unknown> | null = null;
+    try { doc = await v2Discovery(); } catch { /* recorded below */ }
+    if (doc === null) return softSkip('blocked', 'discovery unreachable');
+    if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
+    if (!(Array.isArray(doc['fixtures']) && (doc['fixtures'] as unknown[]).includes(FIXTURE))) {
+      return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run whose completion falls due after its start`);
+    }
+
+    const held = new Map<string, Held>();
+    let healthyId: string | null = null;
+    let healthyAt: number | null = null;
+    let openAtHealthy = -1;
+    const openCount = (): number => [...held.values()].filter((h) => h.closedAt === null).length;
+
+    const rx = await startScopedReceiver((hit, res) => {
+      const webhookId = String(hit.headers['openwop-webhook-id'] ?? hit.headers['x-openwop-webhook-id'] ?? '');
+      if (webhookId !== '' && webhookId === healthyId) {
+        if (healthyAt === null) { healthyAt = Date.now(); openAtHealthy = openCount(); }
+        res.writeHead(204); res.end();
+        return;
+      }
+      if (webhookId === '' || held.has(webhookId) || !registered.includes(webhookId)) {
+        // A retry of a held attempt, or a stranger: answered, not counted as a new held attempt.
+        res.writeHead(204); res.end();
+        return;
+      }
+      const h: Held = { webhookId, res, openedAt: Date.now(), closedAt: null };
+      held.set(webhookId, h);
+      // The HOST closing the socket before we answer is the host abandoning the attempt.
+      res.on('close', () => { if (h.closedAt === null) h.closedAt = Date.now(); });
+    });
+    receiver = rx;
+    release = () => {
+      for (const h of held.values()) {
+        if (h.closedAt !== null) continue;
+        h.closedAt = Date.now();
+        try { h.res.writeHead(204); h.res.end(); } catch { /* host already gone */ }
+      }
+    };
+
+    const register = async (events: string[]): Promise<string | null> => {
+      const reg = await driver.post('/webhooks', { url: rx.url, events });
+      if (reg.status === 400 && readErrorCode(reg.json) === 'webhook_url_rejected' && !rx.tunnelled) return null;
+      expect(reg.status, req(ID, 'webhooks.md §Surfaces', 'POST /webhooks MUST answer 201 { webhookId }')).toBe(201);
+      const id = (reg.json as { webhookId?: unknown } | null)?.webhookId;
+      expect(typeof id, req(ID, 'webhooks.md §Surfaces', 'the 201 body MUST carry `webhookId`')).toBe('string');
+      registered.push(id as string);
+      return id as string;
+    };
+    for (let i = 0; i < FLOOR; i += 1) {
+      if ((await register(['run.started'])) === null) {
+        return blockedDespiteAssertions('host SSRF guard rejected the loopback receiver (webhooks.md §Egress requires it); set OPENWOP_WEBHOOK_RECEIVER_URL to a public https tunnel in front of the suite receiver');
+      }
+    }
+    healthyId = await register(['run.completed']);
+    if (healthyId === null) return blockedDespiteAssertions('host SSRF guard rejected the loopback receiver');
+
+    const create = await driver.post('/runs', { workflowId: FIXTURE, inputs: { delayMs: DELAY_MS } });
+    expect(create.status, req(ID, 'runs.md §Create', `POST /runs MUST answer 201 for ${FIXTURE}`)).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+    const terminalAt = await waitTerminal(runId, DELAY_MS + 30_000);
+    if (terminalAt === null) return blockedDespiteAssertions(`${FIXTURE} run ${runId} did not reach a terminal status — the healthy delivery never fell due`);
+    const openAtTerminal = openCount();
+    const everOpened = held.size;
+    await waitFor(() => healthyAt !== null, WINDOW_MS);
+    const earliestClose = Math.min(...[...held.values()].map((h) => h.closedAt ?? Infinity));
+    const detail = `${everOpened} held attempt(s) arrived; ${openAtTerminal} were still open when the run was seen terminal; `
+      + (healthyAt === null ? `the healthy attempt did not arrive within ${WINDOW_MS}ms of that` : `the healthy attempt arrived ${healthyAt - terminalAt}ms after it, with ${openAtHealthy} held open`);
+
+    if (healthyAt === null && everOpened === 0) {
+      if (absenceIsUnmeasured(rx)) return blockedDespiteAssertions(noDeliveryCause(rx, 'webhook attempt'));
+      return blockedDespiteAssertions(`no attempt for any of the ${FLOOR + 1} subscriptions arrived — ${noDeliveryCause(rx, 'webhook attempt')}`);
+    }
+    if (healthyAt !== null && openAtHealthy >= FLOOR) {
+      expect(openAtHealthy, req(ID, DOC, `an attempt to one subscription MUST NOT wait for attempts to other subscriptions — ${detail}`)).toBeGreaterThanOrEqual(FLOOR);
+    } else if (openAtTerminal >= FLOOR) {
+      // The healthy attempt waited (or never came), and the contention §A.2
+      // names was present when it fell due.
+      expect.fail(req(ID, DOC, `with ${FLOOR} subscriptions' attempts unanswered, a further subscription's attempt MUST still start; it waited for the host to release one — ${detail}`));
+    } else if (everOpened >= FLOOR || earliestClose < terminalAt) {
+      // Contention was not sustained to the due time. Either the host's own
+      // delivery timeout released the held attempts early (its choice), or it
+      // never opened FLOOR of them at once. The second is the defect, the first
+      // is not, and they differ in WHEN the first held attempt closed.
+      expect(everOpened, req(ID, DOC, 'the held subscriptions\' attempts MUST have been dispatched')).toBeGreaterThan(0);
+      return softSkip('skipped', `partial-witness: the host closed held attempts ${Number.isFinite(earliestClose) ? `${terminalAt - earliestClose}ms ` : ''}before the run was terminal (its delivery timeout is shorter than this leg's ${DELAY_MS}ms delay), so ${FLOOR} attempts were not outstanding when the healthy delivery fell due — ${detail}`);
+    } else {
+      expect.fail(req(ID, DOC, `the host never had ${FLOOR} subscriptions' attempts outstanding at once, and the healthy attempt waited — a bounded dispatcher below the floor — ${detail}`));
+    }
+  }, DELAY_MS + 30_000 + RETRY_WAIT_FLOOR_MS + 30_000);
+});

package/src/scenarios/v2-webhook-unregister-stops-delivery.test.ts

@@ -0,0 +1,176 @@
+/**
+ * RFC 0215 §B — `webhook-unregister-stops-delivery` (suite 2.40.0, target major 2; gated on `webhooks`).
+ *
+ * `spec/v2/core/webhooks.md` §Durability: after `unregisterWebhook` answers
+ * `204`, a host MUST NOT start any further attempt for that subscription,
+ * including attempts already scheduled for retry. An attempt the host had begun
+ * sending before the `204` MAY complete.
+ *
+ * Absence is not evidence on its own (architect review, 2026-09-25). "No retry
+ * arrived after the 204" proves nothing about a host whose next retry falls
+ * outside the window, and `webhooks.retryPolicy` carries no interval, so the
+ * suite cannot compute when that is. The leg therefore runs a CONTROL:
+ *
+ *   - two subscriptions on one receiver, both filtering `run.completed`, both
+ *     answered `500` on every attempt, so both have a retry scheduled;
+ *   - the TARGET is unregistered the moment its first attempt has been
+ *     answered; the CONTROL is left alone;
+ *   - the control's retries are what the target's would have been — same
+ *     event, same moment, same policy.
+ *
+ * Verdicts:
+ *   - pass — the control was retried after `204 + GRACE_MS` and the target
+ *     was not: a retry that would have come did not.
+ *   - fail — an attempt for the target arrived after `204 + GRACE_MS`.
+ *   - partial-witness — neither had an attempt after `204 + GRACE_MS` within
+ *     the window: the schedule finished inside the grace, or runs past the
+ *     window. Nothing was contradicted and nothing was shown.
+ *   - inapplicable — `retryPolicy.maxAttempts: 1`: there is no retry to stop.
+ *
+ * GRACE_MS is an instrument setting, not a spec number: webhooks.md states the
+ * in-flight allowance as "an attempt the host had begun sending", and the
+ * receiver keys on ARRIVAL, so the grace only has to cover transit of a request
+ * already on the wire (RFC 0215 Unresolved question 3).
+ *
+ * @see spec/v2/core/webhooks.md §Durability
+ * @see RFCS/0215-webhook-delivery-isolation.md §B
+ * @see SECURITY/invariants.yaml `webhook-unregister-stops-delivery`
+ */
+
+import { afterEach, describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { absenceIsUnmeasured, noDeliveryCause, startScopedReceiver, type ScopedReceiver } from '../lib/scoped-receiver.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { retryWaitCapMs, retryWaitFor } from '../lib/webhook-retry-window.js';
+
+const ID = 'openwop.requirement.0215.unregister-stops-delivery';
+const DOC = 'webhooks.md §Durability (RFC 0215 §B)';
+const FIXTURE = 'conformance-noop';
+const GRACE_MS = 5_000;
+/** Once the control has been retried past the grace, how long to keep listening for the target's matching retry. */
+const SETTLE_MS = 5_000;
+const CAP_MS = retryWaitCapMs();
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+let receiver: ScopedReceiver | null = null;
+const registered: string[] = [];
+afterEach(async () => {
+  for (const id of registered.splice(0)) await driver.delete(`/webhooks/${encodeURIComponent(id)}`).catch(() => undefined);
+  if (receiver) { const rx = receiver; receiver = null; await rx.close(); }
+});
+
+function advertisedRetryPolicy(doc: Record<string, unknown>): { maxAttempts?: number; backoff?: string } | null {
+  const read = (holder: unknown): { maxAttempts?: number; backoff?: string } | null => {
+    const rp = holder && typeof holder === 'object' ? (holder as { retryPolicy?: unknown }).retryPolicy : undefined;
+    return rp && typeof rp === 'object' ? (rp as { maxAttempts?: number; backoff?: string }) : null;
+  };
+  return read(doc['webhooks']) ?? read(doc['triggerBridge']);
+}
+
+async function waitFor(pred: () => boolean, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (pred()) return true;
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  return pred();
+}
+
+describe('RFC 0215 §B — unregistering stops the attempts (gated on webhooks)', () => {
+  it('no attempt for an unregistered subscription starts after the 204, while its control keeps being retried', async () => {
+    let doc: Record<string, unknown> | null = null;
+    try { doc = await v2Discovery(); } catch { /* recorded below */ }
+    if (doc === null) return softSkip('blocked', 'discovery unreachable');
+    if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
+    if (!(Array.isArray(doc['fixtures']) && (doc['fixtures'] as unknown[]).includes(FIXTURE))) {
+      return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to deliver`);
+    }
+    const policy = advertisedRetryPolicy(doc);
+    if (policy?.maxAttempts === 1) return softSkip('inapplicable', 'webhooks.retryPolicy.maxAttempts is 1 — the host schedules no retry, so there is none for unregistering to stop');
+    const windowMs = retryWaitFor(policy, CAP_MS);
+
+    const arrivals = new Map<string, number[]>();
+    let targetId: string | null = null;
+    let unregisteredAt: number | null = null;
+    let unregisterStatus = 0;
+    let unregistering: Promise<void> | null = null;
+
+    const rx = await startScopedReceiver((hit, res) => {
+      const webhookId = String(hit.headers['openwop-webhook-id'] ?? hit.headers['x-openwop-webhook-id'] ?? '');
+      const list = arrivals.get(webhookId) ?? [];
+      list.push(Date.now());
+      arrivals.set(webhookId, list);
+      res.writeHead(500);
+      res.end();
+      // Unregister the target once its first attempt has been ANSWERED, so the
+      // host has a retry scheduled and nothing of its own in flight.
+      if (webhookId === targetId && unregistering === null) {
+        unregistering = (async () => {
+          const del = await driver.delete(`/webhooks/${encodeURIComponent(webhookId)}`);
+          unregisterStatus = del.status;
+          if (del.status === 204) {
+            unregisteredAt = Date.now();
+            const i = registered.indexOf(webhookId);
+            if (i >= 0) registered.splice(i, 1);
+          }
+        })();
+      }
+    });
+    receiver = rx;
+
+    const register = async (): Promise<string | null> => {
+      const reg = await driver.post('/webhooks', { url: rx.url, events: ['run.completed'] });
+      if (reg.status === 400 && readErrorCode(reg.json) === 'webhook_url_rejected' && !rx.tunnelled) return null;
+      expect(reg.status, req(ID, 'webhooks.md §Surfaces', 'POST /webhooks MUST answer 201 { webhookId }')).toBe(201);
+      const id = (reg.json as { webhookId?: unknown } | null)?.webhookId;
+      expect(typeof id, req(ID, 'webhooks.md §Surfaces', 'the 201 body MUST carry `webhookId`')).toBe('string');
+      registered.push(id as string);
+      return id as string;
+    };
+    const controlId = await register();
+    targetId = await register();
+    if (controlId === null || targetId === null) {
+      return blockedDespiteAssertions('host SSRF guard rejected the loopback receiver (webhooks.md §Egress requires it); set OPENWOP_WEBHOOK_RECEIVER_URL to a public https tunnel in front of the suite receiver');
+    }
+    const target = targetId;
+
+    const create = await driver.post('/runs', { workflowId: FIXTURE });
+    expect(create.status, req(ID, 'runs.md §Create', `POST /runs MUST answer 201 for ${FIXTURE}`)).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+    const deadline = Date.now() + 30_000;
+    for (;;) {
+      const r = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+      if (r.status === 200 && TERMINAL.has(String((r.json as { status?: unknown } | null)?.status ?? ''))) break;
+      if (Date.now() > deadline) return blockedDespiteAssertions(`${FIXTURE} run ${runId} did not reach a terminal status — no run.completed to deliver`);
+      await new Promise((r2) => setTimeout(r2, 250));
+    }
+
+    const firstTarget = await waitFor(() => (arrivals.get(target)?.length ?? 0) > 0, windowMs);
+    if (!firstTarget) {
+      if (absenceIsUnmeasured(rx)) return blockedDespiteAssertions(noDeliveryCause(rx, 'run.completed attempt'));
+      return blockedDespiteAssertions(`the target subscription's first attempt never arrived, so there was nothing to unregister after — ${noDeliveryCause(rx, 'run.completed attempt')}`);
+    }
+    await waitFor(() => unregistering !== null, 5_000);
+    if (unregistering !== null) await unregistering;
+    expect(unregisterStatus, req(ID, 'webhooks.md §Surfaces', 'DELETE /webhooks/{webhookId} MUST answer 204 for the caller\'s own subscription')).toBe(204);
+    const cutoff = (unregisteredAt as number | null ?? Date.now()) + GRACE_MS;
+
+    const after = (id: string): number[] => (arrivals.get(id) ?? []).filter((t) => t > cutoff);
+    await waitFor(() => after(controlId).length > 0 || after(target).length > 0, windowMs);
+    if (after(controlId).length > 0) await new Promise((r) => setTimeout(r, SETTLE_MS));
+
+    const targetLate = after(target);
+    const controlLate = after(controlId);
+    const detail = `target ${target}: ${arrivals.get(target)?.length ?? 0} attempt(s), ${targetLate.length} after the 204 + ${GRACE_MS}ms; control ${controlId}: ${arrivals.get(controlId)?.length ?? 0} attempt(s), ${controlLate.length} after that point`;
+    expect(
+      targetLate.length,
+      req(ID, DOC, `after unregisterWebhook answers 204 the host MUST NOT start another attempt for that subscription, including retries already scheduled — ${detail}`),
+    ).toBe(0);
+    if (controlLate.length === 0) {
+      return softSkip('skipped', `partial-witness: the control subscription was not retried after the 204 + ${GRACE_MS}ms within ${windowMs}ms either, so the target's silence shows nothing — the schedule finished inside the grace or runs past the window (raise OPENWOP_WEBHOOK_RETRY_WAIT_MS above the host's backoff sum) — ${detail}`);
+    }
+  }, CAP_MS * 2 + 90_000);
+});