@openwop/openwop-conformance 2.4.4 → 2.4.5

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.4.5] — 2026-09-18 — the strict flag that was not wired, and the soft-skip that counted as a pass
+
+### Fixed
+
+- **`--require-behavior` was never parsed** — it hit the arg loop's silent
+  default arm, so only `OPENWOP_REQUIRE_BEHAVIOR=true` enabled strict mode. A
+  cut naming the flag measured the loose answer. The flag now sets the variable,
+  and an unknown `--flag` exits 2 rather than being ignored.
+- **`resolveItRecord` dropped the `partial-witness:` note** that
+  `resolveFileRecord` computes, so a leg that asserted and then soft-skipped
+  recorded a bare `executed-pass` at the granularity the RFC acceptance gate
+  reads.
+- **`v2-bound-id-kinds`** now routes its mint through `resolveRegistrationUrl`,
+  so `OPENWOP_WEBHOOK_RECEIVER_URL` works on the leg whose blocked note told
+  operators to set it.
+- **`v2-webhook-delivery-shape`** now honours `OPENWOP_WEBHOOK_RECEIVER_PORT`
+  and is registered in the receiver guard's scenario list. Two major-2 files
+  pin that port, so the webhook lane requires `--max-workers 1`.
+
 ## [2.4.4] — 2026-09-18 — the corpus's first `Superseded` RFC
 
 **Why a patch, and why the suite version moves at all.** No conformance code

package/dist/cli.js

@@ -163,9 +163,24 @@ function parseArgs(argv) {
             case '--max-workers':
                 maxWorkers = parseMaxWorkers(nextValue(), '--max-workers');
                 break;
+            // `--require-behavior` was PRESCRIBED as the certification setting by the
+            // v2 migration runbook and recorded in INTEROP-MATRIX rows, and the CLI
+            // never parsed it: it fell into the silent default arm below while only
+            // `OPENWOP_REQUIRE_BEHAVIOR=true` did anything. So a cut that named the
+            // flag measured the LOOSE answer and reported the strict one — the exact
+            // failure shape the runbook warns about, in the tool that measures it.
+            case '--require-behavior':
+                process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
+                break;
             default:
                 if (arg.startsWith('-')) {
-                    // Unknown flag — pass through to vitest by ignoring here.
+                    // An unknown flag is now a HARD ERROR, not a silent pass-through. The
+                    // old arm is why the miss above went unnoticed for the whole v2
+                    // program: a typo or a removed flag looked identical to a working one.
+                    process.stderr.write(`openwop-conformance: unknown flag ${arg}\n` +
+                        'Run `openwop-conformance --help` for usage. (A flag the CLI does not know is refused rather than ignored: ' +
+                        'a certification run MUST NOT silently measure something other than what its command line says.)\n');
+                    process.exit(2);
                 }
         }
     }
@@ -245,6 +260,9 @@ Certification (RFC 0089):
                         to <out.json>. Requires --base-url (and --api-key as usual).
 
 Other:
+  --require-behavior    Strict mode: an ADVERTISED behaviour that cannot be
+                        observed FAILS instead of soft-skipping (RFC 0148 §B).
+                        Equivalent to OPENWOP_REQUIRE_BEHAVIOR=true.
   --help, -h            Show this message
 
 Examples:

package/dist/lib/scenario-disposition.js

@@ -99,8 +99,19 @@ export const PARTIAL_WITNESS_PREFIX = 'partial-witness: ';
 export function resolveItRecord(state, assertionCalls, gate, noted, firstError) {
     if (state === 'fail')
         return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
-    if (state === 'pass' && assertionCalls > 0)
-        return { disposition: 'executed-pass' };
+    if (state === 'pass' && assertionCalls > 0) {
+        // A leg that asserted AND THEN soft-skipped is only a partial witness, and
+        // the file-level record has always said so (`resolveFileRecord` below).
+        // This `it`-level record dropped the note — and the `it`-level rows are the
+        // ones RFC 0174 §B.1 rule 4 reads for acceptance. Measured consequence:
+        // `openwop.requirement.0173.webhook-durable-delivery.dead-letter` ends in an
+        // UNCONDITIONAL `softSkip('blocked', 'no normative dead-letter read surface…')`
+        // on every host, and still recorded a bare `executed-pass` that satisfied
+        // RFC 0173 §B's dead-letter row on every bundle in the corpus.
+        return noted !== null
+            ? { disposition: 'executed-pass', detail: `${PARTIAL_WITNESS_PREFIX}${noted.kind}: ${noted.reason}` }
+            : { disposition: 'executed-pass' };
+    }
     if (gate !== undefined)
         return { disposition: gate.disposition, detail: gate.detail ?? `${gate.disposition} (gate recorded no reason)` };
     if (noted !== null)

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.4.4",
-  "stampSha256": "fe5763e65915d94bda320daa26bd1b9ab72cd069a347f2e7f9029ec04d714f67"
+  "version": "2.4.5",
+  "stampSha256": "2d625db1edc658e5ca483a95028e5db84c62bef71c8ced299e817c6875fbfbfd"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.4.4",
+  "version": "2.4.5",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.4.4"
+    "@openwop/spec-artifacts": "2.4.5"
   }
 }

package/requirements.json

@@ -26009,7 +26009,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.subscriptionid-post-webhooks-mints-a-bound-webhookid-the-projected-segment-is-ac",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 60,
+      "line": 61,
       "title": "subscriptionId: POST /webhooks mints a bound webhookId, the projected segment is accepted, and a foreign tenant segment is refused 403",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.webhook",
       "citations": [
@@ -26036,7 +26036,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.interruptid-the-id-a-suspension-puts-on-the-wire-is-bound",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 87,
+      "line": 95,
       "title": "interruptId: the id a suspension puts on the wire is bound",
       "explicitId": null,
       "citations": []
@@ -26044,7 +26044,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.effectid-every-row-get-runs-runid-effects-serves-is-bound",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 108,
+      "line": 116,
       "title": "effectId: every row GET /runs/{runId}/effects serves is bound",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.per-kind",
       "citations": [
@@ -26057,7 +26057,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.deliveryid-the-kind-has-no-wire-surface-to-be-bound-on-a-corpus-gap-recorded",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 123,
+      "line": 131,
       "title": "deliveryId: the kind has no wire surface to be bound on — a corpus gap, recorded",
       "explicitId": null,
       "citations": []
@@ -29321,7 +29321,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-2-subscriber-receives-the-v2-rendering-the-delivery-validates-and-run-st",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 175,
+      "line": 186,
       "title": "a major-2 subscriber receives the v2 rendering: the delivery validates, and run.started.owner carries subject, never principal",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -29352,7 +29352,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-1-subscriber-still-receives-the-v1-rendering-the-v1-wire-does-not-move-m",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 194,
+      "line": 205,
       "title": "a major-1 subscriber still receives the v1 rendering — the v1 wire does not move mid-overlap",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -29370,7 +29370,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-seeded-era-2-run-is-delivered-projected-too-the-fan-out-branch-a-fresh-run-can",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 217,
+      "line": 228,
       "title": "a seeded era-2 run is delivered projected too — the fan-out branch a fresh run cannot reach (seam-gated)",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.4.4",
-  "corpusTag": "v2.4.4",
+  "version": "2.4.5",
+  "corpusTag": "v2.4.5",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "563976e89c42a4d1f71198ec7af1c3d10dbf619b37fda08d15723f9a0dfbedf8",
-    "api/v2/asyncapi.yaml": "e3670f2bcc45610ba41ac51ed71f86b2e112705678d9bc44bd6be73412ac9653",
-    "api/v2/openapi.yaml": "1ec6df091e6406760f12ee21ee9f236ec14b30afd59b1cd3295c1dd490858067",
+    "api/seams-v2.yaml": "c630eb49d587cb3453b956ad7a7877b7afc7ce5730928df27b33b317736482c4",
+    "api/v2/asyncapi.yaml": "ce6eac3ac2407ae8a56ea08d4b4cbeca5b3c5bf573beb7f716f0f07d97f2a752",
+    "api/v2/openapi.yaml": "1e9a68170a184d71103a4dc03400f7f321c390042c00f42b1f2d9ebae50ff7ac",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -200,7 +200,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "e90916db12d2297e2e560b2d54d2c4702d6cb3bef7179a575844687a7ec17262",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "d0a809262b519c83c97b7007023bd47982c5919d25207efa9d49272d2d9bb657",
+    "spec/v1/core-standard-manifest.json": "7b47c64730229681956af2a0cf2c9b8fe7ac641e590cf87a157e90fe49cd6678",
     "spec/v1/deprecations.json": "c81c8f71460936c8d489d8270477c7661cf4a5d7b7bad86c98899750b5656027",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -219,7 +219,7 @@
     "spec/v2/core/errors.md": "ad85fc830139e587f20deabf88297b91b1fb6ce31e80d5442624a650246ab16e",
     "spec/v2/core/events.md": "f1bac16419740f3b722febb6f5caaabed8838e092cba3d080fe9184024049dcf",
     "spec/v2/core/form-content-packs.md": "6ffaae85d4550be48dd53fb6e2959af8aceb35bd87c5343b722885084f197713",
-    "spec/v2/core/headers.md": "c1e0df141b49189a04be9462638932e71561977f56857e35011f927c9320042b",
+    "spec/v2/core/headers.md": "d79eb0babdd4a1a8689d40dd7f84c711c729092259b2afe859481a0902dd7342",
     "spec/v2/core/idempotency.md": "b86c352d964aebad532727f314e26ed2177d49de382076fa64d3162e2f56118d",
     "spec/v2/core/identity.md": "9d2b823eb899463807452fe5721dcf09881837c161be024175957db27870b243",
     "spec/v2/core/interop.md": "d4c404e469e1d9d9be88bc2c939d777e7d7c1d0419b1251c18770f039838a401",
@@ -271,8 +271,8 @@
     "spec/v2/path-manifest.json": "a6f4e652e866889e8bde815874062f62929aee95dc8e58e7152c56adee262163",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "06b8e81a8c0ff725e20d7609d52677e5d0d2a29abc853ecf1e10a415fc69164e",
+    "spec/v2/release.json": "a6818de7c8879dc510a539c0c25f7bd06f489578f7454921504551cd1129dfea",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "64aaa871715b242bb5965e8877bf0a8f13693419"
+  "corpusCommit": "9e47426865890fef13e6c0759f428f0e8454ba83"
 }

package/src/cli.ts

@@ -181,9 +181,26 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
       case '--max-workers':
         maxWorkers = parseMaxWorkers(nextValue(), '--max-workers');
         break;
+      // `--require-behavior` was PRESCRIBED as the certification setting by the
+      // v2 migration runbook and recorded in INTEROP-MATRIX rows, and the CLI
+      // never parsed it: it fell into the silent default arm below while only
+      // `OPENWOP_REQUIRE_BEHAVIOR=true` did anything. So a cut that named the
+      // flag measured the LOOSE answer and reported the strict one — the exact
+      // failure shape the runbook warns about, in the tool that measures it.
+      case '--require-behavior':
+        process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
+        break;
       default:
         if (arg.startsWith('-')) {
-          // Unknown flag — pass through to vitest by ignoring here.
+          // An unknown flag is now a HARD ERROR, not a silent pass-through. The
+          // old arm is why the miss above went unnoticed for the whole v2
+          // program: a typo or a removed flag looked identical to a working one.
+          process.stderr.write(
+            `openwop-conformance: unknown flag ${arg}\n` +
+              'Run `openwop-conformance --help` for usage. (A flag the CLI does not know is refused rather than ignored: ' +
+              'a certification run MUST NOT silently measure something other than what its command line says.)\n',
+          );
+          process.exit(2);
         }
     }
   }
@@ -266,6 +283,9 @@ Certification (RFC 0089):
                         to <out.json>. Requires --base-url (and --api-key as usual).
 
 Other:
+  --require-behavior    Strict mode: an ADVERTISED behaviour that cannot be
+                        observed FAILS instead of soft-skipping (RFC 0148 §B).
+                        Equivalent to OPENWOP_REQUIRE_BEHAVIOR=true.
   --help, -h            Show this message
 
 Examples:

package/src/lib/scenario-disposition.ts

@@ -106,7 +106,19 @@ export function resolveItRecord(
   firstError?: string,
 ): { disposition: Disposition; detail?: string } {
   if (state === 'fail') return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
-  if (state === 'pass' && assertionCalls > 0) return { disposition: 'executed-pass' };
+  if (state === 'pass' && assertionCalls > 0) {
+    // A leg that asserted AND THEN soft-skipped is only a partial witness, and
+    // the file-level record has always said so (`resolveFileRecord` below).
+    // This `it`-level record dropped the note — and the `it`-level rows are the
+    // ones RFC 0174 §B.1 rule 4 reads for acceptance. Measured consequence:
+    // `openwop.requirement.0173.webhook-durable-delivery.dead-letter` ends in an
+    // UNCONDITIONAL `softSkip('blocked', 'no normative dead-letter read surface…')`
+    // on every host, and still recorded a bare `executed-pass` that satisfied
+    // RFC 0173 §B's dead-letter row on every bundle in the corpus.
+    return noted !== null
+      ? { disposition: 'executed-pass', detail: `${PARTIAL_WITNESS_PREFIX}${noted.kind}: ${noted.reason}` }
+      : { disposition: 'executed-pass' };
+  }
   if (gate !== undefined) return { disposition: gate.disposition, detail: gate.detail ?? `${gate.disposition} (gate recorded no reason)` };
   if (noted !== null) return { disposition: noted.kind, detail: noted.reason };
   if (state === 'pass') return { disposition: 'blocked', detail: 'unclassified return: the test passed with zero assertions and recorded no reason — RFC 0148 §A resolves it to blocked, never to a pass' };

package/src/scenarios/v2-bound-id-kinds.test.ts

@@ -31,6 +31,7 @@ import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery, gateFamily } from '../lib/v2.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { softSkip } from '../lib/soft-skip.js';
+import { resolveRegistrationUrl } from '../lib/webhook-receiver.js';
 import { req } from '../lib/requirement-ids.js';
 import { projectBoundId, BOUND_ID } from '../lib/bound-id.js';
 
@@ -60,9 +61,16 @@ describe('v2 bound-id kinds (identity.md §5, RFC 0187 §A)', () => {
   it('subscriptionId: POST /webhooks mints a bound webhookId, the projected segment is accepted, and a foreign tenant segment is refused 403', async () => {
     if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable');
     if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised — no subscription to mint (gate recorded under openwop.family.webhooks)');
-    const reg = await http(() => driver.post('/webhooks', { url: 'https://subscriber.invalid/hook', events: ['run.completed'] }));
+    // Route the mint through `resolveRegistrationUrl` so an operator who sets
+    // OPENWOP_WEBHOOK_RECEIVER_URL actually gets a reachable registration here.
+    // Before this, the blocked note TOLD them to set that variable and this file
+    // never read it — inoperative advice in a suite where one blocked row denies
+    // every claimed profile (RFC 0168 §E.1). The fallback stays a reserved
+    // `.invalid` host: this leg only needs the mint, never a delivery.
+    const registration = resolveRegistrationUrl('https://subscriber.invalid/hook');
+    const reg = await http(() => driver.post('/webhooks', { url: registration.url, events: ['run.completed'] }));
     if (reg === null) return softSkip('blocked', 'POST /webhooks unreachable (fetch failed)');
-    if (reg.status === 400 && readErrorCode(reg.json) === 'webhook_url_rejected') return softSkip('blocked', 'host SSRF guard rejected the fixture receiver URL — set OPENWOP_WEBHOOK_RECEIVER_URL or allow the reserved .invalid host to witness');
+    if (reg.status === 400 && readErrorCode(reg.json) === 'webhook_url_rejected') return softSkip('blocked', `host SSRF guard rejected the registration URL ${registration.url}${registration.tunnelled ? ' (from OPENWOP_WEBHOOK_RECEIVER_URL)' : ' — set OPENWOP_WEBHOOK_RECEIVER_URL to a public https receiver, which THIS leg now honours'}`);
     expect(reg.status, req(WEBHOOK_ID, 'webhooks.md §Surfaces', 'POST /webhooks MUST answer 201 { webhookId }')).toBe(201);
     const webhookId = (reg.json as { webhookId?: unknown } | null)?.webhookId;
     expectBound(webhookId, 'webhookId', 'POST /webhooks 201', WEBHOOK_ID);

package/src/scenarios/v2-webhook-delivery-shape.test.ts

@@ -77,11 +77,22 @@ async function startReceiver(): Promise<{ server: Server; url: string; deliverie
       res.writeHead(204); res.end();
     });
   });
-  const { bind, advertise } = receiverBinding();
-  await new Promise<void>((resolve) => server.listen(0, bind, () => resolve()));
+  // Honour OPENWOP_WEBHOOK_RECEIVER_PORT like `v2-webhook-durable-delivery`
+  // does. Without it, a tunnelled run registers the tunnel URL here and the
+  // tunnel forwards to the PINNED port — held by the other receiver, which
+  // answers 500 by design — so this file's `deliveries` stays empty, its legs
+  // soft-skip, and (because `register()` already asserted) the rows resolve
+  // `executed-pass`. A wire-shape scenario that never opened a delivery body
+  // went green. Two major-2 files now want the same pinned port, so the
+  // webhook lane MUST run with `--max-workers 1`, which is already the
+  // certification setting.
+  const pinned = Number(process.env['OPENWOP_WEBHOOK_RECEIVER_PORT'] ?? '');
+  const bindPort = Number.isInteger(pinned) && pinned > 0 && pinned < 65536 ? pinned : 0;
+  const binding = receiverBinding();
+  await new Promise<void>((resolve) => server.listen(bindPort, binding.bind, () => resolve()));
   const addr = server.address();
   const port = typeof addr === 'object' && addr ? addr.port : 0;
-  return { server, url: `http://${advertise}:${port}/hook`, deliveries };
+  return { server, url: `http://${binding.advertise}:${port}/hook`, deliveries };
 }
 
 /**