@openwop/openwop-conformance 2.40.0 → 2.40.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.40.2] — 2026-09-26 — production bundles stop carrying harness-issuer blocked rows, and a colocated companion is marked
+
+- **RFC 0216: `--as-colocated-companion`, and a companion witnesses only the harness-trust-anchor rows.** The flag marks a v3 bundle `host.deployment: "colocated-companion"`. It is refused without `--certify` and bundle version 3. `witnessDigest` takes the marker into the preimage when present (`{ rows, relaxations?, deployment }`), so a signed companion cannot shed it: `--verify` then refuses with `witness-digest`. New coherence scenario `v2-colocated-companion` (7 legs, one id each) drives `scripts/check-harness-trust-anchors.mjs` and `scripts/check-companion-pairing.mjs` on tmpdir fixtures signed by the suite's own `signBundleV3`. Five sabotages were each run red.
+- **The harness OIDC issuer is an instrument a host claims, so an honest production bundle is no longer uncertifiable.** Before this, `v2-oidc-id-token-audience` (`0200.id-token-aud`) and `v2-lane-exp-only-bound` (the four `0210.exp-only-*` / `credential-lifetime-code` rows) recorded `blocked` whenever the host did not trust `OPENWOP_TEST_OIDC_ISSUER_URL`. A production host must never trust a test issuer, and one `blocked` row denies certification bundle-wide (RFC 0168 §E.1). Every production bundle advertising an `oidc` or `exp-only` lane was therefore uncertifiable (openwop-app ADR 0745, corpus defect 1). The rows are `seam-gated`, and RFC 0168 §C.1 already rules that an unclaimed suite instrument is `inapplicable`, with `blocked` reserved for a claimed instrument that does not answer. The new `lib/harness-issuer.ts` treats the harness as claimed when the gated lane's advertised `issuers[]` lists it. When the lane does not list it, the row is `inapplicable` and names the issuers the host does trust. When it does, the legs run as before (a failed serve or a refused control is still `blocked`). RFC 0200 and RFC 0210 carry dated correction notes, and `SECURITY/invariants.yaml` `lane-exp-only-lifetime-bounded` is updated. No MUST changes. The residual is stated in the RFC 0210 note: a production bundle does not witness these rows, just as it witnesses no seam-gated row. The witness comes from a cut whose lane lists the harness. **The issuer now has a bind knob:** it listens via `receiverBinding()`, which is loopback, or `0.0.0.0` under `OPENWOP_CONFORMANCE_HARNESS_HOST`, on 2.39.4's `issuerListenPort()`. It waits out `EADDRINUSE` while the other scenario holds the shared URL. Before this, it always bound `127.0.0.1`, so a host in a Linux container reaching it through `host-gateway` found nothing listening (ADR 0745 defect 2; 2.39.4 fixed the port half). **`requirements.json` resolves `const ID` declared inside a test body** (`generate-requirement-registry.mjs`). Before, only module-level constants resolved, so 14 real ids recorded `explicitId: null`: `0210.lane-rule-surfaces-agree` (ADR 0745 defect 4), three `0199.*`, six `0201.*` and four `0214.*`. Those rows were labelled by their title-derived id whenever the leg did not reach its assertion. ADR 0745 defect 5, the reused kid, was already fixed in 2.37.0: every instance mints `openwop-conformance-key-<instance>-<n>`, pinned by `oidc-issuer.test.ts`. New suite self-test `src/lib/harness-issuer.test.ts` covers the claim predicate and the port knob. It is sabotage-proved: dropping the `issuers[]` check makes it fail 2/4.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.40.2` because `2.40.1` is released, and `spec-artifacts` now carries a changed `spec/v2/core/oauth.md` (RFC 0199's text restored; editorial, `COMPATIBILITY.md` §3 entry of 2026-09-26). No scenario changes. Not tagged, not published.
+
+## [2.40.1] — 2026-09-26 — three declared-unwitnessable rows are reached and say why
+
+- **Three Falsifiability rows declared non-executable now have a leg that records the reason** (RFC 0174 §B.1 rule 4, second branch: "the suite must reach the leg and record a reason"). Each RFC's table declares one of these rows unwitnessable, but no suite leg referenced it, so no bundle could account for it. Each of RFCs 0197, 0205 and 0209 was held from `Accepted` by that one row. No leg can record `executed-pass` without observing the requirement.
+  - `openwop.requirement.0197.retired-not-emitted` (`v2-capability-maturity-bounded`, new describe) is **conditional, not constant**. It reads `spec/v1/deprecations.json`, `spec/v2/migrations.json` and `spec/v2/release.json` from the shipped corpus. While no `v2-minor` row with `retirement.persistence: "persisted"` is due, it records `inapplicable` with RFC 0197 §A.3's reason; that is today's state, with 0 rows. Once one is due, it locates the member by the schema's `x-openwop-retired-in` annotation (a property name, or a `const` / single-`enum` value). It then drives a `conformance-noop` run and fails on any event that carries the member. A due row whose member it cannot locate records `blocked`. The branches no host can reach yet are self-tested in `src/lib/v2-retired-members.test.ts` (due / not-due / advertised-class / unannotated / caught emission / clean event).
+  - `openwop.requirement.0205.export-alias-equivalence` (`v2-artifact-a2a-shape`, new describe) records `inapplicable` on every host, before any request, with RFC 0205 §C.11's verdict: consumer matching logic and a pack-author call, neither on the wire.
+  - `openwop.requirement.0209.render-needs-root` (`v2-a2ui-v09-surface`, new describe) records `inapplicable` on every host, before any request or seam gate, with RFC 0209 §C.9's verdict. It names the reference-impl witness: openwop-app `frontend/react/src/chat/a2ui/__tests__/a2ui-v09-render-needs-root.test.tsx` (openwop-app#4121).
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.40.1` because `2.40.0` is tagged. Not tagged, not published. 561 scenario files, unchanged, so this is a patch.
+
 ## [2.40.0] — 2026-09-26 — RFC 0215: one subscription's dead receiver cannot hold another's delivery, and unregistering stops the retries
 
 - **Two new scenarios, gated on `webhooks` (RFC 0215, `Active` 2026-09-25).** `v2-webhook-delivery-isolation` (`openwop.requirement.0215.no-head-of-line`) holds 8 subscriptions' attempts unanswered, then checks that a ninth subscription's attempt still starts. The 8 filter `run.started` and the ninth `run.completed` of a 2 s `conformance-delay` run, so contention exists before the healthy delivery falls due and the host's dispatch order cannot decide the row. It fails when the held attempts were still open at the due time and the healthy one waited for the host to release one. It records `partial-witness` when the host's own delivery timeout closed them first. `v2-webhook-unregister-stops-delivery` (`openwop.requirement.0215.unregister-stops-delivery`) answers `500` to two subscriptions on one run, unregisters one after its first attempt, and fails if that one is attempted more than 5 s after the `204`. It passes only when the other, the control, was retried after that point: a silence counts only when a retry demonstrably would have come. Sabotage on the v2 reference host: a sequential worker and a 5-slot pool each fail the first scenario, and an attempt that falls back to a cached subscription after the delete fails the second.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.40.0 @openwop/spec-artifacts@2.40.0
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.40.2 @openwop/spec-artifacts@2.40.2
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/cli.js

@@ -70,6 +70,7 @@ function parseArgs(argv) {
     let signingKeyPath, signingKeyId, verifierKeyPath, verifierKeyId;
     let targetMajor;
     let maxWorkers = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
+    let colocatedCompanion = false;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i] ?? '';
         if (arg === '-h' || arg === '--help') {
@@ -180,6 +181,12 @@ function parseArgs(argv) {
             case '--host-key':
                 verifyHostKeyPath = nextValue();
                 break;
+            // RFC 0216 §B — marks the bundle as cut from a colocated companion (the
+            // served host's image beside the suite, trusting a suite-held anchor).
+            // The marker is inside witnessSha256, so a signed companion cannot shed it.
+            case '--as-colocated-companion':
+                colocatedCompanion = true;
+                break;
             case '--require-behavior':
                 process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
                 break;
@@ -215,6 +222,7 @@ function parseArgs(argv) {
         maxWorkers,
         verifyPath,
         verifyHostKeyPath,
+        colocatedCompanion,
     };
 }
 /** Parse a `--max-workers` / `OPENWOP_MAX_WORKERS` value: a positive integer, else exit 2. */
@@ -261,6 +269,10 @@ Certification (RFC 0089):
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.
+  --as-colocated-companion  v3 (RFC 0216): mark the bundle as cut from a colocated companion — the
+                        served host's image run beside the suite so it can trust a suite-held
+                        trust anchor. Signed (inside witnessSha256). A companion is acceptance
+                        evidence only for spec/v2/harness-trust-anchors.json rows.
   --max-workers <n>     Cap concurrently running scenario files (vitest --maxWorkers).
                         Default: one worker per CPU. Use a small number against a
                         rate-limited production origin so 429s don't read as failures.
@@ -680,7 +692,7 @@ async function runCertify(args, baseUrl, apiKey) {
             bundleVersion: '3',
             generatedAt: new Date().toISOString(),
             suite: { name: '@openwop/openwop-conformance', version, targetMajor: target.major, specArtifactsVersion: lock?.version ?? 'repo-layout', ...(lock ? { stampSha256: lock.stampSha256 } : {}) },
-            host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}) },
+            host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}), ...(args.colocatedCompanion ? { deployment: 'colocated-companion' } : {}) },
             // `document` is what makes `claimedProfiles[].certified` checkable by
             // someone other than this process (RFC 0148 §B(1)); v2 carried it and v3
             // dropped it. `sha256` is a digest of `canonicalJSON(document)`, so the
@@ -688,7 +700,7 @@ async function runCertify(args, baseUrl, apiKey) {
             discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion, document },
             claimedProfiles: claimed3,
             results: { totals: totals3, requirements: rows3 },
-            witnessSha256: witnessDigest(rows3, relaxations),
+            witnessSha256: witnessDigest(rows3, relaxations, args.colocatedCompanion ? 'colocated-companion' : undefined),
             assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
             ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
             // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
@@ -856,6 +868,10 @@ async function runCertify(args, baseUrl, apiKey) {
 }
 async function main() {
     const args = parseArgs(process.argv.slice(2));
+    if (args.colocatedCompanion && (!args.certify || args.bundleVersion !== '3')) {
+        process.stderr.write('openwop-conformance: --as-colocated-companion marks a v3 certification bundle; it needs --certify with bundle version 3 (RFC 0216 §B)\n');
+        process.exit(2);
+    }
     // Refused before anything runs: a pinned-port certification that is not
     // single-worker loses the host's traffic to a worker nobody reads (lib/pinned-ports.ts).
     const pinnedConflict = pinnedPortWorkerConflict(process.env, args.maxWorkers, args.certify !== undefined);

package/dist/lib/certification-bundle-v3.js

@@ -49,12 +49,20 @@ export { canonicalJSON } from './jcs.js';
  * from the same bundle anywhere else (Czech sorts `ch` after `h`). Every
  * committed bundle's ids are `[a-z0-9.-]`, where the two orders coincide, so no
  * stored digest changes (v2-bundle-witness-preimage.test.ts pins that).
+ *
+ * RFC 0216 §B.7 — a colocated companion's `host.deployment` joins the preimage
+ * the same way, ONLY WHEN PRESENT (`{ rows, relaxations?, deployment }`), so a
+ * signed companion cannot shed the marker and pass as a served-host bundle, and
+ * every bundle without it digests exactly as before.
  */
-export function witnessDigest(rows, relaxations) {
+export function witnessDigest(rows, relaxations, deployment) {
     const canonicalRows = [...rows].sort((a, b) => codeUnitCompare(a.id, b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
         // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
         ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
-    const preimage = relaxations !== undefined && relaxations.length > 0 ? { rows: canonicalRows, relaxations } : canonicalRows;
+    const relaxed = relaxations !== undefined && relaxations.length > 0;
+    const preimage = relaxed || deployment !== undefined
+        ? { rows: canonicalRows, ...(relaxed ? { relaxations } : {}), ...(deployment !== undefined ? { deployment } : {}) }
+        : canonicalRows;
     return createHash('sha256').update(canonicalJSON(preimage), 'utf8').digest('hex');
 }
 /** The bytes the attestation covers. */
@@ -140,9 +148,9 @@ export function verifyBundleV3(bundle, opts = {}) {
     for (const k of Object.keys(expected))
         if (bundle.results?.totals?.[k] !== expected[k])
             rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(bundle.results?.totals?.[k])} but the rows count ${expected[k]}` });
-    const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations));
+    const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations, bundle.host?.deployment));
     if (digest !== undefined && bundle.witnessSha256 !== digest)
-        rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows and declared relaxations (${digest.slice(0, 12)})` });
+        rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows, declared relaxations and deployment marker (${digest.slice(0, 12)})` });
     const assertions = rows.reduce((n, r) => n + (r.assertions ?? 0), 0);
     if (bundle.assertionCount !== assertions)
         rejections.push({ kind: 'assertion-count', detail: `assertionCount is ${String(bundle.assertionCount)} but the rows sum to ${assertions}` });

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.40.0",
-  "stampSha256": "f65c56d3a36eb7301c4baceef9ce0899091151fb12bc72c1508eb7a7d7b4ca4c"
+  "version": "2.40.2",
+  "stampSha256": "5b784776f9088d58f1fd29e14efa113715876aac5940b728f775a779c59a962a"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.40.0",
+  "version": "2.40.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.40.0"
+    "@openwop/spec-artifacts": "2.40.2"
   }
 }

package/requirement-aliases.json

@@ -167,6 +167,8 @@
     "openwop.it.v2-security-defaults-table.the-obligation-table-has-a-witness-column-and-no-row-is-unwitnessable": "openwop.requirement.0173.security-defaults-table",
     "openwop.it.v2-spec-artifacts-digest.the-corpus-gate-script-exits-0": "openwop.requirement.0168.spec-artifacts-digest",
     "openwop.it.v2-threat-model-template.the-corpus-gate-script-exits-0": "openwop.requirement.0173.threat-model-template",
-    "openwop.it.v2-witness-required.the-corpus-gate-script-exits-0": "openwop.requirement.0168.witness-required"
+    "openwop.it.v2-witness-required.the-corpus-gate-script-exits-0": "openwop.requirement.0168.witness-required",
+    "openwop.it.bundle-maturity-gate.the-committed-corpus-is-green-and-the-report-names-the-overstated-families-and-t": "openwop.it.bundle-maturity-gate.the-committed-corpus-is-green-and-the-gate-states-when-c-7-binds",
+    "openwop.it.bundle-maturity-gate.the-same-committed-bundle-re-labelled-onto-the-rfc-s-suite-fails-naming-every-ov": "openwop.it.bundle-maturity-gate.the-superseded-myndhyve-bundle-re-labelled-onto-the-rfc-s-suite-fails-naming-eve"
   }
 }