@openwop/openwop-conformance 2.40.1 → 2.40.3

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.40.3] — 2026-09-26 — a cookie-borne lane can be revoke-witnessed, and a secret-named setting no longer corrupts the discovery digest
+
+- **`v2-revocation-honored` presents a cookie-lane credential as a cookie.** When the mint seam answers `presentation: { kind: "cookie", name }`, the probe sends `Cookie: <name>=<credential>` instead of a bearer token. The seams contract's `mintLaneCredential` response gains that optional member. Bearer stays the default when `presentation` is absent. The cookie branch is unexercised until a host serves it; openwop-app's `session` lane is the first expected.
+- **RFC 0215 gap G1 closes in the contract peer.** `@openwop/spec-artifacts`' `spec/v1/gaps.json` records MyndHyve's measurement (openwop#1595), and `spec/v2/core/webhooks.md`'s `Stable` banner cites RFC 0215 now that it is `Accepted`. No scenario change.
+- **A setting that names a secret is not scrubbed as one.** `evidenceSecretsFromEnv` sweeps every `OPENWOP_*` value whose NAME mentions a key/token/secret/password, and `scrubEvidence` then rewrites that value everywhere in the bundle. openwop-app's RFC 0201 setting `OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60` was swept, the "60" inside `discovery.sha256` was rewritten, the bundle failed `^[0-9a-f]{64}$`, and its deploy certify refused to ship. Values guessed from names are now swept only when credential-shaped (at least 8 characters and not a bare integer); a credential the emitter hands over explicitly is scrubbed whatever its shape. Sabotage: without the floor the new redaction leg fails.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.40.3` because `2.40.2` is tagged. Not tagged, not published.
+
+## [2.40.2] — 2026-09-26 — production bundles stop carrying harness-issuer blocked rows, and a colocated companion is marked
+
+- **RFC 0216: `--as-colocated-companion`, and a companion witnesses only the harness-trust-anchor rows.** The flag marks a v3 bundle `host.deployment: "colocated-companion"`. It is refused without `--certify` and bundle version 3. `witnessDigest` takes the marker into the preimage when present (`{ rows, relaxations?, deployment }`), so a signed companion cannot shed it: `--verify` then refuses with `witness-digest`. New coherence scenario `v2-colocated-companion` (7 legs, one id each) drives `scripts/check-harness-trust-anchors.mjs` and `scripts/check-companion-pairing.mjs` on tmpdir fixtures signed by the suite's own `signBundleV3`. Five sabotages were each run red.
+- **The harness OIDC issuer is an instrument a host claims, so an honest production bundle is no longer uncertifiable.** Before this, `v2-oidc-id-token-audience` (`0200.id-token-aud`) and `v2-lane-exp-only-bound` (the four `0210.exp-only-*` / `credential-lifetime-code` rows) recorded `blocked` whenever the host did not trust `OPENWOP_TEST_OIDC_ISSUER_URL`. A production host must never trust a test issuer, and one `blocked` row denies certification bundle-wide (RFC 0168 §E.1). Every production bundle advertising an `oidc` or `exp-only` lane was therefore uncertifiable (openwop-app ADR 0745, corpus defect 1). The rows are `seam-gated`, and RFC 0168 §C.1 already rules that an unclaimed suite instrument is `inapplicable`, with `blocked` reserved for a claimed instrument that does not answer. The new `lib/harness-issuer.ts` treats the harness as claimed when the gated lane's advertised `issuers[]` lists it. When the lane does not list it, the row is `inapplicable` and names the issuers the host does trust. When it does, the legs run as before (a failed serve or a refused control is still `blocked`). RFC 0200 and RFC 0210 carry dated correction notes, and `SECURITY/invariants.yaml` `lane-exp-only-lifetime-bounded` is updated. No MUST changes. The residual is stated in the RFC 0210 note: a production bundle does not witness these rows, just as it witnesses no seam-gated row. The witness comes from a cut whose lane lists the harness. **The issuer now has a bind knob:** it listens via `receiverBinding()`, which is loopback, or `0.0.0.0` under `OPENWOP_CONFORMANCE_HARNESS_HOST`, on 2.39.4's `issuerListenPort()`. It waits out `EADDRINUSE` while the other scenario holds the shared URL. Before this, it always bound `127.0.0.1`, so a host in a Linux container reaching it through `host-gateway` found nothing listening (ADR 0745 defect 2; 2.39.4 fixed the port half). **`requirements.json` resolves `const ID` declared inside a test body** (`generate-requirement-registry.mjs`). Before, only module-level constants resolved, so 14 real ids recorded `explicitId: null`: `0210.lane-rule-surfaces-agree` (ADR 0745 defect 4), three `0199.*`, six `0201.*` and four `0214.*`. Those rows were labelled by their title-derived id whenever the leg did not reach its assertion. ADR 0745 defect 5, the reused kid, was already fixed in 2.37.0: every instance mints `openwop-conformance-key-<instance>-<n>`, pinned by `oidc-issuer.test.ts`. New suite self-test `src/lib/harness-issuer.test.ts` covers the claim predicate and the port knob. It is sabotage-proved: dropping the `issuers[]` check makes it fail 2/4.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.40.2` because `2.40.1` is released, and `spec-artifacts` now carries a changed `spec/v2/core/oauth.md` (RFC 0199's text restored; editorial, `COMPATIBILITY.md` §3 entry of 2026-09-26). No scenario changes. Not tagged, not published.
+
 ## [2.40.1] — 2026-09-26 — three declared-unwitnessable rows are reached and say why
 
 - **Three Falsifiability rows declared non-executable now have a leg that records the reason** (RFC 0174 §B.1 rule 4, second branch: "the suite must reach the leg and record a reason"). Each RFC's table declares one of these rows unwitnessable, but no suite leg referenced it, so no bundle could account for it. Each of RFCs 0197, 0205 and 0209 was held from `Accepted` by that one row. No leg can record `executed-pass` without observing the requirement.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.40.1 @openwop/spec-artifacts@2.40.1
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.40.3 @openwop/spec-artifacts@2.40.3
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/cli.js

@@ -70,6 +70,7 @@ function parseArgs(argv) {
     let signingKeyPath, signingKeyId, verifierKeyPath, verifierKeyId;
     let targetMajor;
     let maxWorkers = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
+    let colocatedCompanion = false;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i] ?? '';
         if (arg === '-h' || arg === '--help') {
@@ -180,6 +181,12 @@ function parseArgs(argv) {
             case '--host-key':
                 verifyHostKeyPath = nextValue();
                 break;
+            // RFC 0216 §B — marks the bundle as cut from a colocated companion (the
+            // served host's image beside the suite, trusting a suite-held anchor).
+            // The marker is inside witnessSha256, so a signed companion cannot shed it.
+            case '--as-colocated-companion':
+                colocatedCompanion = true;
+                break;
             case '--require-behavior':
                 process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
                 break;
@@ -215,6 +222,7 @@ function parseArgs(argv) {
         maxWorkers,
         verifyPath,
         verifyHostKeyPath,
+        colocatedCompanion,
     };
 }
 /** Parse a `--max-workers` / `OPENWOP_MAX_WORKERS` value: a positive integer, else exit 2. */
@@ -261,6 +269,10 @@ Certification (RFC 0089):
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.
+  --as-colocated-companion  v3 (RFC 0216): mark the bundle as cut from a colocated companion — the
+                        served host's image run beside the suite so it can trust a suite-held
+                        trust anchor. Signed (inside witnessSha256). A companion is acceptance
+                        evidence only for spec/v2/harness-trust-anchors.json rows.
   --max-workers <n>     Cap concurrently running scenario files (vitest --maxWorkers).
                         Default: one worker per CPU. Use a small number against a
                         rate-limited production origin so 429s don't read as failures.
@@ -680,7 +692,7 @@ async function runCertify(args, baseUrl, apiKey) {
             bundleVersion: '3',
             generatedAt: new Date().toISOString(),
             suite: { name: '@openwop/openwop-conformance', version, targetMajor: target.major, specArtifactsVersion: lock?.version ?? 'repo-layout', ...(lock ? { stampSha256: lock.stampSha256 } : {}) },
-            host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}) },
+            host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}), ...(args.colocatedCompanion ? { deployment: 'colocated-companion' } : {}) },
             // `document` is what makes `claimedProfiles[].certified` checkable by
             // someone other than this process (RFC 0148 §B(1)); v2 carried it and v3
             // dropped it. `sha256` is a digest of `canonicalJSON(document)`, so the
@@ -688,7 +700,7 @@ async function runCertify(args, baseUrl, apiKey) {
             discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion, document },
             claimedProfiles: claimed3,
             results: { totals: totals3, requirements: rows3 },
-            witnessSha256: witnessDigest(rows3, relaxations),
+            witnessSha256: witnessDigest(rows3, relaxations, args.colocatedCompanion ? 'colocated-companion' : undefined),
             assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
             ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
             // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
@@ -856,6 +868,10 @@ async function runCertify(args, baseUrl, apiKey) {
 }
 async function main() {
     const args = parseArgs(process.argv.slice(2));
+    if (args.colocatedCompanion && (!args.certify || args.bundleVersion !== '3')) {
+        process.stderr.write('openwop-conformance: --as-colocated-companion marks a v3 certification bundle; it needs --certify with bundle version 3 (RFC 0216 §B)\n');
+        process.exit(2);
+    }
     // Refused before anything runs: a pinned-port certification that is not
     // single-worker loses the host's traffic to a worker nobody reads (lib/pinned-ports.ts).
     const pinnedConflict = pinnedPortWorkerConflict(process.env, args.maxWorkers, args.certify !== undefined);

package/dist/lib/certification-bundle-v3.js

@@ -49,12 +49,20 @@ export { canonicalJSON } from './jcs.js';
  * from the same bundle anywhere else (Czech sorts `ch` after `h`). Every
  * committed bundle's ids are `[a-z0-9.-]`, where the two orders coincide, so no
  * stored digest changes (v2-bundle-witness-preimage.test.ts pins that).
+ *
+ * RFC 0216 §B.7 — a colocated companion's `host.deployment` joins the preimage
+ * the same way, ONLY WHEN PRESENT (`{ rows, relaxations?, deployment }`), so a
+ * signed companion cannot shed the marker and pass as a served-host bundle, and
+ * every bundle without it digests exactly as before.
  */
-export function witnessDigest(rows, relaxations) {
+export function witnessDigest(rows, relaxations, deployment) {
     const canonicalRows = [...rows].sort((a, b) => codeUnitCompare(a.id, b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
         // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
         ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
-    const preimage = relaxations !== undefined && relaxations.length > 0 ? { rows: canonicalRows, relaxations } : canonicalRows;
+    const relaxed = relaxations !== undefined && relaxations.length > 0;
+    const preimage = relaxed || deployment !== undefined
+        ? { rows: canonicalRows, ...(relaxed ? { relaxations } : {}), ...(deployment !== undefined ? { deployment } : {}) }
+        : canonicalRows;
     return createHash('sha256').update(canonicalJSON(preimage), 'utf8').digest('hex');
 }
 /** The bytes the attestation covers. */
@@ -140,9 +148,9 @@ export function verifyBundleV3(bundle, opts = {}) {
     for (const k of Object.keys(expected))
         if (bundle.results?.totals?.[k] !== expected[k])
             rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(bundle.results?.totals?.[k])} but the rows count ${expected[k]}` });
-    const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations));
+    const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations, bundle.host?.deployment));
     if (digest !== undefined && bundle.witnessSha256 !== digest)
-        rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows and declared relaxations (${digest.slice(0, 12)})` });
+        rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows, declared relaxations and deployment marker (${digest.slice(0, 12)})` });
     const assertions = rows.reduce((n, r) => n + (r.assertions ?? 0), 0);
     if (bundle.assertionCount !== assertions)
         rejections.push({ kind: 'assertion-count', detail: `assertionCount is ${String(bundle.assertionCount)} but the rows sum to ${assertions}` });

package/dist/lib/certification-bundle-verify.js

@@ -267,6 +267,25 @@ export function scrubEvidence(value, secrets) {
  * are excluded, and a caller may name values that MUST stay visible (`except`)
  * regardless of which variable carried them.
  */
+/**
+ * Whether an environment VALUE can be a credential at all (suite 2.40.3).
+ *
+ * The name filter above matches settings ABOUT secrets as well as secrets:
+ * openwop-app's `OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60` (RFC 0201's
+ * rotation overlap) was swept in, and `scrubEvidence` then rewrote every "60"
+ * in the bundle — including the one inside `discovery.sha256`, which stopped
+ * matching `^[0-9a-f]{64}$` and failed the host's own deploy certify. A short
+ * value occurs by chance inside digests, counts and timestamps, so scrubbing it
+ * corrupts the evidence without protecting anything: no credential is a bare
+ * integer or under 8 characters (NIST SP 800-63B's floor for a memorized
+ * secret). The floor applies only to values GUESSED from variable names; a
+ * credential the emitter hands over explicitly (`extra`) is always scrubbed,
+ * whatever its shape.
+ */
+export function credentialShaped(v) {
+    const t = v.trim();
+    return t.length >= 8 && !/^\d+$/.test(t);
+}
 export function evidenceSecretsFromEnv(env, extra = [], except = []) {
     const keep = new Set(except.filter((s) => s !== undefined && s.trim() !== ''));
     const out = new Set();
@@ -277,8 +296,11 @@ export function evidenceSecretsFromEnv(env, extra = [], except = []) {
             continue;
         if (/_ID$/.test(k))
             continue; // a key's identifier is published, not secret
-        if (v !== undefined && v.trim() !== '' && !keep.has(v))
-            out.add(v);
+        if (v === undefined || v.trim() === '' || keep.has(v))
+            continue;
+        if (!credentialShaped(v))
+            continue; // a setting that names a secret, not a secret
+        out.add(v);
     }
     for (const s of extra)
         if (s !== undefined && s.trim() !== '' && !keep.has(s))

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.40.1",
-  "stampSha256": "1fb5733bb565913ac21afc3e5179ea3cb4d1b98ab39f543fb3c70f9a936453bd"
+  "version": "2.40.3",
+  "stampSha256": "a3da70b5c189e692914fd3516f841bfaff477a365503009b761bccc1842f43e2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.40.1",
+  "version": "2.40.3",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.40.1"
+    "@openwop/spec-artifacts": "2.40.3"
   }
 }