@openwop/openwop-conformance 2.42.1 → 2.42.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.42.2] — 2026-09-26 — four conformance legs now measure what their spec says: effect re-fire, keying fallback, A2UI JSON values, digest-safe scrubbing
+
+- **`0173.effect-seam-no-refire` can detect a re-fire.** The leg asserted that the replay fork's ledger count was at most the parent's. The seam fires one attempt on the source run, so a host that re-fires on replay read 1 ≤ 1 and passed, over exactly the defect the leg exists for. ws3 measured it: openwop-app with `sideEffecting` dropped still passed. The leg now fails if the fork records any attempt the parent never made, using the new `lib/effect-refire.ts`. An inherited row repeats a parent attempt's `(nodeId, attempt, at)`, while a re-fire is a new attempt, and one parent row covers at most one fork row. A host whose fork projection is empty passes, as does one that projects the parent's attempts as history. The `effect-ledger-projection` schema description, which said the scenario "compares row COUNTS", is corrected. New suite self-test `src/lib/effect-refire.test.ts` uses a re-firing host stub as its first leg. It is sabotage-proved: with the old count rule restored, that leg fails.
+- **RFC 0209 §C.11 compares JSON values, not JSON text, so a JSONB host can pass.** In `v2-a2ui-v09-surface`, `carries()` compared `JSON.stringify(subtree) === JSON.stringify(sent)`, which is order-sensitive. RFC 8259 §4 gives object member order no meaning, and a Postgres JSONB host re-sorts keys. ws5 measured `{version,catalogId,surfaceId,messages}` coming back as `{version,messages,catalogId,surfaceId}` on pg16. So `recorded-as-recorded` and `0209.legacy-readable` could never pass on a conforming JSONB host. The comparison now uses RFC 8785 (JCS) forms, via the new `lib/carries-payload.ts` built on `lib/jcs.ts`. A changed value, an added or dropped member, and reordered messages still fail. New suite self-test `src/lib/carries-payload.test.ts` covers the measured reordering as the positive leg and four negative controls. It is sabotage-proved: with the text comparison restored, the reordering leg fails. RFC 0209 carries a dated correction note. A sweep of every scenario for `JSON.stringify` equality found no other comparison of a suite-sent payload with a host-returned one. The rest compare two answers from the same host and route (`tools/list` twice, source vs fork, `v1` vs `v2` discovery), or arrays of numbers.
+- **The 0173 retry leg accepts the keying the spec allows.** `v2-effect-identity-business-key` demanded `keying: business-identity` on every retried attempt. `idempotency.md` §Layer 2 makes the activity recipe "the fallback for a provider with no business key", and the seam's effect (a POST to a suite-chosen `providerUrl`) has none. So a host honestly declaring `activity-recipe` failed a rule the spec does not state. The leg now requires every attempt to declare a documented keying, the same one across attempts, and the same provider key. The last check was already there and is unchanged. Raised by openwop-app, whose seam began writing one ledger row per attempt.
+- **`scrubEvidence` never rewrites inside a hex digest.** 2.40.3 stopped the environment sweep from collecting short and bare-integer values, after openwop-app's `OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60` rewrote the "60" inside `discovery.sha256`. That failed the host's certify at random, roughly one bundle in five. But a credential the emitter hands over explicitly is still scrubbed whatever its shape, so the scrub itself could still corrupt a digest. A string that is wholly a hex digest (32+ hex characters, bare or `sha256:`-prefixed) is now left untouched unless it IS a secret. A secret inside a digest is a coincidence, not a leak, and rewriting it only breaks the evidence. A real leak in any other string is still redacted. Name classification needs no separate rule: a `*_S` / `*_MS` / `*_SECONDS` setting is a bare integer, which 2.40.3's floor already excludes. New suite self-test `src/lib/scrub-evidence-digest.test.ts` hands the scrub secrets that are substrings of a digest and asserts the digest survives while a neighbouring leak is redacted. It is sabotage-proved: without the guard, two of its three legs fail. **The 2.40.3 redaction leg was vacuous:** its fixture digest contained no "60", so it passed whether or not the value was scrubbed. The fixture now contains one.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.42.2` because `2.42.1` is tagged, and this cycle changes a shipped file: `spec/v1/gaps.json` records RFC 0111 gap G5 `closed` (RFC 0111 `Accepted`, witnessed by MyndHyve on 2.42.1). No scenario, schema or `MUST` change. Not tagged, not published.
+
 ## [2.42.1] — 2026-09-26 — RFC 0111's live witness scenarios outlast a real host, and the MCP run-transport leg identifies its own run
 
 - **RFC 0111's live scenarios no longer die at vitest's 30 s default.** `context-budget-transcript-bound` and `context-summarization-replay` drive the live-model fixture `conformance-context-budget-live` (six real model turns and six child runs; 30–40 s per run on MyndHyve production, 2026-09-26), and the global `testTimeout: 30_000` killed both before any assertion — which `OPENWOP_POLL_TIMEOUT_SCALE` could not reach. Each now carries a per-test timeout from `liveScenarioTimeoutMs(runs)` (`src/lib/polling.ts`: the scaled sum of `LIVE_RUN_POLL_MS` = 180 s per run plus 60 s for seam reads — 240 s / 420 s at scale 1) and polls with `{ timeoutMs: LIVE_RUN_POLL_MS }`, so the named poll deadline always fires before the test deadline, at every scale. The global timeout is unchanged. Self-test: `src/lib/polling.test.ts` (3 new); an unscaled helper fails 2 of them and a 30 s helper 3.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.1 @openwop/spec-artifacts@2.42.1
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.2 @openwop/spec-artifacts@2.42.2
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/coverage.md

@@ -269,6 +269,7 @@ Every OpenAPI operation should have:
 | `putTestPackTarball`, `getTestPackTarball`, `deleteTestPackVersion`, `getTestPackSignature` | `pack-registry-publish.test.ts` covers the 19-code publish error catalog through the RFC 0025 `/v1/packs-test/*` mirror namespace, gated on `capabilities.packs.testMode.supported: true` (RFC 0025 §A). 26 scenarios soft-skip when the advertisement is absent; when present, the suite exercises URL/scope, body-shape, tarball-extraction, manifest-contents, integrity, auth/conflict, unpublish-window, and signature-endpoint pairing. | Soft-skip on advertisement absence; behavioral on advertisement presence                                                                                                                                                                                                                  | Add real-tarball-builder fixtures so the manifest_mismatch / pack_integrity_failure / unsupported_runtime branches assert against a meaningful gzip+tar payload (currently soft-skipped with explanatory comments). |
 | `getContentPage` | `localized-content-delivery.test.ts` (RFC 0103 §D) — always-on `localized-content-page-response.schema.json` shape + the §C `resolveSection` merge; gated live legs assert negotiated delivery + `Content-Language`. Public (anonymous-capable) endpoint, `security: []`. | Gated behavioral legs: published-only delivery, tenant isolation, no cross-tenant enumeration (`content-no-cross-tenant-enumeration`); cross-tenant slug → same `404`. | Behavioral legs soft-skip without a live `GET /v1/content/pages/{slug}`; non-vacuous against openwop-app + MyndHyve. |
 | `listContentPages`, `createContentPage` | `localized-content-delivery.test.ts` (RFC 0103 §D) — `localized-content-page.schema.json` shape + §A coherence. | Protected admin ops document `401`/`403`; create documents `400`. Tenant-scoped (`content-response-tenant-scoped`). | Behavioral list/create round-trip pending a host admin seam. |
+| `deleteContentPage` | No leg asserts it. `v2-content-locale-keys.test.ts` calls it only as best-effort cleanup, and its result is not asserted (RFC 0103 §D; added to the contract 2026-09-26). | `401`/`403`/`404`; `204` with no body. The same `404` for a `pageId` outside the caller's tenant (§F). | Uncovered. A behavioral delete (the page, its sections and its overlays are gone, and delivery answers `404`) is pending a host admin seam. The other four §D admin operations have no contract yet (RFC 0103 gap G12). |
 | `putContentSection` | `localized-content-delivery.test.ts` (RFC 0103 §D) — `localized-content-section.schema.json` shape + the locale-targeted write body. | `401`/`403`/`404`/`400`; base-locale key + bad-key-case negatives. | Behavioral locale-targeted upsert pending a host admin seam. |
 | `getContentSettings`, `putContentSettings` | `localized-content-delivery.test.ts` (RFC 0103 §B) — `localized-content-language-settings.schema.json` shape (base ∉ supported). | `401`/`403`; put documents `400` for the base ∈ supported violation. | Behavioral settings round-trip pending a host admin seam. |
 

package/dist/lib/certification-bundle-verify.js

@@ -208,6 +208,8 @@ export function verifyBundleV2(bundle) {
 export function redactionMarker(secret) {
     return `«redacted:${createHash('sha256').update(secret).digest('hex').slice(0, 12)}»`;
 }
+/** A whole-string hex digest: `sha256:`-prefixed or bare, 32+ hex characters. */
+const HEX_DIGEST = /^(sha256:)?[0-9a-f]{32,}$/i;
 /**
  * Replace every occurrence of every secret in every string of `value` (keys
  * included) with `redactionMarker(secret)`. Empty / whitespace-only secrets
@@ -223,6 +225,17 @@ export function scrubEvidence(value, secrets) {
     if (live.length === 0)
         return { value, redactedAt };
     const scrubString = (s, path) => {
+        // A string that is wholly a hex digest (a sha256, a key fingerprint) is
+        // scrubbed only when it IS a secret, never for a secret found inside it.
+        // A secret inside a digest is a coincidence, not a leak: the digest does
+        // not disclose it. Rewriting it only corrupts the evidence. Suite 2.40.3
+        // floored the env sweep after openwop-app's `…_ROTATION_OVERLAP_S=60`
+        // rewrote the "60" inside `discovery.sha256`, but an explicitly handed
+        // credential is still scrubbed whatever its shape, so a short one (or any
+        // hex one) could still hit a digest at random. This closes that class at
+        // the scrub instead of at each source of secrets.
+        if (HEX_DIGEST.test(s) && !live.includes(s))
+            return s;
         let out = s;
         let hit = false;
         for (const secret of live) {

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.1",
-  "stampSha256": "f71d4bdee95ce4bb80f65ffb6ace46bc5fb62db3456131531ad31caa1040c944"
+  "version": "2.42.2",
+  "stampSha256": "1410563585447c32dced7e6679caf5968a68e9de88c39a5188d527336b86e784"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.42.1",
+  "version": "2.42.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.42.1"
+    "@openwop/spec-artifacts": "2.42.2"
   }
 }

package/requirements.json

@@ -27246,7 +27246,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-2-envelope-carrying-a-version-1-body-is-refused-the-positive-is-admitt",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 137,
+      "line": 131,
       "title": "a version-2 envelope carrying a version-1 body is refused; the positive is admitted; above the floor is refused; below it follows envelopeStrictness",
       "explicitId": "openwop.requirement.0209.version-selects-branch",
       "citations": [
@@ -27290,7 +27290,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.no-first-createsurface-a-message-after-deletesurface-and-a-second-createsurface",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 163,
+      "line": 157,
       "title": "no first createSurface, a message after deleteSurface, and a second createSurface are each refused; the valid steps are admitted",
       "explicitId": "openwop.requirement.0209.fold-guarded",
       "citations": [
@@ -27304,7 +27304,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-createsurface-catalogid-differing-from-the-payload-catalogid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 188,
+      "line": 182,
       "title": "a createSurface.catalogId differing from the payload catalogId is refused",
       "explicitId": "openwop.requirement.0209.catalog-equality",
       "citations": [
@@ -27322,7 +27322,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-message-whose-surfaceid-differs-from-the-payload-surfaceid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 202,
+      "line": 196,
       "title": "a message whose surfaceId differs from the payload surfaceId is refused",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.surface-id-equality",
       "citations": [
@@ -27340,7 +27340,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-recorded-version-2-surface-is-returned-byte-equal-on-poll-and-carried-by-a-for",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 218,
+      "line": 214,
       "title": "a recorded version-2 surface is returned byte-equal on poll and carried by a fork at a later fromSeq",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.recorded-as-recorded",
       "citations": [
@@ -27351,7 +27351,7 @@
         },
         {
           "section": "RFC 0209 §C.11",
-          "requirement": "the run's poll MUST return the recorded surface payload byte-equal — no surface is regenerated"
+          "requirement": "the run's poll MUST return the recorded surface payload unchanged as JSON (JCS-equal; member order carries no meaning) — no surface is regenerated"
         },
         {
           "section": "RFC 0209 §C.9",
@@ -27377,7 +27377,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-1-surface-recorded-at-floor-1-is-returned-byte-equal-on-poll-and-carri",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 245,
+      "line": 241,
       "title": "a version-1 surface recorded at floor 1 is returned byte-equal on poll and carried by a fork",
       "explicitId": "openwop.requirement.0209.legacy-readable",
       "citations": [
@@ -27388,7 +27388,7 @@
         },
         {
           "section": "RFC 0209 §C.11",
-          "requirement": "the poll MUST return the version-1 surface byte-equal"
+          "requirement": "the poll MUST return the version-1 surface unchanged as JSON (JCS-equal)"
         },
         {
           "section": "RFC 0209 §C.11",
@@ -27414,7 +27414,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.one-untrusted-update-taints-a-trusted-surface-a-later-trusted-update-does-not-la",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 269,
+      "line": 265,
       "title": "one untrusted update taints a trusted surface, a later trusted update does not launder it, and the approval does not advance; an all-trusted surface does",
       "explicitId": "openwop.requirement.0209.taint-sticky",
       "citations": [
@@ -27428,7 +27428,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.records-why-render-needs-root-has-no-server-side-witness-and-where-its-witness-l",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 308,
+      "line": 304,
       "title": "records why render-needs-root has no server-side witness, and where its witness lives",
       "explicitId": "openwop.requirement.0209.render-needs-root",
       "citations": [
@@ -28814,6 +28814,11 @@
           "requirement": null,
           "interpolated": true
         },
+        {
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
           "requirement": null,
@@ -28889,7 +28894,7 @@
     {
       "id": "openwop.it.v2-effect-seam-no-refire.driving-one-seam-of-each-kind-observes-no-re-fire-on-replay",
       "file": "v2-effect-seam-no-refire.test.ts",
-      "line": 42,
+      "line": 44,
       "title": "driving one seam of each kind observes no re-fire on replay",
       "explicitId": "openwop.requirement.0173.effect-seam-no-refire",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.1",
-  "corpusTag": "v2.42.1",
+  "version": "2.42.2",
+  "corpusTag": "v2.42.2",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
-    "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
+    "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "849b6c3d37336132343468e553b413a61a133fbc943d21ffc8e961948284db9f",
-    "api/v2/asyncapi.yaml": "96bac052de733a0987c35b4834341d91633381ff2ae1e6087ddb2956ac1edad9",
-    "api/v2/openapi.yaml": "eb39b2957737fc0f2e3187c33aac2f1475a3d2aa382a5c57686a1a15a5b643d4",
+    "api/seams-v2.yaml": "0777cffd47bdaad6482bc910064a42f793d74ae8e8921c84f498b1670f254f21",
+    "api/v2/asyncapi.yaml": "b87e6d39591f6967c6a6154657863c4573dd9833e7b6b8f4ca3472e9d92c9352",
+    "api/v2/openapi.yaml": "12ee6cf90544a49863f9238ba8ddd2d1333f913f26e122819e399ec65e6b682b",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -132,7 +132,7 @@
     "schemas/v2/credential-reference.schema.json": "ea699ce30f58fb2c32d4279158b3f730f70be7b2dc8c3037693a76e66eb3e001",
     "schemas/v2/debug-bundle.schema.json": "0bfa4b1d91fefbc12c95670dba9d5eacb72b879bb9a5c074e821ca9ed0fee6fd",
     "schemas/v2/dispatch-config.schema.json": "5718c1ed7d95672e618bcb1f1da8e38180e144b12151307afc3aba1314dfcef0",
-    "schemas/v2/effect-ledger-projection.schema.json": "928340b243c60aaf04c1b40adb09be8a90340d44f57be1dfff837be10f104822",
+    "schemas/v2/effect-ledger-projection.schema.json": "0d118d385a43921118a76888449c5c3c5618eab1b80914b84a0a1b48d18822c1",
     "schemas/v2/effect-seam-manifest.schema.json": "197ef9944ab027a50d1b9352f317cbbc12c8ad955fdb14650fb90477052ffef0",
     "schemas/v2/envelopes/clarification.request.schema.json": "9e39d7b09f0b3ce7902d6aa19ca0eb52867b634efc78a881469c4d44fb3333e7",
     "schemas/v2/envelopes/error.schema.json": "6a11fa3b9d61736fcb5675e6ac9825919aa609dceba13ef5615993d54647802b",
@@ -204,17 +204,17 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "bbcefda69bffa9fb67803c48ddc7e786866c655d8af36f73fc0e3b27e69a1917",
+    "spec/v1/core-standard-manifest.json": "c38981a02d063f68cffd5d22cf8e10390a3b12af4271e2819dc753711fc9616f",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "d91c400b704b83e65dd40dbed1c0331a6d005fdb77d3facce0eacea89c4c7f14",
+    "spec/v1/gaps.json": "e99603a9c0e14f69fc3dd5ff6269f75a7b25aa2eb28051f9e2e1758fd08265b9",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
-    "spec/v1/operation-path-manifest.json": "968c2fceb27cf76acbb14f7d250798f913bbbd3e9789dd3fb2a32c1ef536e771",
+    "spec/v1/operation-path-manifest.json": "fada0342815fb129c1ae61f1829bd6e34417717408ce86fcc54280f373c19e74",
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "ccfed7d978ce7293a6d8f3c0f6045835dfb7e488f2b67a68f6b04d67c4b0cfc9",
     "spec/v2/core/capabilities.md": "e22381fed3a93376ad478fa7f07571fdad9653aefd7c05f189a2ef45a49f6c63",
@@ -224,7 +224,7 @@
     "spec/v2/core/errors.md": "870f1a9c9481fb49c8bd39170f0656c2ae46124afd4472fb7a3c18c67be0e561",
     "spec/v2/core/events.md": "3df1866a89fb765c78adf79b8d51f96c59584dee9aa88d59179b88a681d827da",
     "spec/v2/core/form-content-packs.md": "55ea021b5f676f5851f420b3597262fbf6642108bddeb726922f8c5dd96c968b",
-    "spec/v2/core/headers.md": "38c03524e3aeea30862432d203faffb8b0b05ec65136d223e96ab06941c3717b",
+    "spec/v2/core/headers.md": "10ec6a6c3e0437b1501cb224273e86c2f6aede92fd469605f3353904d3ebd230",
     "spec/v2/core/host-services.md": "c3ff93201d642edf835e9ae84f06a17edd207f9d351f8bfd70572be05bbfd894",
     "spec/v2/core/idempotency.md": "b61d4a200526485937897dd7ebca092e68424a80624e0be7a0b7db8cdbd54403",
     "spec/v2/core/identity.md": "d15667552019f64316be9b65c6e5696c10766581405f05da3907fb47f36e6459",
@@ -291,12 +291,12 @@
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
     "spec/v2/migrations.json": "651954938a1e154c0b6f1e3dd6e105889d30de3bb65789f21de7f77a12869e9e",
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
-    "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
+    "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "c226854124edd701082c57b55c908cdf09926837611a59d00e306696a06a9b8a",
+    "spec/v2/release.json": "f8aeec2581bb0b934b2667ac72680f2caf6259b2ca7312e716598e9302573966",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "8411f06cd9888524b6d234e8d111896d8c90d06991453c9a192e7550d0b3cb9e"
+    "spec/v2/surface-baseline.json": "e2ce7ec18f217f08dd13d6ff1895ea4030b0a76965b774689fb6b52bb20b745a"
   },
-  "corpusCommit": "c92bac3ebafda0fab5a6113df67422efe428d70d"
+  "corpusCommit": "10e78e04bc0dac6cb93a0ef00eda5dc7547b4ee8"
 }

package/src/lib/carries-payload.ts

@@ -0,0 +1,42 @@
+/**
+ * Does any event's payload carry `sent`, as JSON — member order ignored?
+ *
+ * `v2-a2ui-v09-surface` asserted RFC 0209 §C.11 ("recorded surface envelopes
+ * are returned as recorded") by comparing `JSON.stringify(subtree)` with
+ * `JSON.stringify(sent)`. That comparison is ORDER-sensitive, and RFC 8259 §4
+ * gives object member order no meaning. A Postgres JSONB host returns every
+ * member and every value but re-sorts keys (shorter first, then bytewise):
+ * measured on pg16, `{version,catalogId,surfaceId,messages}` came back as
+ * `{version,messages,catalogId,surfaceId}`. So a conforming host could never
+ * pass the leg (suite 2.42.2 correction).
+ *
+ * The comparison is now between RFC 8785 (JCS) forms, the corpus's canonical
+ * JSON (`lib/jcs.ts`; conformance.md §"Canonical JSON"). JCS sorts members and
+ * fixes number and string serialization, so two values are JCS-equal exactly
+ * when they are the same JSON value. What §C.11 forbids, a regenerated or
+ * altered surface, still fails: a changed value, a dropped or added member, or
+ * a reordered ARRAY (message order is meaningful) all change the JCS form.
+ */
+
+import { canonicalJSON } from './jcs.js';
+
+/** Every subtree of `v`, depth-first. */
+function* subtrees(v: unknown): Generator<unknown> {
+  yield v;
+  if (Array.isArray(v)) for (const x of v) yield* subtrees(x);
+  else if (v && typeof v === 'object') for (const x of Object.values(v)) yield* subtrees(x);
+}
+
+/** JCS form, or null for a value JCS refuses (not I-JSON), which then matches nothing. */
+function jcs(v: unknown): string | null {
+  try { return canonicalJSON(v); } catch { return null; }
+}
+
+export function carriesPayload(events: readonly unknown[], sent: unknown): boolean {
+  const want = jcs(sent);
+  if (want === null) return false;
+  return events.some((e) => {
+    const payload = e !== null && typeof e === 'object' ? (e as Record<string, unknown>)['payload'] : undefined;
+    return [...subtrees(payload)].some((s) => jcs(s) === want);
+  });
+}

package/src/lib/certification-bundle-verify.ts

@@ -298,6 +298,9 @@ export interface ScrubResult<T> {
   readonly redactedAt: readonly string[];
 }
 
+/** A whole-string hex digest: `sha256:`-prefixed or bare, 32+ hex characters. */
+const HEX_DIGEST = /^(sha256:)?[0-9a-f]{32,}$/i;
+
 /**
  * Replace every occurrence of every secret in every string of `value` (keys
  * included) with `redactionMarker(secret)`. Empty / whitespace-only secrets
@@ -312,6 +315,16 @@ export function scrubEvidence<T>(value: T, secrets: readonly string[]): ScrubRes
   const redactedAt: string[] = [];
   if (live.length === 0) return { value, redactedAt };
   const scrubString = (s: string, path: string): string => {
+    // A string that is wholly a hex digest (a sha256, a key fingerprint) is
+    // scrubbed only when it IS a secret, never for a secret found inside it.
+    // A secret inside a digest is a coincidence, not a leak: the digest does
+    // not disclose it. Rewriting it only corrupts the evidence. Suite 2.40.3
+    // floored the env sweep after openwop-app's `…_ROTATION_OVERLAP_S=60`
+    // rewrote the "60" inside `discovery.sha256`, but an explicitly handed
+    // credential is still scrubbed whatever its shape, so a short one (or any
+    // hex one) could still hit a digest at random. This closes that class at
+    // the scrub instead of at each source of secrets.
+    if (HEX_DIGEST.test(s) && !live.includes(s)) return s;
     let out = s;
     let hit = false;
     for (const secret of live) {

package/src/lib/effect-refire.ts

@@ -0,0 +1,34 @@
+/**
+ * Which rows of a replay fork's effect ledger record an attempt the PARENT
+ * never made, i.e. a re-fire (RFC 0173 §C.2; replay.md §Suppression rule 1)?
+ *
+ * `v2-effect-seam-no-refire` used to assert `fork count ≤ parent count`. The
+ * seam fires ONE attempt on the source run, so a host that re-fires on replay
+ * records one row on the fork and reads 1 ≤ 1: the leg passed over exactly the
+ * defect it exists for. Measured: openwop-app with `sideEffecting` dropped
+ * still passed (suite 2.42.2 correction).
+ *
+ * A fork's projection may legitimately carry nothing (a host that keys the
+ * ledger per run: its fork's own ledger is empty when nothing re-fired) or the
+ * parent's rows as fixed history (a host that projects inherited attempts). So
+ * the witness is not a count. It is whether any fork row records an attempt
+ * that is not one of the parent's: an inherited row repeats a parent attempt's
+ * `(nodeId, attempt, at)`, while a re-fire is a new attempt with a new `at`.
+ * The multiset match means N inherited rows cover at most N parent rows.
+ */
+
+export interface EffectRow { readonly nodeId?: unknown; readonly attempt?: unknown; readonly at?: unknown }
+
+const key = (r: EffectRow): string => `${String(r.nodeId)}|${String(r.attempt)}|${String(r.at)}`;
+
+export function refiredAttempts(parent: readonly EffectRow[], fork: readonly EffectRow[]): EffectRow[] {
+  const available = new Map<string, number>();
+  for (const r of parent) available.set(key(r), (available.get(key(r)) ?? 0) + 1);
+  const out: EffectRow[] = [];
+  for (const r of fork) {
+    const n = available.get(key(r)) ?? 0;
+    if (n > 0) available.set(key(r), n - 1);
+    else out.push(r);
+  }
+  return out;
+}

package/src/scenarios/certification-bundle-redaction.test.ts

@@ -158,7 +158,7 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
     // Suite 2.40.2: openwop-app set OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60,
     // the name matched SECRET, and scrubEvidence rewrote the "60" inside
     // discovery.sha256 — the bundle failed ^[0-9a-f]{64}$ and main could not deploy.
-    const digest = '4b8d99c002a061a0255e8224ee683162007febadd251b2d171b47c0849695315';
+    const digest = '4b8d99c002a061a0255e8224ee683160007febadd251b2d171b47c0849695315';
     const env = {
       OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S: '60',
       OPENWOP_TOKEN_TTL_SECONDS_KEY: '86400000',

package/src/scenarios/v2-a2ui-v09-surface.test.ts

@@ -42,6 +42,7 @@ import { readErrorCode } from '../lib/error-envelope.js';
 import { FIXTURES_DIR } from '../lib/paths.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
+import { carriesPayload } from '../lib/carries-payload.js';
 
 type Json = Record<string, unknown>;
 const KIND = 'ui.a2ui-surface';
@@ -117,16 +118,9 @@ async function gate(want: (floor: number) => boolean, wantText: string): Promise
 }
 async function done(runId: string): Promise<void> { await driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}); }
 
-/** Every subtree of `v`, depth-first. */
-function* subtrees(v: unknown): Generator<unknown> {
-  yield v;
-  if (Array.isArray(v)) for (const x of v) yield* subtrees(x);
-  else if (v && typeof v === 'object') for (const x of Object.values(v)) yield* subtrees(x);
-}
-const carries = (events: unknown[], payload: unknown): boolean => {
-  const want = JSON.stringify(payload);
-  return events.some((e) => [...subtrees((e as Json)['payload'])].some((s) => JSON.stringify(s) === want));
-};
+// RFC 0209 §C.11 compares as JSON, not as text: member order carries no meaning
+// (RFC 8259 §4), and a JSONB host re-sorts it. See lib/carries-payload.ts.
+const carries = carriesPayload;
 async function eventsOf(runId: string): Promise<unknown[]> {
   const r = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`);
   const ev = (r.json as { events?: unknown } | null)?.events;
@@ -215,6 +209,8 @@ describe('RFC 0209 §A.2 — the cross-field rules are checked at admission (sea
 });
 
 describe('RFC 0209 §C.11 — recorded surfaces are returned as recorded (seam-gated)', () => {
+  // "byte-equal" in these two titles means JCS-equal (lib/carries-payload.ts). The titles
+  // are kept because they mint the rows' title ids.
   it('a recorded version-2 surface is returned byte-equal on poll and carried by a fork at a later fromSeq', async () => {
     const g = await gate((f) => f >= 2, 'a floor of at least 2');
     if (!g.ok) return softSkip(g.kind, g.reason);
@@ -225,7 +221,7 @@ describe('RFC 0209 §C.11 — recorded surfaces are returned as recorded (seam-g
       expect(r.status, req('openwop.it.v2-a2ui-v09-surface.recorded-as-recorded', 'RFC 0209 §C.11', `the positive surface MUST be admitted, got ${code(r)}`)).toBe(201);
       const sequence = (r.json as { sequence: number }).sequence;
       const events = await eventsOf(runId);
-      expect(carries(events, payload), req('openwop.it.v2-a2ui-v09-surface.recorded-as-recorded', 'RFC 0209 §C.11', 'the run\'s poll MUST return the recorded surface payload byte-equal — no surface is regenerated')).toBe(true);
+      expect(carries(events, payload), req('openwop.it.v2-a2ui-v09-surface.recorded-as-recorded', 'RFC 0209 §C.11', 'the run\'s poll MUST return the recorded surface payload unchanged as JSON (JCS-equal; member order carries no meaning) — no surface is regenerated')).toBe(true);
       // The surface is the last event of the suspended run, so `sequence + 1`
       // names no event and runs.md §Fork REQUIRES 422 fork_point_invalid for it.
       // Record one more envelope on the same surface and fork AT that event:
@@ -250,7 +246,7 @@ describe('RFC 0209 §C.11 — recorded surfaces are returned as recorded (seam-g
       const r = await emit(runId, envelope(1, V1_SURFACE));
       expect(r.status, req('openwop.requirement.0209.legacy-readable', 'RFC 0209 §C.11', `a version-1 surface at floor 1 MUST be admitted, got ${code(r)}`)).toBe(201);
       const sequence = (r.json as { sequence: number }).sequence;
-      expect(carries(await eventsOf(runId), V1_SURFACE), req('openwop.requirement.0209.legacy-readable', 'RFC 0209 §C.11', 'the poll MUST return the version-1 surface byte-equal')).toBe(true);
+      expect(carries(await eventsOf(runId), V1_SURFACE), req('openwop.requirement.0209.legacy-readable', 'RFC 0209 §C.11', 'the poll MUST return the version-1 surface unchanged as JSON (JCS-equal)')).toBe(true);
       // As in the version-2 leg: fork at a recorded event after the surface, never at `sequence + 1` (no such event; 422 fork_point_invalid).
       const later = await emit(runId, envelope(1, V1_LATER));
       expect(later.status, req('openwop.requirement.0209.legacy-readable', 'RFC 0209 §C.11', `a second version-1 surface at floor 1 MUST be admitted (it supplies the fork point), got ${code(later)}`)).toBe(201);

package/src/scenarios/v2-effect-identity-business-key.test.ts

@@ -122,11 +122,25 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
       keys.size,
       req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt of one effect MUST present the same provider key across a transport retry — ${attempts.length} attempt(s) presented ${keys.size} distinct key(s)`),
     ).toBe(1);
+    // idempotency.md §Layer 2: business identity is the rule, and the activity
+    // recipe is "the fallback for a provider with no business key". The seam's
+    // effect is a POST to a suite-chosen providerUrl, which has no business key,
+    // so `activity-recipe` is the CONFORMANT keying here. Until 2.42.2 this leg
+    // demanded `business-identity` on every attempt, which is stricter than the
+    // spec, and a host honestly declaring the fallback failed. What the spec does
+    // require of a retry is one effect, one key: every attempt carries a documented
+    // keying, and the SAME one. A host that switches modes between attempts has
+    // re-derived the effect's identity mid-flight.
+    const keyings = new Set(attempts.map((a) => String(a['keying'])));
     for (const a of attempts) {
       expect(
-        a['keying'],
-        req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `a Layer-2 host keys a retried effect on business identity, not the activity recipe (attempt ${String(a['attempt'])})`),
-      ).toBe('business-identity');
+        KEYING,
+        req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt MUST declare a documented keying — business-identity, or activity-recipe for a provider with no business key (attempt ${String(a['attempt'])} declares ${String(a['keying'])})`),
+      ).toContain(a['keying']);
     }
+    expect(
+      keyings.size,
+      req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt of one effect MUST declare the same keying — ${attempts.length} attempt(s) declared ${[...keyings].join(', ')}`),
+    ).toBe(1);
   });
 });

package/src/scenarios/v2-effect-seam-no-refire.test.ts

@@ -3,8 +3,9 @@
  * on `replay`, driven through the seams profile).
  *
  * A guarded manifest row that states `branchReFires: false` MUST NOT be fired
- * again by a replay fork: the fork's Layer-2 effect ledger cannot grow past the
- * parent's for that seam. The witness is the host's own ledger, reached by
+ * again by a replay fork: the fork's Layer-2 effect ledger records no attempt
+ * the parent did not make (suite 2.42.2; until then "cannot grow past the
+ * parent's", which a one-attempt source let a re-firing host pass at 1 ≤ 1). The witness is the host's own ledger, reached by
  * firing a named manifest row inside a run through the catalogued seam
  * (`api/seams-v2.yaml` `fireEffectSeam`), forking in `replay` mode, and reading
  * `GET /runs/{runId}/effects` on both.
@@ -28,6 +29,7 @@ import { v2Discovery, gateFamily } from '../lib/v2.js';
 import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
+import { refiredAttempts, type EffectRow } from '../lib/effect-refire.js';
 
 const MANIFEST_PATH = '/host/effect-seams';
 
@@ -115,9 +117,20 @@ describe('RFC 0173 §C.2 — effect-seam-no-refire (gated on replay, seam-driven
     }
     const forkEffects = await driver.get(`/runs/${encodeURIComponent(String(forkBody.runId))}/effects`);
     if (forkEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${forkEffects.status} on the replay fork`);
+    // Not a count comparison. The seam fires ONE attempt, so a host that
+    // re-fires on replay reads 1 on the fork and `fork <= parent` passed it:
+    // measured, openwop-app with `sideEffecting` dropped still passed (suite
+    // 2.42.2). The witness is whether the fork records any attempt the parent
+    // never made (lib/effect-refire.ts): inherited history repeats a parent
+    // attempt, a re-fire is a new one.
+    const rowsOf = (r: OpenWOPResponse): EffectRow[] => {
+      const b = r.json as { effects?: unknown } | null;
+      return Array.isArray(b?.effects) ? (b.effects as EffectRow[]) : [];
+    };
+    const refired = refiredAttempts(rowsOf(parentEffects), rowsOf(forkEffects));
     expect(
-      countOf(forkEffects),
-      req('openwop.requirement.0173.effect-seam-no-refire', 'spec/v2/core/replay.md §Suppression', `seam ${String(target.seam)} is guarded, so a replay fork MUST NOT issue a further attempt through it — suppression is unconditional for mode: replay (§Suppression rule 1) and does not depend on branchReFires, which states only what a BRANCH may re-fire (§Branch: a host "MUST NOT report that as replay suppression"). The fork's effect ledger (${countOf(forkEffects)}) cannot exceed the parent's (${countOf(parentEffects)})`),
-    ).toBeLessThanOrEqual(countOf(parentEffects));
+      refired.length,
+      req('openwop.requirement.0173.effect-seam-no-refire', 'spec/v2/core/replay.md §Suppression', `seam ${String(target.seam)} is guarded, so a replay fork MUST NOT issue a further attempt through it — suppression is unconditional for mode: replay (§Suppression rule 1) and does not depend on branchReFires, which states only what a BRANCH may re-fire (§Branch: a host "MUST NOT report that as replay suppression"). The fork's ledger records ${refired.length} attempt(s) the parent never made: ${JSON.stringify(refired).slice(0, 300)}`),
+    ).toBe(0);
   });
 });