@openwop/openwop-conformance 2.42.1 → 2.42.3

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.42.3] — 2026-09-27 — the unfailable-leg audit: 19 legs a non-conforming host could pass now measure their requirement
+
+- **The unfailable-leg audit: 19 legs that a non-conforming host could pass now measure their requirement.** A scanner (`scripts/audit-unfailable-legs.mjs`, an audit aid, not a gate) flagged 66 legs that witness an Accepted RFC's Falsifiability row and have a shape this corpus has shipped as a defect before: satisfiable bounds (the 1 ≤ 1 no-refire leg), loops over a possibly empty list, `if`-guarded assertions, always-defined checks, and the host's own ledger as the only witness. A reviewer judged each one against a single bar: would a host that breaks the rule record `executed-pass`?
+  - **Confirmed and fixed (12):**
+    - `0173.effect-identity-business-key`: a no-op run's empty ledger passed on setup asserts.
+    - `.retry`: an omitted `providerKey` folded to `''`, so "one distinct key" passed.
+    - `0205.artifact-url-part-scoped`: a 3xx to a public pre-signed URL passed.
+    - `0176.era-2-append-vocabulary`: cancel appends names that are the same in v1 and v2, so the writer rule was never tested. It now records `blocked` unless a renamed type is appended. Its `era` leg now requires `eventLogSchemaVersion`.
+    - `0171.poll-cursor-v2.shape`: `lastSequence` must equal the log's highest sequence, and `status`/`isTerminal` must say terminal.
+    - `0173.webhook-durable-delivery`: exponential backoff must actually grow, second gap ≥ 1.5× the first.
+    - `0175.mrtr-rounds-ceiling.refused`: the refusal must come at the ceiling, not before it.
+    - `0215.no-head-of-line`: a serial dispatcher with a short timeout passed as a partial witness. It now fails below the concurrency floor and is otherwise `blocked`.
+    - `0187.bound-id-kinds.per-kind`, effectId/deliveryId: no-op runs record `inapplicable` before any assertion.
+    - `0173.effect-seam-manifest`: removed a loop that could not fail.
+    - RFC 0173 cites `effect-seam-no-refire` for replay suppression.
+    - RFC 0186 says its row is a schema-validation witness.
+  - **Plausible, tightened (7):**
+    - `0201.message-id-stable`: all four delivery keys are required, otherwise `blocked`.
+    - `0169.profiles-derived-only`: records need `status`, `since` and `witness`; a tautology is removed.
+    - `0200.inbound-credential-no-passthrough`: waits for THIS run's delivery.
+    - `0168.advertised-fixtures-exist`: samples across the whole list.
+    - `0198.task-update-approver-checked`: polls about 3 s rather than one 750 ms read.
+    - `0201.endpoint-verification`: a late echo control and a scaled grace; a missing control is `blocked`.
+    - `0207.a2a-malformed-ignored`: the task must not fail or be rejected.
+  - **Not defects:** 47 of the 66 flags; each reviewer recorded its reason.
+  - **Measured against the v2 reference host** (loopback regression lane) before merge.
+- **RFC 0217 gap G1 closes in the contract peer.** `spec/v1/gaps.json` records MyndHyve's certified production witness of `0217.dead-letter-read-after-unregister` (openwop#1631). No scenario change.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.42.3` because `2.42.2` is tagged. Not tagged, not published.
+
+## [2.42.2] — 2026-09-26 — four conformance legs now measure what their spec says: effect re-fire, keying fallback, A2UI JSON values, digest-safe scrubbing
+
+- **`0173.effect-seam-no-refire` can detect a re-fire.** The leg asserted that the replay fork's ledger count was at most the parent's. The seam fires one attempt on the source run, so a host that re-fires on replay read 1 ≤ 1 and passed, over exactly the defect the leg exists for. ws3 measured it: openwop-app with `sideEffecting` dropped still passed. The leg now fails if the fork records any attempt the parent never made, using the new `lib/effect-refire.ts`. An inherited row repeats a parent attempt's `(nodeId, attempt, at)`, while a re-fire is a new attempt, and one parent row covers at most one fork row. A host whose fork projection is empty passes, as does one that projects the parent's attempts as history. The `effect-ledger-projection` schema description, which said the scenario "compares row COUNTS", is corrected. New suite self-test `src/lib/effect-refire.test.ts` uses a re-firing host stub as its first leg. It is sabotage-proved: with the old count rule restored, that leg fails.
+- **RFC 0209 §C.11 compares JSON values, not JSON text, so a JSONB host can pass.** In `v2-a2ui-v09-surface`, `carries()` compared `JSON.stringify(subtree) === JSON.stringify(sent)`, which is order-sensitive. RFC 8259 §4 gives object member order no meaning, and a Postgres JSONB host re-sorts keys. ws5 measured `{version,catalogId,surfaceId,messages}` coming back as `{version,messages,catalogId,surfaceId}` on pg16. So `recorded-as-recorded` and `0209.legacy-readable` could never pass on a conforming JSONB host. The comparison now uses RFC 8785 (JCS) forms, via the new `lib/carries-payload.ts` built on `lib/jcs.ts`. A changed value, an added or dropped member, and reordered messages still fail. New suite self-test `src/lib/carries-payload.test.ts` covers the measured reordering as the positive leg and four negative controls. It is sabotage-proved: with the text comparison restored, the reordering leg fails. RFC 0209 carries a dated correction note. A sweep of every scenario for `JSON.stringify` equality found no other comparison of a suite-sent payload with a host-returned one. The rest compare two answers from the same host and route (`tools/list` twice, source vs fork, `v1` vs `v2` discovery), or arrays of numbers.
+- **The 0173 retry leg accepts the keying the spec allows.** `v2-effect-identity-business-key` demanded `keying: business-identity` on every retried attempt. `idempotency.md` §Layer 2 makes the activity recipe "the fallback for a provider with no business key", and the seam's effect (a POST to a suite-chosen `providerUrl`) has none. So a host honestly declaring `activity-recipe` failed a rule the spec does not state. The leg now requires every attempt to declare a documented keying, the same one across attempts, and the same provider key. The last check was already there and is unchanged. Raised by openwop-app, whose seam began writing one ledger row per attempt.
+- **`scrubEvidence` never rewrites inside a hex digest.** 2.40.3 stopped the environment sweep from collecting short and bare-integer values, after openwop-app's `OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60` rewrote the "60" inside `discovery.sha256`. That failed the host's certify at random, roughly one bundle in five. But a credential the emitter hands over explicitly is still scrubbed whatever its shape, so the scrub itself could still corrupt a digest. A string that is wholly a hex digest (32+ hex characters, bare or `sha256:`-prefixed) is now left untouched unless it IS a secret. A secret inside a digest is a coincidence, not a leak, and rewriting it only breaks the evidence. A real leak in any other string is still redacted. Name classification needs no separate rule: a `*_S` / `*_MS` / `*_SECONDS` setting is a bare integer, which 2.40.3's floor already excludes. New suite self-test `src/lib/scrub-evidence-digest.test.ts` hands the scrub secrets that are substrings of a digest and asserts the digest survives while a neighbouring leak is redacted. It is sabotage-proved: without the guard, two of its three legs fail. **The 2.40.3 redaction leg was vacuous:** its fixture digest contained no "60", so it passed whether or not the value was scrubbed. The fixture now contains one.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.42.2` because `2.42.1` is tagged, and this cycle changes a shipped file: `spec/v1/gaps.json` records RFC 0111 gap G5 `closed` (RFC 0111 `Accepted`, witnessed by MyndHyve on 2.42.1). No scenario, schema or `MUST` change. Not tagged, not published.
+
 ## [2.42.1] — 2026-09-26 — RFC 0111's live witness scenarios outlast a real host, and the MCP run-transport leg identifies its own run
 
 - **RFC 0111's live scenarios no longer die at vitest's 30 s default.** `context-budget-transcript-bound` and `context-summarization-replay` drive the live-model fixture `conformance-context-budget-live` (six real model turns and six child runs; 30–40 s per run on MyndHyve production, 2026-09-26), and the global `testTimeout: 30_000` killed both before any assertion — which `OPENWOP_POLL_TIMEOUT_SCALE` could not reach. Each now carries a per-test timeout from `liveScenarioTimeoutMs(runs)` (`src/lib/polling.ts`: the scaled sum of `LIVE_RUN_POLL_MS` = 180 s per run plus 60 s for seam reads — 240 s / 420 s at scale 1) and polls with `{ timeoutMs: LIVE_RUN_POLL_MS }`, so the named poll deadline always fires before the test deadline, at every scale. The global timeout is unchanged. Self-test: `src/lib/polling.test.ts` (3 new); an unscaled helper fails 2 of them and a 30 s helper 3.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.1 @openwop/spec-artifacts@2.42.1
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.3 @openwop/spec-artifacts@2.42.3
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/coverage.md

@@ -269,6 +269,7 @@ Every OpenAPI operation should have:
 | `putTestPackTarball`, `getTestPackTarball`, `deleteTestPackVersion`, `getTestPackSignature` | `pack-registry-publish.test.ts` covers the 19-code publish error catalog through the RFC 0025 `/v1/packs-test/*` mirror namespace, gated on `capabilities.packs.testMode.supported: true` (RFC 0025 §A). 26 scenarios soft-skip when the advertisement is absent; when present, the suite exercises URL/scope, body-shape, tarball-extraction, manifest-contents, integrity, auth/conflict, unpublish-window, and signature-endpoint pairing. | Soft-skip on advertisement absence; behavioral on advertisement presence                                                                                                                                                                                                                  | Add real-tarball-builder fixtures so the manifest_mismatch / pack_integrity_failure / unsupported_runtime branches assert against a meaningful gzip+tar payload (currently soft-skipped with explanatory comments). |
 | `getContentPage` | `localized-content-delivery.test.ts` (RFC 0103 §D) — always-on `localized-content-page-response.schema.json` shape + the §C `resolveSection` merge; gated live legs assert negotiated delivery + `Content-Language`. Public (anonymous-capable) endpoint, `security: []`. | Gated behavioral legs: published-only delivery, tenant isolation, no cross-tenant enumeration (`content-no-cross-tenant-enumeration`); cross-tenant slug → same `404`. | Behavioral legs soft-skip without a live `GET /v1/content/pages/{slug}`; non-vacuous against openwop-app + MyndHyve. |
 | `listContentPages`, `createContentPage` | `localized-content-delivery.test.ts` (RFC 0103 §D) — `localized-content-page.schema.json` shape + §A coherence. | Protected admin ops document `401`/`403`; create documents `400`. Tenant-scoped (`content-response-tenant-scoped`). | Behavioral list/create round-trip pending a host admin seam. |
+| `deleteContentPage` | No leg asserts it. `v2-content-locale-keys.test.ts` calls it only as best-effort cleanup, and its result is not asserted (RFC 0103 §D; added to the contract 2026-09-26). | `401`/`403`/`404`; `204` with no body. The same `404` for a `pageId` outside the caller's tenant (§F). | Uncovered. A behavioral delete (the page, its sections and its overlays are gone, and delivery answers `404`) is pending a host admin seam. The other four §D admin operations have no contract yet (RFC 0103 gap G12). |
 | `putContentSection` | `localized-content-delivery.test.ts` (RFC 0103 §D) — `localized-content-section.schema.json` shape + the locale-targeted write body. | `401`/`403`/`404`/`400`; base-locale key + bad-key-case negatives. | Behavioral locale-targeted upsert pending a host admin seam. |
 | `getContentSettings`, `putContentSettings` | `localized-content-delivery.test.ts` (RFC 0103 §B) — `localized-content-language-settings.schema.json` shape (base ∉ supported). | `401`/`403`; put documents `400` for the base ∈ supported violation. | Behavioral settings round-trip pending a host admin seam. |
 

package/dist/lib/certification-bundle-verify.js

@@ -208,6 +208,8 @@ export function verifyBundleV2(bundle) {
 export function redactionMarker(secret) {
     return `«redacted:${createHash('sha256').update(secret).digest('hex').slice(0, 12)}»`;
 }
+/** A whole-string hex digest: `sha256:`-prefixed or bare, 32+ hex characters. */
+const HEX_DIGEST = /^(sha256:)?[0-9a-f]{32,}$/i;
 /**
  * Replace every occurrence of every secret in every string of `value` (keys
  * included) with `redactionMarker(secret)`. Empty / whitespace-only secrets
@@ -223,6 +225,17 @@ export function scrubEvidence(value, secrets) {
     if (live.length === 0)
         return { value, redactedAt };
     const scrubString = (s, path) => {
+        // A string that is wholly a hex digest (a sha256, a key fingerprint) is
+        // scrubbed only when it IS a secret, never for a secret found inside it.
+        // A secret inside a digest is a coincidence, not a leak: the digest does
+        // not disclose it. Rewriting it only corrupts the evidence. Suite 2.40.3
+        // floored the env sweep after openwop-app's `…_ROTATION_OVERLAP_S=60`
+        // rewrote the "60" inside `discovery.sha256`, but an explicitly handed
+        // credential is still scrubbed whatever its shape, so a short one (or any
+        // hex one) could still hit a digest at random. This closes that class at
+        // the scrub instead of at each source of secrets.
+        if (HEX_DIGEST.test(s) && !live.includes(s))
+            return s;
         let out = s;
         let hit = false;
         for (const secret of live) {

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.1",
-  "stampSha256": "f71d4bdee95ce4bb80f65ffb6ace46bc5fb62db3456131531ad31caa1040c944"
+  "version": "2.42.3",
+  "stampSha256": "06eaa8ddc41c7ab3bb1af3b2b6b3566042a92b50a2249914946657c16490896d"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.42.1",
+  "version": "2.42.3",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.42.1"
+    "@openwop/spec-artifacts": "2.42.3"
   }
 }

package/requirements.json

@@ -14752,7 +14752,7 @@
     {
       "id": "openwop.it.inbound-credential-no-passthrough.no-webhook-delivery-carries-the-caller-s-authorization-cookie-or-proxy-authoriza",
       "file": "inbound-credential-no-passthrough.test.ts",
-      "line": 70,
+      "line": 71,
       "title": "no webhook delivery carries the caller's Authorization, Cookie or Proxy-Authorization",
       "explicitId": "openwop.requirement.0200.inbound-credential-no-passthrough",
       "citations": [
@@ -27246,7 +27246,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-2-envelope-carrying-a-version-1-body-is-refused-the-positive-is-admitt",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 137,
+      "line": 131,
       "title": "a version-2 envelope carrying a version-1 body is refused; the positive is admitted; above the floor is refused; below it follows envelopeStrictness",
       "explicitId": "openwop.requirement.0209.version-selects-branch",
       "citations": [
@@ -27290,7 +27290,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.no-first-createsurface-a-message-after-deletesurface-and-a-second-createsurface",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 163,
+      "line": 157,
       "title": "no first createSurface, a message after deleteSurface, and a second createSurface are each refused; the valid steps are admitted",
       "explicitId": "openwop.requirement.0209.fold-guarded",
       "citations": [
@@ -27304,7 +27304,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-createsurface-catalogid-differing-from-the-payload-catalogid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 188,
+      "line": 182,
       "title": "a createSurface.catalogId differing from the payload catalogId is refused",
       "explicitId": "openwop.requirement.0209.catalog-equality",
       "citations": [
@@ -27322,7 +27322,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-message-whose-surfaceid-differs-from-the-payload-surfaceid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 202,
+      "line": 196,
       "title": "a message whose surfaceId differs from the payload surfaceId is refused",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.surface-id-equality",
       "citations": [
@@ -27340,7 +27340,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-recorded-version-2-surface-is-returned-byte-equal-on-poll-and-carried-by-a-for",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 218,
+      "line": 214,
       "title": "a recorded version-2 surface is returned byte-equal on poll and carried by a fork at a later fromSeq",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.recorded-as-recorded",
       "citations": [
@@ -27351,7 +27351,7 @@
         },
         {
           "section": "RFC 0209 §C.11",
-          "requirement": "the run's poll MUST return the recorded surface payload byte-equal — no surface is regenerated"
+          "requirement": "the run's poll MUST return the recorded surface payload unchanged as JSON (JCS-equal; member order carries no meaning) — no surface is regenerated"
         },
         {
           "section": "RFC 0209 §C.9",
@@ -27377,7 +27377,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-1-surface-recorded-at-floor-1-is-returned-byte-equal-on-poll-and-carri",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 245,
+      "line": 241,
       "title": "a version-1 surface recorded at floor 1 is returned byte-equal on poll and carried by a fork",
       "explicitId": "openwop.requirement.0209.legacy-readable",
       "citations": [
@@ -27388,7 +27388,7 @@
         },
         {
           "section": "RFC 0209 §C.11",
-          "requirement": "the poll MUST return the version-1 surface byte-equal"
+          "requirement": "the poll MUST return the version-1 surface unchanged as JSON (JCS-equal)"
         },
         {
           "section": "RFC 0209 §C.11",
@@ -27414,7 +27414,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.one-untrusted-update-taints-a-trusted-surface-a-later-trusted-update-does-not-la",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 269,
+      "line": 265,
       "title": "one untrusted update taints a trusted surface, a later trusted update does not launder it, and the approval does not advance; an all-trusted surface does",
       "explicitId": "openwop.requirement.0209.taint-sticky",
       "citations": [
@@ -27428,7 +27428,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.records-why-render-needs-root-has-no-server-side-witness-and-where-its-witness-l",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 308,
+      "line": 304,
       "title": "records why render-needs-root has no server-side witness, and where its witness lives",
       "explicitId": "openwop.requirement.0209.render-needs-root",
       "citations": [
@@ -27568,7 +27568,7 @@
     {
       "id": "openwop.it.v2-artifact-a2a-shape.records-why-export-alias-equivalence-has-no-wire-witness",
       "file": "v2-artifact-a2a-shape.test.ts",
-      "line": 132,
+      "line": 138,
       "title": "records why export-alias-equivalence has no wire witness",
       "explicitId": "openwop.requirement.0205.export-alias-equivalence",
       "citations": [
@@ -27753,7 +27753,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.deliveryid-every-record-in-the-dead-letter-read-carries-a-bound-id-in-the-caller",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 230,
+      "line": 235,
       "title": "deliveryId: every record in the dead-letter read carries a bound id in the caller's tenant",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.per-kind",
       "citations": [
@@ -28805,10 +28805,20 @@
     {
       "id": "openwop.it.v2-effect-identity-business-key.the-same-provider-key-is-presented-across-two-transport-retries",
       "file": "v2-effect-identity-business-key.test.ts",
-      "line": 96,
+      "line": 107,
       "title": "the same provider key is presented across two transport retries",
       "explicitId": "openwop.requirement.0173.effect-identity-business-key.retry",
       "citations": [
+        {
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
           "requirement": null,
@@ -28861,11 +28871,6 @@
           "requirement": null,
           "interpolated": true
         },
-        {
-          "section": "RFC 0173 §C.1",
-          "requirement": null,
-          "interpolated": true
-        },
         {
           "section": "effect-seam-manifest.schema.json seams[].branchReFires",
           "requirement": null,
@@ -28876,7 +28881,7 @@
     {
       "id": "openwop.it.v2-effect-seam-manifest.the-replay-facet-names-the-manifest-address-as-the-constant-host-effect-seams",
       "file": "v2-effect-seam-manifest.test.ts",
-      "line": 118,
+      "line": 112,
       "title": "the replay facet names the manifest address as the constant /host/effect-seams",
       "explicitId": "openwop.requirement.0173.effect-seam-manifest.facet",
       "citations": [
@@ -28889,7 +28894,7 @@
     {
       "id": "openwop.it.v2-effect-seam-no-refire.driving-one-seam-of-each-kind-observes-no-re-fire-on-replay",
       "file": "v2-effect-seam-no-refire.test.ts",
-      "line": 42,
+      "line": 44,
       "title": "driving one seam of each kind observes no re-fire on replay",
       "explicitId": "openwop.requirement.0173.effect-seam-no-refire",
       "citations": [
@@ -28976,7 +28981,7 @@
     {
       "id": "openwop.it.v2-era-2-append-vocabulary.the-run-keeps-the-era-it-was-created-with-an-append-does-not-promote-it-to-era-3",
       "file": "v2-era-2-append-vocabulary.test.ts",
-      "line": 133,
+      "line": 165,
       "title": "the run keeps the era it was created with; an append does not promote it to era 3",
       "explicitId": "openwop.requirement.0176.era-2-append-vocabulary",
       "citations": [
@@ -29583,13 +29588,23 @@
         {
           "section": "spec/v2/core/interop.md §\"Trace context\" (RFC 0207)",
           "requirement": "SendMessage MUST answer a normal result"
+        },
+        {
+          "section": "spec/v2/core/interop.md §\"Trace context\" (RFC 0207)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interop.md §\"Trace context\" (RFC 0207)",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
     {
       "id": "openwop.it.v2-interop-trace-context.a2a-interface-metadata-openwop-traceparent-is-the-parent-not-the-transport-heade",
       "file": "v2-interop-trace-context.test.ts",
-      "line": 335,
+      "line": 358,
       "title": "A2A interface: metadata.openwop.traceparent is the parent, not the transport header",
       "explicitId": "openwop.requirement.0207.a2a-inbound-adopts",
       "citations": [
@@ -30493,7 +30508,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-mount-that-lists-the-tasks-extension-in-server-discover-also-lists-extensions",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 247,
+      "line": 248,
       "title": "a mount that lists the Tasks extension in server/discover also lists extensions in mcp.features",
       "explicitId": "openwop.requirement.0198.advertised-via-discover",
       "citations": [
@@ -30507,7 +30522,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-tools-call-declaring-the-extension-on-a-run-that-is-not-terminal-is-answered-c",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 254,
+      "line": 255,
       "title": "a tools/call declaring the extension on a run that is not terminal is answered CreateTaskResult",
       "explicitId": "openwop.requirement.0198.task-when-nonterminal",
       "citations": [
@@ -30546,7 +30561,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.taskid-is-the-run-id-in-its-projected-wire-form-with-an-opaque-segment-of-at-lea",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 274,
+      "line": 275,
       "title": "taskId is the run id in its projected wire form, with an opaque segment of at least 22 characters",
       "explicitId": "openwop.requirement.0198.task-id-is-run-id",
       "citations": [
@@ -30570,7 +30585,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.tasks-get-projects-input-required-keyed-by-interruptid-and-a-failed-run-as-compl",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 290,
+      "line": 291,
       "title": "tasks/get projects input_required keyed by interruptId, and a failed run as completed with isError true",
       "explicitId": "openwop.requirement.0198.task-status-projection",
       "citations": [
@@ -30602,7 +30617,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.tasks-update-answered-twice-resolves-the-interrupt-once-and-the-task-completes",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 313,
+      "line": 314,
       "title": "tasks/update answered twice resolves the interrupt once and the task completes",
       "explicitId": "openwop.requirement.0198.task-update-resolves-once",
       "citations": [
@@ -30630,7 +30645,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-tasks-update-from-a-caller-not-in-approverslist-resolves-nothing",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 333,
+      "line": 334,
       "title": "a tasks/update from a caller not in approversList resolves nothing",
       "explicitId": "openwop.requirement.0198.task-update-approver-checked",
       "citations": [
@@ -30658,7 +30673,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.tasks-get-appends-nothing-to-the-run-log",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 352,
+      "line": 365,
       "title": "tasks/get appends nothing to the run log",
       "explicitId": "openwop.requirement.0198.task-get-read-only",
       "citations": [
@@ -30672,7 +30687,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.an-unreadable-task-is-answered-32602-exactly-as-a-nonexistent-one",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 367,
+      "line": 380,
       "title": "an unreadable task is answered -32602 exactly as a nonexistent one",
       "explicitId": "openwop.requirement.0198.task-unreadable-not-found",
       "citations": [
@@ -30704,7 +30719,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-subscriptions-listen-acknowledgement-leaves-out-a-task-the-caller-cannot-read",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 400,
+      "line": 413,
       "title": "a subscriptions/listen acknowledgement leaves out a task the caller cannot read",
       "explicitId": "openwop.requirement.0198.listen-omits-unreadable",
       "citations": [
@@ -30732,7 +30747,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.tasks-cancel-cancels-the-run-on-a-terminal-task-it-is-acknowledged-and-appends-n",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 422,
+      "line": 435,
       "title": "tasks/cancel cancels the run; on a terminal task it is acknowledged and appends nothing",
       "explicitId": "openwop.requirement.0198.task-cancel-cancels-run",
       "citations": [
@@ -30764,7 +30779,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-client-disconnect-before-the-host-answers-a-task-less-tools-call-cancels-the-r",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 441,
+      "line": 454,
       "title": "a client disconnect before the host answers a task-less tools/call cancels the run it started",
       "explicitId": "openwop.requirement.0198.disconnect-cancels-run",
       "citations": [
@@ -30787,7 +30802,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-disconnect-after-createtaskresult-never-affects-the-run",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 461,
+      "line": 474,
       "title": "a disconnect after CreateTaskResult never affects the run",
       "explicitId": "openwop.requirement.0198.task-survives-disconnect",
       "citations": [
@@ -30806,7 +30821,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-blocking-tools-call-on-an-sse-stream-whose-run-is-cancelled-carries-no-notific",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 476,
+      "line": 489,
       "title": "a blocking tools/call on an SSE stream whose run is cancelled carries no notifications/cancelled and ends isError true",
       "explicitId": "openwop.requirement.0198.no-server-cancelled",
       "citations": [
@@ -30912,6 +30927,11 @@
           "requirement": null,
           "interpolated": true
         },
+        {
+          "section": "interop.md §The MCP round ceiling",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "interop.md §The MCP round ceiling",
           "requirement": null,
@@ -31675,7 +31695,7 @@
     {
       "id": "openwop.it.v2-poll-cursor-v2.the-response-is-the-closed-runid-events-lastsequence-status-isterminal",
       "file": "v2-poll-cursor-v2.test.ts",
-      "line": 60,
+      "line": 65,
       "title": "the response is the closed { runId, events, lastSequence, status, isTerminal }",
       "explicitId": "openwop.requirement.0171.poll-cursor-v2.shape",
       "citations": [
@@ -31709,14 +31729,24 @@
         },
         {
           "section": "spec/v2/core/events.md §Poll",
-          "requirement": "lastSequence MUST equal the highest sequence returned when the response carries the whole log"
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/events.md §Poll",
+          "requirement": "isTerminal is whether the run is terminal: the run was observed terminal, so isTerminal MUST be true"
+        },
+        {
+          "section": "spec/v2/core/events.md §Poll",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
     {
       "id": "openwop.it.v2-poll-cursor-v2.omitting-the-cursor-returns-from-the-first-event-sequence-0",
       "file": "v2-poll-cursor-v2.test.ts",
-      "line": 77,
+      "line": 100,
       "title": "omitting the cursor returns from the first event (sequence 0)",
       "explicitId": "openwop.requirement.0171.poll-cursor-v2.from-first",
       "citations": [
@@ -31729,7 +31759,7 @@
     {
       "id": "openwop.it.v2-poll-cursor-v2.aftersequence-n-returns-only-events-with-sequence-n",
       "file": "v2-poll-cursor-v2.test.ts",
-      "line": 87,
+      "line": 110,
       "title": "afterSequence=N returns only events with sequence > N",
       "explicitId": "openwop.requirement.0171.poll-cursor-v2.after-sequence",
       "citations": [
@@ -31751,7 +31781,7 @@
     {
       "id": "openwop.it.v2-poll-cursor-v2.a-cursor-past-the-end-of-the-log-returns-200-with-an-empty-events-array",
       "file": "v2-poll-cursor-v2.test.ts",
-      "line": 121,
+      "line": 144,
       "title": "a cursor past the end of the log returns 200 with an empty events array",
       "explicitId": "openwop.requirement.0171.poll-cursor-v2.past-end",
       "citations": [
@@ -31835,7 +31865,7 @@
     {
       "id": "openwop.it.v2-profiles-derived-only.the-v2-document-carries-no-root-profiles",
       "file": "v2-profiles-derived-only.test.ts",
-      "line": 43,
+      "line": 48,
       "title": "the v2 document carries no root `profiles[]`",
       "explicitId": "openwop.requirement.0169.profiles-derived-only.no-root-profiles",
       "citations": [
@@ -31848,7 +31878,7 @@
     {
       "id": "openwop.it.v2-profiles-derived-only.every-registry-profile-is-derivable-from-the-document-the-discovery-core-predica",
       "file": "v2-profiles-derived-only.test.ts",
-      "line": 49,
+      "line": 54,
       "title": "every registry profile is derivable from the document; the discovery-core predicate holds on a valid document",
       "explicitId": "openwop.requirement.0169.profiles-derived-only.derivable",
       "citations": [
@@ -31861,11 +31891,6 @@
           "requirement": null,
           "interpolated": true
         },
-        {
-          "section": "spec/v2/core/capabilities.md §7",
-          "requirement": null,
-          "interpolated": true
-        },
         {
           "section": "spec/v2/core/capabilities.md §7",
           "requirement": "openwop-discovery-core (metadata protocolVersions + preferredVersion, both REQUIRED at the root) MUST derive true from every valid v2 document"
@@ -33222,7 +33247,7 @@
     {
       "id": "openwop.requirement.0215.no-head-of-line",
       "file": "v2-webhook-delivery-isolation.test.ts",
-      "line": 111,
+      "line": 113,
       "title": null,
       "explicitId": "openwop.requirement.0215.no-head-of-line",
       "citations": [
@@ -33251,7 +33276,8 @@
         },
         {
           "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
-          "requirement": "the held subscriptions' attempts MUST have been dispatched"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
@@ -33353,6 +33379,11 @@
           "requirement": null,
           "interpolated": true
         },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "webhooks.md §Surfaces",
           "requirement": "DELETE /webhooks/{webhookId} MUST answer 204"
@@ -33362,7 +33393,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 360,
+      "line": 376,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
@@ -33396,7 +33427,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 454,
+      "line": 470,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -33409,7 +33440,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.after-unregister-the-dead-letter-read-answers-404-not-found-as-for-a-subscriptio",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 475,
+      "line": 491,
       "title": "after unregister, the dead-letter read answers 404 not_found, as for a subscription that never existed",
       "explicitId": "openwop.requirement.0217.dead-letter-read-after-unregister",
       "citations": [
@@ -33436,7 +33467,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 508,
+      "line": 524,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
@@ -33473,7 +33504,7 @@
     {
       "id": "openwop.it.v2-webhook-endpoint-verification.no-echo-wrong-echo-and-a-redirect-are-refused-and-persist-nothing-an-echo-is-acc",
       "file": "v2-webhook-endpoint-verification.test.ts",
-      "line": 64,
+      "line": 68,
       "title": "no-echo, wrong-echo and a redirect are refused and persist nothing; an echo is accepted",
       "explicitId": "openwop.requirement.0201.endpoint-verification",
       "citations": [
@@ -33492,6 +33523,11 @@
           "requirement": null,
           "interpolated": true
         },
+        {
+          "section": "RFC 0201 §D.14",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "RFC 0201 §D.13–§D.14",
           "requirement": null,