@openwop/openwop-conformance 2.42.1 → 2.42.3

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.1",
-  "corpusTag": "v2.42.1",
+  "version": "2.42.3",
+  "corpusTag": "v2.42.3",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
-    "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
+    "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "849b6c3d37336132343468e553b413a61a133fbc943d21ffc8e961948284db9f",
-    "api/v2/asyncapi.yaml": "96bac052de733a0987c35b4834341d91633381ff2ae1e6087ddb2956ac1edad9",
-    "api/v2/openapi.yaml": "eb39b2957737fc0f2e3187c33aac2f1475a3d2aa382a5c57686a1a15a5b643d4",
+    "api/seams-v2.yaml": "6824903e9a7d33a6913878d46ad0a1e25746b596c6ab2ae7aa6c31d72babfa63",
+    "api/v2/asyncapi.yaml": "45ee1825660a8d6336e145042e6e6e7f69d63d823fb7a6af8f5e9c46ec93c45f",
+    "api/v2/openapi.yaml": "d45f0d99b6d57b45a30640583c0aa828163ba778768dd58835246ed5dad212b1",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -132,7 +132,7 @@
     "schemas/v2/credential-reference.schema.json": "ea699ce30f58fb2c32d4279158b3f730f70be7b2dc8c3037693a76e66eb3e001",
     "schemas/v2/debug-bundle.schema.json": "0bfa4b1d91fefbc12c95670dba9d5eacb72b879bb9a5c074e821ca9ed0fee6fd",
     "schemas/v2/dispatch-config.schema.json": "5718c1ed7d95672e618bcb1f1da8e38180e144b12151307afc3aba1314dfcef0",
-    "schemas/v2/effect-ledger-projection.schema.json": "928340b243c60aaf04c1b40adb09be8a90340d44f57be1dfff837be10f104822",
+    "schemas/v2/effect-ledger-projection.schema.json": "0d118d385a43921118a76888449c5c3c5618eab1b80914b84a0a1b48d18822c1",
     "schemas/v2/effect-seam-manifest.schema.json": "197ef9944ab027a50d1b9352f317cbbc12c8ad955fdb14650fb90477052ffef0",
     "schemas/v2/envelopes/clarification.request.schema.json": "9e39d7b09f0b3ce7902d6aa19ca0eb52867b634efc78a881469c4d44fb3333e7",
     "schemas/v2/envelopes/error.schema.json": "6a11fa3b9d61736fcb5675e6ac9825919aa609dceba13ef5615993d54647802b",
@@ -204,17 +204,17 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "bbcefda69bffa9fb67803c48ddc7e786866c655d8af36f73fc0e3b27e69a1917",
+    "spec/v1/core-standard-manifest.json": "4271942ecca7c7455cb6318572bdb5a53ddc34f8d8914e2a68c64b091d131a0f",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "d91c400b704b83e65dd40dbed1c0331a6d005fdb77d3facce0eacea89c4c7f14",
+    "spec/v1/gaps.json": "361fb29a27dc933c2462a64f32a5a6a6ecf8e6d9fb46039550cb5cfa2eb0ab13",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
-    "spec/v1/operation-path-manifest.json": "968c2fceb27cf76acbb14f7d250798f913bbbd3e9789dd3fb2a32c1ef536e771",
+    "spec/v1/operation-path-manifest.json": "fada0342815fb129c1ae61f1829bd6e34417717408ce86fcc54280f373c19e74",
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "ccfed7d978ce7293a6d8f3c0f6045835dfb7e488f2b67a68f6b04d67c4b0cfc9",
     "spec/v2/core/capabilities.md": "e22381fed3a93376ad478fa7f07571fdad9653aefd7c05f189a2ef45a49f6c63",
@@ -224,7 +224,7 @@
     "spec/v2/core/errors.md": "870f1a9c9481fb49c8bd39170f0656c2ae46124afd4472fb7a3c18c67be0e561",
     "spec/v2/core/events.md": "3df1866a89fb765c78adf79b8d51f96c59584dee9aa88d59179b88a681d827da",
     "spec/v2/core/form-content-packs.md": "55ea021b5f676f5851f420b3597262fbf6642108bddeb726922f8c5dd96c968b",
-    "spec/v2/core/headers.md": "38c03524e3aeea30862432d203faffb8b0b05ec65136d223e96ab06941c3717b",
+    "spec/v2/core/headers.md": "10ec6a6c3e0437b1501cb224273e86c2f6aede92fd469605f3353904d3ebd230",
     "spec/v2/core/host-services.md": "c3ff93201d642edf835e9ae84f06a17edd207f9d351f8bfd70572be05bbfd894",
     "spec/v2/core/idempotency.md": "b61d4a200526485937897dd7ebca092e68424a80624e0be7a0b7db8cdbd54403",
     "spec/v2/core/identity.md": "d15667552019f64316be9b65c6e5696c10766581405f05da3907fb47f36e6459",
@@ -291,12 +291,12 @@
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
     "spec/v2/migrations.json": "651954938a1e154c0b6f1e3dd6e105889d30de3bb65789f21de7f77a12869e9e",
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
-    "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
+    "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "c226854124edd701082c57b55c908cdf09926837611a59d00e306696a06a9b8a",
+    "spec/v2/release.json": "1b3dde14cbaf3cfc4eab1ae9a461aab6d357c9c4cda511047087c0b57b400055",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "8411f06cd9888524b6d234e8d111896d8c90d06991453c9a192e7550d0b3cb9e"
+    "spec/v2/surface-baseline.json": "dc52941e7f3e19da5151bb5c994af9b18b137a5a3b34ee0b63bc9cb2789dc52a"
   },
-  "corpusCommit": "c92bac3ebafda0fab5a6113df67422efe428d70d"
+  "corpusCommit": "d310f781e2dcb00d670e26fc23668c2d61548304"
 }

package/src/lib/carries-payload.ts

@@ -0,0 +1,42 @@
+/**
+ * Does any event's payload carry `sent`, as JSON — member order ignored?
+ *
+ * `v2-a2ui-v09-surface` asserted RFC 0209 §C.11 ("recorded surface envelopes
+ * are returned as recorded") by comparing `JSON.stringify(subtree)` with
+ * `JSON.stringify(sent)`. That comparison is ORDER-sensitive, and RFC 8259 §4
+ * gives object member order no meaning. A Postgres JSONB host returns every
+ * member and every value but re-sorts keys (shorter first, then bytewise):
+ * measured on pg16, `{version,catalogId,surfaceId,messages}` came back as
+ * `{version,messages,catalogId,surfaceId}`. So a conforming host could never
+ * pass the leg (suite 2.42.2 correction).
+ *
+ * The comparison is now between RFC 8785 (JCS) forms, the corpus's canonical
+ * JSON (`lib/jcs.ts`; conformance.md §"Canonical JSON"). JCS sorts members and
+ * fixes number and string serialization, so two values are JCS-equal exactly
+ * when they are the same JSON value. What §C.11 forbids, a regenerated or
+ * altered surface, still fails: a changed value, a dropped or added member, or
+ * a reordered ARRAY (message order is meaningful) all change the JCS form.
+ */
+
+import { canonicalJSON } from './jcs.js';
+
+/** Every subtree of `v`, depth-first. */
+function* subtrees(v: unknown): Generator<unknown> {
+  yield v;
+  if (Array.isArray(v)) for (const x of v) yield* subtrees(x);
+  else if (v && typeof v === 'object') for (const x of Object.values(v)) yield* subtrees(x);
+}
+
+/** JCS form, or null for a value JCS refuses (not I-JSON), which then matches nothing. */
+function jcs(v: unknown): string | null {
+  try { return canonicalJSON(v); } catch { return null; }
+}
+
+export function carriesPayload(events: readonly unknown[], sent: unknown): boolean {
+  const want = jcs(sent);
+  if (want === null) return false;
+  return events.some((e) => {
+    const payload = e !== null && typeof e === 'object' ? (e as Record<string, unknown>)['payload'] : undefined;
+    return [...subtrees(payload)].some((s) => jcs(s) === want);
+  });
+}

package/src/lib/certification-bundle-verify.ts

@@ -298,6 +298,9 @@ export interface ScrubResult<T> {
   readonly redactedAt: readonly string[];
 }
 
+/** A whole-string hex digest: `sha256:`-prefixed or bare, 32+ hex characters. */
+const HEX_DIGEST = /^(sha256:)?[0-9a-f]{32,}$/i;
+
 /**
  * Replace every occurrence of every secret in every string of `value` (keys
  * included) with `redactionMarker(secret)`. Empty / whitespace-only secrets
@@ -312,6 +315,16 @@ export function scrubEvidence<T>(value: T, secrets: readonly string[]): ScrubRes
   const redactedAt: string[] = [];
   if (live.length === 0) return { value, redactedAt };
   const scrubString = (s: string, path: string): string => {
+    // A string that is wholly a hex digest (a sha256, a key fingerprint) is
+    // scrubbed only when it IS a secret, never for a secret found inside it.
+    // A secret inside a digest is a coincidence, not a leak: the digest does
+    // not disclose it. Rewriting it only corrupts the evidence. Suite 2.40.3
+    // floored the env sweep after openwop-app's `…_ROTATION_OVERLAP_S=60`
+    // rewrote the "60" inside `discovery.sha256`, but an explicitly handed
+    // credential is still scrubbed whatever its shape, so a short one (or any
+    // hex one) could still hit a digest at random. This closes that class at
+    // the scrub instead of at each source of secrets.
+    if (HEX_DIGEST.test(s) && !live.includes(s)) return s;
     let out = s;
     let hit = false;
     for (const secret of live) {

package/src/lib/effect-refire.ts

@@ -0,0 +1,34 @@
+/**
+ * Which rows of a replay fork's effect ledger record an attempt the PARENT
+ * never made, i.e. a re-fire (RFC 0173 §C.2; replay.md §Suppression rule 1)?
+ *
+ * `v2-effect-seam-no-refire` used to assert `fork count ≤ parent count`. The
+ * seam fires ONE attempt on the source run, so a host that re-fires on replay
+ * records one row on the fork and reads 1 ≤ 1: the leg passed over exactly the
+ * defect it exists for. Measured: openwop-app with `sideEffecting` dropped
+ * still passed (suite 2.42.2 correction).
+ *
+ * A fork's projection may legitimately carry nothing (a host that keys the
+ * ledger per run: its fork's own ledger is empty when nothing re-fired) or the
+ * parent's rows as fixed history (a host that projects inherited attempts). So
+ * the witness is not a count. It is whether any fork row records an attempt
+ * that is not one of the parent's: an inherited row repeats a parent attempt's
+ * `(nodeId, attempt, at)`, while a re-fire is a new attempt with a new `at`.
+ * The multiset match means N inherited rows cover at most N parent rows.
+ */
+
+export interface EffectRow { readonly nodeId?: unknown; readonly attempt?: unknown; readonly at?: unknown }
+
+const key = (r: EffectRow): string => `${String(r.nodeId)}|${String(r.attempt)}|${String(r.at)}`;
+
+export function refiredAttempts(parent: readonly EffectRow[], fork: readonly EffectRow[]): EffectRow[] {
+  const available = new Map<string, number>();
+  for (const r of parent) available.set(key(r), (available.get(key(r)) ?? 0) + 1);
+  const out: EffectRow[] = [];
+  for (const r of fork) {
+    const n = available.get(key(r)) ?? 0;
+    if (n > 0) available.set(key(r), n - 1);
+    else out.push(r);
+  }
+  return out;
+}

package/src/scenarios/certification-bundle-redaction.test.ts

@@ -158,7 +158,7 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
     // Suite 2.40.2: openwop-app set OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60,
     // the name matched SECRET, and scrubEvidence rewrote the "60" inside
     // discovery.sha256 — the bundle failed ^[0-9a-f]{64}$ and main could not deploy.
-    const digest = '4b8d99c002a061a0255e8224ee683162007febadd251b2d171b47c0849695315';
+    const digest = '4b8d99c002a061a0255e8224ee683160007febadd251b2d171b47c0849695315';
     const env = {
       OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S: '60',
       OPENWOP_TOKEN_TTL_SECONDS_KEY: '86400000',

package/src/scenarios/inbound-credential-no-passthrough.test.ts

@@ -42,6 +42,7 @@ import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { targetMajor } from '../lib/seams.js';
 import { startModalReceiver } from '../lib/webhook-receiver.js';
+import { deliveriesFor } from '../lib/standard-webhooks.js';
 import { projectBoundId } from '../lib/bound-id.js';
 
 const DOC = 'spec/v1/auth.md §"Onward hops"; spec/v2/core/security-defaults.md §"Onward hops" (RFC 0200 §E)';
@@ -93,9 +94,19 @@ describe('RFC 0200 §E — inbound-credential-no-passthrough (the caller\'s cred
     });
     if (created.status !== 201) return softSkip('blocked', `could not start ${FIXTURE} (${created.status}) — no run, no delivery, nothing to inspect`);
 
-    const delivered = await waitFor(() => rx.hits.some((h) => !h.verification), WAIT_MS);
+    // Unfailable-leg audit, 2026-09-26: the wait accepted ANY non-verification
+    // hit, so a foreign run.completed (a parallel scenario's run) could end it
+    // before THIS run's delivery — the one carrying the canaries' run — arrived.
+    // The wait now requires a delivery for this run; every hit is still scanned.
+    const runId = (created.json as { runId?: unknown } | null)?.runId;
+    if (typeof runId !== 'string' || runId === '') return softSkip('blocked', `POST ${runsPath()} answered 201 without a runId — this run's delivery cannot be told apart from another run's`);
+    const ours = (): number => (subscriptionId !== null
+      ? deliveriesFor(rx.hits, subscriptionId, runId)
+      : rx.hits.filter((h) => { if (h.verification) return false; try { return (JSON.parse(h.body) as { runId?: unknown }).runId === runId; } catch { return false; } })
+    ).length;
+    const delivered = await waitFor(() => ours() > 0, WAIT_MS);
     // A hop that never happened leaks nothing: this is `blocked`, not a pass.
-    if (!delivered) return softSkip('blocked', `no delivery reached the suite-owned receiver within ${WAIT_MS}ms — an unmade hop cannot witness that a credential did not cross it`);
+    if (!delivered) return softSkip('blocked', `no delivery for run ${runId} reached the suite-owned receiver within ${WAIT_MS}ms (${rx.hits.filter((h) => !h.verification).length} other capture(s)) — an unmade hop cannot witness that a credential did not cross it`);
 
     const canaries: Array<[string, string]> = [['the suite\'s own API key', env.apiKey], ['the Cookie canary', c1], ['the Proxy-Authorization canary', c2]];
     const found: string[] = [];

package/src/scenarios/v2-a2ui-v09-surface.test.ts

@@ -42,6 +42,7 @@ import { readErrorCode } from '../lib/error-envelope.js';
 import { FIXTURES_DIR } from '../lib/paths.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
+import { carriesPayload } from '../lib/carries-payload.js';
 
 type Json = Record<string, unknown>;
 const KIND = 'ui.a2ui-surface';
@@ -117,16 +118,9 @@ async function gate(want: (floor: number) => boolean, wantText: string): Promise
 }
 async function done(runId: string): Promise<void> { await driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}); }
 
-/** Every subtree of `v`, depth-first. */
-function* subtrees(v: unknown): Generator<unknown> {
-  yield v;
-  if (Array.isArray(v)) for (const x of v) yield* subtrees(x);
-  else if (v && typeof v === 'object') for (const x of Object.values(v)) yield* subtrees(x);
-}
-const carries = (events: unknown[], payload: unknown): boolean => {
-  const want = JSON.stringify(payload);
-  return events.some((e) => [...subtrees((e as Json)['payload'])].some((s) => JSON.stringify(s) === want));
-};
+// RFC 0209 §C.11 compares as JSON, not as text: member order carries no meaning
+// (RFC 8259 §4), and a JSONB host re-sorts it. See lib/carries-payload.ts.
+const carries = carriesPayload;
 async function eventsOf(runId: string): Promise<unknown[]> {
   const r = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`);
   const ev = (r.json as { events?: unknown } | null)?.events;
@@ -215,6 +209,8 @@ describe('RFC 0209 §A.2 — the cross-field rules are checked at admission (sea
 });
 
 describe('RFC 0209 §C.11 — recorded surfaces are returned as recorded (seam-gated)', () => {
+  // "byte-equal" in these two titles means JCS-equal (lib/carries-payload.ts). The titles
+  // are kept because they mint the rows' title ids.
   it('a recorded version-2 surface is returned byte-equal on poll and carried by a fork at a later fromSeq', async () => {
     const g = await gate((f) => f >= 2, 'a floor of at least 2');
     if (!g.ok) return softSkip(g.kind, g.reason);
@@ -225,7 +221,7 @@ describe('RFC 0209 §C.11 — recorded surfaces are returned as recorded (seam-g
       expect(r.status, req('openwop.it.v2-a2ui-v09-surface.recorded-as-recorded', 'RFC 0209 §C.11', `the positive surface MUST be admitted, got ${code(r)}`)).toBe(201);
       const sequence = (r.json as { sequence: number }).sequence;
       const events = await eventsOf(runId);
-      expect(carries(events, payload), req('openwop.it.v2-a2ui-v09-surface.recorded-as-recorded', 'RFC 0209 §C.11', 'the run\'s poll MUST return the recorded surface payload byte-equal — no surface is regenerated')).toBe(true);
+      expect(carries(events, payload), req('openwop.it.v2-a2ui-v09-surface.recorded-as-recorded', 'RFC 0209 §C.11', 'the run\'s poll MUST return the recorded surface payload unchanged as JSON (JCS-equal; member order carries no meaning) — no surface is regenerated')).toBe(true);
       // The surface is the last event of the suspended run, so `sequence + 1`
       // names no event and runs.md §Fork REQUIRES 422 fork_point_invalid for it.
       // Record one more envelope on the same surface and fork AT that event:
@@ -250,7 +246,7 @@ describe('RFC 0209 §C.11 — recorded surfaces are returned as recorded (seam-g
       const r = await emit(runId, envelope(1, V1_SURFACE));
       expect(r.status, req('openwop.requirement.0209.legacy-readable', 'RFC 0209 §C.11', `a version-1 surface at floor 1 MUST be admitted, got ${code(r)}`)).toBe(201);
       const sequence = (r.json as { sequence: number }).sequence;
-      expect(carries(await eventsOf(runId), V1_SURFACE), req('openwop.requirement.0209.legacy-readable', 'RFC 0209 §C.11', 'the poll MUST return the version-1 surface byte-equal')).toBe(true);
+      expect(carries(await eventsOf(runId), V1_SURFACE), req('openwop.requirement.0209.legacy-readable', 'RFC 0209 §C.11', 'the poll MUST return the version-1 surface unchanged as JSON (JCS-equal)')).toBe(true);
       // As in the version-2 leg: fork at a recorded event after the surface, never at `sequence + 1` (no such event; 422 fork_point_invalid).
       const later = await emit(runId, envelope(1, V1_LATER));
       expect(later.status, req('openwop.requirement.0209.legacy-readable', 'RFC 0209 §C.11', `a second version-1 surface at floor 1 MUST be admitted (it supplies the fork point), got ${code(later)}`)).toBe(201);

package/src/scenarios/v2-advertised-fixtures-exist.test.ts

@@ -65,9 +65,16 @@ describe('v2-advertised-fixtures-exist (RFC 0168 §C.3)', () => {
     const ids = advertisedIds(doc);
     if (ids.length === 0) return softSkip('inapplicable', 'the host advertises no fixtures[]');
 
-    // Deterministic sample: the first N by sort order, so a failure is
+    // Deterministic sample spread across the sorted list, so a failure is
     // reproducible and a host cannot pass by luck of ordering.
-    const sample = [...ids].sort().slice(0, SAMPLE);
+    // Unfailable-leg audit, 2026-09-26: the sample was the first N by sort
+    // order, so an unseeded fixture sorting 6th or later was never attempted.
+    // Indices round(i*(n-1)/(SAMPLE-1)), deduped, reach both ends and between.
+    const sorted = [...new Set(ids)].sort();
+    const picks = sorted.length <= SAMPLE
+      ? sorted.map((_, i) => i)
+      : Array.from({ length: SAMPLE }, (_, i) => Math.round((i * (sorted.length - 1)) / (SAMPLE - 1)));
+    const sample = [...new Set(picks)].map((i) => sorted[i]!);
     const unreachable: string[] = [];
     let attempted = 0;
     for (const id of sample) {
@@ -79,7 +86,14 @@ describe('v2-advertised-fixtures-exist (RFC 0168 §C.3)', () => {
       // 201 is the claim honoured. A 4xx that names the workflow as unknown is
       // the drift this leg exists to catch; any other status is a different
       // problem and is not judged here.
-      if (res.status !== 201) unreachable.push(`${id} → ${res.status}`);
+      // The comment above always said only an unknown-workflow refusal is
+      // judged, but the code counted ANY non-201. The 2026-09-26 audit's wider
+      // sample then hit fixtures that need an Idempotency-Key or specific
+      // inputs (a validation 4xx) and failed a conforming host. v2 has no
+      // dedicated unknown-workflow code, so the signal is 404, or a 4xx whose
+      // details.field names workflowId.
+      const field = (res.json as { details?: { field?: unknown } } | null)?.details?.field;
+      if (res.status === 404 || (res.status >= 400 && res.status < 500 && field === 'workflowId')) unreachable.push(`${id} → ${res.status}`);
     }
     if (attempted === 0) return softSkip('blocked', 'no advertised fixture could be attempted');
     expect(

package/src/scenarios/v2-artifact-a2a-shape.test.ts

@@ -118,12 +118,18 @@ describe('RFC 0205 §A.3 — a url Part does not resolve beyond the caller\'s au
     const tenantB = process.env['OPENWOP_TEST_TENANT_B_API_KEY'];
     if (!tenantB) return softSkip('blocked', 'the artifact carries a url Part but OPENWOP_TEST_TENANT_B_API_KEY is not supplied — the second-tenant leg cannot run');
     const base = loadEnv().baseUrl;
+    // unfailable-leg audit, 2026-09-26: the probes use redirect:'manual' and
+    // only failed on a 2xx, so a url that answered 302 to a public pre-signed
+    // object-store URL — readable by tenant B and by anyone — passed. A 3xx is
+    // the host resolving the url for that caller; the only answers that do not
+    // resolve it are a refusal (401/403) or a non-disclosing 404.
+    const REFUSED = new Set([401, 403, 404]);
     for (const u of urls) {
       const abs = new URL(u, base).toString();
       const asB = await fetch(abs, { headers: { Authorization: `Bearer ${tenantB}` }, redirect: 'manual' });
-      expect(asB.status >= 200 && asB.status < 300, req('openwop.requirement.0205.artifact-url-part-scoped', 'RFC 0205 §A.3', `${abs} MUST NOT answer 2xx to tenant B's credential (got ${asB.status})`)).toBe(false);
+      expect(REFUSED.has(asB.status), req('openwop.requirement.0205.artifact-url-part-scoped', 'RFC 0205 §A.3', `${abs} MUST NOT resolve for tenant B's credential: expected 401/403/404, got ${asB.status}${asB.status >= 300 && asB.status < 400 ? ` (a redirect to ${asB.headers.get('location') ?? 'no Location'} resolves the url)` : ''}`)).toBe(true);
       const anon = await fetch(abs, { redirect: 'manual' });
-      expect(anon.status >= 200 && anon.status < 300, req('openwop.requirement.0205.artifact-url-part-scoped', 'RFC 0205 §A.3', `${abs} MUST NOT answer 2xx with no credential (got ${anon.status})`)).toBe(false);
+      expect(REFUSED.has(anon.status), req('openwop.requirement.0205.artifact-url-part-scoped', 'RFC 0205 §A.3', `${abs} MUST NOT resolve with no credential: expected 401/403/404, got ${anon.status}${anon.status >= 300 && anon.status < 400 ? ` (a redirect to ${anon.headers.get('location') ?? 'no Location'} resolves the url)` : ''}`)).toBe(true);
     }
   });
 });

package/src/scenarios/v2-bound-id-kinds.test.ts

@@ -221,9 +221,14 @@ describe('v2 bound-id kinds (identity.md §5, RFC 0187 §A)', () => {
     const res = await http(() => driver.get(`/runs/${projectBoundId(runId)}/effects`));
     if (res === null) return softSkip('blocked', 'GET /runs/{runId}/effects unreachable (fetch failed)');
     if (res.status === 404 || res.status === 405) return softSkip('inapplicable', `the host advertises idempotency but serves no effect ledger at /runs/{runId}/effects (${res.status})`);
-    expect(res.status, req(PER_KIND, 'security-defaults.md §Layer-2 effect identity', 'GET /runs/{runId}/effects MUST answer 200')).toBe(200);
     const effects = ((res.json as { effects?: Array<Record<string, unknown>> } | null)?.effects ?? []);
-    if (effects.length === 0) return softSkip('inapplicable', 'the noop fixture records no effects — no effectId on the wire to read (a host with an effect-producing fixture witnesses this leg)');
+    // Unfailable-leg audit (2026-09-26): the status assert used to precede this
+    // empty check, so on every host (the noop fixture records no effects) the
+    // leg asserted 200 then soft-skipped — `executed-pass` partial-witness folded
+    // into the shared per-kind row with no effectId ever read. The empty 200 now
+    // returns before any assertion.
+    if (res.status === 200 && effects.length === 0) return softSkip('inapplicable', 'the noop fixture records no effects — no effectId on the wire to read (a host with an effect-producing fixture witnesses this leg)');
+    expect(res.status, req(PER_KIND, 'security-defaults.md §Layer-2 effect identity', 'GET /runs/{runId}/effects MUST answer 200')).toBe(200);
     for (const e of effects) expectBound(e['effectId'], 'effectId', 'GET /runs/{runId}/effects', PER_KIND);
   });
 
@@ -244,9 +249,13 @@ describe('v2 bound-id kinds (identity.md §5, RFC 0187 §A)', () => {
     try {
     const res = await http(() => driver.get(`/webhooks/${projectBoundId(webhookId)}/dead-letters`));
     if (res === null) return softSkip('blocked', 'GET /webhooks/{webhookId}/dead-letters unreachable (fetch failed)');
-    expect(res.status, req(PER_KIND, 'RFC 0188 §A.1', 'a host advertising webhooks.deadLetter MUST serve the dead-letter read (200)')).toBe(200);
     const rows = ((res.json as { deliveries?: Array<Record<string, unknown>> } | null)?.deliveries ?? []);
-    if (rows.length === 0) return softSkip('inapplicable', 'the subscription has no dead-lettered delivery in this run — the read is served and the shape is unwitnessed here; v2-webhook-durable-delivery drives an exhaustion and asserts the record');
+    // Unfailable-leg audit (2026-09-26): as with effectId above, the 200 assert
+    // preceded the empty check, so a fresh subscription (always empty) recorded
+    // `executed-pass` partial-witness with no deliveryId read. Empty-200 now
+    // returns before any assertion.
+    if (res.status === 200 && rows.length === 0) return softSkip('inapplicable', 'the subscription has no dead-lettered delivery in this run — the read is served and the shape is unwitnessed here; v2-webhook-durable-delivery drives an exhaustion and asserts the record');
+    expect(res.status, req(PER_KIND, 'RFC 0188 §A.1', 'a host advertising webhooks.deadLetter MUST serve the dead-letter read (200)')).toBe(200);
     for (const r of rows) expectBound(r['deliveryId'], 'deliveryId', 'GET /webhooks/{webhookId}/dead-letters', PER_KIND);
     } finally {
       await http(() => driver.delete(`/webhooks/${projectBoundId(webhookId)}`));

package/src/scenarios/v2-effect-identity-business-key.test.ts

@@ -53,24 +53,36 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
     const fixtures = Array.isArray(doc['fixtures']) ? (doc['fixtures'] as unknown[]) : [];
     if (!fixtures.includes(FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to read`);
 
+    // Unfailable-leg audit (2026-09-26): the noop fixture issues no effects, so
+    // the per-row loop asserted nothing on any host, and the trailing
+    // `softSkip('inapplicable')` (called without `return`, after four passing
+    // setup asserts) recorded `executed-pass` with a `partial-witness:` detail —
+    // a host that mis-keyed every effect passed this row. Now no expect passes
+    // before the empty-ledger check: a failing setup read still fails, and an
+    // empty but well-formed ledger returns `inapplicable` with zero assertions.
     const create = await driver.post('/runs', { workflowId: FIXTURE });
-    expect(create.status, req('openwop.requirement.0173.effect-identity-business-key', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    if (create.status !== 201) {
+      expect(create.status, req('openwop.requirement.0173.effect-identity-business-key', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    }
     const runId = (create.json as { runId: string }).runId;
     await waitTerminal(runId, 10_000);
 
     const res = await driver.get(`/runs/${encodeURIComponent(runId)}/effects`);
+    const check = v2Validator('effect-ledger-projection')(res.json);
+    const body = res.json as { runId?: unknown; effects?: Array<{ effectId?: unknown; keying?: unknown; providerKey?: unknown }> } | null;
+    const effects = body?.effects ?? [];
+    if (res.status === 200 && check.ok && body?.runId === runId && effects.length === 0) {
+      return softSkip('inapplicable', 'the noop fixture issued no external effect — the ledger read is well-formed but the per-row keying leg had no rows (an effect-issuing fixture would exercise it)');
+    }
     expect(
       res.status,
       req('openwop.requirement.0173.effect-identity-business-key', 'security-defaults.md §Layer-2 effect identity', 'a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)'),
     ).toBe(200);
-    const check = v2Validator('effect-ledger-projection')(res.json);
     expect(
       check.ok,
       req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json', `the ledger projection MUST validate: ${check.errors}`),
     ).toBe(true);
-    const body = res.json as { runId?: unknown; effects?: Array<{ effectId?: unknown; keying?: unknown; providerKey?: unknown }> };
-    expect(body.runId, req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json runId', 'runId MUST echo the run read')).toBe(runId);
-    const effects = body.effects ?? [];
+    expect(body?.runId, req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json runId', 'runId MUST echo the run read')).toBe(runId);
     const ids = new Set<string>();
     for (const e of effects) {
       expect(
@@ -90,7 +102,6 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
         ).toBe(false);
       }
     }
-    if (effects.length === 0) softSkip('inapplicable', 'the noop fixture issued no external effect — the per-row keying leg had no rows (an effect-issuing fixture would exercise it)');
   });
 
   it('the same provider key is presented across two transport retries', async () => {
@@ -117,16 +128,43 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
     if (attempts.length < 2) {
       return softSkip('blocked', `the seam produced ${attempts.length} ledger row(s) for effect ${String(body.effectId)} — a cross-retry assertion needs at least two attempts`);
     }
-    const keys = new Set(attempts.map((e) => String(e['providerKey'] ?? '')));
+    // Unfailable-leg audit (2026-09-26): `providerKey` is optional in the ledger
+    // schema and `?? ''` folded a missing key to '', so a host that recorded no
+    // provider key on any attempt showed "one distinct key" and passed. Every
+    // attempt now MUST carry a non-empty key. Remaining limit: the witness is
+    // still the host's own ledger; a suite-owned receiver counting the
+    // Idempotency-Key header on the wire (lib/effect-receiver.ts) is the
+    // stronger follow-up, not done here.
+    for (const a of attempts) {
+      expect(
+        typeof a['providerKey'] === 'string' && (a['providerKey'] as string).length > 0,
+        req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt of one effect MUST record the provider key it presented — attempt ${String(a['attempt'])} recorded ${JSON.stringify(a['providerKey'] ?? null)}`),
+      ).toBe(true);
+    }
+    const keys = new Set(attempts.map((e) => String(e['providerKey'])));
     expect(
       keys.size,
       req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt of one effect MUST present the same provider key across a transport retry — ${attempts.length} attempt(s) presented ${keys.size} distinct key(s)`),
     ).toBe(1);
+    // idempotency.md §Layer 2: business identity is the rule, and the activity
+    // recipe is "the fallback for a provider with no business key". The seam's
+    // effect is a POST to a suite-chosen providerUrl, which has no business key,
+    // so `activity-recipe` is the CONFORMANT keying here. Until 2.42.2 this leg
+    // demanded `business-identity` on every attempt, which is stricter than the
+    // spec, and a host honestly declaring the fallback failed. What the spec does
+    // require of a retry is one effect, one key: every attempt carries a documented
+    // keying, and the SAME one. A host that switches modes between attempts has
+    // re-derived the effect's identity mid-flight.
+    const keyings = new Set(attempts.map((a) => String(a['keying'])));
     for (const a of attempts) {
       expect(
-        a['keying'],
-        req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `a Layer-2 host keys a retried effect on business identity, not the activity recipe (attempt ${String(a['attempt'])})`),
-      ).toBe('business-identity');
+        KEYING,
+        req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt MUST declare a documented keying — business-identity, or activity-recipe for a provider with no business key (attempt ${String(a['attempt'])} declares ${String(a['keying'])})`),
+      ).toContain(a['keying']);
     }
+    expect(
+      keyings.size,
+      req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt of one effect MUST declare the same keying — ${attempts.length} attempt(s) declared ${[...keyings].join(', ')}`),
+    ).toBe(1);
   });
 });

package/src/scenarios/v2-effect-seam-manifest.test.ts

@@ -95,15 +95,9 @@ describe('RFC 0173 §C.1 — effect-seam-manifest (gated on replay)', () => {
         ).toBe(true);
       }
     }
-    // One row per kind the host declares: the set of kinds the manifest names is
-    // the host's declaration, and each named kind is backed by at least one row.
-    const declared = new Set(rows.map((r) => String(r.kind)));
-    for (const kind of declared) {
-      expect(
-        rows.filter((r) => r.kind === kind).length,
-        req('openwop.requirement.0173.effect-seam-manifest', 'RFC 0173 §C.1', `at least one manifest row per declared kind (${kind})`),
-      ).toBeGreaterThanOrEqual(1);
-    }
+    // Unfailable-leg audit (2026-09-26): a "one row per declared kind" loop stood
+    // here, but it built the declared set FROM the rows, so every host passed it.
+    // The manifest has no kind declaration independent of its rows; removed.
     // RFC 0140 G6: a `branch` re-fire is stated as a permission, and a permission
     // for a mode the host does not offer is a claim about nothing.
     const modes = Array.isArray(replay['modes']) ? (replay['modes'] as unknown[]) : [];

package/src/scenarios/v2-effect-seam-no-refire.test.ts

@@ -3,8 +3,9 @@
  * on `replay`, driven through the seams profile).
  *
  * A guarded manifest row that states `branchReFires: false` MUST NOT be fired
- * again by a replay fork: the fork's Layer-2 effect ledger cannot grow past the
- * parent's for that seam. The witness is the host's own ledger, reached by
+ * again by a replay fork: the fork's Layer-2 effect ledger records no attempt
+ * the parent did not make (suite 2.42.2; until then "cannot grow past the
+ * parent's", which a one-attempt source let a re-firing host pass at 1 ≤ 1). The witness is the host's own ledger, reached by
  * firing a named manifest row inside a run through the catalogued seam
  * (`api/seams-v2.yaml` `fireEffectSeam`), forking in `replay` mode, and reading
  * `GET /runs/{runId}/effects` on both.
@@ -28,6 +29,7 @@ import { v2Discovery, gateFamily } from '../lib/v2.js';
 import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
+import { refiredAttempts, type EffectRow } from '../lib/effect-refire.js';
 
 const MANIFEST_PATH = '/host/effect-seams';
 
@@ -115,9 +117,20 @@ describe('RFC 0173 §C.2 — effect-seam-no-refire (gated on replay, seam-driven
     }
     const forkEffects = await driver.get(`/runs/${encodeURIComponent(String(forkBody.runId))}/effects`);
     if (forkEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${forkEffects.status} on the replay fork`);
+    // Not a count comparison. The seam fires ONE attempt, so a host that
+    // re-fires on replay reads 1 on the fork and `fork <= parent` passed it:
+    // measured, openwop-app with `sideEffecting` dropped still passed (suite
+    // 2.42.2). The witness is whether the fork records any attempt the parent
+    // never made (lib/effect-refire.ts): inherited history repeats a parent
+    // attempt, a re-fire is a new one.
+    const rowsOf = (r: OpenWOPResponse): EffectRow[] => {
+      const b = r.json as { effects?: unknown } | null;
+      return Array.isArray(b?.effects) ? (b.effects as EffectRow[]) : [];
+    };
+    const refired = refiredAttempts(rowsOf(parentEffects), rowsOf(forkEffects));
     expect(
-      countOf(forkEffects),
-      req('openwop.requirement.0173.effect-seam-no-refire', 'spec/v2/core/replay.md §Suppression', `seam ${String(target.seam)} is guarded, so a replay fork MUST NOT issue a further attempt through it — suppression is unconditional for mode: replay (§Suppression rule 1) and does not depend on branchReFires, which states only what a BRANCH may re-fire (§Branch: a host "MUST NOT report that as replay suppression"). The fork's effect ledger (${countOf(forkEffects)}) cannot exceed the parent's (${countOf(parentEffects)})`),
-    ).toBeLessThanOrEqual(countOf(parentEffects));
+      refired.length,
+      req('openwop.requirement.0173.effect-seam-no-refire', 'spec/v2/core/replay.md §Suppression', `seam ${String(target.seam)} is guarded, so a replay fork MUST NOT issue a further attempt through it — suppression is unconditional for mode: replay (§Suppression rule 1) and does not depend on branchReFires, which states only what a BRANCH may re-fire (§Branch: a host "MUST NOT report that as replay suppression"). The fork's ledger records ${refired.length} attempt(s) the parent never made: ${JSON.stringify(refired).slice(0, 300)}`),
+    ).toBe(0);
   });
 });