@openwop/openwop-conformance 2.42.2 → 2.42.3

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.42.3] — 2026-09-27 — the unfailable-leg audit: 19 legs a non-conforming host could pass now measure their requirement
+
+- **The unfailable-leg audit: 19 legs that a non-conforming host could pass now measure their requirement.** A scanner (`scripts/audit-unfailable-legs.mjs`, an audit aid, not a gate) flagged 66 legs that witness an Accepted RFC's Falsifiability row and have a shape this corpus has shipped as a defect before: satisfiable bounds (the 1 ≤ 1 no-refire leg), loops over a possibly empty list, `if`-guarded assertions, always-defined checks, and the host's own ledger as the only witness. A reviewer judged each one against a single bar: would a host that breaks the rule record `executed-pass`?
+  - **Confirmed and fixed (12):**
+    - `0173.effect-identity-business-key`: a no-op run's empty ledger passed on setup asserts.
+    - `.retry`: an omitted `providerKey` folded to `''`, so "one distinct key" passed.
+    - `0205.artifact-url-part-scoped`: a 3xx to a public pre-signed URL passed.
+    - `0176.era-2-append-vocabulary`: cancel appends names that are the same in v1 and v2, so the writer rule was never tested. It now records `blocked` unless a renamed type is appended. Its `era` leg now requires `eventLogSchemaVersion`.
+    - `0171.poll-cursor-v2.shape`: `lastSequence` must equal the log's highest sequence, and `status`/`isTerminal` must say terminal.
+    - `0173.webhook-durable-delivery`: exponential backoff must actually grow, second gap ≥ 1.5× the first.
+    - `0175.mrtr-rounds-ceiling.refused`: the refusal must come at the ceiling, not before it.
+    - `0215.no-head-of-line`: a serial dispatcher with a short timeout passed as a partial witness. It now fails below the concurrency floor and is otherwise `blocked`.
+    - `0187.bound-id-kinds.per-kind`, effectId/deliveryId: no-op runs record `inapplicable` before any assertion.
+    - `0173.effect-seam-manifest`: removed a loop that could not fail.
+    - RFC 0173 cites `effect-seam-no-refire` for replay suppression.
+    - RFC 0186 says its row is a schema-validation witness.
+  - **Plausible, tightened (7):**
+    - `0201.message-id-stable`: all four delivery keys are required, otherwise `blocked`.
+    - `0169.profiles-derived-only`: records need `status`, `since` and `witness`; a tautology is removed.
+    - `0200.inbound-credential-no-passthrough`: waits for THIS run's delivery.
+    - `0168.advertised-fixtures-exist`: samples across the whole list.
+    - `0198.task-update-approver-checked`: polls about 3 s rather than one 750 ms read.
+    - `0201.endpoint-verification`: a late echo control and a scaled grace; a missing control is `blocked`.
+    - `0207.a2a-malformed-ignored`: the task must not fail or be rejected.
+  - **Not defects:** 47 of the 66 flags; each reviewer recorded its reason.
+  - **Measured against the v2 reference host** (loopback regression lane) before merge.
+- **RFC 0217 gap G1 closes in the contract peer.** `spec/v1/gaps.json` records MyndHyve's certified production witness of `0217.dead-letter-read-after-unregister` (openwop#1631). No scenario change.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.42.3` because `2.42.2` is tagged. Not tagged, not published.
+
 ## [2.42.2] — 2026-09-26 — four conformance legs now measure what their spec says: effect re-fire, keying fallback, A2UI JSON values, digest-safe scrubbing
 
 - **`0173.effect-seam-no-refire` can detect a re-fire.** The leg asserted that the replay fork's ledger count was at most the parent's. The seam fires one attempt on the source run, so a host that re-fires on replay read 1 ≤ 1 and passed, over exactly the defect the leg exists for. ws3 measured it: openwop-app with `sideEffecting` dropped still passed. The leg now fails if the fork records any attempt the parent never made, using the new `lib/effect-refire.ts`. An inherited row repeats a parent attempt's `(nodeId, attempt, at)`, while a re-fire is a new attempt, and one parent row covers at most one fork row. A host whose fork projection is empty passes, as does one that projects the parent's attempts as history. The `effect-ledger-projection` schema description, which said the scenario "compares row COUNTS", is corrected. New suite self-test `src/lib/effect-refire.test.ts` uses a re-firing host stub as its first leg. It is sabotage-proved: with the old count rule restored, that leg fails.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.2 @openwop/spec-artifacts@2.42.2
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.3 @openwop/spec-artifacts@2.42.3
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.2",
-  "stampSha256": "1410563585447c32dced7e6679caf5968a68e9de88c39a5188d527336b86e784"
+  "version": "2.42.3",
+  "stampSha256": "06eaa8ddc41c7ab3bb1af3b2b6b3566042a92b50a2249914946657c16490896d"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.42.2",
+  "version": "2.42.3",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.42.2"
+    "@openwop/spec-artifacts": "2.42.3"
   }
 }

package/requirements.json

@@ -14752,7 +14752,7 @@
     {
       "id": "openwop.it.inbound-credential-no-passthrough.no-webhook-delivery-carries-the-caller-s-authorization-cookie-or-proxy-authoriza",
       "file": "inbound-credential-no-passthrough.test.ts",
-      "line": 70,
+      "line": 71,
       "title": "no webhook delivery carries the caller's Authorization, Cookie or Proxy-Authorization",
       "explicitId": "openwop.requirement.0200.inbound-credential-no-passthrough",
       "citations": [
@@ -27568,7 +27568,7 @@
     {
       "id": "openwop.it.v2-artifact-a2a-shape.records-why-export-alias-equivalence-has-no-wire-witness",
       "file": "v2-artifact-a2a-shape.test.ts",
-      "line": 132,
+      "line": 138,
       "title": "records why export-alias-equivalence has no wire witness",
       "explicitId": "openwop.requirement.0205.export-alias-equivalence",
       "citations": [
@@ -27753,7 +27753,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.deliveryid-every-record-in-the-dead-letter-read-carries-a-bound-id-in-the-caller",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 230,
+      "line": 235,
       "title": "deliveryId: every record in the dead-letter read carries a bound id in the caller's tenant",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.per-kind",
       "citations": [
@@ -28805,7 +28805,7 @@
     {
       "id": "openwop.it.v2-effect-identity-business-key.the-same-provider-key-is-presented-across-two-transport-retries",
       "file": "v2-effect-identity-business-key.test.ts",
-      "line": 96,
+      "line": 107,
       "title": "the same provider key is presented across two transport retries",
       "explicitId": "openwop.requirement.0173.effect-identity-business-key.retry",
       "citations": [
@@ -28819,6 +28819,11 @@
           "requirement": null,
           "interpolated": true
         },
+        {
+          "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "spec/v2/core/idempotency.md §Layer 2: effect identity",
           "requirement": null,
@@ -28866,11 +28871,6 @@
           "requirement": null,
           "interpolated": true
         },
-        {
-          "section": "RFC 0173 §C.1",
-          "requirement": null,
-          "interpolated": true
-        },
         {
           "section": "effect-seam-manifest.schema.json seams[].branchReFires",
           "requirement": null,
@@ -28881,7 +28881,7 @@
     {
       "id": "openwop.it.v2-effect-seam-manifest.the-replay-facet-names-the-manifest-address-as-the-constant-host-effect-seams",
       "file": "v2-effect-seam-manifest.test.ts",
-      "line": 118,
+      "line": 112,
       "title": "the replay facet names the manifest address as the constant /host/effect-seams",
       "explicitId": "openwop.requirement.0173.effect-seam-manifest.facet",
       "citations": [
@@ -28981,7 +28981,7 @@
     {
       "id": "openwop.it.v2-era-2-append-vocabulary.the-run-keeps-the-era-it-was-created-with-an-append-does-not-promote-it-to-era-3",
       "file": "v2-era-2-append-vocabulary.test.ts",
-      "line": 133,
+      "line": 165,
       "title": "the run keeps the era it was created with; an append does not promote it to era 3",
       "explicitId": "openwop.requirement.0176.era-2-append-vocabulary",
       "citations": [
@@ -29588,13 +29588,23 @@
         {
           "section": "spec/v2/core/interop.md §\"Trace context\" (RFC 0207)",
           "requirement": "SendMessage MUST answer a normal result"
+        },
+        {
+          "section": "spec/v2/core/interop.md §\"Trace context\" (RFC 0207)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interop.md §\"Trace context\" (RFC 0207)",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
     {
       "id": "openwop.it.v2-interop-trace-context.a2a-interface-metadata-openwop-traceparent-is-the-parent-not-the-transport-heade",
       "file": "v2-interop-trace-context.test.ts",
-      "line": 335,
+      "line": 358,
       "title": "A2A interface: metadata.openwop.traceparent is the parent, not the transport header",
       "explicitId": "openwop.requirement.0207.a2a-inbound-adopts",
       "citations": [
@@ -30498,7 +30508,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-mount-that-lists-the-tasks-extension-in-server-discover-also-lists-extensions",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 247,
+      "line": 248,
       "title": "a mount that lists the Tasks extension in server/discover also lists extensions in mcp.features",
       "explicitId": "openwop.requirement.0198.advertised-via-discover",
       "citations": [
@@ -30512,7 +30522,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-tools-call-declaring-the-extension-on-a-run-that-is-not-terminal-is-answered-c",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 254,
+      "line": 255,
       "title": "a tools/call declaring the extension on a run that is not terminal is answered CreateTaskResult",
       "explicitId": "openwop.requirement.0198.task-when-nonterminal",
       "citations": [
@@ -30551,7 +30561,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.taskid-is-the-run-id-in-its-projected-wire-form-with-an-opaque-segment-of-at-lea",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 274,
+      "line": 275,
       "title": "taskId is the run id in its projected wire form, with an opaque segment of at least 22 characters",
       "explicitId": "openwop.requirement.0198.task-id-is-run-id",
       "citations": [
@@ -30575,7 +30585,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.tasks-get-projects-input-required-keyed-by-interruptid-and-a-failed-run-as-compl",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 290,
+      "line": 291,
       "title": "tasks/get projects input_required keyed by interruptId, and a failed run as completed with isError true",
       "explicitId": "openwop.requirement.0198.task-status-projection",
       "citations": [
@@ -30607,7 +30617,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.tasks-update-answered-twice-resolves-the-interrupt-once-and-the-task-completes",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 313,
+      "line": 314,
       "title": "tasks/update answered twice resolves the interrupt once and the task completes",
       "explicitId": "openwop.requirement.0198.task-update-resolves-once",
       "citations": [
@@ -30635,7 +30645,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-tasks-update-from-a-caller-not-in-approverslist-resolves-nothing",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 333,
+      "line": 334,
       "title": "a tasks/update from a caller not in approversList resolves nothing",
       "explicitId": "openwop.requirement.0198.task-update-approver-checked",
       "citations": [
@@ -30663,7 +30673,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.tasks-get-appends-nothing-to-the-run-log",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 352,
+      "line": 365,
       "title": "tasks/get appends nothing to the run log",
       "explicitId": "openwop.requirement.0198.task-get-read-only",
       "citations": [
@@ -30677,7 +30687,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.an-unreadable-task-is-answered-32602-exactly-as-a-nonexistent-one",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 367,
+      "line": 380,
       "title": "an unreadable task is answered -32602 exactly as a nonexistent one",
       "explicitId": "openwop.requirement.0198.task-unreadable-not-found",
       "citations": [
@@ -30709,7 +30719,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-subscriptions-listen-acknowledgement-leaves-out-a-task-the-caller-cannot-read",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 400,
+      "line": 413,
       "title": "a subscriptions/listen acknowledgement leaves out a task the caller cannot read",
       "explicitId": "openwop.requirement.0198.listen-omits-unreadable",
       "citations": [
@@ -30737,7 +30747,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.tasks-cancel-cancels-the-run-on-a-terminal-task-it-is-acknowledged-and-appends-n",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 422,
+      "line": 435,
       "title": "tasks/cancel cancels the run; on a terminal task it is acknowledged and appends nothing",
       "explicitId": "openwop.requirement.0198.task-cancel-cancels-run",
       "citations": [
@@ -30769,7 +30779,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-client-disconnect-before-the-host-answers-a-task-less-tools-call-cancels-the-r",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 441,
+      "line": 454,
       "title": "a client disconnect before the host answers a task-less tools/call cancels the run it started",
       "explicitId": "openwop.requirement.0198.disconnect-cancels-run",
       "citations": [
@@ -30792,7 +30802,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-disconnect-after-createtaskresult-never-affects-the-run",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 461,
+      "line": 474,
       "title": "a disconnect after CreateTaskResult never affects the run",
       "explicitId": "openwop.requirement.0198.task-survives-disconnect",
       "citations": [
@@ -30811,7 +30821,7 @@
     {
       "id": "openwop.it.v2-mcp-tasks.a-blocking-tools-call-on-an-sse-stream-whose-run-is-cancelled-carries-no-notific",
       "file": "v2-mcp-tasks.test.ts",
-      "line": 476,
+      "line": 489,
       "title": "a blocking tools/call on an SSE stream whose run is cancelled carries no notifications/cancelled and ends isError true",
       "explicitId": "openwop.requirement.0198.no-server-cancelled",
       "citations": [
@@ -30917,6 +30927,11 @@
           "requirement": null,
           "interpolated": true
         },
+        {
+          "section": "interop.md §The MCP round ceiling",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "interop.md §The MCP round ceiling",
           "requirement": null,
@@ -31680,7 +31695,7 @@
     {
       "id": "openwop.it.v2-poll-cursor-v2.the-response-is-the-closed-runid-events-lastsequence-status-isterminal",
       "file": "v2-poll-cursor-v2.test.ts",
-      "line": 60,
+      "line": 65,
       "title": "the response is the closed { runId, events, lastSequence, status, isTerminal }",
       "explicitId": "openwop.requirement.0171.poll-cursor-v2.shape",
       "citations": [
@@ -31714,14 +31729,24 @@
         },
         {
           "section": "spec/v2/core/events.md §Poll",
-          "requirement": "lastSequence MUST equal the highest sequence returned when the response carries the whole log"
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/events.md §Poll",
+          "requirement": "isTerminal is whether the run is terminal: the run was observed terminal, so isTerminal MUST be true"
+        },
+        {
+          "section": "spec/v2/core/events.md §Poll",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
     {
       "id": "openwop.it.v2-poll-cursor-v2.omitting-the-cursor-returns-from-the-first-event-sequence-0",
       "file": "v2-poll-cursor-v2.test.ts",
-      "line": 77,
+      "line": 100,
       "title": "omitting the cursor returns from the first event (sequence 0)",
       "explicitId": "openwop.requirement.0171.poll-cursor-v2.from-first",
       "citations": [
@@ -31734,7 +31759,7 @@
     {
       "id": "openwop.it.v2-poll-cursor-v2.aftersequence-n-returns-only-events-with-sequence-n",
       "file": "v2-poll-cursor-v2.test.ts",
-      "line": 87,
+      "line": 110,
       "title": "afterSequence=N returns only events with sequence > N",
       "explicitId": "openwop.requirement.0171.poll-cursor-v2.after-sequence",
       "citations": [
@@ -31756,7 +31781,7 @@
     {
       "id": "openwop.it.v2-poll-cursor-v2.a-cursor-past-the-end-of-the-log-returns-200-with-an-empty-events-array",
       "file": "v2-poll-cursor-v2.test.ts",
-      "line": 121,
+      "line": 144,
       "title": "a cursor past the end of the log returns 200 with an empty events array",
       "explicitId": "openwop.requirement.0171.poll-cursor-v2.past-end",
       "citations": [
@@ -31840,7 +31865,7 @@
     {
       "id": "openwop.it.v2-profiles-derived-only.the-v2-document-carries-no-root-profiles",
       "file": "v2-profiles-derived-only.test.ts",
-      "line": 43,
+      "line": 48,
       "title": "the v2 document carries no root `profiles[]`",
       "explicitId": "openwop.requirement.0169.profiles-derived-only.no-root-profiles",
       "citations": [
@@ -31853,7 +31878,7 @@
     {
       "id": "openwop.it.v2-profiles-derived-only.every-registry-profile-is-derivable-from-the-document-the-discovery-core-predica",
       "file": "v2-profiles-derived-only.test.ts",
-      "line": 49,
+      "line": 54,
       "title": "every registry profile is derivable from the document; the discovery-core predicate holds on a valid document",
       "explicitId": "openwop.requirement.0169.profiles-derived-only.derivable",
       "citations": [
@@ -31866,11 +31891,6 @@
           "requirement": null,
           "interpolated": true
         },
-        {
-          "section": "spec/v2/core/capabilities.md §7",
-          "requirement": null,
-          "interpolated": true
-        },
         {
           "section": "spec/v2/core/capabilities.md §7",
           "requirement": "openwop-discovery-core (metadata protocolVersions + preferredVersion, both REQUIRED at the root) MUST derive true from every valid v2 document"
@@ -33227,7 +33247,7 @@
     {
       "id": "openwop.requirement.0215.no-head-of-line",
       "file": "v2-webhook-delivery-isolation.test.ts",
-      "line": 111,
+      "line": 113,
       "title": null,
       "explicitId": "openwop.requirement.0215.no-head-of-line",
       "citations": [
@@ -33256,7 +33276,8 @@
         },
         {
           "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
-          "requirement": "the held subscriptions' attempts MUST have been dispatched"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
@@ -33358,6 +33379,11 @@
           "requirement": null,
           "interpolated": true
         },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "webhooks.md §Surfaces",
           "requirement": "DELETE /webhooks/{webhookId} MUST answer 204"
@@ -33367,7 +33393,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 360,
+      "line": 376,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
@@ -33401,7 +33427,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 454,
+      "line": 470,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -33414,7 +33440,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.after-unregister-the-dead-letter-read-answers-404-not-found-as-for-a-subscriptio",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 475,
+      "line": 491,
       "title": "after unregister, the dead-letter read answers 404 not_found, as for a subscription that never existed",
       "explicitId": "openwop.requirement.0217.dead-letter-read-after-unregister",
       "citations": [
@@ -33441,7 +33467,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 508,
+      "line": 524,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
@@ -33478,7 +33504,7 @@
     {
       "id": "openwop.it.v2-webhook-endpoint-verification.no-echo-wrong-echo-and-a-redirect-are-refused-and-persist-nothing-an-echo-is-acc",
       "file": "v2-webhook-endpoint-verification.test.ts",
-      "line": 64,
+      "line": 68,
       "title": "no-echo, wrong-echo and a redirect are refused and persist nothing; an echo is accepted",
       "explicitId": "openwop.requirement.0201.endpoint-verification",
       "citations": [
@@ -33497,6 +33523,11 @@
           "requirement": null,
           "interpolated": true
         },
+        {
+          "section": "RFC 0201 §D.14",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "RFC 0201 §D.13–§D.14",
           "requirement": null,

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.2",
-  "corpusTag": "v2.42.2",
+  "version": "2.42.3",
+  "corpusTag": "v2.42.3",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "0777cffd47bdaad6482bc910064a42f793d74ae8e8921c84f498b1670f254f21",
-    "api/v2/asyncapi.yaml": "b87e6d39591f6967c6a6154657863c4573dd9833e7b6b8f4ca3472e9d92c9352",
-    "api/v2/openapi.yaml": "12ee6cf90544a49863f9238ba8ddd2d1333f913f26e122819e399ec65e6b682b",
+    "api/seams-v2.yaml": "6824903e9a7d33a6913878d46ad0a1e25746b596c6ab2ae7aa6c31d72babfa63",
+    "api/v2/asyncapi.yaml": "45ee1825660a8d6336e145042e6e6e7f69d63d823fb7a6af8f5e9c46ec93c45f",
+    "api/v2/openapi.yaml": "d45f0d99b6d57b45a30640583c0aa828163ba778768dd58835246ed5dad212b1",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "c38981a02d063f68cffd5d22cf8e10390a3b12af4271e2819dc753711fc9616f",
+    "spec/v1/core-standard-manifest.json": "4271942ecca7c7455cb6318572bdb5a53ddc34f8d8914e2a68c64b091d131a0f",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "e99603a9c0e14f69fc3dd5ff6269f75a7b25aa2eb28051f9e2e1758fd08265b9",
+    "spec/v1/gaps.json": "361fb29a27dc933c2462a64f32a5a6a6ecf8e6d9fb46039550cb5cfa2eb0ab13",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -294,9 +294,9 @@
     "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "f8aeec2581bb0b934b2667ac72680f2caf6259b2ca7312e716598e9302573966",
+    "spec/v2/release.json": "1b3dde14cbaf3cfc4eab1ae9a461aab6d357c9c4cda511047087c0b57b400055",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "e2ce7ec18f217f08dd13d6ff1895ea4030b0a76965b774689fb6b52bb20b745a"
+    "spec/v2/surface-baseline.json": "dc52941e7f3e19da5151bb5c994af9b18b137a5a3b34ee0b63bc9cb2789dc52a"
   },
-  "corpusCommit": "10e78e04bc0dac6cb93a0ef00eda5dc7547b4ee8"
+  "corpusCommit": "d310f781e2dcb00d670e26fc23668c2d61548304"
 }

package/src/scenarios/inbound-credential-no-passthrough.test.ts

@@ -42,6 +42,7 @@ import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { targetMajor } from '../lib/seams.js';
 import { startModalReceiver } from '../lib/webhook-receiver.js';
+import { deliveriesFor } from '../lib/standard-webhooks.js';
 import { projectBoundId } from '../lib/bound-id.js';
 
 const DOC = 'spec/v1/auth.md §"Onward hops"; spec/v2/core/security-defaults.md §"Onward hops" (RFC 0200 §E)';
@@ -93,9 +94,19 @@ describe('RFC 0200 §E — inbound-credential-no-passthrough (the caller\'s cred
     });
     if (created.status !== 201) return softSkip('blocked', `could not start ${FIXTURE} (${created.status}) — no run, no delivery, nothing to inspect`);
 
-    const delivered = await waitFor(() => rx.hits.some((h) => !h.verification), WAIT_MS);
+    // Unfailable-leg audit, 2026-09-26: the wait accepted ANY non-verification
+    // hit, so a foreign run.completed (a parallel scenario's run) could end it
+    // before THIS run's delivery — the one carrying the canaries' run — arrived.
+    // The wait now requires a delivery for this run; every hit is still scanned.
+    const runId = (created.json as { runId?: unknown } | null)?.runId;
+    if (typeof runId !== 'string' || runId === '') return softSkip('blocked', `POST ${runsPath()} answered 201 without a runId — this run's delivery cannot be told apart from another run's`);
+    const ours = (): number => (subscriptionId !== null
+      ? deliveriesFor(rx.hits, subscriptionId, runId)
+      : rx.hits.filter((h) => { if (h.verification) return false; try { return (JSON.parse(h.body) as { runId?: unknown }).runId === runId; } catch { return false; } })
+    ).length;
+    const delivered = await waitFor(() => ours() > 0, WAIT_MS);
     // A hop that never happened leaks nothing: this is `blocked`, not a pass.
-    if (!delivered) return softSkip('blocked', `no delivery reached the suite-owned receiver within ${WAIT_MS}ms — an unmade hop cannot witness that a credential did not cross it`);
+    if (!delivered) return softSkip('blocked', `no delivery for run ${runId} reached the suite-owned receiver within ${WAIT_MS}ms (${rx.hits.filter((h) => !h.verification).length} other capture(s)) — an unmade hop cannot witness that a credential did not cross it`);
 
     const canaries: Array<[string, string]> = [['the suite\'s own API key', env.apiKey], ['the Cookie canary', c1], ['the Proxy-Authorization canary', c2]];
     const found: string[] = [];

package/src/scenarios/v2-advertised-fixtures-exist.test.ts

@@ -65,9 +65,16 @@ describe('v2-advertised-fixtures-exist (RFC 0168 §C.3)', () => {
     const ids = advertisedIds(doc);
     if (ids.length === 0) return softSkip('inapplicable', 'the host advertises no fixtures[]');
 
-    // Deterministic sample: the first N by sort order, so a failure is
+    // Deterministic sample spread across the sorted list, so a failure is
     // reproducible and a host cannot pass by luck of ordering.
-    const sample = [...ids].sort().slice(0, SAMPLE);
+    // Unfailable-leg audit, 2026-09-26: the sample was the first N by sort
+    // order, so an unseeded fixture sorting 6th or later was never attempted.
+    // Indices round(i*(n-1)/(SAMPLE-1)), deduped, reach both ends and between.
+    const sorted = [...new Set(ids)].sort();
+    const picks = sorted.length <= SAMPLE
+      ? sorted.map((_, i) => i)
+      : Array.from({ length: SAMPLE }, (_, i) => Math.round((i * (sorted.length - 1)) / (SAMPLE - 1)));
+    const sample = [...new Set(picks)].map((i) => sorted[i]!);
     const unreachable: string[] = [];
     let attempted = 0;
     for (const id of sample) {
@@ -79,7 +86,14 @@ describe('v2-advertised-fixtures-exist (RFC 0168 §C.3)', () => {
       // 201 is the claim honoured. A 4xx that names the workflow as unknown is
       // the drift this leg exists to catch; any other status is a different
       // problem and is not judged here.
-      if (res.status !== 201) unreachable.push(`${id} → ${res.status}`);
+      // The comment above always said only an unknown-workflow refusal is
+      // judged, but the code counted ANY non-201. The 2026-09-26 audit's wider
+      // sample then hit fixtures that need an Idempotency-Key or specific
+      // inputs (a validation 4xx) and failed a conforming host. v2 has no
+      // dedicated unknown-workflow code, so the signal is 404, or a 4xx whose
+      // details.field names workflowId.
+      const field = (res.json as { details?: { field?: unknown } } | null)?.details?.field;
+      if (res.status === 404 || (res.status >= 400 && res.status < 500 && field === 'workflowId')) unreachable.push(`${id} → ${res.status}`);
     }
     if (attempted === 0) return softSkip('blocked', 'no advertised fixture could be attempted');
     expect(

package/src/scenarios/v2-artifact-a2a-shape.test.ts

@@ -118,12 +118,18 @@ describe('RFC 0205 §A.3 — a url Part does not resolve beyond the caller\'s au
     const tenantB = process.env['OPENWOP_TEST_TENANT_B_API_KEY'];
     if (!tenantB) return softSkip('blocked', 'the artifact carries a url Part but OPENWOP_TEST_TENANT_B_API_KEY is not supplied — the second-tenant leg cannot run');
     const base = loadEnv().baseUrl;
+    // unfailable-leg audit, 2026-09-26: the probes use redirect:'manual' and
+    // only failed on a 2xx, so a url that answered 302 to a public pre-signed
+    // object-store URL — readable by tenant B and by anyone — passed. A 3xx is
+    // the host resolving the url for that caller; the only answers that do not
+    // resolve it are a refusal (401/403) or a non-disclosing 404.
+    const REFUSED = new Set([401, 403, 404]);
     for (const u of urls) {
       const abs = new URL(u, base).toString();
       const asB = await fetch(abs, { headers: { Authorization: `Bearer ${tenantB}` }, redirect: 'manual' });
-      expect(asB.status >= 200 && asB.status < 300, req('openwop.requirement.0205.artifact-url-part-scoped', 'RFC 0205 §A.3', `${abs} MUST NOT answer 2xx to tenant B's credential (got ${asB.status})`)).toBe(false);
+      expect(REFUSED.has(asB.status), req('openwop.requirement.0205.artifact-url-part-scoped', 'RFC 0205 §A.3', `${abs} MUST NOT resolve for tenant B's credential: expected 401/403/404, got ${asB.status}${asB.status >= 300 && asB.status < 400 ? ` (a redirect to ${asB.headers.get('location') ?? 'no Location'} resolves the url)` : ''}`)).toBe(true);
       const anon = await fetch(abs, { redirect: 'manual' });
-      expect(anon.status >= 200 && anon.status < 300, req('openwop.requirement.0205.artifact-url-part-scoped', 'RFC 0205 §A.3', `${abs} MUST NOT answer 2xx with no credential (got ${anon.status})`)).toBe(false);
+      expect(REFUSED.has(anon.status), req('openwop.requirement.0205.artifact-url-part-scoped', 'RFC 0205 §A.3', `${abs} MUST NOT resolve with no credential: expected 401/403/404, got ${anon.status}${anon.status >= 300 && anon.status < 400 ? ` (a redirect to ${anon.headers.get('location') ?? 'no Location'} resolves the url)` : ''}`)).toBe(true);
     }
   });
 });