@openwop/openwop-conformance 2.42.2 → 2.42.4

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.42.4] — 2026-09-27 — unfailable-leg audit wave 2, an on-the-wire Idempotency-Key witness, and a gate so the class stops growing
+
+- **Wave 2 of the unfailable-leg audit.** `scripts/audit-unfailable-legs.mjs --all` widened the scan from Accepted-RFC ids to every leg, and added a sixth shape: *asserts, then soft-skips*. At major 2 an `inapplicable` or `skipped` note after an assertion records `executed-pass` with a `partial-witness:` detail; at major 1 a `blocked` note does too. Certification counts both.
+  - **Reviewed:** 111 new candidates in four parallel reviews: 38 confirmed, 18 plausible. Most are fixed; each fix names the non-conforming host it now catches.
+  - **Fixes that only make a leg check what its title already promised:** exact error codes, required schema members, sequence order, per-type (not per-count) supersets, positive controls.
+  - **Changed dispositions:** where a leg asserted setup and then never observed its requirement, it now calls `blockedDespiteAssertions`.
+  - **Guard against over-correction:** a `blocked` row denies the whole bundle, so every new `blocked` was checked against the committed certified bundles. None of them locks out a conforming host. Three changes were reverted to the honest form:
+    - the dead-letter sink half without the optional `deadLetter` read is an annotated partial witness (RFC 0188 §A.5);
+    - backpressure without an advertised `inflightCap` is `inapplicable` before any assertion;
+    - a SHOULD-level `traceId` and an optional `settings` echo are left untouched.
+  - **Left as they are, with reasons:** fixes that need a per-attempt budget seam, a fixture change, or a spec decision (the audit-verify checkpoint signature preimage is stated two different ways).
+- **The RFC 0173 retry leg counts the key on the wire.** `lib/effect-receiver.ts` gains a fail-first mode: it cuts the first attempt's connection, a genuine transport failure, after recording its `Idempotency-Key`. `v2-effect-identity-business-key`'s retry leg now requires the provider to see one key across attempts, equal to the ledger's. The seam contract always said "the suite fixture provider records the idempotency key of each attempt"; until now the leg sent the host to an address nothing listened on. Checked on the v2 reference host, which passes. Sabotaged with a fresh key per attempt behind a constant ledger key: it fails with "2 attempt(s) on the wire carried 2 distinct key(s)".
+- **New gate `scripts/check-softskip-after-assert.mjs`** in `openwop:check`.
+  - A soft-skip after an assertion must be `blockedDespiteAssertions` or carry a `// partial-witness-ok: <why the requirement was already observed>` reason.
+  - Existing sites are a per-file baseline (`conformance/softskip-after-assert.baseline.json`). The baseline is unreviewed debt, not approval, and `--write` refuses to raise it without `--allow-raise`.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.42.4` because `2.42.3` is tagged. Not tagged, not published.
+
+## [2.42.3] — 2026-09-27 — the unfailable-leg audit: 19 legs a non-conforming host could pass now measure their requirement
+
+- **The unfailable-leg audit: 19 legs that a non-conforming host could pass now measure their requirement.** A scanner (`scripts/audit-unfailable-legs.mjs`, an audit aid, not a gate) flagged 66 legs that witness an Accepted RFC's Falsifiability row and have a shape this corpus has shipped as a defect before: satisfiable bounds (the 1 ≤ 1 no-refire leg), loops over a possibly empty list, `if`-guarded assertions, always-defined checks, and the host's own ledger as the only witness. A reviewer judged each one against a single bar: would a host that breaks the rule record `executed-pass`?
+  - **Confirmed and fixed (12):**
+    - `0173.effect-identity-business-key`: a no-op run's empty ledger passed on setup asserts.
+    - `.retry`: an omitted `providerKey` folded to `''`, so "one distinct key" passed.
+    - `0205.artifact-url-part-scoped`: a 3xx to a public pre-signed URL passed.
+    - `0176.era-2-append-vocabulary`: cancel appends names that are the same in v1 and v2, so the writer rule was never tested. It now records `blocked` unless a renamed type is appended. Its `era` leg now requires `eventLogSchemaVersion`.
+    - `0171.poll-cursor-v2.shape`: `lastSequence` must equal the log's highest sequence, and `status`/`isTerminal` must say terminal.
+    - `0173.webhook-durable-delivery`: exponential backoff must actually grow, second gap ≥ 1.5× the first.
+    - `0175.mrtr-rounds-ceiling.refused`: the refusal must come at the ceiling, not before it.
+    - `0215.no-head-of-line`: a serial dispatcher with a short timeout passed as a partial witness. It now fails below the concurrency floor and is otherwise `blocked`.
+    - `0187.bound-id-kinds.per-kind`, effectId/deliveryId: no-op runs record `inapplicable` before any assertion.
+    - `0173.effect-seam-manifest`: removed a loop that could not fail.
+    - RFC 0173 cites `effect-seam-no-refire` for replay suppression.
+    - RFC 0186 says its row is a schema-validation witness.
+  - **Plausible, tightened (7):**
+    - `0201.message-id-stable`: all four delivery keys are required, otherwise `blocked`.
+    - `0169.profiles-derived-only`: records need `status`, `since` and `witness`; a tautology is removed.
+    - `0200.inbound-credential-no-passthrough`: waits for THIS run's delivery.
+    - `0168.advertised-fixtures-exist`: samples across the whole list.
+    - `0198.task-update-approver-checked`: polls about 3 s rather than one 750 ms read.
+    - `0201.endpoint-verification`: a late echo control and a scaled grace; a missing control is `blocked`.
+    - `0207.a2a-malformed-ignored`: the task must not fail or be rejected.
+  - **Not defects:** 47 of the 66 flags; each reviewer recorded its reason.
+  - **Measured against the v2 reference host** (loopback regression lane) before merge.
+- **RFC 0217 gap G1 closes in the contract peer.** `spec/v1/gaps.json` records MyndHyve's certified production witness of `0217.dead-letter-read-after-unregister` (openwop#1631). No scenario change.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.42.3` because `2.42.2` is tagged. Not tagged, not published.
+
 ## [2.42.2] — 2026-09-26 — four conformance legs now measure what their spec says: effect re-fire, keying fallback, A2UI JSON values, digest-safe scrubbing
 
 - **`0173.effect-seam-no-refire` can detect a re-fire.** The leg asserted that the replay fork's ledger count was at most the parent's. The seam fires one attempt on the source run, so a host that re-fires on replay read 1 ≤ 1 and passed, over exactly the defect the leg exists for. ws3 measured it: openwop-app with `sideEffecting` dropped still passed. The leg now fails if the fork records any attempt the parent never made, using the new `lib/effect-refire.ts`. An inherited row repeats a parent attempt's `(nodeId, attempt, at)`, while a re-fire is a new attempt, and one parent row covers at most one fork row. A host whose fork projection is empty passes, as does one that projects the parent's attempts as history. The `effect-ledger-projection` schema description, which said the scenario "compares row COUNTS", is corrected. New suite self-test `src/lib/effect-refire.test.ts` uses a re-firing host stub as its first leg. It is sabotage-proved: with the old count rule restored, that leg fails.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.2 @openwop/spec-artifacts@2.42.2
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.4 @openwop/spec-artifacts@2.42.4
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.2",
-  "stampSha256": "1410563585447c32dced7e6679caf5968a68e9de88c39a5188d527336b86e784"
+  "version": "2.42.4",
+  "stampSha256": "90c82d8a7f1af393b716e4f020d80d6c1925880de7866483ca99aa40a1a7c118"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.42.2",
+  "version": "2.42.4",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.42.2"
+    "@openwop/spec-artifacts": "2.42.4"
   }
 }