@openwop/openwop-conformance 2.42.3 → 2.42.5

package/src/scenarios/v2-sse-last-event-id.test.ts

@@ -69,6 +69,13 @@ describe('v2 sse-last-event-id (events.md §SSE frames)', () => {
     expect(ids.every((n) => n !== null), req(ID, DOC, `every frame MUST carry id: = its sequence (frames without a parseable id: ${ids.filter((n) => n === null).length} of ${ids.length})`)).toBe(true);
     const seqs = ids as number[];
     expect([...seqs].sort((a, b) => a - b), req(ID, DOC, 'frames MUST arrive in log order')).toEqual(seqs);
+    // unfailable-leg audit wave 2, 2026-09-27: with a single frame, `first` ===
+    // `last` and the mid-stream resume leg compared two empty sets — a host
+    // that ignored Last-Event-ID on a resume with backlog could not fail it. A
+    // completed run's log holds at least `run.started` (events.md: it carries
+    // the owner block) and its terminal event (§The terminal event), and debug
+    // mode streams every event, so ≥2 frames is required, not assumed.
+    expect(seqs.length, req(ID, DOC, `a completed run's debug stream MUST carry at least run.started and its terminal event (got ${seqs.length} frame(s))`)).toBeGreaterThanOrEqual(2);
     const first = seqs[0]!; const last = seqs[seqs.length - 1]!;
 
     const resumed = await subscribe(path, { timeoutMs: 8_000, extraHeaders: V2, lastEventId: String(first) });

package/src/scenarios/v2-version-header-honored.test.ts

@@ -145,10 +145,29 @@ describe('v2-version-header-honored (RFC 0172 §A.3)', () => {
     // A refusal is a correct answer and ends the check: the host has told the
     // truth about not serving major 2.
     if (asked.status === 406) {
+      // unfailable-leg audit wave 2, 2026-09-27: this branch asserted only the
+      // status it had just branched on (`406 === 406`), so ANY 406 passed — a
+      // host that lists `2.x` in protocolVersions[] and still refuses it
+      // (§1.3 row 1: MUST serve a listed major), or one answering 406 with a
+      // bare `{}` body. The refusal is now held to §1.3 row 2 exactly as the
+      // retired-host branch above is: code `protocol_version_unsupported`,
+      // `details.protocolVersions[]` echoing the list, and major 2 NOT listed.
+      let refusal: unknown;
+      try {
+        refusal = JSON.parse(asked.body);
+      } catch {
+        refusal = undefined;
+      }
+      const echoed406 = (refusal as { details?: { protocolVersions?: unknown } } | undefined)?.details?.protocolVersions;
       expect(
-        asked.status,
-        req(ID, DOC, 'a host that does not serve major 2 MUST refuse with 406 protocol_version_unsupported, which it did'),
-      ).toBe(406);
+        {
+          status: asked.status,
+          code: readErrorCode(refusal),
+          echoed: Array.isArray(echoed406) ? [...echoed406].map(String).sort() : echoed406,
+          listsMajor2: majors.has('2'),
+        },
+        req(ID, DOC, `a host that does not serve major 2 MUST refuse OpenWOP-Version: 2.0 with 406 protocol_version_unsupported and details.protocolVersions[] echoing [${advertised.join(', ')}]; a host that LISTS a 2.x member MUST serve it (§1.3 row 1), not refuse it`),
+      ).toEqual({ status: 406, code: 'protocol_version_unsupported', echoed: [...advertised].sort(), listsMajor2: false });
       return softSkip('inapplicable', 'the host refused major 2 with the specified 406 — a correct answer, and there is no second representation to compare bytes against');
     }
     if (asked.status !== 200) {

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -459,6 +459,14 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
       ).toBeLessThanOrEqual(policy.maxAttempts);
     }
     if (inSink === null) {
+      // partial-witness-ok: the retry half of §Durability is observed above
+      // (retried, and capped at maxAttempts). The sink half has no read on a
+      // host without the webhooks.deadLetter facet (RFC 0188 §A.5 makes the read
+      // a 404, not an obligation), so it is unwitnessable here BY DESIGN. It is
+      // not a harness gap that `blocked` would honestly name: a bundle-fatal
+      // `blocked` would deny certification to every conforming host that
+      // declines the optional read. Reviewed in the unfailable-leg audit wave 2
+      // (2026-09-27); the acceptance predicate still refuses this row.
       return softSkip('inapplicable', 'host does not advertise the webhooks.deadLetter facet — RFC 0188 §A.5 makes the read a 404 rather than an obligation, so the sink half of §Durability is unwitnessable here (the retry half above passed)');
     }
     expect(

package/src/scenarios/v2-webhook-unregister-stops-delivery.test.ts

@@ -171,8 +171,13 @@ describe('RFC 0215 §B — unregistering stops the attempts (gated on webhooks)'
       targetLate.length,
       req(ID, DOC, `after unregisterWebhook answers 204 the host MUST NOT start another attempt for that subscription, including retries already scheduled — ${detail}`),
     ).toBe(0);
+    // unfailable-leg audit wave 2, 2026-09-27: a plain softSkip after the
+    // `targetLate === 0` assert recorded a partial-witness `executed-pass`, so a
+    // host that KEPT delivering to an unregistered subscription — but whose
+    // retries fell outside the window — certified. Without a late control
+    // attempt the target's silence proves nothing: `blocked`.
     if (controlLate.length === 0) {
-      return softSkip('skipped', `partial-witness: the control subscription was not retried after the 204 + ${GRACE_MS}ms within ${windowMs}ms either, so the target's silence shows nothing — the schedule finished inside the grace or runs past the window (raise OPENWOP_WEBHOOK_RETRY_WAIT_MS above the host's backoff sum) — ${detail}`);
+      return blockedDespiteAssertions(`the control subscription was not retried after the 204 + ${GRACE_MS}ms within ${windowMs}ms either, so the target's silence shows nothing — the schedule finished inside the grace or runs past the window (raise OPENWOP_WEBHOOK_RETRY_WAIT_MS above the host's backoff sum) — ${detail}`);
     }
   }, CAP_MS * 2 + 90_000);
 });

package/src/scenarios/version-negotiation.test.ts

@@ -74,7 +74,18 @@ describe('version-negotiation: Capabilities advertises a protocolVersion', () =>
       'capabilities.md §3 + version-negotiation.md',
       'Capabilities.protocolVersion MUST be a non-empty string',
     )).toBe('string');
-    expect(String(caps.protocolVersion).length).toBeGreaterThan(0);
+    // unfailable-leg audit wave 2, 2026-09-27: only non-emptiness was checked,
+    // so `v1.0`, `1.0.0`, `1` and `banana` passed. RFC 0149 §C constrains
+    // protocolVersion to ASCII `<major>.<minor>` with no leading zeros —
+    // capabilities.schema.json `protocolVersion.pattern` (the same grammar
+    // lib/profiles.ts PROTOCOL_VERSION_GRAMMAR applies to the core predicate).
+    expect(
+      typeof caps.protocolVersion === 'string' && /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.test(caps.protocolVersion),
+      req('openwop.it.version-negotiation.get-well-known-openwop-returns-capabilities-with-protocolversion-string',
+        'RFC 0149 §C; capabilities.schema.json protocolVersion.pattern',
+        `Capabilities.protocolVersion MUST be ASCII <major>.<minor> with no leading zeros (got ${JSON.stringify(caps.protocolVersion)})`,
+      ),
+    ).toBe(true);
   });
 });
 

package/src/scenarios/webhook-signed-delivery.test.ts

@@ -118,6 +118,8 @@ export const REQUIRES_HOST_CALLBACK = 'the host POSTs a signed webhook delivery
 interface DeliveredRequest {
   readonly headers: Record<string, string>;
   readonly body: string;
+  /** Suite clock (ms) when the receiver recorded the delivery. */
+  readonly receivedAtMs: number;
 }
 
 async function startReceiver(): Promise<ScopedReceiver & { received: DeliveredRequest[] }> {
@@ -141,7 +143,7 @@ async function startReceiver(): Promise<ScopedReceiver & { received: DeliveredRe
       if (typeof v === 'string') headers[k.toLowerCase()] = v;
       else if (Array.isArray(v)) headers[k.toLowerCase()] = v.join(',');
     }
-    received.push({ headers, body: hit.body });
+    received.push({ headers, body: hit.body, receivedAtMs: Date.now() });
     res.writeHead(204);
     res.end();
   });
@@ -352,10 +354,23 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     ).toBe(sub.webhookId);
 
     const timestamp = first.headers['x-openwop-timestamp'];
+    // unfailable-leg audit wave 2, 2026-09-27: this only required a non-empty
+    // string, so an ISO-8601 date, a milliseconds value, or a stale constant
+    // passed "MUST be a Unix-seconds integer" (the HMAC below signs whatever
+    // string was sent, so it could not catch it). Now: digits only (≤ 11 —
+    // seconds, not ms) and within the ±5 min window webhooks.md §"Verification
+    // recipe" tells every subscriber to enforce (a delivery outside it is
+    // rejected by a conforming subscriber, so the host's "when the dispatcher
+    // signed the body" value must fall inside it at receipt).
     expect(
-      typeof timestamp === 'string' && timestamp.length > 0,
-      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', 'X-openwop-Timestamp MUST be a Unix-seconds integer string'),
+      typeof timestamp === 'string' && /^\d{1,11}$/.test(timestamp),
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', `X-openwop-Timestamp MUST be a Unix-seconds integer string (got ${JSON.stringify(timestamp)})`),
     ).toBe(true);
+    const skewSeconds = Math.abs(Number(timestamp) - first.receivedAtMs / 1000);
+    expect(
+      skewSeconds,
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"; §"Verification recipe" step 1 (±5 minutes)', `X-openwop-Timestamp MUST be the signing time — within ±300 s of receipt (off by ${Math.round(skewSeconds)} s)`),
+    ).toBeLessThan(300);
 
     const signature = first.headers['x-openwop-signature'] ?? '';
     expect(