@openwop/openwop-conformance 2.42.7 → 2.42.8

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.42.8] — 2026-09-27 — RFC 0221, a closed audit schema again, and a dispatch race fixed
+
+- **`v2-preferred-version-default`: a header-less request on an unversioned operation path is served major 2.** This follows a Class 3 correction to `versioning.md` §1.3: the `preferredVersion` default applies to `/.well-known/openwop` only. The new leg reads `OpenWOP-Version` on a header-less `GET /runs/{unknown}`. It passes on the v2 reference host and fails when the host applies `preferredVersion` to every path.
+- **RFC 0221: a webhook secret the host generates is returned once.** New `v2-webhook-generated-secret.test.ts` (target major 2, gated on the `webhooks` family and `conformance-noop`). It registers without a secret, and the `201` must carry the generated `secret`. A real `run.completed` delivery must then verify under it (`OpenWOP-Signature`, scheme `v1`), and a supplied secret must not be echoed. Witnessed on the v2 reference host with openwop-examples #98; its previous code, which withheld the secret, fails the row.
+- **The 2.42.8 cycle opens.** RFC 0189 (#1675) changed the packed `@openwop/spec-artifacts` tree (`spec/v2/core/i18n.md`, `spec/v2/core/portability.md`, `declaration.json`) after `v2.42.7` was tagged. The published-identity gate correctly refused to call that tree 2.42.7.
+- **RFC 0219 `Active`: `OpenWOP-Client-Version` is declared, and the floor's refusal has an input.** New `v2-client-version-header` (major 2, four legs, requirement ids `openwop.requirement.0219.*`). `floor-comparison` (gated on `minClientVersion`): `<floor>`, `<floor>.0` and `<floor>.99` are served, never `426`. `malformed-not-refused` (gated on a host that refuses `0.0.1` with `426`): `not-a-version`, `1`, `01.0` and `1.0-rc.1` are served, never `426` or `400`; a host that serves `0.0.1` records `inapplicable`. `absent-not-refused`: a header-less request is never `426` on any host, and is served on a host that refuses `0.0.1`. `no-floor-no-refusal`: a host advertising no `minClientVersion` serves `0.0.1`. Sabotage-proved against a stub host implementing `versioning.md` §1.5 exactly: malformed-read-as-`0.0`, malformed-`400`, at-floor refused, a patch-bearing value refused `400`, header-less refused and no-floor-`426` each turn their leg `executed-fail`. **The v2 reference host and openwop-app read a malformed value as `0.0` and refuse it today; the malformed leg fails on both until their fixes land** (RFC 0219 gap G1).
+- **`v2-min-client-version`: a non-`2xx`, non-`426` answer to `0.0.1` is a failure, not `blocked`** (RFC 0219 decision 4), now that the header is declared. When a refusal carries `details.minClientVersion`, it must equal the advertised floor (decision 5). Sabotaged: a `403` refusal and a `details.minClientVersion` of `0.9` against a `1.0` floor each fail the leg; a `details.minClientVersion` outside the axis-1 grammar fails the envelope check.
+- **The v2 error envelope binds a registered `details` schema to its own code.** `schemas/v2/error-envelope.schema.json` (generated by `scripts/generate-error-envelope.mjs`) put every registered `details` schema and an open fallback in one `oneOf`. A conforming body matched two branches, so every envelope carrying registered `details` (`run_state_conflict` with `details.runStatus`, `unsupported_stream_mode` with `details.supported`) failed validation. The envelope now uses `allOf` of `if error == <code> then details: <schema>`. `client_version_unsupported` registers OPTIONAL `details.minClientVersion` (RFC 0219 decision 5).
+- **`audit-log-integrity` validates the verify body against the CLOSED `audit-verify-result.schema.json` again.** The in-test relaxation that stripped every `additionalProperties: false` is gone. It existed because the postgres and sqlite reference hosts put a per-checkpoint `verified` bit on the wire, which the schema's `Checkpoint` does not name. That bit is host-internal (the aggregate verdict is the schema's OPTIONAL `checkpointsValid`), and the hosts now drop it (openwop-examples#96). Sabotaged: a host that emits `verified` fails with `must NOT have additional properties`.
+- **RFC 0033 §C's budget rule is witnessable per attempt.** New OPTIONAL seam `GET …/test/mock-ai/dispatch-budgets` (`host-sample-test-seams.md` §28; `api/seams-v2.yaml` `getMockDispatchBudgets`) returns every mock-provider call's `maxTokens` for a node, in call order. `last-dispatch-budget` kept only the latest call. The `conformance-envelope-retry-attempted` fixture now sets `maxTokens: 256`, so attempt 1 carries a budget. The schema-violation leg of `envelope-completion-distinguishes-truncation` now requires that no retry's budget exceeds the attempt before it; before, it only range-checked the last budget (`< 20000`). Dispositions: seam served → real assertion (a host that sized the retry from the run's accumulated budget, 256 → 512, records `executed-fail`); served but contract broken → `blocked`; not served → partial witness, never `blocked`.
+- **`v2-id-grammar`'s events leg waits for an event instead of racing the dispatch.** It made one 1-second poll straight after creating the run, and recorded `blocked`, which is bundle-fatal, when the host had not yet recorded an event. A host that queues runs, as MyndHyve does through Cloud Tasks, legitimately has none at that instant. MyndHyve's cut 3 on 2.42.7 was denied certification by this row alone. The leg now polls until an event exists, within a scaled 20-second deadline.
+- **Suite `2.42.8`**. `@openwop/spec-artifacts` moves in lockstep at the same exact pin.
+
 ## [2.42.7] — 2026-09-27 — audit residuals, and extension families can graduate on evidence
 
 - **`v2-sse-last-event-id-cursor` joins the core-standard floor.** It was held off until the three bundle hosts were measured. All three record it `executed-pass`: the v2 reference host on 2.42.2, MyndHyve on 2.42.0 and openwop-app on 2.42.2. Two carry `partial-witness` only on the SHOULD leg (a malformed `Last-Event-ID` is accepted, which is recorded rather than failed). No existing claim moves.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.7 @openwop/spec-artifacts@2.42.7
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.8 @openwop/spec-artifacts@2.42.8
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 565 scenario files under `src/scenarios/`.
+The current suite has 567 scenario files under `src/scenarios/`.
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
@@ -481,7 +481,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 565 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 567 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.7",
-  "stampSha256": "8f82b45d0b4004faf11a49d998e0bebefd3ad7a89d82e67322aabafcd18544a1"
+  "version": "2.42.8",
+  "stampSha256": "16b28d93516147ef6c72fd88e10bed168175639ab4c3feaa92859242e93ba00b"
 }

package/fixtures/conformance-envelope-retry-attempted.json

@@ -2,7 +2,7 @@
   "id": "conformance-envelope-retry-attempted",
   "name": "Conformance: envelope.retry.attempted (RFC 0032 §B.1)",
   "version": "1.0",
-  "description": "Drives `core.ai.structuredOutput` against the conformance-only `mock` provider. The conformance scenario POSTs a 2-entry program to `/v1/host/sample/test/mock-ai/program` (keyed by `nodeId: 'retry-attempted-structured-call'`) BEFORE starting the run: attempt 1 returns invalid JSON, attempt 2 returns a valid envelope. The host's `dispatchStructured` retry loop MUST emit exactly one `envelope.retry.attempted` event with `attempt: 2` between the two provider calls (RFC 0032 §B.1). The run terminates `completed` after the second attempt succeeds.",
+  "description": "Drives `core.ai.structuredOutput` against the conformance-only `mock` provider. The conformance scenario POSTs a 2-entry program to `/v1/host/sample/test/mock-ai/program` (keyed by `nodeId: 'retry-attempted-structured-call'`) BEFORE starting the run: attempt 1 returns invalid JSON, attempt 2 returns a valid envelope. The host's `dispatchStructured` retry loop MUST emit exactly one `envelope.retry.attempted` event with `attempt: 2` between the two provider calls (RFC 0032 §B.1). The run terminates `completed` after the second attempt succeeds. `maxTokens: 256` gives attempt 1 a concrete output budget, so `envelope-completion-distinguishes-truncation` can compare each attempt's budget through the `mock-ai/dispatch-budgets` seam (host-sample-test-seams.md §28): a schema-violation retry MUST NOT carry a larger budget than the attempt before it (RFC 0033 §C).",
   "nodes": [
     {
       "id": "retry-attempted-structured-call",
@@ -12,6 +12,7 @@
       "config": {
         "provider": "mock",
         "model": "mock-mini",
+        "maxTokens": 256,
         "outputSchema": {
           "type": "object",
           "required": ["valid"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.42.7",
+  "version": "2.42.8",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.42.7"
+    "@openwop/spec-artifacts": "2.42.8"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 640,
-    "tests": 2460,
-    "withStableId": 2460,
+    "files": 642,
+    "tests": 2466,
+    "withStableId": 2466,
     "interpolatedTitles": 0,
-    "explicitIds": 2350
+    "explicitIds": 2356
   },
   "records": [
     {
@@ -5534,7 +5534,7 @@
     {
       "id": "openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields",
       "file": "audit-log-integrity.test.ts",
-      "line": 69,
+      "line": 60,
       "title": "host that claims the profile advertises required capability fields",
       "explicitId": "openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields",
       "citations": [
@@ -5551,7 +5551,7 @@
     {
       "id": "openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true",
       "file": "audit-log-integrity.test.ts",
-      "line": 92,
+      "line": 83,
       "title": "GET /v1/audit/verify on a recent range reports chainValid: true",
       "explicitId": "openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true",
       "citations": [
@@ -11541,7 +11541,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.capabilities-envelopes-reliability-completion-when-present-conforms-to-rfc-0033",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 103,
+      "line": 104,
       "title": "capabilities.envelopes.reliability.completion (when present) conforms to RFC 0033 §E",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.capabilities-envelopes-reliability-completion-when-present-conforms-to-rfc-0033",
       "citations": [
@@ -11558,7 +11558,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.truncation-emits-envelope-truncated-envelope-retry-attempted-with-reason-truncat",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 126,
+      "line": 127,
       "title": "truncation: emits envelope.truncated + envelope.retry.attempted with reason: \"truncation\"",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.truncation-emits-envelope-truncated-envelope-retry-attempted-with-reason-truncat",
       "citations": [
@@ -11579,7 +11579,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.truncation-retry-budget-strictly-greater-than-initial-rfc-0033-b-truncationbudge",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 151,
+      "line": 152,
       "title": "truncation: retry budget strictly greater than initial (RFC 0033 §B truncationBudgetMultiplier)",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.truncation-retry-budget-strictly-greater-than-initial-rfc-0033-b-truncationbudge",
       "citations": [
@@ -11592,7 +11592,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-no-envelope-truncated-envelope-retry-attempted-reason-schema-vi",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 175,
+      "line": 176,
       "title": "schema-violation: NO envelope.truncated; envelope.retry.attempted reason ∈ {schema-violation, parse-error}",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-no-envelope-truncated-envelope-retry-attempted-reason-schema-vi",
       "citations": [
@@ -11609,13 +11609,18 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 205,
+      "line": 206,
       "title": "schema-violation: retry budget UNCHANGED from initial (no budget multiplication on this path)",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on",
       "citations": [
         {
           "section": "RFCS/0033-envelope-completion-contract.md §C",
           "requirement": "schema-violation retry MUST NOT multiply maxTokens — budget stays at the original value (host default)"
+        },
+        {
+          "section": "RFCS/0033-envelope-completion-contract.md §C",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
@@ -28349,6 +28354,86 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-client-version-header.a-client-at-the-floor-is-not-below-it-equal-on-major-minor-the-patch-never-decid",
+      "file": "v2-client-version-header.test.ts",
+      "line": 79,
+      "title": "a client at the floor is not below it: equal on major.minor, the patch never decides",
+      "explicitId": "openwop.requirement.0219.floor-comparison",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-client-version-header.a-malformed-openwop-client-version-is-treated-as-absent-never-426-never-400",
+      "file": "v2-client-version-header.test.ts",
+      "line": 90,
+      "title": "a malformed OpenWOP-Client-Version is treated as absent: never 426, never 400",
+      "explicitId": "openwop.requirement.0219.malformed-not-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-client-version-header.a-request-without-openwop-client-version-is-served-where-a-below-floor-one-is-re",
+      "file": "v2-client-version-header.test.ts",
+      "line": 102,
+      "title": "a request without OpenWOP-Client-Version is served where a below-floor one is refused",
+      "explicitId": "openwop.requirement.0219.absent-not-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": "a host MUST NOT answer 426 client_version_unsupported to a request that carries no OpenWOP-Client-Version"
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-client-version-header.a-host-that-advertises-no-minclientversion-refuses-no-client-on-version-grounds",
+      "file": "v2-client-version-header.test.ts",
+      "line": 115,
+      "title": "a host that advertises no minClientVersion refuses no client on version grounds",
+      "explicitId": "openwop.requirement.0219.no-floor-no-refusal",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-coherence-not-in-bundle.every-corpus-ledger-id-has-a-scenario-in-src-coherence-and-none-in-src-scenarios",
       "file": "v2-coherence-not-in-bundle.test.ts",
@@ -29690,7 +29775,7 @@
     {
       "id": "openwop.it.v2-id-grammar.every-id-on-the-run-snapshot-matches-its-ids-schema-json-kind",
       "file": "v2-id-grammar.test.ts",
-      "line": 53,
+      "line": 55,
       "title": "every id on the run snapshot matches its ids.schema.json kind",
       "explicitId": "openwop.requirement.0170.id-grammar.snapshot",
       "citations": [
@@ -29709,7 +29794,7 @@
     {
       "id": "openwop.it.v2-id-grammar.every-id-on-the-run-events-matches-its-ids-schema-json-kind",
       "file": "v2-id-grammar.test.ts",
-      "line": 63,
+      "line": 65,
       "title": "every id on the run events matches its ids.schema.json kind",
       "explicitId": "openwop.requirement.0170.id-grammar.events",
       "citations": [
@@ -29727,7 +29812,7 @@
     {
       "id": "openwop.it.v2-id-grammar.a-run-id-whose-tenant-segment-is-not-the-caller-s-is-refused",
       "file": "v2-id-grammar.test.ts",
-      "line": 78,
+      "line": 90,
       "title": "a run id whose tenant segment is not the caller's is refused",
       "explicitId": "openwop.requirement.0170.id-grammar.tenant-binding",
       "citations": [
@@ -29750,7 +29835,7 @@
     {
       "id": "openwop.it.v2-id-grammar.a-bare-unbound-run-id-in-a-major-2-path-admitted-under-the-caller-s-tenant-throu",
       "file": "v2-id-grammar.test.ts",
-      "line": 88,
+      "line": 100,
       "title": "a bare (unbound) run id in a major-2 path: admitted under the caller's tenant through the overlap, refused 400 validation_error after it",
       "explicitId": "openwop.requirement.0170.id-grammar.bare-id",
       "citations": [
@@ -31289,7 +31374,7 @@
     {
       "id": "openwop.it.v2-min-client-version.a-client-below-minclientversion-is-refused-with-426-client-version-unsupported",
       "file": "v2-min-client-version.test.ts",
-      "line": 35,
+      "line": 38,
       "title": "a client below minClientVersion is refused with 426 client_version_unsupported",
       "explicitId": "openwop.requirement.0172.min-client-version",
       "citations": [
@@ -31297,6 +31382,11 @@
           "section": "spec/v2/core/versioning.md §1.5",
           "requirement": "minClientVersion MUST use the <major>.<minor> grammar (axis 15, as axis 1)"
         },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "spec/v2/core/versioning.md §1.5",
           "requirement": "a 426 refusal MUST carry client_version_unsupported"
@@ -31305,6 +31395,11 @@
           "section": "spec/v2/core/errors.md §The envelope",
           "requirement": null,
           "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
@@ -32238,7 +32333,7 @@
     {
       "id": "openwop.it.v2-preferred-version-default.preferredversion-is-a-member-of-protocolversions",
       "file": "v2-preferred-version-default.test.ts",
-      "line": 40,
+      "line": 41,
       "title": "preferredVersion is a member of protocolVersions[]",
       "explicitId": "openwop.requirement.0172.preferred-version-default.member",
       "citations": [
@@ -32260,7 +32355,7 @@
     {
       "id": "openwop.it.v2-preferred-version-default.a-header-less-get-well-known-openwop-is-the-preferredversion-representation",
       "file": "v2-preferred-version-default.test.ts",
-      "line": 52,
+      "line": 53,
       "title": "a header-less GET /.well-known/openwop is the preferredVersion representation",
       "explicitId": "openwop.requirement.0172.preferred-version-default.headerless",
       "citations": [
@@ -32288,10 +32383,24 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-preferred-version-default.a-header-less-request-on-any-other-unversioned-path-is-served-major-2",
+      "file": "v2-preferred-version-default.test.ts",
+      "line": 71,
+      "title": "a header-less request on any other unversioned path is served major 2",
+      "explicitId": "openwop.requirement.0172.preferred-version-default.unversioned-is-v2",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.2, §1.3",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-preferred-version-default.through-the-overlap-preferredversion-names-a-1-x-member",
       "file": "v2-preferred-version-default.test.ts",
-      "line": 70,
+      "line": 88,
       "title": "through the overlap preferredVersion names a 1.x member",
       "explicitId": "openwop.requirement.0172.preferred-version-default.overlap",
       "citations": [
@@ -34020,6 +34129,40 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-webhook-generated-secret.a-secret-less-registration-returns-the-generated-secret-and-deliveries-verify-un",
+      "file": "v2-webhook-generated-secret.test.ts",
+      "line": 44,
+      "title": "a secret-less registration returns the generated secret, and deliveries verify under it; a supplied secret is never echoed",
+      "explicitId": "openwop.requirement.0221.generated-secret-returned",
+      "citations": [
+        {
+          "section": "RFC 0221 · webhooks.md §Surfaces",
+          "requirement": "a registration that omits secret MUST get the host-generated secret back in the 201 as a non-empty string"
+        },
+        {
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+        },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": "the subscription MUST receive the run.completed delivery"
+        },
+        {
+          "section": "RFC 0221 · webhooks.md §Surfaces",
+          "requirement": "the delivery MUST verify (OpenWOP-Signature, scheme v1) under the secret the 201 returned"
+        },
+        {
+          "section": "RFC 0221 · webhooks.md §Surfaces",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0221 · RFC 0201 §B.6",
+          "requirement": "the 201 MUST NOT echo a supplied secret"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-webhook-message-id-stable.every-attempt-of-one-delivery-carries-one-webhook-id-and-distinct-deliveries-car",
       "file": "v2-webhook-message-id-stable.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 565,
+    "files": 567,
     "v1": 451,
-    "v2": 126
+    "v2": 128
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1317,6 +1317,9 @@
     "v2-chain-pin-exact.test.ts": [
       2
     ],
+    "v2-client-version-header.test.ts": [
+      2
+    ],
     "v2-coherence-not-in-bundle.test.ts": [
       2
     ],
@@ -1587,6 +1590,9 @@
     "v2-webhook-endpoint-verification.test.ts": [
       2
     ],
+    "v2-webhook-generated-secret.test.ts": [
+      2
+    ],
     "v2-webhook-message-id-stable.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.7",
-  "corpusTag": "v2.42.7",
+  "version": "2.42.8",
+  "corpusTag": "v2.42.8",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "32ff503cc953a0d824789241295f08504db7d8a167bd2a2d9f489bcb7cb015e8",
-    "api/v2/asyncapi.yaml": "a7a442826ad9641640b2cc6b9ce1de9beef93b9290f19cd17cf2254ea94c932b",
-    "api/v2/openapi.yaml": "4d631c452aeec8eea96c03ea85f14fc56ea73ca476433bf98cc9c4bf0984e820",
+    "api/seams-v2.yaml": "deda53b9f8917a1dc4b283e50cb47985c0fd06525c96fdf853c2fdb1a2de5cb8",
+    "api/v2/asyncapi.yaml": "a35292b35d003361a9a0a7997557e022641cd869a6aefcd31ab266d0c3fea215",
+    "api/v2/openapi.yaml": "8381ff1d3cca7c0610a5f5a885763a625630c8b36bb5c5f6cd1d3f3cceb176a7",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -116,7 +116,7 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "2a4bfc42976717f78c10468fdba756ca6b19e49762699e6dffd418ffff08e55d",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
-    "schemas/v2/capabilities.schema.json": "65bd0b18b4c00708bc582af9fb4399fd3009c4d452401c6c8ad26695b00b7235",
+    "schemas/v2/capabilities.schema.json": "959b7a1b8e40aeafb8b9702bd0e4b220c0beb02a6afa3ca64fe9b04b95ae3df5",
     "schemas/v2/certification-bundle.schema.json": "82ce31a1ed6c7e21b0ba88ff62a7b8b768fc3b176b1d06fce023203830b94725",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -142,7 +142,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "e92a2548ba65454c9e0a34f72ea6768d18f59e61fa5da7668d0b2d5baddaddc8",
-    "schemas/v2/error-envelope.schema.json": "b812a33626efd68d492269ff4a713e5a91a59d7071eb2470db99757f260e5d47",
+    "schemas/v2/error-envelope.schema.json": "467d7109c54bff71a6cfd457d3bd65a23ca34b8e5577e742d080692771a78ebf",
     "schemas/v2/eval-summary.schema.json": "2f384daf05b8f3b4f604688cae504d6d9971ba41b8c771e55fe9a17e09e86b7a",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "a1942a124e250a6e9fbdb6b811c5a125e78fbcbcaa46dfc71d0636f24710a339",
@@ -202,51 +202,53 @@
     "schemas/workload-identity.schema.json": "64ed93e12cc9f0657e56ff9b8f045e5d68d397df5276d103c07f42c7f34f0579",
     "schemas/workspace-file-create.schema.json": "70a23b92c2958c0165d7d29aea9020a045dc7816af82c80c5f50d0aac19c4856",
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
-    "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
+    "spec/v1/alias-detectors.json": "29f21e0fb2c7a232a92a5c19b4cba3a86bc3b5e16f06780452f0421c66c6ec38",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "5c8757f4745d701dd79b34c63e4ba5ef9623292cc8ae7c661f2976f4a5b142a1",
-    "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
+    "spec/v1/core-standard-manifest.json": "1359a69ad091b8bd3fb8fb7b641b32496d0d7a70d40cb0d1b93c6f171566276e",
+    "spec/v1/deprecations.json": "46df807fb4adf0aae24671c20f69975cf3496e3bc3a521cb7e6ea556bdce563c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "456f3453ce453f0149f3d95c1ac26e669ae7d2bf2541a26320860105c4d55566",
+    "spec/v1/gaps.json": "2b032d91d614a758db347be4f5e617b8ac3c4622b6f95ffcfa928276c0fb7377",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
-    "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
+    "spec/v1/migrations.json": "2efcd9064b2bc65a84a3b3d281aa86a91efd002690c1f4f14e8335c4a18194d1",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "fada0342815fb129c1ae61f1829bd6e34417717408ce86fcc54280f373c19e74",
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
-    "spec/v2/README.md": "4cb63710360e9322a1c7c04aacbad5ce890f79c2da24e7da5ac3bf1fc90bebd7",
+    "spec/v2/README.md": "4fa067d377580495e60baf08a4eafc3214b8ca48d8fb270bf91fc5066fad7186",
     "spec/v2/core/capabilities.md": "225269a257421ebe677070dd13b05f6f297a2a343916e440b7428b839e2da9a4",
     "spec/v2/core/conformance.md": "e7bd7d54062f28801071165a1b92edbeee3774bb3710f31eed75817139b66d95",
     "spec/v2/core/connection-packs.md": "3168d2c8f1a59417a7256a678f4203570be434f64dead6b11fdec86b352686df",
     "spec/v2/core/conversation.md": "6db43d8160bc45d3944aa1151816a6f0fd1669d59d7f822267a2d6cc9db22990",
-    "spec/v2/core/errors.md": "7ba57f0922673038a5f8479b47da88810bf15145ed14a0cd1ef43214e8eb27b5",
+    "spec/v2/core/errors.md": "d14649ee60f8260ec163464163409ad7f50cb86fee7b846e0190f66070b3774b",
     "spec/v2/core/events.md": "234338deb97be648731e8ab2126a90b7b8ad0a7070d98ffc85ee4689ff059791",
-    "spec/v2/core/form-content-packs.md": "347b1c649864360bf2731e6e047a3e26b0783530201185827e85359e90f0b233",
-    "spec/v2/core/headers.md": "89839a4e1ad793e565afe672c8e003ab3852ab7be89145a2510860ac5ca4de5c",
+    "spec/v2/core/form-content-packs.md": "41d40afe0a3760bcd792a4c406e16f28b0ab0aa7b0925323110d3fa2730d5400",
+    "spec/v2/core/headers.md": "5cb1624fa63acc81992b6a6d842ec392cf7271aaf2f65d1f83c8c4fa286e6730",
     "spec/v2/core/host-services.md": "15923cceb95cba148a32e0944f6a2d1d25e9cc36b0c169b67ee42d483bcac800",
+    "spec/v2/core/i18n.md": "846c6d2878fc8454c2ae0a1576f6b6e6c8958d47187a6c96cc5826ca3c3e2e91",
     "spec/v2/core/idempotency.md": "21830b7d23dd03e9e8ba4b0de253dd001fc960f166310d6b6b60b1c33cf60b30",
-    "spec/v2/core/identity.md": "fb6606a322a9167b8ab91402cf7214b6ced3e439eb4b6f9240a0739d9a3e58f1",
+    "spec/v2/core/identity.md": "acb7f739729c69a1f40dcaa5b1d873ba9f32993c17bfd297f5fa56351cf47c69",
     "spec/v2/core/interop.md": "3cfa2af70ae6ba1f4b4268447d46d1d2f5fb65f7917f15bad159d9779d25b1a6",
     "spec/v2/core/interrupt.md": "b31b3f3be7888043ef38c82367a8d743a775c2b6bd499f7da44355ff00452435",
     "spec/v2/core/node-pack-runtimes.md": "d52966319c53aaa03575025915b73b470a42832c039c41d73aff6931758630cb",
     "spec/v2/core/oauth.md": "57f167d899993b6959c243e4102819f4014b365299b9b2b253decd2781e6b8b7",
-    "spec/v2/core/overview.md": "bb6b088d5ffd3ea3f336bba37ef2ca45e7b0bee2c7f25ecb2d78d3f25a3fcee1",
+    "spec/v2/core/overview.md": "3dbc8c0cf7474b31816b1a12412c1edf5597066c38edcdbca4dd2e465880f65b",
     "spec/v2/core/packs.md": "26b0fc3b81f98adbdf70796482db89fa81a6ce3da6f830cd5e8b3d71541c497f",
     "spec/v2/core/persistence.md": "bba672ed3bf6d83af6e4e65c0f4f480fc21fe12207811e321306af2108d9010d",
+    "spec/v2/core/portability.md": "a35fbe66b8b5ccf63cf0216157d4b61d4c47f6dc8e757c830569ddf244e21e8a",
     "spec/v2/core/replay.md": "a5be4e05242f25f8b5a8a4fb31bd359d5abb4bf34fa8e536403a8ee5779ab876",
-    "spec/v2/core/runs.md": "26b459d522901ccf752470c6c9c902af435d7e9690755438ddb24c150424341d",
+    "spec/v2/core/runs.md": "72a94c27d884036d84290e9b108702e98b0c6b2fb598213bbda44fba9c9f860d",
     "spec/v2/core/security-defaults.md": "179fdd2efcc1454453243f8ab6473335dfd4389e70cbbc2669f5b83714092973",
     "spec/v2/core/tool-catalog.md": "6b54b8ce221107de19c718f374a720123c6a5f55db4054e6625f73d06e0a442f",
-    "spec/v2/core/versioning.md": "000fa2db433039fc4f2b0ad7dc2cbf7aadc10eae60322018727da6f99eda4dc3",
-    "spec/v2/core/webhooks.md": "0398db27b2ddd97bc2a9a9b1236b5139451765462789dee9c3a8cc6b7b81e666",
+    "spec/v2/core/versioning.md": "2bfe16a72a909c46b4585fab39dc9e94c97506ed95df6b1b527f97b4cd3684ef",
+    "spec/v2/core/webhooks.md": "78fe97ab5bdee20218183efe32abf5ba1996705d757cb37c8d6a4d808c44199f",
     "spec/v2/core/workflow-chain-packs.md": "35a957f1dd22016febd76bf2c4dfb79cda58b95d8efd8893b5e5babda9f79cf3",
     "spec/v2/corrections.json": "b19f8a80fce7e6473012a20a216e358dd38ae7411e6a348f8031e325ed1a0a01",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "6ed50f204eaac5885188237378feb0f555c4290455861cad133141b8d1296eff",
+    "spec/v2/declaration.json": "1253a5590ec2d9ba511d15e8a9d9da5e6926c4daa981a26b73b29bc915477013",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
-    "spec/v2/errors.json": "034d5c77088c594e104de783ce7ca55c8174923b4fd177593da231f3bfcacaaa",
+    "spec/v2/errors.json": "b89664e9e0e7603253712263ce0843ce607e276c67d0acaf4a680c39bb2bd682",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
@@ -263,7 +265,7 @@
     "spec/v2/ext/knowledge/README.md": "67be1dc97e5cdc9527d56f4836dc96841548a9c2f8f964777825d56fdf9f0e53",
     "spec/v2/ext/launchStudio/README.md": "c732bb855252c31ee1e971cbc2936f2ca29b234c111d548c648095634507babb",
     "spec/v2/ext/messaging/README.md": "32c222c0bce515e75b62a5a44b9f09d0e23c1b40f424e1ab8309deefd296c4b6",
-    "spec/v2/ext/portability/README.md": "0df93357a90ca6317f16a2bdd45b5073965a3d52a020daf900a74f5fcd709bf8",
+    "spec/v2/ext/portability/README.md": "c59423ee446638b748a911b9e97e803c4786157be6120f656f0a060586bc7b82",
     "spec/v2/ext/provider-idempotency/README.md": "9d1bccef0ec16a19a3370ae79c2f5a1726ce0d1d25a51352907f288a2ccb15d7",
     "spec/v2/ext/provider-idempotency/registry.json": "5b5fecad604fb4ab38da39f5abe697a4e57b05406c398f8afeb377331b2bd965",
     "spec/v2/ext/restTransport/README.md": "d485417310616b2f1da97106d970293f3f5712f6cadb6b840f5ac84ee28bdda6",
@@ -295,9 +297,9 @@
     "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "0b9bc03ec7efd4cfacfe6ca72b57655787ee9cc5473e9a9b7af21bb1f25350a7",
+    "spec/v2/release.json": "f2f87ba5a5476f2213b3486a2618ef3c7381b47c96dd3f082bee0e07ac4a35bc",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "549832c2de97b7c7aed07934c1c73c2709ac226dc0cb71fc8c141010bc4928f1"
+    "spec/v2/surface-baseline.json": "fce9d8eeea653476e09b19e525a0b104caab6c51a0b7b427d7d941e2b7118573"
   },
-  "corpusCommit": "f6209c3b2095005b844b44d5046873e4170d9736"
+  "corpusCommit": "0ed567fece2f9c5c5ad337fed92f6926ad7547af"
 }

package/src/lib/mock-ai-budgets.ts

@@ -0,0 +1,40 @@
+/**
+ * Per-attempt dispatch budgets — `GET /v1/host/sample/test/mock-ai/dispatch-budgets`
+ * (host-sample-test-seams.md §28; v2 `api/seams-v2.yaml` `getMockDispatchBudgets`).
+ *
+ * The companion `last-dispatch-budget` seam reports only the most recent call's
+ * `maxTokens`, so a retry's budget cannot be compared with the attempt before
+ * it. This seam returns every call's budget in call order. OPTIONAL: an
+ * unserved seam (404/405/501) is `unserved`, so the caller falls back to its
+ * pre-seam partial witness; a served seam that answers anything else is
+ * `broken`, which the caller records as `blocked`.
+ */
+
+import { driver } from './driver.js';
+
+export type DispatchBudgets =
+  | { ok: true; attempts: Array<number | null> }
+  | { ok: false; unserved: true; reason: string }
+  | { ok: false; unserved: false; reason: string };
+
+const UNSERVED = new Set([404, 405, 501]);
+
+export async function readDispatchBudgets(nodeId: string): Promise<DispatchBudgets> {
+  const res = await driver.get(`/v1/host/sample/test/mock-ai/dispatch-budgets?nodeId=${encodeURIComponent(nodeId)}`);
+  if (UNSERVED.has(res.status)) {
+    return { ok: false, unserved: true, reason: `the dispatch-budgets seam is not served (${res.status})` };
+  }
+  const attempts = (res.json as { attempts?: unknown } | undefined)?.attempts;
+  if (res.status !== 200 || !Array.isArray(attempts)) {
+    return { ok: false, unserved: false, reason: `the dispatch-budgets seam answered ${res.status} without an attempts[] array (host-sample-test-seams.md §28)` };
+  }
+  const out: Array<number | null> = [];
+  for (const a of attempts) {
+    const m = (a as { maxTokens?: unknown } | null)?.maxTokens;
+    if (m !== null && !(typeof m === 'number' && Number.isInteger(m))) {
+      return { ok: false, unserved: false, reason: `the dispatch-budgets seam returned an entry whose maxTokens is ${JSON.stringify(m)}, not an integer or null (host-sample-test-seams.md §28)` };
+    }
+    out.push(m);
+  }
+  return { ok: true, attempts: out };
+}

package/src/scenarios/audit-log-integrity.test.ts

@@ -27,23 +27,14 @@ import { join } from 'node:path';
 import { SCHEMAS_DIR } from '../lib/paths.js';
 
 /**
- * audit-verify-result.schema.json with every `additionalProperties: false`
- * relaxed: the REQUIRED members and their types are enforced, extra members
- * are not (the reference postgres host emits `checkpointsValid` and a
- * per-checkpoint `verified` bit; convicting extras is a separate decision).
+ * audit-verify-result.schema.json, CLOSED: every `additionalProperties: false`
+ * is enforced. (Until 2026-09-27 the suite stripped them because the reference
+ * postgres/sqlite hosts emitted a per-checkpoint `verified` bit the schema does
+ * not name; the hosts now keep that bit host-internal. The aggregate verdict is
+ * the schema's OPTIONAL `checkpointsValid`.)
  */
-function relaxAdditional(node: unknown): unknown {
-  if (Array.isArray(node)) return node.map(relaxAdditional);
-  if (node === null || typeof node !== 'object') return node;
-  const out: Record<string, unknown> = {};
-  for (const [k, v] of Object.entries(node as Record<string, unknown>)) {
-    if (k === 'additionalProperties' && v === false) continue;
-    out[k] = relaxAdditional(v);
-  }
-  return out;
-}
-const VERIFY_RESULT_SCHEMA = relaxAdditional(
-  JSON.parse(readFileSync(join(SCHEMAS_DIR, 'audit-verify-result.schema.json'), 'utf8')),
+const VERIFY_RESULT_SCHEMA = JSON.parse(
+  readFileSync(join(SCHEMAS_DIR, 'audit-verify-result.schema.json'), 'utf8'),
 ) as Record<string, unknown>;
 
 interface AuditIntegrityCaps {

package/src/scenarios/envelope-completion-distinguishes-truncation.test.ts

@@ -33,7 +33,8 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
+import { readDispatchBudgets } from '../lib/mock-ai-budgets.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 /**
@@ -210,26 +211,61 @@ describe.skipIf(HTTP_SKIP)('envelope-completion-distinguishes-truncation: schema
     ]);
     if (seed.status === 404) return softSkip('blocked', 'precondition not met — `seed.status === 404` returned early (seam, prior step, or fixture unavailable)');
 
-    await startRunAndRead(SCHEMA_VIOLATION_FIXTURE);
-    const budget = await lastBudget(SCHEMA_VIOLATION_FIXTURE);
-    if (budget === null) return softSkip('blocked', 'precondition not met — `budget === null` returned early (seam, prior step, or fixture unavailable)');
-    // The schema-violation fixture doesn't set maxTokens explicitly →
-    // budget snapshots whatever the host's default is on each call.
-    // The KEY invariant: the retry call's budget MUST NOT be multiplied
-    // (the truncation path doubles; this path keeps the same). The
-    // budget on the last call equals the budget on the first call.
-    // Without a per-call history hook, we can't strictly compare; we
-    // assert the budget didn't grow into the truncation-path range
-    // (which would be ≥2× the default — typically 8000 for the
-    // sample's structuredOutput dispatch path).
-    if (budget !== null) {
+    const result = await startRunAndRead(SCHEMA_VIOLATION_FIXTURE);
+    const REQ_ID = 'openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on';
+
+    // Suite 2.42.7: the per-attempt witness. `last-dispatch-budget` reports only
+    // the most recent call, so the retry's budget could not be compared with the
+    // attempt before it — a host that doubled 256 → 512 on a schema-violation
+    // retry passed the `< 20_000` range check below. `dispatch-budgets`
+    // (host-sample-test-seams.md §28) returns every call's budget in call order,
+    // and the fixture now sets `maxTokens: 256` so attempt 1 carries one. A served
+    // seam that breaks its contract is `blocked`; an UNSERVED one falls through to
+    // the pre-seam partial witness below (the seam is newer than this leg).
+    const budgets = await readDispatchBudgets(NODE_OF[SCHEMA_VIOLATION_FIXTURE] as string);
+    if (!budgets.ok && !budgets.unserved) return blockedDespiteAssertions(budgets.reason);
+    if (!budgets.ok) {
+      const budget = await lastBudget(SCHEMA_VIOLATION_FIXTURE);
+      if (budget === null) return softSkip('blocked', 'precondition not met — `budget === null` returned early (seam, prior step, or fixture unavailable)');
+      // Pre-seam path: only the most recent call's budget is visible, so it is
+      // range-checked against the truncation path (≥2× the default — typically
+      // 8000 for the sample's structuredOutput dispatch path), not compared.
       expect(
         budget,
-        req('openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on', 
+        req(REQ_ID,
           'RFCS/0033-envelope-completion-contract.md §C',
           'schema-violation retry MUST NOT multiply maxTokens — budget stays at the original value (host default)',
         ),
       ).toBeLessThan(20_000);
+      // partial-witness-ok: the host does not serve the optional dispatch-budgets
+      // seam (host-sample-test-seams.md §28), so the retry's budget is range-checked,
+      // not compared with the attempt before it. The acceptance predicate refuses a
+      // partial-witness row.
+      return softSkip('inapplicable', `partial witness — the §C budget rule is only range-checked: ${budgets.reason}; the most recent call's maxTokens (${budget}) is below the truncation-path range, but a retry that grew the budget within that range is not detected`);
+    }
+    if (result === null) return blockedDespiteAssertions('the run create or event-log read failed — the retry count the budgets are checked against was never observed');
+    const retries = result.events.filter((e) => e.type === 'envelope.retry.attempted').length;
+    // RFC 0033 §C: a host MAY retry. No retry means no retry budget to compare;
+    // the sibling leg above convicts a host that should have retried and did not.
+    // partial-witness-ok: no retry happened, so there is no retry budget to observe.
+    if (retries === 0) return softSkip('inapplicable', 'the host made no schema-violation retry (RFC 0033 §C: MAY retry) — there is no retry budget to compare');
+    if (budgets.attempts.length < retries + 1) {
+      return blockedDespiteAssertions(`the dispatch-budgets seam recorded ${budgets.attempts.length} call(s) but the run emitted ${retries} envelope.retry.attempted event(s), i.e. ${retries + 1} calls — the seam does not report every attempt (host-sample-test-seams.md §28)`);
+    }
+    const attempts = budgets.attempts;
+    if (!attempts.every((m): m is number => m !== null)) {
+      // partial-witness-ok: the seam is served but at least one call carried no
+      // budget (maxTokens null), so no two attempts' budgets can be compared.
+      return softSkip('inapplicable', `partial witness — the §C budget rule is UNWITNESSED: the dispatch-budgets seam shows a call with no output budget (per-attempt budgets: ${JSON.stringify(attempts)}), so no retry's budget can be compared with the attempt before it`);
+    }
+    for (let i = 1; i < attempts.length; i++) {
+      expect(
+        attempts[i]! <= attempts[i - 1]!,
+        req(REQ_ID,
+          'RFCS/0033-envelope-completion-contract.md §C',
+          `schema-violation retries SHALL NOT include an increased output budget — attempt ${i + 1} carried maxTokens ${attempts[i]} after attempt ${i} carried ${attempts[i - 1]} (per-attempt budgets: ${JSON.stringify(attempts)})`,
+        ),
+      ).toBe(true);
     }
   });
 });

package/src/scenarios/v2-client-version-header.test.ts

@@ -0,0 +1,124 @@
+/**
+ * v2 — `OpenWOP-Client-Version` (suite 2.42.8; RFC 0219;
+ * `spec/v2/core/versioning.md` §1.5 "Client precedence and minClientVersion").
+ *
+ * A client announces the protocol version it implements in
+ * `OpenWOP-Client-Version: <major>.<minor>[.<patch>]`. A host that advertises
+ * `minClientVersion` MAY refuse a client below it with `426
+ * client_version_unsupported`, and MUST NOT refuse anything else on version
+ * grounds. Every leg probes `GET /.well-known/openwop` under
+ * `OpenWOP-Version: 2.0` (the discovery document is not exempt from refusal).
+ *
+ *   floor-comparison     (gated on minClientVersion) `<floor>`, `<floor>.0` and
+ *                        `<floor>.99` are served: equal on major.minor is not
+ *                        below, and the patch never decides.
+ *   malformed-not-refused (gated on a host that refuses `0.0.1` with 426) the
+ *                        malformed values `not-a-version`, `1`, `01.0` and
+ *                        `1.0-rc.1` are treated as absent and served — never
+ *                        426, never 400. A host that serves `0.0.1` does not
+ *                        exercise the refusal, so a served malformed value
+ *                        proves nothing there: `inapplicable`.
+ *   absent-not-refused   a header-less request is never 426 (every host); on a
+ *                        host that refuses `0.0.1` with 426, it is also served.
+ *   no-floor-no-refusal  (hosts advertising NO minClientVersion) `0.0.1` is
+ *                        served, not 426. None of today's certified hosts is in
+ *                        this state, so it records `inapplicable` on each.
+ *
+ * Unwitnessed and recorded in RFC 0219's falsifiability table: a host choosing
+ * a major or a representation from the header, and the header used as an
+ * authentication or authorization input.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/versioning.md §1.5';
+const PATH = '/.well-known/openwop';
+const FLOOR = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+/** Below any floor a host can advertise except `0.0`, which nothing is below. */
+const BELOW = '0.0.1';
+const MALFORMED = ['not-a-version', '1', '01.0', '1.0-rc.1'] as const;
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function probe(clientVersion: string | null): Promise<OpenWOPResponse | null> {
+  const headers: Record<string, string> = { 'OpenWOP-Version': '2.0' };
+  if (clientVersion !== null) headers['OpenWOP-Client-Version'] = clientVersion;
+  try { return await driver.get(PATH, { authenticated: false, headers }); } catch { return null; }
+}
+const served = (r: OpenWOPResponse): boolean => r.status >= 200 && r.status < 300;
+
+/** The advertised floor, or a skip reason. */
+async function advertisedFloor(): Promise<{ floor: string } | { skip: [kind: 'blocked' | 'inapplicable', reason: string] }> {
+  const doc = await discovery();
+  if (!doc) return { skip: ['blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0'] };
+  const floor = doc['minClientVersion'];
+  if (floor === undefined) return { skip: ['inapplicable', 'the host does not advertise minClientVersion — the floor legs are gated on a host that sets it'] };
+  // The floor's own grammar is v2-min-client-version's row; a floor this leg cannot read compares nothing.
+  if (typeof floor !== 'string' || !FLOOR.test(floor)) return { skip: ['inapplicable', `minClientVersion ${JSON.stringify(floor)} is not <major>.<minor> — judged by v2-min-client-version, nothing to compare here`] };
+  if (floor === '0.0') return { skip: ['inapplicable', 'minClientVersion is 0.0 — no well-formed client version is below it, so no refusal can be provoked'] };
+  return { floor };
+}
+
+/** Gate for the legs that need a host which actually refuses a below-floor client. */
+async function refusingHost(): Promise<{ floor: string } | { skip: [kind: 'blocked' | 'inapplicable', reason: string] }> {
+  const f = await advertisedFloor();
+  if ('skip' in f) return f;
+  const control = await probe(BELOW);
+  if (control === null) return { skip: ['blocked', `GET ${PATH} with OpenWOP-Client-Version: ${BELOW} unreachable (fetch failed)`] };
+  if (served(control)) return { skip: ['inapplicable', `the host advertises minClientVersion ${f.floor} but served a client announcing ${BELOW} (${control.status}) — refusal is a MAY; a served header-less or malformed request distinguishes nothing on a host that refuses nobody`] };
+  if (control.status !== 426) return { skip: ['blocked', `the control (${BELOW}, below minClientVersion ${f.floor}) answered ${control.status} — neither served nor 426; v2-min-client-version records that as a failure, and this leg has no refusal to compare against`] };
+  return f;
+}
+
+describe('v2 OpenWOP-Client-Version (RFC 0219 — versioning.md §1.5)', () => {
+  it('a client at the floor is not below it: equal on major.minor, the patch never decides', async () => {
+    const f = await advertisedFloor();
+    if ('skip' in f) return softSkip(...f.skip);
+    for (const v of [f.floor, `${f.floor}.0`, `${f.floor}.99`]) {
+      const res = await probe(v);
+      if (res === null) return softSkip('blocked', `GET ${PATH} with OpenWOP-Client-Version: ${v} unreachable (fetch failed)`);
+      expect(res.status, req('openwop.requirement.0219.floor-comparison', DOC, `a client announcing ${v} is not below minClientVersion ${f.floor} (major and minor compared as integers; the patch never decides) and MUST be served, not refused (got ${res.status})`)).not.toBe(426);
+      expect(served(res), req('openwop.requirement.0219.floor-comparison', DOC, `a well-formed OpenWOP-Client-Version at the floor MUST NOT make the request fail — ${v} got ${res.status}`)).toBe(true);
+    }
+  });
+
+  it('a malformed OpenWOP-Client-Version is treated as absent: never 426, never 400', async () => {
+    const f = await refusingHost();
+    if ('skip' in f) return softSkip(...f.skip);
+    for (const v of MALFORMED) {
+      const res = await probe(v);
+      if (res === null) return softSkip('blocked', `GET ${PATH} with OpenWOP-Client-Version: ${v} unreachable (fetch failed)`);
+      expect(res.status, req('openwop.requirement.0219.malformed-not-refused', DOC, `a value outside the grammar (${JSON.stringify(v)}) MUST be treated as absent, so it MUST NOT be refused 426 client_version_unsupported (floor ${f.floor})`)).not.toBe(426);
+      expect(res.status, req('openwop.requirement.0219.malformed-not-refused', DOC, `a value outside the grammar (${JSON.stringify(v)}) MUST NOT produce a 400`)).not.toBe(400);
+      expect(served(res), req('openwop.requirement.0219.malformed-not-refused', DOC, `a malformed value is treated as absent and a header-less request is served — ${JSON.stringify(v)} got ${res.status}`)).toBe(true);
+    }
+  });
+
+  it('a request without OpenWOP-Client-Version is served where a below-floor one is refused', async () => {
+    // A 426 to a header-less request is a violation on ANY host, floor or not — probe it before the gate,
+    // because a host that refuses it also refuses the header-less discovery read the gate depends on.
+    const res = await probe(null);
+    if (res === null) return softSkip('blocked', `GET ${PATH} without OpenWOP-Client-Version unreachable (fetch failed)`);
+    expect(res.status, req('openwop.requirement.0219.absent-not-refused', DOC, 'a host MUST NOT answer 426 client_version_unsupported to a request that carries no OpenWOP-Client-Version')).not.toBe(426);
+    const f = await refusingHost();
+    // partial-witness-ok: the header-less request was not refused 426 (asserted above, binding on every host);
+    // that it is SERVED distinguishes something only on a host that refuses a below-floor client.
+    if ('skip' in f) return softSkip(...f.skip);
+    expect(served(res), req('openwop.requirement.0219.absent-not-refused', DOC, `a host MUST NOT refuse a request because it omits OpenWOP-Client-Version (got ${res.status})`)).toBe(true);
+  });
+
+  it('a host that advertises no minClientVersion refuses no client on version grounds', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    if (doc['minClientVersion'] !== undefined) return softSkip('inapplicable', `the host advertises minClientVersion ${JSON.stringify(doc['minClientVersion'])} — this leg is for a host with no floor`);
+    const res = await probe(BELOW);
+    if (res === null) return softSkip('blocked', `GET ${PATH} with OpenWOP-Client-Version: ${BELOW} unreachable (fetch failed)`);
+    expect(res.status, req('openwop.requirement.0219.no-floor-no-refusal', DOC, `a host that advertises no minClientVersion MUST NOT answer 426 client_version_unsupported (a client announcing ${BELOW})`)).not.toBe(426);
+    expect(served(res), req('openwop.requirement.0219.no-floor-no-refusal', DOC, `a well-formed OpenWOP-Client-Version MUST NOT make the request fail on a host with no floor (got ${res.status})`)).toBe(true);
+  });
+});

package/src/scenarios/v2-id-grammar.test.ts

@@ -28,9 +28,11 @@ import { readErrorCode } from '../lib/error-envelope.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { BOUND_ID as RUN_ID } from '../lib/bound-id.js';
+import { scaledTimeoutMs } from '../lib/polling.js';
 
 const DOC = 'spec/v2/core/identity.md §5';
 const NOOP_WORKFLOW_ID = 'conformance-noop';
+const EVENTS_DEADLINE_MS = 20_000;
 const FOREIGN_RUN_ID = 'openwop-conformance-foreign-tenant/foreignopaque0123456789abcdef';
 
 async function discovery(): Promise<Record<string, unknown> | null> {
@@ -63,17 +65,27 @@ describe('v2 id-grammar (RFC 0170 §D.1)', () => {
   it('every id on the run events matches its ids.schema.json kind', async () => {
     const c = await createRun();
     if ('reason' in c) return softSkip('blocked', c.reason);
-    const res = await http(() => driver.get(`/runs/${encodeURIComponent(c.runId)}/events/poll?timeout=1`));
-    if (res === null || res.status !== 200) return softSkip('blocked', `GET /runs/{runId}/events/poll answered ${res?.status ?? 'no response'}`);
-    const events = (res.json as { events?: unknown } | undefined)?.events;
-    if (!Array.isArray(events) || events.length === 0) return softSkip('blocked', 'the poll returned no events for the run just created — nothing to check the eventId / runId / nodeId grammars against');
+    // Poll until the run has recorded an event. A single 1 s poll straight after
+    // the create raced the host's dispatch: a host that queues the run (Cloud
+    // Tasks on MyndHyve) can legitimately have no event yet, and `blocked` is
+    // bundle-fatal (2.42.8; MyndHyve cut 3 on 2.42.7). A host that records
+    // nothing for a noop run inside the scaled deadline is still `blocked`.
+    const deadline = Date.now() + scaledTimeoutMs(EVENTS_DEADLINE_MS);
+    let res: OpenWOPResponse | null = null;
+    let events: unknown;
+    do {
+      res = await http(() => driver.get(`/runs/${encodeURIComponent(c.runId)}/events/poll?timeout=5`));
+      if (res === null || res.status !== 200) return softSkip('blocked', `GET /runs/{runId}/events/poll answered ${res?.status ?? 'no response'}`);
+      events = (res.json as { events?: unknown } | undefined)?.events;
+    } while ((!Array.isArray(events) || events.length === 0) && Date.now() < deadline);
+    if (!Array.isArray(events) || events.length === 0) return softSkip('blocked', `the poll returned no events for the run just created within ${scaledTimeoutMs(EVENTS_DEADLINE_MS)} ms — nothing to check the eventId / runId / nodeId grammars against`);
     const validate = v2Validator('run-event');
     for (const ev of events) {
       const r = validate(ev);
       expect(r.ok, req('openwop.requirement.0170.id-grammar.events', DOC, `every RunEventDoc id (eventId, runId, nodeId, causationId) MUST match its kind — event ${String((ev as { eventId?: unknown }).eventId)} (${r.errors})`)).toBe(true);
       expect((ev as { runId?: unknown }).runId, req('openwop.requirement.0170.id-grammar.events', DOC, 'every event MUST carry the run\'s own runId')).toBe(c.runId);
     }
-  });
+  }, scaledTimeoutMs(EVENTS_DEADLINE_MS) + 15_000);
 
   it('a run id whose tenant segment is not the caller\'s is refused', async () => {
     if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');

package/src/scenarios/v2-min-client-version.test.ts

@@ -9,16 +9,19 @@
  * any advertised floor) is sent; when the host refuses, the refusal MUST be the
  * registered code at its registered status in the closed envelope; a host that
  * exercises the MAY by serving the request records `inapplicable` with that
- * reason. `OpenWOP-Client-Version` is the `OpenWOP-<Name>` header this
- * scenario uses to announce the client; it is not yet declared in
- * `api/v2/openapi.yaml` / `headers.md`.
+ * reason. `OpenWOP-Client-Version` is declared in `api/v2/openapi.yaml` /
+ * `headers.md` and specified in versioning.md §1.5 (RFC 0219), so a non-`2xx`,
+ * non-`426` answer to a well-formed below-floor value is a refusal in an
+ * unregistered form: a failure, not `blocked` (RFC 0219, Unresolved question 4,
+ * decided 2026-09-27). The header's other legs (at-floor, absent, malformed, no
+ * floor) are `v2-client-version-header`.
  */
 
 import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery, v2Validator } from '../lib/v2.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
+import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const DOC = 'spec/v2/core/versioning.md §1.5';
@@ -40,21 +43,22 @@ describe('v2 min-client-version (RFC 0172 §A.5 — gated on minClientVersion)',
     expect(typeof floor === 'string' && VERSION.test(floor), req('openwop.requirement.0172.min-client-version', DOC, 'minClientVersion MUST use the <major>.<minor> grammar (axis 15, as axis 1)')).toBe(true);
     const res = await http(() => driver.get('/.well-known/openwop', { authenticated: false, headers: { 'OpenWOP-Client-Version': '0.0.1' } }));
     if (res === null) return softSkip('blocked', 'GET /.well-known/openwop with OpenWOP-Client-Version unreachable (fetch failed)');
-    // unfailable-leg audit wave 2, 2026-09-27: every non-426 answer — including
-    // a 4xx/5xx that refused the client in an unregistered form — recorded
-    // `inapplicable` AFTER the grammar assert, i.e. a partial-witness PASS of
-    // the 426 refusal row. Only a SERVED request (2xx) is the MAY exercised; any
-    // other non-426 answer is `blocked`. Not asserted as a failure:
-    // `OpenWOP-Client-Version` is not yet declared in api/v2/openapi.yaml /
-    // headers.md, so a non-2xx here is not provably a version refusal.
-    if (res.status !== 426 && (res.status < 200 || res.status >= 300)) {
-      return blockedDespiteAssertions(`the host advertises minClientVersion ${String(floor)} and answered ${res.status} to a client announcing 0.0.1 — neither served (the MAY) nor refused with the registered 426 client_version_unsupported; the refusal form was not observed`);
-    }
+    // RFC 0219 Q4 (2026-09-27): the header is declared, so a host that answers a
+    // well-formed below-floor value with anything but 2xx (the MAY: served) or
+    // 426 client_version_unsupported refuses a declared header in an
+    // unregistered form. That is a failure. Before RFC 0219 it recorded `blocked`.
+    expect(res.status === 426 || (res.status >= 200 && res.status < 300), req('openwop.requirement.0172.min-client-version', DOC, `a client announcing 0.0.1 below minClientVersion ${String(floor)} MUST be served or refused with 426 client_version_unsupported — the host answered ${res.status}`)).toBe(true);
     // partial-witness-ok: the minClientVersion grammar MUST was asserted above; refusing a
     // below-floor client is a MAY and this host served it, so the 426 shape binds nothing.
     if (res.status !== 426) return softSkip('inapplicable', `the host advertises minClientVersion ${String(floor)} but served a client announcing 0.0.1 (${res.status}) — refusal is a MAY; nothing further is observable`);
     expect(readErrorCode(res.json), req('openwop.requirement.0172.min-client-version', DOC, 'a 426 refusal MUST carry client_version_unsupported')).toBe('client_version_unsupported');
     const r = v2Validator('error-envelope')(res.json);
     expect(r.ok, req('openwop.requirement.0172.min-client-version', 'spec/v2/core/errors.md §The envelope', `the refusal MUST be the closed error envelope (${r.errors})`)).toBe(true);
+    // RFC 0219 Q5: details.minClientVersion is OPTIONAL; when a host sends it, it names the floor
+    // (errors.json registers its grammar, which the envelope validator above already checked).
+    const details = (res.json as { details?: { minClientVersion?: unknown } } | null)?.details;
+    if (details && details.minClientVersion !== undefined) {
+      expect(details.minClientVersion, req('openwop.requirement.0172.min-client-version', DOC, `a refusal's details.minClientVersion MUST name the advertised floor ${String(floor)}`)).toBe(floor);
+    }
   });
 });

package/src/scenarios/v2-preferred-version-default.test.ts

@@ -8,7 +8,8 @@
  * served `preferredVersion`'s major, so a header-less `GET /.well-known/openwop`
  * is the `preferredVersion` representation and its `OpenWOP-Version` response
  * header names that major. The header-less fetch bypasses the driver (which
- * stamps `OpenWOP-Version: 2.0` under target major 2).
+ * stamps `OpenWOP-Version: 2.0` under target major 2). Any OTHER unversioned path
+ * is the v2 surface (§1.2), so a header-less request there is served major 2.
  */
 
 import { describe, it, expect } from 'vitest';
@@ -67,6 +68,23 @@ describe('v2 preferred-version-default (RFC 0172 §A.1, §A.3)', () => {
       expect(Array.isArray(body?.['protocolVersions']) && typeof body?.['preferredVersion'] === 'string', req('openwop.requirement.0172.preferred-version-default.headerless', 'spec/v2/core/capabilities.md §1', 'the v1 representation MUST carry protocolVersions[] and preferredVersion additively so a single fetch names the other major')).toBe(true);
     }
   });
+  it('a header-less request on any other unversioned path is served major 2', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');
+    // versioning.md §1.2/§1.3: an unversioned operation path is the v2 surface, so the
+    // header-less default (preferredVersion) applies to /.well-known/openwop only. Any
+    // answer carries OpenWOP-Version (§1.4), so an unknown run id is enough to read it.
+    const path = `/runs/openwop-conformance~2F${'h'.repeat(22)}`;
+    let version: string | null = null;
+    try {
+      const res = await fetch(`${loadEnv().baseUrl}${path}`, { headers: { Accept: 'application/json', Authorization: `Bearer ${loadEnv().apiKey}` } });
+      await res.text();
+      version = res.headers.get('openwop-version');
+    } catch {
+      return softSkip('blocked', `header-less GET ${path} unreachable (fetch failed)`);
+    }
+    expect(version?.trim().split('.')[0], req('openwop.requirement.0172.preferred-version-default.unversioned-is-v2', 'spec/v2/core/versioning.md §1.2, §1.3', `a header-less request on an unversioned operation path MUST be served major 2 and say so in OpenWOP-Version — the preferredVersion default is for /.well-known/openwop only (got ${JSON.stringify(version)})`)).toBe('2');
+  });
   it('through the overlap preferredVersion names a 1.x member', async () => {
     const doc = await discovery();
     if (!doc) return softSkip('blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0');

package/src/scenarios/v2-webhook-generated-secret.test.ts

@@ -0,0 +1,76 @@
+/**
+ * RFC 0221 — a secret the host generates is returned once (`spec/v2/core/webhooks.md`
+ * §Surfaces; suite 2.42.8, target major 2; gated on the `webhooks` family and the
+ * `conformance-noop` fixture).
+ *
+ * `registerWebhook` makes `secret` optional. When the request omits it, the host
+ * MUST generate one and return it in the `201` as `secret`, the only time it
+ * appears on the wire, and every delivery to that subscription MUST verify under
+ * it (`OpenWOP-Signature`, scheme `v1`). When the request supplies a secret, the
+ * `201` MUST NOT echo it (RFC 0201 §B.6, now for every subscription).
+ *
+ * How it FAILS: a `201` without `secret` for a secret-less registration (the
+ * subscriber can never verify a delivery); a returned secret the deliveries are
+ * not signed with; a `201` that echoes a supplied secret.
+ *
+ * @see spec/v2/core/webhooks.md §Surfaces
+ * @see RFCS/0221-generated-webhook-secret-returned-once.md
+ */
+
+import { afterEach, describe, it, expect } from 'vitest';
+import { createHmac } from 'node:crypto';
+import { req } from '../lib/requirement-ids.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { hitHeader, startModalReceiver, type ModalHit } from '../lib/webhook-receiver.js';
+import { SW_FIXTURE, deliveriesFor, driveRun, loopbackRefusal, registerSw, unregisterAllSw, waitFor } from '../lib/standard-webhooks.js';
+
+const ID = 'openwop.requirement.0221.generated-secret-returned';
+const SPEC = 'RFC 0221 · webhooks.md §Surfaces';
+
+let closeReceiver: (() => Promise<void>) | null = null;
+afterEach(async () => {
+  await unregisterAllSw();
+  if (closeReceiver) { const c = closeReceiver; closeReceiver = null; await c(); }
+});
+
+function v1SignedBy(secret: string, h: ModalHit): boolean {
+  const ts = hitHeader(h, 'openwop-timestamp');
+  return ts !== undefined && hitHeader(h, 'openwop-signature') === `sha256=${createHmac('sha256', secret).update(`${ts}.${h.body}`, 'utf8').digest('hex')}`;
+}
+
+describe('RFC 0221 — a host-generated webhook secret is returned once', () => {
+  it('a secret-less registration returns the generated secret, and deliveries verify under it; a supplied secret is never echoed', async () => {
+    let doc: Record<string, unknown> | null = null;
+    try { doc = await v2Discovery(); } catch { doc = null; }
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable');
+    if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
+    const fixtures = Array.isArray(doc['fixtures']) ? (doc['fixtures'] as unknown[]) : [];
+    if (!fixtures.includes(SW_FIXTURE)) return softSkip('inapplicable', `${SW_FIXTURE} fixture not advertised — no run to deliver`);
+
+    const rx = await startModalReceiver();
+    closeReceiver = rx.close;
+    const target = rx.urlFor('no-echo');
+    const reg = await registerSw({ url: target.url, events: ['run.completed'] });
+    const refused = loopbackRefusal(reg, target.tunnelled);
+    if (refused) return softSkip('blocked', refused);
+    if (reg.status !== 201) return softSkip('blocked', `registerWebhook answered ${reg.status} ${readErrorCode(reg.json) ?? ''} — webhooks.md §Surfaces owns that contract`);
+
+    const body = reg.json as { webhookId: string; secret?: unknown };
+    expect(typeof body.secret === 'string' && body.secret.length > 0, req(ID, SPEC, 'a registration that omits secret MUST get the host-generated secret back in the 201 as a non-empty string')).toBe(true);
+    const secret = body.secret as string;
+
+    const run = await driveRun();
+    expect(run.status, req(ID, 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    await waitFor(() => deliveriesFor(rx.hits, body.webhookId, run.runId).length > 0, 15_000);
+    const delivery = deliveriesFor(rx.hits, body.webhookId, run.runId)[0];
+    expect(delivery, req(ID, 'webhooks.md §Durability', 'the subscription MUST receive the run.completed delivery')).toBeDefined();
+    expect(v1SignedBy(secret, delivery!), req(ID, SPEC, 'the delivery MUST verify (OpenWOP-Signature, scheme v1) under the secret the 201 returned')).toBe(true);
+
+    const supplied = `conformance-${'s'.repeat(24)}`;
+    const own = await registerSw({ url: rx.urlFor('no-echo').url, events: ['run.completed'], secret: supplied });
+    expect(own.status, req(ID, SPEC, `a registration with a supplied secret MUST answer 201 (got ${own.status} ${readErrorCode(own.json) ?? ''})`)).toBe(201);
+    expect(own.text.includes(supplied) || (own.json as { secret?: unknown }).secret !== undefined, req(ID, 'RFC 0221 · RFC 0201 §B.6', 'the 201 MUST NOT echo a supplied secret')).toBe(false);
+  });
+});