@openwop/openwop-conformance 2.42.7 → 2.42.9

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.42.9] — 2026-09-28 — a v2 delivery's workspaceId is checked, and two test-isolation and SHOULD-strength fixes
+
+- **Scenario files that share a mock-AI node no longer race.** The mock-AI program hook is keyed by node id, and a node id belongs to a fixture. `envelope-completion-distinguishes-truncation` drives both envelope fixtures that `envelope-truncated` and `envelope-retry-attempted` also drive, so under the default parallel run one file could overwrite another's program. New `lib/mock-node-lock.ts` holds a cross-process lock per node id for the whole file, so files sharing a node run one after another. Serial runs (`--certify`, openwop-app's harness) are unchanged.
+- **The RFC 0033 §B truncation budget legs compare real attempts and record the SHOULD.** Both legs asserted "retry budget > 50" (the fixture's value) as a MUST. §B makes the retry a MAY and the larger budget a SHOULD, so the old legs failed a conforming host that retried at the same budget and passed a host that ignored the fixture's `maxTokens`. They now read the first and retry budgets through the `dispatch-budgets` hook. A larger retry budget passes, and an unmet SHOULD is recorded as `inapplicable` with the observed values. An unserved hook is a partial witness. On openwop-app the rows are identical before and after, and the truncation leg passes with a real comparison.
+- **`v2-webhook-delivery-shape` checks that `workspaceId` is present exactly when the run has a workspace.** `webhooks.md` §Delivery requires it and forbids substituting a value, but the leg only validated the schema, which cannot say "exactly when". It now compares the delivered `workspaceId` with the owner echo on the event. The v2 reference host sent `"default"` and fails without openwop-examples #99 (fixed there); openwop-app already conformed.
+- **`--help` says `--bundle-version` defaults to 3** (#1693). The code has defaulted to 3 since 2.0.0-rc.1 and the deprecation note for `2` already said so; the help text still read `Default 2`.
+- **Suite `2.42.9`**. `@openwop/spec-artifacts` moves in lockstep at the same exact pin.
+
+## [2.42.8] — 2026-09-27 — RFC 0221, a closed audit schema again, and a dispatch race fixed
+
+- **`v2-preferred-version-default`: a header-less request on an unversioned operation path is served major 2.** This follows a Class 3 correction to `versioning.md` §1.3: the `preferredVersion` default applies to `/.well-known/openwop` only. The new leg reads `OpenWOP-Version` on a header-less `GET /runs/{unknown}`. It passes on the v2 reference host and fails when the host applies `preferredVersion` to every path.
+- **RFC 0221: a webhook secret the host generates is returned once.** New `v2-webhook-generated-secret.test.ts` (target major 2, gated on the `webhooks` family and `conformance-noop`). It registers without a secret, and the `201` must carry the generated `secret`. A real `run.completed` delivery must then verify under it (`OpenWOP-Signature`, scheme `v1`), and a supplied secret must not be echoed. Witnessed on the v2 reference host with openwop-examples #98; its previous code, which withheld the secret, fails the row.
+- **The 2.42.8 cycle opens.** RFC 0189 (#1675) changed the packed `@openwop/spec-artifacts` tree (`spec/v2/core/i18n.md`, `spec/v2/core/portability.md`, `declaration.json`) after `v2.42.7` was tagged. The published-identity gate correctly refused to call that tree 2.42.7.
+- **RFC 0219 `Active`: `OpenWOP-Client-Version` is declared, and the floor's refusal has an input.** New `v2-client-version-header` (major 2, four legs, requirement ids `openwop.requirement.0219.*`). `floor-comparison` (gated on `minClientVersion`): `<floor>`, `<floor>.0` and `<floor>.99` are served, never `426`. `malformed-not-refused` (gated on a host that refuses `0.0.1` with `426`): `not-a-version`, `1`, `01.0` and `1.0-rc.1` are served, never `426` or `400`; a host that serves `0.0.1` records `inapplicable`. `absent-not-refused`: a header-less request is never `426` on any host, and is served on a host that refuses `0.0.1`. `no-floor-no-refusal`: a host advertising no `minClientVersion` serves `0.0.1`. Sabotage-proved against a stub host implementing `versioning.md` §1.5 exactly: malformed-read-as-`0.0`, malformed-`400`, at-floor refused, a patch-bearing value refused `400`, header-less refused and no-floor-`426` each turn their leg `executed-fail`. **The v2 reference host and openwop-app read a malformed value as `0.0` and refuse it today; the malformed leg fails on both until their fixes land** (RFC 0219 gap G1).
+- **`v2-min-client-version`: a non-`2xx`, non-`426` answer to `0.0.1` is a failure, not `blocked`** (RFC 0219 decision 4), now that the header is declared. When a refusal carries `details.minClientVersion`, it must equal the advertised floor (decision 5). Sabotaged: a `403` refusal and a `details.minClientVersion` of `0.9` against a `1.0` floor each fail the leg; a `details.minClientVersion` outside the axis-1 grammar fails the envelope check.
+- **The v2 error envelope binds a registered `details` schema to its own code.** `schemas/v2/error-envelope.schema.json` (generated by `scripts/generate-error-envelope.mjs`) put every registered `details` schema and an open fallback in one `oneOf`. A conforming body matched two branches, so every envelope carrying registered `details` (`run_state_conflict` with `details.runStatus`, `unsupported_stream_mode` with `details.supported`) failed validation. The envelope now uses `allOf` of `if error == <code> then details: <schema>`. `client_version_unsupported` registers OPTIONAL `details.minClientVersion` (RFC 0219 decision 5).
+- **`audit-log-integrity` validates the verify body against the CLOSED `audit-verify-result.schema.json` again.** The in-test relaxation that stripped every `additionalProperties: false` is gone. It existed because the postgres and sqlite reference hosts put a per-checkpoint `verified` bit on the wire, which the schema's `Checkpoint` does not name. That bit is host-internal (the aggregate verdict is the schema's OPTIONAL `checkpointsValid`), and the hosts now drop it (openwop-examples#96). Sabotaged: a host that emits `verified` fails with `must NOT have additional properties`.
+- **RFC 0033 §C's budget rule is witnessable per attempt.** New OPTIONAL seam `GET …/test/mock-ai/dispatch-budgets` (`host-sample-test-seams.md` §28; `api/seams-v2.yaml` `getMockDispatchBudgets`) returns every mock-provider call's `maxTokens` for a node, in call order. `last-dispatch-budget` kept only the latest call. The `conformance-envelope-retry-attempted` fixture now sets `maxTokens: 256`, so attempt 1 carries a budget. The schema-violation leg of `envelope-completion-distinguishes-truncation` now requires that no retry's budget exceeds the attempt before it; before, it only range-checked the last budget (`< 20000`). Dispositions: seam served → real assertion (a host that sized the retry from the run's accumulated budget, 256 → 512, records `executed-fail`); served but contract broken → `blocked`; not served → partial witness, never `blocked`.
+- **`v2-id-grammar`'s events leg waits for an event instead of racing the dispatch.** It made one 1-second poll straight after creating the run, and recorded `blocked`, which is bundle-fatal, when the host had not yet recorded an event. A host that queues runs, as MyndHyve does through Cloud Tasks, legitimately has none at that instant. MyndHyve's cut 3 on 2.42.7 was denied certification by this row alone. The leg now polls until an event exists, within a scaled 20-second deadline.
+- **Suite `2.42.8`**. `@openwop/spec-artifacts` moves in lockstep at the same exact pin.
+
 ## [2.42.7] — 2026-09-27 — audit residuals, and extension families can graduate on evidence
 
 - **`v2-sse-last-event-id-cursor` joins the core-standard floor.** It was held off until the three bundle hosts were measured. All three record it `executed-pass`: the v2 reference host on 2.42.2, MyndHyve on 2.42.0 and openwop-app on 2.42.2. Two carry `partial-witness` only on the SHOULD leg (a malformed `Last-Event-ID` is accepted, which is recorded rather than failed). No existing claim moves.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.7 @openwop/spec-artifacts@2.42.7
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.9 @openwop/spec-artifacts@2.42.9
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 565 scenario files under `src/scenarios/`.
+The current suite has 567 scenario files under `src/scenarios/`.
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
@@ -481,7 +481,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 565 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 567 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -60,9 +60,8 @@ function parseArgs(argv) {
     let impl;
     let implVersion;
     let certify;
-    // Suite 1.152.0: bundle v2 (RFC 0148) is the default. v1 stays reachable via
-    // `--bundle-version 1` through the RFC 0148 migration window (ends
-    // 2026-11-10) and is removed at v2.0 (spec/v1/deprecations.json).
+    // Suite 2.0.0-rc.1: bundle v3 (RFC 0168 §E) is the default. v2 stays reachable
+    // via `--bundle-version 2`, deprecated (RFC 0168 §E.3); v1 is gone.
     let bundleVersion = '3';
     let hostBuild;
     let evidenceTier = 'self';
@@ -265,7 +264,7 @@ Certification (RFC 0089):
   --signing-key <pem>     v3: Ed25519 private key (PKCS8 PEM) that signs the bundle, or OPENWOP_BUNDLE_SIGNING_KEY.
   --signing-key-id <id>   v3: the keyId the host publishes for that key, or OPENWOP_BUNDLE_SIGNING_KEY_ID.
   --evidence-tier <t>     v3: self | steward | independent (independent needs --verifier-key/--verifier-key-id).
-  --bundle-version <2|3>  Certification bundle format. Default 2 (corrected 2026-09-03, RFC 0168 §E.4; the text said 1 while the code set 2). Version 2 (RFC 0148
+  --bundle-version <2|3>  Certification bundle format. Default 3 (since suite 2.0.0-rc.1; 2 is DEPRECATED, RFC 0168 §E.3). Version 2 (RFC 0148
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.7",
-  "stampSha256": "8f82b45d0b4004faf11a49d998e0bebefd3ad7a89d82e67322aabafcd18544a1"
+  "version": "2.42.9",
+  "stampSha256": "e7d8fb98741be5d68706bbe33d3e4c1509af29bd13bfd0f7b241f93270b4af89"
 }

package/fixtures/conformance-envelope-retry-attempted.json

@@ -2,7 +2,7 @@
   "id": "conformance-envelope-retry-attempted",
   "name": "Conformance: envelope.retry.attempted (RFC 0032 §B.1)",
   "version": "1.0",
-  "description": "Drives `core.ai.structuredOutput` against the conformance-only `mock` provider. The conformance scenario POSTs a 2-entry program to `/v1/host/sample/test/mock-ai/program` (keyed by `nodeId: 'retry-attempted-structured-call'`) BEFORE starting the run: attempt 1 returns invalid JSON, attempt 2 returns a valid envelope. The host's `dispatchStructured` retry loop MUST emit exactly one `envelope.retry.attempted` event with `attempt: 2` between the two provider calls (RFC 0032 §B.1). The run terminates `completed` after the second attempt succeeds.",
+  "description": "Drives `core.ai.structuredOutput` against the conformance-only `mock` provider. The conformance scenario POSTs a 2-entry program to `/v1/host/sample/test/mock-ai/program` (keyed by `nodeId: 'retry-attempted-structured-call'`) BEFORE starting the run: attempt 1 returns invalid JSON, attempt 2 returns a valid envelope. The host's `dispatchStructured` retry loop MUST emit exactly one `envelope.retry.attempted` event with `attempt: 2` between the two provider calls (RFC 0032 §B.1). The run terminates `completed` after the second attempt succeeds. `maxTokens: 256` gives attempt 1 a concrete output budget, so `envelope-completion-distinguishes-truncation` can compare each attempt's budget through the `mock-ai/dispatch-budgets` seam (host-sample-test-seams.md §28): a schema-violation retry MUST NOT carry a larger budget than the attempt before it (RFC 0033 §C).",
   "nodes": [
     {
       "id": "retry-attempted-structured-call",
@@ -12,6 +12,7 @@
       "config": {
         "provider": "mock",
         "model": "mock-mini",
+        "maxTokens": 256,
         "outputSchema": {
           "type": "object",
           "required": ["valid"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.42.7",
+  "version": "2.42.9",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.42.7"
+    "@openwop/spec-artifacts": "2.42.9"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 640,
-    "tests": 2460,
-    "withStableId": 2460,
+    "files": 642,
+    "tests": 2466,
+    "withStableId": 2466,
     "interpolatedTitles": 0,
-    "explicitIds": 2350
+    "explicitIds": 2356
   },
   "records": [
     {
@@ -5534,7 +5534,7 @@
     {
       "id": "openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields",
       "file": "audit-log-integrity.test.ts",
-      "line": 69,
+      "line": 60,
       "title": "host that claims the profile advertises required capability fields",
       "explicitId": "openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields",
       "citations": [
@@ -5551,7 +5551,7 @@
     {
       "id": "openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true",
       "file": "audit-log-integrity.test.ts",
-      "line": 92,
+      "line": 83,
       "title": "GET /v1/audit/verify on a recent range reports chainValid: true",
       "explicitId": "openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true",
       "citations": [
@@ -11541,7 +11541,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.capabilities-envelopes-reliability-completion-when-present-conforms-to-rfc-0033",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 103,
+      "line": 108,
       "title": "capabilities.envelopes.reliability.completion (when present) conforms to RFC 0033 §E",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.capabilities-envelopes-reliability-completion-when-present-conforms-to-rfc-0033",
       "citations": [
@@ -11558,7 +11558,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.truncation-emits-envelope-truncated-envelope-retry-attempted-with-reason-truncat",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 126,
+      "line": 131,
       "title": "truncation: emits envelope.truncated + envelope.retry.attempted with reason: \"truncation\"",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.truncation-emits-envelope-truncated-envelope-retry-attempted-with-reason-truncat",
       "citations": [
@@ -11579,20 +11579,21 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.truncation-retry-budget-strictly-greater-than-initial-rfc-0033-b-truncationbudge",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 151,
+      "line": 156,
       "title": "truncation: retry budget strictly greater than initial (RFC 0033 §B truncationBudgetMultiplier)",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.truncation-retry-budget-strictly-greater-than-initial-rfc-0033-b-truncationbudge",
       "citations": [
         {
           "section": "RFCS/0033-envelope-completion-contract.md §B",
-          "requirement": "truncation retry MUST multiply maxTokens by truncationBudgetMultiplier — final budget > initial 50 fixture value"
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-no-envelope-truncated-envelope-retry-attempted-reason-schema-vi",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 175,
+      "line": 185,
       "title": "schema-violation: NO envelope.truncated; envelope.retry.attempted reason ∈ {schema-violation, parse-error}",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-no-envelope-truncated-envelope-retry-attempted-reason-schema-vi",
       "citations": [
@@ -11609,13 +11610,18 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 205,
+      "line": 215,
       "title": "schema-violation: retry budget UNCHANGED from initial (no budget multiplication on this path)",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on",
       "citations": [
         {
           "section": "RFCS/0033-envelope-completion-contract.md §C",
           "requirement": "schema-violation retry MUST NOT multiply maxTokens — budget stays at the original value (host default)"
+        },
+        {
+          "section": "RFCS/0033-envelope-completion-contract.md §C",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
@@ -12256,7 +12262,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.when-mock-llm-emits-invalid-envelope-on-attempt-1-then-valid-on-attempt-2-exactl",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 158,
+      "line": 162,
       "title": "when mock LLM emits invalid envelope on attempt 1 then valid on attempt 2, exactly one `envelope.retry.attempted` event fires before the second attempt",
       "explicitId": "openwop.it.envelope-retry-attempted.when-mock-llm-emits-invalid-envelope-on-attempt-1-then-valid-on-attempt-2-exactl",
       "citations": [
@@ -12269,7 +12275,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.event-payload-carries-attempt-2-1-indexed-first-attempt-does-not-emit",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 179,
+      "line": 183,
       "title": "event payload carries `attempt: 2` (1-indexed; first attempt does not emit)",
       "explicitId": "openwop.it.envelope-retry-attempted.event-payload-carries-attempt-2-1-indexed-first-attempt-does-not-emit",
       "citations": [
@@ -12286,7 +12292,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.reason-is-one-of-the-spec-reserved-closed-enum-values-or-matches-the-x-host-host",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 197,
+      "line": 201,
       "title": "`reason` is one of the spec-reserved closed-enum values OR matches the `x-host-<host>-<key>` extension pattern",
       "explicitId": "openwop.it.envelope-retry-attempted.reason-is-one-of-the-spec-reserved-closed-enum-values-or-matches-the-x-host-host",
       "citations": [
@@ -12299,7 +12305,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.eventual-success-records-normally-via-envelope-acceptance-downstream-runeventdoc",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 217,
+      "line": 221,
       "title": "eventual success records normally via envelope acceptance + downstream RunEventDoc",
       "explicitId": "openwop.it.envelope-retry-attempted.eventual-success-records-normally-via-envelope-acceptance-downstream-runeventdoc",
       "citations": [
@@ -12312,7 +12318,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.previouserror-when-populated-must-not-contain-prompt-or-response-substring-excer",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 236,
+      "line": 240,
       "title": "`previousError` (when populated) MUST NOT contain prompt or response substring excerpts — limit to validator output",
       "explicitId": "openwop.it.envelope-retry-attempted.previouserror-when-populated-must-not-contain-prompt-or-response-substring-excer",
       "citations": [
@@ -12423,7 +12429,7 @@
     {
       "id": "openwop.it.envelope-truncated.when-mock-returns-stopreason-max-tokens-on-attempt-1-exactly-one-envelope-trunca",
       "file": "envelope-truncated.test.ts",
-      "line": 60,
+      "line": 59,
       "title": "when mock returns stopReason: max_tokens on attempt 1, exactly one envelope.truncated event fires with stopReason: max_tokens",
       "explicitId": "openwop.it.envelope-truncated.when-mock-returns-stopreason-max-tokens-on-attempt-1-exactly-one-envelope-trunca",
       "citations": [
@@ -12436,7 +12442,7 @@
     {
       "id": "openwop.it.envelope-truncated.payload-includes-nodeid-provider-model-partialpayloadavailable-boolean",
       "file": "envelope-truncated.test.ts",
-      "line": 86,
+      "line": 85,
       "title": "payload includes nodeId + provider + model + partialPayloadAvailable boolean",
       "explicitId": "openwop.it.envelope-truncated.payload-includes-nodeid-provider-model-partialpayloadavailable-boolean",
       "citations": [
@@ -12449,13 +12455,14 @@
     {
       "id": "openwop.it.envelope-truncated.retry-attempt-receives-a-maxtokens-value-strictly-greater-than-the-previous-atte",
       "file": "envelope-truncated.test.ts",
-      "line": 105,
+      "line": 104,
       "title": "retry attempt receives a maxTokens value strictly greater than the previous attempt (RFC 0033 §B truncationBudgetMultiplier)",
       "explicitId": "openwop.it.envelope-truncated.retry-attempt-receives-a-maxtokens-value-strictly-greater-than-the-previous-atte",
       "citations": [
         {
           "section": "RFCS/0033-envelope-completion-contract.md §B",
-          "requirement": "truncation retry MUST issue with a strictly-increased maxTokens budget (host multiplies by capabilities.envelopes.reliability.completion.truncationBudgetMultiplier)"
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
@@ -28349,6 +28356,86 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-client-version-header.a-client-at-the-floor-is-not-below-it-equal-on-major-minor-the-patch-never-decid",
+      "file": "v2-client-version-header.test.ts",
+      "line": 79,
+      "title": "a client at the floor is not below it: equal on major.minor, the patch never decides",
+      "explicitId": "openwop.requirement.0219.floor-comparison",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-client-version-header.a-malformed-openwop-client-version-is-treated-as-absent-never-426-never-400",
+      "file": "v2-client-version-header.test.ts",
+      "line": 90,
+      "title": "a malformed OpenWOP-Client-Version is treated as absent: never 426, never 400",
+      "explicitId": "openwop.requirement.0219.malformed-not-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-client-version-header.a-request-without-openwop-client-version-is-served-where-a-below-floor-one-is-re",
+      "file": "v2-client-version-header.test.ts",
+      "line": 102,
+      "title": "a request without OpenWOP-Client-Version is served where a below-floor one is refused",
+      "explicitId": "openwop.requirement.0219.absent-not-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": "a host MUST NOT answer 426 client_version_unsupported to a request that carries no OpenWOP-Client-Version"
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-client-version-header.a-host-that-advertises-no-minclientversion-refuses-no-client-on-version-grounds",
+      "file": "v2-client-version-header.test.ts",
+      "line": 115,
+      "title": "a host that advertises no minClientVersion refuses no client on version grounds",
+      "explicitId": "openwop.requirement.0219.no-floor-no-refusal",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-coherence-not-in-bundle.every-corpus-ledger-id-has-a-scenario-in-src-coherence-and-none-in-src-scenarios",
       "file": "v2-coherence-not-in-bundle.test.ts",
@@ -29690,7 +29777,7 @@
     {
       "id": "openwop.it.v2-id-grammar.every-id-on-the-run-snapshot-matches-its-ids-schema-json-kind",
       "file": "v2-id-grammar.test.ts",
-      "line": 53,
+      "line": 55,
       "title": "every id on the run snapshot matches its ids.schema.json kind",
       "explicitId": "openwop.requirement.0170.id-grammar.snapshot",
       "citations": [
@@ -29709,7 +29796,7 @@
     {
       "id": "openwop.it.v2-id-grammar.every-id-on-the-run-events-matches-its-ids-schema-json-kind",
       "file": "v2-id-grammar.test.ts",
-      "line": 63,
+      "line": 65,
       "title": "every id on the run events matches its ids.schema.json kind",
       "explicitId": "openwop.requirement.0170.id-grammar.events",
       "citations": [
@@ -29727,7 +29814,7 @@
     {
       "id": "openwop.it.v2-id-grammar.a-run-id-whose-tenant-segment-is-not-the-caller-s-is-refused",
       "file": "v2-id-grammar.test.ts",
-      "line": 78,
+      "line": 90,
       "title": "a run id whose tenant segment is not the caller's is refused",
       "explicitId": "openwop.requirement.0170.id-grammar.tenant-binding",
       "citations": [
@@ -29750,7 +29837,7 @@
     {
       "id": "openwop.it.v2-id-grammar.a-bare-unbound-run-id-in-a-major-2-path-admitted-under-the-caller-s-tenant-throu",
       "file": "v2-id-grammar.test.ts",
-      "line": 88,
+      "line": 100,
       "title": "a bare (unbound) run id in a major-2 path: admitted under the caller's tenant through the overlap, refused 400 validation_error after it",
       "explicitId": "openwop.requirement.0170.id-grammar.bare-id",
       "citations": [
@@ -31289,7 +31376,7 @@
     {
       "id": "openwop.it.v2-min-client-version.a-client-below-minclientversion-is-refused-with-426-client-version-unsupported",
       "file": "v2-min-client-version.test.ts",
-      "line": 35,
+      "line": 38,
       "title": "a client below minClientVersion is refused with 426 client_version_unsupported",
       "explicitId": "openwop.requirement.0172.min-client-version",
       "citations": [
@@ -31297,6 +31384,11 @@
           "section": "spec/v2/core/versioning.md §1.5",
           "requirement": "minClientVersion MUST use the <major>.<minor> grammar (axis 15, as axis 1)"
         },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "spec/v2/core/versioning.md §1.5",
           "requirement": "a 426 refusal MUST carry client_version_unsupported"
@@ -31305,6 +31397,11 @@
           "section": "spec/v2/core/errors.md §The envelope",
           "requirement": null,
           "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.5",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
@@ -32238,7 +32335,7 @@
     {
       "id": "openwop.it.v2-preferred-version-default.preferredversion-is-a-member-of-protocolversions",
       "file": "v2-preferred-version-default.test.ts",
-      "line": 40,
+      "line": 41,
       "title": "preferredVersion is a member of protocolVersions[]",
       "explicitId": "openwop.requirement.0172.preferred-version-default.member",
       "citations": [
@@ -32260,7 +32357,7 @@
     {
       "id": "openwop.it.v2-preferred-version-default.a-header-less-get-well-known-openwop-is-the-preferredversion-representation",
       "file": "v2-preferred-version-default.test.ts",
-      "line": 52,
+      "line": 53,
       "title": "a header-less GET /.well-known/openwop is the preferredVersion representation",
       "explicitId": "openwop.requirement.0172.preferred-version-default.headerless",
       "citations": [
@@ -32288,10 +32385,24 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-preferred-version-default.a-header-less-request-on-any-other-unversioned-path-is-served-major-2",
+      "file": "v2-preferred-version-default.test.ts",
+      "line": 71,
+      "title": "a header-less request on any other unversioned path is served major 2",
+      "explicitId": "openwop.requirement.0172.preferred-version-default.unversioned-is-v2",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.2, §1.3",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-preferred-version-default.through-the-overlap-preferredversion-names-a-1-x-member",
       "file": "v2-preferred-version-default.test.ts",
-      "line": 70,
+      "line": 88,
       "title": "through the overlap preferredVersion names a 1.x member",
       "explicitId": "openwop.requirement.0172.preferred-version-default.overlap",
       "citations": [
@@ -33760,13 +33871,18 @@
         {
           "section": "spec/v2/core/webhooks.md §Delivery",
           "requirement": "a major-2 owner echo carries tenant and subject"
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §Delivery",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-1-subscriber-still-receives-the-v1-rendering-the-v1-wire-does-not-move-m",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 239,
+      "line": 244,
       "title": "a major-1 subscriber still receives the v1 rendering — the v1 wire does not move mid-overlap",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -33784,7 +33900,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-seeded-era-2-run-is-delivered-projected-too-the-fan-out-branch-a-fresh-run-can",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 263,
+      "line": 268,
       "title": "a seeded era-2 run is delivered projected too — the fan-out branch a fresh run cannot reach (seam-gated)",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -34020,6 +34136,40 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-webhook-generated-secret.a-secret-less-registration-returns-the-generated-secret-and-deliveries-verify-un",
+      "file": "v2-webhook-generated-secret.test.ts",
+      "line": 44,
+      "title": "a secret-less registration returns the generated secret, and deliveries verify under it; a supplied secret is never echoed",
+      "explicitId": "openwop.requirement.0221.generated-secret-returned",
+      "citations": [
+        {
+          "section": "RFC 0221 · webhooks.md §Surfaces",
+          "requirement": "a registration that omits secret MUST get the host-generated secret back in the 201 as a non-empty string"
+        },
+        {
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+        },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": "the subscription MUST receive the run.completed delivery"
+        },
+        {
+          "section": "RFC 0221 · webhooks.md §Surfaces",
+          "requirement": "the delivery MUST verify (OpenWOP-Signature, scheme v1) under the secret the 201 returned"
+        },
+        {
+          "section": "RFC 0221 · webhooks.md §Surfaces",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0221 · RFC 0201 §B.6",
+          "requirement": "the 201 MUST NOT echo a supplied secret"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-webhook-message-id-stable.every-attempt-of-one-delivery-carries-one-webhook-id-and-distinct-deliveries-car",
       "file": "v2-webhook-message-id-stable.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 565,
+    "files": 567,
     "v1": 451,
-    "v2": 126
+    "v2": 128
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1317,6 +1317,9 @@
     "v2-chain-pin-exact.test.ts": [
       2
     ],
+    "v2-client-version-header.test.ts": [
+      2
+    ],
     "v2-coherence-not-in-bundle.test.ts": [
       2
     ],
@@ -1587,6 +1590,9 @@
     "v2-webhook-endpoint-verification.test.ts": [
       2
     ],
+    "v2-webhook-generated-secret.test.ts": [
+      2
+    ],
     "v2-webhook-message-id-stable.test.ts": [
       2
     ],