@openwop/openwop-conformance 2.42.8 → 2.42.9

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.42.9] — 2026-09-28 — a v2 delivery's workspaceId is checked, and two test-isolation and SHOULD-strength fixes
+
+- **Scenario files that share a mock-AI node no longer race.** The mock-AI program hook is keyed by node id, and a node id belongs to a fixture. `envelope-completion-distinguishes-truncation` drives both envelope fixtures that `envelope-truncated` and `envelope-retry-attempted` also drive, so under the default parallel run one file could overwrite another's program. New `lib/mock-node-lock.ts` holds a cross-process lock per node id for the whole file, so files sharing a node run one after another. Serial runs (`--certify`, openwop-app's harness) are unchanged.
+- **The RFC 0033 §B truncation budget legs compare real attempts and record the SHOULD.** Both legs asserted "retry budget > 50" (the fixture's value) as a MUST. §B makes the retry a MAY and the larger budget a SHOULD, so the old legs failed a conforming host that retried at the same budget and passed a host that ignored the fixture's `maxTokens`. They now read the first and retry budgets through the `dispatch-budgets` hook. A larger retry budget passes, and an unmet SHOULD is recorded as `inapplicable` with the observed values. An unserved hook is a partial witness. On openwop-app the rows are identical before and after, and the truncation leg passes with a real comparison.
+- **`v2-webhook-delivery-shape` checks that `workspaceId` is present exactly when the run has a workspace.** `webhooks.md` §Delivery requires it and forbids substituting a value, but the leg only validated the schema, which cannot say "exactly when". It now compares the delivered `workspaceId` with the owner echo on the event. The v2 reference host sent `"default"` and fails without openwop-examples #99 (fixed there); openwop-app already conformed.
+- **`--help` says `--bundle-version` defaults to 3** (#1693). The code has defaulted to 3 since 2.0.0-rc.1 and the deprecation note for `2` already said so; the help text still read `Default 2`.
+- **Suite `2.42.9`**. `@openwop/spec-artifacts` moves in lockstep at the same exact pin.
+
 ## [2.42.8] — 2026-09-27 — RFC 0221, a closed audit schema again, and a dispatch race fixed
 
 - **`v2-preferred-version-default`: a header-less request on an unversioned operation path is served major 2.** This follows a Class 3 correction to `versioning.md` §1.3: the `preferredVersion` default applies to `/.well-known/openwop` only. The new leg reads `OpenWOP-Version` on a header-less `GET /runs/{unknown}`. It passes on the v2 reference host and fails when the host applies `preferredVersion` to every path.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.8 @openwop/spec-artifacts@2.42.8
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.42.9 @openwop/spec-artifacts@2.42.9
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/cli.js

@@ -60,9 +60,8 @@ function parseArgs(argv) {
     let impl;
     let implVersion;
     let certify;
-    // Suite 1.152.0: bundle v2 (RFC 0148) is the default. v1 stays reachable via
-    // `--bundle-version 1` through the RFC 0148 migration window (ends
-    // 2026-11-10) and is removed at v2.0 (spec/v1/deprecations.json).
+    // Suite 2.0.0-rc.1: bundle v3 (RFC 0168 §E) is the default. v2 stays reachable
+    // via `--bundle-version 2`, deprecated (RFC 0168 §E.3); v1 is gone.
     let bundleVersion = '3';
     let hostBuild;
     let evidenceTier = 'self';
@@ -265,7 +264,7 @@ Certification (RFC 0089):
   --signing-key <pem>     v3: Ed25519 private key (PKCS8 PEM) that signs the bundle, or OPENWOP_BUNDLE_SIGNING_KEY.
   --signing-key-id <id>   v3: the keyId the host publishes for that key, or OPENWOP_BUNDLE_SIGNING_KEY_ID.
   --evidence-tier <t>     v3: self | steward | independent (independent needs --verifier-key/--verifier-key-id).
-  --bundle-version <2|3>  Certification bundle format. Default 2 (corrected 2026-09-03, RFC 0168 §E.4; the text said 1 while the code set 2). Version 2 (RFC 0148
+  --bundle-version <2|3>  Certification bundle format. Default 3 (since suite 2.0.0-rc.1; 2 is DEPRECATED, RFC 0168 §E.3). Version 2 (RFC 0148
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.8",
-  "stampSha256": "16b28d93516147ef6c72fd88e10bed168175639ab4c3feaa92859242e93ba00b"
+  "version": "2.42.9",
+  "stampSha256": "e7d8fb98741be5d68706bbe33d3e4c1509af29bd13bfd0f7b241f93270b4af89"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.42.8",
+  "version": "2.42.9",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.42.8"
+    "@openwop/spec-artifacts": "2.42.9"
   }
 }

package/requirements.json

@@ -11541,7 +11541,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.capabilities-envelopes-reliability-completion-when-present-conforms-to-rfc-0033",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 104,
+      "line": 108,
       "title": "capabilities.envelopes.reliability.completion (when present) conforms to RFC 0033 §E",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.capabilities-envelopes-reliability-completion-when-present-conforms-to-rfc-0033",
       "citations": [
@@ -11558,7 +11558,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.truncation-emits-envelope-truncated-envelope-retry-attempted-with-reason-truncat",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 127,
+      "line": 131,
       "title": "truncation: emits envelope.truncated + envelope.retry.attempted with reason: \"truncation\"",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.truncation-emits-envelope-truncated-envelope-retry-attempted-with-reason-truncat",
       "citations": [
@@ -11579,20 +11579,21 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.truncation-retry-budget-strictly-greater-than-initial-rfc-0033-b-truncationbudge",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 152,
+      "line": 156,
       "title": "truncation: retry budget strictly greater than initial (RFC 0033 §B truncationBudgetMultiplier)",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.truncation-retry-budget-strictly-greater-than-initial-rfc-0033-b-truncationbudge",
       "citations": [
         {
           "section": "RFCS/0033-envelope-completion-contract.md §B",
-          "requirement": "truncation retry MUST multiply maxTokens by truncationBudgetMultiplier — final budget > initial 50 fixture value"
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-no-envelope-truncated-envelope-retry-attempted-reason-schema-vi",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 176,
+      "line": 185,
       "title": "schema-violation: NO envelope.truncated; envelope.retry.attempted reason ∈ {schema-violation, parse-error}",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-no-envelope-truncated-envelope-retry-attempted-reason-schema-vi",
       "citations": [
@@ -11609,7 +11610,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 206,
+      "line": 215,
       "title": "schema-violation: retry budget UNCHANGED from initial (no budget multiplication on this path)",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on",
       "citations": [
@@ -12261,7 +12262,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.when-mock-llm-emits-invalid-envelope-on-attempt-1-then-valid-on-attempt-2-exactl",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 158,
+      "line": 162,
       "title": "when mock LLM emits invalid envelope on attempt 1 then valid on attempt 2, exactly one `envelope.retry.attempted` event fires before the second attempt",
       "explicitId": "openwop.it.envelope-retry-attempted.when-mock-llm-emits-invalid-envelope-on-attempt-1-then-valid-on-attempt-2-exactl",
       "citations": [
@@ -12274,7 +12275,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.event-payload-carries-attempt-2-1-indexed-first-attempt-does-not-emit",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 179,
+      "line": 183,
       "title": "event payload carries `attempt: 2` (1-indexed; first attempt does not emit)",
       "explicitId": "openwop.it.envelope-retry-attempted.event-payload-carries-attempt-2-1-indexed-first-attempt-does-not-emit",
       "citations": [
@@ -12291,7 +12292,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.reason-is-one-of-the-spec-reserved-closed-enum-values-or-matches-the-x-host-host",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 197,
+      "line": 201,
       "title": "`reason` is one of the spec-reserved closed-enum values OR matches the `x-host-<host>-<key>` extension pattern",
       "explicitId": "openwop.it.envelope-retry-attempted.reason-is-one-of-the-spec-reserved-closed-enum-values-or-matches-the-x-host-host",
       "citations": [
@@ -12304,7 +12305,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.eventual-success-records-normally-via-envelope-acceptance-downstream-runeventdoc",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 217,
+      "line": 221,
       "title": "eventual success records normally via envelope acceptance + downstream RunEventDoc",
       "explicitId": "openwop.it.envelope-retry-attempted.eventual-success-records-normally-via-envelope-acceptance-downstream-runeventdoc",
       "citations": [
@@ -12317,7 +12318,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.previouserror-when-populated-must-not-contain-prompt-or-response-substring-excer",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 236,
+      "line": 240,
       "title": "`previousError` (when populated) MUST NOT contain prompt or response substring excerpts — limit to validator output",
       "explicitId": "openwop.it.envelope-retry-attempted.previouserror-when-populated-must-not-contain-prompt-or-response-substring-excer",
       "citations": [
@@ -12428,7 +12429,7 @@
     {
       "id": "openwop.it.envelope-truncated.when-mock-returns-stopreason-max-tokens-on-attempt-1-exactly-one-envelope-trunca",
       "file": "envelope-truncated.test.ts",
-      "line": 60,
+      "line": 59,
       "title": "when mock returns stopReason: max_tokens on attempt 1, exactly one envelope.truncated event fires with stopReason: max_tokens",
       "explicitId": "openwop.it.envelope-truncated.when-mock-returns-stopreason-max-tokens-on-attempt-1-exactly-one-envelope-trunca",
       "citations": [
@@ -12441,7 +12442,7 @@
     {
       "id": "openwop.it.envelope-truncated.payload-includes-nodeid-provider-model-partialpayloadavailable-boolean",
       "file": "envelope-truncated.test.ts",
-      "line": 86,
+      "line": 85,
       "title": "payload includes nodeId + provider + model + partialPayloadAvailable boolean",
       "explicitId": "openwop.it.envelope-truncated.payload-includes-nodeid-provider-model-partialpayloadavailable-boolean",
       "citations": [
@@ -12454,13 +12455,14 @@
     {
       "id": "openwop.it.envelope-truncated.retry-attempt-receives-a-maxtokens-value-strictly-greater-than-the-previous-atte",
       "file": "envelope-truncated.test.ts",
-      "line": 105,
+      "line": 104,
       "title": "retry attempt receives a maxTokens value strictly greater than the previous attempt (RFC 0033 §B truncationBudgetMultiplier)",
       "explicitId": "openwop.it.envelope-truncated.retry-attempt-receives-a-maxtokens-value-strictly-greater-than-the-previous-atte",
       "citations": [
         {
           "section": "RFCS/0033-envelope-completion-contract.md §B",
-          "requirement": "truncation retry MUST issue with a strictly-increased maxTokens budget (host multiplies by capabilities.envelopes.reliability.completion.truncationBudgetMultiplier)"
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
@@ -33869,13 +33871,18 @@
         {
           "section": "spec/v2/core/webhooks.md §Delivery",
           "requirement": "a major-2 owner echo carries tenant and subject"
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §Delivery",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-1-subscriber-still-receives-the-v1-rendering-the-v1-wire-does-not-move-m",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 239,
+      "line": 244,
       "title": "a major-1 subscriber still receives the v1 rendering — the v1 wire does not move mid-overlap",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -33893,7 +33900,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-seeded-era-2-run-is-delivered-projected-too-the-fan-out-branch-a-fresh-run-can",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 263,
+      "line": 268,
       "title": "a seeded era-2 run is delivered projected too — the fan-out branch a fresh run cannot reach (seam-gated)",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.42.8",
-  "corpusTag": "v2.42.8",
+  "version": "2.42.9",
+  "corpusTag": "v2.42.9",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "deda53b9f8917a1dc4b283e50cb47985c0fd06525c96fdf853c2fdb1a2de5cb8",
-    "api/v2/asyncapi.yaml": "a35292b35d003361a9a0a7997557e022641cd869a6aefcd31ab266d0c3fea215",
-    "api/v2/openapi.yaml": "8381ff1d3cca7c0610a5f5a885763a625630c8b36bb5c5f6cd1d3f3cceb176a7",
+    "api/seams-v2.yaml": "91a84ef4a8d38824e528ee7f59b29df34c167f2e5e695f200ad19b0fd4b47cdd",
+    "api/v2/asyncapi.yaml": "b93593055cf033fdf37b8a18fd36a2045b989a97a97b49adda23efb6ff1654e6",
+    "api/v2/openapi.yaml": "d698d93dd3ef46c060bcdb68f8950aa983ef8904ad18cf14b87ce96304ae59ed",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,7 +204,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "29f21e0fb2c7a232a92a5c19b4cba3a86bc3b5e16f06780452f0421c66c6ec38",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "1359a69ad091b8bd3fb8fb7b641b32496d0d7a70d40cb0d1b93c6f171566276e",
+    "spec/v1/core-standard-manifest.json": "717b478af97d11a4c7844fceecd536a70783ca1cbb7079ec1434e710a24fc6e5",
     "spec/v1/deprecations.json": "46df807fb4adf0aae24671c20f69975cf3496e3bc3a521cb7e6ea556bdce563c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -297,9 +297,9 @@
     "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "f2f87ba5a5476f2213b3486a2618ef3c7381b47c96dd3f082bee0e07ac4a35bc",
+    "spec/v2/release.json": "1ac31e3dd517036b357bfa5743b760e21d28b8cda7f8550e65d8444e964751c6",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "fce9d8eeea653476e09b19e525a0b104caab6c51a0b7b427d7d941e2b7118573"
+    "spec/v2/surface-baseline.json": "5cab3b39eaeb344361ac7d9038d15be5cf6a5620f1912fdd0c184cef95bae857"
   },
-  "corpusCommit": "0ed567fece2f9c5c5ad337fed92f6926ad7547af"
+  "corpusCommit": "67e27a37bbd22f24ca2b6a2bce8f0a0f0971e3c8"
 }

package/src/cli.ts

@@ -104,9 +104,8 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
   let impl: string | undefined;
   let implVersion: string | undefined;
   let certify: string | undefined;
-  // Suite 1.152.0: bundle v2 (RFC 0148) is the default. v1 stays reachable via
-  // `--bundle-version 1` through the RFC 0148 migration window (ends
-  // 2026-11-10) and is removed at v2.0 (spec/v1/deprecations.json).
+  // Suite 2.0.0-rc.1: bundle v3 (RFC 0168 §E) is the default. v2 stays reachable
+  // via `--bundle-version 2`, deprecated (RFC 0168 §E.3); v1 is gone.
   let bundleVersion: '2' | '3' = '3';
   let hostBuild: ParsedArgs['hostBuild'];
   let evidenceTier: ParsedArgs['evidenceTier'] = 'self';
@@ -294,7 +293,7 @@ Certification (RFC 0089):
   --signing-key <pem>     v3: Ed25519 private key (PKCS8 PEM) that signs the bundle, or OPENWOP_BUNDLE_SIGNING_KEY.
   --signing-key-id <id>   v3: the keyId the host publishes for that key, or OPENWOP_BUNDLE_SIGNING_KEY_ID.
   --evidence-tier <t>     v3: self | steward | independent (independent needs --verifier-key/--verifier-key-id).
-  --bundle-version <2|3>  Certification bundle format. Default 2 (corrected 2026-09-03, RFC 0168 §E.4; the text said 1 while the code set 2). Version 2 (RFC 0148
+  --bundle-version <2|3>  Certification bundle format. Default 3 (since suite 2.0.0-rc.1; 2 is DEPRECATED, RFC 0168 §E.3). Version 2 (RFC 0148
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.

package/src/lib/mock-ai-budgets.ts

@@ -38,3 +38,29 @@ export async function readDispatchBudgets(nodeId: string): Promise<DispatchBudge
   }
   return { ok: true, attempts: out };
 }
+
+/**
+ * RFC 0033 §B: a host MAY retry a truncated emission, and the new output budget
+ * SHOULD be greater than the previous one. A SHOULD is recorded, not failed: the
+ * caller asserts only on `met`, and records `unmet` as `inapplicable` with the
+ * observed budgets. The comparison is between the attempts the provider actually
+ * received (the dispatch-budgets seam), never against the fixture's configured value.
+ */
+export type TruncationBudgetVerdict =
+  | { kind: 'met'; first: number; retry: number }
+  | { kind: 'unmet'; first: number; retry: number }
+  | { kind: 'skip'; skip: 'inapplicable' | 'blocked'; reason: string };
+
+export async function truncationBudgetVerdict(nodeId: string): Promise<TruncationBudgetVerdict> {
+  const budgets = await readDispatchBudgets(nodeId);
+  if (!budgets.ok && budgets.unserved) {
+    return { kind: 'skip', skip: 'inapplicable', reason: `partial witness — the §B budget SHOULD is not observed: ${budgets.reason}, so the retry's budget cannot be compared with the first attempt's` };
+  }
+  if (!budgets.ok) return { kind: 'skip', skip: 'blocked', reason: budgets.reason };
+  const [first, retry] = budgets.attempts;
+  if (budgets.attempts.length < 2) return { kind: 'skip', skip: 'inapplicable', reason: `the host made no truncation retry (RFC 0033 §B: MAY retry); per-attempt budgets ${JSON.stringify(budgets.attempts)}` };
+  if (typeof first !== 'number' || typeof retry !== 'number') {
+    return { kind: 'skip', skip: 'inapplicable', reason: `partial witness — a call carried no output budget (per-attempt budgets ${JSON.stringify(budgets.attempts)}), so the §B SHOULD cannot be compared` };
+  }
+  return retry > first ? { kind: 'met', first, retry } : { kind: 'unmet', first, retry };
+}

package/src/lib/mock-node-lock.ts

@@ -0,0 +1,66 @@
+/**
+ * Cross-file isolation for the mock-AI program seam.
+ *
+ * `POST /v1/host/sample/test/mock-ai/program` is keyed by `nodeId` alone
+ * (host-sample-test-seams.md §5), and a node id belongs to a fixture. When two
+ * scenario files drive the same fixture, vitest runs them in parallel workers
+ * by default and each can overwrite the other's program between seeding it and
+ * reading the run: a flaky result that says nothing about the host.
+ *
+ * `holdMockNodes(...ids)` holds a lock per node id for the whole file, taken in
+ * `beforeAll` and released in `afterAll`, so files sharing a node run one after
+ * another. The lock is an atomic `mkdir` in the OS temp dir, keyed by the target
+ * base URL and the node id, so it is shared by every worker process on the
+ * machine and separate hosts never contend. Ids are taken in sorted order (no
+ * deadlock between files holding overlapping sets); a lock older than
+ * STALE_MS is presumed left by a killed run and is broken.
+ */
+
+import { beforeAll, afterAll } from 'vitest';
+import { mkdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const POLL_MS = 200;
+const WAIT_MS = 300_000;
+const STALE_MS = 600_000;
+
+function lockDir(nodeId: string): string {
+  const key = createHash('sha256').update(`${process.env.OPENWOP_BASE_URL ?? ''}\u0000${nodeId}`).digest('hex').slice(0, 24);
+  return join(tmpdir(), `openwop-mock-node-${key}`);
+}
+
+async function acquire(dir: string, nodeId: string): Promise<void> {
+  const deadline = Date.now() + WAIT_MS;
+  for (;;) {
+    try {
+      mkdirSync(dir);
+      writeFileSync(join(dir, 'owner'), `${process.pid} ${nodeId} ${new Date().toISOString()}\n`);
+      return;
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code !== 'EEXIST') throw e;
+      try {
+        if (Date.now() - statSync(dir).mtimeMs > STALE_MS) { rmSync(dir, { recursive: true, force: true }); continue; }
+      } catch { continue; }
+      if (Date.now() > deadline) throw new Error(`mock-node lock for ${nodeId} not acquired within ${WAIT_MS / 1000}s (${dir}) — another scenario file still holds it`);
+      await new Promise((r) => setTimeout(r, POLL_MS));
+    }
+  }
+}
+
+/** Hold the mock-AI program slot for these node ids for the duration of the calling file. */
+export function holdMockNodes(...nodeIds: string[]): void {
+  const held: string[] = [];
+  beforeAll(async () => {
+    if (!process.env.OPENWOP_BASE_URL) return; // server-free run: nothing to isolate
+    for (const id of [...new Set(nodeIds)].sort()) {
+      const dir = lockDir(id);
+      await acquire(dir, id);
+      held.push(dir);
+    }
+  }, WAIT_MS + 10_000);
+  afterAll(() => {
+    for (const dir of held.splice(0).reverse()) rmSync(dir, { recursive: true, force: true });
+  });
+}

package/src/scenarios/envelope-completion-distinguishes-truncation.test.ts

@@ -34,7 +34,11 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
-import { readDispatchBudgets } from '../lib/mock-ai-budgets.js';
+import { readDispatchBudgets, truncationBudgetVerdict } from '../lib/mock-ai-budgets.js';
+import { holdMockNodes } from '../lib/mock-node-lock.js';
+
+// The mock-AI program seam is keyed by node id; files sharing a fixture's node run one at a time.
+holdMockNodes('truncated-structured-call', 'retry-attempted-structured-call');
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 /**
@@ -159,16 +163,21 @@ describe.skipIf(HTTP_SKIP)('envelope-completion-distinguishes-truncation: trunca
     ]);
     if (seed.status === 404) return softSkip('blocked', 'precondition not met — `seed.status === 404` returned early (seam, prior step, or fixture unavailable)');
 
-    await startRunAndRead(TRUNCATED_FIXTURE);
-    const budget = await lastBudget(TRUNCATED_FIXTURE);
-    if (budget === null) return softSkip('blocked', 'precondition not met — `budget === null` returned early (seam, prior step, or fixture unavailable)');
+    const run = await startRunAndRead(TRUNCATED_FIXTURE);
+    if (run === null) return softSkip('blocked', 'precondition not met — the run create or event-log read failed');
+    // RFC 0033 §B: MAY retry, and the retry budget SHOULD exceed the first
+    // attempt's. Compared through the dispatch-budgets seam; an unmet SHOULD is
+    // recorded, not failed (suite 2.42.9; this leg asserted `> 50` as a MUST).
+    const v = await truncationBudgetVerdict(NODE_OF[TRUNCATED_FIXTURE] as string);
+    if (v.kind === 'skip') return softSkip(v.skip, v.reason);
+    if (v.kind === 'unmet') return softSkip('inapplicable', `RFC 0033 §B SHOULD not met — the retry carried maxTokens ${v.retry} after the first attempt carried ${v.first}; recorded, not failed`);
     expect(
-      budget,
-      req('openwop.it.envelope-completion-distinguishes-truncation.truncation-retry-budget-strictly-greater-than-initial-rfc-0033-b-truncationbudge', 
+      v.retry,
+      req('openwop.it.envelope-completion-distinguishes-truncation.truncation-retry-budget-strictly-greater-than-initial-rfc-0033-b-truncationbudge',
         'RFCS/0033-envelope-completion-contract.md §B',
-        'truncation retry MUST multiply maxTokens by truncationBudgetMultiplier — final budget > initial 50 fixture value',
+        `the truncation retry's budget SHOULD exceed the first attempt's (first ${v.first}, retry ${v.retry})`,
       ),
-    ).toBeGreaterThan(50);
+    ).toBeGreaterThan(v.first);
   });
 });
 

package/src/scenarios/envelope-retry-attempted.test.ts

@@ -117,6 +117,10 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
+import { holdMockNodes } from '../lib/mock-node-lock.js';
+
+// The mock-AI program seam is keyed by node id; files sharing a fixture's node run one at a time.
+holdMockNodes('retry-attempted-structured-call');
 
 const FIXTURE = 'conformance-envelope-retry-attempted';
 const NODE_ID = 'retry-attempted-structured-call';

package/src/scenarios/envelope-truncated.test.ts

@@ -22,6 +22,11 @@ import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
+import { holdMockNodes } from '../lib/mock-node-lock.js';
+import { truncationBudgetVerdict } from '../lib/mock-ai-budgets.js';
+
+// The mock-AI program seam is keyed by node id; files sharing a fixture's node run one at a time.
+holdMockNodes('truncated-structured-call');
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 const FIXTURE = 'conformance-envelope-truncated';
@@ -50,12 +55,6 @@ async function startRunAndRead(): Promise<{ events: RunEvent[]; terminal: unknow
   return { events, terminal };
 }
 
-async function lastBudget(): Promise<number | null> {
-  const res = await driver.get(`/v1/host/sample/test/mock-ai/last-dispatch-budget?nodeId=${encodeURIComponent(NODE_ID)}`);
-  if (res.status !== 200) return null;
-  return (res.json as { maxTokens?: number | null }).maxTokens ?? null;
-}
-
 describe.skipIf(HTTP_SKIP)('envelope-truncated: runtime behavior (RFC 0032 §B.4 + RFC 0033 §B)', () => {
   it('when mock returns stopReason: max_tokens on attempt 1, exactly one envelope.truncated event fires with stopReason: max_tokens', async () => {
     if (!isFixtureAdvertised(FIXTURE)) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!isFixtureAdvertised(FIXTURE)` returned early');
@@ -112,19 +111,20 @@ describe.skipIf(HTTP_SKIP)('envelope-truncated: runtime behavior (RFC 0032 §B.4
 
     const result = await startRunAndRead();
     if (result === null) return softSkip('blocked', 'precondition not met — `result === null` returned early (seam, prior step, or fixture unavailable)');
-    // After the run, the mock's most-recent budget is the SECOND (retry)
-    // attempt's maxTokens. Per RFC 0033 §B, this MUST exceed the fixture's
-    // initial maxTokens (50). The host's default multiplier is 2 — so the
-    // retry should see 100.
-    const budget = await lastBudget();
-    if (budget === null) return softSkip('blocked', 'precondition not met — `budget === null` returned early (host doesn\'t expose the seam) (seam, prior step, or fixture unavailable)'); // host doesn't expose the seam
+    // RFC 0033 §B: the retry budget SHOULD exceed the first attempt's (a MAY retry,
+    // a SHOULD increase). Suite 2.42.9 compares the budgets the provider actually
+    // received, and records an unmet SHOULD rather than failing it; until then this
+    // leg asserted `> 50` (the fixture value) as a MUST.
+    const v = await truncationBudgetVerdict(NODE_ID);
+    if (v.kind === 'skip') return softSkip(v.skip, v.reason);
+    if (v.kind === 'unmet') return softSkip('inapplicable', `RFC 0033 §B SHOULD not met — the retry carried maxTokens ${v.retry} after the first attempt carried ${v.first}; recorded, not failed`);
     expect(
-      budget,
-      req('openwop.it.envelope-truncated.retry-attempt-receives-a-maxtokens-value-strictly-greater-than-the-previous-atte', 
+      v.retry,
+      req('openwop.it.envelope-truncated.retry-attempt-receives-a-maxtokens-value-strictly-greater-than-the-previous-atte',
         'RFCS/0033-envelope-completion-contract.md §B',
-        'truncation retry MUST issue with a strictly-increased maxTokens budget (host multiplies by capabilities.envelopes.reliability.completion.truncationBudgetMultiplier)',
+        `the truncation retry's budget SHOULD exceed the first attempt's (first ${v.first}, retry ${v.retry})`,
       ),
-    ).toBeGreaterThan(50);
+    ).toBeGreaterThan(v.first);
   });
 
   it('run terminates `completed` after the second attempt succeeds', async () => {

package/src/scenarios/v2-webhook-delivery-shape.test.ts

@@ -234,6 +234,11 @@ describe('webhook delivery shape is per-contract (webhooks.md §Delivery, versio
     expect(owner !== null, req(ID, DOC, 'a major-2 run.started payload MUST carry the owner echo { tenant, subject } (identity.md §1; run-event-payloads runStarted.owner requires both)')).toBe(true);
     expect(Object.keys(owner ?? {}).filter((k) => k === 'principal' || k === 'principalKind'), req(ID, DOC, 'a major-2 owner echo MUST NOT carry the v1 keys principal / principalKind — that is the fan-out forwarding the in-process dialect instead of projecting')).toEqual([]);
     expect(typeof owner?.['tenant'] === 'string' && owner?.['subject'] !== undefined, req(ID, DOC, 'a major-2 owner echo carries tenant and subject')).toBe(true);
+    // webhooks.md §Delivery: `workspaceId` is present exactly when RunSnapshot.owner.workspace is,
+    // equal to it, and a host MUST NOT substitute its tenant id (or any placeholder) for an absent one.
+    const ws = owner?.['workspace'];
+    const sent = (d.envelope as Record<string, unknown>)['workspaceId'];
+    expect(ws === undefined ? sent === undefined : sent === ws, req(ID, DOC, `workspaceId MUST be present exactly when owner.workspace is, and equal to it — nothing is substituted for an absent workspace (owner.workspace ${JSON.stringify(ws)}, delivered workspaceId ${JSON.stringify(sent)})`)).toBe(true);
   });
 
   it('a major-1 subscriber still receives the v1 rendering — the v1 wire does not move mid-overlap', async () => {