@openwop/openwop-conformance 2.43.0 → 2.43.1

package/src/scenarios/v2-manifest-hatch-carried.test.ts

@@ -15,8 +15,10 @@
  *      packs at all (`pack_kind_invalid`) records `skipped` for that leg.
  *
  * Installs through the seams-profile publish seam
- * (`/conformance/seams/packs-test/…`, RFC 0168 §C.2). Gated on `packs` + the
- * seams profile.
+ * (`/conformance/seams/packs-test/…`, RFC 0168 §C.2). Gated on the seams
+ * profile; not on `packs` since suite 2.43.1 (#1706) — the hatch binds at install
+ * on every path. A seam 404 records `blocked` when `packs` is advertised and
+ * `inapplicable` when it is not.
  *
  * @see RFCS/0177-v2-registry-packs-and-extension-tail.md §C.2
  * @see spec/v2/core/packs.md §"The manifest schema family"
@@ -30,7 +32,7 @@ import { readErrorCode } from '../lib/error-envelope.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip, type SoftSkipKind } from '../lib/soft-skip.js';
 import { seamsProfileAdvertised, targetMajor } from '../lib/seams.js';
-import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
 
 const SECTION = 'packs.md §"The manifest schema family" (RFC 0177 §C.2)';
 
@@ -67,6 +69,17 @@ async function publish(manifest: Record<string, unknown>, files: Record<string,
     headers: { 'Content-Type': 'application/octet-stream' },
   });
 }
+/**
+ * The publish seam answered 404. Whether that is a defect depends on `packs`
+ * (#1706): a host advertising `packs` claims an install path and must mount it
+ * (`blocked`); a host that omits `packs` may have no install path the suite can
+ * drive (`inapplicable`). §A.1 binds at install on every path, not on `packs`.
+ */
+async function seamMissing(): Promise<undefined> {
+  if (await familyAdvertised('packs')) return softSkip('blocked', 'packs-test publish seam answered 404 — packs and the seams profile are advertised but the seam is not mounted');
+  return softSkip('inapplicable', 'packs-test publish seam answered 404 and packs is not advertised — no install path the suite can drive');
+}
+
 async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | null> {
   if (targetMajor() !== 2) return { kind: 'inapplicable', reason: 'suite 2.0.0 v2 scenario: OPENWOP_TARGET_MAJOR is not 2' };
   let doc: Record<string, unknown> | null;
@@ -76,7 +89,6 @@ async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | nul
     doc = null;
   }
   if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
-  if (!(await gateFamily('packs'))) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise the packs family (RFC 0169 §A.2)' };
   if (!seamsProfileAdvertised(doc)) return { kind: 'inapplicable', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only install path the suite can drive (RFC 0168 §C.1)' };
   return null;
 }
@@ -93,10 +105,14 @@ describe('v2-manifest-hatch-carried (RFC 0177 §C.2)', () => {
       engines: { openwop: '>=2.0.0 <3.0.0' },
       runtime: { language: 'javascript', entry: 'index.mjs', format: 'esm' },
       nodes: [{ typeId: `${name}.echo`, version: '1.0.0', category: 'data', role: 'pure' }],
-      agents: [{ agentId: `${name}.helper`, persona: 'Hatch Helper', modelClass: 'general', 'x-vendor-note': 'a hatch property the host MUST ignore' }],
+      // systemPrompt: agent-manifest requires exactly one of systemPrompt /
+      // systemPromptRef (oneOf). Without it the fixture was schema-invalid for a
+      // reason unrelated to the hatch, and a conforming host had to refuse it
+      // (2.43.1; reported by MyndHyve).
+      agents: [{ agentId: `${name}.helper`, persona: 'Hatch Helper', modelClass: 'general', systemPrompt: 'You are a conformance fixture.', 'x-vendor-note': 'a hatch property the host MUST ignore' }],
     };
     const res = await publish(manifest, { 'index.mjs': ENTRY });
-    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    if (res.status === 404) return seamMissing();
     expect([200, 201].includes(res.status), req('openwop.requirement.0177.manifest-hatch-carried.agents-x-field', SECTION, `agent-manifest admits ^(openwop-|x-|vendor\\.) — a pack whose agents[0] carries x-vendor-note MUST install (got ${res.status} ${readErrorCode(res.json) ?? ''})`)).toBe(true);
   });
 
@@ -112,7 +128,7 @@ describe('v2-manifest-hatch-carried (RFC 0177 §C.2)', () => {
       prompts: [{ templateId: `${name}.system`, version: '1.0.0', kind: 'system', text: 'You are a conformance fixture.', 'x-vendor-note': 'a hatch property the host MUST ignore' }],
     };
     const res = await publish(manifest, {});
-    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    if (res.status === 404) return seamMissing();
     const code = readErrorCode(res.json);
     if (res.status >= 400 && code === 'pack_kind_invalid') return softSkip('skipped', 'host does not install kind: prompt packs (pack_kind_invalid) — the prompt-template hatch cannot be observed on this host');
     expect([200, 201].includes(res.status), req('openwop.requirement.0177.manifest-hatch-carried.prompt-template-x-field', SECTION, `prompt-template admits ^(openwop-|x-|vendor\\.) — a prompt pack whose prompts[0] carries x-vendor-note MUST install (got ${res.status} ${code ?? ''})`)).toBe(true);

package/src/scenarios/v2-pack-isolation.test.ts

@@ -1,5 +1,10 @@
 /**
- * RFC 0173 §B — `pack-isolation` (suite 2.0.0, target major 2; gated on `packs` + `sandbox`).
+ * RFC 0173 §B — `pack-isolation` (suite 2.0.0, target major 2; gated on `sandbox`).
+ *
+ * Gated on `sandbox` alone since suite 2.43.1 (#1706). It was gated on `packs`
+ * + `sandbox`, but `packs` advertises registry resolution (packs.md §The
+ * `packs` capability), which a host executing only local packs correctly omits.
+ * `sandbox` is the advertisement §B requires of any host executing packs.
  *
  * Isolation binds with pack EXECUTION: a host that executes third-party packs
  * MUST enforce the eight `node-pack-sandbox-*` invariants and MUST advertise
@@ -41,11 +46,10 @@ async function discovery(): Promise<Record<string, unknown> | null> {
   try { return await v2Discovery(); } catch { return null; }
 }
 
-/** Gate for every leg: packs + sandbox advertised. Returns the sandbox facet or null (reason recorded). */
+/** Gate for every leg: sandbox advertised. Returns the sandbox facet or null (reason recorded). */
 async function gated(): Promise<Record<string, unknown> | null> {
   const doc = await discovery();
   if (!doc) { softSkip('blocked', 'discovery unreachable'); return null; }
-  if (!(await gateFamily('packs'))) { softSkip('inapplicable', 'packs family not advertised — no pack execution, no isolation obligation (gate recorded under openwop.family.packs)'); return null; }
   const sandbox = await gateFamily('sandbox');
   if (!sandbox) { softSkip('inapplicable', 'sandbox family not advertised (gate recorded under openwop.family.sandbox)'); return null; }
   return sandbox;
@@ -56,7 +60,7 @@ async function invoke(typeId: string, extra: Record<string, unknown> = {}): Prom
   const doc = await discovery();
   if (!doc || !seamsProfileAdvertised(doc)) { softSkip('inapplicable', `the ${typeId} leg is seam-driven — seams profile (conformance.seamsProfile = openwop-conformance-seams-v2) not advertised`); return null; }
   const res = await driver.post(INVOKE, { typeId, ...extra });
-  if (res.status === 404 || res.status === 403 || res.status === 405) { seamAbsent(`host advertises packs + sandbox but ${INVOKE} answered ${res.status} — the ${typeId} leg is unobservable (host-sample-test-seams.md §8)`); return null; }
+  if (res.status === 404 || res.status === 403 || res.status === 405) { seamAbsent(`host advertises sandbox but ${INVOKE} answered ${res.status} — the ${typeId} leg is unobservable (host-sample-test-seams.md §8)`); return null; }
   // The same id is ALSO asserted by its own `it` above, and that is the copy the
   // registry can see: `generate-requirement-registry.mjs` harvests `req(…)` only
   // within an `it`, so this helper-level call alone left the id out of
@@ -74,7 +78,7 @@ function expectEscape(id: string, r: InvokeResult, escapeKind: string, invariant
   expect(r.error?.details?.escapeKind, req(id, 'host-sample-test-seams.md §8 SandboxError', `escapeKind MUST be ${escapeKind}`)).toBe(escapeKind);
 }
 
-describe('RFC 0173 §B — pack-isolation (gated on packs + sandbox)', () => {
+describe('RFC 0173 §B — pack-isolation (gated on sandbox)', () => {
   it('sandbox.isolationModel names a real mechanism, never node:vm', async () => {
     const sandbox = await gated();
     if (!sandbox) return softSkip('inapplicable', 'gate not met (reason recorded above)');
@@ -94,7 +98,7 @@ describe('RFC 0173 §B — pack-isolation (gated on packs + sandbox)', () => {
     const doc = await discovery();
     if (!doc || !seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'seam-driven — seams profile (conformance.seamsProfile = openwop-conformance-seams-v2) not advertised');
     const res = await driver.post(INVOKE, { typeId: 'misbehave.fs-escape-read' });
-    if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises packs + sandbox but ${INVOKE} answered ${res.status}`);
+    if (res.status === 404 || res.status === 403 || res.status === 405) return seamAbsent(`host advertises sandbox but ${INVOKE} answered ${res.status}`);
     expect(
       res.status,
       req('openwop.requirement.0173.pack-isolation.seam', 'host-sample-test-seams.md §8', `${INVOKE} MUST answer 200 { result } | 200 { error } — the eight behavioural legs are unobservable otherwise`),

package/src/scenarios/v2-peer-dependency-declared.test.ts

@@ -17,8 +17,10 @@
  *      failure; any other refusal fails.
  *
  * Both legs install through the seams-profile publish seam
- * (`/conformance/seams/packs-test/…`, RFC 0168 §C.2). Gated on `packs` + the
- * seams profile.
+ * (`/conformance/seams/packs-test/…`, RFC 0168 §C.2). Gated on the seams
+ * profile; not on `packs` since suite 2.43.1 (#1706) — the rule binds at install
+ * on every path. A seam 404 records `blocked` when `packs` is advertised and
+ * `inapplicable` when it is not.
  *
  * @see RFCS/0177-v2-registry-packs-and-extension-tail.md §B.1, §B.2
  * @see spec/v2/core/packs.md §"Peer-dependency identifiers", §"The alias table"
@@ -35,7 +37,7 @@ import { SCHEMAS_DIR } from '../lib/paths.js';
 import { req } from '../lib/requirement-ids.js';
 import { softSkip, type SoftSkipKind } from '../lib/soft-skip.js';
 import { seamsProfileAdvertised, targetMajor } from '../lib/seams.js';
-import { v2Discovery, gateFamily, familyAdvertised } from '../lib/v2.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
 
 const SECTION = 'packs.md §"Peer-dependency identifiers" (RFC 0177 §B.1)';
 const ALIASES = join(SCHEMAS_DIR, '..', 'spec', 'v2', 'peer-dependency-aliases.json');
@@ -86,6 +88,17 @@ async function publish(manifest: Record<string, unknown>) {
     headers: { 'Content-Type': 'application/octet-stream' },
   });
 }
+/**
+ * The publish seam answered 404. Whether that is a defect depends on `packs`
+ * (#1706): a host advertising `packs` claims an install path and must mount it
+ * (`blocked`); a host that omits `packs` may have no install path the suite can
+ * drive (`inapplicable`). §A.1 binds at install on every path, not on `packs`.
+ */
+async function seamMissing(): Promise<undefined> {
+  if (await familyAdvertised('packs')) return softSkip('blocked', 'packs-test publish seam answered 404 — packs and the seams profile are advertised but the seam is not mounted');
+  return softSkip('inapplicable', 'packs-test publish seam answered 404 and packs is not advertised — no install path the suite can drive');
+}
+
 async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | null> {
   if (targetMajor() !== 2) return { kind: 'inapplicable', reason: 'suite 2.0.0 v2 scenario: OPENWOP_TARGET_MAJOR is not 2' };
   let doc: Record<string, unknown> | null;
@@ -95,7 +108,6 @@ async function preflight(): Promise<{ kind: SoftSkipKind; reason: string } | nul
     doc = null;
   }
   if (!doc) return { kind: 'blocked', reason: 'discovery unreachable — /.well-known/openwop (OpenWOP-Version: 2.0) did not answer 200 JSON' };
-  if (!(await gateFamily('packs'))) return { kind: 'inapplicable', reason: 'v2 discovery does not advertise the packs family (RFC 0169 §A.2)' };
   if (!seamsProfileAdvertised(doc)) return { kind: 'inapplicable', reason: 'host does not advertise conformance.seamsProfile: openwop-conformance-seams-v2 — the packs-test publish seam is the only install path the suite can drive (RFC 0168 §C.1)' };
   return null;
 }
@@ -105,7 +117,7 @@ describe('v2-peer-dependency-declared (RFC 0177 §B.1/§B.2)', () => {
     const skip = await preflight();
     if (skip) return softSkip(skip.kind, skip.reason);
     const res = await publish(nodePack(freshName('peer-undefined'), { 'host.nonexistent': 'required' }));
-    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    if (res.status === 404) return seamMissing();
     expect(res.status, req('openwop.requirement.0177.peer-dependency-declared.undefined-key', SECTION, 'a key absent from spec/v2/declaration.json MUST be refused with 400 pack_peer_dependency_undefined')).toBe(400);
     expect(readErrorCode(res.json), req('openwop.requirement.0177.peer-dependency-declared.undefined-key', SECTION, 'the refusal code MUST be pack_peer_dependency_undefined')).toBe('pack_peer_dependency_undefined');
   });
@@ -124,7 +136,7 @@ describe('v2-peer-dependency-declared (RFC 0177 §B.1/§B.2)', () => {
     }
     if (!chosen) return softSkip('inapplicable', 'no facet-less alias row names a family this host advertises — the overlap alias cannot be exercised');
     const res = await publish(nodePack(freshName('peer-alias'), { [chosen.alias]: 'required' }));
-    if (res.status === 404) return softSkip('blocked', 'packs-test publish seam answered 404 — seams profile advertised but the seam is not mounted');
+    if (res.status === 404) return seamMissing();
     const code = readErrorCode(res.json);
     if (res.status === 400 && code === 'pack_peer_dependency_undefined') return softSkip('skipped', `host does not resolve the overlap alias ${chosen.alias} (RFC 0177 §B.2 is a MAY during the overlap; MUST NOT after v1 end-of-support)`);
     expect([200, 201].includes(res.status), req('openwop.requirement.0177.peer-dependency-declared.alias-overlap', 'packs.md §"The alias table" (RFC 0177 §B.2)', `alias ${chosen.alias} → ${chosen.family} (advertised) MUST install through the overlap or be refused only with pack_peer_dependency_undefined (got ${res.status} ${code ?? ''})`)).toBe(true);

package/src/scenarios/v2-webhook-secret-rotation.test.ts

@@ -10,15 +10,20 @@
  * checked before lookup (`403 id_tenant_mismatch`), refuses a subscription that
  * did not opt in (`400 validation_error`), and returns no secret.
  *
- * The post-overlap leg waits for `previousSecretExpiresAt` only when
- * `overlapSeconds` fits inside the suite's retry-wait cap
- * (`OPENWOP_WEBHOOK_RETRY_WAIT_MS`, operator-raisable). Past the cap it is not
- * observed, and the row says so with a `partial-witness:` detail — which the
- * acceptance predicate refuses to cite as `executed-pass` (RFC 0201 §Falsifiability).
+ * The post-overlap leg waits for `previousSecretExpiresAt` when `overlapSeconds`
+ * fits inside the suite's retry-wait cap (`OPENWOP_WEBHOOK_RETRY_WAIT_MS`,
+ * operator-raisable). Past the cap (suite 2.43.1), a seams-profile host that
+ * serves the OPTIONAL `shortenRotationOverlap` seam (host-sample-test-seams.md
+ * §29) has this one subscription's overlap cut to a few seconds, and the leg
+ * waits for that; a served seam that breaks its contract records `blocked`.
+ * A host without the seam is not observed, and the row says so with a
+ * `partial-witness:` detail — which the acceptance predicate refuses to cite as
+ * `executed-pass` (RFC 0201 §Falsifiability).
  *
  * How it FAILS: signing only with the new secret (one entry); moving
  * `OpenWOP-Signature` to the new secret at rotation; a foreign-tenant id that
- * reaches the lookup (`404` instead of `403`); a response that echoes the secret.
+ * reaches the lookup (`404` instead of `403`); a response that echoes the secret;
+ * the previous secret still signing after the (shortened) overlap.
  *
  * @see spec/v2/core/webhooks.md §Standard Webhooks
  * @see RFCS/0201-standard-webhooks-signature-scheme.md §E
@@ -32,6 +37,7 @@ import { readErrorCode } from '../lib/error-envelope.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { projectBoundId } from '../lib/bound-id.js';
 import { retryWaitCapMs } from '../lib/webhook-retry-window.js';
+import { seamsProfileAdvertised } from '../lib/seams.js';
 import { hitHeader, mintWhsec, startModalReceiver, verifyStandardWebhooks, type ModalHit } from '../lib/webhook-receiver.js';
 import {
   STANDARD_WEBHOOKS_ALG,
@@ -39,12 +45,15 @@ import {
   driveRun,
   loopbackRefusal,
   registerSw,
+  shortenRotationOverlap,
   swGate,
   unregisterAllSw,
   waitFor,
 } from '../lib/standard-webhooks.js';
 
 const CAP_MS = retryWaitCapMs();
+/** The overlap the §29 seam sets: long enough that the call returns inside it, short enough to wait out. */
+const SEAM_OVERLAP_SECONDS = 3;
 
 let closeReceiver: (() => Promise<void>) | null = null;
 afterEach(async () => {
@@ -114,17 +123,25 @@ describe('RFC 0201 §E — secret rotation overlaps, then retires (gated on webh
     expect(underOld.matched, req(ID, 'RFC 0201 §E.20', 'one entry MUST verify under the previous secret')).toBe(1);
     expect(v1SignedBy(s1, d), req(ID, 'RFC 0201 §E.20', 'OpenWOP-Signature MUST stay on the previous secret during the overlap')).toBe(true);
 
-    // After the overlap: only when it fits the operator's wait cap.
-    const expiresAt = Date.parse(body.previousSecretExpiresAt ?? '');
+    // After the overlap: when it fits the operator's wait cap, or when the §29 seam shortens it.
+    let expiresAt = Date.parse(body.previousSecretExpiresAt ?? '');
     if (expiresAt - Date.now() > CAP_MS) {
+      const unobserved = (why: string): string => `the post-overlap leg is not observed: the advertised webhooks.secretRotation.overlapSeconds is ${overlapSeconds}s (expiry ${new Date(expiresAt).toISOString()}) and the suite wait cap is ${CAP_MS}ms, and ${why}; raise OPENWOP_WEBHOOK_RETRY_WAIT_MS past the overlap, or serve the seam, to witness it`;
       // partial-witness-ok: the tenant check, the rotate response and the dual signature during
       // the overlap were asserted above. "The previous secret MUST NOT sign after
       // previousSecretExpiresAt" cannot be observed inside a bounded run when the host's
       // advertised webhooks.secretRotation.overlapSeconds outlasts the suite's wait cap, and
       // blocking every long-overlap host would deny certification to conforming hosts
-      // (steward ruling, 2026-09-27). The row detail names both numbers. Raise
-      // OPENWOP_WEBHOOK_RETRY_WAIT_MS past the overlap to witness it.
-      return softSkip('inapplicable', `the post-overlap leg is not observed: the advertised webhooks.secretRotation.overlapSeconds is ${overlapSeconds}s (expiry ${new Date(expiresAt).toISOString()}) and the suite wait cap is ${CAP_MS}ms; raise OPENWOP_WEBHOOK_RETRY_WAIT_MS past the overlap to witness it`);
+      // (steward ruling, 2026-09-27). The §29 seam closes it, but only for a host that
+      // claims the seams profile; this one did not. The row detail names both numbers.
+      if (!seamsProfileAdvertised(g.doc)) return softSkip('inapplicable', unobserved('the seams profile is not advertised, so the optional shortenRotationOverlap seam (host-sample-test-seams.md §29) is not offered'));
+      const cut = await shortenRotationOverlap(webhookId, SEAM_OVERLAP_SECONDS, foreign);
+      // partial-witness-ok: as above — the dual-signing half was asserted. The §29 seam is
+      // OPTIONAL and newer than this leg, so a host that does not serve it keeps the partial
+      // witness it held before the seam existed, never `blocked`.
+      if (!cut.ok && cut.unserved) return softSkip('inapplicable', unobserved(cut.reason));
+      if (!cut.ok) return softSkip('blocked', cut.reason);
+      expiresAt = cut.expiresAt;
     }
     await new Promise((r) => setTimeout(r, Math.max(0, expiresAt - Date.now()) + 1_500));
     const after = await oneDelivery(rx, webhookId);