@openwop/openwop-conformance 2.43.0 → 2.43.2

package/src/scenarios/v2-run-fork-ancestry.test.ts

@@ -0,0 +1,83 @@
+/**
+ * `spec/v2/core/runs.md` §Diff and ancestry — a fork has no ancestry parent
+ * (suite 2.43.2, target major 2; gated on `replay` and on
+ * `multiAgent.executionModel.crossHostCausation.ancestryEndpointSupported`;
+ * one run created plus one branch fork).
+ *
+ * `getRunAncestry`'s `parent` is the run that dispatched this one, and `cause`
+ * names the composition mechanism it used (`core.subWorkflow`,
+ * `core.dispatch`, `mcp-tool-call`, `a2a-message`). A fork is not dispatched:
+ * its lineage is `sourceRunId` on the fork `201` and `parentRunId` on the
+ * snapshot, and its ancestry `parent` MUST be `null`. A host that reuses its
+ * fork link as an ancestry parent reports `cause: core.subWorkflow` for a run
+ * no parent dispatched, and fails here.
+ *
+ * The source run's own ancestry is the control: it was created by `POST /runs`,
+ * so its `parent` is `null` too. Without it a host answering `null` for every
+ * run would pass the fork leg without being measured on it, and one answering
+ * non-null for every run would fail it for the wrong reason.
+ *
+ * Its own file, not a leg of `v2-run-fork-refusals`: the ancestry gate is
+ * absent on most v2 hosts, and an `inapplicable` leg would turn that file's
+ * row into a `partial-witness` pass on every one of them.
+ *
+ * @see spec/v2/core/runs.md §Diff and ancestry
+ * @see spec/v2/core/runs.md §Fork
+ * @see schemas/v2/run-ancestry-response.schema.json
+ * @see RFCS/0040-multi-agent-cross-host-causation.md §C
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, gateFamily, familyAdvertised } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0040.fork-has-no-ancestry-parent';
+const DOC = 'spec/v2/core/runs.md §Diff and ancestry';
+const NOOP = 'conformance-noop';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+async function discovery(): Promise<Record<string, unknown> | null> { try { return await v2Discovery(); } catch { return null; } }
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
+const enc = (id: string): string => encodeURIComponent(id);
+async function status(runId: string): Promise<string | null> {
+  const res = await http(() => driver.get(`/runs/${enc(runId)}`));
+  return res?.status === 200 ? String((res.json as { status?: unknown } | null)?.status ?? '') : null;
+}
+
+describe('v2 run-fork-ancestry (runs.md §Diff and ancestry)', () => {
+  it('a branch fork is not a composition child: its ancestry parent is null', async () => {
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable');
+    if (!(await gateFamily('replay'))) return softSkip('inapplicable', 'replay family not advertised (gate recorded under openwop.family.replay) — forkRun is gated on replay (runs.md §Surface)');
+    const chc = ((await familyAdvertised('multiAgent'))?.['executionModel'] as { crossHostCausation?: { ancestryEndpointSupported?: unknown } } | undefined)?.crossHostCausation;
+    if (chc?.ancestryEndpointSupported !== true) return softSkip('inapplicable', 'multiAgent.executionModel.crossHostCausation.ancestryEndpointSupported not advertised — getRunAncestry is gated on it (runs.md §Surface)');
+
+    const created = await http(() => driver.post('/runs', { workflowId: NOOP }));
+    if (created === null) return softSkip('blocked', 'POST /runs unreachable (fetch failed)');
+    const runId = (created.json as { runId?: unknown } | null)?.runId;
+    if (created.status !== 201 || typeof runId !== 'string') return softSkip('blocked', `POST /runs answered ${created.status} ${readErrorCode(created.json) ?? ''}`.trim());
+    const t0 = Date.now(); let settled: string | null = null;
+    while (Date.now() - t0 < 10_000) { settled = await status(runId); if (settled !== null && TERMINAL.has(settled)) break; await new Promise((r) => setTimeout(r, 250)); }
+    if (settled === null || !TERMINAL.has(settled)) return softSkip('blocked', 'the noop run did not settle within 10 s');
+
+    const own = await http(() => driver.get(`/runs/${enc(runId)}/ancestry`));
+    if (own === null) return softSkip('blocked', 'GET /runs/{runId}/ancestry unreachable (fetch failed)');
+    expect(own.status, req(ID, DOC, `a host advertising ancestryEndpointSupported MUST serve getRunAncestry — got ${own.status} ${readErrorCode(own.json) ?? ''}`.trim())).toBe(200);
+    expect((own.json as { parent?: unknown } | null)?.parent, req(ID, DOC, 'the control: a run created by POST /runs was dispatched by no parent, so its ancestry parent MUST be null')).toBeNull();
+
+    const fork = await http(() => driver.post(`/runs/${enc(runId)}:fork`, { mode: 'branch', fromSeq: 0 }));
+    if (fork === null) return softSkip('blocked', 'POST /runs/{runId}:fork unreachable (fetch failed)');
+    if (fork.status === 404) return softSkip('blocked', 'POST /runs/{runId}:fork answered 404 with replay advertised — forkRun is not mounted');
+    const forkId = (fork.json as { runId?: unknown } | null)?.runId;
+    if (fork.status !== 201 || typeof forkId !== 'string') return softSkip('blocked', `a branch fork at fromSeq 0 answered ${fork.status} ${readErrorCode(fork.json) ?? ''} — no fork to read the ancestry of`.trim());
+    expect((fork.json as { sourceRunId?: unknown }).sourceRunId, req(ID, 'spec/v2/core/runs.md §Fork', 'the fork\'s lineage is carried by the 201: sourceRunId MUST name the source')).toBe(runId);
+
+    const anc = await http(() => driver.get(`/runs/${enc(forkId)}/ancestry`));
+    if (anc === null) return softSkip('blocked', 'GET /runs/{fork}/ancestry unreachable (fetch failed)');
+    expect(anc.status, req(ID, DOC, `getRunAncestry on a fork MUST answer 200 — got ${anc.status} ${readErrorCode(anc.json) ?? ''}`.trim())).toBe(200);
+    const parent = (anc.json as { parent?: unknown } | null)?.parent;
+    expect(parent, req(ID, DOC, `a fork is not dispatched, so its ancestry parent MUST be null — got ${JSON.stringify(parent)}. Its lineage is sourceRunId and the snapshot's parentRunId; ancestry's cause names a composition mechanism no fork used`)).toBeNull();
+  }, 30_000);
+});

package/src/scenarios/v2-webhook-secret-rotation.test.ts

@@ -10,15 +10,20 @@
  * checked before lookup (`403 id_tenant_mismatch`), refuses a subscription that
  * did not opt in (`400 validation_error`), and returns no secret.
  *
- * The post-overlap leg waits for `previousSecretExpiresAt` only when
- * `overlapSeconds` fits inside the suite's retry-wait cap
- * (`OPENWOP_WEBHOOK_RETRY_WAIT_MS`, operator-raisable). Past the cap it is not
- * observed, and the row says so with a `partial-witness:` detail — which the
- * acceptance predicate refuses to cite as `executed-pass` (RFC 0201 §Falsifiability).
+ * The post-overlap leg waits for `previousSecretExpiresAt` when `overlapSeconds`
+ * fits inside the suite's retry-wait cap (`OPENWOP_WEBHOOK_RETRY_WAIT_MS`,
+ * operator-raisable). Past the cap (suite 2.43.1), a seams-profile host that
+ * serves the OPTIONAL `shortenRotationOverlap` seam (host-sample-test-seams.md
+ * §29) has this one subscription's overlap cut to a few seconds, and the leg
+ * waits for that; a served seam that breaks its contract records `blocked`.
+ * A host without the seam is not observed, and the row says so with a
+ * `partial-witness:` detail — which the acceptance predicate refuses to cite as
+ * `executed-pass` (RFC 0201 §Falsifiability).
  *
  * How it FAILS: signing only with the new secret (one entry); moving
  * `OpenWOP-Signature` to the new secret at rotation; a foreign-tenant id that
- * reaches the lookup (`404` instead of `403`); a response that echoes the secret.
+ * reaches the lookup (`404` instead of `403`); a response that echoes the secret;
+ * the previous secret still signing after the (shortened) overlap.
  *
  * @see spec/v2/core/webhooks.md §Standard Webhooks
  * @see RFCS/0201-standard-webhooks-signature-scheme.md §E
@@ -32,6 +37,7 @@ import { readErrorCode } from '../lib/error-envelope.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { projectBoundId } from '../lib/bound-id.js';
 import { retryWaitCapMs } from '../lib/webhook-retry-window.js';
+import { seamsProfileAdvertised } from '../lib/seams.js';
 import { hitHeader, mintWhsec, startModalReceiver, verifyStandardWebhooks, type ModalHit } from '../lib/webhook-receiver.js';
 import {
   STANDARD_WEBHOOKS_ALG,
@@ -39,12 +45,15 @@ import {
   driveRun,
   loopbackRefusal,
   registerSw,
+  shortenRotationOverlap,
   swGate,
   unregisterAllSw,
   waitFor,
 } from '../lib/standard-webhooks.js';
 
 const CAP_MS = retryWaitCapMs();
+/** The overlap the §29 seam sets: long enough that the call returns inside it, short enough to wait out. */
+const SEAM_OVERLAP_SECONDS = 3;
 
 let closeReceiver: (() => Promise<void>) | null = null;
 afterEach(async () => {
@@ -114,17 +123,25 @@ describe('RFC 0201 §E — secret rotation overlaps, then retires (gated on webh
     expect(underOld.matched, req(ID, 'RFC 0201 §E.20', 'one entry MUST verify under the previous secret')).toBe(1);
     expect(v1SignedBy(s1, d), req(ID, 'RFC 0201 §E.20', 'OpenWOP-Signature MUST stay on the previous secret during the overlap')).toBe(true);
 
-    // After the overlap: only when it fits the operator's wait cap.
-    const expiresAt = Date.parse(body.previousSecretExpiresAt ?? '');
+    // After the overlap: when it fits the operator's wait cap, or when the §29 seam shortens it.
+    let expiresAt = Date.parse(body.previousSecretExpiresAt ?? '');
     if (expiresAt - Date.now() > CAP_MS) {
+      const unobserved = (why: string): string => `the post-overlap leg is not observed: the advertised webhooks.secretRotation.overlapSeconds is ${overlapSeconds}s (expiry ${new Date(expiresAt).toISOString()}) and the suite wait cap is ${CAP_MS}ms, and ${why}; raise OPENWOP_WEBHOOK_RETRY_WAIT_MS past the overlap, or serve the seam, to witness it`;
       // partial-witness-ok: the tenant check, the rotate response and the dual signature during
       // the overlap were asserted above. "The previous secret MUST NOT sign after
       // previousSecretExpiresAt" cannot be observed inside a bounded run when the host's
       // advertised webhooks.secretRotation.overlapSeconds outlasts the suite's wait cap, and
       // blocking every long-overlap host would deny certification to conforming hosts
-      // (steward ruling, 2026-09-27). The row detail names both numbers. Raise
-      // OPENWOP_WEBHOOK_RETRY_WAIT_MS past the overlap to witness it.
-      return softSkip('inapplicable', `the post-overlap leg is not observed: the advertised webhooks.secretRotation.overlapSeconds is ${overlapSeconds}s (expiry ${new Date(expiresAt).toISOString()}) and the suite wait cap is ${CAP_MS}ms; raise OPENWOP_WEBHOOK_RETRY_WAIT_MS past the overlap to witness it`);
+      // (steward ruling, 2026-09-27). The §29 seam closes it, but only for a host that
+      // claims the seams profile; this one did not. The row detail names both numbers.
+      if (!seamsProfileAdvertised(g.doc)) return softSkip('inapplicable', unobserved('the seams profile is not advertised, so the optional shortenRotationOverlap seam (host-sample-test-seams.md §29) is not offered'));
+      const cut = await shortenRotationOverlap(webhookId, SEAM_OVERLAP_SECONDS, foreign);
+      // partial-witness-ok: as above — the dual-signing half was asserted. The §29 seam is
+      // OPTIONAL and newer than this leg, so a host that does not serve it keeps the partial
+      // witness it held before the seam existed, never `blocked`.
+      if (!cut.ok && cut.unserved) return softSkip('inapplicable', unobserved(cut.reason));
+      if (!cut.ok) return softSkip('blocked', cut.reason);
+      expiresAt = cut.expiresAt;
     }
     await new Promise((r) => setTimeout(r, Math.max(0, expiresAt - Date.now()) + 1_500));
     const after = await oneDelivery(rx, webhookId);

package/src/setup.ts

@@ -36,7 +36,7 @@ import { basename, join } from 'node:path';
 import { existsSync, readFileSync } from 'node:fs';
 import { PKG_ROOT_PATH } from './lib/paths.js';
 import { recordRequirement, hasRequirement, journalLength, journalSince } from './lib/requirement-ledger.js';
-import { requirementIdForFile, resolveFileRecord, resolveItRecord, type FileTestState, type TestFailure } from './lib/scenario-disposition.js';
+import { requirementIdForFile, resolveFileRecord, resolveItRecord, unrecordedTests, type FileTestState, type FinishedTest, type TestFailure } from './lib/scenario-disposition.js';
 import { softSkipDisposition, softSkipDispositionSince, softSkipMark } from './lib/soft-skip.js';
 import { ItIdAllocator, takeExplicitRequirementId } from './lib/requirement-ids.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './lib/spec-coherence.js';
@@ -250,6 +250,8 @@ const _fileStates = new Map<string, FileTestState[]>();
 const _fileAssertions = new Map<string, number>();
 /** Per file: the failing cases, so the file row can NAME them (2.37.0). */
 const _fileFailures = new Map<string, TestFailure[]>();
+/** Task ids the per-test recorder saw, so `afterAll` can recover the ones a throwing scenario hook hid (`unrecordedTests`). */
+const _fileRecorded = new Map<string, Set<string>>();
 const _ledgerMarks = new Map<string, number>();
 // Per-`it` recording (v2 charter Phase 1, suite 1.153.0 — the durable G8 fix
 // named in scenario-disposition.ts). Each test gets its own ledger row under
@@ -296,6 +298,20 @@ function registeredExplicitId(file: string, title: string): string | null {
   return _registry.get(`${file}\u0000${title}`) ?? null;
 }
 
+/** Every `it` under a suite or file task, with the state vitest settled on. */
+function _finishedTests(node: unknown): FinishedTest[] {
+  const out: FinishedTest[] = [];
+  const walk = (n: unknown): void => {
+    const t = n as { id?: string; name?: string; type?: string; tasks?: unknown[]; result?: { state?: string; errors?: Array<{ message?: string }> } };
+    if (t.type === 'test' && typeof t.id === 'string') {
+      const message = t.result?.errors?.[0]?.message;
+      out.push({ id: t.id, name: t.name ?? '', state: t.result?.state, ...(message === undefined ? {} : { message }) });
+    }
+    for (const c of t.tasks ?? []) walk(c);
+  };
+  walk(node);
+  return out;
+}
 function _fileOf(task: { file?: { filepath?: string; name?: string } } | undefined): string | null {
   const f = task?.file?.filepath ?? task?.file?.name;
   return typeof f === 'string' && f.length > 0 ? basename(f) : null;
@@ -414,6 +430,9 @@ afterEach(({ task }) => {
   if (file === null) return;
   if (!_ledgerMarks.has(file)) _ledgerMarks.set(file, 0);
   const state = task.result?.state;
+  const seen = _fileRecorded.get(file) ?? new Set<string>();
+  seen.add(task.id);
+  _fileRecorded.set(file, seen);
   const arr = _fileStates.get(file) ?? [];
   arr.push(state === 'pass' ? 'pass' : state === 'fail' ? 'fail' : 'skip');
   _fileStates.set(file, arr);
@@ -506,7 +525,10 @@ afterAll(({}, suite) => {
   const s = suite as unknown as { filepath?: string; name?: string; file?: { filepath?: string; name?: string } };
   const file = _fileOf({ file: s.file ?? s });
   if (file === null || !file.endsWith('.test.ts')) return;
-  const states = _fileStates.get(file) ?? [];
+  // A scenario hook that threw before the recorder ran hid its test; recover it from vitest's own results.
+  const hidden = unrecordedTests(_finishedTests(s.file ?? s), _fileRecorded.get(file) ?? new Set());
+  const states = [...(_fileStates.get(file) ?? []), ...hidden.states];
+  if (hidden.failures.length > 0) _fileFailures.set(file, [...(_fileFailures.get(file) ?? []), ...hidden.failures]);
   // Did a behaviorGate in this file record inapplicable/skipped for its profile?
   const mark = _ledgerMarks.get(file) ?? 0;
   const since = journalSince(mark);
@@ -550,6 +572,7 @@ afterAll(({}, suite) => {
   _fileStates.delete(file);
   _fileAssertions.delete(file);
   _fileFailures.delete(file);
+  _fileRecorded.delete(file);
   _ledgerMarks.delete(file);
   _itAllocators.delete(file);
   _itMarks.delete(file);