@openwop/openwop-conformance 2.44.1 → 2.44.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.44.2] — 2026-09-28 — RFC 0215's no-head-of-line leg does not convict a late fan-out, and says when it sampled each count
+
+- **The 2.44.2 cycle opens.** A patch: the requirement is unchanged, and one verdict branch that convicted without the contention it names becomes unjudged. `@openwop/spec-artifacts` moves in lockstep at the same exact pin.
+- **`0215.no-head-of-line` no longer fails a host whose `run.started` fan-out is late.** The last branch failed the row as "a bounded dispatcher below the floor" whenever fewer than 8 held attempts had arrived by the time the run was terminal. MyndHyve `00821-qec` hit it twice. In the first cut no held attempt had arrived and the healthy one was delivered. In the second, 2 held attempts had arrived at terminal and 7 later, and the healthy attempt started with 7 held open and none closed. §A forbids an attempt waiting for another subscription's attempt to *finish*. None had finished, so the healthy attempt waited for nothing, and the contention §A.2 names was never established. The row is now `blocked` (unjudged) in that case. A bounded pool still fails: its healthy attempt starts only after a held attempt closes, or never while they stay open. So does a serial dispatcher, through the peak assertion.
+- **The detail names each sampling time.** It read "2 held attempt(s) arrived (at most 7 open at once)", with the 2 sampled at terminal and the 7 at the verdict. It now reports what had arrived and was open at terminal, what had arrived by the verdict and the peak, when the healthy attempt arrived, and whether the host had closed any held attempt. It no longer names a cause the data does not show.
+- **The verdict is a pure function with self-tests** (`lib/delivery-isolation-verdict.ts`). The tests cover pass, the contention-present fail, a 7-slot pool with a 15 s timeout (fail), a serial dispatcher (peak assertion), and both MyndHyve cuts (unjudged). Sabotage-checked: removing the new branch fails the two MyndHyve cases.
+
 ## [2.44.1] — 2026-09-28 — the webhook retry legs outlast an advertised maxElapsedMs, and four families get v2 normative homes
 
 - **The 2.44.1 cycle opens.** `workspace`, `content`, `triggerBridge` and `uiPlugins` get v2 normative homes (RFC 0189), which changes the packed `@openwop/spec-artifacts` tree (`spec/v2/core/host-services.md`, `i18n.md`, `webhooks.md`, `packs.md`, `spec/v2/declaration.json`) after `v2.44.0` was tagged. No scenario changes: the rules are restated from the v1 text, none added or strengthened.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.44.1 @openwop/spec-artifacts@2.44.1
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.44.2 @openwop/spec-artifacts@2.44.2
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.44.1",
-  "stampSha256": "c9a9550d05910b204589704d1e2c83fac85656062d8374a94e5afedf00b011e3"
+  "version": "2.44.2",
+  "stampSha256": "66d1059ab9f4e5799bbb84c8b66e64033bc08f4daf6016c22c71164cca948c4c"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.44.1",
+  "version": "2.44.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.44.1"
+    "@openwop/spec-artifacts": "2.44.2"
   }
 }

package/requirements.json

@@ -34246,7 +34246,7 @@
     {
       "id": "openwop.requirement.0215.no-head-of-line",
       "file": "v2-webhook-delivery-isolation.test.ts",
-      "line": 113,
+      "line": 119,
       "title": null,
       "explicitId": "openwop.requirement.0215.no-head-of-line",
       "citations": [
@@ -34273,11 +34273,6 @@
           "requirement": null,
           "interpolated": true
         },
-        {
-          "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
-          "requirement": null,
-          "interpolated": true
-        },
         {
           "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
           "requirement": null,

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.44.1",
-  "corpusTag": "v2.44.1",
+  "version": "2.44.2",
+  "corpusTag": "v2.44.2",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "6f9780f7751804b6dd9f57cb5474728326de805fcca667979f6b4f39c9c97336",
-    "api/v2/asyncapi.yaml": "ec6520792f7c4661403053003de7669430178597b5e0250ba5264b65dc82dbef",
-    "api/v2/openapi.yaml": "46314e02c9aeb4cb7a4ca0cfd5997dc24bd11c3971341e505cd0b7bef3150cd8",
+    "api/seams-v2.yaml": "f24127f3cd544f1c5a942859ffc492b438d37b1b7d7a660c631fb87f70cd24f6",
+    "api/v2/asyncapi.yaml": "3283ff1bbe962dc75e6d66d2b755d4eb7d53770ce8511f2d671b923d6ca0e51a",
+    "api/v2/openapi.yaml": "4a455ba22c81718e2842adce60e5d3c5970e6f8a55b301d9154ccc8060f6cf91",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,7 +204,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "29f21e0fb2c7a232a92a5c19b4cba3a86bc3b5e16f06780452f0421c66c6ec38",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "b6efb5d51e1432088bfeff049f310ae0095f3852a59e877e9d628a30782f5580",
+    "spec/v1/core-standard-manifest.json": "3d7fd99cd02153094723c2bf383d757c282e653526aa3b199d9bdb4b9cfd7c80",
     "spec/v1/deprecations.json": "46df807fb4adf0aae24671c20f69975cf3496e3bc3a521cb7e6ea556bdce563c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -299,9 +299,9 @@
     "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "af448fd044ab5b990a21945905f109dbbb9b0df9ab7f1105e79aa7d1e0f35a33",
+    "spec/v2/release.json": "28b407019929da55701a718110d440f08899646af0b74d62f6adc5542c9c1c91",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "2f79e3283946dd8a401db039109d403b9c386e6b91a4780cbcb1440e8d3a6ffe"
+    "spec/v2/surface-baseline.json": "d0540276e74001f5058dd81909100ea6ee3c1925c6ac02918418f5ec941d0661"
   },
-  "corpusCommit": "bf414c875dba212893f0230d44f2b4a2e226311d"
+  "corpusCommit": "c486eafcfa16908a7b57c98b33cfd66fdf8e599d"
 }

package/src/lib/delivery-isolation-verdict.ts

@@ -0,0 +1,97 @@
+/**
+ * The verdict of RFC 0215's `no-head-of-line` leg, as a pure function of what
+ * the leg observed (suite 2.44.2), so the rule can be tested without a host.
+ *
+ * 2.44.2 fixes two defects that MyndHyve's 2.44.x cuts surfaced:
+ *
+ * 1. **A conviction without the contention it names.** The last branch failed
+ *    the row as "a bounded dispatcher below the floor" whenever fewer than
+ *    `floor` held attempts had arrived by the time the run was terminal. On a
+ *    host whose `run.started` fan-out arrived late, that convicted a healthy
+ *    attempt that started while every held attempt that HAD arrived was still
+ *    open and none had finished (MyndHyve `00821-qec`: 0 held attempts, then 2
+ *    at terminal and 7 later, the healthy attempt delivered with 7 open). §A
+ *    forbids an attempt waiting for another subscription's attempt to FINISH; no
+ *    attempt had finished, so there was nothing it could have waited for. The
+ *    contention was never established, so the row is unjudged, not failed. A
+ *    bounded pool still fails: its healthy attempt starts only after a held
+ *    attempt closes, or never while they stay open.
+ *
+ * 2. **A detail string that mixed two sampling times.** It read "2 held
+ *    attempt(s) arrived (at most 7 open at once)": the 2 was sampled at
+ *    terminal, the 7 at the verdict. The detail now names each time.
+ */
+
+export interface IsolationObservation {
+  /** §A.2's floor. */
+  readonly floor: number;
+  /** When the leg saw the run terminal (the healthy delivery is due by then). */
+  readonly terminalAt: number;
+  /** When the healthy attempt arrived, or null if it did not within the window. */
+  readonly healthyAt: number | null;
+  /** Held attempts open when the healthy attempt arrived (-1 if it did not). */
+  readonly openAtHealthy: number;
+  /** Held attempts that had arrived by `terminalAt`. */
+  readonly arrivedAtTerminal: number;
+  /** Held attempts still open at `terminalAt`. */
+  readonly openAtTerminal: number;
+  /** Held attempts that had arrived by the verdict. */
+  readonly arrivedByVerdict: number;
+  /** The most held attempts open at once, up to the verdict. */
+  readonly peakOpen: number;
+  /** When the first held attempt closed (the host abandoning it), or Infinity. */
+  readonly earliestClose: number;
+  readonly windowMs: number;
+  readonly delayMs: number;
+}
+
+export type IsolationVerdict =
+  /** The healthy attempt started while `floor` held attempts were open. */
+  | { readonly kind: 'pass'; readonly detail: string }
+  | { readonly kind: 'fail'; readonly message: string; readonly detail: string }
+  /** Unjudged, after asserting `peakOpen >= floor` (which fails a pool below the floor). */
+  | { readonly kind: 'blocked-after-peak'; readonly message: string; readonly detail: string }
+  | { readonly kind: 'blocked'; readonly message: string; readonly detail: string };
+
+/** What the leg saw, each count against the time it was sampled. */
+export function isolationDetail(o: IsolationObservation): string {
+  const at = (t: number): string => `${t - o.terminalAt}ms after the run was seen terminal`;
+  const healthy = o.healthyAt === null
+    ? `the healthy attempt did not arrive within ${o.windowMs}ms of that`
+    : `the healthy attempt arrived ${at(o.healthyAt)}, with ${o.openAtHealthy} held open`;
+  const closed = Number.isFinite(o.earliestClose) ? `the first held attempt was closed by the host ${at(o.earliestClose)}` : 'no held attempt was closed by the host';
+  return `at terminal, ${o.arrivedAtTerminal} held attempt(s) had arrived and ${o.openAtTerminal} were open; by the verdict, ${o.arrivedByVerdict} had arrived, at most ${o.peakOpen} open at once; ${healthy}; ${closed}`;
+}
+
+export function isolationVerdict(o: IsolationObservation): IsolationVerdict {
+  const detail = isolationDetail(o);
+  const F = o.floor;
+  if (o.healthyAt !== null && o.openAtHealthy >= F) return { kind: 'pass', detail };
+  if (o.openAtTerminal >= F) {
+    // The healthy attempt waited (or never came), and the contention §A.2
+    // names was present when it fell due.
+    return { kind: 'fail', message: `with ${F} subscriptions' attempts unanswered, a further subscription's attempt MUST still start; it waited for the host to release one`, detail };
+  }
+  if (o.arrivedAtTerminal >= F || o.earliestClose < o.terminalAt) {
+    // Contention was not sustained to the due time. Either the host's own
+    // delivery timeout released the held attempts early (its choice), or it
+    // never opened F of them at once. peakOpen separates the two: below F the
+    // host never had F attempts outstanding at once, which is the defect.
+    const released = Number.isFinite(o.earliestClose) ? `${o.terminalAt - o.earliestClose}ms ` : '';
+    return { kind: 'blocked-after-peak', message: `unjudged: ${F} held attempts were open at once, but the host closed held attempts ${released}before the run was terminal (its delivery timeout is shorter than this leg's ${o.delayMs}ms delay), so ${F} attempts were not outstanding when the healthy delivery fell due`, detail };
+  }
+  if (o.healthyAt !== null && !(o.earliestClose < o.healthyAt)) {
+    // Fewer than F held attempts had arrived when the healthy delivery fell
+    // due, and it started before any held attempt finished: it cannot have
+    // waited for one. The held fan-out was late, so the contention the floor
+    // names never existed when it mattered.
+    return { kind: 'blocked', message: `unjudged: only ${o.arrivedAtTerminal} of the ${F} held attempts had arrived when the healthy delivery fell due, and the healthy attempt started before any held attempt finished, so it did not wait for one; the held run.started deliveries arrived late, and the contention §A.2 names was not established`, detail };
+  }
+  return {
+    kind: 'fail',
+    message: o.healthyAt === null
+      ? `the host never had ${F} subscriptions' attempts outstanding at once, and the healthy attempt did not start within ${o.windowMs}ms while the held attempts stayed open`
+      : `the host never had ${F} subscriptions' attempts outstanding at once, and the healthy attempt started only after a held attempt finished`,
+    detail,
+  };
+}

package/src/scenarios/v2-webhook-delivery-isolation.test.ts

@@ -26,6 +26,11 @@
  *     host released one to make room), or never within the window, AND the held
  *     attempts had stayed open until the run was terminal: the contention the
  *     floor names existed when the healthy delivery fell due, and it waited.
+ *   - blocked (unjudged, suite 2.44.2) — fewer than 8 held attempts had arrived
+ *     when the healthy delivery fell due, and the healthy attempt started before
+ *     any held attempt finished: it waited for nothing, and the contention was
+ *     never established (a late `run.started` fan-out). The rule and its tests
+ *     are in `lib/delivery-isolation-verdict.ts`.
  *   - blocked (unjudged) — the host had all 8 held attempts open at once, but
  *     its own delivery timeout closed them before the run was terminal.
  *     Contention was not sustained when the healthy delivery fell due, so this
@@ -56,6 +61,7 @@ import { readErrorCode } from '../lib/error-envelope.js';
 import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { RETRY_WAIT_FLOOR_MS } from '../lib/webhook-retry-window.js';
+import { isolationVerdict } from '../lib/delivery-isolation-verdict.js';
 
 export const REQUIRES_HOST_CALLBACK = 'the host POSTs webhook deliveries to nine suite-owned subscriptions on the scoped receiver behind OPENWOP_WEBHOOK_RECEIVER_URL, eight of which the suite holds open';
 
@@ -179,44 +185,30 @@ describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s
     const terminalAt = await waitTerminal(runId, DELAY_MS + 30_000);
     if (terminalAt === null) return blockedDespiteAssertions(`${FIXTURE} run ${runId} did not reach a terminal status — the healthy delivery never fell due`);
     const openAtTerminal = openCount();
-    const everOpened = held.size;
+    const arrivedAtTerminal = held.size;
     await waitFor(() => healthyAt !== null, WINDOW_MS);
     const earliestClose = Math.min(...[...held.values()].map((h) => h.closedAt ?? Infinity));
-    const detail = `${everOpened} held attempt(s) arrived (at most ${peakOpen} open at once); ${openAtTerminal} were still open when the run was seen terminal; `
-      + (healthyAt === null ? `the healthy attempt did not arrive within ${WINDOW_MS}ms of that` : `the healthy attempt arrived ${healthyAt - terminalAt}ms after it, with ${openAtHealthy} held open`);
 
-    if (healthyAt === null && everOpened === 0) {
+    if (healthyAt === null && held.size === 0) {
       if (absenceIsUnmeasured(rx)) return blockedDespiteAssertions(noDeliveryCause(rx, 'webhook attempt'));
       return blockedDespiteAssertions(`no attempt for any of the ${FLOOR + 1} subscriptions arrived — ${noDeliveryCause(rx, 'webhook attempt')}`);
     }
-    if (healthyAt !== null && openAtHealthy >= FLOOR) {
-      expect(openAtHealthy, req(ID, DOC, `an attempt to one subscription MUST NOT wait for attempts to other subscriptions — ${detail}`)).toBeGreaterThanOrEqual(FLOOR);
-    } else if (openAtTerminal >= FLOOR) {
-      // The healthy attempt waited (or never came), and the contention §A.2
-      // names was present when it fell due.
-      expect.fail(req(ID, DOC, `with ${FLOOR} subscriptions' attempts unanswered, a further subscription's attempt MUST still start; it waited for the host to release one — ${detail}`));
-    } else if (everOpened >= FLOOR || earliestClose < terminalAt) {
-      // Contention was not sustained to the due time. Either the host's own
-      // delivery timeout released the held attempts early (its choice), or it
-      // never opened FLOOR of them at once. The second is the defect, the first
-      // is not, and they differ in WHEN the first held attempt closed.
-      //
-      // Unfailable-leg audit (2026-09-26): this branch asserted everOpened > 0
-      // and then `softSkip('skipped')`, which records `executed-pass` with a
-      // `partial-witness:` detail. A serial dispatcher (pool of 1) with a
-      // sub-2s delivery timeout landed here and passed — every held attempt
-      // arrived eventually (everOpened reached FLOOR), one at a time, while the
-      // healthy attempt queued behind them: head-of-line blocking. peakOpen
-      // separates the two cases the comment above names: below FLOOR the host
-      // never had FLOOR attempts outstanding at once, which is the defect; at
-      // FLOOR the host's timeout released them early, which is unjudged.
+    const v = isolationVerdict({
+      floor: FLOOR, terminalAt, healthyAt, openAtHealthy, arrivedAtTerminal, openAtTerminal,
+      arrivedByVerdict: held.size, peakOpen, earliestClose, windowMs: WINDOW_MS, delayMs: DELAY_MS,
+    });
+    if (v.kind === 'blocked') return blockedDespiteAssertions(`${v.message} — ${v.detail}`);
+    if (v.kind === 'blocked-after-peak') {
+      // Unfailable-leg audit (2026-09-26): a serial dispatcher (pool of 1)
+      // with a sub-2s delivery timeout lands here; below FLOOR at once it
+      // fails, at FLOOR the host's timeout released them early (unjudged).
       expect(
         peakOpen,
-        req(ID, DOC, `a host MUST sustain ${FLOOR} subscriptions' attempts outstanding at once — at most ${peakOpen} were ever open together, so the held attempts were dispatched below the floor — ${detail}`),
+        req(ID, DOC, `a host MUST sustain ${FLOOR} subscriptions' attempts outstanding at once — at most ${peakOpen} were ever open together, so the held attempts were dispatched below the floor — ${v.detail}`),
       ).toBeGreaterThanOrEqual(FLOOR);
-      return blockedDespiteAssertions(`unjudged: ${FLOOR} held attempts were open at once, but the host closed held attempts ${Number.isFinite(earliestClose) ? `${terminalAt - earliestClose}ms ` : ''}before the run was terminal (its delivery timeout is shorter than this leg's ${DELAY_MS}ms delay), so ${FLOOR} attempts were not outstanding when the healthy delivery fell due — ${detail}`);
-    } else {
-      expect.fail(req(ID, DOC, `the host never had ${FLOOR} subscriptions' attempts outstanding at once, and the healthy attempt waited — a bounded dispatcher below the floor — ${detail}`));
+      return blockedDespiteAssertions(`${v.message} — ${v.detail}`);
     }
+    if (v.kind === 'fail') expect.fail(req(ID, DOC, `${v.message} — ${v.detail}`));
+    expect(openAtHealthy, req(ID, DOC, `an attempt to one subscription MUST NOT wait for attempts to other subscriptions — ${v.detail}`)).toBeGreaterThanOrEqual(FLOOR);
   }, DELAY_MS + 30_000 + RETRY_WAIT_FLOOR_MS + 30_000);
 });