@openwop/openwop-conformance 2.45.10 → 2.45.11

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.11] — 2026-10-03 — the trigger bridge is witnessed at major 2
+
+- **New scenarios `v2-trigger-bridge-delivery` and `v2-trigger-dead-letter-read`** (major 2). They port the trigger delivery legs and RFC 0232's read rules to the v2 surface (`/trigger-subscriptions/…`, bound ids `~`-projected). They share their requirement ids with the v1 twins, as the v2 secrets witness does. Each runs only the normative-surface path: there is no trigger seam at major 2.
+  - Legs: `0083.trigger-delivery.dedup`, `.dead-letter`, `.causation` and `.runless-attempt-content-free`, through the signed ingest and `GET /trigger-subscriptions/{subscriptionId}/dead-letters`. `.runless-state-change-content-free` is `inapplicable`: no wire surface causes a state change and no seam drives one (RFC 0232 gap G2).
+  - Read rules: `0232.trigger-dead-letters.paging`, `.cursor-bound` and `.tenant-bound` (`OPENWOP_TEST_TENANT_B_API_KEY`, else `blocked`). At major 2, another tenant's bound id must be refused `403 id_tenant_mismatch` (`identity.md` §5), not `404`; the profile row says which refusal each major uses (`foreignTenantRead`). openwop-app caught this before release.
+  - **Dispositions:** `triggerBridge` absent, or `inboundSigning` not listing `standard-webhooks-1` ⇒ `inapplicable`, since major 2 has no other delivery surface. The read legs also need `triggerBridge.deadLetter`.
+- **Why.** openwop-app's seam-free production cut (build 062381a5, suite 2.45.10) passes every trigger leg at major 1, but that bundle carries 350 seam-precondition `blocked` rows and cannot certify. Its v2 bundle certifies with 0 blocked but had no trigger rows. With these scenarios, a host that advertises `triggerBridge` at major 2 witnesses RFC 0230 and RFC 0232 on a certifiable bundle.
+- **Shared witness.** `lib/trigger-delivery-witness.ts` takes a `MajorProfile`. The profile gains `triggerSubscriptionsPath` and `idSegment`. The major-1 files keep their own inline legs for now.
+- **Sabotage.** `lib/trigger-delivery-witness.test.ts` runs 16 cases against the scratch double in `lib/trigger-double.ts`, and each of twelve defects fails exactly the legs that own the rule. Both scenario files were also run against a standalone double. Conforming: 7 pass, the state-change row `inapplicable`. Seven defects (dedup, refused state, causation, canary leak, foreign cursor, tenant leak, a `404` where v2 requires `403`) each fail only their own leg. With no family, in strict mode, every row is `inapplicable` and none fails. Scenarios gate on `familyAdvertised`, not `gateFamily` (the 2.45.7 strict-mode defect).
+- **Host impact.** MyndHyve advertises `triggerBridge` at major 2 without `inboundSigning`, so every new row records `inapplicable`. openwop-app and the v2 reference host don't advertise the family at major 2. No host gains a `blocked` or failing row.
+
 ## [2.45.10] — 2026-10-03 — RFC 0232 Active: a seam-free path for the run-less trigger leg
 
 - **`trigger-bridge-delivery` leg 4 splits in two (RFC 0232, decided question 1 (a)).** Both ids stay in the `openwop-trigger-bridge` floor; the old title-derived id is aliased to the first.

package/README.md

@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 592 scenario files under `src/scenarios/`.
+The current suite has 594 scenario files under `src/scenarios/`.
 - 2026-09-29 (suite 2.45.0, openwop#1763): NEW `v2-cors-preflight.test.ts` — `headers.md` §Cross-origin preflight. For every operation it preflights with `Origin`, the method, and the operation's declared request headers (plus `authorization` / `content-type` where they apply, from `spec/v2/path-manifest.json`), and reads the answer as the Fetch standard's CORS-preflight check does. Self-gated: `inapplicable` when no operation's preflight grants `OPENWOP_CORS_ORIGIN` (default `https://conformance.invalid`).
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
@@ -482,7 +482,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 592 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 594 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.10",
-  "stampSha256": "cfba8c0d8fc447d57a70ace7ffcb054ba3ee9402be6268f1b40c99e0517791e8"
+  "version": "2.45.11",
+  "stampSha256": "8610a1da9880acfbffcdfc96f015e5a0f7bf7bcd882819a614af305b6cfdb35b"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.10",
+  "version": "2.45.11",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.10"
+    "@openwop/spec-artifacts": "2.45.11"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 667,
-    "tests": 2549,
-    "withStableId": 2549,
+    "files": 669,
+    "tests": 2557,
+    "withStableId": 2557,
     "interpolatedTitles": 0,
-    "explicitIds": 2426
+    "explicitIds": 2434
   },
   "records": [
     {
@@ -35267,6 +35267,117 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.de-dups-a-repeated-webhook-id-effectively-once",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 59,
+      "title": "de-dups a repeated webhook-id: effectively-once",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.dedup",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.a-refused-post-starts-no-run-and-leaves-the-subscription-active",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 69,
+      "title": "a refused post starts no run and leaves the subscription active",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.dead-letter",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.links-delivery-to-run-run-started-carries-the-delivery-as-causationid",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 79,
+      "title": "links delivery to run: run.started carries the delivery as causationId",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.causation",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.keeps-a-dead-lettered-run-less-attempt-content-free",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 89,
+      "title": "keeps a dead-lettered run-less attempt content-free",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.runless-attempt-content-free",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.keeps-a-run-less-subscription-state-change-content-free",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 99,
+      "title": "keeps a run-less subscription state change content-free",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.runless-state-change-content-free",
+      "citations": [
+        {
+          "section": "webhooks.md §Inbound triggers",
+          "requirement": "unreachable: no major-2 surface causes a state change"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-dead-letter-read.clamps-limit-and-continues-a-short-page-with-nextcursor",
+      "file": "v2-trigger-dead-letter-read.test.ts",
+      "line": 52,
+      "title": "clamps limit and continues a short page with nextCursor",
+      "explicitId": "openwop.requirement.0232.trigger-dead-letters.paging",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-dead-letter-read.refuses-a-cursor-minted-for-another-subscription",
+      "file": "v2-trigger-dead-letter-read.test.ts",
+      "line": 61,
+      "title": "refuses a cursor minted for another subscription",
+      "explicitId": "openwop.requirement.0232.trigger-dead-letters.cursor-bound",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-dead-letter-read.refuses-another-tenant-s-bound-id-403-id-tenant-mismatch-and-discloses-nothing",
+      "file": "v2-trigger-dead-letter-read.test.ts",
+      "line": 70,
+      "title": "refuses another tenant's bound id 403 id_tenant_mismatch and discloses nothing",
+      "explicitId": "openwop.requirement.0232.trigger-dead-letters.tenant-bound",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-unadvertised-operation-not-found.get-prompts-answers-404-not-found-when-prompts-endpointssupported-is-not-adverti",
       "file": "v2-unadvertised-operation-not-found.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 592,
+    "files": 594,
     "v1": 455,
-    "v2": 152
+    "v2": 154
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1635,6 +1635,12 @@
     "v2-tool-catalog-annotations.test.ts": [
       2
     ],
+    "v2-trigger-bridge-delivery.test.ts": [
+      2
+    ],
+    "v2-trigger-dead-letter-read.test.ts": [
+      2
+    ],
     "v2-unadvertised-operation-not-found.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.10",
-  "corpusTag": "v2.45.10",
+  "version": "2.45.11",
+  "corpusTag": "v2.45.11",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "448d60e189059fe6bd4953b8c47f6941f89053707f45621d4e32b8bef0773670",
-    "api/v2/asyncapi.yaml": "8db5aa748cd4f6481055d48d0a6d66d596f20e712d2004aa86de79b4c34e9bd9",
-    "api/v2/openapi.yaml": "e3b1ed5954b8e9acd6c68cd2a924603afcebb686d07fb5a26e929b01b7f6599b",
+    "api/seams-v2.yaml": "4d81cca7f95187c62e05ffe9ad738134c5253334f794da200182b0d6f82123a5",
+    "api/v2/asyncapi.yaml": "6cc853cc6fd98213b9d3db9fa23f56ae40d974c8730a9a5288cf7187eb402d94",
+    "api/v2/openapi.yaml": "7bf3b02498d378ae3fc242c79422e8843820b4a519ba8119aa7d7fcaaaf6dcbf",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "bd1c00fae7b6fda506a75aff841bbdc438d4ce092642a72041203bee999b88de",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -206,7 +206,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "819828fb2f978fa9e4a994652bbe16c797d36a8c4393d57d1432c8a53f2120ab",
+    "spec/v1/core-standard-manifest.json": "9cf3fe4d67b3e110f4666fe8d4c3a22e715a7b4ef88afb99470031303e364b8b",
     "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -246,7 +246,7 @@
     "spec/v2/core/security-defaults.md": "887d8c4bc592094e3b931c23f1c2175c18ebbd47528b074016f9d2091bc513b2",
     "spec/v2/core/storage.md": "dc94b985847c1341c7a064f04a6010f0fdbe6c3ab3e555d4362878c81d764c18",
     "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
-    "spec/v2/core/versioning.md": "b7acb0d8b77425cb53ea700e47ba790bf7506de600c398690e6ec5bb9c7a220e",
+    "spec/v2/core/versioning.md": "fe48f4514b9c9f998d5da1930b8faa02ca4de89dcd49b07d95414fb04c67d438",
     "spec/v2/core/webhooks.md": "daf6ec03092f4b3fde1eb74a5e2e801ec48db5139a13fcc0fd7fb4a004635ae3",
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "3a8d93e33865b692d26a3b6bfd3819766e206b2e0c2a69669baa4bf833d05a49",
@@ -305,9 +305,9 @@
     "spec/v2/path-manifest.json": "36363105280139dad095dc4f64b5b272121e9759cdcf6de011358dd1c1a90540",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "044530e75b4cdec6747c1bcebe799ebc62f1f6c2a1e722369b35b2854e54049f",
+    "spec/v2/release.json": "1bb3db70c49debd541741939c8dcfdf31c0076a54c5fb23e7c6564f89b10505c",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "99ddcf9eb0d06967879ce7f6e54c49fe19bfabc9ee50f00f78699b401108bfd5"
+    "spec/v2/surface-baseline.json": "30b8f92461b67517b7a20c7125ce0c6ef1af834e24c09a70be43cda6a25ccd99"
   },
-  "corpusCommit": "8817d7c027047bbf1aa8d9385122137396f1bdca"
+  "corpusCommit": "bc768ee37bcf463c49186a7fec7a5c5ad06f2fff"
 }

package/src/lib/major-profile.ts

@@ -20,6 +20,7 @@
 
 import { capabilityFamily } from './discovery-capabilities.js';
 import { codemapV1toV2 } from './era2-seed.js';
+import { projectBoundId } from './bound-id.js';
 
 export interface MajorProfile {
   readonly major: number;
@@ -49,6 +50,16 @@ export interface MajorProfile {
    * unread observation and never guesses a name.
    */
   eventType(era1Name: string): string | undefined;
+  /** The trigger subscription collection, e.g. `/v1/trigger-subscriptions` or `/trigger-subscriptions`. */
+  readonly triggerSubscriptionsPath: string;
+  /** An id as one URL path segment: percent-encoded at v1, the `~` bound-id projection at v2 (`identity.md` §5). */
+  idSegment(id: string): string;
+  /**
+   * How a read of another tenant's id is refused. `not_found`: as an id never
+   * minted (v1, bare ids). `id_tenant_mismatch`: `403`, because a v2 bound id
+   * names its tenant and `identity.md` §5 requires the refusal to say so.
+   */
+  readonly foreignTenantRead: 'not_found' | 'id_tenant_mismatch';
 }
 
 const isRecord = (v: unknown): v is Record<string, unknown> => v !== null && typeof v === 'object' && !Array.isArray(v);
@@ -68,6 +79,9 @@ export const MAJOR_PROFILES: Readonly<Record<number, MajorProfile>> = {
     // v1 budgets are driven through a host seam, not `createRun`.
     runBudget: () => null,
     eventType: (era1Name) => era1Name,
+    triggerSubscriptionsPath: '/v1/trigger-subscriptions',
+    idSegment: (id) => encodeURIComponent(id),
+    foreignTenantRead: 'not_found',
   },
   2: {
     major: 2,
@@ -82,6 +96,9 @@ export const MAJOR_PROFILES: Readonly<Record<number, MajorProfile>> = {
     },
     runBudget: (policy) => ({ configurable: { version: 1, budget: { ...policy } } }),
     eventType: (era1Name) => codemapV1toV2().get(era1Name),
+    triggerSubscriptionsPath: '/trigger-subscriptions',
+    idSegment: (id) => projectBoundId(id),
+    foreignTenantRead: 'id_tenant_mismatch',
   },
 };
 

package/src/lib/trigger-delivery-witness.ts

@@ -0,0 +1,277 @@
+/**
+ * The trigger-bridge delivery witness on the normative surface (RFC 0230's
+ * signed ingest, RFC 0232's dead-letter read), shared by every major that
+ * serves it. What differs between majors — the subscription path, how an id
+ * becomes a path segment, event names, the page schema — is the profile row
+ * in `major-profile.ts`.
+ *
+ * Each leg OBSERVES and returns findings; it asserts nothing. The scenario file
+ * maps findings to requirement ids, and `trigger-delivery-witness.test.ts`
+ * proves every leg against a scratch double with one defect turned on.
+ *
+ * There is no seam path here. At major 2 no seam drives a trigger delivery, so
+ * a leg whose only surface is a seam is `inapplicable` (no party can cause the
+ * condition), never `blocked`.
+ *
+ * Today only `v2-trigger-bridge-delivery` and `v2-trigger-dead-letter-read` use
+ * it; the major-1 files keep their own inline legs, which the production hosts
+ * have already witnessed.
+ */
+
+import { driver } from './driver.js';
+import { readErrorCode } from './error-envelope.js';
+import type { MajorProfile } from './major-profile.js';
+import { freshWebhookId, standardWebhooksSignature } from './triggerBridge.js';
+import { freshCanary, judge as judgeDeadLetters, type DeadLetterRead } from './trigger-dead-letter-witness.js';
+
+export interface TriggerFinding {
+  readonly ok: boolean;
+  readonly doc: string;
+  readonly message: string;
+}
+export type LegOutcome =
+  | { readonly kind: 'skip'; readonly disposition: 'inapplicable' | 'blocked'; readonly reason: string }
+  | { readonly kind: 'observed'; readonly findings: readonly TriggerFinding[]; readonly note?: string };
+
+const isRecord = (v: unknown): v is Record<string, unknown> => v !== null && typeof v === 'object' && !Array.isArray(v);
+const f = (ok: boolean, doc: string, message: string): TriggerFinding => ({ ok, doc, message });
+
+/** What the host advertises for the trigger bridge at this major. */
+export interface TriggerAdverts {
+  readonly family: Record<string, unknown> | null;
+  readonly inboundSigning: boolean;
+  readonly deadLetter: { readonly retentionDays: number; readonly maxPageSize: number } | null;
+}
+
+export function adverts(profile: MajorProfile, doc: unknown): TriggerAdverts {
+  const family = profile.family(doc, 'triggerBridge');
+  const ingestion = isRecord(family?.['ingestion']) ? family!['ingestion'] as Record<string, unknown> : undefined;
+  const signing = ingestion?.['inboundSigning'];
+  const dl = isRecord(family?.['deadLetter']) ? family!['deadLetter'] as Record<string, unknown> : undefined;
+  return {
+    family,
+    inboundSigning: Array.isArray(signing) && signing.includes('standard-webhooks-1'),
+    deadLetter: dl !== undefined && typeof dl['retentionDays'] === 'number' && typeof dl['maxPageSize'] === 'number'
+      ? { retentionDays: dl['retentionDays'] as number, maxPageSize: dl['maxPageSize'] as number }
+      : null,
+  };
+}
+
+/** The gate every signed-path leg shares. */
+export function signedGate(a: TriggerAdverts): LegOutcome | null {
+  if (a.family === null) return { kind: 'skip', disposition: 'inapplicable', reason: 'the host does not advertise triggerBridge' };
+  if (!a.inboundSigning) return { kind: 'skip', disposition: 'inapplicable', reason: 'triggerBridge.ingestion.inboundSigning does not list standard-webhooks-1, and no other wire surface delivers a trigger event at this major' };
+  return null;
+}
+
+export interface Sub { readonly subscriptionId: string; readonly ingestUrl: string; readonly signingSecret: string }
+
+async function register(profile: MajorProfile, mode: 'none' | 'required'): Promise<Sub | string> {
+  const res = await driver.post(profile.triggerSubscriptionsPath, { source: 'webhook', workflowId: 'conformance-noop', verification: { mode } });
+  const body = res.json as { subscription?: { subscriptionId?: unknown }; binding?: { ingestUrl?: unknown; signingSecret?: unknown } } | undefined;
+  const subscriptionId = body?.subscription?.subscriptionId;
+  const ingestUrl = body?.binding?.ingestUrl;
+  const signingSecret = body?.binding?.signingSecret;
+  if (res.status !== 201 || typeof subscriptionId !== 'string' || typeof ingestUrl !== 'string' || typeof signingSecret !== 'string') {
+    return `POST ${profile.triggerSubscriptionsPath} answered ${res.status} without the binding (subscriptionId, ingestUrl, signingSecret)`;
+  }
+  return { subscriptionId, ingestUrl, signingSecret };
+}
+
+async function ingest(sub: Sub, body: string, opts: { webhookId?: string; signature?: string } = {}): Promise<{ status: number; json: Record<string, unknown> | undefined }> {
+  const id = opts.webhookId ?? freshWebhookId();
+  const ts = String(Math.floor(Date.now() / 1000));
+  const sig = opts.signature ?? standardWebhooksSignature(sub.signingSecret, id, ts, body);
+  const res = await driver.post(sub.ingestUrl, body, {
+    authenticated: false,
+    headers: { 'Content-Type': 'application/json', 'webhook-id': id, 'webhook-timestamp': ts, 'webhook-signature': sig },
+  });
+  return { status: res.status, json: isRecord(res.json) ? res.json : undefined };
+}
+
+export const BAD_SIGNATURE = 'v1,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
+const DOC_INGEST = 'webhooks.md §Inbound triggers';
+
+/** A registration that did not yield the binding is a host defect on an advertised surface. */
+function bindingFinding(reason: string): LegOutcome {
+  return { kind: 'observed', findings: [f(false, DOC_INGEST, `a host advertising inboundSigning MUST return the binding on webhook registration: ${reason}`)] };
+}
+
+/** Leg 1: a repeated `webhook-id` is effectively-once. */
+export async function dedupLeg(profile: MajorProfile, a: TriggerAdverts): Promise<LegOutcome> {
+  const gate = signedGate(a); if (gate) return gate;
+  const sub = await register(profile, 'none'); if (typeof sub === 'string') return bindingFinding(sub);
+  const body = JSON.stringify({ conformance: 'dedup' });
+  const webhookId = freshWebhookId();
+  const first = await ingest(sub, body, { webhookId });
+  const runId = first.json?.['runId'];
+  const again = await ingest(sub, body, { webhookId });
+  return { kind: 'observed', findings: [
+    f(first.status === 202, DOC_INGEST, `a signed delivery MUST answer 202 (got ${first.status})`),
+    f(typeof runId === 'string' && runId.length > 0, DOC_INGEST, 'a 202 MUST carry the started runId'),
+    f(again.status === 200, DOC_INGEST, `a repeated webhook-id MUST answer 200, starting no new run (got ${again.status})`),
+    f(again.json?.['outcome'] === 'duplicate', DOC_INGEST, `the dedup no-op MUST say outcome "duplicate" (got ${String(again.json?.['outcome'])})`),
+    f(again.json?.['runId'] === runId, DOC_INGEST, 'a dedup no-op MUST return the prior runId'),
+  ] };
+}
+
+/** Leg 2: a refused post starts no run and does not change the subscription's state. */
+export async function refusedLeg(profile: MajorProfile, a: TriggerAdverts): Promise<LegOutcome> {
+  const gate = signedGate(a); if (gate) return gate;
+  const sub = await register(profile, 'required'); if (typeof sub === 'string') return bindingFinding(sub);
+  const body = JSON.stringify({ conformance: 'dead-letter' });
+  const bad = await ingest(sub, body, { signature: BAD_SIGNATURE });
+  const read = await driver.get(`${profile.triggerSubscriptionsPath}/${profile.idSegment(sub.subscriptionId)}`);
+  const state = (read.json as { subscription?: { state?: unknown } } | undefined)?.subscription?.state;
+  const ok = await ingest(sub, body);
+  return { kind: 'observed', findings: [
+    f(bad.status === 401, DOC_INGEST, `a bad signature under required verification MUST answer 401 (got ${bad.status})`),
+    f(readErrorCode(bad.json) === 'signature_invalid', DOC_INGEST, `the refusal MUST carry signature_invalid (got ${String(readErrorCode(bad.json))})`),
+    f(bad.json?.['runId'] === undefined, DOC_INGEST, 'a failed required check MUST NOT start a run'),
+    f(state === 'active', DOC_INGEST, `a refused event MUST NOT change the subscription's state (read answered ${read.status}, state ${String(state)})`),
+    f(ok.status === 202, DOC_INGEST, `after a refused post the subscription MUST still deliver a correctly signed one (got ${ok.status})`),
+  ] };
+}
+
+const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
+
+/** Leg 3: the delivered run's `run.started` carries the delivery as `causationId`. */
+export async function causationLeg(profile: MajorProfile, a: TriggerAdverts, opts: { pollMs?: number; pollTries?: number } = {}): Promise<LegOutcome> {
+  const gate = signedGate(a); if (gate) return gate;
+  const sub = await register(profile, 'none'); if (typeof sub === 'string') return bindingFinding(sub);
+  const res = await ingest(sub, JSON.stringify({ conformance: 'causation' }));
+  const runId = res.json?.['runId'];
+  if (res.status !== 202 || typeof runId !== 'string' || runId.length === 0) {
+    return { kind: 'observed', findings: [f(false, DOC_INGEST, `a signed delivery MUST answer 202 with the started runId (got ${res.status} ${JSON.stringify(res.json ?? null).slice(0, 200)})`)] };
+  }
+  const startedType = profile.eventType('run.started');
+  const attemptType = profile.eventType('trigger.delivery.attempted');
+  if (startedType === undefined || attemptType === undefined) return { kind: 'skip', disposition: 'blocked', reason: 'the event codemap is not on disk in this layout, so this major\'s event names are unknown' };
+  let events: Array<Record<string, unknown>> = [];
+  let pollStatus = 0;
+  for (let i = 0; i < (opts.pollTries ?? 10); i++) {
+    const poll = await driver.get(`${profile.runsPath}/${profile.idSegment(runId)}/events/poll`);
+    pollStatus = poll.status;
+    events = ((poll.json as { events?: unknown } | undefined)?.events as Array<Record<string, unknown>> | undefined) ?? [];
+    if (events.some((e) => e['type'] === startedType)) break;
+    await sleep(opts.pollMs ?? 500);
+  }
+  const started = events.find((e) => e['type'] === startedType);
+  const causationId = started?.['causationId'];
+  const delivered = events.find((e) => e['type'] === attemptType && isRecord(e['payload']) && (e['payload'] as Record<string, unknown>)['outcome'] === 'delivered');
+  const findings = [
+    f(started !== undefined, 'webhooks.md §Inbound triggers', `a delivered run MUST emit ${startedType} (poll answered ${pollStatus}; saw ${events.map((e) => String(e['type'])).join(',') || 'none'})`),
+    f(typeof causationId === 'string' && causationId.length > 0, 'webhooks.md §Inbound triggers', `${startedType} MUST carry the delivery id as causationId`),
+  ];
+  if (delivered !== undefined) findings.push(f(causationId === delivered['eventId'], 'webhooks.md §Inbound triggers', `${startedType}.causationId MUST equal the delivered attempt's eventId`));
+  return { kind: 'observed', findings, note: delivered === undefined ? 'the delivered attempt event is not on the run log, so equality was not checked' : 'causationId equals the delivered attempt' };
+}
+
+/** GET one page of a subscription's dead letters at this major. Asserts nothing. */
+export async function readDeadLettersAt(profile: MajorProfile, subscriptionId: string, query: { limit?: number; cursor?: string } = {}, headers?: Record<string, string>): Promise<DeadLetterRead> {
+  const qs = new URLSearchParams();
+  if (query.limit !== undefined) qs.set('limit', String(query.limit));
+  if (query.cursor !== undefined) qs.set('cursor', query.cursor);
+  const suffix = qs.toString() === '' ? '' : `?${qs.toString()}`;
+  const res = await driver.get(`${profile.triggerSubscriptionsPath}/${profile.idSegment(subscriptionId)}/dead-letters${suffix}`, headers ? { headers } : {});
+  return { status: res.status, json: res.json };
+}
+
+/** Leg 4a: a dead-lettered (run-less) attempt is content-free, read through RFC 0232's read. */
+export async function runlessAttemptLeg(profile: MajorProfile, a: TriggerAdverts, validate: (page: unknown) => { ok: boolean; errors: string }): Promise<LegOutcome> {
+  const gate = signedGate(a); if (gate) return gate;
+  if (a.deadLetter === null) return { kind: 'skip', disposition: 'inapplicable', reason: 'a dead-lettered attempt is on no run\'s log, and the host does not advertise triggerBridge.deadLetter, the only surface that reads it at this major' };
+  const sub = await register(profile, 'required'); if (typeof sub === 'string') return bindingFinding(sub);
+  const canary = freshCanary();
+  const bad = await ingest(sub, JSON.stringify({ conformance: 'runless-attempt', canary }), { signature: BAD_SIGNATURE });
+  const read = await readDeadLettersAt(profile, sub.subscriptionId);
+  const findings = [f(bad.status === 401, DOC_INGEST, `a bad signature under required verification MUST answer 401 (got ${bad.status})`)];
+  for (const j of judgeDeadLetters(read, { subscriptionId: sub.subscriptionId, canary, signature: BAD_SIGNATURE, signingSecret: sub.signingSecret, retentionDays: a.deadLetter.retentionDays }, validate)) {
+    findings.push(f(j.ok, DOC_INGEST, j.message));
+  }
+  return { kind: 'observed', findings, note: 'RFC 0232 dead-letter read' };
+}
+
+/** Leg 4b: a run-less state change. No surface causes one without a seam, and no seam exists at this major. */
+export function runlessStateChangeLeg(a: TriggerAdverts): LegOutcome {
+  if (a.family === null) return { kind: 'skip', disposition: 'inapplicable', reason: 'the host does not advertise triggerBridge' };
+  return { kind: 'skip', disposition: 'inapplicable', reason: 'no wire surface causes a trigger subscription state change, and no seam drives one at this major (RFC 0232 §E, gap G2)' };
+}
+
+// ---------------------------------------------------------------------------
+// The read's own rules (RFC 0232 §B).
+// ---------------------------------------------------------------------------
+
+function readGate(a: TriggerAdverts): LegOutcome | null {
+  if (a.family === null) return { kind: 'skip', disposition: 'inapplicable', reason: 'the host does not advertise triggerBridge' };
+  if (a.deadLetter === null) return { kind: 'skip', disposition: 'inapplicable', reason: 'the host does not advertise triggerBridge.deadLetter' };
+  if (!a.inboundSigning) return { kind: 'skip', disposition: 'inapplicable', reason: 'triggerBridge.deadLetter is advertised without inboundSigning, so the suite cannot cause a dead letter unaided' };
+  return null;
+}
+
+async function refusedTwice(profile: MajorProfile, n: number): Promise<Sub | string> {
+  const sub = await register(profile, 'required'); if (typeof sub === 'string') return sub;
+  for (let i = 0; i < n; i++) await ingest(sub, JSON.stringify({ conformance: 'dead-letter-read', i }), { signature: BAD_SIGNATURE });
+  return sub;
+}
+const deliveriesOf = (json: unknown): unknown[] => { const d = (json as { deliveries?: unknown } | undefined)?.deliveries; return Array.isArray(d) ? d : []; };
+const cursorOf = (json: unknown): unknown => (json as { nextCursor?: unknown } | undefined)?.nextCursor;
+
+export async function pagingLeg(profile: MajorProfile, a: TriggerAdverts): Promise<LegOutcome> {
+  const gate = readGate(a); if (gate) return gate;
+  const sub = await refusedTwice(profile, 2); if (typeof sub === 'string') return bindingFinding(sub);
+  const first = await readDeadLettersAt(profile, sub.subscriptionId, { limit: 1 });
+  const cursor = cursorOf(first.json);
+  const second = typeof cursor === 'string' ? await readDeadLettersAt(profile, sub.subscriptionId, { limit: 1, cursor }) : undefined;
+  const big = await readDeadLettersAt(profile, sub.subscriptionId, { limit: a.deadLetter!.maxPageSize + 1 });
+  return { kind: 'observed', findings: [
+    f(first.status === 200, DOC_INGEST, `a host advertising triggerBridge.deadLetter MUST serve the read (got ${first.status})`),
+    f(deliveriesOf(first.json).length === 1, DOC_INGEST, `a page MUST NOT exceed limit (got ${deliveriesOf(first.json).length} for limit 1)`),
+    f(typeof cursor === 'string' && cursor.length > 0, DOC_INGEST, 'with two dead letters and limit 1, the page MUST carry nextCursor'),
+    f(second?.status === 200 && deliveriesOf(second.json).length === 1, DOC_INGEST, `the page's own cursor MUST continue to the second dead letter (got ${String(second?.status)})`),
+    f(big.status === 200, DOC_INGEST, `a limit above maxPageSize MUST be clamped, not refused (got ${big.status})`),
+  ] };
+}
+
+export async function cursorLeg(profile: MajorProfile, a: TriggerAdverts): Promise<LegOutcome> {
+  const gate = readGate(a); if (gate) return gate;
+  const subA = await refusedTwice(profile, 2); if (typeof subA === 'string') return bindingFinding(subA);
+  const page = await readDeadLettersAt(profile, subA.subscriptionId, { limit: 1 });
+  const cursor = cursorOf(page.json);
+  if (typeof cursor !== 'string' || cursor.length === 0) {
+    return { kind: 'observed', findings: [f(false, DOC_INGEST, `with two dead letters and limit 1, the page MUST carry nextCursor (read answered ${page.status})`)] };
+  }
+  const subB = await refusedTwice(profile, 1); if (typeof subB === 'string') return bindingFinding(subB);
+  const cross = await readDeadLettersAt(profile, subB.subscriptionId, { cursor });
+  return { kind: 'observed', findings: [
+    f(cross.status === 400, DOC_INGEST, `a cursor minted for another subscription MUST be refused 400 (got ${cross.status})`),
+    f(readErrorCode(cross.json) === 'validation_error', DOC_INGEST, `the refusal MUST carry validation_error (got ${String(readErrorCode(cross.json))})`),
+  ] };
+}
+
+export async function tenantLeg(profile: MajorProfile, a: TriggerAdverts, otherTenantKey: string | undefined, ownKey: string): Promise<LegOutcome> {
+  const gate = readGate(a); if (gate) return gate;
+  if (!otherTenantKey) return { kind: 'skip', disposition: 'blocked', reason: 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set — the cross-tenant read cannot run' };
+  if (otherTenantKey.trim() === ownKey) return { kind: 'skip', disposition: 'blocked', reason: 'OPENWOP_TEST_TENANT_B_API_KEY equals OPENWOP_API_KEY — the second credential must resolve to a DIFFERENT tenant, or the leg measures nothing' };
+  const sub = await refusedTwice(profile, 1); if (typeof sub === 'string') return bindingFinding(sub);
+  const foreign = await readDeadLettersAt(profile, sub.subscriptionId, {}, { Authorization: `Bearer ${otherTenantKey}` });
+  const unknown = await readDeadLettersAt(profile, `${sub.subscriptionId}-never-minted`);
+  const noDisclosure = f(!JSON.stringify(foreign.json ?? null).includes('verification_failed'), DOC_INGEST, 'a foreign read MUST NOT disclose a record');
+  const unknownFinding = f(unknown.status === 404, DOC_INGEST, `an id the host never minted MUST answer 404 (got ${unknown.status})`);
+  if (profile.foreignTenantRead === 'id_tenant_mismatch') {
+    // identity.md §5: a bound id whose tenant segment is not the caller's is
+    // refused 403 id_tenant_mismatch, before any lookup, so it discloses nothing.
+    return { kind: 'observed', findings: [
+      f(foreign.status === 403, 'identity.md §5', `another tenant's bound id MUST be refused 403 (got ${foreign.status})`),
+      f(readErrorCode(foreign.json) === 'id_tenant_mismatch', 'identity.md §5', `the refusal MUST carry id_tenant_mismatch (got ${String(readErrorCode(foreign.json))})`),
+      noDisclosure,
+      unknownFinding,
+    ] };
+  }
+  return { kind: 'observed', findings: [
+    f(foreign.status === 404, DOC_INGEST, `another tenant's read MUST answer 404 (got ${foreign.status})`),
+    noDisclosure,
+    unknownFinding,
+    f(readErrorCode(foreign.json) === readErrorCode(unknown.json), DOC_INGEST, 'a foreign id MUST be answered exactly as an unknown one'),
+  ] };
+}

package/src/lib/trigger-double.ts

@@ -0,0 +1,131 @@
+/**
+ * A scratch double for the trigger bridge's normative surface at major 2: the
+ * signed ingest (RFC 0230) and the dead-letter read (RFC 0232). Each self-test
+ * turns on ONE defect to show `trigger-delivery-witness.ts` convicts it, and a
+ * standalone instance lets the scenario files themselves be run against it.
+ *
+ * A test double, not a host: it executes nothing, and nothing it does is
+ * evidence about any implementation.
+ */
+
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { unprojectBoundId } from './bound-id.js';
+import { standardWebhooksSignature } from './triggerBridge.js';
+
+/** The credential the double treats as a second tenant. */
+export const OTHER_TENANT_KEY = 'tenant-b-key';
+
+export type TriggerDefect =
+  | 'none' | 'dedup-new-run' | 'refused-starts-run' | 'refused-changes-state' | 'no-causation'
+  | 'record-leaks-canary' | 'refused-not-recorded' | 'refused-records-state-change' | 'wrong-retention'
+  | 'limit-ignored' | 'cursor-not-bound' | 'tenant-leak' | 'tenant-404';
+
+interface DoubleSub { id: string; n: number; mode: string; secret: string; state: string; seen: Map<string, string>; dead: Array<Record<string, unknown>> }
+
+export class TriggerDouble {
+  defect: TriggerDefect = 'none';
+  url = '';
+  private server: Server | undefined;
+  private subs = new Map<string, DoubleSub>();
+  private runs = new Map<string, Array<Record<string, unknown>>>();
+  private seq = 0;
+  discovery: Record<string, unknown> = { triggerBridge: { status: 'experimental', since: '2.45', witness: 'self', ingestion: { inboundSigning: ['standard-webhooks-1'] }, deadLetter: { retentionDays: 7, maxPageSize: 100 } } };
+
+  async start(): Promise<string> {
+    this.server = createServer((req, res) => { void this.handle(req, res); });
+    await new Promise<void>((r) => this.server!.listen(0, '127.0.0.1', r));
+    this.url = `http://127.0.0.1:${(this.server.address() as AddressInfo).port}`;
+    return this.url;
+  }
+  async stop(): Promise<void> { const s = this.server; if (s) { s.closeAllConnections(); await new Promise<void>((r) => s.close(() => r())); } }
+  reset(defect: TriggerDefect): void { this.defect = defect; this.subs.clear(); this.runs.clear(); }
+
+  private id(prefix: string): string { return `acme/${prefix}-${String(++this.seq).padStart(16, '0')}`; }
+  private send(res: ServerResponse, status: number, body: unknown): void { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); }
+  private async raw(req: IncomingMessage): Promise<string> { const c: Buffer[] = []; for await (const x of req) c.push(x as Buffer); return Buffer.concat(c).toString('utf8'); }
+
+  private startRun(sub: DoubleSub): string {
+    const runId = this.id('run');
+    const attemptId = `evt${String(++this.seq).padStart(16, '0')}`;
+    this.runs.set(runId, [
+      { eventId: attemptId, type: 'trigger.delivery-attempted', payload: { subscriptionId: sub.id, dedupKey: 'opaque', attempt: 1, outcome: 'delivered', runId }, sequence: 1 },
+      { eventId: `evt${String(++this.seq).padStart(16, '0')}`, type: 'run.started', ...(this.defect === 'no-causation' ? {} : { causationId: attemptId }), payload: {}, sequence: 2 },
+    ]);
+    return runId;
+  }
+
+  private async handle(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    const u = new URL(req.url ?? '/', 'http://x');
+    const path = u.pathname;
+    if (req.method === 'GET' && path === '/.well-known/openwop') return this.send(res, 200, this.discovery);
+
+    if (req.method === 'POST' && path === '/trigger-subscriptions') {
+      const body = JSON.parse(await this.raw(req) || '{}') as { verification?: { mode?: string } };
+      const n = this.subs.size + 1;
+      const sub: DoubleSub = { id: this.id('sub'), n, mode: body.verification?.mode ?? 'none', secret: `whsec_${Buffer.from(`secret-${n}-bytes`).toString('base64')}`, state: 'active', seen: new Map(), dead: [] };
+      this.subs.set(sub.id, sub);
+      return this.send(res, 201, { subscription: { subscriptionId: sub.id, source: 'webhook', state: 'active' }, binding: { ingestUrl: `${this.url}/ingest/${n}`, signingSecret: sub.secret } });
+    }
+
+    const ing = /^\/ingest\/(\d+)$/.exec(path);
+    if (req.method === 'POST' && ing) {
+      const sub = [...this.subs.values()].find((s) => s.n === Number(ing[1]));
+      if (!sub) return this.send(res, 404, { error: 'not_found', message: 'no ingest' });
+      const body = await this.raw(req);
+      const id = String(req.headers['webhook-id'] ?? ''); const ts = String(req.headers['webhook-timestamp'] ?? '');
+      const good = req.headers['webhook-signature'] === standardWebhooksSignature(sub.secret, id, ts, body);
+      if (!good && sub.mode === 'required') {
+        if (this.defect !== 'refused-not-recorded') {
+          const at = Date.now();
+          sub.dead.unshift({
+            subscriptionId: sub.id, attemptEventId: `evt${String(++this.seq).padStart(16, '0')}`,
+            attempt: { subscriptionId: sub.id, dedupKey: 'opaque', attempt: 1, outcome: 'dead-lettered' },
+            reason: 'verification_failed',
+            deadLetteredAt: new Date(at).toISOString(),
+            expiresAt: new Date(at + (this.defect === 'wrong-retention' ? 1 : 7) * 86_400_000).toISOString(),
+            ...(this.defect === 'record-leaks-canary' ? { body } : {}),
+            ...(this.defect === 'refused-records-state-change' ? { stateChange: { subscriptionId: sub.id, source: 'webhook', fromState: 'active', toState: 'failed', reason: 'signature-invalid' } } : {}),
+          });
+        }
+        if (this.defect === 'refused-changes-state') sub.state = 'failed';
+        return this.send(res, 401, { error: 'signature_invalid', message: 'bad signature', ...(this.defect === 'refused-starts-run' ? { runId: this.startRun(sub) } : {}) });
+      }
+      const prior = sub.seen.get(id);
+      if (prior !== undefined && this.defect !== 'dedup-new-run') return this.send(res, 200, { outcome: 'duplicate', runId: prior });
+      const runId = this.startRun(sub);
+      sub.seen.set(id, runId);
+      return this.send(res, 202, { outcome: 'delivered', runId });
+    }
+
+    const poll = /^\/runs\/([^/]+)\/events\/poll$/.exec(path);
+    if (req.method === 'GET' && poll) {
+      const events = this.runs.get(unprojectBoundId(poll[1]!));
+      return events ? this.send(res, 200, { events }) : this.send(res, 404, { error: 'not_found', message: 'no run' });
+    }
+
+    const m = /^\/trigger-subscriptions\/([^/]+)(\/dead-letters)?$/.exec(path);
+    if (req.method === 'GET' && m) {
+      const auth = String(req.headers['authorization'] ?? '');
+      const sub = this.subs.get(unprojectBoundId(m[1]!));
+      // identity.md §5: tenant B reading acme's bound id is refused 403 before any lookup.
+      if (auth === `Bearer ${OTHER_TENANT_KEY}` && this.defect === 'tenant-404') return this.send(res, 404, { error: 'not_found', message: 'no such subscription' });
+      if (auth === `Bearer ${OTHER_TENANT_KEY}` && this.defect !== 'tenant-leak') return this.send(res, 403, { error: 'id_tenant_mismatch', message: 'tenant segment is not the caller\'s' });
+      if (!sub) return this.send(res, 404, { error: 'not_found', message: 'no such subscription' });
+      if (!m[2]) return this.send(res, 200, { subscription: { subscriptionId: sub.id, source: 'webhook', state: sub.state } });
+      const limit = Math.min(Number(u.searchParams.get('limit') ?? '100'), 100);
+      const cursor = u.searchParams.get('cursor');
+      let offset = 0;
+      if (cursor !== null) {
+        const [cid, off] = Buffer.from(cursor, 'base64url').toString('utf8').split('|');
+        if (cid !== sub.id && this.defect !== 'cursor-not-bound') return this.send(res, 400, { error: 'validation_error', message: 'cursor is for another subscription' });
+        offset = Number(off);
+      }
+      const size = this.defect === 'limit-ignored' ? sub.dead.length : limit;
+      const page = sub.dead.slice(offset, offset + size);
+      const next = offset + size < sub.dead.length ? Buffer.from(`${sub.id}|${offset + size}`).toString('base64url') : undefined;
+      return this.send(res, 200, { deliveries: page, ...(next ? { nextCursor: next } : {}) });
+    }
+    return this.send(res, 404, { error: 'not_found', message: `no route ${req.method} ${path}` });
+  }
+}

package/src/scenarios/v2-trigger-bridge-delivery.test.ts

@@ -0,0 +1,107 @@
+/**
+ * v2 — the trigger bridge's delivery model on the normative surface
+ * (`spec/v2/core/webhooks.md` §Inbound triggers). The v1 twin is
+ * `trigger-bridge-delivery`; this file shares its requirement ids, as the v2
+ * secrets witness does, so a requirement is one id at every major. The legs
+ * live in `lib/trigger-delivery-witness.ts`; what differs between majors is the
+ * profile row in `lib/major-profile.ts`.
+ *
+ * Unaided: the suite registers a `webhook` subscription and posts Standard
+ * Webhooks-signed bodies to its `ingestUrl` with no OpenWOP credential.
+ *
+ *   1. dedup          a repeated `webhook-id` is effectively-once.
+ *   2. dead-letter    a refused post starts no run and leaves the subscription
+ *                     `active`; a correctly signed post still delivers.
+ *   3. causation      the delivered run's `run.started` carries the delivery.
+ *   4a. run-less attempt   a dead-lettered attempt is content-free, read through
+ *                     `GET /trigger-subscriptions/{subscriptionId}/dead-letters`.
+ *   4b. run-less state change   `inapplicable`: no wire surface causes one and
+ *                     no seam drives one at major 2 (RFC 0232 §E, gap G2).
+ *
+ * Dispositions: `triggerBridge` absent, or `ingestion.inboundSigning` not
+ * listing `standard-webhooks-1` ⇒ `inapplicable` (major 2 has no other delivery
+ * surface). Leg 4a also needs `triggerBridge.deadLetter`.
+ *
+ * Proven against a scratch double in `lib/trigger-delivery-witness.test.ts`.
+ *
+ * @see spec/v2/core/webhooks.md §Inbound triggers
+ * @see RFCS/0230-inbound-webhook-ingest-contract.md, RFCS/0232-trigger-dead-letter-read.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { familyAdvertised, v2Discovery, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { noteObservation } from '../lib/row-observation.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { adverts, causationLeg, dedupLeg, refusedLeg, runlessAttemptLeg, runlessStateChangeLeg, type TriggerAdverts } from '../lib/trigger-delivery-witness.js';
+
+const PROFILE = majorProfile(2);
+const R_DEDUP = 'openwop.requirement.0083.trigger-delivery.dedup';
+const R_DEAD_LETTER = 'openwop.requirement.0083.trigger-delivery.dead-letter';
+const R_CAUSATION = 'openwop.requirement.0083.trigger-delivery.causation';
+const R_RUNLESS_ATTEMPT = 'openwop.requirement.0083.trigger-delivery.runless-attempt-content-free';
+const R_RUNLESS_STATE = 'openwop.requirement.0083.trigger-delivery.runless-state-change-content-free';
+
+/**
+ * `familyAdvertised`, not `gateFamily`: `triggerBridge` is optional, and a host that does not advertise it
+ * has taken on no obligation here. `gateFamily` fails an unadvertised family in strict mode (the 2.45.7
+ * `v2-workspace-scope-from-identity` defect).
+ */
+async function discovered(): Promise<TriggerAdverts | string> {
+  if (!(await familyAdvertised('triggerBridge'))) return 'GATED';
+  let doc: Record<string, unknown> | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  return doc ? adverts(PROFILE, doc) : 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0';
+}
+
+describe('v2 trigger-bridge delivery (webhooks.md §Inbound triggers)', () => {
+  it('de-dups a repeated webhook-id: effectively-once', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await dedupLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_DEDUP, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('a refused post starts no run and leaves the subscription active', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await refusedLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_DEAD_LETTER, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('links delivery to run: run.started carries the delivery as causationId', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await causationLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_CAUSATION, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('keeps a dead-lettered run-less attempt content-free', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await runlessAttemptLeg(PROFILE, a, v2Validator('trigger-dead-letter-page'));
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_RUNLESS_ATTEMPT, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('keeps a run-less subscription state change content-free', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = runlessStateChangeLeg(a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    expect(out.kind, req(R_RUNLESS_STATE, 'webhooks.md §Inbound triggers', 'unreachable: no major-2 surface causes a state change')).toBe('skip');
+  });
+});

package/src/scenarios/v2-trigger-dead-letter-read.test.ts

@@ -0,0 +1,78 @@
+/**
+ * v2 — the trigger dead-letter read's own rules (RFC 0232 §B;
+ * `spec/v2/core/webhooks.md` §Inbound triggers). The v1 twin is
+ * `trigger-dead-letter-read`; the requirement ids are shared, and the legs live
+ * in `lib/trigger-delivery-witness.ts`.
+ *
+ *   paging        `limit` is clamped, and a short page carries `nextCursor`.
+ *   cursor-bound  a cursor minted for one subscription is refused on another,
+ *                 `400 validation_error`.
+ *   tenant-bound  another tenant's bound id is refused `403 id_tenant_mismatch`
+ *                 and discloses nothing (`identity.md` §5; at v1, with bare ids,
+ *                 the same rule is `404` as for an id never minted). An id never
+ *                 minted answers `404`. Needs `OPENWOP_TEST_TENANT_B_API_KEY`,
+ *                 else `blocked`.
+ *
+ * Dispositions: `triggerBridge`, `triggerBridge.deadLetter` or
+ * `ingestion.inboundSigning` not advertised ⇒ `inapplicable`.
+ *
+ * Proven against a scratch double in `lib/trigger-delivery-witness.test.ts`.
+ *
+ * @see spec/v2/core/webhooks.md §Inbound triggers
+ * @see RFCS/0232-trigger-dead-letter-read.md §B
+ * @see spec/v2/core/identity.md §5
+ */
+
+import { describe, it, expect } from 'vitest';
+import { familyAdvertised, v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { loadEnv } from '../lib/env.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { adverts, cursorLeg, pagingLeg, tenantLeg, type TriggerAdverts } from '../lib/trigger-delivery-witness.js';
+
+const PROFILE = majorProfile(2);
+const R_PAGING = 'openwop.requirement.0232.trigger-dead-letters.paging';
+const R_CURSOR = 'openwop.requirement.0232.trigger-dead-letters.cursor-bound';
+const R_TENANT = 'openwop.requirement.0232.trigger-dead-letters.tenant-bound';
+
+/**
+ * `familyAdvertised`, not `gateFamily`: `triggerBridge` is optional, and a host that does not advertise it
+ * has taken on no obligation here. `gateFamily` fails an unadvertised family in strict mode (the 2.45.7
+ * `v2-workspace-scope-from-identity` defect).
+ */
+async function discovered(): Promise<TriggerAdverts | string> {
+  if (!(await familyAdvertised('triggerBridge'))) return 'GATED';
+  let doc: Record<string, unknown> | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  return doc ? adverts(PROFILE, doc) : 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0';
+}
+
+describe('v2 trigger dead-letter read (RFC 0232 §B)', () => {
+  it('clamps limit and continues a short page with nextCursor', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await pagingLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_PAGING, x.doc, x.message)).toBe(true);
+  });
+
+  it('refuses a cursor minted for another subscription', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await cursorLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_CURSOR, x.doc, x.message)).toBe(true);
+  });
+
+  it("refuses another tenant's bound id 403 id_tenant_mismatch and discloses nothing", async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await tenantLeg(PROFILE, a, process.env['OPENWOP_TEST_TENANT_B_API_KEY'], loadEnv().apiKey);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_TENANT, x.doc, x.message)).toBe(true);
+  });
+});