@openwop/openwop-conformance 2.45.10 → 2.45.12

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.12] — 2026-10-03 — RFC 0233: the provider-identity rules have a normative witness
+
+- **`v2-provider-conflict` gains a normative-surface path (RFC 0233).** Where the host advertises `connections.providerRead` it reads `GET /connection-providers` and `GET /connection-providers/{providerId}` (`?pack=` for the qualified form). The conflict is caused operator-side by installing the `connection-pack-acme-widgets` / `-rival` fixture pair, and the registry describes the outcome. The seam path still runs where the seams are served.
+  - `openwop.requirement.0177.provider-conflict.fail-closed`: `acme-widgets` is held once by the first pack, and a `connection_provider_conflict` refusal names that holder.
+  - `openwop.requirement.0177.provider-conflict.qualified-form`: `?pack=<first>` resolves to it; `?pack=<rival>` answers `404 connection_provider_unresolved`; the bare id resolves to the first pack.
+  - New `openwop.requirement.0233.provider-registry.unique`: a schema-valid, closed registry with each bare id once, on any host with the facet.
+- **Disposition change.** A host advertising `packsSupported` with neither `providerRead` nor the seams now records `inapplicable`, with the reason, where it recorded `blocked`. That case was a seam-only MUST, which `conformance.md` §Witness class forbids; RFC 0233 mints the path, and `witnessable-gated` means observed when the gating capability is advertised. Without the fixture installed, the two fixture legs are `inapplicable` and uniqueness still runs.
+- **New fixture** `connection-pack-acme-widgets-rival` (catalogued in `fixtures.md`).
+- **Sabotage.** `lib/provider-registry-witness.test.ts` runs 11 cases against `lib/provider-registry-double.ts`, each defect failing exactly its leg. The scenario file was also run against a standalone double: conforming passes in strict mode; missing refusal, rival resolving, duplicate id and unserved read each fail; not-installed and no-facet are `inapplicable` in strict mode with nothing failing.
+- **Host impact.** openwop-app (`connections.packsSupported` at v2, no seams in production): the three `v2-provider-conflict` rows move from `blocked` to `inapplicable` until it advertises `providerRead`; with the facet and the fixture pair they become `executed-pass`. No other host advertises `connections` at v2.
+- **Fix: `v2-advertised-path-space-served` no longer fails a host that has retired `/v1`.** The leg read any non-`404` answer under `/v1` as "served", so a retired host answering `410 Gone` on every `/v1` path (openwop-app's ADR 0669) failed for surfaces it serves at neither address. `410` now reads as not served (RFC 9110 §15.5.11), and the leg is `inapplicable` when `protocolVersions[]` has no `1.x` member, since `versioning.md` §1.2 is an overlap rule.
+  - **Found by** openwop-app's v1-cut rehearsal (suite 2.45.11, `OPENWOP_V1_RETIRED=true`): "/audit/verify (/v1 → 410, major 2 → 404); /host/events (/v1 → 410, major 2 → 404)".
+  - **Proof** against a standalone double in strict mode: a retired host and an overlap host answering `410` on `/v1` are `inapplicable`; an overlap host serving `/v1/agents` but not `/agents` still fails; a conforming overlap host passes.
+- **The 2.45.12 cycle opened** with RFC 0233's filing.
+- **Two RFC 0230 rows that had no test now have one, at both majors** (`trigger-bridge-delivery` and `v2-trigger-bridge-delivery`; gated like the other signed legs on `inboundSigning`, `familyAdvertised` at major 2).
+  - `openwop.requirement.0230.stale-timestamp-refused` (§C): under `required`, a post correctly signed over a `webhook-timestamp` 600 s in the past, and again 600 s in the future, must answer `401 signature_invalid` and start no run. The subscription must stay `active`, and a current signed post must then answer `202`.
+  - `openwop.requirement.0230.signing-secret-once` (§B, SR-1): a re-read of a subscription just registered carries no `signingSecret` key at any depth, not the secret's value, and no `whsec_` string. `inapplicable` where the host serves no re-read (`404`/`405`).
+- **Sabotage.** The scratch double enforces the 300 s window and gains two defects, `skew-accepted` and `reread-leaks-secret`; `lib/trigger-delivery-witness.test.ts` runs 18 cases, and each defect fails only the legs that own the rule. Both scenario files were run against a standalone double (major 1 behind openwop-app's captured 451a665e8 discovery document): conforming, both new rows pass; each defect fails only its own row.
+- **Host impact.** openwop-app at major 1 and 2 serves both rules on the signed path and is expected to pass; no host gains a `blocked` row. A host without `inboundSigning` records `inapplicable`.
+
+## [2.45.11] — 2026-10-03 — the trigger bridge is witnessed at major 2
+
+- **New scenarios `v2-trigger-bridge-delivery` and `v2-trigger-dead-letter-read`** (major 2). They port the trigger delivery legs and RFC 0232's read rules to the v2 surface (`/trigger-subscriptions/…`, bound ids `~`-projected). They share their requirement ids with the v1 twins, as the v2 secrets witness does. Each runs only the normative-surface path: there is no trigger seam at major 2.
+  - Legs: `0083.trigger-delivery.dedup`, `.dead-letter`, `.causation` and `.runless-attempt-content-free`, through the signed ingest and `GET /trigger-subscriptions/{subscriptionId}/dead-letters`. `.runless-state-change-content-free` is `inapplicable`: no wire surface causes a state change and no seam drives one (RFC 0232 gap G2).
+  - Read rules: `0232.trigger-dead-letters.paging`, `.cursor-bound` and `.tenant-bound` (`OPENWOP_TEST_TENANT_B_API_KEY`, else `blocked`). At major 2, another tenant's bound id must be refused `403 id_tenant_mismatch` (`identity.md` §5), not `404`; the profile row says which refusal each major uses (`foreignTenantRead`). openwop-app caught this before release.
+  - **Dispositions:** `triggerBridge` absent, or `inboundSigning` not listing `standard-webhooks-1` ⇒ `inapplicable`, since major 2 has no other delivery surface. The read legs also need `triggerBridge.deadLetter`.
+- **Why.** openwop-app's seam-free production cut (build 062381a5, suite 2.45.10) passes every trigger leg at major 1, but that bundle carries 350 seam-precondition `blocked` rows and cannot certify. Its v2 bundle certifies with 0 blocked but had no trigger rows. With these scenarios, a host that advertises `triggerBridge` at major 2 witnesses RFC 0230 and RFC 0232 on a certifiable bundle.
+- **Shared witness.** `lib/trigger-delivery-witness.ts` takes a `MajorProfile`. The profile gains `triggerSubscriptionsPath` and `idSegment`. The major-1 files keep their own inline legs for now.
+- **Sabotage.** `lib/trigger-delivery-witness.test.ts` runs 16 cases against the scratch double in `lib/trigger-double.ts`, and each of twelve defects fails exactly the legs that own the rule. Both scenario files were also run against a standalone double. Conforming: 7 pass, the state-change row `inapplicable`. Seven defects (dedup, refused state, causation, canary leak, foreign cursor, tenant leak, a `404` where v2 requires `403`) each fail only their own leg. With no family, in strict mode, every row is `inapplicable` and none fails. Scenarios gate on `familyAdvertised`, not `gateFamily` (the 2.45.7 strict-mode defect).
+- **Host impact.** MyndHyve advertises `triggerBridge` at major 2 without `inboundSigning`, so every new row records `inapplicable`. openwop-app and the v2 reference host don't advertise the family at major 2. No host gains a `blocked` or failing row.
+
 ## [2.45.10] — 2026-10-03 — RFC 0232 Active: a seam-free path for the run-less trigger leg
 
 - **`trigger-bridge-delivery` leg 4 splits in two (RFC 0232, decided question 1 (a)).** Both ids stay in the `openwop-trigger-bridge` floor; the old title-derived id is aliased to the first.

package/README.md

@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 592 scenario files under `src/scenarios/`.
+The current suite has 594 scenario files under `src/scenarios/`.
 - 2026-09-29 (suite 2.45.0, openwop#1763): NEW `v2-cors-preflight.test.ts` — `headers.md` §Cross-origin preflight. For every operation it preflights with `Origin`, the method, and the operation's declared request headers (plus `authorization` / `content-type` where they apply, from `spec/v2/path-manifest.json`), and reads the answer as the Fetch standard's CORS-preflight check does. Self-gated: `inapplicable` when no operation's preflight grants `OPENWOP_CORS_ORIGIN` (default `https://conformance.invalid`).
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
@@ -482,7 +482,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 592 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 594 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/lib/profiles.js

@@ -258,7 +258,9 @@ export function isMemory(c) {
 /**
  * `openwop-trigger-bridge` predicate (RFC 0083, widened by RFC 0099). Host
  * composes the durable inbound-work contract: advertises the `triggerBridge`,
- * has a `deadLetter` sink for exhausted deliveries, and has at least one
+ * has a `deadLetter` run sink (RFC 0053: where a trigger-started run that fails
+ * terminally lands; a dead-lettered DELIVERY starts no run and is read through
+ * `triggerBridge.deadLetter`, RFC 0232), and has at least one
  * durable inbound source (queue bus, durable webhooks, scheduling, OR — per
  * RFC 0099 — externally-ingested `email`/`form` via
  * `triggerBridge.ingestion.externalSources[]`). Capability families are

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.10",
-  "stampSha256": "cfba8c0d8fc447d57a70ace7ffcb054ba3ee9402be6268f1b40c99e0517791e8"
+  "version": "2.45.12",
+  "stampSha256": "240b734d24b7a4a8a2595eb85f9035b8d4418dfdff6d7f2237c70811a79f6f0c"
 }

package/fixtures/connection-packs/connection-pack-acme-widgets-rival.json

@@ -0,0 +1,55 @@
+{
+  "name": "core.openwop.connections.acme-widgets-rival",
+  "version": "1.0.0",
+  "kind": "connection",
+  "engines": {
+    "openwop": ">=2.0.0 <3.0.0"
+  },
+  "provider": {
+    "id": "acme-widgets",
+    "displayName": "Acme Widgets",
+    "category": "dev",
+    "auth": {
+      "kind": "oauth2",
+      "authFlow": "pkce",
+      "scopeModel": "groups",
+      "endpoints": {
+        "authorize": "https://auth.acme-widgets.example.com/oauth/authorize",
+        "token": "https://auth.acme-widgets.example.com/oauth/token"
+      },
+      "scopes": {
+        "read": [
+          {
+            "key": "widget.read",
+            "label": "Read widgets",
+            "scopes": [
+              "widget:read"
+            ]
+          }
+        ],
+        "write": [
+          {
+            "key": "widget.write",
+            "label": "Write widgets",
+            "scopes": [
+              "widget:write"
+            ]
+          }
+        ]
+      }
+    },
+    "reach": {
+      "mcp": {
+        "server": {
+          "url": "https://mcp.acme-widgets.example.com/mcp/",
+          "transport": "http"
+        }
+      }
+    },
+    "consumerNodes": [
+      "core.openwop.mcp.invoke-tool",
+      "core.openwop.mcp.read-resource"
+    ],
+    "docsUrl": "https://docs.acme-widgets.example.com/oauth"
+  }
+}

package/fixtures/connection-packs/connection-pack-acme-widgets.json

@@ -2,7 +2,9 @@
   "name": "core.openwop.connections.acme-widgets",
   "version": "1.0.0",
   "kind": "connection",
-  "engines": { "openwop": ">=1.0.0" },
+  "engines": {
+    "openwop": ">=2.0.0 <3.0.0"
+  },
   "provider": {
     "id": "acme-widgets",
     "displayName": "Acme Widgets",
@@ -17,15 +19,37 @@
       },
       "scopes": {
         "read": [
-          { "key": "widget.read", "label": "Read widgets", "scopes": ["widget:read"] }
+          {
+            "key": "widget.read",
+            "label": "Read widgets",
+            "scopes": [
+              "widget:read"
+            ]
+          }
         ],
         "write": [
-          { "key": "widget.write", "label": "Write widgets", "scopes": ["widget:write"] }
+          {
+            "key": "widget.write",
+            "label": "Write widgets",
+            "scopes": [
+              "widget:write"
+            ]
+          }
         ]
       }
     },
-    "reach": { "mcp": { "server": { "url": "https://mcp.acme-widgets.example.com/mcp/", "transport": "http" } } },
-    "consumerNodes": ["core.openwop.mcp.invoke-tool", "core.openwop.mcp.read-resource"],
+    "reach": {
+      "mcp": {
+        "server": {
+          "url": "https://mcp.acme-widgets.example.com/mcp/",
+          "transport": "http"
+        }
+      }
+    },
+    "consumerNodes": [
+      "core.openwop.mcp.invoke-tool",
+      "core.openwop.mcp.read-resource"
+    ],
     "docsUrl": "https://docs.acme-widgets.example.com/oauth"
   }
 }

package/fixtures.md

@@ -823,6 +823,7 @@ The `fixtures/connection-packs/` sub-directory holds canonical connection-pack m
 | ------------------------ | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `connection-pack-github` | `github`      | Canonical positive manifest (oauth2 + pkce, read/write scope groups, MCP reach, the exempt `provider.auth.endpoints.token` endpoint URL). Drives manifest-valid, no-credential-material, reach-exclusive, provider-resolution, and write-reconsent scenarios. **v1 only for the resolution leg:** v1 settles a collision with a built-in by version precedence (`spec/v1/connection-packs.md:89`), so a host shipping a built-in `github` still installs this pack. |
 | `connection-pack-acme-widgets` | `acme-widgets` | Same shape as the `github` pack over a **deliberately fictional** provider. Drives `v2-provider-conflict` (RFC 0177 §D.1). The id is fictional so that no host ships it built-in: at v2 the later registration of a bare id MUST be refused, so a real-world id made the fixture uninstallable on any host that shipped it — and the qualified-form leg recorded `blocked` on a host whose only fault was obeying §D.1. Suite 2.0.4. |
+| `connection-pack-acme-widgets-rival` | `acme-widgets` | RFC 0233 §D: a second well-formed pack (`core.openwop.connections.acme-widgets-rival`) claiming the same fictional bare id. An operator who installs `connection-pack-acme-widgets` also attempts this one after it, so the host's registry shows a `connection_provider_conflict` refusal that `v2-provider-conflict` reads through `GET /connection-providers` without a seam. Never advertised in discovery `fixtures` (those name workflows). Both acme-widgets packs pin `engines.openwop: ">=2.0.0 <3.0.0"`: a range that admits major 1 would get v1 version precedence on a dual-major host instead of the v2 refusal (openwop-app's review, 2026-10-03). |
 | `connection-pack-apihosts-valid` | `meta-ads` | Canonical positive `openapi`-reach manifest declaring a `provider.apiHosts` credential-egress allow-list (`["facebook.com"]`) — RFC 0120. Drives `connection-pack-apihosts` (the `apiHosts` schema + conditional-MUST + egress allow-list scenario). Negatives (IP/wildcard/port/single-label/uppercase entries, openapi-without-apiHosts) are inline mutations per suite convention. |
 
 Negative manifests (credential material, mixed kinds, dual reach) are inline test data in the scenario files per suite convention — a deliberately-invalid fixture file would fail the automatic `fixtures-valid.test.ts` sweep.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.10",
+  "version": "2.45.12",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.10"
+    "@openwop/spec-artifacts": "2.45.12"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 667,
-    "tests": 2549,
-    "withStableId": 2549,
+    "files": 669,
+    "tests": 2562,
+    "withStableId": 2562,
     "interpolatedTitles": 0,
-    "explicitIds": 2426
+    "explicitIds": 2439
   },
   "records": [
     {
@@ -26311,7 +26311,7 @@
     {
       "id": "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-a-repeated-delivery-is-effectively-once",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 171,
+      "line": 191,
       "title": "de-dups by dedupKey: a repeated delivery is effectively-once",
       "explicitId": "openwop.requirement.0083.trigger-delivery.dedup",
       "citations": [
@@ -26347,7 +26347,7 @@
     {
       "id": "openwop.it.trigger-bridge-delivery.dead-letters-an-exhausted-or-refused-delivery-without-starting-a-run",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 195,
+      "line": 215,
       "title": "dead-letters an exhausted or refused delivery without starting a run",
       "explicitId": "openwop.requirement.0083.trigger-delivery.dead-letter",
       "citations": [
@@ -26377,10 +26377,80 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.trigger-bridge-delivery.refuses-a-webhook-timestamp-more-than-300-s-off-without-starting-a-run",
+      "file": "trigger-bridge-delivery.test.ts",
+      "line": 238,
+      "title": "refuses a webhook-timestamp more than 300 s off without starting a run",
+      "explicitId": "openwop.requirement.0230.stale-timestamp-refused",
+      "citations": [
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §F.6 (RFC 0230 §C.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.trigger-bridge-delivery.returns-the-signing-secret-once-a-re-read-carries-no-whsec-value",
+      "file": "trigger-bridge-delivery.test.ts",
+      "line": 260,
+      "title": "returns the signing secret once: a re-read carries no whsec_ value",
+      "explicitId": "openwop.requirement.0230.signing-secret-once",
+      "citations": [
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §F.6 (SR-1)",
+          "requirement": "a re-read MUST NOT carry signingSecret"
+        },
+        {
+          "section": "trigger-bridge.md §F.6 (SR-1)",
+          "requirement": "a re-read MUST NOT carry the secret's value"
+        },
+        {
+          "section": "trigger-bridge.md §F.6 (SR-1)",
+          "requirement": "a re-read MUST NOT carry any whsec_ secret"
+        }
+      ]
+    },
     {
       "id": "openwop.it.trigger-bridge-delivery.links-delivery-run-causation-on-run-started",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 218,
+      "line": 277,
       "title": "links delivery→run causation on run.started",
       "explicitId": "openwop.requirement.0083.trigger-delivery.causation",
       "citations": [
@@ -26416,7 +26486,7 @@
     {
       "id": "openwop.it.trigger-bridge-delivery.keeps-a-dead-lettered-run-less-attempt-content-free",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 247,
+      "line": 306,
       "title": "keeps a dead-lettered run-less attempt content-free",
       "explicitId": "openwop.requirement.0083.trigger-delivery.runless-attempt-content-free",
       "citations": [
@@ -26440,7 +26510,7 @@
     {
       "id": "openwop.it.trigger-bridge-delivery.keeps-a-run-less-subscription-state-change-content-free",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 278,
+      "line": 337,
       "title": "keeps a run-less subscription state change content-free",
       "explicitId": "openwop.requirement.0083.trigger-delivery.runless-state-change-content-free",
       "citations": [
@@ -33471,40 +33541,42 @@
     {
       "id": "openwop.it.v2-provider-conflict.two-definitions-of-one-bare-provider-id-fail-closed-the-later-registration-is-re",
       "file": "v2-provider-conflict.test.ts",
-      "line": 99,
+      "line": 130,
       "title": "two definitions of one bare provider id fail closed: the later registration is refused with connection_provider_conflict",
       "explicitId": "openwop.requirement.0177.provider-conflict.fail-closed",
       "citations": [
         {
-          "section": "connection-packs.md §\"Provider identity\" (RFC 0177 §D.1)",
+          "section": null,
           "requirement": null,
           "interpolated": true
-        },
-        {
-          "section": "connection-packs.md §\"Provider identity\" (RFC 0177 §D.1)",
-          "requirement": "the later registration of a bare provider id MUST NOT install (no version precedence)"
-        },
-        {
-          "section": "connection-packs.md §\"Provider identity\" (RFC 0177 §D.1)",
-          "requirement": "the later registration MUST be refused with connection_provider_conflict"
         }
       ]
     },
     {
       "id": "openwop.it.v2-provider-conflict.the-qualified-form-packname-acme-widgets-resolves-to-the-named-pack-s-definition",
       "file": "v2-provider-conflict.test.ts",
-      "line": 120,
+      "line": 140,
       "title": "the qualified form <packName>#acme-widgets resolves to the named pack's definition",
       "explicitId": "openwop.requirement.0177.provider-conflict.qualified-form",
       "citations": [
         {
-          "section": "connection-packs.md §\"The qualified form\" (RFC 0177 §D.1)",
+          "section": null,
           "requirement": null,
           "interpolated": true
-        },
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-provider-conflict.the-provider-registry-lists-each-bare-id-once-and-carries-no-endpoint-or-credent",
+      "file": "v2-provider-conflict.test.ts",
+      "line": 150,
+      "title": "the provider registry lists each bare id once and carries no endpoint or credential (RFC 0233 §B)",
+      "explicitId": "openwop.requirement.0233.provider-registry.unique",
+      "citations": [
         {
-          "section": "connection-packs.md §\"The qualified form\" (RFC 0177 §D.1)",
-          "requirement": "a qualified reference resolves only to the named pack's definition (source: pack)"
+          "section": null,
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
@@ -35267,6 +35339,145 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.de-dups-a-repeated-webhook-id-effectively-once",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 68,
+      "title": "de-dups a repeated webhook-id: effectively-once",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.dedup",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.a-refused-post-starts-no-run-and-leaves-the-subscription-active",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 78,
+      "title": "a refused post starts no run and leaves the subscription active",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.dead-letter",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.refuses-a-webhook-timestamp-more-than-300-s-off-without-starting-a-run",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 88,
+      "title": "refuses a webhook-timestamp more than 300 s off without starting a run",
+      "explicitId": "openwop.requirement.0230.stale-timestamp-refused",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.returns-the-signing-secret-once-a-re-read-carries-no-whsec-value",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 98,
+      "title": "returns the signing secret once: a re-read carries no whsec_ value",
+      "explicitId": "openwop.requirement.0230.signing-secret-once",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.links-delivery-to-run-run-started-carries-the-delivery-as-causationid",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 108,
+      "title": "links delivery to run: run.started carries the delivery as causationId",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.causation",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.keeps-a-dead-lettered-run-less-attempt-content-free",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 118,
+      "title": "keeps a dead-lettered run-less attempt content-free",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.runless-attempt-content-free",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-bridge-delivery.keeps-a-run-less-subscription-state-change-content-free",
+      "file": "v2-trigger-bridge-delivery.test.ts",
+      "line": 128,
+      "title": "keeps a run-less subscription state change content-free",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.runless-state-change-content-free",
+      "citations": [
+        {
+          "section": "webhooks.md §Inbound triggers",
+          "requirement": "unreachable: no major-2 surface causes a state change"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-dead-letter-read.clamps-limit-and-continues-a-short-page-with-nextcursor",
+      "file": "v2-trigger-dead-letter-read.test.ts",
+      "line": 52,
+      "title": "clamps limit and continues a short page with nextCursor",
+      "explicitId": "openwop.requirement.0232.trigger-dead-letters.paging",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-dead-letter-read.refuses-a-cursor-minted-for-another-subscription",
+      "file": "v2-trigger-dead-letter-read.test.ts",
+      "line": 61,
+      "title": "refuses a cursor minted for another subscription",
+      "explicitId": "openwop.requirement.0232.trigger-dead-letters.cursor-bound",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-trigger-dead-letter-read.refuses-another-tenant-s-bound-id-403-id-tenant-mismatch-and-discloses-nothing",
+      "file": "v2-trigger-dead-letter-read.test.ts",
+      "line": 70,
+      "title": "refuses another tenant's bound id 403 id_tenant_mismatch and discloses nothing",
+      "explicitId": "openwop.requirement.0232.trigger-dead-letters.tenant-bound",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-unadvertised-operation-not-found.get-prompts-answers-404-not-found-when-prompts-endpointssupported-is-not-adverti",
       "file": "v2-unadvertised-operation-not-found.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 592,
+    "files": 594,
     "v1": 455,
-    "v2": 152
+    "v2": 154
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1635,6 +1635,12 @@
     "v2-tool-catalog-annotations.test.ts": [
       2
     ],
+    "v2-trigger-bridge-delivery.test.ts": [
+      2
+    ],
+    "v2-trigger-dead-letter-read.test.ts": [
+      2
+    ],
     "v2-unadvertised-operation-not-found.test.ts": [
       2
     ],