@openwop/openwop-conformance 2.45.14 → 2.45.16

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.16] — 2026-10-04 — witness waves 2 and 3: every core family gains a major-2 witness
+
+- **Advertisement witnesses** for ten families: `selfHostedRunner`, `credentials`, `authorization`, `providerUsage`, `subWorkflow`, `scheduling`, `artifactTypes`, `aiEnvelope`, `deadLetter` and `portability`. Each validates its v2 record plus the facet checks the v2 prose states. No `supported` leg is ported: presence is the claim (capabilities.md:50).
+- **Static twins:** runner frames, the `providerUsage` payload (no `provider_usage_credential_leak`, which isn't a v2 code), the export bundle (v2 flips `bundleVersion` to `"2"`) and `artifactCreated` / `registrationSource`.
+- **New unaided witness, `v2-artifact-type-schema-url`.** `artifact-type-packs.md` requires `{HostBase}/schemas/artifacts/{id}.schema.json` for every host-registered type. No v1 scenario tested it.
+- **Fixture ports:**
+  - `v2-subworkflow-linkage`, on v2's replacement linkage: `node.completed` carries `childRunId`/`childStatus`, and ancestry gives `cause: core.subWorkflow`. The v1 `parentRunId` leg was retired by C4.18.
+  - `v2-subworkflow-input-mapping`, `v2-dispatch-input-mapping`, `v2-dispatch-loop`, `v2-provider-usage-emission`.
+- **Not ported, by ruling:**
+  - every v1 `supported` leg;
+  - `scheduling.maxFutureHorizon`'s ISO format (not a v2 rule);
+  - the `approvalGate` override reason (prose says MAY);
+  - the `aiEnvelope` universal-kind listing ("need not be listed" at v2);
+  - every seam-only leg.
+  - `deadLetter` retry exhaustion is deferred: it needs a fixture and a ruling.
+- **No observation path ⇒ `inapplicable`, never `blocked`.** A dispatched child the host doesn't expose is `inapplicable`, since no v2 rule requires exposure; `blocked` would have denied certification on an unstated rule.
+- **Corpus fix:** `schemas/v2/orchestrator-decision.schema.json` now declares a root `additionalProperties: true` instead of `false`. With no root `properties`, `false` rejected every decision; each `oneOf` branch stays closed. Coverage after wave 2: 62 v2-witnessed, 8 v1-only, 3 unwitnessed (of 73).
+- **Wave 3 — the 11 families no host serves at v2.**
+  - An advertisement scenario each: `dataResidency`, `multiPartyConversation`, `nodePackRuntimes`, `uiPlugins`, `purposePropagation`, `agentRuntime` (implies `agents.manifestRuntime`), and record-only `conversationTurnModelProvenance`, `channelPresence`, `nondeterminismPolicy`, `promptLibrary`, `envelopeContracts`.
+  - `v2-data-residency-admission`: an unadvertised region answers `422 residency_unavailable` and creates no run; an advertised one answers `201`.
+  - `v2-conversation-turn-model-provenance`: a host that stamps `agent.model` advertises the family, and the stamp is closed.
+  - Two schema widenings: a `participants` seat on `conversationOpened`, and `agent.model` on the `ConversationTurn` mirror. The `v2-conversation-payload-mirrors` coherence test fails if either mirror drifts again.
+  - Owed (TODO §8): the multi-party roster legs and the WASM fixture-pack legs, plus an observation path for the four `uiPlugins` invariants.
+- **Coverage:** 73 of 73 core families v2-witnessed (from 52/18/3 at 2.45.15).
+- **Proof:** about 160 self-test cases, plus the scenario files against standalone doubles.
+
+## [2.45.15] — 2026-10-04 — witness wave 1: six v1-only families gain major-2 witnesses
+
+- **Why.** v1 end-of-support was 2026-10-04 (RFC 0234), and openwop-app has retired `/v1`, so it emits no more major-1 bundles. 24 core families were witnessed only by major-1 scenarios. This wave ports the six that production hosts serve at v2. Each port follows the per-major pattern: a profile-aware witness lib whose legs observe and return findings, a thin `v2-*` scenario, and a self-test against a scratch double.
+- **Normative wire, unaided:**
+  - `v2-i18n-negotiation`;
+  - `v2-prompt-list-and-fetch`, `v2-prompt-mutable-lifecycle`, `v2-prompt-render-deterministic`, `v2-prompt-pack-install`;
+  - the live leg of `v2-localized-content-delivery`;
+  - the advertisement witnesses `v2-envelopes-advertisement`, `v2-limits-envelope-caps-advertisement`, `v2-model-capabilities-advertisement`, `v2-ai-providers-advertisement`;
+  - `v2-run-execution-bounds`. It is new at v2, and an out-of-range `runTimeoutMs` is refused `400` unaided.
+- **Static twins over `schemas/v2`:** `v2-prompt-template-shape`, `v2-envelope-reasoning-shape`, `v2-envelope-tier-one-subset-static`, `v2-envelope-variant-discriminator-static`, `v2-ai-envelope-shape-static`, `v2-media-inline-cap-static`, and the localized-content schema legs.
+- **Fixture ports through `POST /runs` with v2 event names:** `v2-prompt-all-four-kinds-events`, `v2-prompt-end-to-end-events`, `v2-prompt-resolution-chain-event`, the run-duration breach leg, and `v2-model-capability-insufficient`.
+- **Not ported, by ruling:**
+  - Seam-only legs: prompt compose and resolve, voice and speech, `ai/call*`, `envelope/accept`, the envelope runtime, the model-capability gate, node-catalog and debug-bundle. There's no v2 seam and no normative path; see TODO.
+  - The `authModes` and `byok` map rules, retired by migration C2.11.
+  - The two prompt workspace-membership scenarios. They have no v2 wire seat, because workspace comes from identity at v2.
+- **Every leg rests on a stated rule.** A proposed `authModes` vocabulary leg was dropped: the prose's only MUSTs bind clients, and v2's schema has no enum, so it would have failed openwop-app (`"api-key"`) on an unstated rule.
+- **Fix to existing witnesses:** `budget-`, `backpressure-`, `exhaustion-facet-` and `table-schema-witness` address v2 runs with the `~` bound-id projection (`profile.idSegment`) instead of `%2F`, and the scratch double accepts both. Only `run-secrets-witness` keeps `%2F` (live-proven; follow-up).
+- **Proof:** about 200 self-test cases across the new witness libs, each defect failing only its own leg.
+
 ## [2.45.14] — 2026-10-04 — v1 end-of-support is 2026-10-04 (RFC 0234)
 
 - **The 2.45.14 cycle opens.** RFC 0234 amends `overview.md` §v1 end-of-support and `versioning.md` §5, adds `spec/v2/eos-override.json` and `spec/v1/end-of-support.json`, and its gap register changes the packed `spec/v1/gaps.json`.

package/README.md

@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 594 scenario files under `src/scenarios/`.
+The current suite has 648 scenario files under `src/scenarios/`.
 - 2026-09-29 (suite 2.45.0, openwop#1763): NEW `v2-cors-preflight.test.ts` — `headers.md` §Cross-origin preflight. For every operation it preflights with `Origin`, the method, and the operation's declared request headers (plus `authorization` / `content-type` where they apply, from `spec/v2/path-manifest.json`), and reads the answer as the Fetch standard's CORS-preflight check does. Self-gated: `inapplicable` when no operation's preflight grants `OPENWOP_CORS_ORIGIN` (default `https://conformance.invalid`).
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
@@ -482,7 +482,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 594 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 648 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.14",
-  "stampSha256": "8b3e620c4bdaf03c76ad97fefb0610413a0d213381c48dd0dedc917a680a5011"
+  "version": "2.45.16",
+  "stampSha256": "c610c19acb41b926293269611f14cb30b5fcf60565f5d64d22e06dcbf1631e89"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.14",
+  "version": "2.45.16",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.14"
+    "@openwop/spec-artifacts": "2.45.16"
   }
 }