@openwop/openwop-conformance 2.45.16 → 2.45.17

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.17] — 2026-10-04 — ETag rules: discovery's 304 gains a major-2 witness, the prompt-template 304 becomes advisory
+
+- **New `v2-discovery-etag`.** `capabilities.md` §1 makes both halves MUSTs at v2: emit an `ETag` on the discovery document, and answer a matching `If-None-Match` with `304` (no body, `OpenWOP-Version` present; a non-matching one gets `200`). The only witness was the v1 `discovery.test.ts` leg, so nothing checked it at major 2. openwop-app's public origin answers `200` because the hosting rewrite drops `If-None-Match` (direct to the origin: `304`), and its 2.45.16 cut certified anyway.
+- **Both 304 witnesses revalidate under every client spelling.** `v2-discovery-etag` and `v2-run-snapshot-etag` now send `OpenWOP-Version: 2.0`, then `2`, then `2` with a wildcard `Accept`; versioning.md §1 says a host MUST accept both version spellings. The snapshot leg had passed on openwop-app's public origin, which answers `304` to `2.0` (the suite's only spelling until now) and `200` to bare `2`.
+- **`openwop.requirement.prompts.etag-revalidation` is advisory.** v2 says only that `getPromptTemplate` SHOULD send an `ETag`, and `headers.md` scopes the `304` MUST to discovery and the run snapshot. The leg rested on RFC 9110 alone. It now passes on a `304` and records `inapplicable` otherwise, never failed (the `tool-catalog-projection` precedent).
+- **Proof:** the new scenario was run against a double in four modes. A conforming double passes. No ETag fails the emitted leg. A dropped `If-None-Match` fails the revalidation leg, and so does a host answering `304` to every conditional request. A double that drops it only for bare `2`, or only for `2` with a wildcard `Accept`, fails both 304 witnesses.
+
 ## [2.45.16] — 2026-10-04 — witness waves 2 and 3: every core family gains a major-2 witness
 
 - **Advertisement witnesses** for ten families: `selfHostedRunner`, `credentials`, `authorization`, `providerUsage`, `subWorkflow`, `scheduling`, `artifactTypes`, `aiEnvelope`, `deadLetter` and `portability`. Each validates its v2 record plus the facet checks the v2 prose states. No `supported` leg is ported: presence is the claim (capabilities.md:50).

package/README.md

@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 648 scenario files under `src/scenarios/`.
+The current suite has 649 scenario files under `src/scenarios/`.
 - 2026-09-29 (suite 2.45.0, openwop#1763): NEW `v2-cors-preflight.test.ts` — `headers.md` §Cross-origin preflight. For every operation it preflights with `Origin`, the method, and the operation's declared request headers (plus `authorization` / `content-type` where they apply, from `spec/v2/path-manifest.json`), and reads the answer as the Fetch standard's CORS-preflight check does. Self-gated: `inapplicable` when no operation's preflight grants `OPENWOP_CORS_ORIGIN` (default `https://conformance.invalid`).
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
@@ -482,7 +482,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 648 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 649 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.16",
-  "stampSha256": "c610c19acb41b926293269611f14cb30b5fcf60565f5d64d22e06dcbf1631e89"
+  "version": "2.45.17",
+  "stampSha256": "688d7b577efa96d9b9295d27f6e4a1245c1f07201c84d6560a712032b9562796"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.16",
+  "version": "2.45.17",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.16"
+    "@openwop/spec-artifacts": "2.45.17"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 724,
-    "tests": 2745,
-    "withStableId": 2745,
+    "files": 725,
+    "tests": 2747,
+    "withStableId": 2747,
     "interpolatedTitles": 0,
-    "explicitIds": 2611
+    "explicitIds": 2613
   },
   "records": [
     {
@@ -30342,6 +30342,49 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-discovery-etag.the-discovery-document-carries-an-etag",
+      "file": "v2-discovery-etag.test.ts",
+      "line": 58,
+      "title": "the discovery document carries an ETag",
+      "explicitId": "openwop.requirement.capabilities.discovery-etag-emitted",
+      "citations": [
+        {
+          "section": "spec/v2/core/capabilities.md §1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-discovery-etag.a-matching-if-none-match-receives-304-with-no-body-and-the-version-header-a-non",
+      "file": "v2-discovery-etag.test.ts",
+      "line": 65,
+      "title": "a matching If-None-Match receives 304 with no body and the version header; a non-matching one receives 200",
+      "explicitId": "openwop.requirement.capabilities.discovery-etag-revalidates",
+      "citations": [
+        {
+          "section": "spec/v2/core/capabilities.md §1",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/headers.md §Request headers",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/capabilities.md §1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-dispatch-input-mapping.inputmapping-projects-the-parent-variable-into-the-dispatched-child-inputs",
       "file": "v2-dispatch-input-mapping.test.ts",
@@ -35086,7 +35129,7 @@
     {
       "id": "openwop.it.v2-prompt-list-and-fetch.get-prompts-answers-items-whose-every-entry-validates",
       "file": "v2-prompt-list-and-fetch.test.ts",
-      "line": 56,
+      "line": 58,
       "title": "GET /prompts answers items whose every entry validates",
       "explicitId": "openwop.requirement.prompts.list-shape",
       "citations": [
@@ -35100,7 +35143,7 @@
     {
       "id": "openwop.it.v2-prompt-list-and-fetch.the-kind-and-source-filters-narrow-the-list",
       "file": "v2-prompt-list-and-fetch.test.ts",
-      "line": 64,
+      "line": 66,
       "title": "the kind and source filters narrow the list",
       "explicitId": "openwop.requirement.prompts.list-filters",
       "citations": [
@@ -35114,7 +35157,7 @@
     {
       "id": "openwop.it.v2-prompt-list-and-fetch.a-listed-template-is-fetched-by-id",
       "file": "v2-prompt-list-and-fetch.test.ts",
-      "line": 72,
+      "line": 74,
       "title": "a listed template is fetched by id",
       "explicitId": "openwop.requirement.prompts.fetch-by-id",
       "citations": [
@@ -35126,10 +35169,10 @@
       ]
     },
     {
-      "id": "openwop.it.v2-prompt-list-and-fetch.an-etag-when-sent-revalidates-to-304",
+      "id": "openwop.it.v2-prompt-list-and-fetch.advisory-an-etag-when-sent-revalidates-to-304",
       "file": "v2-prompt-list-and-fetch.test.ts",
-      "line": 80,
-      "title": "an ETag, when sent, revalidates to 304",
+      "line": 82,
+      "title": "advisory: an ETag, when sent, revalidates to 304",
       "explicitId": "openwop.requirement.prompts.etag-revalidation",
       "citations": [
         {
@@ -35142,7 +35185,7 @@
     {
       "id": "openwop.it.v2-prompt-list-and-fetch.an-unknown-templateid-answers-404-with-the-error-envelope",
       "file": "v2-prompt-list-and-fetch.test.ts",
-      "line": 88,
+      "line": 90,
       "title": "an unknown templateId answers 404 with the error envelope",
       "explicitId": "openwop.requirement.prompts.unknown-template-404",
       "citations": [
@@ -35156,7 +35199,7 @@
     {
       "id": "openwop.it.v2-prompt-list-and-fetch.with-endpointssupported-unadvertised-get-prompts-answers-404-not-found",
       "file": "v2-prompt-list-and-fetch.test.ts",
-      "line": 96,
+      "line": 98,
       "title": "with endpointsSupported unadvertised, GET /prompts answers 404 not_found",
       "explicitId": "openwop.requirement.prompts.endpoints-gate-off-404",
       "citations": [
@@ -36680,7 +36723,7 @@
     {
       "id": "openwop.it.v2-run-snapshot-etag.a-matching-if-none-match-receives-304-with-no-body-and-the-version-header-a-non",
       "file": "v2-run-snapshot-etag.test.ts",
-      "line": 35,
+      "line": 46,
       "title": "a matching If-None-Match receives 304 with no body and the version header; a non-matching one receives 200",
       "explicitId": "openwop.requirement.0170.run-snapshot-etag",
       "citations": [
@@ -36696,7 +36739,8 @@
         },
         {
           "section": "spec/v2/core/versioning.md §1.4",
-          "requirement": "every response carries OpenWOP-Version, the 304 included"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "spec/v2/core/runs.md §Snapshot",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 648,
+    "files": 649,
     "v1": 455,
-    "v2": 208
+    "v2": 209
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1416,6 +1416,9 @@
     "v2-dead-letter-advertisement.test.ts": [
       2
     ],
+    "v2-discovery-etag.test.ts": [
+      2
+    ],
     "v2-dispatch-input-mapping.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.16",
-  "corpusTag": "v2.45.16",
+  "version": "2.45.17",
+  "corpusTag": "v2.45.17",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "429b70d7514eca241ec0353d061ddba2263d34f4e4d7614ecad3e11b2d880076",
-    "api/v2/asyncapi.yaml": "8a8a8f72e0ec39809c4cc85d71834d8263d51dabacc74d1673f3468a66156911",
-    "api/v2/openapi.yaml": "970fdc562da65537205354df32da66c9e1956496fc9b6cd482b1af13e1550fb8",
+    "api/seams-v2.yaml": "d963b75d8b3b689a67e276f29024d7d2b58a4b4a79c11b9f2c112b30c5173156",
+    "api/v2/asyncapi.yaml": "a1d8826c7a8c6bc64361a1db69b607025988fc7fb64a2cb52cca0a79f9ace7c5",
+    "api/v2/openapi.yaml": "d9c1a78a13a32c653d148126c7dd086bd25e1394cac2f4a35db6290ffdc7fa3b",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "bd1c00fae7b6fda506a75aff841bbdc438d4ce092642a72041203bee999b88de",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -207,7 +207,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "e034d628d415045195718b3065abf8ac2df8ad2179804ac63ff04ad7d0e198bb",
+    "spec/v1/core-standard-manifest.json": "2ad9ad7d0d478da17f8b9829997c4fc9b905162e3c2b0c6e4828f50470f7f4e0",
     "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
@@ -309,9 +309,9 @@
     "spec/v2/path-manifest.json": "b84c7561f50c7df0cb61b202bd6595acad3ee7edca7a45f711949bea3c69bd27",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "68d8fd2c8ef4cca09f08ba43adece748ea97a2eb9a5218b899be543569dbe26a",
+    "spec/v2/release.json": "5b6e531003a3c47ed176f1f4fa1777b3b597cb386f31b1bfe4ac962df16ae4a3",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "94199023cd15ef90174eccbb457aa805ac4a60df858fe8dc11e96d599edc56ca"
+    "spec/v2/surface-baseline.json": "273566823eac3465b9f692c9cb795eca669e753bd0e733575b4722d176e115ce"
   },
-  "corpusCommit": "11150aa3a6506f9d679564bff000755897628922"
+  "corpusCommit": "725db8ec383cc3d61068846def2d5b90771b8933"
 }

package/src/lib/prompt-library-witness.ts

@@ -152,7 +152,15 @@ export async function fetchLeg(profile: MajorProfile, a: PromptAdverts, validate
   ] };
 }
 
-/** Leg: an ETag, when sent, revalidates to `304`. `getPromptTemplate` SHOULD send one; none is inapplicable. */
+/**
+ * Leg (advisory): an ETag, when sent, revalidates to `304`. v2 binds the host
+ * to nothing here: `getPromptTemplate` SHOULD send an ETag (host-services.md
+ * §prompts), and the `304` MUST in headers.md §Request headers covers only the
+ * discovery document and the run snapshot. So the leg passes on a `304` and
+ * records `inapplicable` otherwise; it is never failed (the
+ * `tool-catalog-projection` advisory precedent). Until 2.45.17 it failed on
+ * RFC 9110 alone, which no v2 rule imports for this read.
+ */
 export async function etagLeg(profile: MajorProfile, a: PromptAdverts): Promise<PromptOutcome> {
   const g = endpointsGate(a); if (g) return g;
   const t = await aTemplate(a);
@@ -161,7 +169,8 @@ export async function etagLeg(profile: MajorProfile, a: PromptAdverts): Promise<
   const etag = first.headers.get('etag');
   if (first.status !== 200 || etag === null || etag.length === 0) return { kind: 'skip', disposition: 'inapplicable', reason: `getPromptTemplate sent no ETag (status ${first.status}) — a SHOULD, so there is nothing to revalidate` };
   const again = await driver.get(tplPath(profile, a, t.templateId), { headers: { 'If-None-Match': etag } });
-  return { kind: 'observed', findings: [f(again.status === 304, `${DOC_LIB}; RFC 9110 §13.1.2`, `If-None-Match with the current ETag MUST answer 304 (got ${again.status})`)] };
+  if (again.status !== 304) return { kind: 'skip', disposition: 'inapplicable', reason: `advisory SHOULD not met: If-None-Match with the current ETag answered ${again.status}, not 304 — v2 binds 304 only on discovery and the run snapshot (headers.md), so this is recorded, never failed` };
+  return { kind: 'observed', findings: [f(true, `${DOC_LIB} (SHOULD); RFC 9110 §13.1.2`, 'If-None-Match with the current ETag answers 304')] };
 }
 
 /** Leg: an unknown template id is `404` with the error envelope. */

package/src/scenarios/v2-discovery-etag.test.ts

@@ -0,0 +1,86 @@
+/**
+ * v2 — the discovery document's conditional GET (`spec/v2/core/capabilities.md`
+ * §1; `headers.md` §Request headers). The v1 twin is the presence-gated leg in
+ * `discovery.test.ts`, which runs at major 1 only, so until 2.45.17 nothing
+ * witnessed this MUST at major 2.
+ *
+ * At v2 both halves are MUSTs: a host MUST emit a standard `ETag` on the
+ * discovery document and MUST honour `If-None-Match` with `304`. The 304
+ * carries no body and carries `OpenWOP-Version` like every response
+ * (versioning.md §1.4).
+ *
+ *   etag-emitted       the 200 carries a non-empty `ETag`;
+ *   etag-revalidates   a matching `If-None-Match` receives `304`, no body,
+ *                      `OpenWOP-Version` present; a non-matching one receives
+ *                      `200` with the document (control: a host that answers
+ *                      304 to any conditional request fails).
+ *
+ * The revalidation runs once per client spelling: `OpenWOP-Version: 2.0` and
+ * `2` (versioning.md §1: a host MUST accept both), and `2` with a wildcard `Accept`
+ * (curl, a default fetch). openwop-app's public origin answered `304` to the
+ * suite's own spelling and `200` to the bare one, so a single spelling hid a
+ * violation every other client sees.
+ *
+ * Measured against the PUBLIC origin a host is cut on. A front door that drops
+ * `If-None-Match` on the way to a correct origin (openwop-app, 2026-10-04:
+ * direct `304`, through the hosting rewrite `200`) fails here, as it should:
+ * the rule binds what clients reach.
+ *
+ * Dispositions: discovery unreadable ⇒ `blocked`. No other skip — the rule is
+ * unconditional at v2.
+ *
+ * @see spec/v2/core/capabilities.md §1
+ * @see spec/v2/core/headers.md §Request headers
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const DOC = 'spec/v2/core/capabilities.md §1';
+const ID_EMITTED = 'openwop.requirement.capabilities.discovery-etag-emitted';
+const ID_REVALIDATES = 'openwop.requirement.capabilities.discovery-etag-revalidates';
+const V2 = { 'OpenWOP-Version': '2.0' };
+/** The client spellings a host MUST treat alike (versioning.md §1). */
+const SPELLINGS: ReadonlyArray<Readonly<Record<string, string>>> = [
+  { 'OpenWOP-Version': '2.0' },
+  { 'OpenWOP-Version': '2' },
+  { 'OpenWOP-Version': '2', Accept: '*/*' },
+];
+const label = (h: Readonly<Record<string, string>>): string => Object.entries(h).map(([k, v]) => `${k}: ${v}`).join(', ');
+
+async function get(headers: Readonly<Record<string, string>> = V2): Promise<OpenWOPResponse | null> {
+  try { return await driver.get('/.well-known/openwop', { authenticated: false, headers: { ...headers } }); } catch { return null; }
+}
+
+describe('v2 discovery ETag (capabilities.md §1)', () => {
+  it('the discovery document carries an ETag', async () => {
+    const first = await get();
+    if (first === null || first.status !== 200) return softSkip('blocked', `v2 discovery unreachable (${first?.status ?? 'no response'})`);
+    const etag = first.headers.get('etag');
+    expect(etag !== null && etag.trim().length > 0, req(ID_EMITTED, DOC, `a host MUST emit a standard ETag on the discovery document (got ${etag === null ? 'none' : JSON.stringify(etag)})`)).toBe(true);
+  });
+
+  it('a matching If-None-Match receives 304 with no body and the version header; a non-matching one receives 200', async () => {
+    const first = await get();
+    if (first === null || first.status !== 200) return softSkip('blocked', `v2 discovery unreachable (${first?.status ?? 'no response'})`);
+    const etag = first.headers.get('etag');
+    if (etag === null || etag.trim().length === 0) return softSkip('inapplicable', 'no ETag to revalidate — the emitted-ETag leg records that MUST');
+
+    for (const spelling of SPELLINGS) {
+      const own = await get(spelling);
+      if (own === null || own.status !== 200) return softSkip('blocked', `v2 discovery unreachable under ${label(spelling)} (${own?.status ?? 'no response'})`);
+      const tag = own.headers.get('etag') ?? etag;
+      const hit = await get({ ...spelling, 'If-None-Match': tag });
+      if (hit === null) return softSkip('blocked', 'conditional GET unreachable (fetch failed)');
+      expect(hit.status, req(ID_REVALIDATES, DOC, `under ${label(spelling)}, a matching If-None-Match MUST receive 304 (got ${hit.status}; ETag sent ${tag}, answered ${String(hit.headers.get('etag'))})`)).toBe(304);
+      expect(hit.text.length, req(ID_REVALIDATES, 'spec/v2/core/headers.md §Request headers', `under ${label(spelling)}, the 304 MUST carry no body (got ${hit.text.length} byte(s))`)).toBe(0);
+      expect(hit.headers.get('openwop-version'), req(ID_REVALIDATES, 'spec/v2/core/versioning.md §1.4', `under ${label(spelling)}, the 304 carries OpenWOP-Version like every response`)).not.toBeNull();
+    }
+
+    const miss = await get({ ...V2, 'If-None-Match': '"openwop-conformance-no-such-tag"' });
+    if (miss === null) return softSkip('blocked', 'conditional GET unreachable (fetch failed)');
+    expect(miss.status, req(ID_REVALIDATES, DOC, `a non-matching If-None-Match MUST receive 200 with the document (got ${miss.status})`)).toBe(200);
+  });
+});

package/src/scenarios/v2-prompt-list-and-fetch.test.ts

@@ -8,7 +8,9 @@
  *               validates against the closed v2 PromptTemplate;
  *   filters     `?kind=system` and `?source=host` narrow;
  *   fetch       a listed template is fetched by id;
- *   etag        an ETag, when sent (a SHOULD), revalidates to `304`;
+ *   etag        advisory: an ETag, when sent (a SHOULD), revalidates to `304`;
+ *               a non-304 is recorded `inapplicable`, never failed (v2 binds
+ *               304 only on discovery and the run snapshot, headers.md);
  *   unknown     an unknown id is `404` with the v2 error envelope;
  *   gate off    NEW at v2, unaided: with `prompts.endpointsSupported` not
  *               advertised (the record absent, or the facet not `true`),
@@ -77,7 +79,7 @@ describe('v2 prompt library: read surface (host-services.md §prompts)', () => {
     for (const x of out.findings) expect(x.ok, req(ID_FETCH, x.doc, x.message)).toBe(true);
   });
 
-  it('an ETag, when sent, revalidates to 304', async () => {
+  it('advisory: an ETag, when sent, revalidates to 304', async () => {
     const r = await ready();
     if (!r.ok) return r.skip();
     const out = await etagLeg(PROFILE, r.a);

package/src/scenarios/v2-run-snapshot-etag.test.ts

@@ -7,6 +7,10 @@
  * a host that sends no ETag records `inapplicable`. Every response carries
  * `OpenWOP-Version` (versioning.md §1.4), the 304 included.
  *
+ * The revalidation runs once per client spelling (`OpenWOP-Version: 2.0`,
+ * `2`, and `2` with a wildcard Accept): a host MUST treat them alike
+ * (versioning.md §1), and one public origin served 304 to the first only.
+ *
  * Control: a non-matching `If-None-Match` MUST receive 200 with the body — a
  * host that answers 304 to any conditional request fails here. `headers.md`
  * scopes `If-None-Match` to the discovery document; runs.md applies it to the
@@ -27,6 +31,13 @@ import { req } from '../lib/requirement-ids.js';
 const ID = 'openwop.requirement.0170.run-snapshot-etag';
 const DOC = 'spec/v2/core/runs.md §Snapshot';
 const NOOP = 'conformance-noop';
+/** The client spellings a host MUST treat alike (versioning.md §1): openwop-app's public origin answered 304 to `2.0` and 200 to bare `2`. */
+const SPELLINGS: ReadonlyArray<Readonly<Record<string, string>>> = [
+  { 'OpenWOP-Version': '2.0' },
+  { 'OpenWOP-Version': '2' },
+  { 'OpenWOP-Version': '2', Accept: '*/*' },
+];
+const label = (h: Readonly<Record<string, string>>): string => Object.entries(h).map(([k, v]) => `${k}: ${v}`).join(', ');
 
 async function discovery(): Promise<Record<string, unknown> | null> { try { return await v2Discovery(); } catch { return null; } }
 async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
@@ -51,29 +62,31 @@ describe('v2 run-snapshot-etag (runs.md §Snapshot)', () => {
     // happened to finish inside the sleep. It also let a host with a CONSTANT tag
     // pass for the wrong reason, which the control below still catches.
     await pollUntilTerminal(runId, { timeoutMs: scaledTimeoutMs(30_000) });
-    let etag: string | null = null;
-    let hit: OpenWOPResponse | null = null;
-    // A terminal run should be still, but "should" is not the claim under test:
-    // if the tag moves again, take the NEW tag and retry. The violation is a 200
-    // whose ETag EQUALS the If-None-Match that was sent — never a 200 per se.
-    for (let attempt = 0; attempt < 4; attempt++) {
-      const first = await http(() => driver.get(path));
-      if (first === null || first.status !== 200) return softSkip('blocked', `GET /runs/{runId} answered ${first?.status ?? 'no response'}`);
-      etag = first.headers.get('etag');
-      if (!etag) return softSkip('inapplicable', 'the snapshot carries no ETag — runs.md §Snapshot makes the ETag a SHOULD; the 304 rule applies only when it is present');
-      const sent = etag;
-      hit = await http(() => driver.get(path, { headers: { 'If-None-Match': sent } }));
-      if (hit === null) return softSkip('blocked', 'conditional GET unreachable (fetch failed)');
-      if (hit.status !== 200 || hit.headers.get('etag') === sent) break; // 304, or the real violation: decided below
-      await new Promise((r) => setTimeout(r, 500)); // 200 with a DIFFERENT tag: the representation moved; the tag sent was honestly stale
-    }
-    if (hit === null || etag === null) return softSkip('blocked', 'no conditional GET was made');
-    if (hit.status === 200 && hit.headers.get('etag') !== etag) {
-      return softSkip('blocked', `the snapshot of a TERMINAL run kept changing across four reads (last tag sent ${etag}, answered 200 with ${String(hit.headers.get('etag'))}) — the 304 rule cannot be witnessed against a representation that never holds still`);
+    for (const spelling of SPELLINGS) {
+      let etag: string | null = null;
+      let hit: OpenWOPResponse | null = null;
+      // A terminal run should be still, but "should" is not the claim under test:
+      // if the tag moves again, take the NEW tag and retry. The violation is a 200
+      // whose ETag EQUALS the If-None-Match that was sent — never a 200 per se.
+      for (let attempt = 0; attempt < 4; attempt++) {
+        const first = await http(() => driver.get(path, { headers: { ...spelling } }));
+        if (first === null || first.status !== 200) return softSkip('blocked', `GET /runs/{runId} answered ${first?.status ?? 'no response'}`);
+        etag = first.headers.get('etag');
+        if (!etag) return softSkip('inapplicable', 'the snapshot carries no ETag — runs.md §Snapshot makes the ETag a SHOULD; the 304 rule applies only when it is present');
+        const sent = etag;
+        hit = await http(() => driver.get(path, { headers: { ...spelling, 'If-None-Match': sent } }));
+        if (hit === null) return softSkip('blocked', 'conditional GET unreachable (fetch failed)');
+        if (hit.status !== 200 || hit.headers.get('etag') === sent) break; // 304, or the real violation: decided below
+        await new Promise((r) => setTimeout(r, 500)); // 200 with a DIFFERENT tag: the representation moved; the tag sent was honestly stale
+      }
+      if (hit === null || etag === null) return softSkip('blocked', 'no conditional GET was made');
+      if (hit.status === 200 && hit.headers.get('etag') !== etag) {
+        return softSkip('blocked', `the snapshot of a TERMINAL run kept changing across four reads (last tag sent ${etag}, answered 200 with ${String(hit.headers.get('etag'))}) — the 304 rule cannot be witnessed against a representation that never holds still`);
+      }
+      expect(hit.status, req(ID, DOC, `under ${label(spelling)}, a request whose If-None-Match matches the CURRENT ETag MUST receive 304 — got ${hit.status} while the response still carried the same tag ${etag}`)).toBe(304);
+      expect(hit.text.length, req(ID, DOC, `under ${label(spelling)}, the 304 MUST carry no body (got ${hit.text.length} byte(s))`)).toBe(0);
+      expect(hit.headers.get('openwop-version'), req(ID, 'spec/v2/core/versioning.md §1.4', `under ${label(spelling)}, every response carries OpenWOP-Version, the 304 included`)).not.toBeNull();
     }
-    expect(hit.status, req(ID, DOC, `a request whose If-None-Match matches the CURRENT ETag MUST receive 304 — got ${hit.status} while the response still carried the same tag ${etag}`)).toBe(304);
-    expect(hit.text.length, req(ID, DOC, `the 304 MUST carry no body (got ${hit.text.length} byte(s))`)).toBe(0);
-    expect(hit.headers.get('openwop-version'), req(ID, 'spec/v2/core/versioning.md §1.4', 'every response carries OpenWOP-Version, the 304 included')).not.toBeNull();
     const miss = await http(() => driver.get(path, { headers: { 'If-None-Match': '"openwop-conformance-no-such-tag"' } }));
     if (miss === null) return softSkip('blocked', 'conditional GET unreachable (fetch failed)');
     expect(miss.status, req(ID, DOC, `a non-matching If-None-Match MUST receive 200 with the body — got ${miss.status} (a host answering 304 to any conditional request is not honouring the tag)`)).toBe(200);