@openwop/openwop-conformance 2.45.16 → 2.45.18

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.18] — 2026-10-04 — `If-None-Match` per RFC 9110 (RFC 0235); corpus-only legs leave the host bundle; `.supported` leaves the v2 schemas
+
+- **Seven `v2-*-static` scenarios move to `src/coherence/`.** They read only the corpus, and `conformance.md` §Two products says such a check MUST NOT appear in a host bundle. The bundle schema now excludes their ids.
+- **`v2-envelope-tier-one-subset-static` is split.** The universal-kind walk moves to the corpus gate `v2-envelope-tier-one-universal-static`; the scenario keeps the strict leg, which reads the host's advertised kinds.
+- **No `X.supported` in a v2 schema description.** About 38 descriptions across 15 schemas named a `supported` flag that v2 does not have (`capabilities.md` §2: presence is the claim). They now say "advertises `X`". No rule changed.
+- **RFC 0235: `If-None-Match` is evaluated as RFC 9110 defines it.** `v2-discovery-etag` and `v2-run-snapshot-etag` gain legs over one shared library (`lib/if-none-match-witness.ts`): a weak tag, a list holding the tag and `*` get `304` while other tags get `200` (`rfc9110-match`); every `304` carries the `ETag` and the `200`'s `Vary` (`304-carries-etag`); `Cache-Control: no-cache` does not suppress evaluation (`no-cache-ignored`); and on the snapshot, `*` or a minted tag on a run id that does not exist gets the unconditional status, never `304` (`only-on-2xx`). Proof: a self-test double turns on one defect at a time (byte-exact, no list, no `*`, strong-only, no `ETag` or `Vary` on the `304`, `no-cache` skipping, always-`304`, `*` before the readability check), and the v2 reference host fails `rfc9110-match` before openwop-examples #152 and passes all ten legs after it. Node's fetch adds `Cache-Control: no-cache` to every conditional request, so a host that skips evaluation on it fails every 304 leg.
+- **Comment and citation fixes.** The two 304 scenarios no longer blame the client spelling (the cause was a CDN edge). `otel-emission-grpc` no longer cites RFC 0008, which made the coverage report attribute it to `nodePackRuntimes`.
+
+## [2.45.17] — 2026-10-04 — ETag rules: discovery's 304 gains a major-2 witness, the prompt-template 304 becomes advisory
+
+- **New `v2-discovery-etag`.** `capabilities.md` §1 makes both halves MUSTs at v2: emit an `ETag` on the discovery document, and answer a matching `If-None-Match` with `304` (no body, `OpenWOP-Version` present; a non-matching one gets `200`). The only witness was the v1 `discovery.test.ts` leg, so nothing checked it at major 2. openwop-app's public origin answers `200` because the hosting rewrite drops `If-None-Match` (direct to the origin: `304`), and its 2.45.16 cut certified anyway.
+- **Both 304 witnesses revalidate under every client spelling.** `v2-discovery-etag` and `v2-run-snapshot-etag` now send `OpenWOP-Version: 2.0`, then `2`, then `2` with a wildcard `Accept`; versioning.md §1 says a host MUST accept both version spellings. The snapshot leg had passed on openwop-app's public origin, which answers `304` to `2.0` (the suite's only spelling until now) and `200` to bare `2`.
+- **`openwop.requirement.prompts.etag-revalidation` is advisory.** v2 says only that `getPromptTemplate` SHOULD send an `ETag`, and `headers.md` scopes the `304` MUST to discovery and the run snapshot. The leg rested on RFC 9110 alone. It now passes on a `304` and records `inapplicable` otherwise, never failed (the `tool-catalog-projection` precedent).
+- **Proof:** the new scenario was run against a double in four modes. A conforming double passes. No ETag fails the emitted leg. A dropped `If-None-Match` fails the revalidation leg, and so does a host answering `304` to every conditional request. A double that drops it only for bare `2`, or only for `2` with a wildcard `Accept`, fails both 304 witnesses.
+
 ## [2.45.16] — 2026-10-04 — witness waves 2 and 3: every core family gains a major-2 witness
 
 - **Advertisement witnesses** for ten families: `selfHostedRunner`, `credentials`, `authorization`, `providerUsage`, `subWorkflow`, `scheduling`, `artifactTypes`, `aiEnvelope`, `deadLetter` and `portability`. Each validates its v2 record plus the facet checks the v2 prose states. No `supported` leg is ported: presence is the claim (capabilities.md:50).

package/README.md

@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 648 scenario files under `src/scenarios/`.
+The current suite has 642 scenario files under `src/scenarios/`.
 - 2026-09-29 (suite 2.45.0, openwop#1763): NEW `v2-cors-preflight.test.ts` — `headers.md` §Cross-origin preflight. For every operation it preflights with `Origin`, the method, and the operation's declared request headers (plus `authorization` / `content-type` where they apply, from `spec/v2/path-manifest.json`), and reads the answer as the Fetch standard's CORS-preflight check does. Self-gated: `inapplicable` when no operation's preflight grants `OPENWOP_CORS_ORIGIN` (default `https://conformance.invalid`).
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
@@ -482,7 +482,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 648 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 642 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.16",
-  "stampSha256": "c610c19acb41b926293269611f14cb30b5fcf60565f5d64d22e06dcbf1631e89"
+  "version": "2.45.18",
+  "stampSha256": "ebbae5f7e2d21d3cceb270610d2c4e808e9fe98ab7b6e282960281b36fb60d1b"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.16",
+  "version": "2.45.18",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.16"
+    "@openwop/spec-artifacts": "2.45.18"
   }
 }