@openwop/openwop-conformance 2.45.2 → 2.45.4

package/src/scenarios/secrets-run-witness.test.ts

@@ -0,0 +1,154 @@
+/**
+ * RFC 0229 — a production host can witness secret resolution without an oracle
+ * (`spec/v1/capabilities.md` §"Run-supplied secrets"; suite 2.45.3, target
+ * major 1; gated on `capabilities.secrets.runSecrets` and the
+ * `openwop-secrets-run-witness` fixture). The v2 twin is
+ * `v2-secrets-run-witness`, and the four rows are the same requirement ids.
+ *
+ * This file is the SECOND floor path of the v1 `openwop-secrets` profile
+ * (`profiles.md` §`openwop-secrets`): the floor is an any-of group, satisfied
+ * by a witnessed pass of either `byok-roundtrip.test.ts` or this file. A
+ * production host can take this path: the node reads only a `run:` ref, which
+ * resolves only to a value supplied with the same run, and outputs only
+ * `{ matched }`, so it is no oracle over a stored secret.
+ *
+ * Rows: `run-witness-resolves`, `run-witness-redacted`,
+ * `run-witness-scope-bound`, `run-secrets-outside-request-digest` — see the v2
+ * twin for what each observes. Dispositions (RFC 0229 §F): facet absent ⇒
+ * `inapplicable`; facet without the fixture ⇒ `blocked`; a `createRun` that
+ * refuses a well-formed `runSecrets` ⇒ `executed-fail`.
+ *
+ * @see spec/v1/capabilities.md §"Run-supplied secrets"
+ * @see spec/v1/profiles.md §openwop-secrets
+ * @see RFCS/0229-production-safe-secrets-witness.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { randomUUID } from 'node:crypto';
+import { req } from '../lib/requirement-ids.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
+import { CANARY_NAME, WITNESS_REF, WitnessHost, freshName, freshValue, hits, sha256Hex } from '../lib/run-secrets-witness.js';
+
+const DOC = 'capabilities.md §"Run-supplied secrets" (RFC 0229)';
+const host = new WitnessHost(1);
+
+interface Witnessed { runId: string; createText: string; status: string; matched: boolean | undefined; value: string; digestSupplied: boolean }
+type Outcome = { runs: [Witnessed, Witnessed] } | { skip: 'inapplicable' | 'blocked'; reason: string } | { refused: { status: number; detail: string } };
+
+/** Run A (`C`, `sha256(C)`) and run B (`D`, the digest of a different value), once per file. */
+let pair: Promise<Outcome> | undefined;
+function witnessedPair(): Promise<Outcome> {
+  pair ??= (async (): Promise<Outcome> => {
+    const g = await host.gate();
+    if (!g.ok) return { skip: g.kind, reason: g.reason };
+    const out: Witnessed[] = [];
+    for (const same of [true, false]) {
+      const value = freshValue();
+      const expected = same ? sha256Hex(value) : sha256Hex(freshValue());
+      const res = await host.create({ ref: WITNESS_REF, expectedSha256: expected }, [{ ref: WITNESS_REF, value }]);
+      if (res === null) return { skip: 'blocked', reason: 'POST /v1/runs unreachable (fetch failed)' };
+      const runId = (res.json as { runId?: unknown } | null)?.runId;
+      if (res.status !== 201 || typeof runId !== 'string') return { refused: { status: res.status, detail: `POST /v1/runs with a well-formed runSecrets answered ${res.status} ${readErrorCode(res.json) ?? ''}`.trim() } };
+      const snap = await host.waitTerminal(runId);
+      out.push({ runId, createText: res.text, status: String(snap?.['status']), matched: await host.matched(runId, snap), value, digestSupplied: same });
+    }
+    return { runs: [out[0]!, out[1]!] };
+  })();
+  return pair;
+}
+
+/** A run that must end in `witness`'s `node.failed`; returns the code, or a blocked reason. */
+async function failedCode(inputs: { ref: string; expectedSha256: string }, runSecrets?: ReadonlyArray<{ ref: string; value: string }>): Promise<{ code: string | null; status: string } | { reason: string }> {
+  const res = await host.create(inputs, runSecrets);
+  if (res === null) return { reason: 'POST /v1/runs unreachable (fetch failed)' };
+  const runId = (res.json as { runId?: unknown } | null)?.runId;
+  if (res.status !== 201 || typeof runId !== 'string') return { reason: `POST /v1/runs answered ${res.status} ${readErrorCode(res.json) ?? ''}`.trim() };
+  const snap = await host.waitTerminal(runId);
+  return { code: await host.nodeFailedCode(runId), status: String(snap?.['status']) };
+}
+
+describe('RFC 0229 — secrets-run-witness (gated on secrets.runSecrets + openwop-secrets-run-witness)', () => {
+  it('a run-supplied secret resolves intact: matched true for its digest, false for another', async () => {
+    const o = await witnessedPair();
+    if ('skip' in o) return softSkip(o.skip, o.reason);
+    const id = 'openwop.requirement.secrets.run-witness-resolves';
+    if ('refused' in o) {
+      expect(o.refused.status, req(id, DOC, `a host advertising runSecrets MUST accept a well-formed runSecrets on createRun (${o.refused.detail})`)).toBe(201);
+      return blockedDespiteAssertions(`${o.refused.detail} with no runId — no run to witness`);
+    }
+    const [a, b] = o.runs;
+    expect(a.status, req(id, DOC, 'the witness run with a matching digest MUST complete')).toBe('completed');
+    expect(b.status, req(id, DOC, 'the witness run with a different digest MUST complete (a mismatch is an output, not a failure)')).toBe('completed');
+    if (a.matched === undefined || b.matched === undefined) return blockedDespiteAssertions('the runs completed but witness\'s `matched` output was on no readable surface (node.completed outputs or the snapshot)');
+    expect(a.matched, req(id, DOC, 'witness MUST output matched: true when expectedSha256 is the digest of the supplied value')).toBe(true);
+    expect(b.matched, req(id, DOC, 'witness MUST output matched: false when expectedSha256 is the digest of a different value')).toBe(false);
+  }, 90_000);
+
+  it('a run-supplied secret appears on no readable surface, in any encoding or as its digest', async () => {
+    const o = await witnessedPair();
+    if ('skip' in o) return softSkip(o.skip, o.reason);
+    if ('refused' in o) return softSkip('blocked', `${o.refused.detail} — no run to scan (row run-witness-resolves convicts the refusal)`);
+    const id = 'openwop.requirement.secrets.run-witness-redacted';
+    for (const r of o.runs) {
+      const s = await host.surfaces(r.runId, [r.createText]);
+      expect(hits(s.text, r.value, r.digestSupplied), req(id, DOC, `the supplied value MUST NOT appear on any surface (read: ${s.read.join(', ')}), raw, base64, hex, percent- or JSON-encoded, or as its SHA-256 where the suite did not send that digest itself`)).toEqual([]);
+    }
+  }, 90_000);
+
+  it('a run: ref resolves only within the run that supplied it, and the witness refuses any other ref', async () => {
+    const g = await host.gate();
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const id = 'openwop.requirement.secrets.run-witness-scope-bound';
+    const v = freshValue();
+    const cases: Array<{ what: string; inputs: { ref: string; expectedSha256: string }; runSecrets?: Array<{ ref: string; value: string }>; code: string }> = [
+      { what: `the canary name ${CANARY_NAME}`, inputs: { ref: CANARY_NAME, expectedSha256: sha256Hex(v) }, runSecrets: [{ ref: WITNESS_REF, value: v }], code: 'credential_forbidden' },
+      { what: 'a fresh name without run:', inputs: { ref: freshName(), expectedSha256: sha256Hex(v) }, runSecrets: [{ ref: WITNESS_REF, value: v }], code: 'credential_forbidden' },
+      { what: `${WITNESS_REF} with no runSecrets`, inputs: { ref: WITNESS_REF, expectedSha256: sha256Hex(v) }, code: 'credential_not_found' },
+    ];
+    const earlier = freshValue();
+    const first = await host.create({ ref: WITNESS_REF, expectedSha256: sha256Hex(earlier) }, [{ ref: WITNESS_REF, value: earlier }]);
+    const firstId = (first?.json as { runId?: unknown } | null)?.runId;
+    if (first === null || first.status !== 201 || typeof firstId !== 'string') return softSkip('blocked', `the earlier run's POST /v1/runs answered ${first?.status ?? 'nothing'} ${readErrorCode(first?.json) ?? ''}`.trim());
+    await host.waitTerminal(firstId);
+    cases.push({ what: `an earlier run's ref (${WITNESS_REF}) while this run supplies only run:openwop-other`, inputs: { ref: WITNESS_REF, expectedSha256: sha256Hex(earlier) }, runSecrets: [{ ref: 'run:openwop-other', value: freshValue() }], code: 'credential_not_found' });
+    for (const c of cases) {
+      const r = await failedCode(c.inputs, c.runSecrets);
+      if ('reason' in r) return blockedDespiteAssertions(`${c.what}: ${r.reason}`);
+      expect(r.code, req(id, DOC, `${c.what}: witness MUST end in node.failed with ${c.code} (run status ${r.status})`)).toBe(c.code);
+    }
+    // §A.4: gated on replay advertising `branch` (RFC 0229 §F row 3).
+    if (g.branchFork) {
+      const fork = await host.fork(firstId);
+      const forkId = (fork?.json as { runId?: unknown } | null)?.runId;
+      // partial-witness-ok: the four scope legs above observed the requirement; this fork leg is conditional on a fork the host serves (the fork contract is not this row's)
+      if (fork === null || fork.status !== 201 || typeof forkId !== 'string') return softSkip('inapplicable', `replay advertises branch, but POST /v1/v1/runs/{runId}:fork answered ${fork?.status ?? 'nothing'} ${readErrorCode(fork?.json) ?? ''} — the fork leg did not run (rest-endpoints.md owns the fork contract)`.trim());
+      await host.waitTerminal(forkId);
+      expect(await host.nodeFailedCode(forkId), req(id, DOC, 'a branch fork taken before witness MUST NOT inherit runSecrets: witness fails credential_not_found')).toBe('credential_not_found');
+    }
+  }, 180_000);
+
+  it('the idempotency request digest excludes runSecrets: a retry differing only there replays, and its value is discarded', async () => {
+    const g = await host.gate();
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const id = 'openwop.requirement.secrets.run-secrets-outside-request-digest';
+    const key = `openwop-witness-${randomUUID()}`;
+    const c = freshValue();
+    const c2 = freshValue();
+    const inputs = { ref: WITNESS_REF, expectedSha256: sha256Hex(c) };
+    const first = await host.create(inputs, [{ ref: WITNESS_REF, value: c }], key);
+    const runId = (first?.json as { runId?: unknown } | null)?.runId;
+    if (first === null) return softSkip('blocked', 'POST /v1/runs unreachable (fetch failed)');
+    expect(first.status, req(id, DOC, 'a host advertising runSecrets MUST accept a well-formed runSecrets on createRun')).toBe(201);
+    if (typeof runId !== 'string') return blockedDespiteAssertions('the 201 carried no runId');
+    const retry = await host.create(inputs, [{ ref: WITNESS_REF, value: c2 }], key);
+    if (retry === null) return blockedDespiteAssertions('the same-key retry was unreachable (fetch failed)');
+    expect(readErrorCode(retry.json), req(id, `${DOC}; idempotency.md §Outcomes`, 'a same-key retry differing only in runSecrets MUST NOT be 409 idempotency_key_mismatch — the request digest MUST NOT cover runSecrets')).not.toBe('idempotency_key_mismatch');
+    expect(retry.status, req(id, DOC, 'the retry MUST be answered from cache with the original 201')).toBe(201);
+    expect((retry.json as { runId?: unknown } | null)?.runId, req(id, DOC, 'the retry MUST name the original runId')).toBe(runId);
+    expect(retry.headers.get('openwop-idempotent-replay'), req(id, 'idempotency.md §Outcomes', 'a response served from cache MUST carry OpenWOP-Idempotent-Replay: true')).toBe('true');
+    await host.waitTerminal(runId);
+    const s = await host.surfaces(runId, [first.text, retry.text]);
+    expect(hits(s.text, c2), req(id, DOC, `the retried value MUST be discarded unused: it appears on no surface of the run (read: ${s.read.join(', ')})`)).toEqual([]);
+  }, 90_000);
+});

package/src/scenarios/trigger-bridge-delivery.test.ts

@@ -2,29 +2,35 @@
  * Durable trigger bridge — delivery model (RFC 0083 §C) — behavioral.
  *
  * Profile-gated on `openwop-trigger-bridge` (derived from the live discovery
- * doc per RFC 0083 §D: the bridge advertised + a dead-letter sink + a durable
- * source). Soft-skips when the profile isn't derived (default) / hard-fails
- * under `OPENWOP_REQUIRE_BEHAVIOR=true`. The always-on wire-shape coverage
- * lives in `trigger-bridge-shape.test.ts`; this asserts host BEHAVIOR via the
- * `POST /v1/host/sample/trigger-bridge/deliver` seam + the test event-log seam:
+ * doc per RFC 0083 §D). Soft-skips when the profile isn't derived / hard-fails
+ * under `OPENWOP_REQUIRE_BEHAVIOR=true`. The always-on wire-shape coverage lives
+ * in `trigger-bridge-shape.test.ts`.
  *
- *   1. DEDUP (§C-1) — the same `dedupKey` delivered twice is effectively-once:
- *      exactly one `trigger.delivery.attempted { outcome:"delivered" }` for that
- *      key (at-least-once collapses to once within the retention window).
- *   2. RETRY → DEAD-LETTER (§C-2 + RFC 0053) — an exhausted retry policy lands a
- *      terminal `trigger.delivery.attempted { outcome:"dead-lettered" }` and a
- *      `trigger.subscription.state.changed { toState:"dead-lettered" }`; both
- *      content-free (SR-1: ids/states/counters only).
- *   3. CAUSATION (§C / RFC 0040) — a successful delivery's resulting run carries
- *      `run.started.causationId` == the delivery id (trigger → run is resolvable
- *      via `/ancestry`).
+ * Four legs, each its own requirement (RFC 0230 split the one combined `it`):
  *
- * Each leg soft-skips independently (seam absent / event-log seam absent).
+ *   1. DEDUP (§C-1) — a repeated delivery is effectively-once.
+ *   2. DEAD-LETTER (§C-2 + RFC 0053) — an exhausted/refused delivery starts no run.
+ *   3. CAUSATION (§C / RFC 0040) — a delivered run carries the delivery as
+ *      `run.started.causationId`.
+ *   4. RUN-LESS CONTENT-FREENESS (SR-1) — the run-less `trigger.*` events
+ *      (a dead-lettered attempt, `trigger.subscription.state.changed`) carry no
+ *      inbound content.
+ *
+ * TWO WITNESS PATHS. The SEAM path (primary, whenever the host serves them)
+ * drives `POST /v1/host/sample/trigger-bridge/deliver` and reads the test
+ * event-log seam. When the seams are absent — as they are on every production
+ * host — legs 1–3 run the NORMATIVE-SURFACE path of RFC 0230 if the host
+ * advertises `triggerBridge.ingestion.inboundSigning: ["standard-webhooks-1"]`:
+ * register a webhook subscription and POST Standard-Webhooks-signed bodies to its
+ * `ingestUrl` with no OpenWOP credential. Each row notes which path ran
+ * (`observed:`). Leg 4 has no normative-surface path — the run-less events are
+ * on no run's log — so it stays seam-witnessed and records seam-absent
+ * otherwise; it remains in the floor (the floor never narrows).
  *
  * Spec references:
- *   - https://github.com/openwop/openwop/blob/main/spec/v1/trigger-bridge.md (§C)
- *   - https://github.com/openwop/openwop/blob/main/RFCS/0083-durable-trigger-and-channel-bridge-profile.md
- *   - https://github.com/openwop/openwop/blob/main/spec/v1/profiles.md (§openwop-trigger-bridge)
+ *   - spec/v1/trigger-bridge.md (§C, §F.2, §F.6)
+ *   - RFCS/0083-durable-trigger-and-channel-bridge-profile.md, RFCS/0230-inbound-webhook-ingest-contract.md
+ *   - spec/v1/profiles.md (§openwop-trigger-bridge)
  */
 
 import { describe, it, expect } from 'vitest';
@@ -35,144 +41,195 @@ import {
   driveDelivery,
   DELIVERY_OUTCOMES,
   SUBSCRIPTION_STATES,
+  freshDedupKey,
+  inboundSigningAdvertised,
+  registerSignedWebhook,
+  signedIngest,
+  freshWebhookId,
 } from '../lib/triggerBridge.js';
 import { queryTestEvents, requireEvents, isEventLogSeamAvailable, resetTestSeam } from '../lib/event-log-query.js';
 import { req } from '../lib/requirement-ids.js';
-import { freshDedupKey } from '../lib/triggerBridge.js';
+import { noteObservation } from '../lib/row-observation.js';
+import { driver } from '../lib/driver.js';
+
+const R_DEDUP = 'openwop.requirement.0083.trigger-delivery.dedup';
+const R_DEAD_LETTER = 'openwop.requirement.0083.trigger-delivery.dead-letter';
+const R_CAUSATION = 'openwop.requirement.0083.trigger-delivery.causation';
+const R_RUNLESS = 'openwop.requirement.0083.trigger-delivery.runless-content-free';
 
 const CONTENT_FREE_FORBIDDEN = ['body', 'headers', 'payload', 'secret', 'credentials', 'token', 'apiKey'];
 
-function expectContentFree(payload: Record<string, unknown>, where: string): void {
+function expectContentFree(id: string, payload: Record<string, unknown>, where: string): void {
   for (const f of CONTENT_FREE_FORBIDDEN) {
-    expect(
-      !(f in payload),
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'RFC 0083 §C (SR-1)', `${where} MUST be content-free (no ${f})`),
-    ).toBe(true);
+    expect(!(f in payload), req(id, 'RFC 0083 §C (SR-1)', `${where} MUST be content-free (no ${f})`)).toBe(true);
   }
 }
 
-describe('trigger-bridge-delivery (RFC 0083 §C)', () => {
-  it('de-dups by dedupKey, retries to dead-letter, and links delivery→run causation', async () => {
-    if (!behaviorGate('openwop-trigger-bridge', await isTriggerBridgeProfileAdvertised())) return;
-    if (!(await isEventLogSeamAvailable())) return seamAbsent('host advertises openwop-trigger-bridge but the event-log seam is absent');
-
-    // ---- Leg 1: dedup → effectively-once (§C-1) ---------------------------
-    //
-    // The dedupKey is MINTED PER EXERCISE, and that is load-bearing (2.37.0).
-    // It used to be the literal `'conformance-dedup-key'`, and §C-1's dedup
-    // window is a ≥24h FLOOR — so the second run of this file against the same
-    // host, any time that day, hands the bridge a key it has already delivered.
-    // A CONFORMANT host then collapses the whole exercise into the first run's
-    // outcome and emits ZERO `delivered` attempts under this run's id, and the
-    // `=== 1` below convicts it. Cold host passes, warm host fails, nothing
-    // about the host having changed — the same shape as the RFC 0158 row that
-    // shared one effect identity between two files (`lib/effect-receiver.ts`).
-    // The REPETITION that §C-1 is about happens INSIDE `driveDelivery`'s
-    // `scenario: 'dedup'`, so a fresh key per exercise removes the cross-run
-    // collision without weakening the clause.
+type Path = 'seam' | 'normative' | null;
+
+/** Which witness path this host supports: the seams when present, else RFC 0230's. */
+async function witnessPath(): Promise<Path> {
+  if (await isEventLogSeamAvailable()) return 'seam';
+  if (await inboundSigningAdvertised()) return 'normative';
+  return null;
+}
+
+const NO_PATH = 'host advertises openwop-trigger-bridge but neither the event-log seam nor an RFC 0230 inboundSigning ingest is available';
+
+/** The bare opaque id of a (possibly tenant-bound) runId — the v1 read path. */
+function bareRunId(runId: string): string {
+  return runId.includes('/') ? runId.slice(runId.lastIndexOf('/') + 1) : runId;
+}
+
+/** The seam witness path (primary when the host serves the seams). */
+async function dedupViaSeam(): Promise<undefined> {
+    // The dedupKey is MINTED PER EXERCISE, and that is load-bearing (2.37.0):
+    // §C-1's dedup window is a ≥24h floor, so a literal key collides with an
+    // earlier run the same day and convicts a conformant host. The repetition
+    // §C-1 is about happens INSIDE `driveDelivery`'s `scenario: 'dedup'`.
     const dedupKey = freshDedupKey('queue');
     const dedup = await driveDelivery({ scenario: 'dedup', dedupKey, source: 'queue' });
     if (dedup === null) return seamAbsent('host advertises openwop-trigger-bridge but the delivery seam is unwired');
-
-    // The profile is derived AND the seam is wired — missing evidence is a
-    // FAILURE, not a soft-skip. A repeated dedupKey MUST be effectively-once:
-    // EXACTLY one delivered attempt for the key (zero would mean no delivery at all).
-    const dedupQueryId = dedup.runId ?? '__dedup__';
     const dedupEvents = requireEvents(
-      await queryTestEvents(dedupQueryId, { type: 'trigger.delivery.attempted' }),
+      await queryTestEvents(dedup.runId ?? '__dedup__', { type: 'trigger.delivery.attempted' }),
       'trigger.delivery.attempted (dedup)',
     );
-    const deliveredForKey = dedupEvents.filter(
-      (e) => e.payload.dedupKey === dedupKey && e.payload.outcome === 'delivered',
-    );
-    expect(
-      deliveredForKey.length === 1,
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §C-1', 'a repeated dedupKey MUST be effectively-once — EXACTLY one delivered attempt (not zero, not two)'),
-    ).toBe(true);
+    const deliveredForKey = dedupEvents.filter((e) => e.payload.dedupKey === dedupKey && e.payload.outcome === 'delivered');
+    expect(deliveredForKey.length === 1, req(R_DEDUP, 'trigger-bridge.md §C-1', 'a repeated dedupKey MUST be effectively-once — EXACTLY one delivered attempt (not zero, not two)')).toBe(true);
     for (const e of dedupEvents) {
-      expect(
-        typeof e.payload.outcome === 'string' && DELIVERY_OUTCOMES.includes(e.payload.outcome as string),
-        req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'run-event-payloads.schema.json#triggerDeliveryAttempted', 'outcome MUST be delivered|retrying|dead-lettered'),
-      ).toBe(true);
-      expectContentFree(e.payload, 'trigger.delivery.attempted');
+      expect(typeof e.payload.outcome === 'string' && DELIVERY_OUTCOMES.includes(e.payload.outcome as string), req(R_DEDUP, 'run-event-payloads.schema.json#triggerDeliveryAttempted', 'outcome MUST be delivered|retrying|dead-lettered')).toBe(true);
+      expectContentFree(R_DEDUP, e.payload, 'trigger.delivery.attempted');
     }
+    noteObservation('seam path');
+    await resetTestSeam();
+  return undefined;
+}
 
-    // ---- Leg 2: retry → dead-letter (§C-2 + RFC 0053) --------------------
+/** The seam witness path (primary when the host serves the seams). */
+async function deadLetterViaSeam(): Promise<undefined> {
     const exhaust = await driveDelivery({ scenario: 'exhaust', source: 'webhook' });
-    expect(
-      exhaust !== null,
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §C-2', 'the exhaust scenario MUST be wired when the delivery seam is'),
-    ).toBe(true);
-    const exKey = exhaust!.runId ?? '__exhaust__';
-    const exhaustEvents = requireEvents(
-      await queryTestEvents(exKey, { type: 'trigger.delivery.attempted' }),
-      'trigger.delivery.attempted (exhaust)',
-    );
-    expect(
-      exhaustEvents.length >= 1,
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §C-2', 'an exhausted delivery MUST emit ≥1 trigger.delivery.attempted'),
-    ).toBe(true);
+    if (exhaust === null) return seamAbsent('host advertises openwop-trigger-bridge but the delivery seam is unwired');
+    const exKey = exhaust.runId ?? '__exhaust__';
+    const exhaustEvents = requireEvents(await queryTestEvents(exKey, { type: 'trigger.delivery.attempted' }), 'trigger.delivery.attempted (exhaust)');
+    expect(exhaustEvents.length >= 1, req(R_DEAD_LETTER, 'trigger-bridge.md §C-2', 'an exhausted delivery MUST emit ≥1 trigger.delivery.attempted')).toBe(true);
     const terminal = exhaustEvents.sort((a, b) => a.sequence - b.sequence)[exhaustEvents.length - 1]!;
-    expect(
-      terminal.payload.outcome === 'dead-lettered',
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §C-2', 'an exhausted retry policy MUST terminate in a dead-lettered delivery'),
-    ).toBe(true);
-    const stateEvents = requireEvents(
-      await queryTestEvents(exKey, { type: 'trigger.subscription.state.changed' }),
-      'trigger.subscription.state.changed (exhaust)',
-    );
-    expect(
-      stateEvents.length >= 1,
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §B', 'exhaustion MUST emit ≥1 trigger.subscription.state.changed'),
-    ).toBe(true);
-    expect(
-      stateEvents.some((e) => e.payload.toState === 'dead-lettered'),
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §B', 'the subscription MUST transition to dead-lettered on exhaustion'),
-    ).toBe(true);
+    expect(terminal.payload.outcome === 'dead-lettered', req(R_DEAD_LETTER, 'trigger-bridge.md §C-2', 'an exhausted retry policy MUST terminate in a dead-lettered delivery')).toBe(true);
+    const stateEvents = requireEvents(await queryTestEvents(exKey, { type: 'trigger.subscription.state.changed' }), 'trigger.subscription.state.changed (exhaust)');
+    expect(stateEvents.length >= 1, req(R_DEAD_LETTER, 'trigger-bridge.md §B', 'exhaustion MUST emit ≥1 trigger.subscription.state.changed')).toBe(true);
+    expect(stateEvents.some((e) => e.payload.toState === 'dead-lettered'), req(R_DEAD_LETTER, 'trigger-bridge.md §B', 'the subscription MUST transition to dead-lettered on exhaustion')).toBe(true);
     for (const e of stateEvents) {
-      expect(
-        typeof e.payload.toState === 'string' && SUBSCRIPTION_STATES.includes(e.payload.toState as string),
-        req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §B', 'toState MUST be in the four-state vocabulary'),
-      ).toBe(true);
-      expectContentFree(e.payload, 'trigger.subscription.state.changed');
+      expect(typeof e.payload.toState === 'string' && SUBSCRIPTION_STATES.includes(e.payload.toState as string), req(R_DEAD_LETTER, 'trigger-bridge.md §B', 'toState MUST be in the four-state vocabulary')).toBe(true);
     }
+    noteObservation('seam path');
+    await resetTestSeam();
+  return undefined;
+}
 
-    // ---- Leg 3: delivery → run causation (§C / RFC 0040) -----------------
-    // §C: "the run started by a successful delivery MUST carry the delivery's
-    // id as causationId on its run.started." The delivery's id is the
-    // trigger.delivery.attempted{delivered} event's id, so we assert EQUALITY
-    // (not merely "a causation id exists") — the trigger→run link MUST resolve.
+/** The seam witness path (primary when the host serves the seams). */
+async function causationViaSeam(): Promise<undefined> {
     const delivered = await driveDelivery({ scenario: 'deliver', source: 'schedule' });
-    expect(
-      delivered !== null && typeof delivered.runId === 'string' && (delivered.runId as string).length > 0,
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §C', 'a successful delivery MUST create a run'),
-    ).toBe(true);
+    expect(delivered !== null && typeof delivered.runId === 'string' && (delivered.runId as string).length > 0, req(R_CAUSATION, 'trigger-bridge.md §C', 'a successful delivery MUST create a run')).toBe(true);
     const deliveredRunId = delivered!.runId as string;
-    const attemptEvents = requireEvents(
-      await queryTestEvents(deliveredRunId, { type: 'trigger.delivery.attempted' }),
-      'trigger.delivery.attempted (deliver)',
-    );
+    const attemptEvents = requireEvents(await queryTestEvents(deliveredRunId, { type: 'trigger.delivery.attempted' }), 'trigger.delivery.attempted (deliver)');
     const deliveredEvent = attemptEvents.find((e) => e.payload.outcome === 'delivered');
-    expect(
-      deliveredEvent !== undefined,
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §C-1', 'a successful delivery MUST emit a trigger.delivery.attempted{outcome:delivered}'),
-    ).toBe(true);
-    const runStartedEvents = requireEvents(
-      await queryTestEvents(deliveredRunId, { type: 'run.started' }),
-      'run.started (deliver)',
-    );
-    expect(
-      runStartedEvents.length >= 1,
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §C', 'a delivered run MUST emit run.started'),
-    ).toBe(true);
+    expect(deliveredEvent !== undefined, req(R_CAUSATION, 'trigger-bridge.md §C-1', 'a successful delivery MUST emit a trigger.delivery.attempted{outcome:delivered}')).toBe(true);
+    const runStartedEvents = requireEvents(await queryTestEvents(deliveredRunId, { type: 'run.started' }), 'run.started (deliver)');
+    expect(runStartedEvents.length >= 1, req(R_CAUSATION, 'trigger-bridge.md §C', 'a delivered run MUST emit run.started')).toBe(true);
     const runStarted = runStartedEvents.sort((a, b) => a.sequence - b.sequence)[0]!;
     expect(
-      typeof runStarted.causationId === 'string' &&
-        (runStarted.causationId as string).length > 0 &&
-        runStarted.causationId === deliveredEvent!.eventId,
-      req('openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation', 'trigger-bridge.md §C / RFC 0040', 'run.started.causationId MUST EQUAL the delivery id (the trigger.delivery.attempted{delivered} eventId) — resolvable via /ancestry'),
+      typeof runStarted.causationId === 'string' && (runStarted.causationId as string).length > 0 && runStarted.causationId === deliveredEvent!.eventId,
+      req(R_CAUSATION, 'trigger-bridge.md §C / RFC 0040', 'run.started.causationId MUST EQUAL the delivery id (the trigger.delivery.attempted{delivered} eventId) — resolvable via /ancestry'),
     ).toBe(true);
+    noteObservation('seam path');
+    await resetTestSeam();
+  return undefined;
+}
+
+describe('trigger-bridge-delivery (RFC 0083 §C)', () => {
+  it('de-dups by dedupKey: a repeated delivery is effectively-once', async () => {
+    if (!behaviorGate('openwop-trigger-bridge', await isTriggerBridgeProfileAdvertised())) return;
+    const path = await witnessPath();
+    if (path === null) return seamAbsent(NO_PATH);
 
+    if (path === 'seam') return dedupViaSeam();
+
+    // Normative-surface path (RFC 0230 §C Identity + §D).
+    const sub = await registerSignedWebhook('none');
+    if ('reason' in sub) throw new Error(req(R_DEDUP, 'trigger-bridge.md §F.6', `an inboundSigning host MUST return the §B binding on webhook registration: ${sub.reason}`));
+    const body = JSON.stringify({ conformance: 'dedup' });
+    const webhookId = freshWebhookId();
+    const first = await signedIngest(sub, body, { webhookId });
+    expect(first.status, req(R_DEDUP, 'trigger-bridge.md §F.6', `a signed delivery MUST answer 202 (got ${first.status} ${JSON.stringify(first.json)})`)).toBe(202);
+    const runId = first.json?.runId;
+    expect(typeof runId === 'string' && runId.length > 0, req(R_DEDUP, 'trigger-bridge.md §F.6', 'a 202 MUST carry the started runId')).toBe(true);
+    const again = await signedIngest(sub, body, { webhookId });
+    expect(again.status, req(R_DEDUP, 'trigger-bridge.md §F.6 / §C-1', `a repeated webhook-id MUST answer 200 duplicate, starting no new run (got ${again.status})`)).toBe(200);
+    expect(again.json?.outcome, req(R_DEDUP, 'trigger-bridge.md §F.6', 'the dedup no-op MUST say outcome "duplicate"')).toBe('duplicate');
+    expect(again.json?.runId, req(R_DEDUP, 'trigger-bridge.md §F.4', 'a dedup no-op MUST return the PRIOR runId')).toBe(runId);
+    noteObservation('normative-surface path (RFC 0230)');
+  });
+
+  it('dead-letters an exhausted or refused delivery without starting a run', async () => {
+    if (!behaviorGate('openwop-trigger-bridge', await isTriggerBridgeProfileAdvertised())) return;
+    const path = await witnessPath();
+    if (path === null) return seamAbsent(NO_PATH);
+
+    if (path === 'seam') return deadLetterViaSeam();
+
+    // Normative-surface path (RFC 0230 §C Verification + §C.1).
+    const sub = await registerSignedWebhook('required');
+    if ('reason' in sub) throw new Error(req(R_DEAD_LETTER, 'trigger-bridge.md §F.6', `an inboundSigning host MUST return the §B binding on webhook registration: ${sub.reason}`));
+    const body = JSON.stringify({ conformance: 'dead-letter' });
+    const bad = await signedIngest(sub, body, { signature: 'v1,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=' });
+    expect(bad.status, req(R_DEAD_LETTER, 'trigger-bridge.md §F.6', `a bad signature under required verification MUST answer 401 (got ${bad.status})`)).toBe(401);
+    expect(bad.json?.runId, req(R_DEAD_LETTER, 'trigger-bridge.md §F.2', 'a required-verification failure MUST NOT start a run')).toBeUndefined();
+    const read = await driver.get(`/v1/trigger-subscriptions/${encodeURIComponent(sub.subscriptionId)}`);
+    const state = (read.json as { subscription?: { state?: unknown } } | undefined)?.subscription?.state;
+    expect(state, req(R_DEAD_LETTER, 'trigger-bridge.md §F.6 (RFC 0230 §C.1)', `a refused post MUST NOT change the subscription's state (got ${String(state)})`)).toBe('active');
+    const ok = await signedIngest(sub, body);
+    expect(ok.status, req(R_DEAD_LETTER, 'trigger-bridge.md §F.6 (RFC 0230 §C.1)', `after a refused post the subscription MUST still deliver a correctly signed one (got ${ok.status})`)).toBe(202);
+    noteObservation('normative-surface path (RFC 0230)');
+  });
+
+  it('links delivery→run causation on run.started', async () => {
+    if (!behaviorGate('openwop-trigger-bridge', await isTriggerBridgeProfileAdvertised())) return;
+    const path = await witnessPath();
+    if (path === null) return seamAbsent(NO_PATH);
+
+    if (path === 'seam') return causationViaSeam();
+
+    // Normative-surface path: a signed delivery, then the run's own event log.
+    const sub = await registerSignedWebhook('none');
+    if ('reason' in sub) throw new Error(req(R_CAUSATION, 'trigger-bridge.md §F.6', `an inboundSigning host MUST return the §B binding on webhook registration: ${sub.reason}`));
+    const res = await signedIngest(sub, JSON.stringify({ conformance: 'causation' }));
+    expect(res.status, req(R_CAUSATION, 'trigger-bridge.md §F.6', `a signed delivery MUST answer 202 (got ${res.status})`)).toBe(202);
+    const runId = res.json?.runId;
+    expect(typeof runId === 'string' && runId.length > 0, req(R_CAUSATION, 'trigger-bridge.md §F.6', 'a 202 MUST carry the started runId')).toBe(true);
+    const poll = await driver.get(`/v1/runs/${encodeURIComponent(bareRunId(String(runId)))}/events/poll`);
+    const events = ((poll.json as { events?: Array<Record<string, unknown>> } | undefined)?.events ?? []);
+    const started = events.find((e) => e.type === 'run.started');
+    expect(started !== undefined, req(R_CAUSATION, 'trigger-bridge.md §C', `a delivered run MUST emit run.started (poll answered ${poll.status}; saw ${events.map((e) => e.type).join(',') || 'none'})`)).toBe(true);
+    const causationId = started?.causationId;
+    expect(typeof causationId === 'string' && causationId.length > 0, req(R_CAUSATION, 'trigger-bridge.md §C / RFC 0040', 'run.started MUST carry the delivery id as causationId')).toBe(true);
+    const deliveredEvent = events.find((e) => e.type === 'trigger.delivery.attempted' && (e.payload as Record<string, unknown> | undefined)?.outcome === 'delivered');
+    if (deliveredEvent !== undefined) {
+      expect(causationId, req(R_CAUSATION, 'trigger-bridge.md §C / RFC 0040', 'run.started.causationId MUST EQUAL the delivered attempt event id')).toBe(deliveredEvent.eventId);
+      expectContentFree(R_CAUSATION, (deliveredEvent.payload ?? {}) as Record<string, unknown>, 'trigger.delivery.attempted');
+    }
+    noteObservation(`normative-surface path (RFC 0230)${deliveredEvent === undefined ? '; the delivered attempt event is not on the run log, so equality was not checked' : ''}`);
+  });
+
+  it('keeps the run-less trigger events content-free', async () => {
+    if (!behaviorGate('openwop-trigger-bridge', await isTriggerBridgeProfileAdvertised())) return;
+    // No normative-surface path: a dead-lettered attempt and a state change are
+    // on no run's log, so only the seam can read them (RFC 0230 §Conformance).
+    if (!(await isEventLogSeamAvailable())) return seamAbsent('the run-less trigger events are readable only through the event-log seam, which is absent');
+    const exhaust = await driveDelivery({ scenario: 'exhaust', source: 'webhook' });
+    if (exhaust === null) return seamAbsent('host advertises openwop-trigger-bridge but the delivery seam is unwired');
+    const exKey = exhaust.runId ?? '__exhaust__';
+    for (const type of ['trigger.delivery.attempted', 'trigger.subscription.state.changed'] as const) {
+      for (const e of requireEvents(await queryTestEvents(exKey, { type }), `${type} (exhaust)`)) expectContentFree(R_RUNLESS, e.payload, type);
+    }
     await resetTestSeam();
   });
 });