@openwop/openwop-conformance 2.45.20 → 2.45.21

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.21] — 2026-10-05 — `0236.webhook.host-variant` gets its own row
+
+- **`v2-host-event-delivery`: no-fan-out is its own `it`.** A bundle records one requirement id per `it` (the last one asserted), so the webhook `it` that asserted host-variant and then no-fan-out recorded only no-fan-out. Found by the v2 reference host's 2.45.20 loopback rehearsal: five of the six RFC 0236 ids appeared. The new `it` re-runs the same gate, so a host without the families records the same disposition.
+
 ## [2.45.20] — 2026-10-05 — host events (RFC 0236 Active); `channelPresence` delivery witnessed through the §13 seam at v2
 
 - **New `v2-channel-presence-delivery` (seam-gated).** `conversation.md` now restates two RFC 0110 rules: a host advertising `channelPresence` MUST emit it, and MUST NOT deliver it to a non-member. Two legs check them through the snapshot seam, asking as the member first so an unwired seam is never read as a refusal.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.20",
-  "stampSha256": "3fedfa905f02f5fc87e0ecea242b9485a56be19b66f7cb2e04c37d6785888604"
+  "version": "2.45.21",
+  "stampSha256": "ee91d9e41fbcdc73f379cf977fee5ac3e44590a80349c693da2cc5f3a566c68b"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.20",
+  "version": "2.45.21",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.20"
+    "@openwop/spec-artifacts": "2.45.21"
   }
 }

package/requirements.json

@@ -3,8 +3,8 @@
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
     "files": 728,
-    "tests": 2762,
-    "withStableId": 2762,
+    "tests": 2763,
+    "withStableId": 2763,
     "interpolatedTitles": 0,
     "explicitIds": 2626
   },
@@ -31509,7 +31509,7 @@
     {
       "id": "openwop.it.v2-host-event-delivery.an-emitted-durable-host-event-arrives-on-host-events-as-a-valid-envelope",
       "file": "v2-host-event-delivery.test.ts",
-      "line": 122,
+      "line": 131,
       "title": "an emitted durable host event arrives on /host/events as a valid envelope",
       "explicitId": "openwop.requirement.0236.host-event.envelope",
       "citations": [
@@ -31522,7 +31522,7 @@
     {
       "id": "openwop.it.v2-host-event-delivery.an-ephemeral-host-event-has-no-id-and-is-not-redelivered-after-last-event-id",
       "file": "v2-host-event-delivery.test.ts",
-      "line": 136,
+      "line": 145,
       "title": "an ephemeral host event has no id: and is not redelivered after Last-Event-ID",
       "explicitId": null,
       "citations": []
@@ -31530,7 +31530,7 @@
     {
       "id": "openwop.it.v2-host-event-delivery.registerwebhook-refuses-an-ephemeral-host-event-type-with-400-validation-error",
       "file": "v2-host-event-delivery.test.ts",
-      "line": 153,
+      "line": 162,
       "title": "registerWebhook refuses an ephemeral host-event type with 400 validation_error",
       "explicitId": "openwop.requirement.0236.webhook.ephemeral-refused",
       "citations": [
@@ -31546,10 +31546,10 @@
       ]
     },
     {
-      "id": "openwop.it.v2-host-event-delivery.a-subscribed-durable-host-event-is-delivered-as-hostevent-signed-the-ephemeral-o",
+      "id": "openwop.it.v2-host-event-delivery.a-subscribed-durable-host-event-is-delivered-as-hostevent-signed",
       "file": "v2-host-event-delivery.test.ts",
-      "line": 166,
-      "title": "a subscribed durable host event is delivered as { hostEvent }, signed; the ephemeral one is not",
+      "line": 175,
+      "title": "a subscribed durable host event is delivered as { hostEvent }, signed",
       "explicitId": "openwop.requirement.0236.webhook.host-variant",
       "citations": [
         {
@@ -31559,10 +31559,18 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-host-event-delivery.the-same-subscription-never-receives-the-ephemeral-host-event",
+      "file": "v2-host-event-delivery.test.ts",
+      "line": 211,
+      "title": "the same subscription never receives the ephemeral host event",
+      "explicitId": null,
+      "citations": []
+    },
     {
       "id": "openwop.it.v2-host-event-delivery.a-second-tenant-receives-nothing-for-the-first-tenant-s-host-event",
       "file": "v2-host-event-delivery.test.ts",
-      "line": 200,
+      "line": 224,
       "title": "a second tenant receives nothing for the first tenant’s host event",
       "explicitId": null,
       "citations": []

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.20",
-  "corpusTag": "v2.45.20",
+  "version": "2.45.21",
+  "corpusTag": "v2.45.21",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "3d62475a6e5d2f0e005aa58b95c197f8846104d8cb7753c2161d7b6948cb89b4",
-    "api/v2/asyncapi.yaml": "44ea76f380b18c54ccdb51eaa091289212cd044e656c4d97e94df7bf048972e9",
-    "api/v2/openapi.yaml": "4ebf762aabf5d25318923ac0c8a2b865e11d7e07b2a2456ab6b535d91e56da33",
+    "api/seams-v2.yaml": "b589c75cf872617be98ffe553cd4e738b03469d26ee1e8a139d07cb185e61be1",
+    "api/v2/asyncapi.yaml": "a0af325b50f06b2c493d5e7e6cab81cc7af3928065d9c12560a32029b1983a78",
+    "api/v2/openapi.yaml": "173a39da5f735c10b9e24c3582d7aeb05c42e4c221761dfc940e894d9f0728fd",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "a829e3208413062388e52ab6ba714d35889c9c7645db38a290b0c4f4992cd3da",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -208,7 +208,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "d7c4865e30b6eed18c932ca0c4e4bbcbcb3f4cfedfdd560876a436d0ed774ba0",
+    "spec/v1/core-standard-manifest.json": "9aa532383ef7f21117d806a74796680a296c8963f5dae666600f318d560ec25c",
     "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
@@ -311,9 +311,9 @@
     "spec/v2/path-manifest.json": "b84c7561f50c7df0cb61b202bd6595acad3ee7edca7a45f711949bea3c69bd27",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "84c88ee17dd416060ba7d564fb3d47fdb528c4efa9cd8e483749b77557dac816",
+    "spec/v2/release.json": "839927946b61bb164d5b55121ccf51c7e109b8f444dcb09a5de0412ebfb4031e",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "11600f3b5d689962b34aaa1bdfa4c3e2a47632b914a945b356b825dd494ec9db"
+    "spec/v2/surface-baseline.json": "0b284b59b87c69acbaf06caff0da67bee0e4221ac8de1f3fd21cc9c5e5922f0f"
   },
-  "corpusCommit": "d6b2495ddf9ac4b82580a9e0f055f29beccfe24a"
+  "corpusCommit": "7a395e42ec42b03017af5cadc2ef9006a606cef8"
 }

package/src/scenarios/v2-host-event-delivery.test.ts

@@ -18,7 +18,9 @@
  *   0236.webhook.host-variant        a subscribed durable event arrives as
  *                                    `{ hostEvent }`, typed and signed;
  *   0236.ephemeral.no-fan-out        the same subscription never receives the
- *                                    ephemeral event;
+ *                                    ephemeral event (its own `it`, reading what
+ *                                    the host-variant leg observed: a bundle
+ *                                    records one requirement id per `it`);
  *   0236.host-event.tenant-isolation a second tenant's stream receives nothing
  *                                    for the first tenant's event.
  *
@@ -111,6 +113,13 @@ async function streamWhile(act: () => Promise<void>, opts: { lastEventId?: strin
   return [...(await sub).events];
 }
 
+/**
+ * What the host-variant leg observed, for the no-fan-out leg. They are two
+ * `it`s because a bundle records one requirement id per `it` (the last one it
+ * asserts), so one `it` asserting both ids recorded only no-fan-out (2.45.20).
+ */
+let fanOut: { bodies: string[]; ephemeralId: string } | { skipped: string } = { skipped: 'the host-variant leg did not run' };
+
 const registered: string[] = [];
 let receiver: ScopedReceiver | null = null;
 afterEach(async () => {
@@ -163,7 +172,8 @@ describe('v2 host events (RFC 0236 — seam-gated)', () => {
     expect(readErrorCode(res.json), req(ID_REFUSED, 'spec/v2/core/webhooks.md §Surfaces', 'the refusal code MUST be validation_error')).toBe('validation_error');
   }, 20_000);
 
-  it('a subscribed durable host event is delivered as { hostEvent }, signed; the ephemeral one is not', async () => {
+  it('a subscribed durable host event is delivered as { hostEvent }, signed', async () => {
+    fanOut = { skipped: 'the host-variant leg skipped before observing deliveries' };
     const g = await gate();
     if ('kind' in g) return skip(g);
     if ((await familyAdvertised('webhooks')) === null) return softSkip('inapplicable', 'the host does not advertise webhooks');
@@ -193,10 +203,24 @@ describe('v2 host events (RFC 0236 — seam-gated)', () => {
     }
     const h = (name: string): string | undefined => { const v = hit.headers[name]; return Array.isArray(v) ? v[0] : v; };
     const verified = verifyWebhookDelivery(SECRET, h('openwop-signature') ?? '', h('openwop-signature-algorithm'), h('openwop-timestamp') ?? '', hit.body, createReceiverState()).accepted === true;
+    // Everything the subscription received up to the durable delivery, which was emitted after the ephemeral one.
+    fanOut = { bodies: hits.map((x) => x.body), ephemeralId };
     assertAll(ID_HOST_BODY, WDOC, judgeHostBody(hit.body, h('openwop-event-type'), verified, durableId, d.type, webhookDelivery));
-    assertAll(ID_NO_FAN_OUT, DOC, [judgeNoFanOut(hits.map((x) => x.body), ephemeralId)]);
   }, 30_000);
 
+  it('the same subscription never receives the ephemeral host event', async () => {
+    // The same gate as the host-variant leg, so a host without the families records the same disposition here.
+    const g = await gate();
+    if ('kind' in g) return skip(g);
+    if ((await familyAdvertised('webhooks')) === null) return softSkip('inapplicable', 'the host does not advertise webhooks');
+    const d = pick(g.types, 'durable');
+    const e = pick(g.types, 'ephemeral');
+    if ('kind' in d) return skip(d);
+    if ('kind' in e) return skip(e);
+    if ('skipped' in fanOut) return softSkip('blocked', `no-fan-out reads the deliveries the host-variant leg observed, and ${fanOut.skipped}`);
+    assertAll(ID_NO_FAN_OUT, DOC, [judgeNoFanOut(fanOut.bodies, fanOut.ephemeralId)]);
+  });
+
   it('a second tenant receives nothing for the first tenant’s host event', async () => {
     const g = await gate();
     if ('kind' in g) return skip(g);