@openwop/openwop-conformance 2.45.22 → 2.45.24

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.24] — 2026-10-07 — the effect receiver fails fast on a held pinned port; the README index check reads `spec/v2/core`
+
+- **The effect receiver fails fast on a held pinned port.** With `OPENWOP_WEBHOOK_RECEIVER_PORT` pinned to a port another process holds, `startEffectReceiver` attached no `error` handler, so `EADDRINUSE` never settled its `listen` promise and the `0158`/`0194` duplicate-delivery rows hung to their 180 s timeout instead of failing with the cause. It now rejects at once with the bind error, as `scoped-receiver` has since 2.39.3. Self-test: a held port rejects in under 2 s; without the handler the test times out. Reported by MyndHyve (2.45.18 cut, port 8787).
+- **No scenario change.** The coherence test `spec-corpus-validity` checks that the root README's document index lists every `spec/v2/core` doc exactly once and that its **Total** matches; it checked `spec/v1`. The two requirement ids are renamed to match, which changes the packed `requirements.json`.
+- **Package README and metadata.** The README drops a 107-line block that repeated the dated coverage notes verbatim; the package description names v2; `tsconfig.json` sets `noEmit`, so a bare `tsc -p tsconfig.json` no longer writes `.js` files beside the sources.
+- **Package docs rewritten for v2.** The README is the npm page again: install, protocol majors, a coverage summary by area (the dated per-RFC notes stay in this changelog), and a corrected "Resolving the contract" (the contract is the `@openwop/spec-artifacts` peer, not vendored). `coverage.md` leads with v2 coverage by core doc; `fixtures.md` uses v2 paths and catalogs `wasm-sandbox/` and `upstream/a2a-v1.0.1/`.
+- **Erratum (packed contract): `provider_policy_denied`'s `details.reason`** is documented as `provider_disabled`, `byok_required`, `byok_required_but_unresolved` or `model_not_allowed`, the spelling the v1 scenario `providerPolicyEnforcement` already expects; the registry said kebab-case.
+
+## [2.45.23] — 2026-10-06 — `0184.mint-no-tilde` also mints under the second-tenant credential; RFC 0237 filed
+
+- **Erratum: `host.announce` is a `ui-plugin/1` request method at v2.** The v2 `ui-plugin-message.schema.json` request enum omitted it, although the manifest `hostApi` enum and the `uiPlugins.hostApi` facet admit it (RFC 0130), so a host advertising it had to refuse it at `dispatchUiPluginRequest`. The schema is now hand-owned (no v1 seed marker). Found by openwop-app (ADR 0840).
+- **New `v2-multi-party-council` (RFC 0239).** Gated on `multiPartyConversation` and the advertised `conformance-multi-party-council` fixtures: `conversation.opened` carries the configured roster; resuming the exchange with a non-member `speakerId` is `422 conversation_speaker_not_participant`, unconsumed, and a member's turn then resolves it; with `maxParticipants` below 64 the 64-member oversize fixture is refused at run creation with `422 conversation_roster_exceeded`. Proof: a 9-case self-test double (`lib/council-roster-witness.test.ts`), each defect failing only its leg.
+- **WASM fixture packs and `v2-wasm-memory-cap`.** `conformance/fixtures/wasm-packs/` ships two operator-installed node packs written in WebAssembly text (`build.mjs` assembles them with `wabt`, so no Rust toolchain is needed): `misbehaving-memory` grows memory until the host refuses, `misbehaving-abi` reports ABI version 999. New `v2-wasm-memory-cap` (`openwop.requirement.node-pack-runtimes.wasm-memory-cap`) runs `conformance-wasm-pack-memory-cap-breach` and expects `cap.breached` `kind: wasm-memory` and a `failed` run; proven by a 7-case double. `src/coherence/wasm-fixture-packs.test.ts` instantiates both modules and checks their exports, ABI version, pack name and typeId against their v2 manifests. The ABI-rejection leg is not written: rejection at load has no protocol observation path yet.
+- **New `v2-ui-plugin-boundary` (RFC 0238).** Gated on `uiPlugins.served` and the operator-installed `ui-plugin-pack-narrow` fixture: the frame's `Content-Security-Policy` sandboxes without `allow-same-origin` and denies egress; the dispatch refuses `artifact.write` and `host.navigate` (undeclared) with `method_not_allowed`, does not execute `host.exec`, and runs `artifact.read`; no response carries canary material. The four `frontend-plugin-*` invariants move from `seam-gated` to `witnessable-gated`. Proof: a 12-case self-test double (`lib/ui-plugin-boundary-witness.test.ts`), each defect failing only its leg. The fixture's shape is a corpus check (`src/coherence/ui-plugin-fixtures.test.ts`).
+- **No scenario change.** RFC 0237 (declared nondeterminism names its sources) is filed `Draft`; its gap rows change the packed `spec/v1/gaps.json`.
+
+- **`0184.mint-no-tilde` also mints under `OPENWOP_TEST_TENANT_B_API_KEY`.** A host can bind tenant B to a non-clean tenant, so the leg bites in a production cut without moving the primary key. Asked by openwop-app, whose primary tenant is clean. A refused tenant-B create skips only that half. Proven against a double.
+
+- **New `v2-purpose-propagation-onward` (seam-gated).** The suite hands the host a `permittedPurposes` label through the §22 `invoke` seam (new optional field; the seam is now in `api/seams-v2.yaml`), and its fake A2A peer checks the onward message: re-emitted, never widened, and nothing sent for `[]`. Proven against a double.
+
+- **RFC 0237 Active: new `v2-nondeterminism-sources` (fixture-gated) and the §C legs.** A host listing `nondeterminismPolicy.sources` runs `conformance-nondeterminism` (reserved typeId `core.conformance.nondeterminism`); a `replay` fork from `fromSeq: 0` must reproduce each listed source's output. The two advertisement scenarios fail `declared: false` / `advertised: false`.
+
 ## [2.45.22] — 2026-10-06 — an empty `dataResidency.regions` still binds the reject leg; RFC 0236's registers close
 
 - **No scenario change.** RFC 0236 goes `Accepted` on the v2 reference host's certified 2.45.21 cut; its gaps G1 and G2 close, which changes the packed `spec/v1/gaps.json`.