@openwop/openwop-conformance 2.45.27 → 2.45.28

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.28] — 2026-10-08 — two more seam-driven legs, and the backoff ratio, on a public seam-free cut
+
+- **Found by the v2 reference host's first public seams-off cut** (2.45.27, RFC 0241's evidence): all seven target rows `executed-pass`, but four other rows kept the bundle from certifying. Neither shows on a loopback cut.
+  - **`0199.mcp-url-mode` (`v2-mcp-mount-map`) and `0199.a2a-auth-required` (`v2-a2a-operation-map`):** both mint a fresh Subject through the credential mint seam, without checking for the seams profile, and recorded `blocked` when it was absent. They run only where `oauth.credentialInterrupt` is advertised, which this host does only with an https public base. Now `inapplicable` without the seams profile.
+  - **`v2-webhook-durable-delivery`, the exponential-backoff check:** it required the second retry gap to be at least 1.5x the first. Each gap also carries a constant, the receiver round trip a host waits on before scheduling the retry, so the gaps are B + c and 2B + c; through a tunnel (c ≈ 270 ms, base 500 ms) a correct host measured 1.43x. The second gap must now exceed the first by at least a quarter of it.
+- Proven on the v2 reference host: seams off with an https base, both 0199 rows `inapplicable`; the backoff leg passes on the host as is, and fails (510 ms after 604 ms) with the backoff made constant.
+
 ## [2.45.27] — 2026-10-08 — a seam-free host's seam-driven legs record `inapplicable`, not `blocked`
 
 - **Three scenarios recorded `blocked` on a host without the seams profile**, which denies the bundle certification, where the rest of the suite records a seam-driven leg `inapplicable`. Found by the v2 reference host's first seams-off cut (RFC 0241's evidence): 11 rows `blocked`, all `executed-pass` with the seams profile.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.27",
-  "stampSha256": "0ed61d1135dbf584a64a1d1780c8919a45a4e46da25798ad095629b94b61f0a1"
+  "version": "2.45.28",
+  "stampSha256": "0e47a879900333edf1f01645a54edb7935cf263125d4ab3dc90405f81189d8a3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.27",
+  "version": "2.45.28",
   "description": "Black-box conformance suite for OpenWOP hosts (v2 current; v1 scenarios retained for the frozen v1 tree).",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.27"
+    "@openwop/spec-artifacts": "2.45.28"
   }
 }

package/requirements.json

@@ -32919,7 +32919,7 @@
     {
       "id": "openwop.it.v2-mcp-mount-map.form-mode-is-never-emitted-for-a-nested-schema-or-a-sensitive-format-password-fi",
       "file": "v2-mcp-mount-map.test.ts",
-      "line": 344,
+      "line": 345,
       "title": "form mode is never emitted for a nested schema or a sensitive (format password) field",
       "explicitId": "openwop.requirement.0199.form-mode-no-secret",
       "citations": [
@@ -38110,7 +38110,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 430,
+      "line": 435,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
@@ -38149,7 +38149,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 539,
+      "line": 544,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -38162,7 +38162,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.after-unregister-the-dead-letter-read-answers-404-not-found-as-for-a-subscriptio",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 560,
+      "line": 565,
       "title": "after unregister, the dead-letter read answers 404 not_found, as for a subscription that never existed",
       "explicitId": "openwop.requirement.0217.dead-letter-read-after-unregister",
       "citations": [
@@ -38189,7 +38189,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 593,
+      "line": 598,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
@@ -38207,7 +38207,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.every-logged-event-of-a-subscribed-type-reaches-a-healthy-receiver-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 688,
+      "line": 693,
       "title": "every logged event of a subscribed type reaches a healthy receiver at least once within the retry bound",
       "explicitId": "openwop.requirement.0173.webhook-delivery-complete",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.27",
-  "corpusTag": "v2.45.27",
+  "version": "2.45.28",
+  "corpusTag": "v2.45.28",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "9b9455816461b5fc267d1f9a1624667f9f6bd81d2e251731767cca142cd9d0e0",
-    "api/v2/asyncapi.yaml": "ec80cec238dcb350f741b49138ed92c9d60f110fcb8ad4bdff2cf44c83c8e1d8",
-    "api/v2/openapi.yaml": "e3cff1191d97def0575096d0ec450622a39c1126ca4baaa72c24079ab3b50774",
+    "api/seams-v2.yaml": "1408a344c243a2a54de2f19b839efd2a9ad45ffa94ab72c2b3e352cbce2804f3",
+    "api/v2/asyncapi.yaml": "84aa6ad5580f097da601bb257a859c8c4ef745051c77d39b5de222c59734a89b",
+    "api/v2/openapi.yaml": "3a85fa3b6d637123554921da4e003a69aabe2c1dc3144b0dd090b68cf0301553",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -208,7 +208,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "22444c22bb88c568339ef512553f9fc38146e22b566d11ab8608f655d688d19c",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "7e44d633d25ceae4d0d8de5462337e666c3a827c1a003e27b7005edd915fc909",
+    "spec/v1/core-standard-manifest.json": "54ae669965b91b6526ce05a6dcc4ce7bbf419dba030e9f23edeb174b1806b3c2",
     "spec/v1/deprecations.json": "e723bc11d7272c71789ad1303bb7f21809a8a024abf57594f9d5c35dc199ece9",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
@@ -313,9 +313,9 @@
     "spec/v2/path-manifest.json": "7b5679a4dad98c80d855361d88a98c8a4e045af15e310862a05b285b815dc9fc",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "5edf0eb76b4b2d61addd3ebda82c0fa7cbfe9228665050da798cf1f26962cdbe",
+    "spec/v2/release.json": "1001b6d3376418eda319c7bbd6a1f77f45f39d3574df0b977ca474c1f4f3622c",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "d75c8f150df9625594cb6405b603e4f6f4d0e8d0d62ce198d0028c1133e9cbfd"
+    "spec/v2/surface-baseline.json": "9553399d274a2d244ba5ac4de7ccc97b6d7ade51ebb92303938fe684d4cb4d2f"
   },
-  "corpusCommit": "4bf2cc5a47102975d8710f50f619b3e4f1fcd9d8"
+  "corpusCommit": "19b9fd8ea3ae511f8d1b461e99d55564db3857e0"
 }

package/src/scenarios/v2-a2a-operation-map.test.ts

@@ -38,7 +38,7 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
 import { req } from '../lib/requirement-ids.js';
-import { SEAMS_PREFIX } from '../lib/seams.js';
+import { SEAMS_PREFIX, seamsProfileAdvertised } from '../lib/seams.js';
 import { unservedDestination } from '../lib/scoped-receiver.js';
 import { errorInfos, normaliseErrorData, isOpenwopEnvelope, A2A_ERROR_DOMAIN } from '../lib/a2a-error-info.js';
 
@@ -513,6 +513,7 @@ describe('RFC 0208 — v2-a2a-operation-map (host as A2A 1.0 server, gated on a2
     const oauth = await familyAdvertised('oauth');
     if (oauth?.['credentialInterrupt'] !== true) return softSkip('inapplicable', 'oauth.credentialInterrupt is not advertised — the host raises no credential interrupt to project (RFC 0199 §C.1)');
     if (!isFixtureAdvertised('conformance-credential')) return softSkip('blocked', 'fixture conformance-credential is not in the advertised fixtures[]');
+    if (!seamsProfileAdvertised(await v2Discovery().catch(() => null))) return softSkip('inapplicable', 'a fresh Subject is minted through the seams profile (credential mint seam) — conformance.seamsProfile is not openwop-conformance-seams-v2');
     // A fresh Subject, so no credential another scenario acquired satisfies the node.
     const minted = await driver.post(`${SEAMS_PREFIX}/sample/auth/credential/mint`, { lane: 'api-key' }).catch(() => null);
     const bearer = (minted?.json as { credential?: unknown } | undefined)?.credential;

package/src/scenarios/v2-mcp-mount-map.test.ts

@@ -34,7 +34,7 @@ import { loadEnv } from '../lib/env.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
 import { req } from '../lib/requirement-ids.js';
-import { SEAMS_PREFIX } from '../lib/seams.js';
+import { SEAMS_PREFIX, seamsProfileAdvertised } from '../lib/seams.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED = 'the suite is the MCP client: every leg POSTs JSON-RPC to the mount the host advertises in mcp.serverUrls; nothing harness-hosted is handed to the host';
 
@@ -308,6 +308,7 @@ describe('RFC 0208 — v2-mcp-mount-map (host as MCP 2026-07-28 server, gated on
     if (oauth?.['credentialInterrupt'] !== true) return softSkip('inapplicable', 'oauth.credentialInterrupt is not advertised — the host raises no credential interrupt to bridge (RFC 0199 §C.1)');
     const missing = needFixtures(['conformance-credential']);
     if (missing) return softSkip('blocked', missing);
+    if (!seamsProfileAdvertised(await v2Discovery().catch(() => null))) return softSkip('inapplicable', 'a fresh Subject is minted through the seams profile (credential mint seam) — conformance.seamsProfile is not openwop-conformance-seams-v2');
     const minted = await driver.post(`${SEAMS_PREFIX}/sample/auth/credential/mint`, { lane: 'api-key' }).catch(() => null);
     const bearer = (minted?.json as { credential?: unknown } | undefined)?.credential;
     if (typeof bearer !== 'string') return softSkip('blocked', 'the credential mint seam did not mint a fresh Subject — a Subject that may already hold a credential makes the leg vacuous');

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -403,18 +403,23 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
         // Unfailable-leg audit (2026-09-26): `> 0 ms` alone let a host advertising
         // `backoff: exponential` that retried in a tight loop (any constant
         // spacing, even a few ms) pass. An exponential backoff MUST widen, so with
-        // three or more attempts the second gap is at least 1.5x the first (not
-        // 2x: jitter tolerance). Only the first two gaps are compared, so a host
-        // whose schedule hits its cap later is not convicted. `fixed` gets no
-        // equivalent: its base interval is not on the wire (see the comment above
-        // the `!retried` branch), so there is no floor to measure against.
+        // three or more attempts the second gap is wider than the first by at least
+        // a quarter of it. Not 1.5x: each gap also carries a constant c, the
+        // receiver round trip a host waits on before scheduling the retry, so the
+        // gaps are B + c and 2B + c, and a public cut's tunnel (c ≈ 270 ms
+        // against a 500 ms base, 2026-10-08) put a correct host at 1.43x. A
+        // constant spacing still fails: its gaps differ only by jitter. Only the
+        // first two gaps are compared, so a host whose schedule hits its cap
+        // later is not convicted. `fixed` gets no equivalent: its base interval
+        // is not on the wire (see the comment above the `!retried` branch), so
+        // there is no floor to measure against.
         if (policy.backoff === 'exponential' && times.length >= 3) {
           const gap1 = times[1]! - times[0]!;
           const gap2 = times[2]! - times[1]!;
           expect(
-            gap2,
-            req('openwop.requirement.0173.webhook-durable-delivery', 'webhooks.md §Durability', `retry attempts for ${key} MUST follow the advertised exponential backoff — the second gap (${gap2}ms) MUST be at least 1.5x the first (${gap1}ms); a constant spacing is not exponential`),
-          ).toBeGreaterThanOrEqual(1.5 * gap1);
+            gap2 - gap1,
+            req('openwop.requirement.0173.webhook-durable-delivery', 'webhooks.md §Durability', `retry attempts for ${key} MUST follow the advertised exponential backoff — the second gap (${gap2}ms) MUST exceed the first (${gap1}ms) by at least a quarter of it; a constant spacing is not exponential`),
+          ).toBeGreaterThanOrEqual(0.25 * gap1);
         }
       }
     } else {