@openwop/openwop-conformance 2.45.6 → 2.45.7

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.7] — 2026-10-02 — a strict-mode host that does not advertise `workspace` is not failed; RFC 0231 Accepted
+
+- **Fix: `v2-workspace-scope-from-identity` no longer fails a strict-mode host that does not advertise `workspace`.** The file gated with `gateFamily('workspace')`, which under `--require-behavior` fails an unadvertised family unless the operator opts it out. Its own header says an unadvertised family is `inapplicable`, and its sibling isolation scenarios (`v2-storage-`, `v2-queue-cross-tenant-isolation`) read with `familyAdvertised` and recorded `inapplicable` in the same run. It now reads with `familyAdvertised`.
+  - **Found by** MyndHyve's 2.45.5 cut: both `0059.workspace-scope-*` rows `executed-fail` on a host that does not serve `workspace`.
+  - **Proof.** Against a scratch host that does not advertise the family, in strict mode: both legs failed before the change; the three rows are `inapplicable` after it. A host that advertises `workspace` is unchanged (the v2 reference host passes both rows on its certified 2.45.6 cut).
+  - **Workaround on 2.45.3–2.45.6:** `OPENWOP_OPTED_OUT_PROFILES=family.workspace`, which records the rows `skipped`.
+- **The 2.45.7 cycle opens.** RFC 0231's gap register changes the packed `spec/v1/gaps.json`: G3 and G4 close, and G2 and G7 are `externally-gated`. No scenario changes.
+
 ## [2.45.6] — 2026-10-02 — RFC 0231 (Active): a host says which budget exhaustion behaviours it serves
 
 - **The 2.45.6 cycle opens.** RFC 0231's gap register changes the packed `spec/v1/gaps.json`.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.6",
-  "stampSha256": "8ace8621112fabc9df41fdd55225e6e7baf022a0f51f845db41158d65058f16c"
+  "version": "2.45.7",
+  "stampSha256": "23ca7bff43af86c11279cbf51fbd7cfe67ced0171b808fb24cb33c03cf50e0d1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.6",
+  "version": "2.45.7",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.6"
+    "@openwop/spec-artifacts": "2.45.7"
   }
 }

package/requirements.json

@@ -36065,7 +36065,7 @@
     {
       "id": "openwop.it.v2-workspace-scope-from-identity.a-second-tenant-cannot-read-or-list-a-file-the-first-tenant-wrote",
       "file": "v2-workspace-scope-from-identity.test.ts",
-      "line": 100,
+      "line": 107,
       "title": "a second tenant cannot read or list a file the first tenant wrote",
       "explicitId": "openwop.requirement.0059.workspace-scope-from-identity",
       "citations": [
@@ -36099,7 +36099,7 @@
     {
       "id": "openwop.it.v2-workspace-scope-from-identity.naming-the-first-tenant-s-scope-in-the-request-does-not-widen-the-second-tenant",
       "file": "v2-workspace-scope-from-identity.test.ts",
-      "line": 122,
+      "line": 129,
       "title": "naming the first tenant's scope in the request does not widen the second tenant's scope",
       "explicitId": "openwop.requirement.0059.workspace-scope-not-request-named",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.6",
-  "corpusTag": "v2.45.6",
+  "version": "2.45.7",
+  "corpusTag": "v2.45.7",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ad37a5a5c732ad46100fc03c3f4243fdd4f2976e330f02a8791b6b5b10a8a0c1",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "41ce056ad21053d69a824b28d94ac798cc3ed68aa5117f853ae5aaa017648fc6",
-    "api/v2/asyncapi.yaml": "34b82d051f6d1fa20a2abc5a39b822730e22c2eaade1eee1e0975dfe07ff998c",
-    "api/v2/openapi.yaml": "2a59f358e951a33b89bea3a7e4c996ca5f30d96ce1438ee99787b31f54f13f1e",
+    "api/seams-v2.yaml": "c248954e6382322c769fd44e6888f739644bcee2becfacabff3de173a9f40d71",
+    "api/v2/asyncapi.yaml": "63f837b7f56a5b5d17b1c34ffb47337ceb72e0027f8682c2f082c4df3e9dd856",
+    "api/v2/openapi.yaml": "d3c23e3c30db36ebe2ace9273f0262f927a4a44dc0ea4807ea9e94f607b661d3",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "535fef79758a01575c5f49db8690f0b4fe4ebb713564739b974818d6b9b0949b",
+    "spec/v1/core-standard-manifest.json": "592b87877bb6f713f77e6f4f64d671a63a119a71372405370d8a426cfab4113a",
     "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "10c8f4c5bcf312b543dc4139eff23948cb01f6bfaa309b523719ef779e7bec89",
+    "spec/v1/gaps.json": "95c1c9242a97fafd75d5ca040c2ca07e146dbfa6d9be1fcee9ba882da0efd8ed",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -303,9 +303,9 @@
     "spec/v2/path-manifest.json": "27c2307b84376b2f22bea4e2213fc7e33ef3bf8fd1d18039f7955edb00dc9c9a",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "345ed102cf6fee40e78a5deea9d9d8512e8b03a3fea18887e93487e0faf5f9ab",
+    "spec/v2/release.json": "4cc5a5efe139e3ef205ccba16dcc52a684cc65d682a24c195af7ad8a236896ad",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "61c1628690fa95d4ab4b6c746b62d3a021c6485d4e2a2cdcca283489e31c03d9"
+    "spec/v2/surface-baseline.json": "b7b01715d4b07dcefd055a937e8f865896e35017ff89f99a3b1aa1a801bbdb87"
   },
-  "corpusCommit": "ef7ea3078b23d6d488c6c131a305d339eb287afc"
+  "corpusCommit": "501121df013767d1adfcc3a342d82737d6fbd054"
 }

package/src/scenarios/v2-workspace-scope-from-identity.test.ts

@@ -24,7 +24,9 @@
  *      request instead of the credential serves A's file here.
  *
  * Dispositions: family or seams profile not advertised ⇒ `inapplicable`
- * (lib/seams.ts: the host has not claimed the instrument). Advertised, but the
+ * (lib/seams.ts: the host has not claimed the instrument). That holds in
+ * strict mode too: the family is read with `familyAdvertised`, so no
+ * `family.workspace` opt-out is needed from a host that does not serve it. Advertised, but the
  * seam answers 404/405/501, the second-tenant key is absent / identical /
  * refused, or (leg 2) A's scope cannot be read from a run ⇒ `blocked` — the host
  * took the obligation on and the suite could not measure it.
@@ -33,7 +35,7 @@ import { describe, it, expect } from 'vitest';
 import { randomUUID } from 'node:crypto';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { loadEnv } from '../lib/env.js';
-import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { v2Discovery, familyAdvertised } from '../lib/v2.js';
 import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { softSkip, seamAbsent } from '../lib/soft-skip.js';
@@ -55,7 +57,12 @@ async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse
 async function gate(): Promise<Gate> {
   const doc = await v2Discovery();
   if (!doc) return { ok: false, kind: 'blocked', reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0' };
-  if (!(await gateFamily('workspace'))) return { ok: false, kind: 'inapplicable', reason: 'workspace family not advertised (gate recorded under openwop.family.workspace)' };
+  // `familyAdvertised`, not `gateFamily`: `workspace` is optional, and a host that does not advertise it has
+  // taken on no obligation here. Until 2.45.7 this was `gateFamily`, which in strict mode
+  // (`--require-behavior`) FAILS an unadvertised family unless the operator opts it out — so this file
+  // recorded `executed-fail` on a host its own header calls `inapplicable` (MyndHyve, 2.45.5), while
+  // its sibling isolation scenarios recorded `inapplicable` in the same run.
+  if (!(await familyAdvertised('workspace'))) return { ok: false, kind: 'inapplicable', reason: 'workspace family not advertised — no obligation' };
   if (!seamsProfileAdvertised(doc)) return { ok: false, kind: 'inapplicable', reason: 'workspace files have no protocol path; the only observation surface is the seams profile (conformance.seamsProfile = openwop-conformance-seams-v2), which is not advertised' };
   const probe = await http(() => driver.get(FILES));
   if (probe === null) return { ok: false, kind: 'blocked', reason: `GET ${FILES} unreachable (fetch failed)` };