@openwop/openwop-conformance 2.45.9 → 2.45.11

package/src/scenarios/trigger-bridge-delivery.test.ts

@@ -6,15 +6,17 @@
  * under `OPENWOP_REQUIRE_BEHAVIOR=true`. The always-on wire-shape coverage lives
  * in `trigger-bridge-shape.test.ts`.
  *
- * Four legs, each its own requirement (RFC 0230 split the one combined `it`):
+ * Five legs, each its own requirement (RFC 0230 split the one combined `it`;
+ * RFC 0232 split the fourth):
  *
  *   1. DEDUP (§C-1) — a repeated delivery is effectively-once.
  *   2. DEAD-LETTER (§C-2 + RFC 0053) — an exhausted/refused delivery starts no run.
  *   3. CAUSATION (§C / RFC 0040) — a delivered run carries the delivery as
  *      `run.started.causationId`.
- *   4. RUN-LESS CONTENT-FREENESS (SR-1) — the run-less `trigger.*` events
- *      (a dead-lettered attempt, `trigger.subscription.state.changed`) carry no
- *      inbound content.
+ *   4a. RUN-LESS ATTEMPT (SR-1) — a dead-lettered `trigger.delivery.attempted`
+ *      carries no inbound content.
+ *   4b. RUN-LESS STATE CHANGE (SR-1) — a `trigger.subscription.state.changed`
+ *      carries no inbound content.
  *
  * TWO WITNESS PATHS, and a host is measured on EVERY path it offers (2.45.8).
  * The SEAM path drives `POST /v1/host/sample/trigger-bridge/deliver` and reads
@@ -31,18 +33,24 @@
  * certify, and an uncertified bundle supplies no acceptance evidence
  * (RFC 0174 §B.1).
  *
- * Leg 4 has no normative-surface path — the run-less events are on no run's
- * log — so it stays seam-witnessed and records seam-absent otherwise; it
- * remains in the floor (the floor never narrows).
+ * The run-less events are on no run's log. Leg 4a's normative-surface path is
+ * RFC 0232's read: on a host advertising `inboundSigning` AND
+ * `triggerBridge.deadLetter`, it posts a canary with a bad signature and reads
+ * the subscription's dead letters (`lib/trigger-dead-letter-witness.ts`).
+ * Leg 4b has no such path: no wire surface causes a subscription state change
+ * (a refused post must not change state; nothing pauses a subscription), so it
+ * is seam-witnessed and, on a host without the seam, records `inapplicable`
+ * (RFC 0232 Unresolved question 1, decided (a)). Both stay in the floor.
  *
  * Spec references:
  *   - spec/v1/trigger-bridge.md (§C, §F.2, §F.6)
- *   - RFCS/0083-durable-trigger-and-channel-bridge-profile.md, RFCS/0230-inbound-webhook-ingest-contract.md
+ *   - RFCS/0083-durable-trigger-and-channel-bridge-profile.md, RFCS/0230-inbound-webhook-ingest-contract.md,
+ *     RFCS/0232-trigger-dead-letter-read.md
  *   - spec/v1/profiles.md (§openwop-trigger-bridge)
  */
 
 import { describe, it, expect } from 'vitest';
-import { seamAbsent } from '../lib/soft-skip.js';
+import { seamAbsent, softSkip } from '../lib/soft-skip.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import {
   isTriggerBridgeProfileAdvertised,
@@ -59,11 +67,16 @@ import { queryTestEvents, requireEvents, isEventLogSeamAvailable, resetTestSeam
 import { req } from '../lib/requirement-ids.js';
 import { noteObservation } from '../lib/row-observation.js';
 import { driver } from '../lib/driver.js';
+import { deadLetterFacet, freshCanary, judge as judgeDeadLetters, readDeadLetters } from '../lib/trigger-dead-letter-witness.js';
 
 const R_DEDUP = 'openwop.requirement.0083.trigger-delivery.dedup';
 const R_DEAD_LETTER = 'openwop.requirement.0083.trigger-delivery.dead-letter';
 const R_CAUSATION = 'openwop.requirement.0083.trigger-delivery.causation';
-const R_RUNLESS = 'openwop.requirement.0083.trigger-delivery.runless-content-free';
+const R_RUNLESS_ATTEMPT = 'openwop.requirement.0083.trigger-delivery.runless-attempt-content-free';
+const R_RUNLESS_STATE = 'openwop.requirement.0083.trigger-delivery.runless-state-change-content-free';
+
+/** The bad signature every refused-post probe sends. */
+const BAD_SIGNATURE = 'v1,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
 
 const CONTENT_FREE_FORBIDDEN = ['body', 'headers', 'payload', 'secret', 'credentials', 'token', 'apiKey'];
 
@@ -191,7 +204,7 @@ describe('trigger-bridge-delivery (RFC 0083 §C)', () => {
     const sub = await registerSignedWebhook('required');
     if ('reason' in sub) throw new Error(req(R_DEAD_LETTER, 'trigger-bridge.md §F.6', `an inboundSigning host MUST return the §B binding on webhook registration: ${sub.reason}`));
     const body = JSON.stringify({ conformance: 'dead-letter' });
-    const bad = await signedIngest(sub, body, { signature: 'v1,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=' });
+    const bad = await signedIngest(sub, body, { signature: BAD_SIGNATURE });
     expect(bad.status, req(R_DEAD_LETTER, 'trigger-bridge.md §F.6', `a bad signature under required verification MUST answer 401 (got ${bad.status})`)).toBe(401);
     expect(bad.json?.runId, req(R_DEAD_LETTER, 'trigger-bridge.md §F.2', 'a required-verification failure MUST NOT start a run')).toBeUndefined();
     const read = await driver.get(`/v1/trigger-subscriptions/${encodeURIComponent(sub.subscriptionId)}`);
@@ -231,17 +244,53 @@ describe('trigger-bridge-delivery (RFC 0083 §C)', () => {
     notePaths(paths.seam, true, deliveredEvent === undefined ? '; on the normative-surface path the delivered attempt event is not on the run log, so equality was not checked there' : '');
   });
 
-  it('keeps the run-less trigger events content-free', async () => {
+  it('keeps a dead-lettered run-less attempt content-free', async () => {
     if (!behaviorGate('openwop-trigger-bridge', await isTriggerBridgeProfileAdvertised())) return;
-    // No normative-surface path: a dead-lettered attempt and a state change are
-    // on no run's log, so only the seam can read them (RFC 0230 §Conformance).
-    if (!(await isEventLogSeamAvailable())) return seamAbsent('the run-less trigger events are readable only through the event-log seam, which is absent');
+    const seam = await isEventLogSeamAvailable();
+    const disco = await driver.get('/.well-known/openwop');
+    const facet = disco.status === 200 ? deadLetterFacet(disco.json) : null;
+    const normative = facet !== null && (await inboundSigningAdvertised());
+    if (!seam && !normative) return seamAbsent('a dead-lettered attempt is on no run\'s log; it is readable through the event-log seam or the RFC 0232 read (triggerBridge.deadLetter with inboundSigning), and the host offers neither');
+
+    if (seam) {
+      const exhaust = await driveDelivery({ scenario: 'exhaust', source: 'webhook' });
+      if (exhaust === null) return seamAbsent(SEAM_UNWIRED);
+      const exKey = exhaust.runId ?? '__exhaust__';
+      const attempts = requireEvents(await queryTestEvents(exKey, { type: 'trigger.delivery.attempted' }), 'trigger.delivery.attempted (exhaust)');
+      for (const e of attempts) expectContentFree(R_RUNLESS_ATTEMPT, e.payload, 'trigger.delivery.attempted');
+      await resetTestSeam();
+    }
+    if (!normative) return notePaths(true, false);
+
+    // Normative-surface path (RFC 0232 §E): cause a dead letter unaided, then read it.
+    const sub = await registerSignedWebhook('required');
+    if ('reason' in sub) throw new Error(req(R_RUNLESS_ATTEMPT, 'trigger-bridge.md §F.6', `an inboundSigning host MUST return the §B binding on webhook registration: ${sub.reason}`));
+    const canary = freshCanary();
+    const bad = await signedIngest(sub, JSON.stringify({ conformance: 'runless-attempt', canary }), { signature: BAD_SIGNATURE });
+    expect(bad.status, req(R_RUNLESS_ATTEMPT, 'trigger-bridge.md §F.6', `a bad signature under required verification MUST answer 401 (got ${bad.status})`)).toBe(401);
+    const read = await readDeadLetters(sub.subscriptionId);
+    for (const f of judgeDeadLetters(read, { subscriptionId: sub.subscriptionId, canary, signature: BAD_SIGNATURE, signingSecret: sub.signingSecret, retentionDays: facet!.retentionDays })) {
+      expect(f.ok, req(R_RUNLESS_ATTEMPT, 'trigger-bridge.md §C (RFC 0232 §B–§C)', f.message)).toBe(true);
+    }
+    notePaths(seam, true, ' (RFC 0232 dead-letter read)');
+  });
+
+  it('keeps a run-less subscription state change content-free', async () => {
+    if (!behaviorGate('openwop-trigger-bridge', await isTriggerBridgeProfileAdvertised())) return;
+    // Seam-only. No wire surface causes a subscription state change: a refused
+    // post MUST NOT change state, retry exhaustion needs a delivery the host
+    // fails repeatedly, and nothing pauses a subscription (RFC 0232 G2). On a
+    // host without the seam no party can cause the condition, so the row is
+    // `inapplicable`, not a defect (RFC 0232 Unresolved question 1, decided (a)).
+    if (!(await isEventLogSeamAvailable())) {
+      return softSkip('inapplicable', 'no wire surface causes a trigger subscription state change on a host without the event-log seam (RFC 0232 §E, gap G2)');
+    }
     const exhaust = await driveDelivery({ scenario: 'exhaust', source: 'webhook' });
-    if (exhaust === null) return seamAbsent('host advertises openwop-trigger-bridge but the delivery seam is unwired');
+    if (exhaust === null) return seamAbsent(SEAM_UNWIRED);
     const exKey = exhaust.runId ?? '__exhaust__';
-    for (const type of ['trigger.delivery.attempted', 'trigger.subscription.state.changed'] as const) {
-      for (const e of requireEvents(await queryTestEvents(exKey, { type }), `${type} (exhaust)`)) expectContentFree(R_RUNLESS, e.payload, type);
-    }
+    const changes = requireEvents(await queryTestEvents(exKey, { type: 'trigger.subscription.state.changed' }), 'trigger.subscription.state.changed (exhaust)');
+    expect(changes.length >= 1, req(R_RUNLESS_STATE, 'trigger-bridge.md §B', 'exhaustion MUST record ≥1 trigger.subscription.state.changed')).toBe(true);
+    for (const e of changes) expectContentFree(R_RUNLESS_STATE, e.payload, 'trigger.subscription.state.changed');
     await resetTestSeam();
   });
 });

package/src/scenarios/trigger-dead-letter-read.test.ts

@@ -0,0 +1,112 @@
+/**
+ * Trigger dead-letter read — the §B rules (RFC 0232) — behavioral.
+ *
+ * Gated on `triggerBridge.deadLetter` together with
+ * `triggerBridge.ingestion.inboundSigning` (the suite causes a dead letter
+ * unaided by posting a bad signature to a `required` subscription). A host that
+ * advertises neither records `inapplicable`.
+ *
+ * The record's content rules (§C) are leg 4a of `trigger-bridge-delivery`,
+ * which is in the `openwop-trigger-bridge` floor. These are the read's own
+ * rules, each its own requirement:
+ *
+ *   1. PAGING — `limit` is clamped, and a page that stops short carries
+ *      `nextCursor`.
+ *   2. CURSOR — a cursor minted for one subscription is refused on another,
+ *      `400 validation_error`.
+ *   3. TENANT — another tenant's credential reading this subscription's id gets
+ *      `404 not_found`, exactly as for an id the host never minted. Needs
+ *      `OPENWOP_TEST_TENANT_B_API_KEY`; without it the row is `blocked`.
+ *
+ * Spec references:
+ *   - spec/v1/trigger-bridge.md §C (Run-less transitions are recorded)
+ *   - spec/v2/core/webhooks.md §Inbound triggers
+ *   - RFCS/0232-trigger-dead-letter-read.md §B
+ */
+
+import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
+import { driver } from '../lib/driver.js';
+import { loadEnv } from '../lib/env.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { req } from '../lib/requirement-ids.js';
+import { inboundSigningAdvertised, registerSignedWebhook, signedIngest, type SignedWebhookSubscription } from '../lib/triggerBridge.js';
+import { deadLetterFacet, readDeadLetters, type DeadLetterFacet } from '../lib/trigger-dead-letter-witness.js';
+
+const R_PAGING = 'openwop.requirement.0232.trigger-dead-letters.paging';
+const R_CURSOR = 'openwop.requirement.0232.trigger-dead-letters.cursor-bound';
+const R_TENANT = 'openwop.requirement.0232.trigger-dead-letters.tenant-bound';
+
+const BAD_SIGNATURE = 'v1,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
+
+/** The facet, or null with the reason the row is `inapplicable`. */
+async function gate(): Promise<{ facet: DeadLetterFacet } | { reason: string }> {
+  const disco = await driver.get('/.well-known/openwop');
+  const facet = disco.status === 200 ? deadLetterFacet(disco.json) : null;
+  if (facet === null) return { reason: 'the host does not advertise triggerBridge.deadLetter' };
+  if (!(await inboundSigningAdvertised())) return { reason: 'triggerBridge.deadLetter is advertised without inboundSigning, so the suite cannot cause a dead letter unaided' };
+  return { facet };
+}
+
+/** A `required` subscription with `n` refused posts dead-lettered on it. */
+async function withRefused(id: string, n: number): Promise<SignedWebhookSubscription> {
+  const sub = await registerSignedWebhook('required');
+  if ('reason' in sub) throw new Error(req(id, 'trigger-bridge.md §F.6', `an inboundSigning host MUST return the §B binding on webhook registration: ${sub.reason}`));
+  for (let i = 0; i < n; i++) {
+    const bad = await signedIngest(sub, JSON.stringify({ conformance: 'dead-letter-read', i }), { signature: BAD_SIGNATURE });
+    expect(bad.status, req(id, 'trigger-bridge.md §F.6', `a bad signature under required verification MUST answer 401 (got ${bad.status})`)).toBe(401);
+  }
+  return sub;
+}
+
+function deliveriesOf(json: unknown): unknown[] {
+  const d = (json as { deliveries?: unknown } | undefined)?.deliveries;
+  return Array.isArray(d) ? d : [];
+}
+
+describe('trigger-dead-letter-read (RFC 0232 §B)', () => {
+  it('clamps limit and continues a short page with nextCursor', async () => {
+    const g = await gate();
+    if ('reason' in g) return softSkip('inapplicable', g.reason);
+    const sub = await withRefused(R_PAGING, 2);
+    const first = await readDeadLetters(sub.subscriptionId, { limit: 1 });
+    expect(first.status, req(R_PAGING, 'trigger-bridge.md §C', `a host advertising triggerBridge.deadLetter MUST serve the read (got ${first.status})`)).toBe(200);
+    expect(deliveriesOf(first.json).length, req(R_PAGING, 'trigger-bridge.md §C', 'a page MUST NOT exceed limit')).toBe(1);
+    const cursor = (first.json as { nextCursor?: unknown } | undefined)?.nextCursor;
+    expect(typeof cursor === 'string' && cursor.length > 0, req(R_PAGING, 'trigger-bridge.md §C', 'with two dead letters and limit 1, the page MUST carry nextCursor')).toBe(true);
+    const second = await readDeadLetters(sub.subscriptionId, { limit: 1, cursor: cursor as string });
+    expect(second.status, req(R_PAGING, 'trigger-bridge.md §C', `the page's own cursor MUST be accepted (got ${second.status})`)).toBe(200);
+    expect(deliveriesOf(second.json).length, req(R_PAGING, 'trigger-bridge.md §C', 'the next page MUST carry the second dead letter')).toBe(1);
+    const big = await readDeadLetters(sub.subscriptionId, { limit: g.facet.maxPageSize + 1 });
+    expect(big.status, req(R_PAGING, 'trigger-bridge.md §C', `a limit above maxPageSize MUST be clamped, not refused (got ${big.status})`)).toBe(200);
+  });
+
+  it('refuses a cursor minted for another subscription', async () => {
+    const g = await gate();
+    if ('reason' in g) return softSkip('inapplicable', g.reason);
+    const a = await withRefused(R_CURSOR, 2);
+    const page = await readDeadLetters(a.subscriptionId, { limit: 1 });
+    const cursor = (page.json as { nextCursor?: unknown } | undefined)?.nextCursor;
+    expect(typeof cursor === 'string' && cursor.length > 0, req(R_CURSOR, 'trigger-bridge.md §C', `with two dead letters and limit 1, the page MUST carry nextCursor (read answered ${page.status})`)).toBe(true);
+    const b = await withRefused(R_CURSOR, 1);
+    const cross = await readDeadLetters(b.subscriptionId, { cursor: cursor as string });
+    expect(cross.status, req(R_CURSOR, 'trigger-bridge.md §C', `a cursor minted for another subscription MUST be refused 400 (got ${cross.status})`)).toBe(400);
+    expect(readErrorCode(cross.json), req(R_CURSOR, 'trigger-bridge.md §C', 'the refusal MUST carry validation_error')).toBe('validation_error');
+  });
+
+  it("answers another tenant's read of a subscription 404, as for an id never minted", async () => {
+    const g = await gate();
+    if ('reason' in g) return softSkip('inapplicable', g.reason);
+    const other = process.env['OPENWOP_TEST_TENANT_B_API_KEY'];
+    if (!other) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set — the cross-tenant read cannot run');
+    if (other.trim() === loadEnv().apiKey) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY equals OPENWOP_API_KEY — the second credential must resolve to a DIFFERENT tenant, or the leg measures nothing');
+    const sub = await withRefused(R_TENANT, 1);
+    const path = (id: string): string => `/v1/trigger-subscriptions/${encodeURIComponent(id)}/dead-letters`;
+    const foreign = await driver.get(path(sub.subscriptionId), { headers: { Authorization: `Bearer ${other}` } });
+    expect(foreign.status, req(R_TENANT, 'trigger-bridge.md §C', `another tenant's read MUST answer 404 (got ${foreign.status})`)).toBe(404);
+    expect(JSON.stringify(foreign.json ?? null).includes('verification_failed'), req(R_TENANT, 'trigger-bridge.md §C', 'a foreign read MUST NOT disclose a record')).toBe(false);
+    const unknown = await driver.get(path(`${sub.subscriptionId}-never-minted`));
+    expect(unknown.status, req(R_TENANT, 'trigger-bridge.md §C', `an id the host never minted MUST answer 404 (got ${unknown.status})`)).toBe(404);
+    expect(readErrorCode(foreign.json), req(R_TENANT, 'trigger-bridge.md §C', 'a foreign id MUST be answered exactly as an unknown one')).toBe(readErrorCode(unknown.json));
+  });
+});

package/src/scenarios/v2-trigger-bridge-delivery.test.ts

@@ -0,0 +1,107 @@
+/**
+ * v2 — the trigger bridge's delivery model on the normative surface
+ * (`spec/v2/core/webhooks.md` §Inbound triggers). The v1 twin is
+ * `trigger-bridge-delivery`; this file shares its requirement ids, as the v2
+ * secrets witness does, so a requirement is one id at every major. The legs
+ * live in `lib/trigger-delivery-witness.ts`; what differs between majors is the
+ * profile row in `lib/major-profile.ts`.
+ *
+ * Unaided: the suite registers a `webhook` subscription and posts Standard
+ * Webhooks-signed bodies to its `ingestUrl` with no OpenWOP credential.
+ *
+ *   1. dedup          a repeated `webhook-id` is effectively-once.
+ *   2. dead-letter    a refused post starts no run and leaves the subscription
+ *                     `active`; a correctly signed post still delivers.
+ *   3. causation      the delivered run's `run.started` carries the delivery.
+ *   4a. run-less attempt   a dead-lettered attempt is content-free, read through
+ *                     `GET /trigger-subscriptions/{subscriptionId}/dead-letters`.
+ *   4b. run-less state change   `inapplicable`: no wire surface causes one and
+ *                     no seam drives one at major 2 (RFC 0232 §E, gap G2).
+ *
+ * Dispositions: `triggerBridge` absent, or `ingestion.inboundSigning` not
+ * listing `standard-webhooks-1` ⇒ `inapplicable` (major 2 has no other delivery
+ * surface). Leg 4a also needs `triggerBridge.deadLetter`.
+ *
+ * Proven against a scratch double in `lib/trigger-delivery-witness.test.ts`.
+ *
+ * @see spec/v2/core/webhooks.md §Inbound triggers
+ * @see RFCS/0230-inbound-webhook-ingest-contract.md, RFCS/0232-trigger-dead-letter-read.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { familyAdvertised, v2Discovery, v2Validator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { noteObservation } from '../lib/row-observation.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { adverts, causationLeg, dedupLeg, refusedLeg, runlessAttemptLeg, runlessStateChangeLeg, type TriggerAdverts } from '../lib/trigger-delivery-witness.js';
+
+const PROFILE = majorProfile(2);
+const R_DEDUP = 'openwop.requirement.0083.trigger-delivery.dedup';
+const R_DEAD_LETTER = 'openwop.requirement.0083.trigger-delivery.dead-letter';
+const R_CAUSATION = 'openwop.requirement.0083.trigger-delivery.causation';
+const R_RUNLESS_ATTEMPT = 'openwop.requirement.0083.trigger-delivery.runless-attempt-content-free';
+const R_RUNLESS_STATE = 'openwop.requirement.0083.trigger-delivery.runless-state-change-content-free';
+
+/**
+ * `familyAdvertised`, not `gateFamily`: `triggerBridge` is optional, and a host that does not advertise it
+ * has taken on no obligation here. `gateFamily` fails an unadvertised family in strict mode (the 2.45.7
+ * `v2-workspace-scope-from-identity` defect).
+ */
+async function discovered(): Promise<TriggerAdverts | string> {
+  if (!(await familyAdvertised('triggerBridge'))) return 'GATED';
+  let doc: Record<string, unknown> | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  return doc ? adverts(PROFILE, doc) : 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0';
+}
+
+describe('v2 trigger-bridge delivery (webhooks.md §Inbound triggers)', () => {
+  it('de-dups a repeated webhook-id: effectively-once', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await dedupLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_DEDUP, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('a refused post starts no run and leaves the subscription active', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await refusedLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_DEAD_LETTER, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('links delivery to run: run.started carries the delivery as causationId', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await causationLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_CAUSATION, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('keeps a dead-lettered run-less attempt content-free', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await runlessAttemptLeg(PROFILE, a, v2Validator('trigger-dead-letter-page'));
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_RUNLESS_ATTEMPT, x.doc, x.message)).toBe(true);
+    noteObservation(`normative-surface path (RFC 0230)${out.note ? `; ${out.note}` : ''}`);
+  });
+
+  it('keeps a run-less subscription state change content-free', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = runlessStateChangeLeg(a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    expect(out.kind, req(R_RUNLESS_STATE, 'webhooks.md §Inbound triggers', 'unreachable: no major-2 surface causes a state change')).toBe('skip');
+  });
+});

package/src/scenarios/v2-trigger-dead-letter-read.test.ts

@@ -0,0 +1,78 @@
+/**
+ * v2 — the trigger dead-letter read's own rules (RFC 0232 §B;
+ * `spec/v2/core/webhooks.md` §Inbound triggers). The v1 twin is
+ * `trigger-dead-letter-read`; the requirement ids are shared, and the legs live
+ * in `lib/trigger-delivery-witness.ts`.
+ *
+ *   paging        `limit` is clamped, and a short page carries `nextCursor`.
+ *   cursor-bound  a cursor minted for one subscription is refused on another,
+ *                 `400 validation_error`.
+ *   tenant-bound  another tenant's bound id is refused `403 id_tenant_mismatch`
+ *                 and discloses nothing (`identity.md` §5; at v1, with bare ids,
+ *                 the same rule is `404` as for an id never minted). An id never
+ *                 minted answers `404`. Needs `OPENWOP_TEST_TENANT_B_API_KEY`,
+ *                 else `blocked`.
+ *
+ * Dispositions: `triggerBridge`, `triggerBridge.deadLetter` or
+ * `ingestion.inboundSigning` not advertised ⇒ `inapplicable`.
+ *
+ * Proven against a scratch double in `lib/trigger-delivery-witness.test.ts`.
+ *
+ * @see spec/v2/core/webhooks.md §Inbound triggers
+ * @see RFCS/0232-trigger-dead-letter-read.md §B
+ * @see spec/v2/core/identity.md §5
+ */
+
+import { describe, it, expect } from 'vitest';
+import { familyAdvertised, v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { loadEnv } from '../lib/env.js';
+import { majorProfile } from '../lib/major-profile.js';
+import { adverts, cursorLeg, pagingLeg, tenantLeg, type TriggerAdverts } from '../lib/trigger-delivery-witness.js';
+
+const PROFILE = majorProfile(2);
+const R_PAGING = 'openwop.requirement.0232.trigger-dead-letters.paging';
+const R_CURSOR = 'openwop.requirement.0232.trigger-dead-letters.cursor-bound';
+const R_TENANT = 'openwop.requirement.0232.trigger-dead-letters.tenant-bound';
+
+/**
+ * `familyAdvertised`, not `gateFamily`: `triggerBridge` is optional, and a host that does not advertise it
+ * has taken on no obligation here. `gateFamily` fails an unadvertised family in strict mode (the 2.45.7
+ * `v2-workspace-scope-from-identity` defect).
+ */
+async function discovered(): Promise<TriggerAdverts | string> {
+  if (!(await familyAdvertised('triggerBridge'))) return 'GATED';
+  let doc: Record<string, unknown> | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  return doc ? adverts(PROFILE, doc) : 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0';
+}
+
+describe('v2 trigger dead-letter read (RFC 0232 §B)', () => {
+  it('clamps limit and continues a short page with nextCursor', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await pagingLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_PAGING, x.doc, x.message)).toBe(true);
+  });
+
+  it('refuses a cursor minted for another subscription', async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await cursorLeg(PROFILE, a);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_CURSOR, x.doc, x.message)).toBe(true);
+  });
+
+  it("refuses another tenant's bound id 403 id_tenant_mismatch and discloses nothing", async () => {
+    const a = await discovered();
+    if (a === 'GATED') return softSkip('inapplicable', 'the host does not advertise triggerBridge at major 2: no obligation');
+    if (typeof a === 'string') return softSkip('blocked', a);
+    const out = await tenantLeg(PROFILE, a, process.env['OPENWOP_TEST_TENANT_B_API_KEY'], loadEnv().apiKey);
+    if (out.kind === 'skip') return softSkip(out.disposition, out.reason);
+    for (const x of out.findings) expect(x.ok, req(R_TENANT, x.doc, x.message)).toBe(true);
+  });
+});