@openwop/openwop-conformance 2.46.44 → 2.48.0

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.46.44",
-  "corpusTag": "v2.46.44",
+  "version": "2.48.0",
+  "corpusTag": "v2.48.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "55b4467b4ca8278dc8c5944cc0d11e69a2a92fcc6f8608269d7cac2c77626833",
-    "api/v2/asyncapi.yaml": "bbd713d6b5e254622342e21f5a7331514d0901094d8d7daffb3ccac4e15b5558",
-    "api/v2/openapi.yaml": "d82512b61f6b7eeda8a9efeeebc987e5702f452250ad0000623c826a3e5c5aaf",
+    "api/seams-v2.yaml": "61037c7c1d7f9859c9f39c34d6c8e2c65865036dab2d8bd4c5d8e5ff45bbb260",
+    "api/v2/asyncapi.yaml": "0d893e632e7dd72c11e17b38ec19907652265b88bc023a79ac4cbc3992ae8aea",
+    "api/v2/openapi.yaml": "fb704e969745a8886682c532f7de52f6abce67fa4bf1e58ac56a36c5e1bcd935",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -115,14 +115,14 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
-    "schemas/v2/capabilities.schema.json": "c912974988bb56d3d1457cbbd09ff4ffe64533ca7de0953efa5a1d8144ac0b43",
-    "schemas/v2/certification-bundle.schema.json": "29d2ff33d8256d8729cd4914e2ecff5ff07afc310264e2db483a9c0ae13df2a6",
+    "schemas/v2/capabilities.schema.json": "afae0c548cf91a915c2badca77b7c89cd0c657f100c2cd1db64de896c8da2bf0",
+    "schemas/v2/certification-bundle.schema.json": "f9e233dc3584c3cef78809d518749ce37cd1ee79ebbfe58163dc67eeac7802b1",
     "schemas/v2/channel-presence-payload.schema.json": "fc03df0c20cc12a25f7ee6a47503a4c5931d79fe3d5ff24815e8fd7c1bcb9a87",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "9cf235f5d0fe662f34f7e72bfbf2a82e0743046059a9d5af7aec948e228fdb0e",
     "schemas/v2/compact-tool-descriptor.schema.json": "b5c418d72082d5b713bf318212a83397e5be98e56d25ca056302b41b8dd8273b",
     "schemas/v2/compensation-policy.schema.json": "b3c1142637f5bf980f2b0bb67adb47e8cb7abb99a0405a4b6816ccf5d9c089d6",
-    "schemas/v2/compensation-projection.schema.json": "f46977c7076347b5473faa8c4bbe73d8321c33b33c98fff2f26ee7cbada4ed98",
+    "schemas/v2/compensation-projection.schema.json": "6acb2385fab26f172eb69cdca4e0ae6a618c003cfabd89783d2d5cf028a9270e",
     "schemas/v2/configurable.schema.json": "33a6884047e2490f723733bf8b74d3b9164e00374cfea6dc3eac5a70dc368861",
     "schemas/v2/connection-pack-manifest.schema.json": "8d019de6bd0c5b14ea3b227580734ec792521493b396a850f7f9217aa7a6a547",
     "schemas/v2/connection-provider-registry.schema.json": "5b404da328a95c45808929e233ee766ebd635cf0df6f5d15d4c19354dfd7e75d",
@@ -132,7 +132,7 @@
     "schemas/v2/credential-reference.schema.json": "ea699ce30f58fb2c32d4279158b3f730f70be7b2dc8c3037693a76e66eb3e001",
     "schemas/v2/debug-bundle.schema.json": "0ec1e0bca9c0a359cc6cf3448e5200a1c3d3d5b1e5efaa6605231477daaf3fee",
     "schemas/v2/dispatch-config.schema.json": "27cb203d2a5cec90d8eb398569acbd8314ad9b8e231d1acfb8db4aa76f8d8f8b",
-    "schemas/v2/effect-ledger-projection.schema.json": "0d118d385a43921118a76888449c5c3c5618eab1b80914b84a0a1b48d18822c1",
+    "schemas/v2/effect-ledger-projection.schema.json": "ac1f577ec420ece9a5fbe74a33a54aa5bbe4d8259f3c5e9c2bd9b8901ed1c289",
     "schemas/v2/effect-seam-manifest.schema.json": "197ef9944ab027a50d1b9352f317cbbc12c8ad955fdb14650fb90477052ffef0",
     "schemas/v2/error-envelope.schema.json": "5d566a910b715452e99b32876426cd490ef803f2177e3ecbbd1051170d4d4462",
     "schemas/v2/eval-summary.schema.json": "d07f4d116c5410997a81d0bc5387545fb61933a6333c360a26ab8a71c749336b",
@@ -203,14 +203,14 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "202a443678e592a515e33aad7f6ab679a07d8408809f2d4b0f59d156c84ffc65",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "561a3f85b9d00c3f2d6031428b2ca28e95805ed18eb3b069c6c983da62e8f6cc",
+    "spec/v1/core-standard-manifest.json": "b7c589705ad3361c40620c3b796d8a4fe4e45a25776e736b046c33029a9dd55b",
     "spec/v1/deprecations.json": "901fdab0a7212627f1838cbb06ae7b7204f0dff528299e56d3d938deecea27c1",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "871b4b7f12412609c65df1dee40af4cea9dc46996480a157d7863337572d1cb2",
+    "spec/v1/gaps.json": "e2b4a5721aefd6502137b16b55cd1a4edadd37e51029f25e455a44b7e29b3e06",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -218,7 +218,7 @@
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "c58acd84bb67c69043d9f777cbaa16d03e4f0f0a8158d2984526b69981067a14",
     "spec/v2/core/artifact-type-packs.md": "ba5a258ac93b1aa4d74a4464c63a8f72dbbc5d24fd56f34a2c2ce9f464892799",
-    "spec/v2/core/capabilities.md": "316dc256259968e74f24a5529015ad7b78d5866b914aa0c108cb8e7abb724d4d",
+    "spec/v2/core/capabilities.md": "2d94e45537693802032bd0750d05682f5a3f1e189fee2064f8fa969907d74271",
     "spec/v2/core/conformance.md": "2e12b5fceb9cbd1bbf4a536310fe92a4cd44947e48d0466013327c5de202a2d9",
     "spec/v2/core/connection-packs.md": "c80f95bd6a03698f35c72cdb2b46bd973f49203bbd786c26760e35fa86e6f23d",
     "spec/v2/core/conversation.md": "8d6abedf6af408a74577753bfca24719d318e2632e10b45ff5d63bdcf31a8aaa",
@@ -239,17 +239,18 @@
     "spec/v2/core/packs.md": "c46a3bbd8a3a8cfbb6476b88f90d234a45f724aa1f640c9ce6430ba05bacb069",
     "spec/v2/core/persistence.md": "d1767bde0db8038bf6c4f8dc31c4900c67dbd77b4ccc382e99b9f29501b472a3",
     "spec/v2/core/portability.md": "93b9cb8bb85448669df716effb7627236b2bb069f8c5ca7306e8971b9355abfd",
-    "spec/v2/core/replay.md": "cf992b8c7f646a79bd0bdd39451cc9d015f7150a3c342c312b2a89d95abe49de",
+    "spec/v2/core/replay.md": "de705ad72e4878def9a0e1d215df9020c129eabae5f224b8c9b3330bd3b48c47",
     "spec/v2/core/runs.md": "f9c26490e52fa69a10c8e98c8a489e3bc8dfbe3effe334bb1793bc9b575f5efe",
-    "spec/v2/core/security-defaults.md": "18c9956cae51c3da1def80ce94741ad1fd664a8150701160c6cd0ef367c79749",
+    "spec/v2/core/security-defaults.md": "3ca0c9f973232521536024165de8815f80ad9774df5e5210c8e5bfdd4373b670",
     "spec/v2/core/storage.md": "bfcc74526d0f24539188b1c5d1567d8510e80d0b6c39fdc4d19204fcd6fd1f85",
+    "spec/v2/core/telemetry.md": "5e2f30919c51195b57566a2a277663e72dffd1a56a68c19fb8b0d3260629ff7f",
     "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
     "spec/v2/core/versioning.md": "f25c64849e9fa7e3ddc976f33c502bbf0e3fdd158c5c2d5730d524b1f8a19bfe",
     "spec/v2/core/webhooks.md": "861284396eb4f445f4b7bec210f07dd2c96d18084f8511371235b98617bf2b90",
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "5ee76d1ee87677a86d5d9ee2f477b88fc29f9f9d37611040b9ccb08f8f30fb2d",
     "spec/v2/corrections.schema.json": "02f6a0a9531e657693be311af0f59d6432f3efcf645f56ccbf39e5b141e6b641",
-    "spec/v2/declaration.json": "3c3953f30eddf26341ed7ffab7e64bc2807e1def47d57b7e408047e28aab7c0d",
+    "spec/v2/declaration.json": "2d6415ee3b9a801d6a7c4de5ec1ab4d62441dded7b5a44ceb42be80f0a258ce9",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/eos-override.json": "4c72d2f6a658943b01c1de1643cf294642091933af7832f38ee5495df684cb2d",
     "spec/v2/errors.json": "8b4d2ebab569b26f608323ca4c9adaf805ab515286d26532db23fcb97541787f",
@@ -282,6 +283,7 @@
     "spec/v2/facets/connections.schema.json": "f998bb206a5814183bb4720cc34fa43b7ab64d61e39a79437b009c589ce8b78e",
     "spec/v2/facets/heartbeat.schema.json": "81d7fa1895a8b0241bd07cf00a7e7905bef0fd14eb3427325261c62eee5746a6",
     "spec/v2/facets/hostEvents.schema.json": "8834c2fde7bc2ba9eb433f22c9d6ec3f9739f44049eecdbf0a05baf2bfa0bb7d",
+    "spec/v2/facets/idempotency.schema.json": "f20c1e0b08749385b443a7e65293197cfe68cb51486b29659c6af6b96179fa98",
     "spec/v2/facets/interrupt.schema.json": "e89e008a06b0a53cebfeac500c1622ca871c920fc8856b31c019689c5df41b66",
     "spec/v2/facets/limits.schema.json": "e68327665def83007f2573b413757caa602e82ad347d1b85e9853fea153ffb48",
     "spec/v2/facets/loopback.schema.json": "577a34333d1633f8ab00f11e1aeaee2708022faa69a26cf316fc5bea00ee7d50",
@@ -289,9 +291,10 @@
     "spec/v2/facets/nondeterminismPolicy.schema.json": "e9dfaa32e0778a1a837fdad3b8a0673fccda9579ab08c8bfe9777362dd15e989",
     "spec/v2/facets/oauth.schema.json": "3a0cbe249d3bd5a5982349ae7ba2534776cc958e4a57e0fbeabf2bdab6e99e69",
     "spec/v2/facets/packs.schema.json": "d544a280419c0052ce0f3c3b378f7aa04085cadc31df52a3c8f43da600b131b1",
-    "spec/v2/facets/replay.schema.json": "0a5aefb0108c708c6794fadd533cf256709704c4f16dbf44cd63fa8980c78018",
+    "spec/v2/facets/replay.schema.json": "ebb1ce04ed1e4fca237f448e565fe75c833e630320930accecba2ce4e660c8d9",
     "spec/v2/facets/runList.schema.json": "6223e1baaebbb9f4faa71bfe968f8d22b4aa88046d0e43e8d5f56409e7f86e90",
     "spec/v2/facets/sandbox.schema.json": "e75f54486d387b2d089791aa93b5093cd1450f1920753a0f97fc23acdfe978ed",
+    "spec/v2/facets/telemetry.schema.json": "56e96a26910ff1d891eabfc520c2d152fd9881449fdcea7e03df34793763849e",
     "spec/v2/facets/uiPlugins.schema.json": "1fd3f8440cfb6e4422553a7c4b5f091eb3e10a40da0d43e8b977a18929116758",
     "spec/v2/facets/webhooks.schema.json": "54b576f1d150e28e1642693d846ce471c118e9c521bdf3924185305fbd1d0de4",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
@@ -306,9 +309,9 @@
     "spec/v2/path-manifest.json": "3720e502614f301efc7556e0bfcbfa7b7ad8a37c579256ba6bca82417a2728f1",
     "spec/v2/peer-dependency-aliases.json": "cbf62f551f9295b0ac7ba6cc0466abb153563354a57b0622f3ec6e6689cba47e",
     "spec/v2/profiles.json": "b382b261c7844798575f7c1b37c934f0da19846016a2337d883d4f5ef6e05479",
-    "spec/v2/release.json": "26d4c0eb733574959b9bc9a92a5cc1674f73c63b3792241156f628709dad3a1a",
+    "spec/v2/release.json": "8dfa992e0c12d7efda3d0e1c6a63f66790c7c1b29fbe6bb5ae81ba7321f98c39",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "fedf128175065f105c7abb1deb5173093aac64a7b0b7fda286e9697969dbbcb9"
+    "spec/v2/surface-baseline.json": "f1638b1acc7f7408f208c3ada6bd982ed61f9825a6e0e515fba9873808b48192"
   },
-  "corpusCommit": "2111a4fb43c27c18f080355eb0b1dc2e6653bc43"
+  "corpusCommit": "37c05c6cdf6b15dded360ad23455e066e2fc2b99"
 }

package/src/lib/compensation-unwind.ts

@@ -0,0 +1,173 @@
+/**
+ * RFC 0265 — pure judges for `v2-compensation-unwind.test.ts`. The scenario runs
+ * the `conformance-compensate-unwind` fixture (three compensable effects, then a
+ * node that fails) and records the run's event log, its compensation projection
+ * and its effect ledger; these functions decide each leg from those reads, so
+ * the self-tests can fail every wrong host answer without a host.
+ *
+ * Attribution of effect-ledger rows. The ledger projection carries no
+ * forward/inverse marker (`schemas/v2/effect-ledger-projection.schema.json`:
+ * `effectId, nodeId, attempt, keying, state, at`), and a host may record an
+ * inverse under the forward node's id or under one of its own. So a row is
+ * attributed by elimination, using only what the fixture fixes:
+ *   - the FORWARD record of each effect node is that node's earliest row by `at`
+ *     (the forward runs once, deterministically, before the failure);
+ *   - rows for the failing node are neither (it performs no effect);
+ *   - every other row is an INVERSE record — the fixture has nothing else that
+ *     could put a row on the ledger.
+ * A ledger with no row for some effect node never recorded its forward effect,
+ * so the inverse count is not measurable there (RFC 0265 risk R1: the host did
+ * not map the reserved node to a ledgered effect). That is `blocked`, never a
+ * failure.
+ *
+ * @see RFCS/0265-compensation-unwind-witness.md
+ * @see spec/v2/core/security-defaults.md §Compensation
+ */
+
+import { refiredAttempts, type EffectRow } from './effect-refire.js';
+
+export interface Finding { readonly ok: boolean; readonly message: string }
+export interface Ev { readonly type?: unknown; readonly nodeId?: unknown; readonly sequence?: unknown; readonly payload?: unknown }
+export interface LedgerRow extends EffectRow { readonly effectId?: unknown; readonly state?: unknown }
+export interface Attempt { readonly nodeId?: unknown; readonly attempt?: unknown; readonly outcome?: unknown; readonly at?: unknown }
+export interface Projection { readonly status?: unknown; readonly plan?: unknown; readonly attempts?: unknown }
+
+/** The fixture's three compensable effect nodes, in forward order, and its failing node. */
+export const EFFECT_NODES: readonly string[] = ['e1', 'e2', 'e3'];
+export const FAIL_NODE = 'fail';
+
+type Rec = Record<string, unknown>;
+const isRec = (v: unknown): v is Rec => typeof v === 'object' && v !== null && !Array.isArray(v);
+const f = (ok: boolean, message: string): Finding => ({ ok, message });
+const seqOf = (e: Ev): number => (typeof e.sequence === 'number' ? e.sequence : Number.NaN);
+const nodeOf = (e: Ev): unknown => e.nodeId ?? (isRec(e.payload) ? e.payload['nodeId'] : undefined);
+const atOf = (r: LedgerRow): number => (typeof r.at === 'string' ? Date.parse(r.at) : Number.NaN);
+const bySeq = (log: readonly Ev[]): Ev[] => log.filter((e) => Number.isFinite(seqOf(e))).sort((a, b) => seqOf(a) - seqOf(b));
+
+/** Compensation events that end an unwind (asyncapi `compensation.*`). */
+export const COMPENSATION_TERMINAL = new Set(['compensation.completed', 'compensation.failed', 'compensation.manual-intervention-required']);
+/** Projection statuses an unwind can rest in (compensation-projection.schema.json). */
+export const PROJECTION_SETTLED = new Set(['completed', 'partial', 'failed', 'manual-intervention']);
+
+/**
+ * The order the effect nodes FORWARD-completed: the first `node.completed` per
+ * node, by log sequence. An inverse executed under the same node id may emit a
+ * later `node.completed`; the first one is the forward.
+ */
+export function forwardCompletionOrder(log: readonly Ev[], nodes: readonly string[] = EFFECT_NODES): string[] {
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const e of bySeq(log)) {
+    const n = nodeOf(e);
+    if (e.type === 'node.completed' && typeof n === 'string' && nodes.includes(n) && !seen.has(n)) { seen.add(n); out.push(n); }
+  }
+  return out;
+}
+
+/** Leg 1 — `compensation.requested` precedes the first `compensation.started`, and both are present. */
+export function judgePlanBeforeInverse(log: readonly Ev[]): Finding[] {
+  const ordered = bySeq(log);
+  const requested = ordered.find((e) => e.type === 'compensation.requested');
+  const started = ordered.find((e) => e.type === 'compensation.started');
+  return [
+    f(started !== undefined, 'the fixture commits three effects and then fails on a `node-failure` trigger, so an unwind is owed: the log MUST hold `compensation.started` — it holds none, so no inverse action ever began'),
+    f(requested !== undefined, 'the log MUST hold `compensation.requested` (the plan is durable) before any inverse action executes — it holds none'),
+    f(requested !== undefined && started !== undefined && seqOf(requested) < seqOf(started),
+      `\`compensation.started\` MUST follow \`compensation.requested\` (asyncapi): requested at sequence ${requested === undefined ? 'none' : seqOf(requested)}, first started at ${started === undefined ? 'none' : seqOf(started)}`),
+  ];
+}
+
+/**
+ * Leg 2 — the projection's `attempts[]` names the effect nodes in the reverse of
+ * their forward completion order. Judged on the array order of each node's
+ * first attempt; a retried inverse (a second attempt for the same node) does
+ * not reorder the plan.
+ */
+export function judgeReverseCompletion(forwardOrder: readonly string[], attempts: readonly Attempt[], nodes: readonly string[] = EFFECT_NODES): Finding[] {
+  const expected = [...forwardOrder].reverse();
+  const actual: string[] = [];
+  for (const a of attempts) {
+    if (typeof a.nodeId === 'string' && nodes.includes(a.nodeId) && !actual.includes(a.nodeId)) actual.push(a.nodeId);
+  }
+  return [
+    f(actual.length === nodes.length, `attempts[] MUST name every compensable node (${nodes.join(', ')}) — it names ${actual.length === 0 ? 'none' : actual.join(', ')}`),
+    f(JSON.stringify(actual) === JSON.stringify(expected), `orderingModel reverse-completion: attempts[] MUST run in the reverse of forward completion — forward completed ${forwardOrder.join(' → ')}, so attempts MUST read ${expected.join(', ')}; they read ${actual.join(', ') || '(none)'}`),
+  ];
+}
+
+export interface LedgerSplit {
+  /** Effect nodes with no ledger row at all (forward effect not recorded). */
+  readonly missingForward: readonly string[];
+  readonly forward: ReadonlyMap<string, LedgerRow>;
+  readonly inverse: readonly LedgerRow[];
+}
+
+/** Attribute ledger rows to forward and inverse records (see the module comment). */
+export function splitLedger(rows: readonly LedgerRow[], nodes: readonly string[] = EFFECT_NODES, failNode: string = FAIL_NODE): LedgerSplit {
+  const forward = new Map<string, LedgerRow>();
+  for (const n of nodes) {
+    const mine = rows.filter((r) => r.nodeId === n).sort((a, b) => atOf(a) - atOf(b));
+    const first = mine[0];
+    if (first !== undefined) forward.set(n, first);
+  }
+  const forwardRows = new Set<LedgerRow>(forward.values());
+  return {
+    missingForward: nodes.filter((n) => !forward.has(n)),
+    forward,
+    inverse: rows.filter((r) => !forwardRows.has(r) && r.nodeId !== failNode),
+  };
+}
+
+/**
+ * Leg 3 — exactly one inverse record per forward effect, each performed once.
+ * Call only when `split.missingForward` is empty (otherwise the leg is blocked).
+ * A second record for one inverse (an unstable identity, or a re-execution)
+ * shows as a fourth row or a repeated effect; both fail.
+ */
+export function judgeInverseOnce(split: LedgerSplit, nodes: readonly string[] = EFFECT_NODES): Finding[] {
+  const inv = split.inverse;
+  const ids = new Set(inv.map((r) => String(r.effectId)));
+  const out: Finding[] = [
+    f(inv.length === nodes.length, `the effect ledger MUST hold exactly ${nodes.length} inverse records, one per forward effect — it holds ${inv.length} beyond the forward records: ${JSON.stringify(inv).slice(0, 300)}`),
+    f(ids.size === inv.length, `each inverse effect MUST be performed once — ${inv.length} inverse record(s) carry ${ids.size} distinct effectId(s), so an inverse was recorded more than once`),
+  ];
+  // Where the host records inverses under the forward node's id, the per-node
+  // distribution is observable too; under its own ids it is not, and the count
+  // above is the whole witness.
+  const attributable = inv.filter((r) => typeof r.nodeId === 'string' && nodes.includes(r.nodeId));
+  if (attributable.length === inv.length && inv.length > 0) {
+    for (const n of nodes) {
+      const c = attributable.filter((r) => r.nodeId === n).length;
+      out.push(f(c === 1, `node ${n}'s forward effect MUST have exactly one inverse record — it has ${c}`));
+    }
+  }
+  return out;
+}
+
+/** Leg 4 — the projection agrees with the log: `completed` iff `compensation.completed`; `plan[]` names the effect nodes. */
+export function judgeProjectionAgrees(projection: Projection, log: readonly Ev[], nodes: readonly string[] = EFFECT_NODES): Finding[] {
+  const logged = log.some((e) => e.type === 'compensation.completed');
+  const status = projection.status;
+  const plan = Array.isArray(projection.plan) ? (projection.plan as unknown[]) : [];
+  const planned = [...new Set(plan.map((p) => (isRec(p) ? p['nodeId'] : undefined)).filter((n): n is string => typeof n === 'string'))].sort();
+  const want = [...nodes].sort();
+  return [
+    f((status === 'completed') === logged, `the projection's status MUST be "completed" exactly when the log holds compensation.completed — status is ${JSON.stringify(status)}, the log ${logged ? 'holds' : 'does not hold'} compensation.completed`),
+    f(JSON.stringify(planned) === JSON.stringify(want), `plan[] MUST name the three compensable nodes (${want.join(', ')}) — it names ${planned.length === 0 ? 'none' : planned.join(', ')}`),
+  ];
+}
+
+/**
+ * Leg 5 — the records a replay fork's ledger holds that the parent's never did.
+ * Every such row is newly performed work, and on a replay fork of this fixture
+ * that can only be a re-fired forward or a re-fired inverse. The two are not
+ * separable on the wire: a fork ledger keyed per run, re-firing only the
+ * inverses under the forward nodes' ids, looks exactly like one that re-fired
+ * the forwards. So the judge counts every fresh row; a re-fired forward breaks
+ * the same suppression rule (replay.md §Suppression rule 1) and is not a pass
+ * either. `refiredAttempts` treats a fork row that repeats a parent attempt's
+ * `(nodeId, attempt, at)` as inherited history.
+ */
+export function refiredOnFork(parent: readonly LedgerRow[], fork: readonly LedgerRow[]): LedgerRow[] {
+  return refiredAttempts(parent, fork);
+}

package/src/lib/llm-cache-key-2.ts

@@ -0,0 +1,114 @@
+/**
+ * RFC 0260 — LLM cache key recipe 2 (`openwop-llm-key-2`). A pure function: the
+ * suite recomputes the key a host recorded and compares (§B, `0260.key-portable`).
+ *
+ *   key = hex(SHA-256(JCS({ recipe, model, provider, messages, tools, toolChoice,
+ *                           responseSchema, params })))
+ *
+ * `params` names every sampling or output-shaping parameter; one the host did not
+ * send is `null`, never omitted. `stop` is sorted (UTF-16 code-unit order, as JCS
+ * orders keys) and de-duplicated. Any other parameter sits under `params.extra`.
+ * A string message content is the one-part array `[{type: "text", text}]`. No
+ * Unicode normalisation: the bytes are as sent.
+ */
+import { createHash } from 'node:crypto';
+import { canonicalJSON, codeUnitCompare } from './jcs.js';
+
+export const RECIPE_2 = 'openwop-llm-key-2';
+
+/** The parameters recipe 2 names. A request that omits one puts `null` in the key. */
+export const NAMED_PARAMS = ['temperature', 'maxTokens', 'stop', 'seed', 'topP', 'topK', 'frequencyPenalty', 'presencePenalty'] as const;
+export type NamedParam = (typeof NAMED_PARAMS)[number];
+
+export interface KeyInputs {
+  readonly model: string;
+  readonly provider: string;
+  readonly messages: readonly { readonly role: string; readonly content: string | readonly Record<string, unknown>[] }[];
+  readonly tools?: readonly unknown[];
+  readonly toolChoice?: unknown;
+  readonly responseSchema?: unknown;
+  readonly params?: Partial<Record<NamedParam, unknown>> & { readonly extra?: Record<string, unknown> };
+}
+
+const nullIfAbsent = (v: unknown): unknown => (v === undefined ? null : v);
+
+/** The object recipe 2 hashes, before canonicalization. Exported so a failure can show what was hashed. */
+export function keyPreimage(i: KeyInputs): Record<string, unknown> {
+  const p = i.params ?? {};
+  const params: Record<string, unknown> = {};
+  for (const name of NAMED_PARAMS) params[name] = nullIfAbsent(p[name]);
+  if (Array.isArray(params['stop'])) params['stop'] = [...new Set((params['stop'] as unknown[]).map(String))].sort(codeUnitCompare);
+  if (p.extra !== undefined && Object.keys(p.extra).length > 0) params['extra'] = p.extra;
+  return {
+    recipe: RECIPE_2,
+    model: i.model,
+    provider: i.provider,
+    messages: i.messages.map((m) => ({ role: m.role, content: typeof m.content === 'string' ? [{ type: 'text', text: m.content }] : m.content })),
+    tools: i.tools ?? [],
+    toolChoice: nullIfAbsent(i.toolChoice),
+    responseSchema: nullIfAbsent(i.responseSchema),
+    params,
+  };
+}
+
+export function cacheKey2(i: KeyInputs): string {
+  return createHash('sha256').update(canonicalJSON(keyPreimage(i)), 'utf8').digest('hex');
+}
+
+/**
+ * The inputs the `conformance-llm-cache-key` fixture pins (conformance/fixtures.md
+ * §The LLM cache-key fixture): the host's conformance mock is provider
+ * `conformance-mock`, model `conformance-mock-1`; the node sends one user message,
+ * no tools, no toolChoice, no responseSchema, and exactly the parameters in the
+ * run's `inputs.request.params`.
+ */
+export const FIXTURE = 'conformance-llm-cache-key';
+export const NODE_ID = 'llm-call';
+export const FIXTURE_PROVIDER = 'conformance-mock';
+export const FIXTURE_MODEL = 'conformance-mock-1';
+export function fixtureInputs(prompt: string, params: NonNullable<KeyInputs['params']>): KeyInputs {
+  return { model: FIXTURE_MODEL, provider: FIXTURE_PROVIDER, messages: [{ role: 'user', content: prompt }], params };
+}
+
+// ── Judges. Each returns findings and asserts nothing; the scenario frames them with req(). ──
+
+export interface Finding { readonly ok: boolean; readonly message: string }
+const f = (ok: boolean, message: string): Finding => ({ ok, message });
+
+/** The `cacheKey` member of the fixture node's provider-call record on GET /runs/{runId}/effects, or undefined. */
+export interface LedgerKey { readonly recipe?: unknown; readonly digest?: unknown }
+
+export function readLedgerKey(projection: unknown, nodeId: string): LedgerKey | undefined | 'no-record' {
+  const effects = (projection as { effects?: unknown } | null)?.effects;
+  if (!Array.isArray(effects)) return 'no-record';
+  const mine = effects.filter((e) => (e as { nodeId?: unknown } | null)?.nodeId === nodeId);
+  if (mine.length === 0) return 'no-record';
+  const withKey = mine.find((e) => (e as { cacheKey?: unknown }).cacheKey !== undefined) as { cacheKey?: LedgerKey } | undefined;
+  return withKey?.cacheKey;
+}
+
+const HEX64 = /^[0-9a-f]{64}$/;
+
+export function judgeRecorded(key: LedgerKey | undefined): Finding[] {
+  return [
+    f(key !== undefined, 'the provider-call record MUST carry cacheKey when replay.llmCacheKeyRecipe is advertised'),
+    f(key?.recipe === RECIPE_2, `cacheKey.recipe MUST be "${RECIPE_2}" (got ${JSON.stringify(key?.recipe)})`),
+    f(typeof key?.digest === 'string' && HEX64.test(key.digest), `cacheKey.digest MUST be 64 lowercase hex characters (got ${JSON.stringify(key?.digest)})`),
+  ];
+}
+
+/** Two invocations that differ only in one named parameter MUST NOT share a key. */
+export function judgeParamsInKey(a: LedgerKey | undefined, b: LedgerKey | undefined): Finding[] {
+  return [f(typeof a?.digest === 'string' && typeof b?.digest === 'string' && a.digest !== b.digest, `invocations differing only in maxTokens MUST have different keys (got ${String(a?.digest)} twice)`)];
+}
+
+/** The same inputs MUST give the same key. */
+export function judgeStable(a: LedgerKey | undefined, b: LedgerKey | undefined): Finding[] {
+  return [f(typeof a?.digest === 'string' && a.digest === b?.digest, `identical invocations MUST have the same key (got ${String(a?.digest)} and ${String(b?.digest)})`)];
+}
+
+/** The host's key MUST equal the recipe computed from the inputs the fixture pins. */
+export function judgePortable(key: LedgerKey | undefined, expected: KeyInputs): Finding[] {
+  const want = cacheKey2(expected);
+  return [f(key?.digest === want, `cacheKey.digest MUST equal recipe 2 over the fixture's inputs: expected ${want}, got ${String(key?.digest)} (preimage ${canonicalJSON(keyPreimage(expected))})`)];
+}