@xema/omni-protocol 0.1.47 → 0.1.48

package/dist/testing.js

@@ -257,6 +257,18 @@ export async function exerciseAdapter(adapter, context, options = {}) {
         violations.push(...validateHostGuarantees(context.host.guarantees, "context.host.guarantees"));
         // The zone is the host's to state, so a context without one is a host that cannot exist.
         violations.push(...validateTimeZone(context.timeZone, "context.timeZone"));
+        // A provider that reads its own clock passes the round trip on any machine in the host's zone,
+        // which for a demo and a runner in one datacentre is most of them. A conformance run states a
+        // zone this machine is not in, so the only way the identity carries it is that the provider
+        // took it from the host.
+        if (isTimeZone(context.timeZone)) {
+            const canonical = (zone) => new Intl.DateTimeFormat("en", { timeZone: zone }).resolvedOptions().timeZone;
+            const local = Intl.DateTimeFormat().resolvedOptions().timeZone;
+            if (canonical(context.timeZone) === canonical(local)) {
+                violations.push({ rule: "context.timeZone.local", path: "context.timeZone",
+                    message: `a conformance run states a zone this machine is not in; ${context.timeZone} is this machine's, so a provider reading its own clock would pass the round trip` });
+            }
+        }
         // How the agent hears the call decides what the host owns: on a softphone the host has the
         // audio and reports it; on a desk phone, or off voice, there is none for it to report.
         violations.push(...validatePhone(context.phone, adapter.manifest, "context.phone"));

package/guide.md

@@ -1939,7 +1939,10 @@ field to fill in later: an identity without one is refused (`authentication.iden
 so is a zone that is not an IANA name, wherever it appears. Nothing is ever assumed in its place --
 not the viewer's browser, which gives a different answer per reader for the same record, and not the
 provider's clock. The harness holds a provider to the round trip: the identity carries the zone the
-host stated (`authentication.identity.timeZone.republished`). **The round trip is not the store.**
+host stated (`authentication.identity.timeZone.republished`), and a conformance run states a zone
+the machine running it is not in (`context.timeZone.local`): a provider that read its own clock
+would otherwise pass the round trip on any runner in the host's zone, which for a demo and a runner
+in one datacentre is most of them. **The round trip is not the store.**
 An adapter that echoes the stated zone back onto the identity passes that check with nothing kept,
 and a lead reading a colleague's day would still get the wrong one. What proves the store is a zone
 the run never sent: a colleague's `User` from `describeUsers()` carrying theirs. A provider's own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xema/omni-protocol",
-  "version": "0.1.47",
+  "version": "0.1.48",
   "description": "The Omni protocol: the contract every provider adapter implements",
   "type": "module",
   "license": "MIT",