SPEC §15.4 carries MUSTs that no reference implements

[brightbeamarsalan]

§15.4 is written as a threat model and has accumulated normative language that the references do not implement. Two cases so far.

Profile enforcement at dispatch. "Coordinators MUST reject a method call whose namespace's owning profile is not in the workspace's advertised set." Not implemented in either reference. Tracked in #136. Also not implementable as phrased, because namespaces span profiles: participant covers core/1.0 and security-signed/1.0, audit covers core/1.0 and audit-scitt/1.0, task and review and escalate each straddle their home profile and routing/1.0, and workspace covers core, modes and control. The rule has to be per method.

Envelope id replay. "envelope id is a ULID ... which conformant Coordinators MUST reject on second observation (error code -32701 id_reused)". Not implemented. -32701 appears in SPECIFICATION.md §15.4 and in GLOSSARY.md and in no coordinator; neither reference keeps a seen-id set, and no error constant is allocated for it. The task.create idempotency map is a different mechanism serving a different purpose: it dedupes one method by an explicit caller-supplied key, rather than rejecting any envelope whose id has been seen before.

What to do

Two options per claim, and they can differ:

• Implement it, and add the error code and conformance vectors.
• Move it out of the normative voice into the operational threat model in SECURITY.md, which §15.4 already points at for the full model.

Either is fine. Leaving MUSTs in the specification that the reference implementations do not meet is the problem, because the references are what conformance is measured against and both are shipped as the definition of correct behaviour.

Suggest a sweep of the whole of §15 for the same pattern once #136 is settled, and a CI check that every error code named in the specification is allocated in both references.

[brightbeamarsalan]

All of it is on main and CI is green, so closing this. Both named cases, the sweep, and the check.

Profile enforcement at dispatch: implemented in #175, per method rather than per namespace, since six of the twelve namespaces span profiles and the sentence could not be met as written. 15.4 carries the rewrite and 6.5 carries the table it follows from.

Envelope id replay: moved out of the normative voice into SECURITY.md, with what a deployment has to decide before implementing it. The size of a seen-id set is a deployment choice, and task.create's idempotency_key already covers the legitimate retry the refusal would break.

The check you asked for is scripts/check-error-codes.mjs, running in CI. It reads the code tables in 13.3 and every profiles/*.md, and fails on a code named there and missing from a reference, or present in one reference alone. 49 codes checked.

It found a third case while it was being written, which is the best argument for having it. -32401 for a non-monotonic ts: 4.3 stated the rule as strictly monotonic and 15.4 as non-decreasing, so the two could not both be met, and millisecond precision makes the strict form refuse a participant that sends twice inside one millisecond. Neither reference allocated the code. The chain is ordered by arrival and prev_hash rather than the sender's clock, so 4.3 and 15.1 now say that and SECURITY.md carries the operational check.

The sweep of the rest of 15 is in #176. 15.1 listed eight flat obligations on the Coordinator and three were not that: signature verification and step-up are turned on by a profile, TLS and shadow-mode delivery filtering belong to the deployment, and a required_scope is declared per method and enforced by neither reference, which the text now says. 11.3 carried the same unmet shadow-observer MUST and moves with it. What is left is grouped by who does the work, and each unconditional claim is held to the code by a test in each reference, the way 8.1 is.

One thing fell out of the sweep: the workspace descriptor schema required name, coordinator and evidence_count, none of which either reference sends, and declared none of profiles, audit_count, task_count, override_count or routing_policy_uri, all of which both send. Nothing validated against it at runtime. Corrected, and the same test now holds the schema and the coordinator together.

Good issue. The pattern you named is now a CI failure rather than something that accumulates.