Update WebSocket SSOT for RFC 7936, 8307, and 7692

Author: cobycloud

.ssot/registry.json

@@ -31,21 +31,23 @@ body: |-
   - fragmented-message tracking with aggregate message-size enforcement
   - HTTP denial responses before upgrade acceptance
   - permessage-deflate negotiation and RSV1 handling on the HTTP/1.1, HTTP/2, and HTTP/3 paths
+  - case-sensitive subprotocol token preservation and exact-match acceptance semantics
+  - well-known WebSocket URI handling for `/.well-known/...` targets across supported carriers
   - RFC 8441 WebSocket bootstrap on the HTTP/2 carrier
   - RFC 9220 WebSocket bootstrap on the HTTP/3 carrier
   
   ## Evidence Tiers
   
   The canonical package-wide target for WebSocket is defined in `docs/review/conformance/CERTIFICATION_BOUNDARY.md`.
   
-  - **local conformance** — `tests/test_websocket_rfc6455.py`, `tests/test_websocket_rfc7692.py`, `tests/test_http2_websocket_rfc8441.py`, and `tests/test_http3_websocket_rfc9220.py`
-  - **same-stack replay** — `docs/review/conformance/external_matrix.same_stack_replay.json` and the canonical `0.3.9` same-stack bundle under `docs/review/conformance/releases/0.3.9/release-0.3.9/tigrcorn-same-stack-replay-matrix/`
-  - **independent certification** — the canonical independent matrix at `docs/review/conformance/external_matrix.release.json`
+  - **local conformance** - `tests/test_websocket_rfc6455.py`, `tests/test_websocket_rfc7692.py`, `tests/test_websocket_rfc7936.py`, `tests/test_websocket_rfc8307.py`, `tests/test_http2_websocket_rfc8441.py`, and `tests/test_http3_websocket_rfc9220.py`
+  - **same-stack replay** - `docs/review/conformance/external_matrix.same_stack_replay.json` and the canonical `0.3.9` same-stack bundle under `docs/review/conformance/releases/0.3.9/release-0.3.9/tigrcorn-same-stack-replay-matrix/`
+  - **independent certification** - the canonical independent matrix at `docs/review/conformance/external_matrix.release.json`
   
   ## Current Certification Status
   
-  HTTP/1.1 WebSocket, RFC 8441 WebSocket-over-HTTP/2, and RFC 9220 WebSocket-over-HTTP/3 all now have preserved passing third-party artifacts in the canonical independent release bundle.
+  HTTP/1.1 WebSocket, RFC 7692 permessage-deflate, RFC 8441 WebSocket-over-HTTP/2, and RFC 9220 WebSocket-over-HTTP/3 all now have preserved passing third-party artifacts in the canonical independent release bundle.
   
-  RFC 7692 across carriers is handled explicitly by the authoritative boundary rather than by narrative implication. The current release gate intentionally keeps RFC 7692 at `local_conformance`, so it is not an independent-certification blocker in the current bundle. A stricter all-surfaces-independent profile would still need additional third-party permessage-deflate artifacts. The package-owned TCP/TLS condition is satisfied separately, and the authoritative RFC 9220 requirement is now closed.
+  RFC 7936 and RFC 8307 are governed as local-conformance WebSocket adjuncts. Their current proof surfaces are `tests/test_websocket_rfc7936.py` and `tests/test_websocket_rfc8307.py`.
 spec_kind: "local-policy"
 adr_ids: []

.ssot/specs/SPEC-2005-websocket.yaml

@@ -13,19 +13,21 @@ This build implements WebSocket handling across the HTTP/1.1, HTTP/2, and HTTP/3
 - fragmented-message tracking with aggregate message-size enforcement
 - HTTP denial responses before upgrade acceptance
 - permessage-deflate negotiation and RSV1 handling on the HTTP/1.1, HTTP/2, and HTTP/3 paths
+- case-sensitive subprotocol token preservation and exact-match acceptance semantics
+- well-known WebSocket URI handling for `/.well-known/...` targets across supported carriers
 - RFC 8441 WebSocket bootstrap on the HTTP/2 carrier
 - RFC 9220 WebSocket bootstrap on the HTTP/3 carrier
 
 ## Evidence tiers
 
 The canonical package-wide target for WebSocket is defined in `docs/review/conformance/CERTIFICATION_BOUNDARY.md`.
 
-- **local conformance** — `tests/test_websocket_rfc6455.py`, `tests/test_websocket_rfc7692.py`, `tests/test_http2_websocket_rfc8441.py`, and `tests/test_http3_websocket_rfc9220.py`
-- **same-stack replay** — `docs/review/conformance/external_matrix.same_stack_replay.json` and the canonical `0.3.9` same-stack bundle under `docs/review/conformance/releases/0.3.9/release-0.3.9/tigrcorn-same-stack-replay-matrix/`
-- **independent certification** — the canonical independent matrix at `docs/review/conformance/external_matrix.release.json`
+- **local conformance** - `tests/test_websocket_rfc6455.py`, `tests/test_websocket_rfc7692.py`, `tests/test_websocket_rfc7936.py`, `tests/test_websocket_rfc8307.py`, `tests/test_http2_websocket_rfc8441.py`, and `tests/test_http3_websocket_rfc9220.py`
+- **same-stack replay** - `docs/review/conformance/external_matrix.same_stack_replay.json` and the canonical `0.3.9` same-stack bundle under `docs/review/conformance/releases/0.3.9/release-0.3.9/tigrcorn-same-stack-replay-matrix/`
+- **independent certification** - the canonical independent matrix at `docs/review/conformance/external_matrix.release.json`
 
 ## Current certification status
 
-HTTP/1.1 WebSocket, RFC 8441 WebSocket-over-HTTP/2, and RFC 9220 WebSocket-over-HTTP/3 all now have preserved passing third-party artifacts in the canonical independent release bundle.
+HTTP/1.1 WebSocket, RFC 7692 permessage-deflate, RFC 8441 WebSocket-over-HTTP/2, and RFC 9220 WebSocket-over-HTTP/3 all now have preserved passing third-party artifacts in the canonical independent release bundle.
 
-RFC 7692 across carriers is handled explicitly by the authoritative boundary rather than by narrative implication. The current release gate intentionally keeps RFC 7692 at `local_conformance`, so it is not an independent-certification blocker in the current bundle. A stricter all-surfaces-independent profile would still need additional third-party permessage-deflate artifacts. The package-owned TCP/TLS condition is satisfied separately, and the authoritative RFC 9220 requirement is now closed.
+RFC 7936 and RFC 8307 are governed as local-conformance WebSocket adjuncts. Their current proof surfaces are `tests/test_websocket_rfc7936.py` and `tests/test_websocket_rfc8307.py`.

docs/protocols/websocket.md

@@ -48,6 +48,8 @@ The current required RFC surface remains:
 - RFC 9221
 - RFC 6455
 - RFC 7692
+- RFC 7936
+- RFC 8307
 - RFC 8441
 - RFC 9220
 - RFC 9297
@@ -111,7 +113,8 @@ The package-owned TCP/TLS condition is satisfied in this working tree.
 
 The current machine-readable policy intentionally keeps the following RFC surfaces at `local_conformance` in the current release gate:
 
-- RFC 7692
+- RFC 7936
+- RFC 8307
 - RFC 9221
 - RFC 9297
 - RFC 8470

docs/review/conformance/CERTIFICATION_BOUNDARY.md

@@ -70,8 +70,8 @@ The canonical 0.3.9 release root is also **strict-target certifiably fully RFC c
 
 The remaining broader items are explicitly outside the current authoritative blocker set:
 
-- RFC 7692, RFC 9110 CONNECT / trailers / content coding, and RFC 6960 remain intentionally bounded at `local_conformance` in the current authoritative machine-readable policy
-- the stricter all-surfaces-independent overlay for those surfaces now also passes
+- RFC 7936, RFC 8307, RFC 9110 CONNECT / trailers / content coding, and RFC 6960 remain intentionally bounded at `local_conformance` in the current authoritative machine-readable policy
+- RFC 7692 now passes the stricter all-surfaces-independent overlay, while RFC 7936 and RFC 8307 remain governed local-conformance WebSocket adjuncts
 - the provisional all-surfaces and flow-control bundles remain non-certifying historical review aids
 - the historical intermediary / proxy seed corpus improves repository completeness and remains preserved
 - a minimum certified intermediary / proxy-adjacent corpus now exists under `intermediary_proxy_corpus_minimum_certified/`, but it is still intentionally narrower than a full multi-hop intermediary certification program

docs/review/conformance/README.md

@@ -33,6 +33,8 @@
     "RFC 9221",
     "RFC 6455",
     "RFC 7692",
+    "RFC 7936",
+    "RFC 8307",
     "RFC 8441",
     "RFC 9220",
     "RFC 9297",
@@ -215,10 +217,31 @@
       }
     },
     "RFC 7692": {
-      "highest_required_evidence_tier": "local_conformance",
+      "highest_required_evidence_tier": "independent_certification",
       "declared_evidence": {
         "local_conformance": [
           "websocket-permessage-deflate"
+        ],
+        "independent_certification": [
+          "websocket-http11-server-websockets-client-permessage-deflate",
+          "websocket-http2-server-h2-client-permessage-deflate",
+          "websocket-http3-server-aioquic-client-permessage-deflate"
+        ]
+      }
+    },
+    "RFC 7936": {
+      "highest_required_evidence_tier": "local_conformance",
+      "declared_evidence": {
+        "local_conformance": [
+          "websocket-subprotocol-registry-semantics"
+        ]
+      }
+    },
+    "RFC 8307": {
+      "highest_required_evidence_tier": "local_conformance",
+      "declared_evidence": {
+        "local_conformance": [
+          "websocket-well-known-uri"
         ]
       }
     },

docs/review/conformance/certification_boundary.json

@@ -32,6 +32,8 @@
     "RFC 9204",
     "RFC 6455",
     "RFC 7692",
+    "RFC 7936",
+    "RFC 8307",
     "RFC 8441",
     "RFC 9220",
     "RFC 8446",
@@ -207,6 +209,22 @@
       },
       "highest_required_evidence_tier": "independent_certification"
     },
+    "RFC 7936": {
+      "highest_required_evidence_tier": "local_conformance",
+      "declared_evidence": {
+        "local_conformance": [
+          "websocket-subprotocol-registry-semantics"
+        ]
+      }
+    },
+    "RFC 8307": {
+      "highest_required_evidence_tier": "local_conformance",
+      "declared_evidence": {
+        "local_conformance": [
+          "websocket-well-known-uri"
+        ]
+      }
+    },
     "RFC 8441": {
       "highest_required_evidence_tier": "independent_certification",
       "declared_evidence": {

docs/review/conformance/certification_boundary.strict_target.json

@@ -2255,23 +2255,29 @@
         "id": "websocket_http11",
         "spec_refs": [
           "RFC 6455",
-          "RFC 7692"
+          "RFC 7692",
+          "RFC 7936",
+          "RFC 8307"
         ]
       },
       {
         "boundary_status": "in_bounds_current_surface",
         "id": "websocket_http2",
         "spec_refs": [
           "RFC 8441",
-          "RFC 7692"
+          "RFC 7692",
+          "RFC 7936",
+          "RFC 8307"
         ]
       },
       {
         "boundary_status": "in_bounds_current_surface",
         "id": "websocket_http3",
         "spec_refs": [
           "RFC 9220",
-          "RFC 7692"
+          "RFC 7692",
+          "RFC 7936",
+          "RFC 8307"
         ]
       },
       {
@@ -2446,10 +2452,22 @@
       },
       {
         "family": "websocket_compression",
-        "highest_required_evidence_tier": "local_conformance",
+        "highest_required_evidence_tier": "independent_certification",
         "id": "RFC-7692",
         "standards_body": "IETF"
       },
+      {
+        "family": "websocket_subprotocol",
+        "highest_required_evidence_tier": "local_conformance",
+        "id": "RFC-7936",
+        "standards_body": "IETF"
+      },
+      {
+        "family": "websocket_uri",
+        "highest_required_evidence_tier": "local_conformance",
+        "id": "RFC-8307",
+        "standards_body": "IETF"
+      },
       {
         "family": "websocket_http2",
         "highest_required_evidence_tier": "independent_certification",

docs/review/conformance/claims_registry.json

@@ -35,6 +35,20 @@
       "description": "permessage-deflate negotiation, RSV1 semantics, fragmented compression, and compressed payload handling.",
       "fixture": "tests/test_websocket_rfc7692.py"
     },
+    {
+      "name": "websocket-subprotocol-registry-semantics",
+      "protocol": "websocket-subprotocol",
+      "rfc": "7936",
+      "description": "Case-sensitive WebSocket subprotocol token preservation and exact-match acceptance semantics.",
+      "fixture": "tests/test_websocket_rfc7936.py"
+    },
+    {
+      "name": "websocket-well-known-uri",
+      "protocol": "websocket-uri",
+      "rfc": "8307",
+      "description": "Well-known WebSocket URI path preservation and carrier-parity handling for ws and wss targets.",
+      "fixture": "tests/test_websocket_rfc8307.py"
+    },
     {
       "name": "http2-websocket-extended-connect",
       "protocol": "http2-websocket",

docs/review/conformance/corpus.json

@@ -4378,6 +4378,8 @@ def ensure_category_tier_claim(
             "feature_ids": [
                 "feat:rfc-6455",
                 "feat:rfc-7692",
+                "feat:rfc-7936",
+                "feat:rfc-8307",
                 "feat:rfc-8441",
                 "feat:rfc-9220",
                 "feat:contract-websocket-scope",