spec: OVOS-COMMON-QUERY-1 — contest correlation, deterministic selection, responder identity

CHANGELOG.md

@@ -468,6 +468,74 @@ version 2: its `{{ … }}` sequences become substitution points, and its
 
 ### 2
 
+- Audit pass — correlation, determinism, and identity. Stays in class
+  2: the new `query_id` correlation field is **tolerated absent**
+  (a pong or response without it is still accepted when its utterance
+  and session match), so pre-existing skills keep participating and no
+  compatibility class changes.
+  - §6.4 (new) — the **contest identifier**. The plugin generates a
+    `query_id` per contest, carries it in `ovos.common_query.ping` and
+    `<skill_id>.common_query.request`, skills echo it verbatim in the
+    pong and the response, and the plugin discards anything whose
+    `query_id` does not match the active contest. Utterance plus
+    session is not a sufficient key (repeated questions, shared default
+    sessions); OVOS-MSG-1 §5.4 leaves richer discrimination to the
+    asker, and this is it.
+  - §6.3 — early close of the poll window is restricted to
+    **order-independent** sufficiency (all known subscribers have
+    answered). Closing on the first claimant, or on any arrival-order
+    predicate, is now forbidden: it turned answer choice into a
+    latency race between skills.
+  - §8.1 (new) — **deterministic selection**: `conf` descending, then
+    `skill_id` lexicographic ascending. Deployer-defined keys are
+    admitted only when they are deterministic functions of the response
+    set, and a configured reranker MUST be deterministic. The opt-in,
+    default-off fast-win rule stays the one sanctioned exception.
+  - §6.5, §7.1.1 (new) — responder identity and hygiene: a pong's
+    `skill_id` is validated against the envelope `source`; a response's
+    payload `skill_id` MUST equal the topic prefix; one pong and one
+    response per `skill_id` per contest, first wins; malformed pongs
+    count as not claiming; malformed responses — including `conf`
+    outside `[0, 1]`, which is discarded rather than clamped — are
+    dropped whole; late pongs and responses are discarded and never
+    seed a later contest.
+  - §7.1.1 — **prefix extraction** defined: the `<skill_id>` of a
+    `<skill_id>.common_query.request` / `.response` topic is everything
+    before the `.common_query.` infix, so a dotted `skill_id` such as
+    `wiki.test` parses unambiguously. OVOS-MSG-1 §2.1.1 separator
+    hygiene binds only the structural infix here.
+  - §5, §5.1 — early start gets an explicit **language carve-out**
+    against PIPELINE-1 §9.1: the pre-resolution tag is provisional,
+    never published in `Match.lang`, and the cached contest is void
+    unless it equals the `lang` argument. The resolved `lang` argument
+    replaces `context.session.lang` as the normative language source in
+    §6.1, §7.1 and §9.
+  - §5.1 — the transparency claim is narrowed to **selection**: early
+    start is not transparent in invocation, since a later-blacklisted
+    skill has already run its network and database calls. Deployments
+    where invocation is privacy-sensitive or billable SHOULD NOT enable
+    it.
+  - §5.2 — an abandoned contest's cache entry MUST be evicted when the
+    utterance lifecycle terminates, with a wall-clock backstop; and the
+    n-best rule is stated — the contest runs for the **first**
+    candidate utterance, which is also `Match.utterance`, matching
+    PIPELINE-1 §4.1.
+  - §7.2 — the collection window's **extension trigger** is defined:
+    it extends from the initial value toward the ceiling only while a
+    claimant is outstanding, and selection happens at the initial
+    window otherwise. `latency_ms` is a hint — implausible values are
+    ignored and it can never push the window past the ceiling.
+  - §8 step 2 — the denylist filter is marked load-bearing: the
+    PIPELINE-1 §5.3 orchestrator backstop cannot fire for common query,
+    because `Match.skill_id` is the plugin's `pipeline_id`. The
+    answering skill is now surfaced as `slots.skill_id` (§9).
+  - §9 — `Match.updated_session` is **omitted** rather than echoing the
+    inbound session, per PIPELINE-1 §4.1.
+  - §4.2 — the gate's "MUST accept" over a fuzzy predicate is demoted
+    to SHOULD; the accept/reject examples are informative.
+  - §14 — the §5.1/§5.2 early-start rules move from the SHOULD list to
+    the MUST list, where their normative text already put them.
+  - §4 — rationale prose trimmed.
 - Initial draft. Specifies the common query pipeline plugin: a
   scatter-gather contest that answers factual questions by
   broadcasting the utterance, collecting competing answers from