@lovrozagar/oat 0.9.1 → 0.10.0

package/dist/runtime/finding.d.ts

@@ -17,6 +17,8 @@ export interface Finding {
     origin?: string;
     /** Fixture filename when `uploads.each` drove the invocation. */
     fixture?: string;
+    /** Operations this finding judges. Absent on run-level findings (teardown, network, pacing). */
+    operations?: string[];
 }
 /**
  * A check that ran, could not reach a verdict, and stopped.
@@ -32,10 +34,21 @@ export interface Inconclusive {
     entity: string;
     /** Why no verdict was reachable, in the reader's terms. */
     reason: string;
+    operations?: string[];
 }
 export declare class FindingCollector {
+    #private;
     readonly findings: Finding[];
     readonly inconclusive: Inconclusive[];
+    constructor(findings?: Finding[], inconclusive?: Inconclusive[], operations?: readonly string[]);
+    /**
+     * A view over the same findings that attributes everything it records to `operations`.
+     *
+     * Each check runs against its own view, so a finding lands on the operations the check judges
+     * without threading an id through every call site. Read-only checks run concurrently, so a
+     * shared "current check" would attribute one check's finding to another.
+     */
+    attributed(operations: readonly string[]): FindingCollector;
     /**
      * Records that a check ran without reaching a verdict. Returns `undefined` so a check can
      * `return ctx.findings.unresolved(...)` at the point it gives up, which keeps the reason
@@ -47,7 +60,7 @@ export declare class FindingCollector {
     security(check: string, entity: string, summary: string, detail: string, evidence: Exchange[], fixture?: string): void;
     spec(check: string, entity: string, summary: string, detail: string, evidence: Exchange[], fixture?: string): void;
     gap(check: string, entity: string, summary: string, detail: string, fixture?: string): void;
-    blocked(check: string, entity: string, summary: string, cause: string): void;
+    blocked(check: string, entity: string, summary: string, cause: string, evidence?: Exchange[]): void;
     checks(): string[];
     byVerdict(verdict: Verdict): Finding[];
 }

package/dist/runtime/finding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../../src/runtime/finding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,MAAM,OAAO,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,CAAA;AAExG,MAAM,WAAW,OAAO;IACvB,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,QAAQ,EAAE,CAAA;IACpB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAA;CACd;AAOD,qBAAa,gBAAgB;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAK;IACjC,QAAQ,CAAC,YAAY,EAAE,YAAY,EAAE,CAAK;IAE1C;;;;OAIG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;IAKpE,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAI9B,OAAO,CACN,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAAE,EACpB,OAAO,CAAC,EAAE,MAAM,GACd,IAAI;IAIP,QAAQ,CACP,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAAE,EACpB,OAAO,CAAC,EAAE,MAAM,GACd,IAAI;IAIP,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAIlH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAI3F,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAW5E,MAAM,IAAI,MAAM,EAAE;IAIlB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,EAAE;CAGtC"}
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../../src/runtime/finding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,MAAM,OAAO,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,CAAA;AAExG,MAAM,WAAW,OAAO;IACvB,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,QAAQ,EAAE,CAAA;IACpB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB;AAOD,qBAAa,gBAAgB;;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,YAAY,EAAE,CAAA;gBAGzB,QAAQ,GAAE,OAAO,EAAO,EAAE,YAAY,GAAE,YAAY,EAAO,EAAE,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE;IAMvG;;;;;;OAMG;IACH,UAAU,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB;IAQ3D;;;;OAIG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;IAKpE,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAI9B,OAAO,CACN,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAAE,EACpB,OAAO,CAAC,EAAE,MAAM,GACd,IAAI;IAIP,QAAQ,CACP,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAAE,EACpB,OAAO,CAAC,EAAE,MAAM,GACd,IAAI;IAIP,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAIlH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAI3F,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAE,QAAQ,EAAO,GAAG,IAAI;IAWvG,MAAM,IAAI,MAAM,EAAE;IAIlB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,EAAE;CAGtC"}

package/dist/runtime/finding.js

@@ -9,19 +9,38 @@ function withFixture(finding, fixture) {
     return { ...finding, fixture };
 }
 export class FindingCollector {
-    findings = [];
-    inconclusive = [];
+    findings;
+    inconclusive;
+    #operations;
+    constructor(findings = [], inconclusive = [], operations) {
+        this.findings = findings;
+        this.inconclusive = inconclusive;
+        this.#operations = operations;
+    }
+    /**
+     * A view over the same findings that attributes everything it records to `operations`.
+     *
+     * Each check runs against its own view, so a finding lands on the operations the check judges
+     * without threading an id through every call site. Read-only checks run concurrently, so a
+     * shared "current check" would attribute one check's finding to another.
+     */
+    attributed(operations) {
+        return new FindingCollector(this.findings, this.inconclusive, operations);
+    }
+    #stamp() {
+        return this.#operations === undefined ? {} : { operations: [...this.#operations] };
+    }
     /**
      * Records that a check ran without reaching a verdict. Returns `undefined` so a check can
      * `return ctx.findings.unresolved(...)` at the point it gives up, which keeps the reason
      * beside the condition that caused it rather than in a comment.
      */
     unresolved(check, entity, reason) {
-        this.inconclusive.push({ check, entity, reason });
+        this.inconclusive.push({ check, entity, reason, ...this.#stamp() });
         return undefined;
     }
     report(finding) {
-        this.findings.push(finding);
+        this.findings.push(finding.operations === undefined ? { ...finding, ...this.#stamp() } : finding);
     }
     backend(check, entity, summary, detail, evidence, fixture) {
         this.report(withFixture({ check, detail, entity, evidence, summary, verdict: "BACKEND_BUG" }, fixture));
@@ -35,12 +54,12 @@ export class FindingCollector {
     gap(check, entity, summary, detail, fixture) {
         this.report(withFixture({ check, detail, entity, evidence: [], summary, verdict: "COVERAGE_GAP" }, fixture));
     }
-    blocked(check, entity, summary, cause) {
+    blocked(check, entity, summary, cause, evidence = []) {
         this.report({
             check,
             detail: `blocked by ${cause}`,
             entity,
-            evidence: [],
+            evidence,
             summary,
             verdict: "BLOCKED",
         });

package/dist/runtime/finding.js.map

@@ -1 +1 @@
-{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../src/runtime/finding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoCH,SAAS,WAAW,CAAC,OAAgB,EAAE,OAAgB;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,OAAO,CAAA;IAC3D,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAA;AAC/B,CAAC;AAED,MAAM,OAAO,gBAAgB;IACnB,QAAQ,GAAc,EAAE,CAAA;IACxB,YAAY,GAAmB,EAAE,CAAA;IAE1C;;;;OAIG;IACH,UAAU,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;QACvD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACjD,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,MAAM,CAAC,OAAgB;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IAED,OAAO,CACN,KAAa,EACb,MAAc,EACd,OAAe,EACf,MAAc,EACd,QAAoB,EACpB,OAAgB;QAEhB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IACxG,CAAC;IAED,QAAQ,CACP,KAAa,EACb,MAAc,EACd,OAAe,EACf,MAAc,EACd,QAAoB,EACpB,OAAgB;QAEhB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IACrG,CAAC;IAED,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,OAAe,EAAE,MAAc,EAAE,QAAoB,EAAE,OAAgB;QAC1G,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IACrG,CAAC;IAED,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,OAAe,EAAE,MAAc,EAAE,OAAgB;QACnF,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IAC7G,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,MAAc,EAAE,OAAe,EAAE,KAAa;QACpE,IAAI,CAAC,MAAM,CAAC;YACX,KAAK;YACL,MAAM,EAAE,cAAc,KAAK,EAAE;YAC7B,MAAM;YACN,QAAQ,EAAE,EAAE;YACZ,OAAO;YACP,OAAO,EAAE,SAAS;SAClB,CAAC,CAAA;IACH,CAAC;IAED,MAAM;QACL,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9D,CAAC;IAED,SAAS,CAAC,OAAgB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;IAC1D,CAAC;CACD"}
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../src/runtime/finding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuCH,SAAS,WAAW,CAAC,OAAgB,EAAE,OAAgB;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,OAAO,CAAA;IAC3D,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAA;AAC/B,CAAC;AAED,MAAM,OAAO,gBAAgB;IACnB,QAAQ,CAAW;IACnB,YAAY,CAAgB;IAC5B,WAAW,CAA+B;IAEnD,YAAY,WAAsB,EAAE,EAAE,eAA+B,EAAE,EAAE,UAA8B;QACtG,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,UAA6B;QACvC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM;QACL,OAAO,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAA;IACnF,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;QACvD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACnE,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,MAAM,CAAC,OAAgB;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IAClG,CAAC;IAED,OAAO,CACN,KAAa,EACb,MAAc,EACd,OAAe,EACf,MAAc,EACd,QAAoB,EACpB,OAAgB;QAEhB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IACxG,CAAC;IAED,QAAQ,CACP,KAAa,EACb,MAAc,EACd,OAAe,EACf,MAAc,EACd,QAAoB,EACpB,OAAgB;QAEhB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IACrG,CAAC;IAED,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,OAAe,EAAE,MAAc,EAAE,QAAoB,EAAE,OAAgB;QAC1G,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IACrG,CAAC;IAED,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,OAAe,EAAE,MAAc,EAAE,OAAgB;QACnF,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IAC7G,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,MAAc,EAAE,OAAe,EAAE,KAAa,EAAE,WAAuB,EAAE;QAC/F,IAAI,CAAC,MAAM,CAAC;YACX,KAAK;YACL,MAAM,EAAE,cAAc,KAAK,EAAE;YAC7B,MAAM;YACN,QAAQ;YACR,OAAO;YACP,OAAO,EAAE,SAAS;SAClB,CAAC,CAAA;IACH,CAAC;IAED,MAAM;QACL,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9D,CAAC;IAED,SAAS,CAAC,OAAgB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;IAC1D,CAAC;CACD"}

package/dist/runtime/run.d.ts

@@ -12,6 +12,7 @@ import { type PersistedPrincipal } from "./principals.ts";
 import { Client } from "./client.ts";
 import type { ProgressHandler } from "./progress.ts";
 import { type Finding, type Inconclusive } from "./finding.ts";
+import { type ScopeReport } from "./scope.ts";
 import { type TeardownReport } from "./teardown.ts";
 export type PrincipalSpec = Principal;
 export interface RunOptions {
@@ -26,7 +27,13 @@ export interface RunOptions {
     seed?: number;
     cohortSize?: number;
     globalHeaders?: Record<string, string>;
+    /** Entity names; each expands into the target set. */
     only?: string[];
+    /**
+     * Target operationIds (`*` globs, `<originId>:` prefixes). With `only`, the union is graded and
+     * every other operation is support — called, never graded. Omit both for a full run.
+     */
+    ops?: string[];
     /** Named profiles this run can select between. `"full"` and `"cheap"` exist without an entry. */
     profiles?: Record<string, ProfileSpec>;
     /** Active profile by name. Defaults to `"full"` — every operation runs, today's behaviour. */
@@ -86,6 +93,14 @@ export interface RunResult {
         entity: string;
         because: string;
     }>;
+    /**
+     * Checks a targeted run did not run on an entity because none of their subjects is a target.
+     * Neither run nor skipped: the check could apply, this run was not asked to grade it.
+     */
+    checksOutOfScope: Array<{
+        check: string;
+        entity: string;
+    }>;
     /** Checks that ran but could not reach a verdict — see `Inconclusive`. */
     inconclusive: Inconclusive[];
     /** Name of the profile that ran — `"full"` unless `--profile` / `config.profile` said otherwise. */
@@ -96,6 +111,8 @@ export interface RunResult {
         operationId: string;
         reason: string;
     }>;
+    /** What this run graded, per operation — targets only when targeted, every operation when full. */
+    scope: ScopeReport;
     created: number;
     teardown: TeardownReport | null;
     /** Credentials as they stood after acquire — written to `<outDir>/<datetime>/principals.json` by the CLI. */

package/dist/runtime/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/runtime/run.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAqD,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEpG,OAAO,KAAK,EACX,YAAY,EACZ,KAAK,EACL,UAAU,EACV,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,OAAO,EACP,MAAM,4BAA4B,CAAA;AAInC,OAAO,EAIN,KAAK,WAAW,EAMhB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,KAAK,kBAAkB,EAA2C,MAAM,iBAAiB,CAAA;AAElG,OAAO,EAAE,MAAM,EAAoD,MAAM,aAAa,CAAA;AACtF,OAAO,KAAK,EAAE,eAAe,EAAoD,MAAM,eAAe,CAAA;AACtG,OAAO,EAAE,KAAK,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAMhF,OAAO,EAAU,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AAgB3D,MAAM,MAAM,aAAa,GAAG,SAAS,CAAA;AAErC,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACtC,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;IAC5B,+FAA+F;IAC/F,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,qEAAqE;IACrE,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,4FAA4F;IAC5F,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,sCAAsC;IACtC,KAAK,CAAC,EAAE,iBAAiB,CAAA;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACvC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,oEAAoE;QACpE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;CACD;AAED,MAAM,WAAW,SAAS;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,KAAK,EAAE,SAAS,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,gGAAgG;IAChG,aAAa,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtE;;;;;;;OAOG;IACH,gBAAgB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,0EAA0E;IAC1E,YAAY,EAAE,YAAY,EAAE,CAAA;IAC5B,oGAAoG;IACpG,OAAO,EAAE,MAAM,CAAA;IACf,mGAAmG;IACnG,iBAAiB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjF,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,6GAA6G;IAC7G,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,+CAA+C;IAC/C,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7B,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QACT,IAAI,EAAE,WAAW,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,UAAU,EAAE,OAAO,CAAA;QACnB,GAAG,EAAE,MAAM,CAAA;KACX,CAAA;CACD;AA2OD,wBAAsB,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA04BjE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/runtime/run.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAqD,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEpG,OAAO,KAAK,EACX,YAAY,EACZ,KAAK,EACL,UAAU,EACV,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,OAAO,EACP,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EAIN,KAAK,WAAW,EAMhB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,KAAK,kBAAkB,EAA2C,MAAM,iBAAiB,CAAA;AAElG,OAAO,EAAE,MAAM,EAAoD,MAAM,aAAa,CAAA;AACtF,OAAO,KAAK,EAAE,eAAe,EAAoD,MAAM,eAAe,CAAA;AACtG,OAAO,EAAE,KAAK,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAIhF,OAAO,EAMN,KAAK,WAAW,EAGhB,MAAM,YAAY,CAAA;AAGnB,OAAO,EAAU,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AAgB3D,MAAM,MAAM,aAAa,GAAG,SAAS,CAAA;AAErC,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACd,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACtC,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;IAC5B,+FAA+F;IAC/F,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,qEAAqE;IACrE,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,4FAA4F;IAC5F,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,sCAAsC;IACtC,KAAK,CAAC,EAAE,iBAAiB,CAAA;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACvC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,oEAAoE;QACpE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;CACD;AAED,MAAM,WAAW,SAAS;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,KAAK,EAAE,SAAS,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,gGAAgG;IAChG,aAAa,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtE;;;;;;;OAOG;IACH,gBAAgB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E;;;OAGG;IACH,gBAAgB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,0EAA0E;IAC1E,YAAY,EAAE,YAAY,EAAE,CAAA;IAC5B,oGAAoG;IACpG,OAAO,EAAE,MAAM,CAAA;IACf,mGAAmG;IACnG,iBAAiB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjF,mGAAmG;IACnG,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,6GAA6G;IAC7G,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,+CAA+C;IAC/C,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7B,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QACT,IAAI,EAAE,WAAW,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,UAAU,EAAE,OAAO,CAAA;QACnB,GAAG,EAAE,MAAM,CAAA;KACX,CAAA;CACD;AAwMD,wBAAsB,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAm/BjE"}

package/dist/runtime/run.js

@@ -7,7 +7,6 @@
  */
 import { buildModel } from "../spec/graph.js";
 import { dereference, loadSpec } from "../spec/load.js";
-import { isAuthFlow } from "../config/define-config.js";
 import { createPrincipal } from "./auth.js";
 import { createExchangeJournal } from "./exchanges.js";
 import { DEFAULT_NETWORK_RETRIES, DEFAULT_NETWORK_WAIT_MS, NetworkError, createNetworkGate, describeNetworkFailure, isNetworkError, probeOrigin, resolveRequestTimeoutMs, } from "./network.js";
@@ -19,12 +18,13 @@ import { FindingCollector } from "./finding.js";
 import { reportFeatureGateSchemaDrift } from "./feature-gate.js";
 import { formatUniqueSets } from "../spec/extensions.js";
 import { excludedByProfile, resolveProfile } from "./profile.js";
+import { authStepOperationIds, buildScopeReport, createIsAuthProvisioned, GradeLedger, resolveTargetScope, staticSubjects, } from "./scope.js";
 import { buildRateLimitRules, RateLimiter } from "./rate-limit.js";
 import { resolveEntityCapabilities } from "./query-capabilities.js";
 import { Ledger } from "./teardown.js";
 import { SchemaValidator } from "./validate.js";
 import { isOverflowError, overflowFrom } from "./fixture.js";
-import { SeedError, fillPath, listExisting, probeCreateFixtures, resolveScope, seedCohort, } from "./world.js";
+import { SeedError, fillPath, listExisting, probeCreateFixtures, resolvePathScope, seedCohort, } from "./world.js";
 function readPointer(body, pointer) {
     const path = pointer
         .replace(/^\$\.?/, "")
@@ -178,39 +178,6 @@ async function readExisting(listOp, client, headers, roots) {
     const records = await listExisting(listOp, client, headers, scope);
     return { records, scope };
 }
-/** operationIds named in any principal `auth.steps` — those creates already ran during login. */
-function authStepOperationIds(principals) {
-    const ids = new Set();
-    for (const principal of principals) {
-        const auth = principal.auth;
-        if (auth === undefined || !isAuthFlow(auth))
-            continue;
-        for (const step of auth.steps) {
-            if ("operationId" in step)
-                ids.add(step.operationId);
-        }
-    }
-    return ids;
-}
-function createIsAuthProvisioned(createOp, authCreates) {
-    return createOp.freshPrincipal || authCreates.has(createOp.operationId);
-}
-function testableEntities(model, only, authCreates) {
-    return [...model.entities.values()]
-        .filter((entity) => {
-        if (only !== undefined && only.length > 0 && !only.includes(entity.name))
-            return false;
-        const createOp = entity.create === undefined ? undefined : model.byOperationId.get(entity.create);
-        const authProvisioned = createOp !== undefined && createIsAuthProvisioned(createOp, authCreates);
-        /* Register-as-create with no item route is the auth flow, not a fixture. */
-        if (authProvisioned && entity.read === undefined)
-            return false;
-        if (entity.invite !== null && entity.list !== undefined)
-            return true;
-        return entity.list !== undefined && entity.create !== undefined && entity.trackable;
-    })
-        .sort((a, b) => a.name.localeCompare(b.name));
-}
 export async function run(options) {
     const startedAt = Date.now();
     const findings = new FindingCollector();
@@ -394,6 +361,32 @@ export async function run(options) {
     if (options.principals[0] === undefined)
         throw new Error("oat: at least one principal is required");
     const originClients = await loadOriginClients(options.origins ?? [], hooks, options.maxInFlight ?? 4, options.globalHeaders ?? {}, onExchange, httpHooks, networkClient);
+    /* Resolved before any principal signs up: a typo in --ops must cost nothing. */
+    const runScope = resolveTargetScope(model, {
+        ...(options.ops === undefined ? {} : { ops: options.ops }),
+        ...(options.only === undefined ? {} : { only: options.only }),
+        authCreates,
+        exclusion: { profile: profile.name, reason: (op) => excludedByProfile(op, profile.spec) },
+        origins: new Map([...originClients].map(([id, origin]) => [id, origin.model])),
+    });
+    const grades = new GradeLedger();
+    tick({
+        message: runScope.mode === "full"
+            ? "scope: full"
+            : `scope: targeted · ${runScope.targets.size} operation(s) · ${runScope.entities.length} entit${runScope.entities.length === 1 ? "y" : "ies"}`,
+        phase: "load",
+        requests: client.transcript.length,
+    });
+    const scopeReport = () => buildScopeReport({
+        authCreates,
+        baseUrl: options.baseUrl,
+        findings: findings.findings,
+        inconclusive: findings.inconclusive,
+        ledger: grades,
+        model,
+        scope: runScope,
+        transcript: client.transcript,
+    });
     const uploads = {
         seed,
         ...(options.uploads === undefined ? {} : { uploads: options.uploads }),
@@ -413,6 +406,7 @@ export async function run(options) {
             throw error;
         noteNetwork(error, "auth");
         return {
+            checksOutOfScope: [],
             checksRun: [],
             checksSkipped: [],
             checksSuppressed: [],
@@ -425,6 +419,7 @@ export async function run(options) {
             principals: [],
             profile: profile.name,
             profileExclusions,
+            scope: scopeReport(),
             teardown: null,
             ...(journal === null ? {} : { exchanges: { count: journal.count } }),
             ...(networkOutcome === undefined ? {} : { network: networkOutcome }),
@@ -443,6 +438,11 @@ export async function run(options) {
     const checksRun = new Set();
     const checksSkipped = [];
     const checksSuppressed = [];
+    const checksOutOfScope = [];
+    const profileExcludes = (operationId) => {
+        const op = model.byOperationId.get(operationId);
+        return op !== undefined && excludedByProfile(op, profile.spec) !== null;
+    };
     const excludedIds = new Set();
     const excludeOp = (entity, op) => {
         if (op === undefined)
@@ -454,7 +454,9 @@ export async function run(options) {
             return true;
         excludedIds.add(op.operationId);
         profileExclusions.push({ entity: entity.name, operationId: op.operationId, reason });
-        findings.gap("profile.skip", entity.name, `${op.operationId} excluded by profile "${profile.name}"`, `${reason}, under --profile ${profile.name}. Checks that depend on this operation stand ` +
+        findings
+            .attributed([op.operationId])
+            .gap("profile.skip", entity.name, `${op.operationId} excluded by profile "${profile.name}"`, `${reason}, under --profile ${profile.name}. Checks that depend on this operation stand ` +
             "down rather than run against data oat did not create through it.");
         return true;
     };
@@ -465,6 +467,14 @@ export async function run(options) {
             return;
         if (networkGate.exhausted)
             return;
+        /* Targets this entity's checks can grade. Seeding findings land on them: under --ops a seed
+         * that fails leaves exactly these ungraded, and the report has to say which. */
+        const entityTargets = runScope.mode === "full"
+            ? createOp === undefined
+                ? []
+                : [createOp.operationId]
+            : [...staticSubjects(entity, model)].filter((id) => runScope.inScope(id));
+        const entityFindings = entityTargets.length === 0 ? findings : findings.attributed(entityTargets);
         const inviteOnly = entity.invite !== null && createOp === undefined;
         const authProvisioned = createOp !== undefined && createIsAuthProvisioned(createOp, authCreates);
         if (createOp === undefined && !inviteOnly)
@@ -501,7 +511,7 @@ export async function run(options) {
                 ...alpha.roots,
             });
             if (existing.records.length === 0) {
-                findings.blocked("profile.skip", entity.name, `could not test "${entity.name}"`, `create is excluded by profile "${profile.name}" and the list route returned no ` +
+                entityFindings.blocked("profile.skip", entity.name, `could not test "${entity.name}"`, `create is excluded by profile "${profile.name}" and the list route returned no ` +
                     "existing records to fall back on.");
                 return;
             }
@@ -522,7 +532,7 @@ export async function run(options) {
         }
         else {
             try {
-                scope = await resolveScope(createOp, model, client, {
+                scope = await resolvePathScope(createOp, model, client, {
                     authHeaders: alpha.headers,
                     roots: rootValues,
                     seed,
@@ -541,13 +551,13 @@ export async function run(options) {
                     uploads,
                 }, scope);
                 if (cohort.uniqueGap !== undefined) {
-                    findings.gap("world.seed", entity.name, cohort.uniqueGap, cohort.uniqueGap);
+                    entityFindings.gap("world.seed", entity.name, cohort.uniqueGap, cohort.uniqueGap);
                 }
                 if (cohort.adopted === true) {
                     /* Plan limit after an effect already created the row: keep the id so children
                      * (row after extract→table) can seed, but do not assert write-path oracles
                      * against a body oat never submitted. */
-                    findings.gap("world.seed", entity.name, `seeding "${entity.name}" hit a plan limit; using an existing same-tenant record`, `${createOp.operationId} returned a plan-limit refusal and the list already ` +
+                    entityFindings.gap("world.seed", entity.name, `seeding "${entity.name}" hit a plan limit; using an existing same-tenant record`, `${createOp.operationId} returned a plan-limit refusal and the list already ` +
                         "had a record — likely an earlier x-effects create. Write-path checks stand " +
                         "down rather than treat payment_required as a backend defect.");
                     records = cohort.records;
@@ -567,7 +577,7 @@ export async function run(options) {
                      * but unique-conflict checks still run against that row. Write-path oracles
                      * that need a body oat submitted stay skipped. The seed 409 is not the
                      * unique check passing — that check is the explicit second POST. */
-                    findings.gap("world.seed", entity.name, `seeding "${entity.name}" could not insert because of x-unique`, `${createOp.operationId} returned 409 and the list already had a record. ` +
+                    entityFindings.gap("world.seed", entity.name, `seeding "${entity.name}" could not insert because of x-unique`, `${createOp.operationId} returned 409 and the list already had a record. ` +
                         `x-unique: ${formatUniqueSets(createOp.unique)}. The create could not insert; ` +
                         "unique-conflict checks still run against that row. Write-path oracles that " +
                         "need a body oat submitted stand down.");
@@ -588,15 +598,15 @@ export async function run(options) {
                     /* Same degradation a profile-excluded create takes: the tag said this
                      * principal cannot create the row, so a correct 403 is coverage, not a
                      * seed defect. The 403 body still has to match the documented schema. */
-                    reportFeatureGateSchemaDrift(findings, validator, createOp, model.rawOperations.get(createOp.operationId), cohort.featureGate.exchange, entity.name);
-                    findings.gap("world.seed", entity.name, `seeding "${entity.name}" is gated by ${cohort.featureGate.detail}`, `${cohort.featureGate.detail}. Checks that need a row oat created stand down ` +
+                    reportFeatureGateSchemaDrift(entityFindings, validator, createOp, model.rawOperations.get(createOp.operationId), cohort.featureGate.exchange, entity.name);
+                    entityFindings.gap("world.seed", entity.name, `seeding "${entity.name}" is gated by ${cohort.featureGate.detail}`, `${cohort.featureGate.detail}. Checks that need a row oat created stand down ` +
                         "rather than treat the documented 403 as a defect.");
                     const existing = await readExisting(listOp, client, alpha.headers(), {
                         ...options.roots,
                         ...alpha.roots,
                     });
                     if (existing.records.length === 0) {
-                        findings.blocked("world.seed", entity.name, `could not test "${entity.name}"`, `${cohort.featureGate.detail} and the list route returned no existing ` + "records to fall back on.");
+                        entityFindings.blocked("world.seed", entity.name, `could not test "${entity.name}"`, `${cohort.featureGate.detail} and the list route returned no existing ` + "records to fall back on.");
                         return;
                     }
                     scope = { created: [], values: existing.scope };
@@ -622,13 +632,13 @@ export async function run(options) {
                 }
                 if (isOverflowError(error)) {
                     const overflow = overflowFrom(error, createOp.operationId);
-                    findings.gap("world.seed", entity.name, overflow.message, overflow.message);
+                    entityFindings.gap("world.seed", entity.name, overflow.message, overflow.message);
                     const existing = await readExisting(listOp, client, alpha.headers(), {
                         ...options.roots,
                         ...alpha.roots,
                     });
                     if (existing.records.length === 0) {
-                        findings.blocked("world.seed", entity.name, `could not seed "${entity.name}"`, overflow.message);
+                        entityFindings.blocked("world.seed", entity.name, `could not seed "${entity.name}"`, overflow.message);
                         return;
                     }
                     scope = { created: [], values: existing.scope };
@@ -639,13 +649,23 @@ export async function run(options) {
                     const cause = error instanceof SeedError ? error.cause_ : "unknown";
                     const status = error instanceof SeedError ? error.status : undefined;
                     const message = error instanceof Error ? error.message : String(error);
+                    const failedOp = (error instanceof SeedError ? error.operationId : undefined) ?? createOp.operationId;
+                    const evidence = error instanceof SeedError && error.exchange !== undefined
+                        ? [error.exchange]
+                        : client.transcript.filter((e) => e.status >= 500).slice(-1);
+                    /* Under --ops a create nobody targeted is support. Its failure leaves the targets
+                     * ungraded — blocked, with the evidence — but it is not what this run was asked to
+                     * judge, so it is not reported as a defect of its own. */
+                    const supportFailed = runScope.mode === "targeted" && !runScope.inScope(failedOp);
                     /* A create that fails with 5xx is not a fixture problem — it is the defect.
                      * Reporting it as merely "blocked" buries the most serious thing oat found. */
-                    if (status !== undefined && status >= 500) {
-                        findings.backend("create.does-not-error", entity.name, `creating a "${entity.name}" fails with a server error`, `${message}. The request body was generated from the documented schema, so ` +
+                    if (status !== undefined && status >= 500 && !supportFailed) {
+                        findings
+                            .attributed([failedOp])
+                            .backend("create.does-not-error", entity.name, `creating a "${entity.name}" fails with a server error`, `${message}. The request body was generated from the documented schema, so ` +
                             "either the handler rejects input the document permits, or it is failing " +
                             "outright. Everything downstream of this entity is untestable until it is " +
-                            "fixed.", client.transcript.filter((e) => e.status >= 500).slice(-1));
+                            "fixed.", evidence);
                     }
                     /* Fall back to whatever already exists. A backend whose create is broken can still
                      * have a working list, and read-only coverage beats no coverage — this is exactly
@@ -655,10 +675,10 @@ export async function run(options) {
                         ...alpha.roots,
                     });
                     if (existing.records.length === 0) {
-                        findings.blocked("world.seed", entity.name, `could not seed "${entity.name}"`, `${cause}: ${message}`);
+                        entityFindings.blocked("world.seed", entity.name, `could not seed "${entity.name}"`, supportFailed ? `support operation ${failedOp} failing: ${message}` : `${cause}: ${message}`, evidence);
                         return;
                     }
-                    findings.gap("world.seed", entity.name, `seeding "${entity.name}" failed; running read-only checks against existing records`, `${cause}: ${message}. Write-path and lifecycle checks are skipped for this entity.`);
+                    entityFindings.gap("world.seed", entity.name, `seeding "${entity.name}" failed; running read-only checks against existing records`, `${cause}: ${message}. Write-path and lifecycle checks are skipped for this entity.`);
                     scope = { created: [], values: existing.scope };
                     records = existing.records;
                     degraded = true;
@@ -668,7 +688,7 @@ export async function run(options) {
         const actorOf = async (principal, seedOffset) => {
             const roots = { ...options.roots, ...principal.roots };
             try {
-                const next = await resolveScope(listOp, model, client, {
+                const next = await resolvePathScope(listOp, model, client, {
                     authHeaders: principal.headers,
                     roots,
                     seed: seed + seedOffset,
@@ -786,9 +806,12 @@ export async function run(options) {
             actors,
             altAuth,
             altScope,
-            asyncOps: model.operations.filter((op) => op.entity === entity.name && op.async !== null && invocable(op)),
-            effectOps: model.operations.filter((op) => op.entity === entity.name && op.effects.length > 0 && invocable(op)),
-            waitOps: model.operations.filter((op) => op.entity === entity.name && op.wait !== null && invocable(op)),
+            /* Narrowed to targets: these are the subjects their checks invoke, and invoking an
+             * untargeted one is exactly the cost --ops exists to skip. */
+            asyncOps: model.operations.filter((op) => op.entity === entity.name && op.async !== null && invocable(op) && runScope.inScope(op.operationId)),
+            effectOps: model.operations.filter((op) => op.entity === entity.name && op.effects.length > 0 && invocable(op) && runScope.inScope(op.operationId)),
+            waitOps: model.operations.filter((op) => op.entity === entity.name && op.wait !== null && invocable(op) && runScope.inScope(op.operationId)),
+            inScope: (op) => runScope.inScope(op.operationId),
             hooks,
             outOfBand,
             auth: alpha.headers,
@@ -833,7 +856,20 @@ export async function run(options) {
                 : undefined,
         };
         entitiesTested.push(entity.name);
+        /* Subjects each check grades on this entity: in scope, and not excluded by the profile. */
+        const gradedBy = new Map();
         const runOne = async (check) => {
+            const graded = gradedBy.get(check.id) ?? [];
+            let judged;
+            const view = {
+                ...ctx,
+                ...(graded.length === 0 ? {} : { findings: findings.attributed(graded) }),
+                judged: (operationIds) => {
+                    judged ??= new Set();
+                    for (const id of operationIds)
+                        judged.add(id);
+                },
+            };
             checksRun.add(check.id);
             currentCheck = check.id;
             currentPhase = "test";
@@ -846,15 +882,16 @@ export async function run(options) {
                 requests: client.transcript.length,
             });
             try {
-                await check.run(ctx);
+                await check.run(view);
             }
             catch (error) {
                 if (isNetworkError(error)) {
                     noteNetwork(error, entity.name);
                     return;
                 }
-                findings.gap(check.id, entity.name, `check "${check.id}" could not complete`, error instanceof Error ? error.message : String(error));
+                view.findings.gap(check.id, entity.name, `check "${check.id}" could not complete`, error instanceof Error ? error.message : String(error));
             }
+            grades.graded(judged === undefined ? graded : graded.filter((id) => judged?.has(id) === true), check.id);
         };
         /* Cascade suppression: a check whose premise is already known broken would report a
          * consequence, not a defect. One root cause, one finding. */
@@ -881,6 +918,7 @@ export async function run(options) {
                 const because = failed ? dependency : inherited;
                 suppressedBy.set(check.id, because);
                 checksSuppressed.push({ because, check: check.id, entity: entity.name });
+                grades.suppress(gradedBy.get(check.id) ?? [], check.id);
                 return true;
             }
             return false;
@@ -902,14 +940,19 @@ export async function run(options) {
             await Promise.all(pending.map(runOne));
         };
         for (const check of CHECKS) {
+            const graded = check.subjects(entity, model).filter((id) => runScope.inScope(id) && !profileExcludes(id));
+            /* Out of scope is not a skip: the check could have run, this run was not asked to. */
+            if (runScope.mode === "targeted" && graded.length === 0) {
+                checksOutOfScope.push({ check: check.id, entity: entity.name });
+                continue;
+            }
+            gradedBy.set(check.id, graded);
             if (!check.applicable(ctx)) {
                 /* Recorded, not dropped: on an API shaped unlike the fixture this is most of the
                  * suite, and a silent skip reads exactly like a clean result. */
-                checksSkipped.push({
-                    check: check.id,
-                    entity: entity.name,
-                    needs: check.needs ?? "an unstated precondition",
-                });
+                const needs = check.needs ?? "an unstated precondition";
+                checksSkipped.push({ check: check.id, entity: entity.name, needs });
+                grades.skipped(graded, needs);
                 continue;
             }
             if (check.mutates === true) {
@@ -935,7 +978,7 @@ export async function run(options) {
      * entities: a child create in flight while a parent page-walk runs invents pagination
      * findings, so there are no entity lanes.
      */
-    const queue = testableEntities(model, options.only, authCreates);
+    const queue = runScope.entities;
     entityTotal = queue.length;
     for (const [index, entity] of queue.entries()) {
         if (networkGate.exhausted) {
@@ -982,8 +1025,9 @@ export async function run(options) {
         rank: principal.rank,
         ...(principal.inviteAs === undefined ? {} : { inviteAs: principal.inviteAs }),
     }));
+    const coverage = scopeReport();
     if ((options.origins ?? []).length > 0 && options.skipPrincipalTeardown !== true) {
-        await runSecondaryOrigins(options, persisted, findings, checksRun, checksSkipped, checksSuppressed, entitiesTested);
+        await runSecondaryOrigins(options, persisted, findings, checksRun, checksSkipped, checksSuppressed, checksOutOfScope, entitiesTested, runScope, coverage);
     }
     if (options.skipPrincipalTeardown !== true) {
         await teardownPrincipals(resolved, hooks, findings);
@@ -994,6 +1038,7 @@ export async function run(options) {
         requests: client.transcript.length,
     });
     return {
+        checksOutOfScope,
         checksRun: [...checksRun].sort(),
         checksSkipped,
         checksSuppressed,
@@ -1006,6 +1051,7 @@ export async function run(options) {
         principals: persisted,
         profile: profile.name,
         profileExclusions,
+        scope: coverage,
         teardown,
         ...(journal === null ? {} : { exchanges: { count: journal.count } }),
         ...(networkOutcome === undefined ? {} : { network: networkOutcome }),
@@ -1028,8 +1074,15 @@ async function loadOriginClients(origins, hooks, maxInFlight, globalHeaders, onE
     }
     return map;
 }
-async function runSecondaryOrigins(options, persisted, findings, checksRun, checksSkipped, checksSuppressed, entitiesTested) {
+async function runSecondaryOrigins(options, persisted, findings, checksRun, checksSkipped, checksSuppressed, checksOutOfScope, entitiesTested, runScope, coverage) {
     for (const origin of options.origins ?? []) {
+        /* Targets were resolved against every origin up front; an origin none of them name has
+         * nothing to grade, and running it anyway is the cost --ops exists to skip. */
+        const originOps = runScope.origins.get(origin.id);
+        if (runScope.mode === "targeted" && originOps === undefined) {
+            coverage.originsSkipped.push(origin.id);
+            continue;
+        }
         const originHooks = options.hooks === undefined
             ? undefined
             : (() => {
@@ -1048,7 +1101,7 @@ async function runSecondaryOrigins(options, persisted, findings, checksRun, chec
             ...(options.roots === undefined ? {} : { roots: options.roots }),
             ...(options.seed === undefined ? {} : { seed: options.seed }),
             ...(options.cohortSize === undefined ? {} : { cohortSize: options.cohortSize }),
-            ...(options.only === undefined ? {} : { only: options.only }),
+            ...(originOps === undefined ? {} : { ops: originOps }),
             ...(options.profiles === undefined ? {} : { profiles: options.profiles }),
             ...(options.profile === undefined ? {} : { profile: options.profile }),
             ...(options.rateLimits === undefined ? {} : { rateLimits: options.rateLimits }),
@@ -1073,6 +1126,13 @@ async function runSecondaryOrigins(options, persisted, findings, checksRun, chec
         }
         for (const entity of result.entitiesTested)
             entitiesTested.push(`${origin.id}:${entity}`);
+        for (const item of result.checksOutOfScope) {
+            checksOutOfScope.push({ ...item, entity: `${origin.id}:${item.entity}` });
+        }
+        for (const op of result.scope.operations)
+            coverage.operations.push({ ...op, origin: origin.id });
+        for (const use of result.scope.support)
+            coverage.support.push({ ...use, origin: origin.id });
         for (const item of result.inconclusive) {
             findings.unresolved(item.check, `${origin.id}:${item.entity}`, item.reason);
         }