@openwop/openwop-conformance 1.151.0 → 1.153.0

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.151.0",
-  "corpusCommit": "b1203c4399516184e2ad36aaedfec35331abb175"
+  "suiteVersion": "1.153.0",
+  "corpusCommit": "6c84ef16e2cae24b7e7b8d8bf09b9f46634bf9a5"
 }

package/schemas/README.md

@@ -46,7 +46,7 @@
 | `connection-pack-manifest.schema.json` | `connection-packs.md` + RFC 0095 | DRAFT — manifest for `kind: "connection"` registry packs (RFC 0095). Peer to the node/workflow-chain/prompt/artifact-type/chat-card pack manifests; disjoint via the `kind` discriminator. Distributes a portable provider definition — auth endpoints, read/write scope groups, exactly-one reach (`mcp`/`openapi`/`integration`) — that the RFC 0045/0047 `provider` string resolves against. Carries NO credential material (`connection-pack-no-credential-material`). |
 | `frontend-plugin-manifest.schema.json` | `frontend-plugin-packs.md` + RFC 0117 | DRAFT — manifest for `kind: "frontend-plugin"` registry packs (RFC 0117). Peer to the other pack manifests; disjoint via the `kind` discriminator. Distributes a signed, SANDBOXED UI extension — one or more `uiPlugins[]` (a `pluginId`, a `surface`, an opaque `entry` bundle, a closed `hostApi` allowlist). A backend `runtime` member is FORBIDDEN (`not: {}`). Loaded only in a cross-origin sandbox (`frontend-plugin-isolation`). |
 | `ui-plugin-message.schema.json` | `frontend-plugin-packs.md` + RFC 0117 | DRAFT — the `ui-plugin/1` `postMessage` host-RPC envelope (RFC 0117) between a sandboxed front-end plugin and its host: a plugin→host `request` (closed `method` allowlist), a host→plugin `response` (`ok`+`result` or `ok:false`+`error`), or a host→plugin `event`. Carries the optimistic-concurrency `version` token and the `artifact_conflict` + `currentVersion` shape (`frontend-plugin-rpc-allowlist` / `frontend-plugin-no-byok`). |
-| `conformance-certification-bundle.schema.json` | `conformance-certification.md` + RFC 0089 | DRAFT — machine-readable attestation binding a host's claimed profiles to the reproducible run that substantiates them (suite version + per-scenario pass list + host identity/commit + captured discovery document). Out-of-band; a consumer re-derives each claim via the §B binding rule. |
+| `conformance-certification-bundle.schema.json` | `conformance-certification.md` + RFC 0089 | **DEPRECATED** (RFC 0148; `--certify` defaults to bundle v2 since suite 1.152.0; v1 ceases to substantiate a new certification after 2026-11-10; removal scheduled for v2.0 per `spec/v1/deprecations.json`) — machine-readable attestation binding a host's claimed profiles to the reproducible run that substantiates them (suite version + per-scenario pass list + host identity/commit + captured discovery document). Out-of-band; a consumer re-derives each claim via the §B binding rule. |
 | `conversation-event.schema.json` | `channels-and-reducers.md` + conversation RFC | Multi-turn conversation event shape for orchestrator-driven HITL flows |
 | `conversation-turn.schema.json` | `channels-and-reducers.md` + conversation RFC | Conversation turn shape for user/agent/system messages |
 | `core-conformance-mock-agent-config.schema.json` | `node-packs.md` + RFC 0023 | Config shape for the conformance-only `core.conformance.mock-agent` typeId — drives `agent.*` event emission on cue (`mockReasoning` / `mockToolCalls` / `mockHandoff` / `mockDecision` / `mockConfidence`). Hosts MUST refuse this typeId for production tenants unless `capabilities.conformance.mockAgent` is advertised. |

package/schemas/conformance-certification-bundle.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v1/conformance-certification-bundle.schema.json",
   "title": "OpenWOP Conformance Certification Bundle",
-  "description": "RFC 0089. A machine-readable attestation binding a host's claimed profiles to the reproducible run that substantiates them: suite version, per-scenario pass list, host identity + commit, and the captured discovery document. An out-of-band artifact emitted by the conformance harness (not a runtime wire message). A consumer MUST re-derive each claimed profile from the embedded `discovery.document` rather than trusting `claimedProfiles` verbatim (RFC 0089 §B).",
+  "description": "DEPRECATED (RFC 0148, suite 1.114.0): bundle v1 remains parseable but ceases to substantiate a new certification after 2026-11-10; emit `certification-bundle-v2.schema.json` (the `--certify` default since suite 1.152.0). Scheduled for removal at v2.0 — see spec/v1/deprecations.json. RFC 0089. A machine-readable attestation binding a host's claimed profiles to the reproducible run that substantiates them: suite version, per-scenario pass list, host identity + commit, and the captured discovery document. An out-of-band artifact emitted by the conformance harness (not a runtime wire message). A consumer MUST re-derive each claimed profile from the embedded `discovery.document` rather than trusting `claimedProfiles` verbatim (RFC 0089 §B).",
   "type": "object",
   "additionalProperties": false,
   "required": ["bundleVersion", "generatedAt", "generator", "suite", "host", "discovery", "claimedProfiles", "results"],

package/src/cli.ts

@@ -81,7 +81,10 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
   let impl: string | undefined;
   let implVersion: string | undefined;
   let certify: string | undefined;
-  let bundleVersion: '1' | '2' = '1';
+  // Suite 1.152.0: bundle v2 (RFC 0148) is the default. v1 stays reachable via
+  // `--bundle-version 1` through the RFC 0148 migration window (ends
+  // 2026-11-10) and is removed at v2.0 (spec/v1/deprecations.json).
+  let bundleVersion: '1' | '2' = '2';
   let maxWorkers: number | undefined = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
 
   for (let i = 0; i < argv.length; i++) {
@@ -132,6 +135,11 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
           process.exit(2);
         }
         bundleVersion = v;
+        if (v === '1') {
+          process.stderr.write(
+            'openwop-conformance: --bundle-version 1 is DEPRECATED (RFC 0148). A v1 bundle ceases to substantiate a new certification after 2026-11-10 and the format is removed at v2.0; omit the flag to emit bundle v2.\n',
+          );
+        }
         break;
       }
       case '--certify':

package/src/lib/requirement-ids.test.ts

@@ -0,0 +1,83 @@
+/**
+ * Suite self-tests for per-`it` requirement ids (RFC 0148 §A gap G3; v2
+ * charter Phase 1). These prove the ID GRAMMAR, not a host, so they live in
+ * `src/lib/` and produce no scenario ledger row.
+ *
+ * The generator (`scripts/generate-requirement-registry.mjs`) re-implements
+ * `slugTitle` in plain JS; the fixtures below are the contract both must meet,
+ * so a divergence shows up here before it shows up as a registry-check failure.
+ */
+
+import { describe, it, expect } from 'vitest';
+import {
+  IT_ID_GRAMMAR,
+  ItIdAllocator,
+  itRequirementId,
+  req,
+  scenarioFileOfItId,
+  slugTitle,
+  takeExplicitRequirementId,
+} from './requirement-ids.js';
+
+describe('requirement-ids: slug grammar', () => {
+  const cases: ReadonlyArray<[string, string]> = [
+    ['auth.profiles, when present, is an array of non-empty strings', 'auth-profiles-when-present-is-an-array-of-non-empty-strings'],
+    ['REJECTS the alg-none assertion over the seam (synthetic IdP required)', 'rejects-the-alg-none-assertion-over-the-seam-synthetic-idp-required'],
+    ['  --leading and trailing--  ', 'leading-and-trailing'],
+    ['§B.2 fail-closed: `unbound` ⇒ 401', 'b-2-fail-closed-unbound-401'],
+    ['', 'untitled'],
+    ['!!!', 'untitled'],
+  ];
+  for (const [title, slug] of cases) {
+    it(`slugs ${JSON.stringify(title)} → ${slug}`, () => {
+      expect(slugTitle(title)).toBe(slug);
+    });
+  }
+
+  it('caps the slug at 80 characters without a trailing hyphen', () => {
+    const long = 'word '.repeat(40);
+    const s = slugTitle(long);
+    expect(s.length).toBeLessThanOrEqual(80);
+    expect(s.endsWith('-')).toBe(false);
+  });
+
+  it('every derived id matches IT_ID_GRAMMAR', () => {
+    for (const [title] of cases) {
+      expect(itRequirementId('auth-subject-link.test.ts', title)).toMatch(IT_ID_GRAMMAR);
+    }
+  });
+
+  it('maps an id back to its scenario file', () => {
+    expect(scenarioFileOfItId('openwop.it.auth-subject-link.leaver-deny')).toBe('auth-subject-link.test.ts');
+    expect(scenarioFileOfItId('openwop.it.auth-subject-link.leaver-deny~2')).toBe('auth-subject-link.test.ts');
+    expect(scenarioFileOfItId('openwop.floor.auth')).toBeNull();
+    expect(scenarioFileOfItId('openwop.scenario.auth')).toBeNull();
+  });
+});
+
+describe('requirement-ids: collision suffixing', () => {
+  it('first occurrence is bare; duplicates get ~2, ~3', () => {
+    const a = new ItIdAllocator();
+    expect(a.allocate('x.test.ts', 'same title')).toBe('openwop.it.x.same-title');
+    expect(a.allocate('x.test.ts', 'same title')).toBe('openwop.it.x.same-title~2');
+    expect(a.allocate('x.test.ts', 'Same  Title!')).toBe('openwop.it.x.same-title~3');
+    expect('openwop.it.x.same-title~3').toMatch(IT_ID_GRAMMAR);
+  });
+
+  it('reset() forgets prior titles', () => {
+    const a = new ItIdAllocator();
+    a.allocate('x.test.ts', 't');
+    a.reset();
+    expect(a.allocate('x.test.ts', 't')).toBe('openwop.it.x.t');
+  });
+});
+
+describe('requirement-ids: explicit override', () => {
+  it('req() sets the override for the current test and returns the citation message', () => {
+    takeExplicitRequirementId();
+    const msg = req('openwop.auth.subject-link.leaver-deny', 'auth-profiles.md §Subject linking', 'deactivation MUST deny');
+    expect(msg).toBe('auth-profiles.md §Subject linking: deactivation MUST deny');
+    expect(takeExplicitRequirementId()).toBe('openwop.auth.subject-link.leaver-deny');
+    expect(takeExplicitRequirementId()).toBeNull();
+  });
+});

package/src/lib/requirement-ids.ts

@@ -0,0 +1,111 @@
+/**
+ * Per-`it` requirement ids (RFC 0148 §A, gap G3; v2 charter Phase 1).
+ *
+ * The ledger has recorded ONE row per scenario FILE (`openwop.floor.<file>` /
+ * `openwop.scenario.<file>`). That granularity is what produces certification
+ * gap G8: a file that asserted a positive control and then soft-skipped the
+ * requirement still resolves to `executed-pass` for the whole file. The durable
+ * fix named in `scenario-disposition.ts` is per-`it` recording — this module
+ * supplies the ids for it.
+ *
+ * Why the id derives from the TEST TITLE and not from the `driver.describe`
+ * text: 190 of 1,756 citations interpolate the requirement text at run time
+ * (`docs/REQUIREMENT-REGISTRY-FEASIBILITY.md`), so no text-derived id can be
+ * stable for them. Test titles are literals in every scenario file, stable
+ * across hosts, and already the unit vitest reports on. The registry
+ * (`conformance/requirements.json`, generated) maps each id back to the
+ * citations found inside that test's body, so a bundle reader can still ask
+ * "which spec section did this row witness".
+ *
+ * Grammar: `openwop.it.<file-stem>.<title-slug>` where the stem is the scenario
+ * file name without `.test.ts` and the slug is the title lower-cased, every run
+ * of non-alphanumerics folded to one `-`, trimmed, and capped at 80 characters.
+ * A second test in the same file whose title slugs identically gets `~2`,
+ * `~3`, … (vitest allows duplicate titles; the ledger does not allow duplicate
+ * ids). A scenario MAY override the derived id for the current test with
+ * `req()` when it wants a hand-authored, registry-listed id.
+ */
+
+export const IT_ID_PREFIX = 'openwop.it.';
+export const IT_ID_GRAMMAR = /^openwop\.it\.[a-z0-9]+(?:-[a-z0-9]+)*\.[a-z0-9]+(?:-[a-z0-9]+)*(?:~[2-9][0-9]*)?$/;
+
+const MAX_SLUG = 80;
+
+/** Title → slug: lower-case, non-alphanumeric runs → `-`, trimmed, capped. */
+export function slugTitle(title: string): string {
+  const s = title
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+  const capped = s.length > MAX_SLUG ? s.slice(0, MAX_SLUG).replace(/-+$/g, '') : s;
+  return capped.length > 0 ? capped : 'untitled';
+}
+
+/** `auth-subject-link.test.ts` → `auth-subject-link`. */
+export function fileStem(scenarioFile: string): string {
+  return scenarioFile.replace(/\.test\.ts$/, '');
+}
+
+/** Derived id for one test, before collision suffixing. */
+export function itRequirementId(scenarioFile: string, title: string): string {
+  return `${IT_ID_PREFIX}${fileStem(scenarioFile)}.${slugTitle(title)}`;
+}
+
+/** The scenario file a per-`it` id belongs to, or null when the id is not one. */
+export function scenarioFileOfItId(requirementId: string): string | null {
+  if (!requirementId.startsWith(IT_ID_PREFIX)) return null;
+  const rest = requirementId.slice(IT_ID_PREFIX.length);
+  const dot = rest.indexOf('.');
+  if (dot <= 0) return null;
+  return `${rest.slice(0, dot)}.test.ts`;
+}
+
+/**
+ * Collision suffixing: the first occurrence keeps the bare id, later ones get
+ * `~2`, `~3`, … Keyed per file so a worker running many files never crosses
+ * streams. Reset per file by `setup.ts` when the file finishes.
+ */
+export class ItIdAllocator {
+  private readonly seen = new Map<string, number>();
+
+  allocate(scenarioFile: string, title: string): string {
+    const base = itRequirementId(scenarioFile, title);
+    const n = (this.seen.get(base) ?? 0) + 1;
+    this.seen.set(base, n);
+    return n === 1 ? base : `${base}~${n}`;
+  }
+
+  reset(): void {
+    this.seen.clear();
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Explicit override for the current test.
+// ---------------------------------------------------------------------------
+
+let explicitId: string | null = null;
+
+/**
+ * Attach a hand-authored requirement id to the CURRENT test. The per-`it`
+ * ledger row for this test is recorded under `id` instead of the derived
+ * title id. Returns the usual `driver.describe`-style message so the call
+ * doubles as the assertion message:
+ *
+ *   expect(x, req('openwop.auth.subject-link.leaver-deny', 'auth-profiles.md §Subject linking', 'deactivation MUST deny')).toBe(true)
+ *
+ * The id MUST be listed in `conformance/requirements.json` (the generator
+ * collects `req(` first-argument literals); an unlisted id fails the registry
+ * check, so a hand id cannot drift from the registry silently.
+ */
+export function req(id: string, specSection: string, requirement: string): string {
+  explicitId = id;
+  return `${specSection}: ${requirement}`;
+}
+
+/** setup.ts reads and clears the override after each test. */
+export function takeExplicitRequirementId(): string | null {
+  const id = explicitId;
+  explicitId = null;
+  return id;
+}

package/src/lib/saml-idp.test.ts

@@ -19,10 +19,14 @@
  *
  * @see conformance/src/lib/saml-idp.ts
  * @see RFCS/0163-subject-linking-hardening.md §B
+ *
+ * The RFC 0050 §A reference suite (1 positive + 6 negative variants against the
+ * same fixture) moved here from `scenarios/auth-saml-profile.test.ts` on
+ * 2026-09-02 (RFC 0163 gap G5) for the same reason.
  */
 
 import { describe, it, expect } from 'vitest';
-import { createSyntheticSamlIdp, DEFAULT_SAML_ENTITY_ID } from './saml-idp.js';
+import { createSyntheticSamlIdp, DEFAULT_SAML_ENTITY_ID, type SamlVariant } from './saml-idp.js';
 
 const COLLIDING_SUBJECT = 'idp-op-8f3a';
 
@@ -81,3 +85,43 @@ describe('saml-idp: two-trust-root fixture (RFC 0163 §B)', () => {
     expect(idpB.verify(forged).valid, 'the original root MUST NOT verify it either').toBe(false);
   });
 });
+
+describe('saml-idp: synthetic-IdP reference suite (RFC 0050 §A)', () => {
+  // Server-free: the bundled synthetic IdP (conformance/src/lib/saml-idp.ts)
+  // mints a valid assertion + the 6 negative variants, and its verify()
+  // implements the RFC 0050 §A MUST list. This proves each negative is
+  // detectably malformed and gives the suite a reference SAML validator.
+  // A host's real ACS validates the SAME assertions over the
+  // `auth/saml/validate` seam (scenarios/auth-saml-profile.test.ts, gated on
+  // OPENWOP_TEST_SAML_IDP_URL).
+  const idp = createSyntheticSamlIdp();
+
+  it('publishes a PEM signing certificate', () => {
+    expect(idp.certificatePem).toContain('BEGIN PUBLIC KEY');
+  });
+
+  it('accepts a valid signed, in-window, non-wrapped assertion', () => {
+    const r = idp.verify(idp.mint('valid'));
+    expect(r.valid, `expected valid; got reason=${r.reason}`).toBe(true);
+  });
+
+  const negatives: ReadonlyArray<[Exclude<SamlVariant, 'valid'>, string]> = [
+    ['alg-none', 'alg-none'],
+    ['unsigned', 'unsigned'],
+    ['bad-signature', 'bad-signature'],
+    ['expired', 'expired'],
+    ['not-yet-valid', 'not-yet-valid'],
+    ['signature-wrapping', 'signature-wrapping'],
+  ];
+
+  for (const [variant, expectedReason] of negatives) {
+    it(`rejects the ${variant} assertion (RFC 0050 §A MUST)`, () => {
+      const r = idp.verify(idp.mint(variant));
+      expect(r.valid, `${variant} MUST be rejected`).toBe(false);
+      expect(
+        r.reason,
+        `${variant} MUST be rejected for the ${expectedReason} reason`,
+      ).toBe(expectedReason);
+    });
+  }
+});

package/src/lib/scenario-disposition.ts

@@ -26,6 +26,7 @@
  * host or a vitest subprocess.
  */
 
+import { scenarioFileOfItId } from './requirement-ids.js';
 import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
 import { requirementIdForScenario, requirementIdForPrefix, requirementsFor } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
@@ -285,6 +286,27 @@ export function deriveRequirementDispositions(
     rows.push(row);
   }
 
+  // Per-`it` rows (suite 1.153.0): every ledger entry keyed `openwop.it.<file>.<slug>`
+  // becomes its own bundle row, attributed to its scenario file. Additive — the
+  // file-level and prefix rows above are unchanged, and the floors still key on
+  // them. This is the granularity RFC 0148 §A describes and the G8 fix.
+  const emitted = new Set(rows.map((r) => r.requirementId));
+  for (const e of [...ledger].sort((a, b) => a.requirementId.localeCompare(b.requirementId))) {
+    const file = scenarioFileOfItId(e.requirementId);
+    // Attribute only to files this run reported on: a worker's ledger can carry
+    // rows from files outside the certified set (the suite's own lib tests, or
+    // a filtered run), and those are not evidence about the host.
+    if (file === null || emitted.has(e.requirementId) || !reportStates.has(file)) continue;
+    emitted.add(e.requirementId);
+    rows.push({
+      requirementId: e.requirementId,
+      scenarioId: file,
+      disposition: e.disposition,
+      ...(e.detail === undefined ? {} : { detail: e.detail }),
+      ...(e.assertionCount === undefined ? {} : { assertionCount: e.assertionCount }),
+    });
+  }
+
   const totals = { executedPass: 0, executedFail: 0, skipped: 0, inapplicable: 0, blocked: 0 };
   for (const r of rows) {
     if (r.disposition === 'executed-pass') totals.executedPass++;

package/src/scenarios/auth-saml-profile.test.ts

@@ -23,7 +23,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
-import { createSyntheticSamlIdp, type SamlVariant } from '../lib/saml-idp.js';
+import { type SamlVariant } from '../lib/saml-idp.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 
 const SAML_PROFILE = 'openwop-auth-saml';
@@ -117,41 +117,9 @@ describe('auth-saml-profile: assertion validation (RFC 0050 §A — opt-in)', ()
   }
 });
 
-describe('category: auth-saml synthetic-IdP reference suite (RFC 0050 §A)', () => {
-  // Server-free: the bundled synthetic IdP (conformance/src/lib/saml-idp.ts)
-  // mints a valid assertion + the 6 negative variants, and its verify()
-  // implements the RFC 0050 §A MUST list. This proves each negative is
-  // detectably malformed and gives the suite a reference SAML validator.
-  // A host's real ACS validates the SAME assertions over the
-  // `auth/saml/validate` seam (gated above on OPENWOP_TEST_SAML_IDP_URL).
-  const idp = createSyntheticSamlIdp();
-
-  it('publishes a PEM signing certificate', () => {
-    expect(idp.certificatePem).toContain('BEGIN PUBLIC KEY');
-  });
-
-  it('accepts a valid signed, in-window, non-wrapped assertion', () => {
-    const r = idp.verify(idp.mint('valid'));
-    expect(r.valid, `expected valid; got reason=${r.reason}`).toBe(true);
-  });
-
-  const negatives: ReadonlyArray<[Exclude<SamlVariant, 'valid'>, string]> = [
-    ['alg-none', 'alg-none'],
-    ['unsigned', 'unsigned'],
-    ['bad-signature', 'bad-signature'],
-    ['expired', 'expired'],
-    ['not-yet-valid', 'not-yet-valid'],
-    ['signature-wrapping', 'signature-wrapping'],
-  ];
-
-  for (const [variant, expectedReason] of negatives) {
-    it(`rejects the ${variant} assertion (RFC 0050 §A MUST)`, () => {
-      const r = idp.verify(idp.mint(variant));
-      expect(r.valid, `${variant} MUST be rejected`).toBe(false);
-      expect(
-        r.reason,
-        `${variant} MUST be rejected for the ${expectedReason} reason`,
-      ).toBe(expectedReason);
-    });
-  }
-});
+// The RFC 0050 §A synthetic-IdP reference suite (1 positive + 6 negatives against
+// the bundled fixture) moved to `conformance/src/lib/saml-idp.test.ts` on
+// 2026-09-02 (RFC 0163 gap G5): it proves the FIXTURE, not a host, and a
+// server-free block inside a scenario file records `executed-pass` in every
+// host bundle (conformance-certification.md gap G8). This file keeps only the
+// host-facing legs above.

package/src/setup.ts

@@ -30,11 +30,13 @@ import { setMultiAgentCapabilities } from './lib/multi-agent-capabilities.js';
 import { OtelCollector, setCollector } from './lib/otel-collector.js';
 import { McpFakeServer, setMcpFakeServer } from './lib/mcp-fake-server.js';
 import { A2AFakePeer, setA2AFakePeer } from './lib/a2a-fake-peer.js';
-import { afterAll, afterEach, beforeAll, expect } from 'vitest';
+import { afterAll, afterEach, beforeAll, beforeEach, expect } from 'vitest';
 import { basename } from 'node:path';
 import { recordRequirement, hasRequirement, journalLength, journalSince } from './lib/requirement-ledger.js';
 import { requirementIdForFile, resolveFileRecord, type FileTestState } from './lib/scenario-disposition.js';
 import { softSkipDisposition } from './lib/soft-skip.js';
+import { ItIdAllocator, takeExplicitRequirementId } from './lib/requirement-ids.js';
+import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './lib/spec-coherence.js';
 import type { DiscoveryPayload } from './lib/profiles.js';
 
 const SUITE_INIT_TIMEOUT_MS = 5_000;
@@ -225,6 +227,22 @@ await maybeStartA2AFakePeer();
 const _fileStates = new Map<string, FileTestState[]>();
 const _fileAssertions = new Map<string, number>();
 const _ledgerMarks = new Map<string, number>();
+// Per-`it` recording (v2 charter Phase 1, suite 1.153.0 — the durable G8 fix
+// named in scenario-disposition.ts). Each test gets its own ledger row under
+// `openwop.it.<file>.<title-slug>` so a file that asserted a positive control
+// and soft-skipped the requirement no longer certifies the requirement. The
+// file-level row is RETAINED (floors key on it); the per-`it` rows are
+// additive bundle rows (RFC 0148 §C `requirements[]` accepts any id).
+const _itAllocators = new Map<string, ItIdAllocator>();
+const _itMarks = new Map<string, number>();
+const _itAssertionsBefore = new Map<string, number>();
+function _assertionCalls(): number {
+  try {
+    return (expect.getState() as { assertionCalls?: number }).assertionCalls ?? 0;
+  } catch {
+    return 0;
+  }
+}
 function _fileOf(task: { file?: { filepath?: string; name?: string } } | undefined): string | null {
   const f = task?.file?.filepath ?? task?.file?.name;
   return typeof f === 'string' && f.length > 0 ? basename(f) : null;
@@ -236,6 +254,14 @@ beforeAll(({}, suite) => {
   const file = _fileOf({ file: s.file ?? s });
   if (file !== null && !_ledgerMarks.has(file)) _ledgerMarks.set(file, journalLength());
 });
+beforeEach(({ task }) => {
+  const file = _fileOf(task as { file?: { filepath?: string; name?: string } });
+  if (file === null) return;
+  // Window for this test's own gate decisions and its own assertion count.
+  _itMarks.set(file, journalLength());
+  _itAssertionsBefore.set(file, _assertionCalls());
+  takeExplicitRequirementId(); // clear any override left by a test that threw before afterEach
+});
 afterEach(({ task }) => {
   const file = _fileOf(task as { file?: { filepath?: string; name?: string } });
   if (file === null) return;
@@ -248,13 +274,63 @@ afterEach(({ task }) => {
   // A leg that early-returns from a gate makes zero, and a file of such legs is
   // an `executed-pass` with assertionCount 0 — visible, and unclassified for a
   // claimed floor.
-  let calls = 0;
+  //
+  // `expect.getState().assertionCalls` is per-test in vitest (reset at each
+  // test start), so it is this test's count; the file total is the sum.
+  const calls = _assertionCalls();
+  _fileAssertions.set(file, (_fileAssertions.get(file) ?? 0) + calls);
+
+  // Per-`it` row. Disposition follows RFC 0148 §A at test granularity:
+  //   fail                       → executed-fail (detail = the first error message)
+  //   skip (ctx.skip / it.skip)  → the gate's recorded reason since this test began, else `skipped`
+  //   pass with ≥1 assertion     → executed-pass
+  //   pass with 0 assertions     → the gate's recorded reason (softSkip / seamAbsent / behaviorGate)
+  //                                since this test began, else `blocked` (unclassified return)
+  if (!file.endsWith('.test.ts')) return;
+  // Only SCENARIO files get per-`it` rows. The setup hooks run for every file in
+  // the worker, including `src/lib/*.test.ts` — the suite's own self-tests,
+  // which prove fixtures and helpers, not a host, and must never become bundle
+  // evidence (that is why RFC 0163 G5 / RFC 0050 G1 moved them out of scenarios).
+  const filepath = (task as { file?: { filepath?: string } }).file?.filepath ?? '';
+  if (!/[\\/]src[\\/]scenarios[\\/]/.test(filepath)) {
+    takeExplicitRequirementId();
+    return;
+  }
+  const explicit = takeExplicitRequirementId();
+  const alloc = _itAllocators.get(file) ?? new ItIdAllocator();
+  _itAllocators.set(file, alloc);
+  const itId = explicit ?? alloc.allocate(file, task.name);
+  const since = journalSince(_itMarks.get(file) ?? 0);
+  const gate = since.find((e) => e.disposition === 'inapplicable') ?? since.find((e) => e.disposition === 'skipped');
+  let disposition: 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
+  let detail: string | undefined;
+  if (SPEC_COHERENCE_SCENARIOS.has(file) || SPEC_COHERENCE_SCENARIOS.has(file.replace(/\.test\.ts$/, ''))) {
+    // Corpus-coherence scenario: it reads spec/v1 and asserts nothing about a
+    // host, in any layout. Its rows are `inapplicable` to every host — the same
+    // rule `resolveFileRecord` applies to the file in the published layout.
+    disposition = 'inapplicable';
+    detail = SPEC_COHERENCE_DETAIL;
+  } else if (state === 'fail') {
+    disposition = 'executed-fail';
+    const err = (task.result?.errors ?? [])[0] as { message?: string } | undefined;
+    detail = `the test executed and failed: ${(err?.message ?? 'no message').slice(0, 300)}`;
+  } else if (state === 'pass' && calls > 0) {
+    disposition = 'executed-pass';
+  } else if (gate !== undefined) {
+    disposition = gate.disposition as 'skipped' | 'inapplicable';
+    detail = gate.detail ?? `${gate.disposition} (gate recorded no reason)`;
+  } else if (state === 'pass') {
+    disposition = 'blocked';
+    detail = 'unclassified return: the test passed with zero assertions and recorded no reason — RFC 0148 §A resolves it to blocked, never to a pass';
+  } else {
+    disposition = 'skipped';
+    detail = 'vitest skipped the test (ctx.skip / it.skip) without a recorded gate reason';
+  }
   try {
-    calls = (expect.getState() as { assertionCalls?: number }).assertionCalls ?? 0;
+    recordRequirement(itId, disposition, detail, { assertionCount: calls });
   } catch {
-    /* no state — count 0 */
+    /* never fail a test for bookkeeping */
   }
-  _fileAssertions.set(file, (_fileAssertions.get(file) ?? 0) + calls);
 });
 afterAll(({}, suite) => {
   // vitest 4: the suite/file task is the SECOND argument. For a file-level
@@ -306,5 +382,8 @@ afterAll(({}, suite) => {
   _fileStates.delete(file);
   _fileAssertions.delete(file);
   _ledgerMarks.delete(file);
+  _itAllocators.delete(file);
+  _itMarks.delete(file);
+  _itAssertionsBefore.delete(file);
 });