@openwop/openwop-conformance 1.152.0 → 1.153.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [1.153.0] — 2026-09-02 — per-`it` requirement rows and the requirement registry (RFC 0148 §A / G3; v2 charter Phase 1)
+
+No new scenario file. Three packed changes, all additive to bundle v2:
+
+- **Every test records its own ledger row.** `setup.ts` now records one RFC 0148 §A disposition per `it()` under `openwop.it.<file-stem>.<title-slug>` (`src/lib/requirement-ids.ts`), next to the retained file-level row the floors key on. A test that passes with ≥1 assertion is `executed-pass`; a failure is `executed-fail` with the first error message; a pass with zero assertions takes the gate reason recorded during that test (`softSkip` / `seamAbsent` / `behaviorGate`) or resolves to `blocked`. This is the durable fix for certification gap G8: a file that asserted a positive control and then soft-skipped the requirement no longer certifies the requirement, because the requirement's own row says `skipped`/`inapplicable`/`blocked`.
+- **`--certify` emits the per-`it` rows** in `results.requirements[]`, attributed to their scenario file. Existing verifiers accept them (the row shape is unchanged; ids are new). Expect bundles to grow from ~470 rows to ~2,400.
+- **`conformance/requirements.json`** (packed) is the generated registry: one record per test with its id, file, line, title, and the `driver.describe` / `req()` citations found in its body. `scripts/generate-requirement-registry.mjs --check` runs in `openwop:check`; a reworded title needs a row in `requirement-aliases.json` or the check fails, so a bundle that cited the old id still resolves. Measured at generation: 1,950 tests in 468 files, 1,927 stable ids, 23 interpolated titles (those rows exist at run time keyed by the rendered title and map to the registry by file+line).
+- New `req(id, section, requirement)` helper: a scenario may attach a hand-authored registry id to the current test; it doubles as the assertion message.
+
 ## [1.152.0] — 2026-09-02 — v2 charter Phase 0: `--certify` defaults to bundle v2; the RFC 0050 reference suite leaves the scenario file
 
 No new scenario file. Two packed changes:

package/dist/lib/requirement-ids.js

@@ -0,0 +1,100 @@
+/**
+ * Per-`it` requirement ids (RFC 0148 §A, gap G3; v2 charter Phase 1).
+ *
+ * The ledger has recorded ONE row per scenario FILE (`openwop.floor.<file>` /
+ * `openwop.scenario.<file>`). That granularity is what produces certification
+ * gap G8: a file that asserted a positive control and then soft-skipped the
+ * requirement still resolves to `executed-pass` for the whole file. The durable
+ * fix named in `scenario-disposition.ts` is per-`it` recording — this module
+ * supplies the ids for it.
+ *
+ * Why the id derives from the TEST TITLE and not from the `driver.describe`
+ * text: 190 of 1,756 citations interpolate the requirement text at run time
+ * (`docs/REQUIREMENT-REGISTRY-FEASIBILITY.md`), so no text-derived id can be
+ * stable for them. Test titles are literals in every scenario file, stable
+ * across hosts, and already the unit vitest reports on. The registry
+ * (`conformance/requirements.json`, generated) maps each id back to the
+ * citations found inside that test's body, so a bundle reader can still ask
+ * "which spec section did this row witness".
+ *
+ * Grammar: `openwop.it.<file-stem>.<title-slug>` where the stem is the scenario
+ * file name without `.test.ts` and the slug is the title lower-cased, every run
+ * of non-alphanumerics folded to one `-`, trimmed, and capped at 80 characters.
+ * A second test in the same file whose title slugs identically gets `~2`,
+ * `~3`, … (vitest allows duplicate titles; the ledger does not allow duplicate
+ * ids). A scenario MAY override the derived id for the current test with
+ * `req()` when it wants a hand-authored, registry-listed id.
+ */
+export const IT_ID_PREFIX = 'openwop.it.';
+export const IT_ID_GRAMMAR = /^openwop\.it\.[a-z0-9]+(?:-[a-z0-9]+)*\.[a-z0-9]+(?:-[a-z0-9]+)*(?:~[2-9][0-9]*)?$/;
+const MAX_SLUG = 80;
+/** Title → slug: lower-case, non-alphanumeric runs → `-`, trimmed, capped. */
+export function slugTitle(title) {
+    const s = title
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    const capped = s.length > MAX_SLUG ? s.slice(0, MAX_SLUG).replace(/-+$/g, '') : s;
+    return capped.length > 0 ? capped : 'untitled';
+}
+/** `auth-subject-link.test.ts` → `auth-subject-link`. */
+export function fileStem(scenarioFile) {
+    return scenarioFile.replace(/\.test\.ts$/, '');
+}
+/** Derived id for one test, before collision suffixing. */
+export function itRequirementId(scenarioFile, title) {
+    return `${IT_ID_PREFIX}${fileStem(scenarioFile)}.${slugTitle(title)}`;
+}
+/** The scenario file a per-`it` id belongs to, or null when the id is not one. */
+export function scenarioFileOfItId(requirementId) {
+    if (!requirementId.startsWith(IT_ID_PREFIX))
+        return null;
+    const rest = requirementId.slice(IT_ID_PREFIX.length);
+    const dot = rest.indexOf('.');
+    if (dot <= 0)
+        return null;
+    return `${rest.slice(0, dot)}.test.ts`;
+}
+/**
+ * Collision suffixing: the first occurrence keeps the bare id, later ones get
+ * `~2`, `~3`, … Keyed per file so a worker running many files never crosses
+ * streams. Reset per file by `setup.ts` when the file finishes.
+ */
+export class ItIdAllocator {
+    seen = new Map();
+    allocate(scenarioFile, title) {
+        const base = itRequirementId(scenarioFile, title);
+        const n = (this.seen.get(base) ?? 0) + 1;
+        this.seen.set(base, n);
+        return n === 1 ? base : `${base}~${n}`;
+    }
+    reset() {
+        this.seen.clear();
+    }
+}
+// ---------------------------------------------------------------------------
+// Explicit override for the current test.
+// ---------------------------------------------------------------------------
+let explicitId = null;
+/**
+ * Attach a hand-authored requirement id to the CURRENT test. The per-`it`
+ * ledger row for this test is recorded under `id` instead of the derived
+ * title id. Returns the usual `driver.describe`-style message so the call
+ * doubles as the assertion message:
+ *
+ *   expect(x, req('openwop.auth.subject-link.leaver-deny', 'auth-profiles.md §Subject linking', 'deactivation MUST deny')).toBe(true)
+ *
+ * The id MUST be listed in `conformance/requirements.json` (the generator
+ * collects `req(` first-argument literals); an unlisted id fails the registry
+ * check, so a hand id cannot drift from the registry silently.
+ */
+export function req(id, specSection, requirement) {
+    explicitId = id;
+    return `${specSection}: ${requirement}`;
+}
+/** setup.ts reads and clears the override after each test. */
+export function takeExplicitRequirementId() {
+    const id = explicitId;
+    explicitId = null;
+    return id;
+}

package/dist/lib/scenario-disposition.js

@@ -25,6 +25,7 @@
  * Pure functions, no I/O, so `runner-ledger.test.ts` can pin them without a
  * host or a vitest subprocess.
  */
+import { scenarioFileOfItId } from './requirement-ids.js';
 import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
 import { requirementIdForScenario, requirementIdForPrefix, requirementsFor } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
@@ -233,6 +234,27 @@ document) {
         }
         rows.push(row);
     }
+    // Per-`it` rows (suite 1.153.0): every ledger entry keyed `openwop.it.<file>.<slug>`
+    // becomes its own bundle row, attributed to its scenario file. Additive — the
+    // file-level and prefix rows above are unchanged, and the floors still key on
+    // them. This is the granularity RFC 0148 §A describes and the G8 fix.
+    const emitted = new Set(rows.map((r) => r.requirementId));
+    for (const e of [...ledger].sort((a, b) => a.requirementId.localeCompare(b.requirementId))) {
+        const file = scenarioFileOfItId(e.requirementId);
+        // Attribute only to files this run reported on: a worker's ledger can carry
+        // rows from files outside the certified set (the suite's own lib tests, or
+        // a filtered run), and those are not evidence about the host.
+        if (file === null || emitted.has(e.requirementId) || !reportStates.has(file))
+            continue;
+        emitted.add(e.requirementId);
+        rows.push({
+            requirementId: e.requirementId,
+            scenarioId: file,
+            disposition: e.disposition,
+            ...(e.detail === undefined ? {} : { detail: e.detail }),
+            ...(e.assertionCount === undefined ? {} : { assertionCount: e.assertionCount }),
+        });
+    }
     const totals = { executedPass: 0, executedFail: 0, skipped: 0, inapplicable: 0, blocked: 0 };
     for (const r of rows) {
         if (r.disposition === 'executed-pass')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.152.0",
+  "version": "1.153.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -18,6 +18,8 @@
     "fixtures",
     "fixtures.md",
     "coverage.md",
+    "requirements.json",
+    "requirement-aliases.json",
     "api",
     "schemas",
     "vectors",

package/requirement-aliases.json

@@ -0,0 +1,4 @@
+{
+  "$comment": "old id → new id. Add a row when a test title is reworded so bundles citing the old id still resolve.",
+  "aliases": {}
+}