@openwop/openwop-conformance 1.162.0 → 2.0.0-rc.0

package/src/scenarios/artifact-type-store-without-render.test.ts

@@ -25,7 +25,6 @@
 
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
-import { driver } from '../lib/driver.js';
 import { behaviorGate, behaviorGatePresent } from '../lib/behavior-gate.js';
 
 const PROFILE = 'openwop-artifact-type-packs';
@@ -36,6 +35,7 @@ import {
   produceArtifact,
   sampleArtifactTypePack,
 } from '../lib/artifactTypes.js';
+import { req } from '../lib/requirement-ids.js';
 
 describe('artifact-type-store-without-render: store-only hosts must not fail the run (RFC 0071)', () => {
   it('a stored-but-unrendered artifact completes the run', async () => {
@@ -54,15 +54,15 @@ describe('artifact-type-store-without-render: store-only hosts must not fail the
 
     expect(
       produced.json['stored'],
-      driver.describe('artifact-type-packs.md §host.artifactTypes', 'a host advertising store:true MUST persist the artifact'),
+      req('openwop.it.artifact-type-store-without-render.a-stored-but-unrendered-artifact-completes-the-run', 'artifact-type-packs.md §host.artifactTypes', 'a host advertising store:true MUST persist the artifact'),
     ).toBe(true);
     expect(
       produced.json['rendered'],
-      driver.describe('artifact-type-packs.md §host.artifactTypes', 'render:false host MUST NOT render'),
+      req('openwop.it.artifact-type-store-without-render.a-stored-but-unrendered-artifact-completes-the-run', 'artifact-type-packs.md §host.artifactTypes', 'render:false host MUST NOT render'),
     ).toBe(false);
     expect(
       produced.json['runStatus'],
-      driver.describe('artifact-type-packs.md §host.artifactTypes', 'a host MUST NOT fail the run solely because it lacks a renderer for a stored artifact type'),
+      req('openwop.it.artifact-type-store-without-render.a-stored-but-unrendered-artifact-completes-the-run', 'artifact-type-packs.md §host.artifactTypes', 'a host MUST NOT fail the run solely because it lacks a renderer for a stored artifact type'),
     ).toBe('completed');
   });
 });

package/src/scenarios/audit-log-integrity.test.ts

@@ -19,6 +19,8 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface AuditIntegrityCaps {
   hashChain?: boolean;
@@ -50,11 +52,11 @@ describe('audit-log-integrity: profile shape', () => {
       capabilityFamily<AuthCaps>(disco.json, 'auth')
         ?.auditLogIntegrity ?? {};
 
-    expect(integrity.hashChain, driver.describe(
+    expect(integrity.hashChain, req('openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields', 
       'auth-profiles.md §"Audit-log integrity"',
       "openwop-audit-log-integrity profile MUST advertise auditLogIntegrity.hashChain: true",
     )).toBe(true);
-    expect(integrity.checkpointSignatureAlgorithm, driver.describe(
+    expect(integrity.checkpointSignatureAlgorithm, req('openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields', 
       'auth-profiles.md §"Audit-log integrity" §"Key management"',
       'checkpointSignatureAlgorithm MUST be present (canonical: ed25519)',
     )).toBeDefined();
@@ -72,11 +74,11 @@ describe('audit-log-integrity: verify endpoint returns chainValid', () => {
     if (verify.status === 404) {
       // Host claims the profile but doesn't expose the endpoint — that's
       // a profile-claim violation. Fail explicitly.
-      expect(verify.status, driver.describe(
+      expect(verify.status, req('openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true', 
         'auth-profiles.md §"Audit-log integrity" §"Verification endpoint"',
         'claiming openwop-audit-log-integrity profile REQUIRES exposing GET /v1/audit/verify',
       )).not.toBe(404);
-      return;
+      return softSkip('blocked', 'precondition not met — `verify.status === 404` returned early (seam, prior step, or fixture unavailable)');
     }
     expect(verify.status).toBe(200);
 
@@ -88,7 +90,7 @@ describe('audit-log-integrity: verify endpoint returns chainValid', () => {
       anomalies?: unknown[];
     };
 
-    expect(body.chainValid, driver.describe(
+    expect(body.chainValid, req('openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true', 
       'auth-profiles.md §"Audit-log integrity"',
       'unmodified audit range MUST report chainValid: true',
     )).toBe(true);
@@ -97,7 +99,7 @@ describe('audit-log-integrity: verify endpoint returns chainValid', () => {
 
     if (Array.isArray(body.checkpoints) && body.checkpoints.length > 0) {
       const cp = body.checkpoints[0];
-      expect(typeof cp.signature, 'checkpoint signature MUST be a non-empty string').toBe('string');
+      expect(typeof cp.signature, req('openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true', 'auth-profiles.md §"Audit-log integrity"', 'checkpoint signature MUST be a non-empty string')).toBe('string');
       expect((cp.signature ?? '').length).toBeGreaterThan(0);
     }
   });

package/src/scenarios/auth-api-key-rotation.test.ts

@@ -29,6 +29,8 @@ import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface RotationCaps {
   supported?: boolean;
@@ -65,12 +67,12 @@ describe('auth-api-key-rotation: capability shape', () => {
       return;
     }
 
-    expect(auth?.profiles?.includes(PROFILE), driver.describe(
+    expect(auth?.profiles?.includes(PROFILE), req('openwop.it.auth-api-key-rotation.host-claiming-rotation-profile-advertises-required-fields', 
       'auth-profiles.md §`openwop-auth-api-key-rotation`',
       'capabilities.auth.profiles MUST include openwop-auth-api-key-rotation when the profile is claimed',
     )).toBe(true);
 
-    expect(auth?.rotation?.supported, driver.describe(
+    expect(auth?.rotation?.supported, req('openwop.it.auth-api-key-rotation.host-claiming-rotation-profile-advertises-required-fields', 
       'auth-profiles.md §`openwop-auth-api-key-rotation`',
       'capabilities.auth.rotation.supported MUST be true when the profile is claimed',
     )).toBe(true);
@@ -79,7 +81,7 @@ describe('auth-api-key-rotation: capability shape', () => {
       expect(
         Number.isInteger(auth.rotation.minGraceSeconds) &&
           auth.rotation.minGraceSeconds >= 0,
-        driver.describe(
+        req('openwop.it.auth-api-key-rotation.host-claiming-rotation-profile-advertises-required-fields', 
           'capabilities.schema.json auth.rotation.minGraceSeconds',
           'minGraceSeconds MUST be a non-negative integer when advertised',
         ),
@@ -109,7 +111,7 @@ describe('auth-api-key-rotation: two-key overlap', () => {
       console.warn(
         '[auth-api-key-rotation] OPENWOP_TEST_SECONDARY_API_KEY not supplied; skipping two-key overlap assertion',
       );
-      return;
+      return softSkip('blocked', 'precondition not met — `!secondaryKey` returned early ([auth-api-key-rotation] OPENWOP_TEST_SECONDARY_API_KEY not supplied; skipping two-key overlap assertion) (seam, prior step, or fixture unavailable)');
     }
 
     if (!isFixtureAdvertised(FIXTURE)) {
@@ -117,12 +119,12 @@ describe('auth-api-key-rotation: two-key overlap', () => {
       console.warn(
         `[auth-api-key-rotation] ${FIXTURE} not advertised; skipping overlap assertion`,
       );
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!isFixtureAdvertised(FIXTURE)` returned early ([auth-api-key-rotation] … not advertised; skipping overlap assertion)');
     }
 
     // Primary key — uses driver's default Authorization header (env-loaded).
     const primary = await driver.post('/v1/runs', { workflowId: FIXTURE });
-    expect(primary.status, driver.describe(
+    expect(primary.status, req('openwop.it.auth-api-key-rotation.primary-secondary-keys-both-authenticate-the-same-operation', 
       'auth-profiles.md §`openwop-auth-api-key-rotation`',
       'primary key MUST authenticate POST /v1/runs during rotation grace',
     )).toBe(201);
@@ -137,7 +139,7 @@ describe('auth-api-key-rotation: two-key overlap', () => {
         headers: { Authorization: `Bearer ${secondaryKey}` },
       },
     );
-    expect(secondary.status, driver.describe(
+    expect(secondary.status, req('openwop.it.auth-api-key-rotation.primary-secondary-keys-both-authenticate-the-same-operation', 
       'auth-profiles.md §`openwop-auth-api-key-rotation`',
       'secondary key MUST authenticate POST /v1/runs during rotation grace',
     )).toBe(201);
@@ -167,7 +169,7 @@ describe('auth-api-key-rotation: canary redaction', () => {
       },
     );
 
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth-api-key-rotation.invalid-bearer-returns-401-without-echoing-the-canary-credential', 
       'auth.md §3',
       'invalid bearer MUST return 401, not 200 or 403',
     )).toBe(401);
@@ -175,7 +177,7 @@ describe('auth-api-key-rotation: canary redaction', () => {
     // The response body MUST NOT echo the canary in any field. We
     // check the serialized JSON to catch echoes even in nested fields.
     const serialized = JSON.stringify(res.json ?? {});
-    expect(serialized.includes(CANARY), driver.describe(
+    expect(serialized.includes(CANARY), req('openwop.it.auth-api-key-rotation.invalid-bearer-returns-401-without-echoing-the-canary-credential', 
       'auth.md §"No credential echo" + threat-model-auth-profiles.md A1',
       'rotation-profile hosts MUST NOT echo the rejected credential in error responses',
     )).toBe(false);

package/src/scenarios/auth-mtls.test.ts

@@ -46,6 +46,8 @@ import { loadEnv } from '../lib/env.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface MtlsCaps {
   supported?: boolean;
@@ -114,7 +116,7 @@ function mtlsPost(
   return new Promise((resolve) => {
     const url = new URL(baseUrl + path);
     const payload = JSON.stringify(body);
-    const req = httpsRequest(
+    const reqBody = httpsRequest(
       {
         hostname: url.hostname,
         port: url.port ? Number.parseInt(url.port, 10) : 443,
@@ -138,9 +140,9 @@ function mtlsPost(
         });
       },
     );
-    req.on('error', (error) => resolve({ error }));
-    req.write(payload);
-    req.end();
+    reqBody.on('error', (error) => resolve({ error }));
+    reqBody.write(payload);
+    reqBody.end();
   });
 }
 
@@ -152,12 +154,12 @@ describe('auth-mtls: capability shape', () => {
       return;
     }
 
-    expect(auth?.profiles?.includes(PROFILE), driver.describe(
+    expect(auth?.profiles?.includes(PROFILE), req('openwop.it.auth-mtls.host-claiming-mtls-profile-advertises-required-fields', 
       'auth-profiles.md §`openwop-auth-mtls`',
       'capabilities.auth.profiles MUST include openwop-auth-mtls when the profile is claimed',
     )).toBe(true);
 
-    expect(auth?.mtls?.supported, driver.describe(
+    expect(auth?.mtls?.supported, req('openwop.it.auth-mtls.host-claiming-mtls-profile-advertises-required-fields', 
       'auth-profiles.md §`openwop-auth-mtls`',
       'capabilities.auth.mtls.supported MUST be true when the profile is claimed',
     )).toBe(true);
@@ -165,14 +167,14 @@ describe('auth-mtls: capability shape', () => {
     if (auth?.mtls?.required !== undefined) {
       expect(
         typeof auth.mtls.required,
-        'mtls.required MUST be boolean when advertised',
+        req('openwop.it.auth-mtls.host-claiming-mtls-profile-advertises-required-fields', 'auth-profiles.md §`openwop-auth-mtls`', 'mtls.required MUST be boolean when advertised'),
       ).toBe('boolean');
     }
 
     if (auth?.mtls?.subjectMapping !== undefined) {
       expect(
         ['cn', 'san-dns', 'san-uri'].includes(auth.mtls.subjectMapping),
-        driver.describe(
+        req('openwop.it.auth-mtls.host-claiming-mtls-profile-advertises-required-fields', 
           'capabilities.schema.json auth.mtls.subjectMapping',
           'subjectMapping MUST be one of cn / san-dns / san-uri',
         ),
@@ -184,7 +186,7 @@ describe('auth-mtls: capability shape', () => {
 describe.skipIf(!RUN_BEHAVIOR)('auth-mtls: client cert behavior', () => {
   it('valid client cert + valid bearer → 201', async () => {
     const auth = await readAuthCaps();
-    if (!isProfileAdvertised(auth)) return;
+    if (!isProfileAdvertised(auth)) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!isProfileAdvertised(auth)` returned early');
 
     const certs = loadClientCerts();
     if (!certs) {
@@ -192,10 +194,10 @@ describe.skipIf(!RUN_BEHAVIOR)('auth-mtls: client cert behavior', () => {
       console.warn(
         '[auth-mtls] OPENWOP_TEST_MTLS=1 but cert paths missing; skipping behavior',
       );
-      return;
+      return softSkip('blocked', 'precondition not met — `!certs` returned early ([auth-mtls] OPENWOP_TEST_MTLS=1 but cert paths missing; skipping behavior) (seam, prior step, or fixture unavailable)');
     }
 
-    if (!isFixtureAdvertised(FIXTURE)) return;
+    if (!isFixtureAdvertised(FIXTURE)) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!isFixtureAdvertised(FIXTURE)` returned early');
 
     const env = loadEnv();
     if (!env.baseUrl.startsWith('https://')) {
@@ -203,7 +205,7 @@ describe.skipIf(!RUN_BEHAVIOR)('auth-mtls: client cert behavior', () => {
       console.warn(
         `[auth-mtls] OPENWOP_BASE_URL is not HTTPS (got ${env.baseUrl}); mTLS requires HTTPS — skipping`,
       );
-      return;
+      return softSkip('blocked', 'precondition not met — `!env.baseUrl.startsWith(\'https://\')` returned early ([auth-mtls] OPENWOP_BASE_URL is not HTTPS (got …); mTLS requires HTTPS — skipping) (seam, prior step, or fixture unavailable)');
     }
 
     const res = await mtlsPost(
@@ -220,7 +222,7 @@ describe.skipIf(!RUN_BEHAVIOR)('auth-mtls: client cert behavior', () => {
       );
     }
 
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth-mtls.valid-client-cert-valid-bearer-201', 
       'auth-profiles.md §`openwop-auth-mtls`',
       'valid client cert + valid bearer MUST authenticate POST /v1/runs (201)',
     )).toBe(201);
@@ -228,16 +230,16 @@ describe.skipIf(!RUN_BEHAVIOR)('auth-mtls: client cert behavior', () => {
 
   it('no client cert against mtls.required: true → non-2xx or TLS failure', async () => {
     const auth = await readAuthCaps();
-    if (!isProfileAdvertised(auth)) return;
+    if (!isProfileAdvertised(auth)) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!isProfileAdvertised(auth)` returned early');
     if (auth?.mtls?.required !== true) {
       // eslint-disable-next-line no-console
       console.warn(
         '[auth-mtls] host advertises mtls.required: false; skipping no-cert rejection (host may accept bearer-only)',
       );
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `auth?.mtls?.required !== true` returned early ([auth-mtls] host advertises mtls.required: false; skipping no-cert rejection (host may accept bearer-only))');
     }
 
-    if (!isFixtureAdvertised(FIXTURE)) return;
+    if (!isFixtureAdvertised(FIXTURE)) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!isFixtureAdvertised(FIXTURE)` returned early');
 
     const env = loadEnv();
     if (!env.baseUrl.startsWith('https://')) {
@@ -245,7 +247,7 @@ describe.skipIf(!RUN_BEHAVIOR)('auth-mtls: client cert behavior', () => {
       console.warn(
         `[auth-mtls] OPENWOP_BASE_URL is not HTTPS (got ${env.baseUrl}); skipping no-cert rejection`,
       );
-      return;
+      return softSkip('blocked', 'precondition not met — `!env.baseUrl.startsWith(\'https://\')` returned early ([auth-mtls] OPENWOP_BASE_URL is not HTTPS (got …); skipping no-cert rejection) (seam, prior step, or fixture unavailable)');
     }
 
     // No certs supplied → either 4xx or transport-layer TLS handshake failure.
@@ -260,14 +262,14 @@ describe.skipIf(!RUN_BEHAVIOR)('auth-mtls: client cert behavior', () => {
     if ('error' in res) {
       // Transport-layer TLS failure is conformant per auth-profiles.md.
       // The handshake rejected the client because no cert was offered.
-      expect(true, driver.describe(
+      expect(true, req('openwop.it.auth-mtls.no-client-cert-against-mtls-required-true-non-2xx-or-tls-failure', 
         'auth-profiles.md §`openwop-auth-mtls`',
         'mtls.required: true MUST reject no-cert requests (TLS handshake failure is conformant)',
       )).toBe(true);
-      return;
+      return softSkip('blocked', 'precondition not met — `\'error\' in res` returned early (seam, prior step, or fixture unavailable)');
     }
 
-    expect(res.status >= 400, driver.describe(
+    expect(res.status >= 400, req('openwop.it.auth-mtls.no-client-cert-against-mtls-required-true-non-2xx-or-tls-failure', 
       'auth-profiles.md §`openwop-auth-mtls`',
       'mtls.required: true MUST reject no-cert requests at the auth layer (4xx) when not rejected at the TLS layer',
     )).toBe(true);

package/src/scenarios/auth-oauth2-client-credentials.test.ts

@@ -34,6 +34,8 @@ import { behaviorGate } from '../lib/behavior-gate.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { createSyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 /**
  * Callback-shaped: the host fetches the token endpoint on the suite's synthetic OIDC issuer.
@@ -79,12 +81,12 @@ describe('auth-oauth2-client-credentials: capability shape', () => {
       return;
     }
 
-    expect(auth?.profiles?.includes(PROFILE), driver.describe(
+    expect(auth?.profiles?.includes(PROFILE), req('openwop.it.auth-oauth2-client-credentials.host-claiming-oauth2-cc-profile-advertises-required-fields', 
       'auth-profiles.md §`openwop-auth-oauth2-client-credentials`',
       'capabilities.auth.profiles MUST include openwop-auth-oauth2-client-credentials when the profile is claimed',
     )).toBe(true);
 
-    expect(auth?.oauth2?.supported, driver.describe(
+    expect(auth?.oauth2?.supported, req('openwop.it.auth-oauth2-client-credentials.host-claiming-oauth2-cc-profile-advertises-required-fields', 
       'auth-profiles.md §`openwop-auth-oauth2-client-credentials`',
       'capabilities.auth.oauth2.supported MUST be true when the profile is claimed',
     )).toBe(true);
@@ -92,7 +94,7 @@ describe('auth-oauth2-client-credentials: capability shape', () => {
     if (auth?.oauth2?.issuer !== undefined) {
       expect(
         typeof auth.oauth2.issuer === 'string' && auth.oauth2.issuer.length > 0,
-        driver.describe(
+        req('openwop.it.auth-oauth2-client-credentials.host-claiming-oauth2-cc-profile-advertises-required-fields', 
           'capabilities.schema.json auth.oauth2.issuer',
           'issuer MUST be a non-empty string when advertised',
         ),
@@ -102,7 +104,7 @@ describe('auth-oauth2-client-credentials: capability shape', () => {
     if (auth?.oauth2?.audience !== undefined) {
       expect(
         typeof auth.oauth2.audience === 'string' && auth.oauth2.audience.length > 0,
-        driver.describe(
+        req('openwop.it.auth-oauth2-client-credentials.host-claiming-oauth2-cc-profile-advertises-required-fields', 
           'capabilities.schema.json auth.oauth2.audience',
           'audience MUST be a non-empty string when advertised',
         ),
@@ -113,7 +115,7 @@ describe('auth-oauth2-client-credentials: capability shape', () => {
       expect(
         Array.isArray(auth.oauth2.supportedAlgorithms) &&
           auth.oauth2.supportedAlgorithms.length > 0,
-        driver.describe(
+        req('openwop.it.auth-oauth2-client-credentials.host-claiming-oauth2-cc-profile-advertises-required-fields', 
           'capabilities.schema.json auth.oauth2.supportedAlgorithms',
           'supportedAlgorithms MUST be a non-empty array when advertised',
         ),
@@ -139,13 +141,13 @@ describe('auth-oauth2-client-credentials: malformed JWT rejected', () => {
       },
     );
 
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth-oauth2-client-credentials.returns-401-on-bearer-that-is-not-a-valid-jwt-shape', 
       'auth.md §3',
       'malformed JWT bearer MUST return 401 (canonical invalid_token envelope)',
     )).toBe(401);
 
     const body = res.json as { error?: unknown; message?: unknown } | undefined;
-    expect(typeof body?.error, driver.describe(
+    expect(typeof body?.error, req('openwop.it.auth-oauth2-client-credentials.returns-401-on-bearer-that-is-not-a-valid-jwt-shape', 
       'auth.md §3 + rest-endpoints.md error envelope',
       'response body MUST include `error` (machine code) string',
     )).toBe('string');
@@ -165,7 +167,7 @@ describe('auth-oauth2-client-credentials: harness-minted negative cases', () =>
       console.warn(
         '[auth-oauth2-client-credentials] OPENWOP_TEST_OAUTH_ISSUER_TRUSTED not set; skipping harness-minted negative cases (operator must pre-configure the host to trust the conformance harness)',
       );
-      return;
+      return softSkip('blocked', 'precondition not met — `process.env.OPENWOP_TEST_OAUTH_ISSUER_TRUSTED !== \'true\'` returned early ([auth-oauth2-client-credentials] OPENWOP_TEST_OAUTH_ISSUER_TRUSTED not set; skipping harness-minted negative cases (ope…');
     }
 
     const issuerUrl =
@@ -187,7 +189,7 @@ describe('auth-oauth2-client-credentials: harness-minted negative cases', () =>
         headers: { Authorization: `Bearer ${wrongAud.token}` },
       },
     );
-    expect(wrongAudRes.status, driver.describe(
+    expect(wrongAudRes.status, req('openwop.it.auth-oauth2-client-credentials.wrong-audience-token-returns-401-when-host-trusts-the-harness', 
       'auth-profiles.md §`openwop-auth-oauth2-client-credentials`',
       'token with wrong aud claim MUST return 401',
     )).toBe(401);
@@ -205,7 +207,7 @@ describe('auth-oauth2-client-credentials: harness-minted negative cases', () =>
         headers: { Authorization: `Bearer ${expired.token}` },
       },
     );
-    expect(expiredRes.status, driver.describe(
+    expect(expiredRes.status, req('openwop.it.auth-oauth2-client-credentials.wrong-audience-token-returns-401-when-host-trusts-the-harness', 
       'auth-profiles.md §`openwop-auth-oauth2-client-credentials`',
       'expired token (exp < now) MUST return 401',
     )).toBe(401);
@@ -223,7 +225,7 @@ describe('auth-oauth2-client-credentials: harness-minted negative cases', () =>
         headers: { Authorization: `Bearer ${algSpoofed.token}` },
       },
     );
-    expect(algSpoofedRes.status, driver.describe(
+    expect(algSpoofedRes.status, req('openwop.it.auth-oauth2-client-credentials.wrong-audience-token-returns-401-when-host-trusts-the-harness', 
       'auth-profiles.md §`openwop-auth-oauth2-client-credentials`',
       'token with alg outside supportedAlgorithms MUST return 401',
     )).toBe(401);
@@ -244,11 +246,11 @@ describe('auth-oauth2-client-credentials: positive token', () => {
       console.warn(
         '[auth-oauth2-client-credentials] OPENWOP_TEST_OAUTH_TOKEN not supplied; skipping positive-path assertion',
       );
-      return;
+      return softSkip('blocked', 'precondition not met — `!token` returned early ([auth-oauth2-client-credentials] OPENWOP_TEST_OAUTH_TOKEN not supplied; skipping positive-path assertion) (seam, prior step, or fixture unavailable)');
     }
 
     if (!isFixtureAdvertised(FIXTURE)) {
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!isFixtureAdvertised(FIXTURE)` returned early');
     }
 
     const res = await driver.post(
@@ -260,7 +262,7 @@ describe('auth-oauth2-client-credentials: positive token', () => {
       },
     );
 
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth-oauth2-client-credentials.operator-supplied-valid-token-authenticates-post-v1-runs', 
       'auth-profiles.md §`openwop-auth-oauth2-client-credentials`',
       'valid OAuth2-CC token MUST authenticate POST /v1/runs (201)',
     )).toBe(201);

package/src/scenarios/auth-oidc-user-bearer.test.ts

@@ -48,6 +48,8 @@ import {
   type SyntheticOIDCIssuer,
 } from '../lib/oidc-issuer.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 /**
  * Callback-shaped: the host fetches JWKS and discovery from the suite's synthetic OIDC issuer.
@@ -94,19 +96,19 @@ describe('auth-oidc-user-bearer: capability shape', () => {
       return;
     }
 
-    expect(auth?.profiles?.includes(PROFILE), driver.describe(
+    expect(auth?.profiles?.includes(PROFILE), req('openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields', 
       'auth-profiles.md §`openwop-auth-oidc-user-bearer`',
       'capabilities.auth.profiles MUST include openwop-auth-oidc-user-bearer when the profile is claimed',
     )).toBe(true);
 
-    expect(auth?.oidc?.supported, driver.describe(
+    expect(auth?.oidc?.supported, req('openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields', 
       'auth-profiles.md §`openwop-auth-oidc-user-bearer`',
       'capabilities.auth.oidc.supported MUST be true when the profile is claimed',
     )).toBe(true);
 
     expect(
       Array.isArray(auth?.oidc?.issuers) && (auth?.oidc?.issuers?.length ?? 0) > 0,
-      driver.describe(
+      req('openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields', 
         'capabilities.schema.json auth.oidc.issuers',
         'issuers MUST be a non-empty array when the profile is claimed',
       ),
@@ -115,14 +117,14 @@ describe('auth-oidc-user-bearer: capability shape', () => {
     for (const issuer of auth?.oidc?.issuers ?? []) {
       expect(
         typeof issuer === 'string' && issuer.length > 0,
-        'each issuer entry MUST be a non-empty string',
+        req('openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields', 'capabilities.schema.json auth.oidc.issuers', 'each issuer entry MUST be a non-empty string'),
       ).toBe(true);
     }
 
     if (auth?.oidc?.audience !== undefined) {
       expect(
         typeof auth.oidc.audience === 'string' && auth.oidc.audience.length > 0,
-        'audience MUST be a non-empty string when advertised',
+        req('openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields', 'capabilities.schema.json auth.oidc.issuers', 'audience MUST be a non-empty string when advertised'),
       ).toBe(true);
     }
 
@@ -131,7 +133,7 @@ describe('auth-oidc-user-bearer: capability shape', () => {
         ['group-claim', 'scope-claim', 'host-acl'].includes(
           auth.oidc.supportedScopeMapping,
         ),
-        driver.describe(
+        req('openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields', 
           'capabilities.schema.json auth.oidc.supportedScopeMapping',
           'supportedScopeMapping MUST be one of group-claim/scope-claim/host-acl',
         ),
@@ -142,7 +144,7 @@ describe('auth-oidc-user-bearer: capability shape', () => {
       expect(
         Number.isInteger(auth.oidc.introspectionIntervalSeconds) &&
           auth.oidc.introspectionIntervalSeconds >= 0,
-        'introspectionIntervalSeconds MUST be a non-negative integer when advertised',
+        req('openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields', 'capabilities.schema.json auth.oidc.supportedScopeMapping', 'introspectionIntervalSeconds MUST be a non-negative integer when advertised'),
       ).toBe(true);
     }
   });
@@ -175,16 +177,16 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
     const parsed = new URL(harnessUrl);
     const port = parsed.port ? Number.parseInt(parsed.port, 10) : 80;
 
-    server = createServer((req, res) => {
+    server = createServer((reqBody, res) => {
       if (!issuer) {
         res.writeHead(503);
         res.end();
         return;
       }
-      if (req.url === '/.well-known/jwks.json') {
+      if (reqBody.url === '/.well-known/jwks.json') {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(issuer.jwksJson);
-      } else if (req.url === '/.well-known/openid-configuration') {
+      } else if (reqBody.url === '/.well-known/openid-configuration') {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(issuer.discoveryJson);
       } else {
@@ -230,7 +232,7 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
       console.warn(
         '[auth-oidc-user-bearer] harness not wired or host trust not configured; skipping wrong-iss case',
       );
-      return;
+      return softSkip('blocked', 'precondition not met — `!issuer || !trustWired` returned early ([auth-oidc-user-bearer] harness not wired or host trust not configured; skipping wrong-iss case) (seam, prior step, or fixture unavailable)');
     }
 
     const wrongIssIssuer = createSyntheticOIDCIssuer({
@@ -248,14 +250,14 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
       },
     );
 
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth-oidc-user-bearer.wrong-iss-401', 
       'auth-profiles.md §`openwop-auth-oidc-user-bearer`',
       'token with non-trusted iss MUST return 401',
     )).toBe(401);
   });
 
   it('wrong aud → 401', async () => {
-    if (!issuer || !trustWired) return;
+    if (!issuer || !trustWired) return softSkip('blocked', 'precondition not met — `!issuer || !trustWired` returned early (seam, prior step, or fixture unavailable)');
     const wrongAud = issuer.mint({ aud: 'wrong-audience', sub: 'attacker' });
     const res = await driver.post(
       '/v1/runs',
@@ -265,14 +267,14 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
         headers: { Authorization: `Bearer ${wrongAud.token}` },
       },
     );
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth-oidc-user-bearer.wrong-aud-401', 
       'auth-profiles.md §`openwop-auth-oidc-user-bearer`',
       'token with wrong aud MUST return 401',
     )).toBe(401);
   });
 
   it('expired exp → 401', async () => {
-    if (!issuer || !trustWired) return;
+    if (!issuer || !trustWired) return softSkip('blocked', 'precondition not met — `!issuer || !trustWired` returned early (seam, prior step, or fixture unavailable)');
     const expired = issuer.mint(
       { sub: 'conformance-suite' },
       { expiresInSeconds: -3600 },
@@ -285,14 +287,14 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
         headers: { Authorization: `Bearer ${expired.token}` },
       },
     );
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth-oidc-user-bearer.expired-exp-401', 
       'auth-profiles.md §`openwop-auth-oidc-user-bearer`',
       'expired token (exp < now) MUST return 401',
     )).toBe(401);
   });
 
   it('unknown kid → 401', async () => {
-    if (!issuer || !trustWired) return;
+    if (!issuer || !trustWired) return softSkip('blocked', 'precondition not met — `!issuer || !trustWired` returned early (seam, prior step, or fixture unavailable)');
     const unknownKid = issuer.mint(
       { sub: 'conformance-suite' },
       { keyId: 'openwop-conformance-key-NEVER-PUBLISHED' },
@@ -305,15 +307,15 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
         headers: { Authorization: `Bearer ${unknownKid.token}` },
       },
     );
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth-oidc-user-bearer.unknown-kid-401', 
       'auth-profiles.md §`openwop-auth-oidc-user-bearer` + threat-model-auth-profiles.md A3',
       'token referencing a kid not in JWKS MUST return 401',
     )).toBe(401);
   });
 
   it('valid token → 201 or 403 (depending on host scope mapping)', async () => {
-    if (!issuer || !trustWired) return;
-    if (!isFixtureAdvertised(FIXTURE)) return;
+    if (!issuer || !trustWired) return softSkip('blocked', 'precondition not met — `!issuer || !trustWired` returned early (seam, prior step, or fixture unavailable)');
+    if (!isFixtureAdvertised(FIXTURE)) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!isFixtureAdvertised(FIXTURE)` returned early');
 
     const valid = issuer.mint({
       sub: 'conformance-suite',
@@ -334,7 +336,7 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
     // decision is a separate host-side policy not normated by RFC 0010.
     expect(
       [201, 403].includes(res.status),
-      driver.describe(
+      req('openwop.it.auth-oidc-user-bearer.valid-token-201-or-403-depending-on-host-scope-mapping', 
         'auth-profiles.md §`openwop-auth-oidc-user-bearer`',
         'host-trusted token MUST yield 201 (mapped scope) or 403 (unmapped sub), NOT 401',
       ),
@@ -342,14 +344,14 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
   });
 
   it('scope-insufficient → 403 (when host uses group-claim mapping)', async () => {
-    if (!issuer || !trustWired) return;
+    if (!issuer || !trustWired) return softSkip('blocked', 'precondition not met — `!issuer || !trustWired` returned early (seam, prior step, or fixture unavailable)');
     const auth = await readAuthCaps();
     if (auth?.oidc?.supportedScopeMapping !== 'group-claim') {
       // eslint-disable-next-line no-console
       console.warn(
         '[auth-oidc-user-bearer] host scope mapping is not group-claim; skipping scope-insufficient case',
       );
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `auth?.oidc?.supportedScopeMapping !== \'group-claim\'` returned early ([auth-oidc-user-bearer] host scope mapping is not group-claim; skipping scope-insufficient…');
     }
 
     const noGroups = issuer.mint({ sub: 'conformance-suite', groups: [] });
@@ -362,7 +364,7 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
       },
     );
 
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth-oidc-user-bearer.scope-insufficient-403-when-host-uses-group-claim-mapping', 
       'auth-profiles.md §`openwop-auth-oidc-user-bearer`',
       'token-valid-but-empty-groups against group-claim host MUST return 403 (forbidden), NOT 401',
     )).toBe(403);