@openwop/openwop-conformance 1.162.0 → 2.0.0-rc.0

package/src/scenarios/auth-saml-profile.test.ts

@@ -25,6 +25,8 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { type SamlVariant } from '../lib/saml-idp.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const SAML_PROFILE = 'openwop-auth-saml';
 
@@ -46,10 +48,10 @@ async function readProfiles(): Promise<string[] | null> {
 describe('auth-saml-profile: advertisement shape (RFC 0050)', () => {
   it('auth.profiles, when present, is an array of non-empty strings', async () => {
     const profiles = await readProfiles();
-    if (profiles === null) return; // host advertises no auth profiles
+    if (profiles === null) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `profiles === null` returned early (host advertises no auth profiles)'); // host advertises no auth profiles
     expect(
       Array.isArray(profiles),
-      driver.describe('auth-profiles.md §Discovery', 'capabilities.auth.profiles MUST be an array'),
+      req('openwop.it.auth-saml-profile.auth-profiles-when-present-is-an-array-of-non-empty-strings', 'auth-profiles.md §Discovery', 'capabilities.auth.profiles MUST be an array'),
     ).toBe(true);
     for (const p of profiles) {
       expect(typeof p === 'string' && p.length > 0).toBe(true);
@@ -58,10 +60,10 @@ describe('auth-saml-profile: advertisement shape (RFC 0050)', () => {
 
   it('claims openwop-auth-saml as a well-formed profile id when advertised', async () => {
     const profiles = await readProfiles();
-    if (profiles === null || !profiles.includes(SAML_PROFILE)) return; // profile not claimed
+    if (profiles === null || !profiles.includes(SAML_PROFILE)) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `profiles === null || !profiles.includes(SAML_PROFILE)` returned early (profile not claimed)'); // profile not claimed
     expect(
       profiles.includes(SAML_PROFILE),
-      driver.describe('RFC 0050 §A', 'openwop-auth-saml MUST appear verbatim in capabilities.auth.profiles when claimed'),
+      req('openwop.it.auth-saml-profile.claims-openwop-auth-saml-as-a-well-formed-profile-id-when-advertised', 'RFC 0050 §A', 'openwop-auth-saml MUST appear verbatim in capabilities.auth.profiles when claimed'),
     ).toBe(true);
   });
 });
@@ -83,13 +85,13 @@ describe('auth-saml-profile: assertion validation (RFC 0050 §A — opt-in)', ()
 
   it('ACCEPTS a valid signed, in-window, non-wrapped assertion (synthetic IdP required)', async () => {
     const profiles = await readProfiles();
-    if (profiles === null || !profiles.includes(SAML_PROFILE)) return; // capability-gated
-    if (!gated()) return; // opt-in: synthetic-IdP harness not provided
+    if (profiles === null || !profiles.includes(SAML_PROFILE)) return softSkip('blocked', 'precondition not met — `profiles === null || !profiles.includes(SAML_PROFILE)` returned early (capability-gated) (seam, prior step, or fixture unavailable)'); // capability-gated
+    if (!gated()) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!gated()` returned early (opt-in: synthetic-IdP harness not provided)'); // opt-in: synthetic-IdP harness not provided
     const res = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl, variant: 'valid' });
-    if (res.status === 404) return; // seam unwired
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam unwired) (seam, prior step, or fixture unavailable)'); // seam unwired
     expect(
       res.status,
-      driver.describe('RFC 0050 §A', 'a valid signed, in-window, non-wrapped SAML assertion MUST be accepted (2xx)'),
+      req('openwop.it.auth-saml-profile.accepts-a-valid-signed-in-window-non-wrapped-assertion-synthetic-idp-required', 'RFC 0050 §A', 'a valid signed, in-window, non-wrapped SAML assertion MUST be accepted (2xx)'),
     ).toBeLessThan(400);
   });
 
@@ -108,11 +110,11 @@ describe('auth-saml-profile: assertion validation (RFC 0050 §A — opt-in)', ()
   for (const [variant, requirement] of negatives) {
     it(`REJECTS the ${variant} assertion over the seam (synthetic IdP required)`, async () => {
       const profiles = await readProfiles();
-      if (profiles === null || !profiles.includes(SAML_PROFILE)) return; // capability-gated
-      if (!gated()) return; // opt-in: synthetic-IdP harness not provided
+      if (profiles === null || !profiles.includes(SAML_PROFILE)) return softSkip('blocked', 'precondition not met — `profiles === null || !profiles.includes(SAML_PROFILE)` returned early (capability-gated) (seam, prior step, or fixture unavailable)'); // capability-gated
+      if (!gated()) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!gated()` returned early (opt-in: synthetic-IdP harness not provided)'); // opt-in: synthetic-IdP harness not provided
       const res = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl, variant });
-      if (res.status === 404) return; // seam unwired
-      expect(res.status, driver.describe('RFC 0050 §A', requirement)).toBeGreaterThanOrEqual(400);
+      if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam unwired) (seam, prior step, or fixture unavailable)'); // seam unwired
+      expect(res.status, req('openwop.it.auth-saml-profile.rejects-the-assertion-over-the-seam-synthetic-idp-required', 'RFC 0050 §A', requirement)).toBeGreaterThanOrEqual(400);
     });
   }
 });

package/src/scenarios/auth-scim-profile.test.ts

@@ -19,6 +19,7 @@ import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 const SCIM_PROFILE = 'openwop-auth-scim';
 
@@ -43,7 +44,7 @@ describe('auth-scim-profile: advertisement shape (RFC 0050)', () => {
     if (profiles === null || !profiles.includes(SCIM_PROFILE)) return softSkip('inapplicable', 'profile not claimed');
     expect(
       profiles.includes(SCIM_PROFILE),
-      driver.describe('RFC 0050 §B', 'openwop-auth-scim MUST appear verbatim in capabilities.auth.profiles when claimed'),
+      req('openwop.it.auth-scim-profile.claims-openwop-auth-scim-as-a-well-formed-profile-id-when-advertised', 'RFC 0050 §B', 'openwop-auth-scim MUST appear verbatim in capabilities.auth.profiles when claimed'),
     ).toBe(true);
   });
 });
@@ -61,7 +62,7 @@ describe('auth-scim-profile: provisioning roundtrip (RFC 0050 §B — opt-in)',
     if (res.status === 404) return softSkip('blocked', 'seam unwired');
     expect(
       res.status,
-      driver.describe('RFC 0050 §B', 'a SCIM user provisioning MUST succeed (2xx) and upsert an RFC 0048 principal'),
+      req('openwop.it.auth-scim-profile.provisions-a-scim-user-principal-scim-endpoint-required', 'RFC 0050 §B', 'a SCIM user provisioning MUST succeed (2xx) and upsert an RFC 0048 principal'),
     ).toBeLessThan(400);
   });
 });

package/src/scenarios/auth-subject-link-key-class.test.ts

@@ -42,6 +42,7 @@ import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 const SAML_PROFILE = 'openwop-auth-saml';
 const SCIM_PROFILE = 'openwop-auth-scim';
@@ -81,7 +82,7 @@ describe('auth-subject-link-key-class: advertisement shape (RFC 0163 §A)', () =
     // profiles) MUST advertise a subjectLinkKey.
     expect(
       typeof auth.subjectLinkKey === 'string' && auth.subjectLinkKey.length > 0,
-      driver.describe(
+      req('openwop.it.auth-subject-link-key-class.subjectlinking-true-requires-a-subjectlinkkey-drawn-from-the-closed-safe-class-e', 
         'auth-profiles.md §Subject linking',
         'RFC 0163 §A.1: a host advertising capabilities.auth.subjectLinking:true MUST also advertise capabilities.auth.subjectLinkKey',
       ),
@@ -93,7 +94,7 @@ describe('auth-subject-link-key-class: advertisement shape (RFC 0163 §A)', () =
     // host cannot name one.
     expect(
       (SUBJECT_LINK_KEY_CLASSES as readonly string[]).includes(auth.subjectLinkKey ?? ''),
-      driver.describe(
+      req('openwop.it.auth-subject-link-key-class.subjectlinking-true-requires-a-subjectlinkkey-drawn-from-the-closed-safe-class-e', 
         'auth-profiles.md §Subject linking',
         `RFC 0163 §A.3: subjectLinkKey MUST be one of ${SUBJECT_LINK_KEY_CLASSES.join(', ')} — a closed enum of allowed CLASSES (not attributes); a mutable/PII key is inexpressible`,
       ),
@@ -108,7 +109,7 @@ describe('auth-subject-link-key-class: advertisement shape (RFC 0163 §A)', () =
     const profiles = auth.profiles ?? [];
     expect(
       profiles.includes(SAML_PROFILE) && profiles.includes(SCIM_PROFILE),
-      driver.describe(
+      req('openwop.it.auth-subject-link-key-class.subjectlinkkey-is-only-claimed-alongside-both-saml-and-scim-profiles-rides-the-r', 
         'auth-profiles.md §Subject linking',
         'RFC 0163: subjectLinkKey is meaningful only when both openwop-auth-saml and openwop-auth-scim are advertised (it names the class the two lanes are joined on)',
       ),
@@ -146,13 +147,13 @@ describe('auth-subject-link-key-class: same-IdP trust root (RFC 0163 §B — beh
       userName: 'r.smith',
     });
     if (provSame.status === 404) return softSkip('blocked', 'SCIM provisioning seam unwired');
-    expect(provSame.status, driver.describe('auth-profiles.md §Subject linking', 'SCIM provisioning MUST succeed')).toBeLessThan(400);
+    expect(provSame.status, req('openwop.it.auth-subject-link-key-class.a-same-idp-link-forms-control-but-a-cross-idp-collision-must-not-link', 'auth-profiles.md §Subject linking', 'SCIM provisioning MUST succeed')).toBeLessThan(400);
 
     const sameIdp = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl: idpAUrl, variant: 'valid', nameId: sameId });
     if (sameIdp.status === 404) return softSkip('blocked', 'SAML validate seam unwired');
     expect(
       (sameIdp.json as { authenticated?: boolean } | undefined)?.authenticated,
-      driver.describe('auth-profiles.md §Subject linking', 'RFC 0163 §B positive control: a SAML assertion from the SAME IdP trust root as the SCIM lane links and authenticates'),
+      req('openwop.it.auth-subject-link-key-class.a-same-idp-link-forms-control-but-a-cross-idp-collision-must-not-link', 'auth-profiles.md §Subject linking', 'RFC 0163 §B positive control: a SAML assertion from the SAME IdP trust root as the SCIM lane links and authenticates'),
     ).toBe(true);
 
     // THE §B.1 MUST — cross-IdP identifier collision. Provision a SCIM user fed
@@ -168,13 +169,13 @@ describe('auth-subject-link-key-class: same-IdP trust root (RFC 0163 §B — beh
       externalId: collideId,
       userName: 'a.other',
     });
-    expect(provCross.status, driver.describe('auth-profiles.md §Subject linking', 'SCIM provisioning MUST succeed')).toBeLessThan(400);
+    expect(provCross.status, req('openwop.it.auth-subject-link-key-class.a-same-idp-link-forms-control-but-a-cross-idp-collision-must-not-link', 'auth-profiles.md §Subject linking', 'SCIM provisioning MUST succeed')).toBeLessThan(400);
 
     const crossIdp = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl: idpBUrl, variant: 'valid', nameId: collideId });
     if (crossIdp.status === 404) return softSkip('blocked', 'SAML validate seam unwired');
     expect(
       (crossIdp.json as { authenticated?: boolean } | undefined)?.authenticated === true,
-      driver.describe(
+      req('openwop.it.auth-subject-link-key-class.a-same-idp-link-forms-control-but-a-cross-idp-collision-must-not-link', 
         'auth-profiles.md §Subject linking',
         'RFC 0163 §B.1: a SAML assertion from IdP-B colliding on an identifier the SCIM lane provisioned from IdP-A MUST NOT form a cross-lane link (no cross-IdP identifier collision joins two principals)',
       ),

package/src/scenarios/auth-subject-link.test.ts

@@ -27,6 +27,7 @@ import { describe, it, expect } from 'vitest';
 import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 const SAML_PROFILE = 'openwop-auth-saml';
 const SCIM_PROFILE = 'openwop-auth-scim';
@@ -65,7 +66,7 @@ describe('auth-subject-link: advertisement shape (RFC 0159 §B + RFC 0164 §A.3)
     const profiles = auth.profiles ?? [];
     expect(
       profiles.includes(SAML_PROFILE) && profiles.includes(SCIM_PROFILE),
-      driver.describe(
+      req('openwop.it.auth-subject-link.subjectlinking-true-is-only-claimed-alongside-both-saml-and-scim-profiles', 
         'auth-profiles.md §Subject linking',
         'a host MUST NOT set capabilities.auth.subjectLinking:true unless BOTH openwop-auth-saml and openwop-auth-scim are advertised',
       ),
@@ -83,14 +84,14 @@ describe('auth-subject-link: advertisement shape (RFC 0159 §B + RFC 0164 §A.3)
     // absence alongside both profiles is a conformance FAILURE.
     expect(
       auth.subjectLinking,
-      driver.describe(
+      req('openwop.it.auth-subject-link.advertising-both-profiles-requires-subjectlinking-true-a-subjectlinkkey-rfc-0164', 
         'auth-profiles.md §Subject linking (RFC 0164)',
         'RFC 0164 §A.3: a host advertising BOTH openwop-auth-saml and openwop-auth-scim MUST advertise capabilities.auth.subjectLinking:true — the leaver contract follows the profile pair; omitting the flag is the vulnerable pre-0164 shape',
       ),
     ).toBe(true);
     expect(
       typeof auth.subjectLinkKey === 'string' && SUBJECT_LINK_KEY_CLASSES.includes(auth.subjectLinkKey),
-      driver.describe(
+      req('openwop.it.auth-subject-link.advertising-both-profiles-requires-subjectlinking-true-a-subjectlinkkey-rfc-0164', 
         'auth-profiles.md §Subject linking (RFC 0164)',
         `RFC 0164 §A.3 / RFC 0163 §A.1: a host advertising both profiles MUST advertise subjectLinkKey ∈ {${SUBJECT_LINK_KEY_CLASSES.join(', ')}}`,
       ),
@@ -116,7 +117,7 @@ describe('auth-subject-link: cross-lane deactivation (RFC 0159 §A.3 — opt-in)
       userName: 'r.smith',
     });
     if (provision.status === 404) return softSkip('blocked', 'seam unwired');
-    expect(provision.status, driver.describe('auth-profiles.md §Subject linking', 'SCIM provisioning MUST succeed')).toBeLessThan(400);
+    expect(provision.status, req('openwop.it.auth-subject-link.a-scim-deactivation-fail-closes-the-linked-saml-identity', 'auth-profiles.md §Subject linking', 'SCIM provisioning MUST succeed')).toBeLessThan(400);
 
     // 2. A valid SAML assertion whose persistent NameID equals the externalId
     //    links to the same subject and authenticates.
@@ -124,19 +125,19 @@ describe('auth-subject-link: cross-lane deactivation (RFC 0159 §A.3 — opt-in)
     if (before.status === 404) return softSkip('blocked', 'seam unwired');
     expect(
       (before.json as { authenticated?: boolean } | undefined)?.authenticated,
-      driver.describe('auth-profiles.md §Subject linking', 'a valid linked SAML assertion authenticates before deactivation'),
+      req('openwop.it.auth-subject-link.a-scim-deactivation-fail-closes-the-linked-saml-identity', 'auth-profiles.md §Subject linking', 'a valid linked SAML assertion authenticates before deactivation'),
     ).toBe(true);
 
     // 3. SCIM-deactivate the provisioned user.
     const deactivate = await driver.post('/v1/host/sample/auth/scim/provision', { scimUrl, op: 'deactivate-user', externalId });
-    expect(deactivate.status, driver.describe('auth-profiles.md §Subject linking', 'SCIM deactivation MUST succeed')).toBeLessThan(400);
+    expect(deactivate.status, req('openwop.it.auth-subject-link.a-scim-deactivation-fail-closes-the-linked-saml-identity', 'auth-profiles.md §Subject linking', 'SCIM deactivation MUST succeed')).toBeLessThan(400);
 
     // 4. THE CONTRACT: a subsequent SAML assertion for the linked subject MUST
     //    NOT yield an authorized decision (fail-closed across the link).
     const after = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl, variant: 'valid', nameId: externalId });
     expect(
       (after.json as { authenticated?: boolean } | undefined)?.authenticated === true,
-      driver.describe(
+      req('openwop.it.auth-subject-link.a-scim-deactivation-fail-closes-the-linked-saml-identity', 
         'auth-profiles.md §Subject linking',
         'RFC 0159 §A.3: after a SCIM deactivation the LINKED SAML identity MUST be denied (a provisioned leaver cannot still SSO in)',
       ),
@@ -169,9 +170,9 @@ describe('auth-subject-link: link-key hygiene (RFC 0159 §A.2 — opt-in)', () =
       // Conforming: the host rejected a mutable-key link outright.
       expect(
         link.status,
-        driver.describe('auth-profiles.md §Subject linking', 'RFC 0159 §A.2: a link on a mutable/PII key (email) MUST be rejected'),
+        req('openwop.it.auth-subject-link.a-mutable-pii-link-key-email-never-produces-a-cross-lane-pass', 'auth-profiles.md §Subject linking', 'RFC 0159 §A.2: a link on a mutable/PII key (email) MUST be rejected'),
       ).toBeGreaterThanOrEqual(400);
-      return;
+      return softSkip('blocked', 'precondition not met — `link.status >= 400` returned early (seam, prior step, or fixture unavailable)');
     }
 
     // If the host accepted the request, it MUST NOT have formed a cross-lane
@@ -183,7 +184,7 @@ describe('auth-subject-link: link-key hygiene (RFC 0159 §A.2 — opt-in)', () =
     const other = await driver.post('/v1/host/sample/auth/saml/validate', { idpUrl, variant: 'valid', nameId: 'idp-op-DIFFERENT' });
     expect(
       (other.json as { linkedDenied?: boolean } | undefined)?.linkedDenied === true,
-      driver.describe(
+      req('openwop.it.auth-subject-link.a-mutable-pii-link-key-email-never-produces-a-cross-lane-pass', 
         'auth-profiles.md §Subject linking',
         'RFC 0159 §A.2: a mutable-key (email) operation MUST NOT drive a cross-lane deny on any opaque subject',
       ),

package/src/scenarios/auth.test.ts

@@ -8,6 +8,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { req } from '../lib/requirement-ids.js';
 
 const KNOWN_AUTHED_PATH = '/v1/runs';
 
@@ -19,17 +20,17 @@ describe('auth: missing credential', () => {
       { authenticated: false },
     );
 
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth.returns-401-with-canonical-error-envelope-per-auth-md-3', 
       'auth.md §3',
       'request without Authorization header MUST return 401',
     )).toBe(401);
 
     const body = res.json as { error?: unknown; message?: unknown } | undefined;
-    expect(typeof body?.error, driver.describe(
+    expect(typeof body?.error, req('openwop.it.auth.returns-401-with-canonical-error-envelope-per-auth-md-3', 
       'auth.md §3 + rest-endpoints.md error envelope',
       'response body MUST include `error` (machine code) string',
     )).toBe('string');
-    expect(typeof body?.message, driver.describe(
+    expect(typeof body?.message, req('openwop.it.auth.returns-401-with-canonical-error-envelope-per-auth-md-3', 
       'auth.md §3 + rest-endpoints.md error envelope',
       'response body MUST include `message` (human description) string',
     )).toBe('string');
@@ -47,7 +48,7 @@ describe('auth: invalid credential', () => {
       },
     );
 
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.auth.returns-401-not-200-not-403-per-auth-md-3', 
       'auth.md §3',
       'request with invalid Authorization MUST return 401, not 403',
     )).toBe(401);

package/src/scenarios/authorization-fail-closed.test.ts

@@ -26,6 +26,7 @@ import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DiscoveryAuthorization {
   supported?: boolean;
@@ -50,7 +51,7 @@ describe('authorization-fail-closed: advertisement shape (RFC 0049 §C)', () =>
     if (!authz?.supported || authz.failClosed === undefined) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!authz?.supported || authz.failClosed === undefined` returned early');
     expect(
       authz.failClosed,
-      driver.describe('RFC 0049 §C', 'capabilities.authorization.failClosed MUST be `true`'),
+      req('openwop.it.authorization-fail-closed.failclosed-is-exactly-true-when-authorization-is-supported', 'RFC 0049 §C', 'capabilities.authorization.failClosed MUST be `true`'),
     ).toBe(true);
   });
 });
@@ -73,7 +74,7 @@ describe('authorization-fail-closed: absent/unseeded role MUST deny (RFC 0049 §
     const decision = res.json as { allowed?: boolean } | undefined;
     expect(
       decision?.allowed,
-      driver.describe(
+      req('openwop.it.authorization-fail-closed.a-decision-for-an-unseeded-role-principal-resolves-allowed-false', 
         'SECURITY/invariants.yaml authorization-fail-closed',
         'an absent/unseeded role MUST deny (allowed=false); the host MUST NOT default-allow',
       ),

package/src/scenarios/authorization-roles-shape.test.ts

@@ -21,6 +21,8 @@
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface DiscoveryRole {
   role?: string;
@@ -48,10 +50,10 @@ async function readAuthorization(): Promise<DiscoveryAuthorization | null> {
 describe('authorization-roles-shape: advertisement shape (RFC 0049 §A)', () => {
   it('capabilities.authorization is either absent or well-formed', async () => {
     const authz = await readAuthorization();
-    if (authz === null) return; // host doesn't advertise authorization at all
+    if (authz === null) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `authz === null` returned early (host doesn\'t advertise authorization at all)'); // host doesn't advertise authorization at all
     expect(
       typeof authz.supported,
-      driver.describe(
+      req('openwop.it.authorization-roles-shape.capabilities-authorization-is-either-absent-or-well-formed', 
         'capabilities.schema.json §authorization',
         'capabilities.authorization.supported MUST be a boolean when authorization is advertised',
       ),
@@ -60,24 +62,24 @@ describe('authorization-roles-shape: advertisement shape (RFC 0049 §A)', () =>
 
   it('failClosed, when present, is exactly true (RFC 0049 §C)', async () => {
     const authz = await readAuthorization();
-    if (!authz?.supported || authz.failClosed === undefined) return;
+    if (!authz?.supported || authz.failClosed === undefined) return softSkip('blocked', 'precondition not met — `!authz?.supported || authz.failClosed === undefined` returned early (seam, prior step, or fixture unavailable)');
     expect(
       authz.failClosed,
-      driver.describe('RFC 0049 §C', 'capabilities.authorization.failClosed MUST be `true` (fail-closed)'),
+      req('openwop.it.authorization-roles-shape.failclosed-when-present-is-exactly-true-rfc-0049-c', 'RFC 0049 §C', 'capabilities.authorization.failClosed MUST be `true` (fail-closed)'),
     ).toBe(true);
   });
 
   it('every advertised role has a non-empty role name + a scopes array', async () => {
     const authz = await readAuthorization();
-    if (!authz?.supported || authz.roles === undefined) return;
+    if (!authz?.supported || authz.roles === undefined) return softSkip('blocked', 'precondition not met — `!authz?.supported || authz.roles === undefined` returned early (seam, prior step, or fixture unavailable)');
     for (const entry of authz.roles) {
       expect(
         typeof entry.role === 'string' && entry.role.length > 0,
-        driver.describe('RFC 0049 §A', 'each capabilities.authorization.roles[] entry MUST declare a non-empty role'),
+        req('openwop.it.authorization-roles-shape.every-advertised-role-has-a-non-empty-role-name-a-scopes-array', 'RFC 0049 §A', 'each capabilities.authorization.roles[] entry MUST declare a non-empty role'),
       ).toBe(true);
       expect(
         Array.isArray(entry.scopes),
-        driver.describe('RFC 0049 §A', 'each role MUST declare a scopes array'),
+        req('openwop.it.authorization-roles-shape.every-advertised-role-has-a-non-empty-role-name-a-scopes-array', 'RFC 0049 §A', 'each role MUST declare a scopes array'),
       ).toBe(true);
     }
   });

package/src/scenarios/blob-cross-tenant-isolation.test.ts

@@ -10,6 +10,8 @@
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -30,10 +32,10 @@ async function call(tenantId: string, op: string, args: Record<string, unknown>)
 describe('blob-cross-tenant-isolation: advertisement shape (RFC 0019)', () => {
   it('capabilities.blobStorage is either absent or a well-formed object', async () => {
     const cap = await readCap();
-    if (cap === null) return;
+    if (cap === null) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `cap === null` returned early');
     expect(
       typeof cap.supported,
-      driver.describe(
+      req('openwop.it.blob-cross-tenant-isolation.capabilities-blobstorage-is-either-absent-or-a-well-formed-object', 
         'capabilities.schema.json §blobStorage',
         'capabilities.blobStorage.supported MUST be a boolean when present',
       ),
@@ -44,7 +46,7 @@ describe('blob-cross-tenant-isolation: advertisement shape (RFC 0019)', () => {
 describe('blob-cross-tenant-isolation: behavioral (RFC 0019 §B point 1)', () => {
   it('put under tenant A → get under tenant B with same key returns found:false', async () => {
     const cap = await readCap();
-    if (!cap || cap.supported !== true) return;
+    if (!cap || cap.supported !== true) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!cap || cap.supported !== true` returned early');
     const key = `xtenant-blob-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
 
     const putRes = await call('tenant-a', 'put', {
@@ -53,15 +55,15 @@ describe('blob-cross-tenant-isolation: behavioral (RFC 0019 §B point 1)', () =>
       contentBase64: Buffer.from('from-A').toString('base64'),
       contentType: 'text/plain',
     });
-    if (putRes.status === 404) return;
-    expect(putRes.status, 'put MUST succeed').toBe(200);
+    if (putRes.status === 404) return softSkip('blocked', 'precondition not met — `putRes.status === 404` returned early (seam, prior step, or fixture unavailable)');
+    expect(putRes.status, req('openwop.it.blob-cross-tenant-isolation.put-under-tenant-a-get-under-tenant-b-with-same-key-returns-found-false', 'RFC 0019 §B point 1', 'put MUST succeed')).toBe(200);
 
     const getRes = await call('tenant-b', 'get', { bucket: 'default', key });
     expect(getRes.status).toBe(200);
     const body = getRes.json as { found?: boolean };
     expect(
       body.found,
-      driver.describe('RFC 0019 §B point 1', 'tenant B MUST NOT retrieve tenant A blob at same key'),
+      req('openwop.it.blob-cross-tenant-isolation.put-under-tenant-a-get-under-tenant-b-with-same-key-returns-found-false', 'RFC 0019 §B point 1', 'tenant B MUST NOT retrieve tenant A blob at same key'),
     ).toBe(false);
   });
 });

package/src/scenarios/blob-presign-expiry.test.ts

@@ -16,6 +16,8 @@
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -32,10 +34,10 @@ async function readCap(): Promise<Record<string, unknown> | null> {
 describe('blob-presign-expiry: advertisement shape (RFC 0019)', () => {
   it('capabilities.blobStorage is either absent or a well-formed object', async () => {
     const cap = await readCap();
-    if (cap === null) return; // host doesn't advertise — skip
+    if (cap === null) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `cap === null` returned early (host doesn\'t advertise — skip)'); // host doesn't advertise — skip
     expect(
       typeof cap.supported,
-      driver.describe(
+      req('openwop.it.blob-presign-expiry.capabilities-blobstorage-is-either-absent-or-a-well-formed-object', 
         'capabilities.schema.json §blobStorage',
         'capabilities.blobStorage.supported MUST be a boolean when present',
       ),
@@ -44,17 +46,17 @@ describe('blob-presign-expiry: advertisement shape (RFC 0019)', () => {
 
   it('presignSupported is a boolean when set', async () => {
     const cap = await readCap();
-    if (!cap || cap.supported !== true) return;
+    if (!cap || cap.supported !== true) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!cap || cap.supported !== true` returned early');
     const subParts = ["presignSupported"];
     let sub: unknown = cap;
     for (const p of subParts) {
       if (sub && typeof sub === 'object') sub = (sub as Record<string, unknown>)[p];
       else { sub = undefined; break; }
     }
-    if (sub === undefined) return; // optional sub-field
+    if (sub === undefined) return softSkip('blocked', 'precondition not met — `sub === undefined` returned early (optional sub-field) (seam, prior step, or fixture unavailable)'); // optional sub-field
     expect(
       typeof sub,
-      driver.describe(
+      req('openwop.it.blob-presign-expiry.presignsupported-is-a-boolean-when-set', 
         'RFC 0019 §A',
         'blobStorage.presignSupported MUST be boolean when present',
       ),
@@ -69,7 +71,7 @@ async function call(op: string, args: Record<string, unknown>) {
 describe('blob-presign-expiry: behavioral (RFC 0019 §B point 1)', () => {
   it('presigned URL MUST resolve to the blob inside its TTL window and return 403 after expiry', async () => {
     const probe = await call('get', { key: '__probe__' });
-    if (probe.status === 404) return; // seam not exposed
+    if (probe.status === 404) return softSkip('blocked', 'precondition not met — `probe.status === 404` returned early (seam not exposed) (seam, prior step, or fixture unavailable)'); // seam not exposed
     const key = `pre-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const contentBase64 = Buffer.from('presigned-payload').toString('base64');
     await call('put', { key, contentBase64, contentType: 'text/plain' });
@@ -78,14 +80,14 @@ describe('blob-presign-expiry: behavioral (RFC 0019 §B point 1)', () => {
     const presign = await call('presign', { key, expiresInSeconds: 2 });
     expect(presign.status).toBe(200);
     const body = presign.json as { url?: string; expiresAtMs?: number };
-    expect(typeof body.url, 'presign MUST return a URL').toBe('string');
+    expect(typeof body.url, req('openwop.it.blob-presign-expiry.presigned-url-must-resolve-to-the-blob-inside-its-ttl-window-and-return-403-afte', 'RFC 0019 §B point 1', 'presign MUST return a URL')).toBe('string');
 
     // Fetch within the window — MUST return 200 + the bytes
     const within = await driver.get(body.url!);
-    if (within.status === 404) return; // host doesn't expose the resolver route — soft-skip the expiry side too
+    if (within.status === 404) return softSkip('blocked', 'precondition not met — `within.status === 404` returned early (host doesn\'t expose the resolver route — soft-skip the expiry side too) (seam, prior step, or fixture unavailable)'); // host doesn't expose the resolver route — soft-skip the expiry side too
     expect(
       within.status,
-      driver.describe('RFC 0019 §B point 1', 'presigned URL MUST resolve to 200 within its TTL window'),
+      req('openwop.it.blob-presign-expiry.presigned-url-must-resolve-to-the-blob-inside-its-ttl-window-and-return-403-afte', 'RFC 0019 §B point 1', 'presigned URL MUST resolve to 200 within its TTL window'),
     ).toBe(200);
 
     // Wait past expiry (TTL=2s + 1s buffer)
@@ -94,7 +96,7 @@ describe('blob-presign-expiry: behavioral (RFC 0019 §B point 1)', () => {
     const after = await driver.get(body.url!);
     expect(
       after.status,
-      driver.describe('RFC 0019 §B point 1', 'presigned URL MUST return 403 after TTL expiry'),
+      req('openwop.it.blob-presign-expiry.presigned-url-must-resolve-to-the-blob-inside-its-ttl-window-and-return-403-afte', 'RFC 0019 §B point 1', 'presigned URL MUST return 403 after TTL expiry'),
     ).toBe(403);
   });
 });

package/src/scenarios/budget-enforcement.test.ts

@@ -29,11 +29,12 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readBudgetCap, driveBudgetRun, BUDGET_CAP_KINDS, BUDGET_CONTENT_FORBIDDEN } from '../lib/budgetPolicy.js';
 import { queryTestEvents, isEventLogSeamAvailable, resetTestSeam } from '../lib/event-log-query.js';
 import type { TestEvent } from '../lib/event-log-query.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 function seq(events: TestEvent[], type: string): number {
   const e = events.find((x) => x.type === type);
@@ -45,7 +46,7 @@ function expectContentFree(events: TestEvent[]): void {
     for (const f of BUDGET_CONTENT_FORBIDDEN) {
       expect(
         !(f in e.payload),
-        driver.describe('RFC 0084 §F (SR-1) / budget-no-pricing-leak', `budget.* MUST be content-free (no ${f})`),
+        req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'RFC 0084 §F (SR-1) / budget-no-pricing-leak', `budget.* MUST be content-free (no ${f})`),
       ).toBe(true);
     }
   }
@@ -55,11 +56,11 @@ describe('budget-enforcement (RFC 0084 §C/§D)', () => {
   it('runs the reserved→consumed→threshold→exhausted→cap.breached→run.failed chain, refuses denied models, and honors advisory mode', async () => {
     const cap = await readBudgetCap();
     if (!behaviorGate('openwop-budget-enforcement', cap?.supported === true)) return;
-    if (!(await isEventLogSeamAvailable())) return; // event-log seam absent — soft-skip
+    if (!(await isEventLogSeamAvailable())) return softSkip('blocked', 'precondition not met — `!(await isEventLogSeamAvailable())` returned early (event-log seam absent — soft-skip) (seam, prior step, or fixture unavailable)'); // event-log seam absent — soft-skip
 
     // ---- Leg 1: hard cost exhaust (§C/§D) -------------------------------
     const hard = await driveBudgetRun({ scenario: 'hard-cost-exhaust' });
-    if (hard === null) return; // budget seam absent — soft-skip the whole behavior
+    if (hard === null) return softSkip('blocked', 'precondition not met — `hard === null` returned early (budget seam absent — soft-skip the whole behavior) (seam, prior step, or fixture unavailable)'); // budget seam absent — soft-skip the whole behavior
     if (hard.runId) {
       const q = await queryTestEvents(hard.runId);
       if (q.ok) {
@@ -72,39 +73,39 @@ describe('budget-enforcement (RFC 0084 §C/§D)', () => {
 
         expect(
           reserved >= 0 && exhausted >= 0,
-          driver.describe('budget-policy.md §C', 'a hard budget run MUST emit budget.reserved + budget.exhausted'),
+          req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'budget-policy.md §C', 'a hard budget run MUST emit budget.reserved + budget.exhausted'),
         ).toBe(true);
         // §C ordering: reserved < threshold.crossed < exhausted < run.failed.
         if (threshold >= 0) {
           expect(
             reserved < threshold && threshold < exhausted,
-            driver.describe('RFC 0084 §C', 'ordering MUST be reserved < threshold.crossed < exhausted'),
+            req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'RFC 0084 §C', 'ordering MUST be reserved < threshold.crossed < exhausted'),
           ).toBe(true);
           const tc = ev.find((e) => e.type === 'budget.threshold.crossed');
           expect(
             typeof tc?.payload.percent === 'number',
-            driver.describe('run-event-payloads.schema.json#budgetThresholdCrossed', 'threshold.crossed MUST carry a numeric percent'),
+            req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'run-event-payloads.schema.json#budgetThresholdCrossed', 'threshold.crossed MUST carry a numeric percent'),
           ).toBe(true);
         }
         // §D hard-stop: exhausted → cap.breached{budget-*} → run.failed{budget_exhausted}.
         expect(
           capBreached !== undefined,
-          driver.describe('RFC 0084 §D', 'exhaustion MUST emit cap.breached with a budget-* kind'),
+          req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'RFC 0084 §D', 'exhaustion MUST emit cap.breached with a budget-* kind'),
         ).toBe(true);
         if (capBreached) {
           expect(
             BUDGET_CAP_KINDS.includes(capBreached.payload.kind as string),
-            driver.describe('RFC 0084 §D', 'cap.breached.kind MUST be in the closed budget vocabulary'),
+            req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'RFC 0084 §D', 'cap.breached.kind MUST be in the closed budget vocabulary'),
           ).toBe(true);
           expect(
             exhausted <= capBreached.sequence && capBreached.sequence <= failed,
-            driver.describe('RFC 0084 §D', 'ordering MUST be exhausted ≤ cap.breached ≤ run.failed'),
+            req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'RFC 0084 §D', 'ordering MUST be exhausted ≤ cap.breached ≤ run.failed'),
           ).toBe(true);
         }
         const failedEvt = ev.find((e) => e.type === 'run.failed');
         expect(
           failedEvt?.payload.error === 'budget_exhausted',
-          driver.describe('RFC 0084 §D', 'a hard-budget overrun MUST fail the run with error budget_exhausted'),
+          req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'RFC 0084 §D', 'a hard-budget overrun MUST fail the run with error budget_exhausted'),
         ).toBe(true);
         expectContentFree(ev);
       }
@@ -115,11 +116,11 @@ describe('budget-enforcement (RFC 0084 §C/§D)', () => {
     if (denied !== null) {
       expect(
         denied.error === 'budget_model_denied',
-        driver.describe('RFC 0084 §D', 'a model violating the budget allow/deny list MUST be refused with budget_model_denied'),
+        req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'RFC 0084 §D', 'a model violating the budget allow/deny list MUST be refused with budget_model_denied'),
       ).toBe(true);
       expect(
         denied.modelCalled !== true,
-        driver.describe('RFC 0084 §D', 'a denied model MUST be refused BEFORE the provider call (fail-closed)'),
+        req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'RFC 0084 §D', 'a denied model MUST be refused BEFORE the provider call (fail-closed)'),
       ).toBe(true);
     }
 
@@ -139,7 +140,7 @@ describe('budget-enforcement (RFC 0084 §C/§D)', () => {
           if (hasBudgetEvents) {
             expect(
               !stopped,
-              driver.describe('RFC 0084 §D', 'advisory enforcement MUST emit budget.* events without stopping the run'),
+              req('openwop.it.budget-enforcement.runs-the-reserved-consumed-threshold-exhausted-cap-breached-run-failed-chain-ref', 'RFC 0084 §D', 'advisory enforcement MUST emit budget.* events without stopping the run'),
             ).toBe(true);
           }
           expectContentFree(ev);