@openwop/openwop-conformance 1.162.0 → 2.0.0-rc.0

package/src/scenarios/connection-pack-apihosts.test.ts

@@ -47,6 +47,8 @@ import { SCHEMAS_DIR, FIXTURES_DIR } from '../lib/paths.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const SCHEMA_PATH = join(SCHEMAS_DIR, 'connection-pack-manifest.schema.json');
 const APIHOSTS_FIXTURE = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-apihosts-valid.json');
@@ -90,7 +92,7 @@ describe('category: connection-pack apiHosts — schema shape (RFC 0120 §A; inv
   it('positive: an openapi-reach provider declaring apiHosts validates', () => {
     expect(
       validate(apiHostsFixture()),
-      `connection-packs.md §Manifest item 10: a well-formed apiHosts allow-list MUST validate. Errors: ${JSON.stringify(validate.errors)}`,
+      req('openwop.it.connection-pack-apihosts.positive-an-openapi-reach-provider-declaring-apihosts-validates', 'RFC 0120', `connection-packs.md §Manifest item 10: a well-formed apiHosts allow-list MUST validate. Errors: ${JSON.stringify(validate.errors)}`),
     ).toBe(true);
   });
 
@@ -100,16 +102,16 @@ describe('category: connection-pack apiHosts — schema shape (RFC 0120 §A; inv
     const errs = failsWith(m, 'required');
     expect(
       errs.some((e) => (e.params as { missingProperty?: string }).missingProperty === 'apiHosts'),
-      'connection-packs.md §Manifest item 13: when reach is openapi, apiHosts is REQUIRED (the provider-level allOf)',
+      req('openwop.it.connection-pack-apihosts.conditional-must-item-13-a-allof-an-openapi-reach-provider-that-omits-apihosts-i', 'RFC 0120', 'connection-packs.md §Manifest item 13: when reach is openapi, apiHosts is REQUIRED (the provider-level allOf)'),
     ).toBe(true);
   });
 
   it('omission OK off the conditional: an mcp-reach provider without apiHosts validates', () => {
     const m = mcpFixture();
-    expect(m.provider.apiHosts, 'precondition: the github fixture is mcp-reach and declares no apiHosts').toBeUndefined();
+    expect(m.provider.apiHosts, req('openwop.it.connection-pack-apihosts.omission-ok-off-the-conditional-an-mcp-reach-provider-without-apihosts-validates', 'RFC 0120', 'precondition: the github fixture is mcp-reach and declares no apiHosts')).toBeUndefined();
     expect(
       validate(m),
-      `connection-packs.md §Manifest item 13: a non-openapi provider MAY omit apiHosts. Errors: ${JSON.stringify(validate.errors)}`,
+      req('openwop.it.connection-pack-apihosts.omission-ok-off-the-conditional-an-mcp-reach-provider-without-apihosts-validates', 'RFC 0120', `connection-packs.md §Manifest item 13: a non-openapi provider MAY omit apiHosts. Errors: ${JSON.stringify(validate.errors)}`),
     ).toBe(true);
   });
 
@@ -120,7 +122,7 @@ describe('category: connection-pack apiHosts — schema shape (RFC 0120 §A; inv
       const errs = failsWith(m, 'pattern');
       expect(
         errs.length,
-        `connection-packs.md §Manifest item 11: "${bad}" MUST be rejected — apiHosts entries are bare, lowercase, alphabetic-TLD registrable hostnames (connection_pack_invalid_api_host)`,
+        req('openwop.it.connection-pack-apihosts.entry-shape-item-11-ipv4-literal-wildcard-port-single-label-uppercase-entries-ar', 'RFC 0120', `connection-packs.md §Manifest item 11: "${bad}" MUST be rejected — apiHosts entries are bare, lowercase, alphabetic-TLD registrable hostnames (connection_pack_invalid_api_host)`),
       ).toBeGreaterThan(0);
     }
   });
@@ -128,16 +130,16 @@ describe('category: connection-pack apiHosts — schema shape (RFC 0120 §A; inv
 
 describe('category: connection-pack apiHosts — matching rule (RFC 0120 item 10; invariant connection-pack-egress-host-bound)', () => {
   it('permits the entry host and its subdomains (eTLD+1 floor)', () => {
-    expect(matchesApiHost('facebook.com', 'facebook.com'), 'item 10: a request host equal to the entry matches').toBe(true);
-    expect(matchesApiHost('graph.facebook.com', 'facebook.com'), 'item 10: a subdomain of the entry matches (eTLD+1 floor)').toBe(true);
-    expect(matchesApiHost('api.example.com', 'example.com'), 'item 10: a subdomain matches').toBe(true);
+    expect(matchesApiHost('facebook.com', 'facebook.com'), req('openwop.it.connection-pack-apihosts.permits-the-entry-host-and-its-subdomains-etld-1-floor', 'RFC 0120', 'item 10: a request host equal to the entry matches')).toBe(true);
+    expect(matchesApiHost('graph.facebook.com', 'facebook.com'), req('openwop.it.connection-pack-apihosts.permits-the-entry-host-and-its-subdomains-etld-1-floor', 'RFC 0120', 'item 10: a subdomain of the entry matches (eTLD+1 floor)')).toBe(true);
+    expect(matchesApiHost('api.example.com', 'example.com'), req('openwop.it.connection-pack-apihosts.permits-the-entry-host-and-its-subdomains-etld-1-floor', 'RFC 0120', 'item 10: a subdomain matches')).toBe(true);
   });
 
   it('a pack MAY tighten to an exact host without admitting siblings', () => {
-    expect(matchesApiHost('googleads.googleapis.com', 'googleads.googleapis.com'), 'item 10: the tighter exact host matches itself').toBe(true);
+    expect(matchesApiHost('googleads.googleapis.com', 'googleads.googleapis.com'), req('openwop.it.connection-pack-apihosts.a-pack-may-tighten-to-an-exact-host-without-admitting-siblings', 'RFC 0120', 'item 10: the tighter exact host matches itself')).toBe(true);
     expect(
       matchesApiHost('bigquery.googleapis.com', 'googleads.googleapis.com'),
-      'item 10: a sibling subdomain MUST NOT match a tighter exact-host entry',
+      req('openwop.it.connection-pack-apihosts.a-pack-may-tighten-to-an-exact-host-without-admitting-siblings', 'RFC 0120', 'item 10: a sibling subdomain MUST NOT match a tighter exact-host entry'),
     ).toBe(false);
   });
 
@@ -145,7 +147,7 @@ describe('category: connection-pack apiHosts — matching rule (RFC 0120 item 10
     for (const evil of ['notexample.com', 'evil.com', 'example.com.evil.com', 'myexample.com']) {
       expect(
         matchesApiHost(evil, 'example.com'),
-        `item 10: "${evil}" MUST NOT match "example.com" (dot-anchored containment, never a bare substring)`,
+        req('openwop.it.connection-pack-apihosts.no-substring-suffix-prefix-escape-non-matching-hosts-fail-closed', 'RFC 0120', `item 10: "${evil}" MUST NOT match "example.com" (dot-anchored containment, never a bare substring)`),
       ).toBe(false);
     }
   });
@@ -163,10 +165,10 @@ async function gate(): Promise<boolean> {
 
 describe('connection-pack apiHosts — behavioral egress allow-list (RFC 0120 item 10; capability-gated)', () => {
   it('permits a credential-bearing egress to an apiHosts match; fails closed otherwise (no substring escape)', async () => {
-    if (!(await gate())) return;
+    if (!(await gate())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await gate())` returned early');
 
     const install = await driver.post('/v1/host/sample/connection-packs/install', { manifest: apiHostsFixture() });
-    if (install.status === 404 || install.status === 403) return; // seam unwired — soft-skip
+    if (install.status === 404 || install.status === 403) return softSkip('blocked', 'precondition not met — `install.status === 404 || install.status === 403` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
 
     const probe = async (requestHost: string): Promise<EgressResult | undefined> => {
       const res = await driver.post('/v1/host/sample/connection-packs/egress-check', {
@@ -178,18 +180,18 @@ describe('connection-pack apiHosts — behavioral egress allow-list (RFC 0120 it
     };
 
     const allowed = await probe('graph.facebook.com');
-    if (allowed === undefined) return; // soft-skip
+    if (allowed === undefined) return softSkip('blocked', 'precondition not met — `allowed === undefined` returned early (soft-skip) (seam, prior step, or fixture unavailable)'); // soft-skip
     expect(
       allowed.allowed,
-      driver.describe('connection-packs.md §Manifest item 10', 'a credential-bearing egress to a host matching apiHosts MUST be permitted'),
+      req('openwop.it.connection-pack-apihosts.permits-a-credential-bearing-egress-to-an-apihosts-match-fails-closed-otherwise', 'connection-packs.md §Manifest item 10', 'a credential-bearing egress to a host matching apiHosts MUST be permitted'),
     ).toBe(true);
 
     for (const evil of ['evil.com', 'notfacebook.com', 'facebook.com.evil.com']) {
       const denied = await probe(evil);
-      if (denied === undefined) return; // soft-skip
+      if (denied === undefined) return softSkip('blocked', 'precondition not met — `denied === undefined` returned early (soft-skip) (seam, prior step, or fixture unavailable)'); // soft-skip
       expect(
         denied.allowed,
-        driver.describe('connection-packs.md §Manifest item 10', `egress to "${evil}" (no apiHosts match) MUST fail closed — no credential sent`),
+        req('openwop.it.connection-pack-apihosts.permits-a-credential-bearing-egress-to-an-apihosts-match-fails-closed-otherwise', 'connection-packs.md §Manifest item 10', `egress to "${evil}" (no apiHosts match) MUST fail closed — no credential sent`),
       ).toBe(false);
     }
   });

package/src/scenarios/connection-pack-manifest-valid.test.ts

@@ -42,6 +42,7 @@ import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import type { ErrorObject } from 'ajv';
 import { SCHEMAS_DIR, FIXTURES_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
 
 const SCHEMA_PATH = join(SCHEMAS_DIR, 'connection-pack-manifest.schema.json');
 const FIXTURE_PATH = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-github.json');
@@ -69,7 +70,7 @@ describe('category: connection-pack manifest validation (RFC 0095 §A)', () => {
   it('positive: the connection-pack-github fixture validates cleanly', () => {
     expect(
       validate(fixture()),
-      `connection-packs.md §Manifest clause 1: a well-formed kind:"connection" manifest MUST validate. Errors: ${JSON.stringify(validate.errors)}`,
+      req('openwop.it.connection-pack-manifest-valid.positive-the-connection-pack-github-fixture-validates-cleanly', 'connection-packs.md', `connection-packs.md §Manifest clause 1: a well-formed kind:"connection" manifest MUST validate. Errors: ${JSON.stringify(validate.errors)}`),
     ).toBe(true);
   });
 
@@ -78,10 +79,10 @@ describe('category: connection-pack manifest validation (RFC 0095 §A)', () => {
       properties?: Record<string, { properties?: Record<string, unknown>; required?: string[] }>;
     };
     const connections = caps.properties?.connections;
-    expect(connections, 'capabilities.md §connections — the connections block MUST be declared').toBeDefined();
+    expect(connections, req('openwop.it.connection-pack-manifest-valid.capabilities-schema-json-declares-connections-packssupported-rfc-0095-c', 'RFC 0095 §C', 'capabilities.md §connections — the connections block MUST be declared')).toBeDefined();
     expect(
       connections?.properties?.packsSupported,
-      'RFC 0095 §C — connections.packsSupported MUST be declared',
+      req('openwop.it.connection-pack-manifest-valid.capabilities-schema-json-declares-connections-packssupported-rfc-0095-c', 'RFC 0095 §C', 'RFC 0095 §C — connections.packsSupported MUST be declared'),
     ).toBeDefined();
   });
 
@@ -90,7 +91,7 @@ describe('category: connection-pack manifest validation (RFC 0095 §A)', () => {
     const errs = failsWith(m, 'const');
     expect(
       errs.length,
-      'connection-packs.md §Manifest clause 1: kind MUST be the const "connection"',
+      req('openwop.it.connection-pack-manifest-valid.negative-the-kind-discriminator-routes-other-kinds-away-kind-node-rejected', 'connection-packs.md', 'connection-packs.md §Manifest clause 1: kind MUST be the const "connection"'),
     ).toBeGreaterThan(0);
   });
 
@@ -102,7 +103,7 @@ describe('category: connection-pack manifest validation (RFC 0095 §A)', () => {
     const errs = failsWith(m, 'additionalProperties');
     expect(
       errs.some((e) => (e.params as { additionalProperty?: string }).additionalProperty === 'nodes'),
-      'node-packs.md §"Pack kinds": one kind per pack — a foreign `nodes[]` field MUST be rejected (additionalProperties:false)',
+      req('openwop.it.connection-pack-manifest-valid.negative-a-manifest-mixing-provider-and-nodes-is-rejected-pack-kind-invalid-at-t', 'connection-packs.md', 'node-packs.md §"Pack kinds": one kind per pack — a foreign `nodes[]` field MUST be rejected (additionalProperties:false)'),
     ).toBe(true);
   });
 
@@ -112,7 +113,7 @@ describe('category: connection-pack manifest validation (RFC 0095 §A)', () => {
     const errs = failsWith(m, 'pattern');
     expect(
       errs.length,
-      'connection-packs.md §Manifest clause 3: auth endpoints MUST be absolute https:// URLs',
+      req('openwop.it.connection-pack-manifest-valid.negative-a-non-https-token-endpoint-is-rejected-clause-3', 'connection-packs.md', 'connection-packs.md §Manifest clause 3: auth endpoints MUST be absolute https:// URLs'),
     ).toBeGreaterThan(0);
   });
 
@@ -120,7 +121,7 @@ describe('category: connection-pack manifest validation (RFC 0095 §A)', () => {
     const m = { ...fixture(), version: '1.0.0-alpha.1' };
     expect(
       validate(m),
-      `connection-packs.md §Manifest clause 6: prerelease ordering is resolution-time SemVer §11, not manifest shape. Errors: ${JSON.stringify(validate.errors)}`,
+      req('openwop.it.connection-pack-manifest-valid.positive-a-semver-prerelease-version-is-schema-valid-precedence-is-a-host-concer', 'connection-packs.md', `connection-packs.md §Manifest clause 6: prerelease ordering is resolution-time SemVer §11, not manifest shape. Errors: ${JSON.stringify(validate.errors)}`),
     ).toBe(true);
   });
 
@@ -130,16 +131,16 @@ describe('category: connection-pack manifest validation (RFC 0095 §A)', () => {
     m.provider.vendor = 'Google';
     expect(
       validate(m),
-      `connection-packs.md §Manifest clause 16 (RFC 0123): a string provider.vendor MUST validate. Errors: ${JSON.stringify(validate.errors)}`,
+      req('openwop.it.connection-pack-manifest-valid.positive-a-provider-vendor-string-validates-rfc-0123', 'RFC 0123', `connection-packs.md §Manifest clause 16 (RFC 0123): a string provider.vendor MUST validate. Errors: ${JSON.stringify(validate.errors)}`),
     ).toBe(true);
   });
 
   it('positive: a manifest OMITTING provider.vendor still validates (back-compat, RFC 0123)', () => {
     const m = fixture();
-    expect('vendor' in m.provider, 'the base fixture omits vendor').toBe(false);
+    expect('vendor' in m.provider, req('openwop.it.connection-pack-manifest-valid.positive-a-manifest-omitting-provider-vendor-still-validates-back-compat-rfc-012', 'RFC 0123', 'the base fixture omits vendor')).toBe(false);
     expect(
       validate(m),
-      `connection-packs.md §Manifest clause 16 (RFC 0123): vendor is OPTIONAL — a manifest without it MUST remain valid. Errors: ${JSON.stringify(validate.errors)}`,
+      req('openwop.it.connection-pack-manifest-valid.positive-a-manifest-omitting-provider-vendor-still-validates-back-compat-rfc-012', 'RFC 0123', `connection-packs.md §Manifest clause 16 (RFC 0123): vendor is OPTIONAL — a manifest without it MUST remain valid. Errors: ${JSON.stringify(validate.errors)}`),
     ).toBe(true);
   });
 
@@ -149,7 +150,7 @@ describe('category: connection-pack manifest validation (RFC 0095 §A)', () => {
     const errs = failsWith(m, 'type');
     expect(
       errs.some((e) => e.instancePath === '/provider/vendor'),
-      'connection-packs.md §Manifest clause 16 (RFC 0123): provider.vendor MUST be a string — an array MUST be rejected',
+      req('openwop.it.connection-pack-manifest-valid.negative-a-non-string-provider-vendor-is-rejected-rfc-0123', 'RFC 0123', 'connection-packs.md §Manifest clause 16 (RFC 0123): provider.vendor MUST be a string — an array MUST be rejected'),
     ).toBe(true);
   });
 });

package/src/scenarios/connection-pack-no-credential-material.test.ts

@@ -40,6 +40,8 @@ import { SCHEMAS_DIR, FIXTURES_DIR } from '../lib/paths.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const SCHEMA_PATH = join(SCHEMAS_DIR, 'connection-pack-manifest.schema.json');
 const FIXTURE_PATH = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-github.json');
@@ -80,7 +82,7 @@ describe('connection-pack-no-credential-material: schema layer (always-on, serve
       for (const [where, m] of [['root', atRoot], ['provider', atProvider], ['provider.auth', atAuth]] as const) {
         expect(
           validate(m),
-          `SECURITY invariant connection-pack-no-credential-material — a property named "${name}" at ${where} MUST NOT validate (additionalProperties:false)`,
+          req('openwop.it.connection-pack-no-credential-material.every-blocklisted-property-name-is-schema-rejected-at-the-root-provider-and-auth', 'connection-packs.md', `SECURITY invariant connection-pack-no-credential-material — a property named "${name}" at ${where} MUST NOT validate (additionalProperties:false)`),
         ).toBe(false);
       }
     }
@@ -90,11 +92,11 @@ describe('connection-pack-no-credential-material: schema layer (always-on, serve
     const m = fixture();
     expect(
       typeof (m.provider.auth.endpoints as Record<string, string>).token,
-      'fixture sanity — the github fixture declares the token endpoint',
+      req('openwop.it.connection-pack-no-credential-material.the-exemption-provider-auth-endpoints-token-the-token-endpoint-url-is-valid', 'connection-packs.md', 'fixture sanity — the github fixture declares the token endpoint'),
     ).toBe('string');
     expect(
       validate(m),
-      `connection-packs.md §Manifest clause 2 — the property named "token" at exactly provider.auth.endpoints.token is the OAuth token-endpoint URL and MUST validate. Errors: ${JSON.stringify(validate.errors)}`,
+      req('openwop.it.connection-pack-no-credential-material.the-exemption-provider-auth-endpoints-token-the-token-endpoint-url-is-valid', 'connection-packs.md', `connection-packs.md §Manifest clause 2 — the property named "token" at exactly provider.auth.endpoints.token is the OAuth token-endpoint URL and MUST validate. Errors: ${JSON.stringify(validate.errors)}`),
     ).toBe(true);
   });
 });
@@ -107,16 +109,16 @@ describe('connection-pack-no-credential-material: specific rejection code (capab
     const leaky = fixture();
     (leaky.provider.auth as Record<string, unknown>).clientSecret = 'ghs_conformance_canary';
     const res = await driver.post('/v1/host/sample/connection-packs/install', { manifest: leaky });
-    if (res.status === 404 || res.status === 403) return; // seam unwired — soft-skip
+    if (res.status === 404 || res.status === 403) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 403` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
 
     const body = res.json as { installed?: boolean; errors?: Array<{ code?: string }> } | undefined;
     expect(
       body?.installed,
-      driver.describe('connection-packs.md §Manifest clause 2', 'a manifest carrying credential material MUST NOT install'),
+      req('openwop.it.connection-pack-no-credential-material.installing-a-manifest-carrying-clientsecret-is-rejected-with-connection-pack-cre', 'connection-packs.md §Manifest clause 2', 'a manifest carrying credential material MUST NOT install'),
     ).toBe(false);
     expect(
       (body?.errors ?? []).some((e) => e.code === 'connection_pack_credential_material'),
-      driver.describe(
+      req('openwop.it.connection-pack-no-credential-material.installing-a-manifest-carrying-clientsecret-is-rejected-with-connection-pack-cre', 
         'connection-packs.md §Manifest clause 2',
         'the credential-material scan runs BEFORE generic schema validation — the SPECIFIC code connection_pack_credential_material MUST surface, not a generic shape error',
       ),

package/src/scenarios/connection-pack-reach-exclusive.test.ts

@@ -23,6 +23,7 @@ import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import type { ErrorObject } from 'ajv';
 import { SCHEMAS_DIR, FIXTURES_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
 
 const SCHEMA_PATH = join(SCHEMAS_DIR, 'connection-pack-manifest.schema.json');
 const FIXTURE_PATH = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-github.json');
@@ -60,7 +61,7 @@ describe('connection-pack-reach-exclusive (RFC 0095 §B.5)', () => {
     for (const reach of [MCP, OPENAPI, INTEGRATION]) {
       expect(
         validate(withReach(reach)),
-        `connection-packs.md §Manifest clause 5: a single reach mode (${Object.keys(reach)[0]}) MUST validate. Errors: ${JSON.stringify(validate.errors)}`,
+        req('openwop.it.connection-pack-reach-exclusive.positive-each-reach-mode-validates-alone', 'connection-packs.md', `connection-packs.md §Manifest clause 5: a single reach mode (${Object.keys(reach)[0]}) MUST validate. Errors: ${JSON.stringify(validate.errors)}`),
       ).toBe(true);
     }
   });
@@ -69,7 +70,7 @@ describe('connection-pack-reach-exclusive (RFC 0095 §B.5)', () => {
     const errs = failsWith(withReach({ ...MCP, ...OPENAPI }), 'maxProperties');
     expect(
       errs.length,
-      'connection-packs.md §Manifest clause 5: reach MUST specify exactly one of mcp/openapi/integration',
+      req('openwop.it.connection-pack-reach-exclusive.negative-two-reach-modes-are-rejected-maxproperties-1', 'connection-packs.md', 'connection-packs.md §Manifest clause 5: reach MUST specify exactly one of mcp/openapi/integration'),
     ).toBeGreaterThan(0);
   });
 
@@ -77,7 +78,7 @@ describe('connection-pack-reach-exclusive (RFC 0095 §B.5)', () => {
     const errs = failsWith(withReach({}), 'minProperties');
     expect(
       errs.length,
-      'connection-packs.md §Manifest clause 5: reach MUST declare a mode — an empty object is invalid',
+      req('openwop.it.connection-pack-reach-exclusive.negative-an-empty-reach-is-rejected-minproperties-1', 'connection-packs.md', 'connection-packs.md §Manifest clause 5: reach MUST declare a mode — an empty object is invalid'),
     ).toBeGreaterThan(0);
   });
 
@@ -85,7 +86,7 @@ describe('connection-pack-reach-exclusive (RFC 0095 §B.5)', () => {
     const errs = failsWith(withReach({ grpc: { url: 'https://example.com' } }), 'additionalProperties');
     expect(
       errs.some((e) => (e.params as { additionalProperty?: string }).additionalProperty === 'grpc'),
-      'connection-packs.md §Manifest clause 5: the reach vocabulary is closed (mcp | openapi | integration)',
+      req('openwop.it.connection-pack-reach-exclusive.negative-an-unknown-reach-mode-is-rejected-additionalproperties-false', 'connection-packs.md', 'connection-packs.md §Manifest clause 5: the reach vocabulary is closed (mcp | openapi | integration)'),
     ).toBe(true);
   });
 });

package/src/scenarios/connection-pack-write-reconsent.test.ts

@@ -30,6 +30,8 @@ import { FIXTURES_DIR } from '../lib/paths.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const FIXTURE_PATH = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-github.json');
 
@@ -54,13 +56,13 @@ describe('connection-pack-write-reconsent (RFC 0095 §B.4)', () => {
       provider: 'github',
       requested: ['read', 'write'],
     });
-    if (res.status === 404 || res.status === 403) return; // seam unwired — soft-skip
+    if (res.status === 404 || res.status === 403) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 403` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
 
     const plan = res.json as ConsentPlan | undefined;
     const steps = plan?.steps ?? [];
     expect(
       steps.length >= 2,
-      driver.describe(
+      req('openwop.it.connection-pack-write-reconsent.write-scope-groups-are-a-separate-consent-step-never-bundled-into-the-initial-re', 
         'connection-packs.md §Manifest clause 4',
         'requesting read + write scope groups MUST plan write as a SEPARATE consent step (≥ 2 steps)',
       ),
@@ -70,7 +72,7 @@ describe('connection-pack-write-reconsent (RFC 0095 §B.4)', () => {
       first.includesWrite === true || (first.groups ?? []).some((g) => g.access === 'write');
     expect(
       firstHasWrite,
-      driver.describe(
+      req('openwop.it.connection-pack-write-reconsent.write-scope-groups-are-a-separate-consent-step-never-bundled-into-the-initial-re', 
         'connection-packs.md §Manifest clause 4',
         'the INITIAL authorization step MUST NOT bundle write scopes',
       ),
@@ -84,7 +86,7 @@ describe('connection-pack-write-reconsent (RFC 0095 §B.4)', () => {
       const roSteps = (readOnly.json as ConsentPlan | undefined)?.steps ?? [];
       expect(
         roSteps.length,
-        driver.describe('connection-packs.md §Manifest clause 4', 'a read-only request plans a single consent step'),
+        req('openwop.it.connection-pack-write-reconsent.write-scope-groups-are-a-separate-consent-step-never-bundled-into-the-initial-re', 'connection-packs.md §Manifest clause 4', 'a read-only request plans a single consent step'),
       ).toBe(1);
     }
   });

package/src/scenarios/connection-provider-resolution.test.ts

@@ -34,6 +34,8 @@ import { FIXTURES_DIR } from '../lib/paths.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const FIXTURE_PATH = join(FIXTURES_DIR, 'connection-packs', 'connection-pack-github.json');
 
@@ -64,25 +66,25 @@ async function gate(): Promise<boolean> {
 
 describe('connection-provider-resolution (RFC 0095 §B.6/§B.8)', () => {
   it('an installed pack resolves its provider id; an unknown provider is unresolved', async () => {
-    if (!(await gate())) return;
+    if (!(await gate())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await gate())` returned early');
 
     const install = await driver.post('/v1/host/sample/connection-packs/install', { manifest: fixture() });
-    if (install.status === 404 || install.status === 403) return; // seam unwired — soft-skip
+    if (install.status === 404 || install.status === 403) return softSkip('blocked', 'precondition not met — `install.status === 404 || install.status === 403` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
     const installed = install.json as InstallResult | undefined;
     expect(
       installed?.installed,
-      driver.describe('connection-packs.md §Manifest clause 1', 'a well-formed connection pack MUST install'),
+      req('openwop.it.connection-provider-resolution.an-installed-pack-resolves-its-provider-id-an-unknown-provider-is-unresolved', 'connection-packs.md §Manifest clause 1', 'a well-formed connection pack MUST install'),
     ).toBe(true);
 
     const hit = await driver.post('/v1/host/sample/connection-packs/resolve', { provider: 'github' });
     const resolved = hit.json as ResolveResult | undefined;
     expect(
       resolved?.resolved,
-      driver.describe('connection-packs.md §Manifest clause 6', 'provider "github" MUST resolve against the installed pack whose provider.id matches'),
+      req('openwop.it.connection-provider-resolution.an-installed-pack-resolves-its-provider-id-an-unknown-provider-is-unresolved', 'connection-packs.md §Manifest clause 6', 'provider "github" MUST resolve against the installed pack whose provider.id matches'),
     ).toBe(true);
     expect(
       resolved?.source,
-      driver.describe('connection-packs.md §Manifest clause 6', 'the installed pack is the resolution source'),
+      req('openwop.it.connection-provider-resolution.an-installed-pack-resolves-its-provider-id-an-unknown-provider-is-unresolved', 'connection-packs.md §Manifest clause 6', 'the installed pack is the resolution source'),
     ).toBe('pack');
 
     const miss = await driver.post('/v1/host/sample/connection-packs/resolve', {
@@ -91,35 +93,35 @@ describe('connection-provider-resolution (RFC 0095 §B.6/§B.8)', () => {
     const unresolved = miss.json as ResolveResult | undefined;
     expect(
       unresolved?.resolved,
-      driver.describe('connection-packs.md §Manifest clause 6', 'a provider with no installed pack and no built-in MUST NOT resolve'),
+      req('openwop.it.connection-provider-resolution.an-installed-pack-resolves-its-provider-id-an-unknown-provider-is-unresolved', 'connection-packs.md §Manifest clause 6', 'a provider with no installed pack and no built-in MUST NOT resolve'),
     ).toBe(false);
     expect(
       unresolved?.code,
-      driver.describe('connection-packs.md §Manifest clause 6', 'the refusal code MUST be connection_provider_unresolved'),
+      req('openwop.it.connection-provider-resolution.an-installed-pack-resolves-its-provider-id-an-unknown-provider-is-unresolved', 'connection-packs.md §Manifest clause 6', 'the refusal code MUST be connection_provider_unresolved'),
     ).toBe('connection_provider_unresolved');
   });
 
   it('an installed prerelease does not outrank a built-in release — conflict surfaces (SemVer §11)', async () => {
-    if (!(await gate())) return;
+    if (!(await gate())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await gate())` returned early');
 
     const prerelease = { ...fixture(), version: '1.0.0-alpha.1' };
     prerelease.provider = { ...prerelease.provider, id: 'conformance-prerelease-probe' };
     const install = await driver.post('/v1/host/sample/connection-packs/install', { manifest: prerelease });
-    if (install.status === 404 || install.status === 403) return; // seam unwired — soft-skip
+    if (install.status === 404 || install.status === 403) return softSkip('blocked', 'precondition not met — `install.status === 404 || install.status === 403` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
     expect(
       (install.json as InstallResult | undefined)?.installed,
-      driver.describe('connection-packs.md §Manifest clause 1', 'a prerelease-versioned pack is shape-valid and MUST install'),
+      req('openwop.it.connection-provider-resolution.an-installed-prerelease-does-not-outrank-a-built-in-release-conflict-surfaces-se', 'connection-packs.md §Manifest clause 1', 'a prerelease-versioned pack is shape-valid and MUST install'),
     ).toBe(true);
 
     const res = await driver.post('/v1/host/sample/connection-packs/resolve', {
       provider: 'conformance-prerelease-probe',
       simulateBuiltinVersion: '1.0.0',
     });
-    if (res.status === 404 || res.status === 403) return; // simulate knob unwired — soft-skip
+    if (res.status === 404 || res.status === 403) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 403` returned early (simulate knob unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // simulate knob unwired — soft-skip
     const body = res.json as ResolveResult | undefined;
     expect(
       body?.code,
-      driver.describe(
+      req('openwop.it.connection-provider-resolution.an-installed-prerelease-does-not-outrank-a-built-in-release-conflict-surfaces-se', 
         'connection-packs.md §Manifest clause 6',
         'SemVer §11: 1.0.0-alpha.1 < 1.0.0 — the installed pack is NOT greater-or-equal, so the host MUST surface connection_provider_conflict rather than silently choosing',
       ),
@@ -127,16 +129,16 @@ describe('connection-provider-resolution (RFC 0095 §B.6/§B.8)', () => {
   });
 
   it('rejection isolation: one rejected pack never takes down the install path (§B.8)', async () => {
-    if (!(await gate())) return;
+    if (!(await gate())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await gate())` returned early');
 
     const leaky = fixture();
     leaky.provider = { ...leaky.provider, id: 'conformance-isolation-probe' };
     (leaky.provider.auth as Record<string, unknown>).clientSecret = 'ghs_conformance_canary';
     const bad = await driver.post('/v1/host/sample/connection-packs/install', { manifest: leaky });
-    if (bad.status === 404 || bad.status === 403) return; // seam unwired — soft-skip
+    if (bad.status === 404 || bad.status === 403) return softSkip('blocked', 'precondition not met — `bad.status === 404 || bad.status === 403` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
     expect(
       (bad.json as InstallResult | undefined)?.installed,
-      driver.describe('connection-packs.md §Manifest clause 2', 'the credential-carrying manifest MUST NOT install'),
+      req('openwop.it.connection-provider-resolution.rejection-isolation-one-rejected-pack-never-takes-down-the-install-path-b-8', 'connection-packs.md §Manifest clause 2', 'the credential-carrying manifest MUST NOT install'),
     ).toBe(false);
 
     const good = { ...fixture() };
@@ -144,7 +146,7 @@ describe('connection-provider-resolution (RFC 0095 §B.6/§B.8)', () => {
     const after = await driver.post('/v1/host/sample/connection-packs/install', { manifest: good });
     expect(
       (after.json as InstallResult | undefined)?.installed,
-      driver.describe(
+      req('openwop.it.connection-provider-resolution.rejection-isolation-one-rejected-pack-never-takes-down-the-install-path-b-8', 
         'connection-packs.md §Manifest clause 8',
         'a rejected pack means NOT INSTALLED — nothing more; a subsequent valid install MUST succeed',
       ),

package/src/scenarios/connector-manifest-validity.test.ts

@@ -27,6 +27,7 @@ import { join } from 'node:path';
 import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { SCHEMAS_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface SchemaDefs {
   $defs: Record<string, unknown>;
@@ -82,7 +83,7 @@ describe('category: connector-manifest validity — schema shape (RFC 0045 §A)'
       ],
       triggers: ['vendor.acme.salesforce.onRecordChange'],
     });
-    expect(ok, JSON.stringify(validate.errors)).toBe(true);
+    expect(ok, req('openwop.it.connector-manifest-validity.positive-a-well-formed-connector-block-oauth2-auth-validates', 'RFC 0045 §A/§B', JSON.stringify(validate.errors))).toBe(true);
   });
 
   it('positive: credential-auth variant validates', () => {
@@ -92,11 +93,11 @@ describe('category: connector-manifest validity — schema shape (RFC 0045 §A)'
       auth: { type: 'credential', key: 'stripe-secret-key', scope: 'workspace' },
       actions: [{ typeId: 'vendor.acme.stripe.charge', displayName: 'Charge' }],
     });
-    expect(ok, JSON.stringify(validate.errors)).toBe(true);
+    expect(ok, req('openwop.it.connector-manifest-validity.positive-credential-auth-variant-validates', 'RFC 0045 §A/§B', JSON.stringify(validate.errors))).toBe(true);
   });
 
   it('negative: connector missing displayName is rejected', () => {
-    expect(validate({ id: 'salesforce' })).toBe(false);
+    expect(validate({ id: 'salesforce' }), req('openwop.it.connector-manifest-validity.negative-connector-missing-displayname-is-rejected', 'RFC 0045 §A/§B', 'negative: connector missing displayName is rejected')).toBe(false);
   });
 
   it('negative: an action missing typeId is rejected', () => {
@@ -105,7 +106,7 @@ describe('category: connector-manifest validity — schema shape (RFC 0045 §A)'
       displayName: 'Salesforce',
       actions: [{ displayName: 'Upsert' }],
     });
-    expect(ok).toBe(false);
+    expect(ok, req('openwop.it.connector-manifest-validity.negative-an-action-missing-typeid-is-rejected', 'RFC 0045 §A/§B', 'negative: an action missing typeId is rejected')).toBe(false);
   });
 
   it('negative: an unknown ConnectorAuth type is rejected', () => {
@@ -114,7 +115,7 @@ describe('category: connector-manifest validity — schema shape (RFC 0045 §A)'
       displayName: 'Salesforce',
       auth: { type: 'basic', user: 'x' },
     });
-    expect(ok).toBe(false);
+    expect(ok, req('openwop.it.connector-manifest-validity.negative-an-unknown-connectorauth-type-is-rejected', 'RFC 0045 §A/§B', 'negative: an unknown ConnectorAuth type is rejected')).toBe(false);
   });
 });
 
@@ -130,13 +131,13 @@ describe('category: connector-manifest validity — action resolution (RFC 0045
       actions: [{ typeId: 'vendor.acme.salesforce.upsert' }, { typeId: 'vendor.acme.salesforce.query' }],
       triggers: ['vendor.acme.salesforce.onRecordChange'],
     });
-    expect(unresolved, 'every connector.actions[].typeId + triggers[] MUST resolve to a nodes[].typeId').toEqual([]);
+    expect(unresolved, req('openwop.it.connector-manifest-validity.all-action-trigger-typeids-resolve-to-nodes-in-the-same-manifest', 'RFC 0045 §A/§B', 'every connector.actions[].typeId + triggers[] MUST resolve to a nodes[].typeId')).toEqual([]);
   });
 
   it('an action typeId not in nodes[] is flagged (connector_action_unresolved)', () => {
     const unresolved = unresolvedReferences(nodeTypeIds, {
       actions: [{ typeId: 'vendor.acme.salesforce.does-not-exist' }],
     });
-    expect(unresolved).toContain('vendor.acme.salesforce.does-not-exist');
+    expect(unresolved, req('openwop.it.connector-manifest-validity.an-action-typeid-not-in-nodes-is-flagged-connector-action-unresolved', 'RFC 0045 §A/§B', 'an action typeId not in nodes[] is flagged (connector_action_unresolved)')).toContain('vendor.acme.salesforce.does-not-exist');
   });
 });