@openwop/openwop-conformance 1.162.0 → 2.0.0-rc.0

package/src/scenarios/owner-subject-echo.test.ts

@@ -19,6 +19,7 @@ import { driver } from '../lib/driver.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { pollUntil } from '../lib/polling.js';
+import { req } from '../lib/requirement-ids.js';
 
 const NOOP_WORKFLOW_ID = 'conformance-noop';
 const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);
@@ -88,19 +89,19 @@ describe.skipIf(SKIP_NO_NOOP)('owner-subject-echo: consistency, echo, fork (RFC
     if (subject === undefined) {
       return softSkip('inapplicable', 'host does not emit owner.subject on new runs (RFC 0165 §B — optional in v1.x)');
     }
-    expect(subject.tenant, driver.describe('RFC 0165 §B.2', 'subject.tenant MUST equal owner.tenant')).toBe(snap.owner?.tenant);
+    expect(subject.tenant, req('openwop.it.owner-subject-echo.subject-is-consistent-with-the-owner-triple-b-2-and-the-actor-chain-is-bounded-b', 'RFC 0165 §B.2', 'subject.tenant MUST equal owner.tenant')).toBe(snap.owner?.tenant);
     if (snap.owner?.principal !== undefined) {
-      expect(subject.subjectId, driver.describe('RFC 0165 §B.2', 'subject.subjectId MUST equal owner.principal when both are present')).toBe(snap.owner.principal);
+      expect(subject.subjectId, req('openwop.it.owner-subject-echo.subject-is-consistent-with-the-owner-triple-b-2-and-the-actor-chain-is-bounded-b', 'RFC 0165 §B.2', 'subject.subjectId MUST equal owner.principal when both are present')).toBe(snap.owner.principal);
     }
     if (snap.owner?.principalKind !== undefined) {
-      expect(subject.kind, driver.describe('RFC 0165 §B.2', 'subject.kind MUST equal owner.principalKind when both are present')).toBe(snap.owner.principalKind);
+      expect(subject.kind, req('openwop.it.owner-subject-echo.subject-is-consistent-with-the-owner-triple-b-2-and-the-actor-chain-is-bounded-b', 'RFC 0165 §B.2', 'subject.kind MUST equal owner.principalKind when both are present')).toBe(snap.owner.principalKind);
     }
     if (subject.lane === 'saml' || subject.lane === 'scim') {
-      expect(subject.keyClass, driver.describe('RFC 0165 §B.2', 'keyClass MUST be present on a linkable lane')).toBeDefined();
+      expect(subject.keyClass, req('openwop.it.owner-subject-echo.subject-is-consistent-with-the-owner-triple-b-2-and-the-actor-chain-is-bounded-b', 'RFC 0165 §B.2', 'keyClass MUST be present on a linkable lane')).toBeDefined();
     } else {
-      expect(subject.keyClass, driver.describe('RFC 0165 §B.2', 'keyClass MUST be absent off the linkable lanes')).toBeUndefined();
+      expect(subject.keyClass, req('openwop.it.owner-subject-echo.subject-is-consistent-with-the-owner-triple-b-2-and-the-actor-chain-is-bounded-b', 'RFC 0165 §B.2', 'keyClass MUST be absent off the linkable lanes')).toBeUndefined();
     }
-    expect(actorDepth(subject), driver.describe('RFC 0165 §B.5', 'actor chain depth MUST NOT exceed 4')).toBeLessThanOrEqual(4);
+    expect(actorDepth(subject), req('openwop.it.owner-subject-echo.subject-is-consistent-with-the-owner-triple-b-2-and-the-actor-chain-is-bounded-b', 'RFC 0165 §B.5', 'actor chain depth MUST NOT exceed 4')).toBeLessThanOrEqual(4);
   });
 
   it('run.started echoes the snapshot subject verbatim (§B.2, RFC 0048 §C)', async () => {
@@ -116,8 +117,8 @@ describe.skipIf(SKIP_NO_NOOP)('owner-subject-echo: consistency, echo, fork (RFC
     // leave `pending` first, then the event is a fact, not a timing.
     await pollUntil(runId, (s) => s.status !== 'pending', { label: 'run left pending (run.started appended)' });
     const started = (await events(runId)).find((e) => e.type === 'run.started');
-    expect(started, driver.describe('RFC 0048 §C', 'run.started MUST be present in the event log')).toBeDefined();
-    expect(started?.payload?.owner?.subject, driver.describe('RFC 0165 §B.2', 'run.started owner.subject MUST equal RunSnapshot.owner.subject')).toEqual(snap.owner.subject);
+    expect(started, req('openwop.it.owner-subject-echo.run-started-echoes-the-snapshot-subject-verbatim-b-2-rfc-0048-c', 'RFC 0048 §C', 'run.started MUST be present in the event log')).toBeDefined();
+    expect(started?.payload?.owner?.subject, req('openwop.it.owner-subject-echo.run-started-echoes-the-snapshot-subject-verbatim-b-2-rfc-0048-c', 'RFC 0165 §B.2', 'run.started owner.subject MUST equal RunSnapshot.owner.subject')).toEqual(snap.owner.subject);
   });
 
   it('a fork copies owner.tenant and owner.subject verbatim onto the child (§B.4)', async () => {
@@ -130,11 +131,11 @@ describe.skipIf(SKIP_NO_NOOP)('owner-subject-echo: consistency, echo, fork (RFC
     if (fork.status === 404 || fork.status === 501 || fork.status === 403) {
       return softSkip('inapplicable', `host does not offer :fork on this run (${fork.status}); the fork-copy rule has no fork to check`);
     }
-    expect(fork.status, driver.describe('replay.md §"Fork ownership"', ':fork MUST return 201 for a completed noop run')).toBe(201);
+    expect(fork.status, req('openwop.it.owner-subject-echo.a-fork-copies-owner-tenant-and-owner-subject-verbatim-onto-the-child-b-4', 'replay.md §"Fork ownership"', ':fork MUST return 201 for a completed noop run')).toBe(201);
     const childId = (fork.json as { runId?: string }).runId;
-    expect(typeof childId, 'fork response MUST include the child runId').toBe('string');
+    expect(typeof childId, req('openwop.it.owner-subject-echo.a-fork-copies-owner-tenant-and-owner-subject-verbatim-onto-the-child-b-4', 'replay.md §"Fork ownership"', 'fork response MUST include the child runId')).toBe('string');
     const child = await snapshot(childId as string);
-    expect(child.owner?.tenant, driver.describe('RFC 0165 §B.4', 'the child owner.tenant MUST equal the source')).toBe(source.owner.tenant);
-    expect(child.owner?.subject, driver.describe('RFC 0165 §B.4', 'the child owner.subject MUST be copied verbatim from the source')).toEqual(source.owner.subject);
+    expect(child.owner?.tenant, req('openwop.it.owner-subject-echo.a-fork-copies-owner-tenant-and-owner-subject-verbatim-onto-the-child-b-4', 'RFC 0165 §B.4', 'the child owner.tenant MUST equal the source')).toBe(source.owner.tenant);
+    expect(child.owner?.subject, req('openwop.it.owner-subject-echo.a-fork-copies-owner-tenant-and-owner-subject-verbatim-onto-the-child-b-4', 'RFC 0165 §B.4', 'the child owner.subject MUST be copied verbatim from the source')).toEqual(source.owner.subject);
   });
 });

package/src/scenarios/owner-subject-shape.test.ts

@@ -23,6 +23,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import Ajv2020 from 'ajv/dist/2020.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
 
 const read = (f: string): Record<string, unknown> => JSON.parse(readFileSync(join(SCHEMAS_DIR, f), 'utf8')) as Record<string, unknown>;
 const subject = read('subject.schema.json');
@@ -41,28 +42,28 @@ describe('owner-subject-shape: subject.schema.json (RFC 0165 §B.1)', () => {
   const validate = ajvWithSubject().compile(subject);
 
   it('compiles and accepts a full SAML subject', () => {
-    expect(validate(VALID), JSON.stringify(validate.errors)).toBe(true);
+    expect(validate(VALID), req('openwop.it.owner-subject-shape.compiles-and-accepts-a-full-saml-subject', 'RFC 0165 §B.1–§B.2', JSON.stringify(validate.errors))).toBe(true);
   });
 
   it('accepts the legacy issuer form (RFC 0165 §B.3) and a workload subject', () => {
-    expect(validate({ issuer: 'urn:openwop:legacy', subjectId: 'user_42', tenant: 'acme', lane: 'api-key', kind: 'user' }), JSON.stringify(validate.errors)).toBe(true);
+    expect(validate({ issuer: 'urn:openwop:legacy', subjectId: 'user_42', tenant: 'acme', lane: 'api-key', kind: 'user' }), req('openwop.it.owner-subject-shape.accepts-the-legacy-issuer-form-rfc-0165-b-3-and-a-workload-subject', 'RFC 0165 §B.3', JSON.stringify(validate.errors))).toBe(true);
     expect(validate({ issuer: 'spiffe://trust.example', subjectId: 'spiffe://trust.example/ns/a/sa/b', tenant: 'acme', lane: 'workload', kind: 'workload' }), JSON.stringify(validate.errors)).toBe(true);
   });
 
   it('rejects an email-shaped or whitespace subjectId (invariant subject-record-opaque)', () => {
-    expect(validate({ ...VALID, subjectId: 'alice@example.com' }), 'RFC 0165 §B.2: subjectId MUST NOT be an email address').toBe(false);
-    expect(validate({ ...VALID, subjectId: 'Alice Example' }), 'RFC 0165 §B.2: subjectId MUST NOT contain whitespace (a display name)').toBe(false);
+    expect(validate({ ...VALID, subjectId: 'alice@example.com' }), req('openwop.it.owner-subject-shape.rejects-an-email-shaped-or-whitespace-subjectid-invariant-subject-record-opaque', 'RFC 0165 §B.1–§B.2', 'RFC 0165 §B.2: subjectId MUST NOT be an email address')).toBe(false);
+    expect(validate({ ...VALID, subjectId: 'Alice Example' }), req('openwop.it.owner-subject-shape.rejects-an-email-shaped-or-whitespace-subjectid-invariant-subject-record-opaque', 'RFC 0165 §B.1–§B.2', 'RFC 0165 §B.2: subjectId MUST NOT contain whitespace (a display name)')).toBe(false);
   });
 
   it('requires keyClass on the saml/scim lanes and forbids it elsewhere', () => {
     const { keyClass: _k, ...noKey } = VALID;
-    expect(validate(noKey), 'RFC 0165 §B.2: keyClass MUST be present when lane is saml or scim').toBe(false);
-    expect(validate({ ...VALID, lane: 'oidc' }), 'RFC 0165 §B.2: keyClass MUST be absent when the lane is not linkable').toBe(false);
+    expect(validate(noKey), req('openwop.it.owner-subject-shape.requires-keyclass-on-the-saml-scim-lanes-and-forbids-it-elsewhere', 'RFC 0165 §B.1–§B.2', 'RFC 0165 §B.2: keyClass MUST be present when lane is saml or scim')).toBe(false);
+    expect(validate({ ...VALID, lane: 'oidc' }), req('openwop.it.owner-subject-shape.requires-keyclass-on-the-saml-scim-lanes-and-forbids-it-elsewhere', 'RFC 0165 §B.1–§B.2', 'RFC 0165 §B.2: keyClass MUST be absent when the lane is not linkable')).toBe(false);
     expect(validate({ ...noKey, lane: 'oidc' }), JSON.stringify(validate.errors)).toBe(true);
   });
 
   it('rejects an unknown member and a missing required member', () => {
-    expect(validate({ ...VALID, email: 'x' })).toBe(false);
+    expect(validate({ ...VALID, email: 'x' }), req('openwop.it.owner-subject-shape.rejects-an-unknown-member-and-a-missing-required-member', 'RFC 0165 §B.1–§B.2', 'rejects an unknown member and a missing required member')).toBe(false);
     const { tenant: _t, ...noTenant } = VALID;
     expect(validate(noTenant)).toBe(false);
   });
@@ -70,7 +71,7 @@ describe('owner-subject-shape: subject.schema.json (RFC 0165 §B.1)', () => {
   it('accepts a nested actor chain (depth is a host obligation, RFC 0165 §B.5)', () => {
     const peer = { issuer: 'https://peer.example', subjectId: 'peer-1', tenant: 'acme', lane: 'workload', kind: 'workload' };
     const { keyClass: _k, ...anon } = { ...VALID, kind: 'anonymous', lane: 'api-key', actor: peer };
-    expect(validate(anon), JSON.stringify(validate.errors)).toBe(true);
+    expect(validate(anon), req('openwop.it.owner-subject-shape.accepts-a-nested-actor-chain-depth-is-a-host-obligation-rfc-0165-b-5', 'RFC 0165 §B.5', JSON.stringify(validate.errors))).toBe(true);
   });
 });
 
@@ -82,14 +83,14 @@ describe('owner-subject-shape: both owner sub-objects declare `subject` (RFC 016
   it('RunSnapshot.owner accepts a subject and still rejects an undeclared member', () => {
     const v = ajvWithSubject().compile(ownerSnap);
     expect(v({ tenant: 'acme', principal: 'idp-op-8f3a', principalKind: 'user', subject: VALID }), JSON.stringify(v.errors)).toBe(true);
-    expect(v({ tenant: 'acme', role: 'admin' })).toBe(false);
+    expect(v({ tenant: 'acme', role: 'admin' }), req('openwop.it.owner-subject-shape.runsnapshot-owner-accepts-a-subject-and-still-rejects-an-undeclared-member', 'RFC 0165 §B.1–§B.2', 'RunSnapshot.owner accepts a subject and still rejects an undeclared member')).toBe(false);
   });
 
   it('run.started owner echo accepts the same subject AND principalKind (the echo matches the snapshot)', () => {
     const v = ajvWithSubject().compile(ownerEcho);
     expect(
       v({ tenant: 'acme', principal: 'idp-op-8f3a', principalKind: 'user', subject: VALID }),
-      'RFC 0165 §B.1: run.started owner MUST declare subject and principalKind so a host can echo its snapshot owner verbatim',
+      req('openwop.it.owner-subject-shape.run-started-owner-echo-accepts-the-same-subject-and-principalkind-the-echo-match', 'RFC 0165 §B.1–§B.2', 'RFC 0165 §B.1: run.started owner MUST declare subject and principalKind so a host can echo its snapshot owner verbatim'),
     ).toBe(true);
     expect(v({ tenant: 'acme', subject: { ...VALID, subjectId: 'a@b' } })).toBe(false);
   });

package/src/scenarios/pack-manifest-extension-opacity.test.ts

@@ -60,7 +60,6 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { driver } from '../lib/driver.js';
 import { behaviorGate, behaviorGatePresent } from '../lib/behavior-gate.js';
 import {
   readArtifactTypesCap,
@@ -71,6 +70,7 @@ import {
   withExtensions,
   canonicalJson,
 } from '../lib/artifactTypes.js';
+import { req } from '../lib/requirement-ids.js';
 
 const PROFILE = 'openwop-artifact-type-packs';
 
@@ -102,7 +102,7 @@ describe('pack-manifest-extension-opacity: a host MUST accept an extended manife
     if (!behaviorGatePresent(PROFILE, res)) return; // seam absent: skip default, FAIL strict
     expect(
       ok(res.status),
-      driver.describe('node-packs.md §"Vendor extensions on pack manifests"', 'a consumer MUST ignore an unrecognized extension and MUST NOT reject the pack for its presence'),
+      req('openwop.it.pack-manifest-extension-opacity.leg-1-an-extension-bearing-manifest-installs', 'node-packs.md §"Vendor extensions on pack manifests"', 'a consumer MUST ignore an unrecognized extension and MUST NOT reject the pack for its presence'),
     ).toBe(true);
   });
 
@@ -113,7 +113,7 @@ describe('pack-manifest-extension-opacity: a host MUST accept an extended manife
     if (!behaviorGatePresent(PROFILE, res)) return;
     expect(
       ok(res.status),
-      driver.describe('RFC 0139 §Conformance', 'baseline — guards against a differential that passes because EVERYTHING fails'),
+      req('openwop.it.pack-manifest-extension-opacity.leg-2-the-same-manifest-without-the-extension-installs-baseline', 'RFC 0139 §Conformance', 'baseline — guards against a differential that passes because EVERYTHING fails'),
     ).toBe(true);
   });
 });
@@ -130,12 +130,12 @@ describe('pack-manifest-extension-opacity: the differential — behavior MUST NO
 
     expect(
       ok(plain.status) === ok(extended.status),
-      driver.describe('RFC 0139 §"The differential-install contract"', 'acceptance MUST NOT be a function of an unrecognized extension — a host MUST accept both or reject both for the same reason'),
+      req('openwop.it.pack-manifest-extension-opacity.leg-3-projections-for-m-and-m-are-equal-modulo-the-extensions-load-bearing', 'RFC 0139 §"The differential-install contract"', 'acceptance MUST NOT be a function of an unrecognized extension — a host MUST accept both or reject both for the same reason'),
     ).toBe(true);
 
     expect(
       canonicalJson(stripExtensions(extended.json)),
-      driver.describe('RFC 0139 §"The differential-install contract"', 'the registration projection MUST be identical modulo the extension properties — a difference means the host acted on an extension it does not recognize (rendering catalog, derived facet, or code-path switch)'),
+      req('openwop.it.pack-manifest-extension-opacity.leg-3-projections-for-m-and-m-are-equal-modulo-the-extensions-load-bearing', 'RFC 0139 §"The differential-install contract"', 'the registration projection MUST be identical modulo the extension properties — a difference means the host acted on an extension it does not recognize (rendering catalog, derived facet, or code-path switch)'),
     ).toBe(canonicalJson(stripExtensions(plain.json)));
   });
 
@@ -150,12 +150,12 @@ describe('pack-manifest-extension-opacity: the differential — behavior MUST NO
 
     expect(
       ok(hostile.status),
-      driver.describe('node-packs.md §"Vendor extensions on pack manifests"', 'an extension value is PACK-AUTHORED and therefore untrusted, but untrusted is not a rejection reason — the host MUST install and ignore'),
+      req('openwop.it.pack-manifest-extension-opacity.leg-4-an-extension-carrying-markup-a-templating-directive-is-not-interpreted-at', 'node-packs.md §"Vendor extensions on pack manifests"', 'an extension value is PACK-AUTHORED and therefore untrusted, but untrusted is not a rejection reason — the host MUST install and ignore'),
     ).toBe(true);
 
     expect(
       canonicalJson(stripExtensions(hostile.json)),
-      driver.describe('node-packs.md §"Vendor extensions on pack manifests"', 'MUST NOT render it, execute it, or interpret it as markup or a templating directive — a projection that differs from baseline means the value reached an interpreter'),
+      req('openwop.it.pack-manifest-extension-opacity.leg-4-an-extension-carrying-markup-a-templating-directive-is-not-interpreted-at', 'node-packs.md §"Vendor extensions on pack manifests"', 'MUST NOT render it, execute it, or interpret it as markup or a templating directive — a projection that differs from baseline means the value reached an interpreter'),
     ).toBe(canonicalJson(stripExtensions(plain.json)));
   });
 });
@@ -173,7 +173,7 @@ describe('pack-manifest-extension-opacity: the HOST reader stays narrow (RFC 013
     if (!behaviorGatePresent(PROFILE, res)) return;
     expect(
       ok(res.status),
-      driver.describe('node-packs.md §"Vendor extensions on pack manifests"', 'the hatch admits DECLARED extensions, not arbitrary keys — a host that widened its own reader to additionalProperties:true to "support extensions" accepts everything, which is not the same as accepting extensions'),
+      req('openwop.it.pack-manifest-extension-opacity.leg-5-a-misspelled-canonical-field-is-still-rejected-by-the-host-not-merely-by-t', 'node-packs.md §"Vendor extensions on pack manifests"', 'the hatch admits DECLARED extensions, not arbitrary keys — a host that widened its own reader to additionalProperties:true to "support extensions" accepts everything, which is not the same as accepting extensions'),
     ).toBe(false);
   });
 });

package/src/scenarios/pack-registry-isolation.test.ts

@@ -23,6 +23,7 @@ import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -88,12 +89,12 @@ describe('pack-registry-isolation: test catalog MUST NOT bleed into production (
       const stringified = body ? JSON.stringify(body) : '';
       expect(
         stringified.includes(name),
-        driver.describe(
+        req('openwop.it.pack-registry-isolation.a-pack-put-to-v1-packs-test-name-must-not-appear-in-get-v1-packs-name', 
           'RFCS/0025-test-mode-registry-namespace.md §C point 1',
           `pack name '${name}' was written via /v1/packs-test/${name}@${version} but appeared in /v1/packs/${name} response body — test-catalog isolation MUST hold`,
         ),
       ).toBe(false);
-      return;
+      return softSkip('blocked', 'precondition not met — `prodRes.status === 200` returned early (404 is the canonical "not found" — exactly what isolation requires. 200 with a payload that does NOT name our pack would mean the host returned a listing…');
     }
 
     // Acceptable: 4xx range (404 pack_not_found is the spec-canonical
@@ -101,7 +102,7 @@ describe('pack-registry-isolation: test catalog MUST NOT bleed into production (
     // signal satisfies the invariant).
     expect(
       prodRes.status >= 400 && prodRes.status < 500,
-      driver.describe(
+      req('openwop.it.pack-registry-isolation.a-pack-put-to-v1-packs-test-name-must-not-appear-in-get-v1-packs-name', 
         'RFCS/0025-test-mode-registry-namespace.md §C point 1',
         `expected production-namespace GET to return 4xx for a test-namespace-only pack '${name}', got ${prodRes.status}`,
       ),

package/src/scenarios/pack-registry-publish.test.ts

@@ -26,6 +26,8 @@ import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { recordRequirement } from '../lib/requirement-ledger.js';
 import { requirementIdForScenario } from '../lib/requirement-registry.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -145,48 +147,48 @@ function errorCode(body: unknown): string | undefined {
 
 describe('pack-registry-publish: URL / scope error catalog (RFC 0025)', () => {
   it('PUT with non-spec scope MUST return 400 invalid_pack_scope', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     const res = await putTest('bogus.unsupported-scope.pack', '1.0.0', Buffer.from([]));
-    if (res.status === 404) return; // seam not exposed
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam not exposed) (seam, prior step, or fixture unavailable)'); // seam not exposed
     expect(res.status).toBeGreaterThanOrEqual(400);
     expect(res.status).toBeLessThan(500);
     expect(
       errorCode(res.json),
-      driver.describe('node-packs.md §"PUT /v1/packs/{name}/-/{version}.tgz"', 'non-spec scope MUST return invalid_pack_scope'),
+      req('openwop.it.pack-registry-publish.put-with-non-spec-scope-must-return-400-invalid-pack-scope', 'node-packs.md §"PUT /v1/packs/{name}/-/{version}.tgz"', 'non-spec scope MUST return invalid_pack_scope'),
     ).toBe('invalid_pack_scope');
   });
 
   it('PUT with a single-segment URL pack name MUST return 400 invalid_pack_name', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     const res = await putTest('singleseg', '1.0.0', Buffer.from([]));
-    if (res.status === 404) return;
-    expect(res.status).toBe(400);
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam, prior step, or fixture unavailable)');
+    expect(res.status, req('openwop.it.pack-registry-publish.put-with-a-single-segment-url-pack-name-must-return-400-invalid-pack-name', 'node-packs.md', 'PUT with a single-segment URL pack name MUST return 400 invalid_pack_name')).toBe(400);
     expect(errorCode(res.json)).toBe('invalid_pack_name');
   });
 
   it('PUT with a non-semver URL version MUST return 400 invalid_version', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     const res = await putTest(freshPackName(), 'not-a-semver', Buffer.from([]));
-    if (res.status === 404) return;
-    expect(res.status).toBe(400);
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam, prior step, or fixture unavailable)');
+    expect(res.status, req('openwop.it.pack-registry-publish.put-with-a-non-semver-url-version-must-return-400-invalid-version', 'node-packs.md', 'PUT with a non-semver URL version MUST return 400 invalid_version')).toBe(400);
     expect(errorCode(res.json)).toBe('invalid_version');
   });
 });
 
 describe('pack-registry-publish: body-shape error catalog (RFC 0025)', () => {
   it('PUT with a JSON body (instead of tarball bytes) MUST return 400 invalid_body', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     const res = await driver.put(`/v1/packs-test/${encodeURIComponent(freshPackName())}/-/1.0.0.tgz`, JSON.stringify({}), { headers: { 'Content-Type': 'application/json' } });
-    if (res.status === 404) return;
-    expect(res.status).toBe(400);
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam, prior step, or fixture unavailable)');
+    expect(res.status, req('openwop.it.pack-registry-publish.put-with-a-json-body-instead-of-tarball-bytes-must-return-400-invalid-body', 'node-packs.md', 'PUT with a JSON body (instead of tarball bytes) MUST return 400 invalid_body')).toBe(400);
     expect(errorCode(res.json)).toBe('invalid_body');
   });
 
   it('PUT with an empty body MUST return 400 invalid_body', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     const res = await putTest(freshPackName(), '1.0.0', Buffer.from([]));
-    if (res.status === 404) return;
-    expect(res.status).toBe(400);
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam, prior step, or fixture unavailable)');
+    expect(res.status, req('openwop.it.pack-registry-publish.put-with-an-empty-body-must-return-400-invalid-body', 'node-packs.md', 'PUT with an empty body MUST return 400 invalid_body')).toBe(400);
     expect(errorCode(res.json)).toBe('invalid_body');
   });
 });
@@ -196,15 +198,15 @@ describe('pack-registry-publish: tarball extraction error catalog (RFC 0025)', (
   // For shape-only assertions, we don't need real gzip; the host's
   // gunzip step fails first, surfacing tarball_gunzip_failed.
   it('PUT with a body that isn\'t a valid gzip stream MUST return 400 tarball_gunzip_failed', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     const res = await putTest(freshPackName(), '1.0.0', Buffer.from('not a gzip stream'));
-    if (res.status === 404) return;
-    expect(res.status).toBe(400);
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam, prior step, or fixture unavailable)');
+    expect(res.status, req('openwop.it.pack-registry-publish.put-with-a-body-that-isn-t-a-valid-gzip-stream-must-return-400-tarball-gunzip-fa', 'node-packs.md', 'PUT with a body that isn\'t a valid gzip stream MUST return 400 tarball_gunzip_failed')).toBe(400);
     expect(errorCode(res.json)).toBe('tarball_gunzip_failed');
   });
 
   it('PUT with decompressed bytes exceeding the registry\'s cap MUST return 400 tarball_too_large', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     // S45 (2026-08-18): the cap is on DECOMPRESSED bytes (node-packs.md
     // §"Tarball extraction", recommended default 50 MB), so the probe is a
     // small VALID gzip stream that inflates past it — 64 MiB of zeros gzips
@@ -219,142 +221,142 @@ describe('pack-registry-publish: tarball extraction error catalog (RFC 0025)', (
     // tar layer means the cap is absent or above 64 MiB (> the recommended
     // default) — say so in the run record if that is a deliberate host choice.
     const res = await putTest(freshPackName(), '1.0.0', OVERSIZED_GZIP);
-    if (res.status === 404) return;
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam, prior step, or fixture unavailable)');
     expect(
       res.status,
-      driver.describe('node-packs.md §"Tarball extraction"', 'a valid gzip inflating past the decompressed cap MUST be refused with 400 (a 413 here means a proxy refused the wire body — this probe is ~64 KB on the wire, so that is a host/proxy misconfiguration, not the cap)'),
+      req('openwop.it.pack-registry-publish.put-with-decompressed-bytes-exceeding-the-registry-s-cap-must-return-400-tarball', 'node-packs.md §"Tarball extraction"', 'a valid gzip inflating past the decompressed cap MUST be refused with 400 (a 413 here means a proxy refused the wire body — this probe is ~64 KB on the wire, so that is a host/proxy misconfiguration, not the cap)'),
     ).toBe(400);
     expect(
       errorCode(res.json),
-      driver.describe('node-packs.md §"Tarball extraction"', 'decompressed bytes exceeding the registry cap MUST surface tarball_too_large (recommended default cap 50 MB; this probe inflates to 64 MiB)'),
+      req('openwop.it.pack-registry-publish.put-with-decompressed-bytes-exceeding-the-registry-s-cap-must-return-400-tarball', 'node-packs.md §"Tarball extraction"', 'decompressed bytes exceeding the registry cap MUST surface tarball_too_large (recommended default cap 50 MB; this probe inflates to 64 MiB)'),
     ).toBe('tarball_too_large');
   });
 
   it('PUT with no `pack.json` at the tarball root MUST return 400 tarball_manifest_missing', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     // Stub: a real test would build a minimal gzip+tar with no pack.json.
     // For now, soft-skip when the host needs a real tarball structure to reach this code path.
-    return;
+    return softSkip('skipped', 'suite-side limitation — Stub: a real test would build a minimal gzip+tar with no pack.json. For now, soft-skip when the host needs a real tarball structure to reach this code path.');
   });
 
   it('PUT with `pack.json` exceeding the registry\'s per-file cap MUST return 400 tarball_manifest_too_large', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires a real tarball builder — defer to host-side test
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires a real tarball builder — defer to host-side test'); // requires a real tarball builder — defer to host-side test
   });
 
   it('PUT with `pack.json` that isn\'t valid JSON MUST return 400 tarball_manifest_not_json', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires a real tarball builder
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires a real tarball builder'); // requires a real tarball builder
   });
 
   it('PUT with `manifest.runtime.entry` declaring a path that isn\'t in the tarball MUST return 400 tarball_entry_missing', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires a real tarball builder
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires a real tarball builder'); // requires a real tarball builder
   });
 
   it('PUT with an entry source exceeding the registry\'s per-file cap MUST return 400 tarball_entry_too_large', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires a real tarball builder
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires a real tarball builder'); // requires a real tarball builder
   });
 
   it('PUT with a tarball entry whose name contains `..` or otherwise escapes the pack root MUST return 400 tarball_path_traversal', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires a real tarball builder
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires a real tarball builder'); // requires a real tarball builder
   });
 
   it('PUT with a tar stream that the parser can\'t read past the gzip layer MUST return 400 tarball_tar_parse_failed', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     // A gzip stream of garbage (header valid, payload not a tar)
     const garbage = Buffer.from([0x1f, 0x8b, 0x08, 0x00, 0, 0, 0, 0, 0, 0xff, 0x01, 0x02]);
     const res = await putTest(freshPackName(), '1.0.0', garbage);
-    if (res.status === 404) return;
-    if (res.status < 400 || res.status >= 500) return; // host may not reach this code path with garbage gzip
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam, prior step, or fixture unavailable)');
+    if (res.status < 400 || res.status >= 500) return softSkip('blocked', 'precondition not met — `res.status < 400 || res.status >= 500` returned early (host may not reach this code path with garbage gzip) (seam, prior step, or fixture unavailable)'); // host may not reach this code path with garbage gzip
     const code = errorCode(res.json);
     expect(
       ['tarball_tar_parse_failed', 'tarball_gunzip_failed'].includes(code ?? ''),
-      driver.describe('node-packs.md', 'garbage gzip stream MUST surface tarball_tar_parse_failed or tarball_gunzip_failed'),
+      req('openwop.it.pack-registry-publish.put-with-a-tar-stream-that-the-parser-can-t-read-past-the-gzip-layer-must-return', 'node-packs.md', 'garbage gzip stream MUST surface tarball_tar_parse_failed or tarball_gunzip_failed'),
     ).toBe(true);
   });
 });
 
 describe('pack-registry-publish: manifest contents error catalog (RFC 0025)', () => {
   it('PUT with a `pack.json` that fails schema validation MUST return 400 invalid_manifest', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires a real tarball builder + intentionally-invalid manifest
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires a real tarball builder + intentionally-invalid manifest'); // requires a real tarball builder + intentionally-invalid manifest
   });
 
   it('PUT with `manifest.name`/`manifest.version` differing from URL MUST return 400 manifest_mismatch (or granular pair)', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires a real tarball builder
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires a real tarball builder'); // requires a real tarball builder
   });
 
   it('PUT with server-computed SHA-256 not matching `X-Pack-Sha256` MUST return 400 pack_integrity_failure', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     const res = await putTest(freshPackName(), '1.0.0', Buffer.from([0x1f, 0x8b, 0]), { 'X-Pack-Sha256': '0'.repeat(64) });
-    if (res.status === 404) return;
-    if (res.status < 400) return; // host may not validate header on garbage gzip
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (seam, prior step, or fixture unavailable)');
+    if (res.status < 400) return softSkip('blocked', 'precondition not met — `res.status < 400` returned early (host may not validate header on garbage gzip) (seam, prior step, or fixture unavailable)'); // host may not validate header on garbage gzip
     const code = errorCode(res.json);
     expect(
       ['pack_integrity_failure', 'tarball_gunzip_failed', 'invalid_body'].includes(code ?? ''),
-      driver.describe('node-packs.md', 'SHA-256 mismatch MUST be detectable; absence of valid gzip masks this case for the test'),
+      req('openwop.it.pack-registry-publish.put-with-server-computed-sha-256-not-matching-x-pack-sha256-must-return-400-pack', 'node-packs.md', 'SHA-256 mismatch MUST be detectable; absence of valid gzip masks this case for the test'),
     ).toBe(true);
   });
 
   it('PUT with `runtime.language` value not accepted by the registry MUST return 400 unsupported_runtime', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires a real tarball builder + manifest with unsupported runtime
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires a real tarball builder + manifest with unsupported runtime'); // requires a real tarball builder + manifest with unsupported runtime
   });
 });
 
 describe('pack-registry-publish: authorization + conflict (RFC 0025)', () => {
   it('PUT without `packs:publish` scope or namespace claim MUST return 403 forbidden', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     // The test-mode catalog typically allows the conformance suite's API key
     // by design; this assertion gates on the host returning 403 with the
     // canonical code when scope IS missing (some hosts MAY accept the suite
     // key universally — in that case the test soft-skips).
-    return;
+    return softSkip('skipped', 'suite-side limitation — The test-mode catalog typically allows the conformance suite\'s API key by design; this assertion gates on the host returning 403 with the canonical code when scope IS missing (some hosts MAY ac…');
   });
 
   it('PUT for an existing (name, version) with DIFFERENT content MUST return 409 conflict', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires successful first PUT then conflicting second PUT
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires successful first PUT then conflicting second PUT'); // requires successful first PUT then conflicting second PUT
   });
 
   it('PUT for an existing (name, version) with IDENTICAL sha256 content MUST return 200 OK (idempotent re-publish)', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires successful first PUT, then identical second PUT
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires successful first PUT, then identical second PUT'); // requires successful first PUT, then identical second PUT
   });
 });
 
 describe('pack-registry-publish: unpublish window (RFC 0025)', () => {
   it('DELETE for a version older than the unpublish window MUST return 400 unpublish_window_expired', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires time-travel or an explicit aged-version fixture
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires time-travel or an explicit aged-version fixture'); // requires time-travel or an explicit aged-version fixture
   });
 });
 
 describe('pack-registry-publish: signature endpoint pairing (RFC 0025)', () => {
   it('after PUT WITHOUT signature, GET /sig MUST return 404 signature_not_available', async () => {
-    if (!(await isTestModeAdvertised())) return;
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
     const name = freshPackName();
     const sigRes = await getTestSignature(name, '1.0.0');
     if (sigRes.status === 404) {
       // Could be either "seam returns 404 on missing pack" OR "signature_not_available 404"
       const code = errorCode(sigRes.json);
-      if (code === 'signature_not_available' || code === undefined) return; // shape-conformant either way
+      if (code === 'signature_not_available' || code === undefined) return softSkip('blocked', 'precondition not met — `code === \'signature_not_available\' || code === undefined` returned early (shape-conformant either way) (seam, prior step, or fixture unavailable)'); // shape-conformant either way
     }
     // If a real test had PUT a pack without sig and gotten 200 back, the next GET .sig MUST be 404.
-    return; // soft-skip — requires successful prior PUT
+    return softSkip('skipped', 'suite-side limitation — soft-skip — requires successful prior PUT'); // soft-skip — requires successful prior PUT
   });
 
   it('after PUT WITH signature blob, GET /sig MUST return 200 (or 302 to signed URL)', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires real tarball with signature.sig at root
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires real tarball with signature.sig at root'); // requires real tarball with signature.sig at root
   });
 
   it('after YANK, GET /sig MUST return 404 signature_not_available', async () => {
-    if (!(await isTestModeAdvertised())) return;
-    return; // requires successful PUT then YANK
+    if (!(await isTestModeAdvertised())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isTestModeAdvertised())` returned early');
+    return softSkip('skipped', 'suite-side limitation — requires successful PUT then YANK'); // requires successful PUT then YANK
   });
 });