@openwop/openwop-conformance 1.162.0 → 2.0.0-rc.0

package/src/scenarios/purpose-propagation.test.ts

@@ -53,6 +53,8 @@ import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { SCHEMAS_DIR, FIXTURES_DIR } from '../lib/paths.js';
 import { driver } from '../lib/driver.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 const SEAM = '/v1/host/sample/purpose-propagation/forward';
@@ -79,30 +81,30 @@ describe('purpose-propagation: label schema (always-on, server-free)', () => {
 
   it('a labelled TriggerEvent validates; a non-array label fails', () => {
     const ev = JSON.parse(readFileSync(FIXTURE, 'utf8'));
-    expect(validate(ev), `a labelled TriggerEvent MUST validate (RFC 0128 §1). Errors: ${JSON.stringify(validate.errors)}`).toBe(true);
+    expect(validate(ev), req('openwop.it.purpose-propagation.a-labelled-triggerevent-validates-a-non-array-label-fails', 'RFC 0128', `a labelled TriggerEvent MUST validate (RFC 0128 §1). Errors: ${JSON.stringify(validate.errors)}`)).toBe(true);
 
     ev.permittedPurposes = 'analytics';
-    expect(validate(ev), 'RFC 0128 §1 — permittedPurposes MUST be string[]').toBe(false);
+    expect(validate(ev), req('openwop.it.purpose-propagation.a-labelled-triggerevent-validates-a-non-array-label-fails', 'RFC 0128', 'RFC 0128 §1 — permittedPurposes MUST be string[]')).toBe(false);
   });
 
   it('absent and [] are BOTH wire-valid — distinct states (unlabelled vs no-onward-use)', () => {
     const ev = JSON.parse(readFileSync(FIXTURE, 'utf8'));
     delete ev.permittedPurposes;
-    expect(validate(ev), 'RFC 0128 §1 — an unlabelled event (absent label) MUST validate').toBe(true);
+    expect(validate(ev), req('openwop.it.purpose-propagation.absent-and-are-both-wire-valid-distinct-states-unlabelled-vs-no-onward-use', 'RFC 0128', 'RFC 0128 §1 — an unlabelled event (absent label) MUST validate')).toBe(true);
     ev.permittedPurposes = [];
-    expect(validate(ev), 'RFC 0128 §1 — a []-labelled event MUST validate (behavioral meaning: no onward use)').toBe(true);
+    expect(validate(ev), req('openwop.it.purpose-propagation.absent-and-are-both-wire-valid-distinct-states-unlabelled-vs-no-onward-use', 'RFC 0128', 'RFC 0128 §1 — a []-labelled event MUST validate (behavioral meaning: no onward use)')).toBe(true);
   });
 
   it('the capabilities.purposePropagation family requires `supported` and closes its shape', () => {
     const caps = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'capabilities.schema.json'), 'utf8'));
     const fam = caps.properties?.purposePropagation;
-    expect(fam, 'capabilities.schema.json MUST define the purposePropagation family (RFC 0128 §2)').toBeDefined();
-    expect(fam.required, 'purposePropagation MUST require `supported`').toContain('supported');
-    expect(fam.additionalProperties, 'purposePropagation MUST close its shape').toBe(false);
+    expect(fam, req('openwop.it.purpose-propagation.the-capabilities-purposepropagation-family-requires-supported-and-closes-its-sha', 'RFC 0128', 'capabilities.schema.json MUST define the purposePropagation family (RFC 0128 §2)')).toBeDefined();
+    expect(fam.required, req('openwop.it.purpose-propagation.the-capabilities-purposepropagation-family-requires-supported-and-closes-its-sha', 'RFC 0128', 'purposePropagation MUST require `supported`')).toContain('supported');
+    expect(fam.additionalProperties, req('openwop.it.purpose-propagation.the-capabilities-purposepropagation-family-requires-supported-and-closes-its-sha', 'RFC 0128', 'purposePropagation MUST close its shape')).toBe(false);
     const ajvFam = new Ajv2020({ allErrors: true, strict: false });
     const vf = ajvFam.compile(fam);
-    expect(vf({ supported: true, propagatesOnward: true }), 'the canonical advert MUST validate').toBe(true);
-    expect(vf({ propagatesOnward: true }), 'an advert without `supported` MUST fail').toBe(false);
+    expect(vf({ supported: true, propagatesOnward: true }), req('openwop.it.purpose-propagation.the-capabilities-purposepropagation-family-requires-supported-and-closes-its-sha', 'RFC 0128', 'the canonical advert MUST validate')).toBe(true);
+    expect(vf({ propagatesOnward: true }), req('openwop.it.purpose-propagation.the-capabilities-purposepropagation-family-requires-supported-and-closes-its-sha', 'RFC 0128', 'an advert without `supported` MUST fail')).toBe(false);
   });
 });
 
@@ -127,17 +129,17 @@ describe.skipIf(HTTP_SKIP)('purpose-propagation: two-hop onward behavior (seam-g
   it('a forwarded label survives ⊆ the received set (re-emit; MAY narrow, MUST NOT widen)', async () => {
     const input = ['analytics', 'marketing-email'];
     const res = await seamPost({ mode: 'forward', records: [{ id: 'r1', permittedPurposes: input, data: { k: 1 } }] });
-    if (res === null) return;
+    if (res === null) return softSkip('blocked', 'precondition not met — `res === null` returned early (seam, prior step, or fixture unavailable)');
 
     const onward = res.onward ?? [];
     expect(
       onward.length > 0,
-      driver.describe('RFC 0128 §3', 'an advertising host MUST re-emit a received label on the onward hop — silent loss fails (the promise is propagation)'),
+      req('openwop.it.purpose-propagation.a-forwarded-label-survives-the-received-set-re-emit-may-narrow-must-not-widen', 'RFC 0128 §3', 'an advertising host MUST re-emit a received label on the onward hop — silent loss fails (the promise is propagation)'),
     ).toBe(true);
     for (const o of onward) {
       expect(
         Array.isArray(o.permittedPurposes) && subsetOf(o.permittedPurposes, input),
-        driver.describe('RFC 0128 §3', `the onward label MUST be a subset of what the host received — got ${JSON.stringify(o.permittedPurposes)} vs input ${JSON.stringify(input)} (widening is the testable violation)`),
+        req('openwop.it.purpose-propagation.a-forwarded-label-survives-the-received-set-re-emit-may-narrow-must-not-widen', 'RFC 0128 §3', `the onward label MUST be a subset of what the host received — got ${JSON.stringify(o.permittedPurposes)} vs input ${JSON.stringify(input)} (widening is the testable violation)`),
       ).toBe(true);
     }
   });
@@ -150,13 +152,13 @@ describe.skipIf(HTTP_SKIP)('purpose-propagation: two-hop onward behavior (seam-g
         { id: 'b', permittedPurposes: ['analytics'], data: { k: 2 } },
       ],
     });
-    if (res === null) return;
+    if (res === null) return softSkip('blocked', 'precondition not met — `res === null` returned early (seam, prior step, or fixture unavailable)');
     const onward = res.onward ?? [];
-    expect(onward.length > 0, driver.describe('RFC 0128 §3', 'a merge of forwardable labelled inputs MUST produce an onward emission')).toBe(true);
+    expect(onward.length > 0, req('openwop.it.purpose-propagation.a-derived-merged-output-arrives-the-intersection-of-contributing-labelled-inputs', 'RFC 0128 §3', 'a merge of forwardable labelled inputs MUST produce an onward emission')).toBe(true);
     for (const o of onward) {
       expect(
         subsetOf(o.permittedPurposes, ['analytics']),
-        driver.describe('RFC 0128 §3', `a derived output MUST NOT carry a purpose absent from any contributing labelled input — transformation does not launder a grant; got ${JSON.stringify(o.permittedPurposes)}, allowed ⊆ ["analytics"]`),
+        req('openwop.it.purpose-propagation.a-derived-merged-output-arrives-the-intersection-of-contributing-labelled-inputs', 'RFC 0128 §3', `a derived output MUST NOT carry a purpose absent from any contributing labelled input — transformation does not launder a grant; got ${JSON.stringify(o.permittedPurposes)}, allowed ⊆ ["analytics"]`),
       ).toBe(true);
     }
   });
@@ -169,11 +171,11 @@ describe.skipIf(HTTP_SKIP)('purpose-propagation: two-hop onward behavior (seam-g
         { id: 'b', data: { k: 2 } },
       ],
     });
-    if (res === null) return;
+    if (res === null) return softSkip('blocked', 'precondition not met — `res === null` returned early (seam, prior step, or fixture unavailable)');
     for (const o of res.onward ?? []) {
       expect(
         subsetOf(o.permittedPurposes, ['analytics']),
-        driver.describe('RFC 0128 §3', 'an unlabelled input asserts no constraint — the derived label is still bounded by the labelled input(s)'),
+        req('openwop.it.purpose-propagation.an-unlabelled-input-adds-no-constraint-to-a-merge', 'RFC 0128 §3', 'an unlabelled input asserts no constraint — the derived label is still bounded by the labelled input(s)'),
       ).toBe(true);
     }
   });
@@ -186,20 +188,20 @@ describe.skipIf(HTTP_SKIP)('purpose-propagation: two-hop onward behavior (seam-g
         { id: 'control', data: { k: 1 } },
       ],
     });
-    if (res === null) return;
+    if (res === null) return softSkip('blocked', 'precondition not met — `res === null` returned early (seam, prior step, or fixture unavailable)');
 
     const onwardIds = (res.onward ?? []).map((o) => o.recordId);
     expect(
       !onwardIds.includes('blocked'),
-      driver.describe('RFC 0128 §3', 'permittedPurposes: [] means no onward use — a conformant host MUST NOT forward []-labelled data to a further sink at all'),
+      req('openwop.it.purpose-propagation.labelled-data-is-fail-closed-dropped-from-onward-emission-positive-control-unlab', 'RFC 0128 §3', 'permittedPurposes: [] means no onward use — a conformant host MUST NOT forward []-labelled data to a further sink at all'),
     ).toBe(true);
     expect(
       (res.dropped ?? []).includes('blocked'),
-      driver.describe('RFC 0128 §3', 'the []-labelled record MUST be reported dropped (fail-closed, observable)'),
+      req('openwop.it.purpose-propagation.labelled-data-is-fail-closed-dropped-from-onward-emission-positive-control-unlab', 'RFC 0128 §3', 'the []-labelled record MUST be reported dropped (fail-closed, observable)'),
     ).toBe(true);
     expect(
       onwardIds.includes('control'),
-      driver.describe('RFC 0128 §3', 'the unlabelled twin (positive control) MUST forward — proving the non-arrival of the []-labelled record is the rule firing, not a dead seam'),
+      req('openwop.it.purpose-propagation.labelled-data-is-fail-closed-dropped-from-onward-emission-positive-control-unlab', 'RFC 0128 §3', 'the unlabelled twin (positive control) MUST forward — proving the non-arrival of the []-labelled record is the rule firing, not a dead seam'),
     ).toBe(true);
   });
 });

package/src/scenarios/queue-ack-nack-dlq.test.ts

@@ -16,6 +16,8 @@
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -32,10 +34,10 @@ async function readCap(): Promise<Record<string, unknown> | null> {
 describe('queue-ack-nack-dlq: advertisement shape (RFC 0017)', () => {
   it('capabilities.queueBus is either absent or a well-formed object', async () => {
     const cap = await readCap();
-    if (cap === null) return; // host doesn't advertise — skip
+    if (cap === null) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `cap === null` returned early (host doesn\'t advertise — skip)'); // host doesn't advertise — skip
     expect(
       typeof cap.supported,
-      driver.describe(
+      req('openwop.it.queue-ack-nack-dlq.capabilities-queuebus-is-either-absent-or-a-well-formed-object', 
         'capabilities.schema.json §queueBus',
         'capabilities.queueBus.supported MUST be a boolean when present',
       ),
@@ -44,17 +46,17 @@ describe('queue-ack-nack-dlq: advertisement shape (RFC 0017)', () => {
 
   it('deadLetterSupported is a boolean when set', async () => {
     const cap = await readCap();
-    if (!cap || cap.supported !== true) return;
+    if (!cap || cap.supported !== true) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!cap || cap.supported !== true` returned early');
     const subParts = ["deadLetterSupported"];
     let sub: unknown = cap;
     for (const p of subParts) {
       if (sub && typeof sub === 'object') sub = (sub as Record<string, unknown>)[p];
       else { sub = undefined; break; }
     }
-    if (sub === undefined) return; // optional sub-field
+    if (sub === undefined) return softSkip('blocked', 'precondition not met — `sub === undefined` returned early (optional sub-field) (seam, prior step, or fixture unavailable)'); // optional sub-field
     expect(
       typeof sub,
-      driver.describe(
+      req('openwop.it.queue-ack-nack-dlq.deadlettersupported-is-a-boolean-when-set', 
         'RFC 0017 §A',
         'queueBus.deadLetterSupported MUST be boolean when present',
       ),
@@ -69,7 +71,7 @@ async function call(op: string, args: Record<string, unknown>) {
 describe('queue-ack-nack-dlq: behavioral (RFC 0017 §B point 2 — nack + DLQ)', () => {
   it('nack(requeue=true) → message is redelivered on next consume with deliveryCount incremented', async () => {
     const probe = await call('consume', { subject: '__probe__' });
-    if (probe.status === 404) return;
+    if (probe.status === 404) return softSkip('blocked', 'precondition not met — `probe.status === 404` returned early (seam, prior step, or fixture unavailable)');
     const subject = `q-nack-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     await call('publish', { subject, payload: { v: 'redeliver-me' } });
 
@@ -83,18 +85,18 @@ describe('queue-ack-nack-dlq: behavioral (RFC 0017 §B point 2 — nack + DLQ)',
     const secondBody = second.json as { found?: boolean; payload?: unknown; deliveryCount?: number };
     expect(
       secondBody.found,
-      driver.describe('RFC 0017 §B point 2', 'nack(requeue=true) MUST make the message available to next consume'),
+      req('openwop.it.queue-ack-nack-dlq.nack-requeue-true-message-is-redelivered-on-next-consume-with-deliverycount-incr', 'RFC 0017 §B point 2', 'nack(requeue=true) MUST make the message available to next consume'),
     ).toBe(true);
     expect(secondBody.payload).toEqual(firstBody.payload);
     expect(
       secondBody.deliveryCount,
-      driver.describe('RFC 0017 §B point 2', 'redelivered message MUST have incremented deliveryCount'),
+      req('openwop.it.queue-ack-nack-dlq.nack-requeue-true-message-is-redelivered-on-next-consume-with-deliverycount-incr', 'RFC 0017 §B point 2', 'redelivered message MUST have incremented deliveryCount'),
     ).toBe(2);
   });
 
   it('deadLetter → message appears on the <subject>.dlq subject; original subject is empty', async () => {
     const probe = await call('consume', { subject: '__probe__' });
-    if (probe.status === 404) return;
+    if (probe.status === 404) return softSkip('blocked', 'precondition not met — `probe.status === 404` returned early (seam, prior step, or fixture unavailable)');
     const subject = `q-dlq-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     await call('publish', { subject, payload: { v: 'poison' } });
 
@@ -114,7 +116,7 @@ describe('queue-ack-nack-dlq: behavioral (RFC 0017 §B point 2 — nack + DLQ)',
     const dlqBody = dlqMsg.json as { found?: boolean; payload?: { original?: unknown; deadLetterReason?: string } };
     expect(
       dlqBody.found,
-      driver.describe('RFC 0017 §B point 2', 'deadLetter MUST route the message to the <subject>.dlq subject'),
+      req('openwop.it.queue-ack-nack-dlq.deadletter-message-appears-on-the-subject-dlq-subject-original-subject-is-empty', 'RFC 0017 §B point 2', 'deadLetter MUST route the message to the <subject>.dlq subject'),
     ).toBe(true);
     expect(dlqBody.payload?.deadLetterReason).toBe('unparseable_payload');
     expect(dlqBody.payload?.original).toEqual({ v: 'poison' });

package/src/scenarios/queue-cross-tenant-isolation.test.ts

@@ -12,6 +12,8 @@
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -32,10 +34,10 @@ async function call(tenantId: string, op: string, args: Record<string, unknown>)
 describe('queue-cross-tenant-isolation: advertisement shape (RFC 0017)', () => {
   it('capabilities.queueBus is either absent or a well-formed object', async () => {
     const cap = await readCap();
-    if (cap === null) return;
+    if (cap === null) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `cap === null` returned early');
     expect(
       typeof cap.supported,
-      driver.describe(
+      req('openwop.it.queue-cross-tenant-isolation.capabilities-queuebus-is-either-absent-or-a-well-formed-object', 
         'capabilities.schema.json §queueBus',
         'capabilities.queueBus.supported MUST be a boolean when present',
       ),
@@ -46,19 +48,19 @@ describe('queue-cross-tenant-isolation: advertisement shape (RFC 0017)', () => {
 describe('queue-cross-tenant-isolation: behavioral (RFC 0017 §C)', () => {
   it('publish under tenant A → consume under tenant B returns not-found', async () => {
     const cap = await readCap();
-    if (!cap || cap.supported !== true) return;
+    if (!cap || cap.supported !== true) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!cap || cap.supported !== true` returned early');
     const topic = `xtenant.${Date.now()}.${Math.random().toString(36).slice(2, 6)}`;
 
     const pubRes = await call('tenant-a', 'publish', { topic, payload: { hello: 'A' } });
-    if (pubRes.status === 404) return;
-    expect(pubRes.status, 'publish MUST succeed').toBe(200);
+    if (pubRes.status === 404) return softSkip('blocked', 'precondition not met — `pubRes.status === 404` returned early (seam, prior step, or fixture unavailable)');
+    expect(pubRes.status, req('openwop.it.queue-cross-tenant-isolation.publish-under-tenant-a-consume-under-tenant-b-returns-not-found', 'SECURITY/invariants.yaml queue-cross-tenant-isolation', 'publish MUST succeed')).toBe(200);
 
     const consRes = await call('tenant-b', 'consume', { topic, timeoutMs: 100 });
     expect(consRes.status).toBe(200);
     const body = consRes.json as { found?: boolean };
     expect(
       body.found,
-      driver.describe(
+      req('openwop.it.queue-cross-tenant-isolation.publish-under-tenant-a-consume-under-tenant-b-returns-not-found', 
         'SECURITY/invariants.yaml queue-cross-tenant-isolation',
         'tenant B MUST NOT consume tenant A messages on the same topic',
       ),

package/src/scenarios/queue-publish-consume-roundtrip.test.ts

@@ -16,6 +16,8 @@
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface DiscoveryDoc {
   capabilities?: Record<string, unknown>;
@@ -32,10 +34,10 @@ async function readCap(): Promise<Record<string, unknown> | null> {
 describe('queue-publish-consume-roundtrip: advertisement shape (RFC 0017)', () => {
   it('capabilities.queueBus is either absent or a well-formed object', async () => {
     const cap = await readCap();
-    if (cap === null) return; // host doesn't advertise — skip
+    if (cap === null) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `cap === null` returned early (host doesn\'t advertise — skip)'); // host doesn't advertise — skip
     expect(
       typeof cap.supported,
-      driver.describe(
+      req('openwop.it.queue-publish-consume-roundtrip.capabilities-queuebus-is-either-absent-or-a-well-formed-object', 
         'capabilities.schema.json §queueBus',
         'capabilities.queueBus.supported MUST be a boolean when present',
       ),
@@ -50,7 +52,7 @@ async function call(op: string, args: Record<string, unknown>) {
 describe('queue-publish-consume-roundtrip: behavioral (RFC 0017 §B point 2)', () => {
   it('publish → consume returns the same payload + subject', async () => {
     const probe = await call('consume', { subject: '__probe__' });
-    if (probe.status === 404) return; // seam not exposed
+    if (probe.status === 404) return softSkip('blocked', 'precondition not met — `probe.status === 404` returned early (seam not exposed) (seam, prior step, or fixture unavailable)'); // seam not exposed
     const subject = `q-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const payload = { event: 'order.created', orderId: 42 };
     const pub = await call('publish', { subject, payload });
@@ -59,18 +61,18 @@ describe('queue-publish-consume-roundtrip: behavioral (RFC 0017 §B point 2)', (
     const got = await call('consume', { subject });
     expect(got.status).toBe(200);
     const body = got.json as { found?: boolean; subject?: string; payload?: unknown; deliveryToken?: string };
-    expect(body.found, 'consume MUST find the just-published message').toBe(true);
+    expect(body.found, req('openwop.it.queue-publish-consume-roundtrip.publish-consume-returns-the-same-payload-subject', 'RFC 0017 §B point 2', 'consume MUST find the just-published message')).toBe(true);
     expect(body.subject).toBe(subject);
     expect(
       body.payload,
-      driver.describe('RFC 0017 §B point 2', 'consume MUST return the exact published payload'),
+      req('openwop.it.queue-publish-consume-roundtrip.publish-consume-returns-the-same-payload-subject', 'RFC 0017 §B point 2', 'consume MUST return the exact published payload'),
     ).toEqual(payload);
-    expect(typeof body.deliveryToken, 'consume MUST return a deliveryToken for ack/nack').toBe('string');
+    expect(typeof body.deliveryToken, req('openwop.it.queue-publish-consume-roundtrip.publish-consume-returns-the-same-payload-subject', 'RFC 0017 §B point 2', 'consume MUST return a deliveryToken for ack/nack')).toBe('string');
   });
 
   it('ack removes the message; subsequent consume on empty queue returns found:false', async () => {
     const probe = await call('consume', { subject: '__probe__' });
-    if (probe.status === 404) return;
+    if (probe.status === 404) return softSkip('blocked', 'precondition not met — `probe.status === 404` returned early (seam, prior step, or fixture unavailable)');
     const subject = `q-ack-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     await call('publish', { subject, payload: { v: 1 } });
     const got = await call('consume', { subject });
@@ -83,7 +85,7 @@ describe('queue-publish-consume-roundtrip: behavioral (RFC 0017 §B point 2)', (
     const emptyBody = empty.json as { found?: boolean };
     expect(
       emptyBody.found,
-      driver.describe('RFC 0017 §B point 2', 'consume after ack MUST surface as found:false'),
+      req('openwop.it.queue-publish-consume-roundtrip.ack-removes-the-message-subsequent-consume-on-empty-queue-returns-found-false', 'RFC 0017 §B point 2', 'consume after ack MUST surface as found:false'),
     ).toBe(false);
   });
 });

package/src/scenarios/rate-limit-envelope.test.ts

@@ -23,6 +23,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
+import { req } from '../lib/requirement-ids.js';
 
 const ALLOWED_SCOPES = new Set(['tenant', 'route', 'global', 'key']);
 const FORCE = process.env.OPENWOP_FORCE_RATE_LIMIT === 'true';
@@ -48,7 +49,7 @@ describe('rate-limit-envelope: 429 conforms to canonical shape', () => {
     }
 
     const retryAfter = last.headers.get('retry-after');
-    expect(retryAfter, driver.describe(
+    expect(retryAfter, req('openwop.it.rate-limit-envelope.when-a-429-is-observed-the-response-body-satisfies-the-v1-1-contract', 
       'rest-endpoints.md §"429 Too Many Requests envelope"',
       '429 response MUST set Retry-After header',
     )).not.toBeNull();
@@ -60,7 +61,7 @@ describe('rate-limit-envelope: 429 conforms to canonical shape', () => {
       [k: string]: unknown;
     };
 
-    expect(body.error, driver.describe(
+    expect(body.error, req('openwop.it.rate-limit-envelope.when-a-429-is-observed-the-response-body-satisfies-the-v1-1-contract', 
       'rest-endpoints.md §"429 Too Many Requests envelope"',
       "429 body MUST carry error === 'rate_limited'",
     )).toBe('rate_limited');
@@ -70,13 +71,13 @@ describe('rate-limit-envelope: 429 conforms to canonical shape', () => {
     const topKeys = Object.keys(body).filter(
       (k) => !['error', 'message', 'details'].includes(k),
     );
-    expect(topKeys, driver.describe(
+    expect(topKeys, req('openwop.it.rate-limit-envelope.when-a-429-is-observed-the-response-body-satisfies-the-v1-1-contract', 
       'error-envelope.schema.json additionalProperties: false',
       '429 envelope MUST NOT carry top-level keys outside {error, message, details}',
     )).toEqual([]);
 
     if (body.details?.scope !== undefined) {
-      expect(ALLOWED_SCOPES.has(body.details.scope), driver.describe(
+      expect(ALLOWED_SCOPES.has(body.details.scope), req('openwop.it.rate-limit-envelope.when-a-429-is-observed-the-response-body-satisfies-the-v1-1-contract', 
         'rest-endpoints.md §"429 Too Many Requests envelope"',
         "details.scope MUST be one of {'tenant','route','global','key'} when present",
       )).toBe(true);
@@ -89,7 +90,7 @@ describe('rate-limit-envelope: 429 conforms to canonical shape', () => {
       retryAfterSec > 0
     ) {
       const diff = Math.abs(body.details.retryAfterMs / 1000 - retryAfterSec);
-      expect(diff, driver.describe(
+      expect(diff, req('openwop.it.rate-limit-envelope.when-a-429-is-observed-the-response-body-satisfies-the-v1-1-contract', 
         'rest-endpoints.md §"429 Too Many Requests envelope"',
         'details.retryAfterMs MUST be consistent with Retry-After header (±1s)',
       )).toBeLessThanOrEqual(1.5);

package/src/scenarios/redaction.test.ts

@@ -55,6 +55,8 @@ import {
   getCanary,
 } from '../lib/canaries.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const NOOP_WORKFLOW_ID = 'conformance-noop';
 const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);
@@ -71,7 +73,7 @@ describe('redaction: /.well-known/openwop secrets+aiProviders shape contract', (
 
     if (secrets === undefined) {
       // Optional v1 field — hosts MAY omit. Spec-allowed; nothing to assert.
-      return;
+      return softSkip('blocked', 'precondition not met — `secrets === undefined` returned early (Optional v1 field — hosts MAY omit. Spec-allowed; nothing to assert.) (seam, prior step, or fixture unavailable)');
     }
 
     // Per capabilities.schema.json: `secrets.supported` is REQUIRED
@@ -81,7 +83,7 @@ describe('redaction: /.well-known/openwop secrets+aiProviders shape contract', (
       scopes?: unknown;
       resolution?: unknown;
     };
-    expect(typeof s.supported, driver.describe(
+    expect(typeof s.supported, req('openwop.it.redaction.secrets-is-well-formed-regardless-of-supported-value', 
       'capabilities.md §"Secrets"',
       'secrets.supported MUST be a boolean',
     )).toBe('boolean');
@@ -90,12 +92,12 @@ describe('redaction: /.well-known/openwop secrets+aiProviders shape contract', (
     // (a host claiming secrets must declare at least one scope) AND
     // resolution MUST be 'host-managed' (only allowed value in v1.x).
     if (s.supported === true) {
-      expect(Array.isArray(s.scopes), driver.describe(
+      expect(Array.isArray(s.scopes), req('openwop.it.redaction.secrets-is-well-formed-regardless-of-supported-value', 
         'capabilities.md §"Secrets"',
         'when secrets.supported is true, scopes MUST be a string[]',
       )).toBe(true);
       const scopes = s.scopes as string[];
-      expect(scopes.length, driver.describe(
+      expect(scopes.length, req('openwop.it.redaction.secrets-is-well-formed-regardless-of-supported-value', 
         'capabilities.md §"Secrets"',
         'when secrets.supported is true, scopes MUST be non-empty',
       )).toBeGreaterThanOrEqual(1);
@@ -105,7 +107,7 @@ describe('redaction: /.well-known/openwop secrets+aiProviders shape contract', (
         // sub-tenant scope — additive; hosts that advertise it (e.g. MyndHyve) are conformant.
         expect(['tenant', 'user', 'run', 'workspace']).toContain(scope);
       }
-      expect(s.resolution, driver.describe(
+      expect(s.resolution, req('openwop.it.redaction.secrets-is-well-formed-regardless-of-supported-value', 
         'capabilities.md §"Secrets"',
         'resolution MUST be "host-managed" in v1.x',
       )).toBe('host-managed');
@@ -119,7 +121,7 @@ describe('redaction: /.well-known/openwop secrets+aiProviders shape contract', (
       | { supported?: unknown; byok?: unknown }
       | undefined;
 
-    if (ap === undefined) return; // Optional v1 field — hosts MAY omit.
+    if (ap === undefined) return softSkip('blocked', 'precondition not met — `ap === undefined` returned early (Optional v1 field — hosts MAY omit.) (seam, prior step, or fixture unavailable)'); // Optional v1 field — hosts MAY omit.
 
     if (ap.supported !== undefined) {
       expect(Array.isArray(ap.supported)).toBe(true);
@@ -130,7 +132,7 @@ describe('redaction: /.well-known/openwop secrets+aiProviders shape contract', (
         expect(Array.isArray(ap.byok)).toBe(true);
         const byok = ap.byok as string[];
         for (const id of byok) {
-          expect(supportedSet.has(id), driver.describe(
+          expect(supportedSet.has(id), req('openwop.it.redaction.aiproviders-is-well-formed-when-present-byok-supported', 
             'capabilities.md §"aiProviders"',
             `byok entry "${id}" MUST appear in aiProviders.supported`,
           )).toBe(true);
@@ -177,7 +179,7 @@ describe('redaction: 401 response MUST NOT echo invalid Bearer token (NFR-7)', (
       },
     );
     const responseText = captureToText(res.json) + '\n' + res.text;
-    expect(responseText).not.toContain(CANARY_MARKER);
+    expect(responseText, req('openwop.it.redaction.the-marker-substring-alone-never-appears-in-a-401-body-universal', 'capabilities.md', 'the marker substring alone never appears in a 401 body (universal)')).not.toContain(CANARY_MARKER);
   });
 });
 
@@ -193,8 +195,8 @@ describe.skipIf(SKIP_NO_NOOP)('redaction: credentialRef value MUST NOT appear in
     if (supported !== true) {
       // Spec-allowed — this scenario only applies to hosts that opt
       // into BYOK. Pass trivially.
-      expect(supported).not.toBe(true);
-      return;
+      expect(supported, req('openwop.it.redaction.skips-when-host-does-not-advertise-secrets-supported', 'capabilities.md', 'skips when host does NOT advertise secrets.supported')).not.toBe(true);
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `supported !== true` returned early');
     }
 
     // Real assertion path: plant a canary as credentialRef on a noop
@@ -217,7 +219,7 @@ describe.skipIf(SKIP_NO_NOOP)('redaction: credentialRef value MUST NOT appear in
       // full scenario; if the key is missing or invalid, the suite's
       // earlier auth scenarios already catch that. Bail with a non-
       // assertion — this scenario is opt-in.
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `create.status !== 201` returned early (Auth-required hosts may 401 here without an API key. The conformance suite is expected to provide OPENWOP_API_KEY for th…');
     }
     const runId = (create.json as { runId: string }).runId;
 

package/src/scenarios/redactionAdversarial.test.ts

@@ -47,6 +47,8 @@ import { driver } from '../lib/driver.js';
 import { CANARIES, CANARY_MARKER, getCanary } from '../lib/canaries.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const NOOP_WORKFLOW_ID = 'conformance-noop';
 const SKIP_NO_NOOP = !isFixtureAdvertised(NOOP_WORKFLOW_ID);
@@ -66,7 +68,7 @@ describe.skipIf(SKIP_NO_NOOP)('redaction-adversarial: workflow input canaries',
         userSuppliedField: canary,
       },
     });
-    expect(create.status, driver.describe('rest-endpoints.md', 'noop run create returns 201')).toBe(201);
+    expect(create.status, req('openwop.it.redactionAdversarial.openai-shaped-canary-in-arbitrary-input-field-must-not-appear-verbatim-in-any-ev', 'rest-endpoints.md', 'noop run create returns 201')).toBe(201);
     const runId = (create.json as { runId: string }).runId;
 
     await pollUntilTerminal(runId);
@@ -76,15 +78,15 @@ describe.skipIf(SKIP_NO_NOOP)('redaction-adversarial: workflow input canaries',
     );
     if (events.status !== 200) {
       // Host doesn't expose polling; SSE is the alternative. Skip-equivalent.
-      return;
+      return softSkip('blocked', 'precondition not met — `events.status !== 200` returned early (Host doesn\'t expose polling; SSE is the alternative. Skip-equivalent.) (seam, prior step, or fixture unavailable)');
     }
 
     const eventsText = events.text;
-    expect(eventsText.includes(canary), driver.describe(
+    expect(eventsText.includes(canary), req('openwop.it.redactionAdversarial.openai-shaped-canary-in-arbitrary-input-field-must-not-appear-verbatim-in-any-ev', 
       'capabilities.md §"Secrets" + NFR-7',
       'canary value submitted as workflow input MUST NOT appear verbatim in event poll response',
     )).toBe(false);
-    expect(eventsText.includes(CANARY_MARKER), driver.describe(
+    expect(eventsText.includes(CANARY_MARKER), req('openwop.it.redactionAdversarial.openai-shaped-canary-in-arbitrary-input-field-must-not-appear-verbatim-in-any-ev', 
       'NFR-7',
       'canary marker substring MUST NOT appear in event poll response',
     )).toBe(false);
@@ -100,7 +102,7 @@ describe('redaction-adversarial: error-envelope canaries', () => {
     });
     expect(
       [400, 404].includes(res.status),
-      driver.describe('rest-endpoints.md', 'unknown workflowId returns 400 or 404'),
+      req('openwop.it.redactionAdversarial.jwt-shaped-canary-in-workflowid-of-a-404-failing-request-must-not-echo-verbatim', 'rest-endpoints.md', 'unknown workflowId returns 400 or 404'),
     ).toBe(true);
 
     const responseText = res.text;
@@ -110,7 +112,7 @@ describe('redaction-adversarial: error-envelope canaries', () => {
     // SECURITY/invariants.yaml `secret-leakage-error-envelope`, the
     // host SHOULD sanitize entropy-shaped substrings even when echoing
     // the workflowId.
-    expect(responseText.includes(canary), driver.describe(
+    expect(responseText.includes(canary), req('openwop.it.redactionAdversarial.jwt-shaped-canary-in-workflowid-of-a-404-failing-request-must-not-echo-verbatim', 
       'SECURITY/invariants.yaml secret-leakage-error-envelope',
       'JWT-shaped canary submitted in workflowId SHOULD NOT echo verbatim in 4xx error envelope',
     )).toBe(false);
@@ -137,9 +139,9 @@ describe.skipIf(SKIP_NO_NOOP)('redaction-adversarial: bearer-shaped strings roun
     const events = await driver.get(
       `/v1/runs/${encodeURIComponent(runId)}/events/poll`,
     );
-    if (events.status !== 200) return;
+    if (events.status !== 200) return softSkip('blocked', 'precondition not met — `events.status !== 200` returned early (seam, prior step, or fixture unavailable)');
 
-    expect(events.text.includes(canary), driver.describe(
+    expect(events.text.includes(canary), req('openwop.it.redactionAdversarial.anthropic-shaped-canary-embedded-in-non-credential-input-must-not-appear-verbati', 
       'capabilities.md §"Secrets" + NFR-7',
       'Anthropic-shaped canary embedded in arbitrary input MUST NOT appear verbatim in events',
     )).toBe(false);
@@ -153,7 +155,7 @@ describe('redaction-adversarial: every canary fixture carries the marker substri
     // If this fails the canary harness has a bug — every other
     // adversarial scenario depends on this property.
     for (const c of CANARIES) {
-      expect(c.value.includes(CANARY_MARKER), driver.describe(
+      expect(c.value.includes(CANARY_MARKER), req('openwop.it.redactionAdversarial.every-canary-in-canaries-has-the-marker-substring', 
         'lib/canaries.ts',
         `every canary fixture MUST contain CANARY_MARKER (offender label: ${c.label})`,
       )).toBe(true);

package/src/scenarios/registry-public.test.ts

@@ -28,6 +28,7 @@
 import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { req } from '../lib/requirement-ids.js';
 
 const REGISTRY_BASE = 'https://packs.openwop.dev';
 const ENABLED = process.env.OPENWOP_TEST_PUBLIC_REGISTRY === 'true';
@@ -59,7 +60,7 @@ describe('registry-public: packs.openwop.dev discovery document', () => {
     }
 
     const res = await get('/.well-known/openwop-registry');
-    expect(res.status).toBe(200);
+    expect(res.status, req('openwop.it.registry-public.get-well-known-openwop-registry-returns-a-valid-discovery-payload', 'spec/v1/registry-operations.md', 'GET /.well-known/openwop-registry returns a valid discovery payload')).toBe(200);
 
     const body = res.json as {
       registryVersion?: string;
@@ -105,8 +106,8 @@ describe('registry-public: packs.openwop.dev index', () => {
     expect(body.packs?.length ?? 0).toBeGreaterThan(0);
 
     for (const p of body.packs ?? []) {
-      expect(p.name, `pack name must match reverse-DNS pattern: ${p.name}`).toMatch(PACK_NAME_RE);
-      expect(p.latestVersion, `pack version must be semver: ${p.latestVersion}`).toMatch(SEMVER_RE);
+      expect(p.name, req('openwop.it.registry-public.get-v1-index-json-returns-a-non-empty-pack-list-with-valid-name-version-shapes', 'spec/v1/registry-operations.md', `pack name must match reverse-DNS pattern: ${p.name}`)).toMatch(PACK_NAME_RE);
+      expect(p.latestVersion, req('openwop.it.registry-public.get-v1-index-json-returns-a-non-empty-pack-list-with-valid-name-version-shapes', 'spec/v1/registry-operations.md', `pack version must be semver: ${p.latestVersion}`)).toMatch(SEMVER_RE);
     }
   });
 });
@@ -123,7 +124,7 @@ describe('registry-public: spec-canonical pack manifests resolve', () => {
       if (!ENABLED) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!ENABLED` returned early');
 
       const res = await get(`/v1/packs/${name}/-/${version}.json`);
-      expect(res.status).toBe(200);
+      expect(res.status, req('openwop.it.registry-public.get-v1-packs-json-returns-a-valid-manifest', 'spec/v1/registry-operations.md', 'GET /v1/packs/ /-/ .json returns a valid manifest')).toBe(200);
 
       const manifest = res.json as { name?: string; version?: string };
       expect(manifest.name).toBe(name);
@@ -178,26 +179,26 @@ describe('registry-public: tarball + signature + Ed25519 verify roundtrip', () =
 
     // 2. Tarball.
     const tarball = await getBinary(`/v1/packs/${PACK_NAME}/-/${PACK_VERSION}.tgz`);
-    expect(tarball.status, 'tarball MUST be retrievable').toBe(200);
-    expect(tarball.bytes.byteLength, 'tarball MUST be non-empty').toBeGreaterThan(0);
+    expect(tarball.status, req('openwop.it.registry-public.tarball-sig-public-key-all-retrievable-sri-matches-ed25519-verifies-for', 'spec/v1/registry-operations.md', 'tarball MUST be retrievable')).toBe(200);
+    expect(tarball.bytes.byteLength, req('openwop.it.registry-public.tarball-sig-public-key-all-retrievable-sri-matches-ed25519-verifies-for', 'spec/v1/registry-operations.md', 'tarball MUST be non-empty')).toBeGreaterThan(0);
 
     // 3. Detached signature (64-byte raw Ed25519).
     const sig = await getBinary(`/v1/packs/${PACK_NAME}/-/${PACK_VERSION}.sig`);
-    expect(sig.status, 'signature MUST be retrievable').toBe(200);
-    expect(sig.bytes.byteLength, 'Ed25519 detached signature MUST be 64 bytes').toBe(64);
+    expect(sig.status, req('openwop.it.registry-public.tarball-sig-public-key-all-retrievable-sri-matches-ed25519-verifies-for', 'spec/v1/registry-operations.md', 'signature MUST be retrievable')).toBe(200);
+    expect(sig.bytes.byteLength, req('openwop.it.registry-public.tarball-sig-public-key-all-retrievable-sri-matches-ed25519-verifies-for', 'spec/v1/registry-operations.md', 'Ed25519 detached signature MUST be 64 bytes')).toBe(64);
 
     // 4. Public key — fetch from the publisher-declared URL when present,
     //    else fall back to the canonical `/keys/<keyId>.pub` shape.
     const keyUrl = manifest.signing!.publicKeyUrl ?? `/keys/${manifest.signing!.keyId}.pub`;
     const keyRes = await getText(keyUrl);
-    expect(keyRes.status, `public key MUST be retrievable at ${keyUrl}`).toBe(200);
+    expect(keyRes.status, req('openwop.it.registry-public.tarball-sig-public-key-all-retrievable-sri-matches-ed25519-verifies-for', 'spec/v1/registry-operations.md', `public key MUST be retrievable at ${keyUrl}`)).toBe(200);
     const publicKey = createPublicKey(keyRes.body);
 
     // 5. SRI integrity check: `sha256-<base64>=` MUST match a fresh
     //    sha256 of the tarball bytes per registry-operations.md.
     expect(manifest.integrity).toMatch(/^sha256-[A-Za-z0-9+/]+=*$/);
     const expectedSri = `sha256-${createHash('sha256').update(tarball.bytes).digest('base64')}`;
-    expect(expectedSri, 'SRI integrity in manifest MUST match a fresh sha256 of the tarball').toBe(
+    expect(expectedSri, req('openwop.it.registry-public.tarball-sig-public-key-all-retrievable-sri-matches-ed25519-verifies-for', 'spec/v1/registry-operations.md', 'SRI integrity in manifest MUST match a fresh sha256 of the tarball')).toBe(
       manifest.integrity,
     );
 
@@ -217,7 +218,7 @@ describe('registry-public: tarball + signature + Ed25519 verify roundtrip', () =
     if (method !== 'ed25519') return softSkip('blocked', 'precondition not met — `method !== \'ed25519\'` returned early (seam, prior step, or fixture unavailable)');
 
     const verified = cryptoVerify(null, tarball.bytes, publicKey, sig.bytes);
-    expect(verified, `Ed25519 signature over ${PACK_NAME}@${PACK_VERSION}.tgz MUST verify against ${manifest.signing!.keyId}`)
+    expect(verified, req('openwop.it.registry-public.tarball-sig-public-key-all-retrievable-sri-matches-ed25519-verifies-for', 'spec/v1/registry-operations.md', `Ed25519 signature over ${PACK_NAME}@${PACK_VERSION}.tgz MUST verify against ${manifest.signing!.keyId}`))
       .toBe(true);
   });
 });