@openwop/openwop-conformance 1.162.0 → 2.0.0-rc.0

package/src/scenarios/workload-identity-behavior.test.ts

@@ -37,6 +37,8 @@ import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const PROFILE = 'openwop-workload-identity';
 /**
@@ -88,7 +90,7 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
     const r = await resolve({ identity: { ...IDENTITY, audience: 'openwop-host' } });
     expect(
       r,
-      driver.describe(
+      req('openwop.it.workload-identity-behavior.the-seam-is-wired-or-the-requirement-is-blocked-rather-than-skipped', 
         'spec/v1/host-sample-test-seams.md §20',
         'a host advertising `auth.workloadIdentity` MUST expose the resolution seam. §A\'s ' +
           'requirements — verify, bind, resolve-before-authorize, fail closed — are invisible from ' +
@@ -102,21 +104,21 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
   it('a verified identity resolves to a principal', async () => {
     if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
     const r = await resolve({ identity: { ...IDENTITY, audience: 'openwop-host' } });
-    if (r === null) return;
-    expect(r.status, driver.describe('RFCS/0154 §A', 'a verified identity resolves')).toBe(200);
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
+    expect(r.status, req('openwop.it.workload-identity-behavior.a-verified-identity-resolves-to-a-principal', 'RFCS/0154 §A', 'a verified identity resolves')).toBe(200);
     const principalId = (r.json as { principalId?: string }).principalId;
-    expect(principalId, driver.describe('RFCS/0154 §A', 'resolution yields an OpenWOP principal')).toBeTruthy();
+    expect(principalId, req('openwop.it.workload-identity-behavior.a-verified-identity-resolves-to-a-principal', 'RFCS/0154 §A', 'resolution yields an OpenWOP principal')).toBeTruthy();
   });
 
   it('an identity for another audience is rejected', async () => {
     if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
     const r = await resolve({ identity: { ...IDENTITY, audience: 'some-other-host' }, expectedAudience: 'openwop-host' });
-    if (r === null) return;
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
     // The load-bearing negative. A host that echoes its input passes every
     // positive assertion; only this distinguishes a verifier from a passthrough.
     expect(
       r.status >= 400,
-      driver.describe(
+      req('openwop.it.workload-identity-behavior.an-identity-for-another-audience-is-rejected', 
         'RFCS/0154 §A + RFC 0147 R12',
         'an identity minted for another host, accepted here, is how a credential valid elsewhere ' +
           'becomes a credential valid here — the confused-deputy path this profile prevents',
@@ -140,10 +142,10 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
         },
       },
     });
-    if (r === null) return;
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
     expect(
       r.status >= 400,
-      driver.describe(
+      req('openwop.it.workload-identity-behavior.an-expired-delegation-is-rejected', 
         'RFCS/0154 §B',
         'a delegation without a live expiry is a standing grant, which is not what delegation means',
       ),
@@ -154,13 +156,13 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
   it('a failure is non-retriable and carries a closed reason code', async () => {
     if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
     const r = await resolve({ identity: { scheme: 'spiffe', subject: 'spiffe://example/unknown' } });
-    if (r === null || r.status < 400) return;
+    if (r === null || r.status < 400) return softSkip('blocked', 'precondition not met — `r === null || r.status < 400` returned early (seam, prior step, or fixture unavailable)');
     // canonical flat envelope: code = `error`, retriable = `details.retriable`
     // (the legacy nested `error.{code,retriable}` the §20 catalog prescribed until
     // 2026-08-16 is tolerated by the helpers for the deprecation window)
     expect(
       readRetriable(r.json),
-      driver.describe(
+      req('openwop.it.workload-identity-behavior.a-failure-is-non-retriable-and-carries-a-closed-reason-code', 
         'spec/v1/host-sample-test-seams.md §20',
         'an identity that does not resolve will not resolve on retry. Marking it retriable invites ' +
           'a caller to hammer a failing authorization path.',
@@ -168,19 +170,19 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
     ).toBe(false);
     expect(
       ['identity_unverified', 'identity_unresolvable', 'audience_mismatch', 'delegation_expired', 'sender_constraint_missing', 'delegation_chain_too_long', 'delegation_chain_cyclic', 'delegation_scope_amplified'],
-      driver.describe('RFCS/0154 §A', 'failures use a closed reason vocabulary'),
+      req('openwop.it.workload-identity-behavior.a-failure-is-non-retriable-and-carries-a-closed-reason-code', 'RFCS/0154 §A', 'failures use a closed reason vocabulary'),
     ).toContain(readErrorCode(r.json));
   });
 
   it('a resolution response carries no credential material', async () => {
     if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
     const r = await resolve({ identity: { ...IDENTITY, audience: 'openwop-host' } });
-    if (r === null) return;
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
     const serialized = JSON.stringify(r.json ?? {});
     for (const forbidden of ['-----BEGIN', 'Bearer ', 'eyJ']) {
       expect(
         serialized.includes(forbidden),
-        driver.describe(
+        req('openwop.it.workload-identity-behavior.a-resolution-response-carries-no-credential-material', 
           'RFCS/0154 §A',
           'a verified identity is a fact about a completed verification, not a container for the ' +
             `material that proved it. Found: ${forbidden}`,

package/src/scenarios/workload-identity-chain-bounds.test.ts

@@ -36,7 +36,8 @@ import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
-import { seamAbsent } from '../lib/soft-skip.js';
+import { seamAbsent, softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
 
 const DELEGATION_PROFILE = 'openwop-workload-identity-delegation';
 const SEAM = '/v1/host/sample/test/workload-identity/resolve';
@@ -76,10 +77,10 @@ function hop(n: number, scopes?: readonly string[]): Record<string, unknown> {
 }
 
 /** A refusal: 4xx, non-retriable, the named closed reason. */
-function expectRefusal(r: { status: number; json: unknown }, reason: string, why: string): void {
-  expect(r.status >= 400, driver.describe('RFCS/0154 §B', why)).toBe(true);
-  expect(readErrorCode(r.json), driver.describe('spec/v1/host-sample-test-seams.md §20', `closed reason \`${reason}\``)).toBe(reason);
-  expect(readRetriable(r.json), driver.describe('spec/v1/host-sample-test-seams.md §20', 'a chain the host refuses will be refused on retry')).toBe(false);
+function expectRefusal(requirementId: string, r: { status: number; json: unknown }, reason: string, why: string): void {
+  expect(r.status >= 400, req(requirementId, 'RFCS/0154 §B', why)).toBe(true);
+  expect(readErrorCode(r.json), req(requirementId, 'spec/v1/host-sample-test-seams.md §20', `closed reason \`${reason}\``)).toBe(reason);
+  expect(readRetriable(r.json), req(requirementId, 'spec/v1/host-sample-test-seams.md §20', 'a chain the host refuses will be refused on retry')).toBe(false);
 }
 
 describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)', () => {
@@ -88,13 +89,13 @@ describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)',
     if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
     expect(
       caps.maxChainDepth,
-      driver.describe('spec/v1/auth.md §Bounds', 'a host advertising delegation MUST advertise a positive integer `maxChainDepth`'),
+      req('openwop.it.workload-identity-chain-bounds.a-chain-longer-than-the-advertised-maxchaindepth-is-refused', 'spec/v1/auth.md §Bounds', 'a host advertising delegation MUST advertise a positive integer `maxChainDepth`'),
     ).not.toBeNull();
     const depth = caps.maxChainDepth as number;
     const chain = Array.from({ length: depth + 1 }, (_, i) => hop(i + 1));
     const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
-    if (r === null) return;
-    expectRefusal(r, 'delegation_chain_too_long', `a chain of ${depth + 1} hops exceeds the advertised bound of ${depth} — each hop is another party the host trusts transitively`);
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
+    expectRefusal('openwop.it.workload-identity-chain-bounds.a-chain-longer-than-the-advertised-maxchaindepth-is-refused', r, 'delegation_chain_too_long', `a chain of ${depth + 1} hops exceeds the advertised bound of ${depth} — each hop is another party the host trusts transitively`);
   });
 
   it('a chain that revisits a subject is refused as cyclic', async () => {
@@ -106,15 +107,15 @@ describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)',
     // and this leg accepts either reason, saying so.
     const chain = [hop(1), hop(2), hop(1)];
     const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
-    if (r === null) return;
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
     const bound = caps.maxChainDepth ?? Number.POSITIVE_INFINITY;
     if (bound < 3) {
-      expect(r.status >= 400, driver.describe('RFCS/0154 §B', 'a cyclic chain is refused')).toBe(true);
-      expect(['delegation_chain_cyclic', 'delegation_chain_too_long'], driver.describe('spec/v1/host-sample-test-seams.md §20', 'cyclic or too-long — the bound is below the cycle length')).toContain(readErrorCode(r.json));
+      expect(r.status >= 400, req('openwop.it.workload-identity-chain-bounds.a-chain-that-revisits-a-subject-is-refused-as-cyclic', 'RFCS/0154 §B', 'a cyclic chain is refused')).toBe(true);
+      expect(['delegation_chain_cyclic', 'delegation_chain_too_long'], req('openwop.it.workload-identity-chain-bounds.a-chain-that-revisits-a-subject-is-refused-as-cyclic', 'spec/v1/host-sample-test-seams.md §20', 'cyclic or too-long — the bound is below the cycle length')).toContain(readErrorCode(r.json));
       expect(readRetriable(r.json)).toBe(false);
-      return;
+      return softSkip('blocked', 'precondition not met — `bound < 3` returned early (seam, prior step, or fixture unavailable)');
     }
-    expectRefusal(r, 'delegation_chain_cyclic', 'a subject appearing twice is a chain that loops back through authority it already spent — unbounded laundering with a bounded length');
+    expectRefusal('openwop.it.workload-identity-chain-bounds.a-chain-that-revisits-a-subject-is-refused-as-cyclic', r, 'delegation_chain_cyclic', 'a subject appearing twice is a chain that loops back through authority it already spent — unbounded laundering with a bounded length');
   });
 
   it('a later hop claiming a scope the previous hop did not hold is refused', async () => {
@@ -122,8 +123,8 @@ describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)',
     if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
     const chain = [hop(1, ['runs:read']), hop(2, ['runs:read', 'runs:write'])];
     const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
-    if (r === null) return;
-    expectRefusal(r, 'delegation_scope_amplified', 'the effective scopes at any hop MUST NOT exceed the hop before it — a chain is provenance, and provenance cannot mint `runs:write` from `runs:read`');
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
+    expectRefusal('openwop.it.workload-identity-chain-bounds.a-later-hop-claiming-a-scope-the-previous-hop-did-not-hold-is-refused', r, 'delegation_scope_amplified', 'the effective scopes at any hop MUST NOT exceed the hop before it — a chain is provenance, and provenance cannot mint `runs:write` from `runs:read`');
   });
 
   it('a well-formed bounded, acyclic, non-amplifying chain still resolves (the negatives are not a blanket refusal)', async () => {
@@ -131,11 +132,11 @@ describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)',
     if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
     const chain = [hop(1, ['runs:read', 'manifest:read']), hop(2, ['runs:read'])];
     const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
-    if (r === null) return;
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
     // A host that refuses EVERY chain passes the three negatives vacuously; this
     // is the positive that keeps them honest. Scopes narrow hop-to-hop, which
     // is the one direction §B permits.
-    expect(r.status, driver.describe('RFCS/0154 §B', 'a compliant chain resolves; the bounds refuse laundering, not delegation')).toBe(200);
+    expect(r.status, req('openwop.it.workload-identity-chain-bounds.a-well-formed-bounded-acyclic-non-amplifying-chain-still-resolves-the-negatives', 'RFCS/0154 §B', 'a compliant chain resolves; the bounds refuse laundering, not delegation')).toBe(200);
     expect((r.json as { resolved?: unknown }).resolved).toBe(true);
   });
 });

package/src/scenarios/workspace-behavior.test.ts

@@ -24,6 +24,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DiscoveryWorkspace {
   supported?: boolean;
@@ -54,26 +55,26 @@ describe('workspace-behavior: §C CRUD round-trip (RFC 0059)', () => {
     const path = 'behavior/CRUD.md';
 
     const created = await driver.put(`${FILES}/${encodeURIComponent(path)}`, { content: 'first body' });
-    expect(created.status, driver.describe('agent-workspace.md §C PUT', 'create MUST return 200')).toBe(200);
+    expect(created.status, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C PUT', 'create MUST return 200')).toBe(200);
     const file = created.json as WorkspaceFile;
-    expect(file.version, driver.describe('agent-workspace.md §File model', 'version MUST start at 1')).toBe(1);
-    expect(typeof file.etag, driver.describe('agent-workspace.md §File model', 'PUT MUST return an etag')).toBe('string');
+    expect(file.version, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §File model', 'version MUST start at 1')).toBe(1);
+    expect(typeof file.etag, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §File model', 'PUT MUST return an etag')).toBe('string');
 
     const got = await driver.get(`${FILES}/${encodeURIComponent(path)}`);
-    expect((got.json as WorkspaceFile).content, driver.describe('agent-workspace.md §C GET', 'GET MUST return the content')).toBe('first body');
+    expect((got.json as WorkspaceFile).content, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C GET', 'GET MUST return the content')).toBe('first body');
 
     const list = await driver.get(FILES);
     const rows = (list.json as { files?: WorkspaceFile[] }).files ?? [];
     const row = rows.find((r) => r.path === path);
-    expect(row, driver.describe('agent-workspace.md §C list', 'list MUST include the created file')).toBeDefined();
-    expect('content' in (row as object), driver.describe('agent-workspace.md §C list', 'list MUST NOT include file bodies (metadata only)')).toBe(false);
+    expect(row, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C list', 'list MUST include the created file')).toBeDefined();
+    expect('content' in (row as object), req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C list', 'list MUST NOT include file bodies (metadata only)')).toBe(false);
 
     const del = await driver.del(`${FILES}/${encodeURIComponent(path)}`);
-    expect(del.status, driver.describe('agent-workspace.md §C DELETE', 'DELETE MUST return 2xx')).toBeGreaterThanOrEqual(200);
-    expect(del.status, 'DELETE MUST be < 300').toBeLessThan(300);
+    expect(del.status, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C DELETE', 'DELETE MUST return 2xx')).toBeGreaterThanOrEqual(200);
+    expect(del.status, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C DELETE', 'DELETE MUST be < 300')).toBeLessThan(300);
 
     const gone = await driver.get(`${FILES}/${encodeURIComponent(path)}`);
-    expect(gone.status, driver.describe('agent-workspace.md §C GET', 'GET after DELETE MUST be 404')).toBe(404);
+    expect(gone.status, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C GET', 'GET after DELETE MUST be 404')).toBe(404);
   });
 });
 
@@ -86,14 +87,14 @@ describe('workspace-behavior: §C optimistic concurrency (RFC 0059)', () => {
     const etag = (v1.json as WorkspaceFile).etag!;
 
     const stale = await driver.put(`${FILES}/${encodeURIComponent(path)}`, { content: 'nope' }, { headers: { 'If-Match': '"definitely-stale"' } });
-    expect(stale.status, driver.describe('agent-workspace.md §C PUT', 'a stale If-Match MUST return 409 workspace_conflict')).toBe(409);
-    expect((stale.json as { error?: string }).error, driver.describe('rest-endpoints.md workspace_conflict', 'error code MUST be workspace_conflict')).toBe('workspace_conflict');
+    expect(stale.status, req('openwop.it.workspace-behavior.stale-if-match-409-workspace-conflict-matching-if-match-bumps-version', 'agent-workspace.md §C PUT', 'a stale If-Match MUST return 409 workspace_conflict')).toBe(409);
+    expect((stale.json as { error?: string }).error, req('openwop.it.workspace-behavior.stale-if-match-409-workspace-conflict-matching-if-match-bumps-version', 'rest-endpoints.md workspace_conflict', 'error code MUST be workspace_conflict')).toBe('workspace_conflict');
     const details = (stale.json as { details?: { currentVersion?: number } }).details;
-    expect(typeof details?.currentVersion, driver.describe('agent-workspace.md §C PUT', '409 MUST carry details.currentVersion')).toBe('number');
+    expect(typeof details?.currentVersion, req('openwop.it.workspace-behavior.stale-if-match-409-workspace-conflict-matching-if-match-bumps-version', 'agent-workspace.md §C PUT', '409 MUST carry details.currentVersion')).toBe('number');
 
     const v2 = await driver.put(`${FILES}/${encodeURIComponent(path)}`, { content: 'v2' }, { headers: { 'If-Match': etag } });
-    expect(v2.status, 'a matching If-Match MUST succeed').toBe(200);
-    expect((v2.json as WorkspaceFile).version, driver.describe('agent-workspace.md §File model', 'a successful PUT MUST bump version')).toBe(2);
+    expect(v2.status, req('openwop.it.workspace-behavior.stale-if-match-409-workspace-conflict-matching-if-match-bumps-version', 'agent-workspace.md §C PUT', 'a matching If-Match MUST succeed')).toBe(200);
+    expect((v2.json as WorkspaceFile).version, req('openwop.it.workspace-behavior.stale-if-match-409-workspace-conflict-matching-if-match-bumps-version', 'agent-workspace.md §File model', 'a successful PUT MUST bump version')).toBe(2);
 
     await driver.del(`${FILES}/${encodeURIComponent(path)}`);
   });
@@ -106,8 +107,8 @@ describe('workspace-behavior: §C size ceiling (RFC 0059)', () => {
     const max = typeof cap.maxFileBytes === 'number' ? cap.maxFileBytes : 1_048_576;
     const tooBig = 'x'.repeat(max + 1);
     const res = await driver.put(`${FILES}/${encodeURIComponent('behavior/TOOBIG.md')}`, { content: tooBig });
-    expect(res.status, driver.describe('agent-workspace.md §C PUT', 'oversize content MUST be rejected (4xx)')).toBeGreaterThanOrEqual(400);
-    expect((res.json as { error?: string }).error, driver.describe('rest-endpoints.md workspace_too_large', 'error code MUST be workspace_too_large')).toBe('workspace_too_large');
+    expect(res.status, req('openwop.it.workspace-behavior.content-beyond-maxfilebytes-returns-workspace-too-large', 'agent-workspace.md §C PUT', 'oversize content MUST be rejected (4xx)')).toBeGreaterThanOrEqual(400);
+    expect((res.json as { error?: string }).error, req('openwop.it.workspace-behavior.content-beyond-maxfilebytes-returns-workspace-too-large', 'rest-endpoints.md workspace_too_large', 'error code MUST be workspace_too_large')).toBe('workspace_too_large');
   });
 });
 
@@ -124,10 +125,10 @@ describe('workspace-behavior: §D run-start snapshot (RFC 0059)', () => {
 
     const snap = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
     const ws = (snap.json as { workspace?: Array<{ path: string }> }).workspace;
-    if (ws === undefined) return; // host doesn't expose the snapshot field — skip
+    if (ws === undefined) return softSkip('blocked', 'precondition not met — `ws === undefined` returned early (host doesn\'t expose the snapshot field — skip) (seam, prior step, or fixture unavailable)'); // host doesn't expose the snapshot field — skip
     expect(
       ws.some((f) => f.path === path),
-      driver.describe('agent-workspace.md §D', 'the run snapshot MUST reflect a workspace file present at run start'),
+      req('openwop.it.workspace-behavior.a-run-started-after-a-write-exposes-the-workspace-snapshot', 'agent-workspace.md §D', 'the run snapshot MUST reflect a workspace file present at run start'),
     ).toBe(true);
 
     await driver.del(`${FILES}/${encodeURIComponent(path)}`);

package/src/scenarios/workspace-capability-shape.test.ts

@@ -25,6 +25,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DiscoveryWorkspace {
   supported?: boolean;
@@ -52,7 +53,7 @@ describe('workspace-capability-shape: advertisement shape (RFC 0059 §A)', () =>
     if (ws === null) return softSkip('inapplicable', 'optional advertisement — `capabilities.workspace` not advertised by this host (RFC 0059 §A)');
     expect(
       typeof ws.supported,
-      driver.describe(
+      req('openwop.it.workspace-capability-shape.capabilities-workspace-is-either-absent-or-well-formed', 
         'capabilities.schema.json §workspace',
         'capabilities.workspace.supported MUST be a boolean when workspace is advertised',
       ),
@@ -67,7 +68,7 @@ describe('workspace-capability-shape: advertisement shape (RFC 0059 §A)', () =>
       if (v === undefined) continue;
       expect(
         Number.isInteger(v) && v >= 1,
-        driver.describe('RFC 0059 §A', `capabilities.workspace.${field} MUST be an integer >= 1, got: ${v}`),
+        req('openwop.it.workspace-capability-shape.maxfilebytes-maxfiles-maxversions-are-positive-integers-when-present', 'RFC 0059 §A', `capabilities.workspace.${field} MUST be an integer >= 1, got: ${v}`),
       ).toBe(true);
     }
   });

package/src/scenarios/workspace-cross-tenant-isolation-blackbox.test.ts

@@ -28,6 +28,7 @@ import { softSkip } from '../lib/soft-skip.js';
 import { randomUUID } from 'node:crypto';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DiscoveryDoc {
   workspace?: { supported?: boolean };
@@ -55,18 +56,18 @@ describe('workspace-cross-tenant-isolation (black-box): a §C file MUST NOT leak
 
     // Owner A (default credential) writes the file via the NORMATIVE PUT.
     const put = await driver.put(`/v1/host/workspace/files/${path}`, { content: secret });
-    expect(put.status, driver.describe('agent-workspace.md §C PUT', 'the owning workspace MUST create its file (200)')).toBe(200);
+    expect(put.status, req('openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent', 'agent-workspace.md §C PUT', 'the owning workspace MUST create its file (200)')).toBe(200);
 
     try {
       // Owner B (second-tenant credential) MUST NOT read it — fail closed, no existence leak.
       const crossRead = await driver.get(`/v1/host/workspace/files/${path}`, asTenantB);
       expect(
         crossRead.status === 404 || crossRead.status === 403,
-        driver.describe('agent-workspace.md §E WCT-1', `a second-tenant read MUST fail closed (404/403), got ${crossRead.status}`),
+        req('openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent', 'agent-workspace.md §E WCT-1', `a second-tenant read MUST fail closed (404/403), got ${crossRead.status}`),
       ).toBe(true);
       expect(
         !JSON.stringify(crossRead.json ?? '').includes(secret),
-        driver.describe('agent-workspace.md §E WCT-1', 'a second-tenant read MUST NOT surface the owner\'s content'),
+        req('openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent', 'agent-workspace.md §E WCT-1', 'a second-tenant read MUST NOT surface the owner\'s content'),
       ).toBe(true);
 
       // Owner B MUST NOT enumerate it in the list projection.
@@ -74,13 +75,13 @@ describe('workspace-cross-tenant-isolation (black-box): a §C file MUST NOT leak
       if (crossList.status === 200) {
         expect(
           !JSON.stringify((crossList.json as { files?: unknown })?.files ?? []).includes(path),
-          driver.describe('agent-workspace.md §E WCT-1', 'a second-tenant list MUST NOT enumerate the owner\'s path'),
+          req('openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent', 'agent-workspace.md §E WCT-1', 'a second-tenant list MUST NOT enumerate the owner\'s path'),
         ).toBe(true);
       }
 
       // Isolation, not loss: owner A still reads its own file.
       const ownerRead = await driver.get(`/v1/host/workspace/files/${path}`);
-      expect(ownerRead.status, driver.describe('agent-workspace.md §C GET', 'the owning workspace MUST still read its own file')).toBe(200);
+      expect(ownerRead.status, req('openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent', 'agent-workspace.md §C GET', 'the owning workspace MUST still read its own file')).toBe(200);
       expect((ownerRead.json as { content?: string } | undefined)?.content).toBe(secret);
     } finally {
       // Best-effort cleanup as owner A.

package/src/scenarios/workspace-cross-tenant-isolation.test.ts

@@ -22,6 +22,7 @@ import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DiscoveryDoc {
   capabilities?: { workspace?: { supported?: boolean } };
@@ -46,25 +47,25 @@ describe('workspace-cross-tenant-isolation: a workspace file MUST NOT leak acros
     // Owner A writes a file.
     const put = await seam({ tenant: 'wct1-tenant-a', workspace: 'ws-a', op: 'put', path: SEAM_PATH, content: 'A-only secret body' });
     if (put.status === 404) return softSkip('blocked', 'seam unwired — soft-skip the behavioral probe');
-    expect(put.status, driver.describe('agent-workspace.md §C PUT', 'seam put MUST succeed for the owning workspace')).toBe(200);
+    expect(put.status, req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §C PUT', 'seam put MUST succeed for the owning workspace')).toBe(200);
 
     // A DIFFERENT workspace (same tenant) MUST NOT read it.
     const crossWs = await seam({ tenant: 'wct1-tenant-a', workspace: 'ws-b', op: 'get', path: SEAM_PATH });
     expect(
       crossWs.status === 404 || crossWs.status === 403,
-      driver.describe('agent-workspace.md §E WCT-1', `a cross-workspace get MUST fail closed (404/403, no existence leak), got ${crossWs.status}`),
+      req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §E WCT-1', `a cross-workspace get MUST fail closed (404/403, no existence leak), got ${crossWs.status}`),
     ).toBe(true);
     const crossWsBody = JSON.stringify(crossWs.json ?? '');
     expect(
       !crossWsBody.includes('A-only secret body'),
-      driver.describe('agent-workspace.md §E WCT-1', 'a cross-workspace read MUST NOT surface the other owner\'s content'),
+      req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §E WCT-1', 'a cross-workspace read MUST NOT surface the other owner\'s content'),
     ).toBe(true);
 
     // A DIFFERENT tenant MUST NOT read it either.
     const crossTenant = await seam({ tenant: 'wct1-tenant-b', workspace: 'ws-a', op: 'get', path: SEAM_PATH });
     expect(
       crossTenant.status === 404 || crossTenant.status === 403,
-      driver.describe('agent-workspace.md §E WCT-1', `a cross-tenant get MUST fail closed, got ${crossTenant.status}`),
+      req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §E WCT-1', `a cross-tenant get MUST fail closed, got ${crossTenant.status}`),
     ).toBe(true);
 
     // And list MUST NOT enumerate the other owner's path.
@@ -72,14 +73,14 @@ describe('workspace-cross-tenant-isolation: a workspace file MUST NOT leak acros
     const listed = JSON.stringify((crossList.json as { files?: unknown })?.files ?? []);
     expect(
       !listed.includes(SEAM_PATH),
-      driver.describe('agent-workspace.md §E WCT-1', 'a cross-workspace list MUST NOT enumerate another owner\'s file'),
+      req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §E WCT-1', 'a cross-workspace list MUST NOT enumerate another owner\'s file'),
     ).toBe(true);
 
     // Sanity: the owner itself still reads its file (isolation, not loss).
     const ownerRead = await seam({ tenant: 'wct1-tenant-a', workspace: 'ws-a', op: 'get', path: SEAM_PATH });
     expect(
       (ownerRead.json as { content?: string } | undefined)?.content,
-      driver.describe('agent-workspace.md §C GET', 'the owning workspace MUST still read its own file'),
+      req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §C GET', 'the owning workspace MUST still read its own file'),
     ).toBe('A-only secret body');
   });
 });

package/src/scenarios/x-openwop-form-pack-manifest.test.ts

@@ -38,6 +38,7 @@ import { describe, it, expect } from 'vitest';
 import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import type { ErrorObject } from 'ajv';
+import { req } from '../lib/requirement-ids.js';
 
 /** The §A `x-openwop-form` annotation shape. `kind` is the only required
  *  field; it is an OPEN string (unknown kinds are valid per the forward-compat
@@ -103,11 +104,11 @@ describe('category: x-openwop-form pack-manifest shape (RFC 0066)', () => {
     let validateConfig: ReturnType<typeof ajv.compile> | undefined;
     expect(() => {
       validateConfig = ajv.compile(annotatedConfigSchema());
-    }, 'node-packs.md §x-openwop-form: an annotated configSchema MUST remain a valid 2020-12 schema').not.toThrow();
+    }, req('openwop.it.x-openwop-form-pack-manifest.positive-a-configschema-carrying-x-openwop-form-remains-a-valid-json-schema-2020', 'node-packs.md', 'node-packs.md §x-openwop-form: an annotated configSchema MUST remain a valid 2020-12 schema')).not.toThrow();
     // The annotations do not alter schema semantics: valid config passes…
     expect(
       validateConfig!({ provider: 'anthropic', model: 'claude', temperature: 1 }),
-      'x-openwop-form is advisory — it MUST NOT change what the schema accepts',
+      req('openwop.it.x-openwop-form-pack-manifest.positive-a-configschema-carrying-x-openwop-form-remains-a-valid-json-schema-2020', 'node-packs.md', 'x-openwop-form is advisory — it MUST NOT change what the schema accepts'),
     ).toBe(true);
     // …and a type violation on an annotated field still rejects.
     expect(validateConfig!({ provider: 123 })).toBe(false);
@@ -120,7 +121,7 @@ describe('category: x-openwop-form pack-manifest shape (RFC 0066)', () => {
       if (ann === undefined) continue;
       expect(
         validateShape(ann),
-        `node-packs.md §x-openwop-form: the annotation on "${name}" MUST match the §A shape. Errors: ${JSON.stringify(validateShape.errors)}`,
+        req('openwop.it.x-openwop-form-pack-manifest.positive-each-documented-x-openwop-form-annotation-matches-the-a-shape', 'node-packs.md', `node-packs.md §x-openwop-form: the annotation on "${name}" MUST match the §A shape. Errors: ${JSON.stringify(validateShape.errors)}`),
       ).toBe(true);
     }
   });
@@ -128,28 +129,28 @@ describe('category: x-openwop-form pack-manifest shape (RFC 0066)', () => {
   it('forward-compat: an unknown kind is a structurally valid annotation (renderer falls back per the §A MUST)', () => {
     expect(
       validateShape({ kind: 'unknown-future-picker' }),
-      'node-packs.md §x-openwop-form: an unknown kind MUST validate (kind is an open string, not a closed enum) so future vocabulary is forward-compatible',
+      req('openwop.it.x-openwop-form-pack-manifest.forward-compat-an-unknown-kind-is-a-structurally-valid-annotation-renderer-falls', 'node-packs.md', 'node-packs.md §x-openwop-form: an unknown kind MUST validate (kind is an open string, not a closed enum) so future vocabulary is forward-compatible'),
     ).toBe(true);
   });
 
   it('negative: an annotation missing kind is rejected', () => {
     expect(
       shapeFailsWith({ dependsOn: 'provider' }, 'required').length,
-      'node-packs.md §x-openwop-form: kind is the one REQUIRED sub-field',
+      req('openwop.it.x-openwop-form-pack-manifest.negative-an-annotation-missing-kind-is-rejected', 'node-packs.md', 'node-packs.md §x-openwop-form: kind is the one REQUIRED sub-field'),
     ).toBeGreaterThan(0);
   });
 
   it('negative: a non-string kind is rejected', () => {
     expect(
       shapeFailsWith({ kind: 42 }, 'type').length,
-      'node-packs.md §x-openwop-form: kind MUST be a string',
+      req('openwop.it.x-openwop-form-pack-manifest.negative-a-non-string-kind-is-rejected', 'node-packs.md', 'node-packs.md §x-openwop-form: kind MUST be a string'),
     ).toBeGreaterThan(0);
   });
 
   it('negative: a non-string dependsOn is rejected', () => {
     expect(
       shapeFailsWith({ kind: 'model-picker', dependsOn: ['provider'] }, 'type').length,
-      'node-packs.md §x-openwop-form: dependsOn names a sibling property — it MUST be a string',
+      req('openwop.it.x-openwop-form-pack-manifest.negative-a-non-string-dependson-is-rejected', 'node-packs.md', 'node-packs.md §x-openwop-form: dependsOn names a sibling property — it MUST be a string'),
     ).toBeGreaterThan(0);
   });
 });

package/src/setup.ts

@@ -292,7 +292,8 @@ afterEach(({ task }) => {
   // which prove fixtures and helpers, not a host, and must never become bundle
   // evidence (that is why RFC 0163 G5 / RFC 0050 G1 moved them out of scenarios).
   const filepath = (task as { file?: { filepath?: string } }).file?.filepath ?? '';
-  if (!/[\\/]src[\\/]scenarios[\\/]/.test(filepath)) {
+  // Suite 2.0.0: src/coherence/ rows feed the corpus ledger (scripts/check-spec-coherence.mjs), not a host bundle.
+  if (!/[\\/]src[\\/](scenarios|coherence)[\\/]/.test(filepath)) {
     takeExplicitRequirementId();
     return;
   }
@@ -304,7 +305,8 @@ afterEach(({ task }) => {
   const gate = since.find((e) => e.disposition === 'inapplicable') ?? since.find((e) => e.disposition === 'skipped');
   let disposition: 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
   let detail: string | undefined;
-  if (SPEC_COHERENCE_SCENARIOS.has(file) || SPEC_COHERENCE_SCENARIOS.has(file.replace(/\.test\.ts$/, ''))) {
+  // Suite 2.0.0: under the corpus gate (scripts/check-spec-coherence.mjs sets OPENWOP_CORPUS_GATE) a coherence scenario IS the subject; its rows are real dispositions for evidence/corpus-ledger.json.
+  if (process.env.OPENWOP_CORPUS_GATE !== '1' && (SPEC_COHERENCE_SCENARIOS.has(file) || SPEC_COHERENCE_SCENARIOS.has(file.replace(/\.test\.ts$/, '')))) {
     // Corpus-coherence scenario: it reads spec/v1 and asserts nothing about a
     // host, in any layout. Its rows are `inapplicable` to every host — the same
     // rule `resolveFileRecord` applies to the file in the published layout.

package/vitest.config.ts

@@ -6,7 +6,11 @@ export default defineConfig({
     // scenarios; `src/lib/**/*.test.ts` are server-free unit tests for
     // suite-internal helpers (e.g., the synthetic OIDC issuer harness)
     // that don't depend on OPENWOP_BASE_URL.
-    include: ['src/scenarios/**/*.test.ts', 'src/lib/**/*.test.ts'],
+    include: ['src/scenarios/**/*.test.ts'],
+    // Suite 2.0.0: the corpus-coherence scenarios (src/coherence/) and the suite
+    // self-tests (src/lib/*.test.ts) are NOT host scenarios; they run under
+    // vitest.coherence.config.ts (scripts/check-spec-coherence.mjs) and
+    // vitest.selftest.config.ts. A host run never executes them.
     testTimeout: 30_000,
     hookTimeout: 30_000,
     globals: true,

package/api/.redocly.lint-ignore.yaml

@@ -1,22 +0,0 @@
-# Scoped, documented exceptions to redocly's `no-ambiguous-paths` rule.
-# The rule stays ENABLED globally (it catches genuinely ambiguous new paths);
-# only the two known-safe occurrences below are exempted.
-#
-# Why these are safe (NOT merely tolerated):
-#   The rule flags the structural template/literal swap between
-#   `/v1/agents/{agentId}/deployments` and the sibling collection routes
-#   `/v1/agents/roster/{rosterId}` + `/v1/agents/org-chart/{departmentId}`
-#   (e.g. `/v1/agents/roster/deployments` could in principle parse two ways).
-#   It is resolved deterministically:
-#     1. `agentId` carries `pattern: '^(?!roster$|org-chart$).+$'` (see the two
-#        `/v1/agents/{agentId}*` paths), so `{agentId}` can NEVER be `roster` or
-#        `org-chart` — a pattern-aware validator/router cannot misroute.
-#     2. OpenAPI 3.x matching is concrete-before-templated, so `/v1/agents/roster/*`
-#        and `/v1/agents/org-chart/*` bind to the literal collection routes first.
-#   The paths are all normative (RFC 0072/0082/0086/0087), so they can't be
-#   renamed without a breaking change; the pattern is the non-breaking fix and
-#   redocly's purely-structural rule can't see it.
-openapi.yaml:
-  no-ambiguous-paths:
-    - '#/paths/~1v1~1agents~1roster~1{rosterId}'
-    - '#/paths/~1v1~1agents~1org-chart~1{departmentId}'