@openwop/openwop-conformance 1.163.0 → 2.0.0-rc.1

package/src/scenarios/certification-bundle-non-vacuous.test.ts

@@ -34,7 +34,8 @@ import {
   type BundleV2Like,
   type BundleV2Requirement,
 } from '../lib/certification-bundle-verify.js';
-import { UNCLASSIFIED_RETURN_DETAIL } from '../lib/soft-skip.js';
+import { UNCLASSIFIED_RETURN_DETAIL, softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED = 'server-free: verifies bundle documents built in-process; no host is contacted';
 
@@ -103,7 +104,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     const b = bundle(witnessedRows());
     expect(schemaValid(b), JSON.stringify(schemaValid.errors)).toBe(true);
     const v = verifyBundleV2(b);
-    expect(v.rejections).toEqual([]);
+    expect(v.rejections, req('openwop.it.certification-bundle-non-vacuous.valid-v2-every-required-row-witnessed-evidence-valid-and-certified-and-the-vecto', 'RFC 0148 §A/§C', 'valid-v2: every required row witnessed → evidence valid AND certified (and the vector is schema-valid)')).toEqual([]);
     expect(v.evidenceValid).toBe(true);
     expect(v.certified).toBe(true);
     const p = v.profiles.find((x) => x.profile === PROFILE);
@@ -115,7 +116,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     const rows = witnessedRows();
     rows[0] = { ...(rows[0] as BundleV2Requirement), assertionCount: 0 };
     const v = verifyBundleV2(bundle(rows));
-    expect(v.evidenceValid).toBe(false);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-non-vacuous.early-return-a-required-row-that-is-executed-pass-with-assertioncount-0-rejects', 'RFC 0148 §A/§C', 'early-return: a required row that is executed-pass with assertionCount 0 REJECTS the evidence')).toBe(false);
     expect(v.certified).toBe(false);
     const p = v.profiles[0];
     expect(p?.rejections.map((r) => r.kind)).toEqual(['vacuous-pass']);
@@ -127,7 +128,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     const { assertionCount: _drop, ...noCount } = rows[1] as BundleV2Requirement & { assertionCount: number };
     rows[1] = noCount;
     const v = verifyBundleV2(bundle(rows));
-    expect(v.evidenceValid).toBe(false);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-non-vacuous.early-return-no-count-at-all-an-executed-pass-with-no-assertioncount-is-unwitnes', 'RFC 0148 §A/§C', 'early-return (no count at all): an executed-pass with NO assertionCount is unwitnessed and REJECTS')).toBe(false);
     expect(v.profiles[0]?.rejections[0]?.kind).toBe('vacuous-pass');
   });
 
@@ -135,7 +136,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     const rows = witnessedRows();
     rows[0] = { requirementId: (rows[0] as BundleV2Requirement).requirementId, scenarioId: (rows[0] as BundleV2Requirement).scenarioId, disposition: 'blocked', detail: UNCLASSIFIED_RETURN_DETAIL, assertionCount: 0 };
     const v = verifyBundleV2(bundle(rows));
-    expect(v.evidenceValid).toBe(false);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-non-vacuous.the-emitter-s-a-resolution-of-a-silent-zero-assertion-file-blocked-marker-detail', 'RFC 0148 §A/§C', 'the emitter\'s §A resolution of a silent zero-assertion file (blocked + marker detail) on a required row REJECTS as unwitnessed')).toBe(false);
     expect(v.profiles[0]?.rejections.map((r) => r.kind)).toEqual(['unwitnessed-requirement']);
   });
 
@@ -143,7 +144,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     const rows = witnessedRows().slice(1); // drop the first floor row
     const dropped = requirementIdForScenario(floor().files[0] as string);
     const v = verifyBundleV2(bundle(rows));
-    expect(v.evidenceValid).toBe(false);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-non-vacuous.missing-floor-a-required-requirement-with-no-row-at-all-rejects-unwitnessed-neve', 'RFC 0148 §A/§C', 'missing-floor: a required requirement with no row at all REJECTS (unwitnessed), never "not certified"')).toBe(false);
     const rej = v.profiles[0]?.rejections ?? [];
     expect(rej.map((r) => r.kind)).toEqual(['unwitnessed-requirement']);
     expect(rej[0]?.requirementId).toBe(dropped);
@@ -153,10 +154,10 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
 
   it('missing prefix witness: no `interrupt-*` scenario row and no summary row REJECTS the prefix requirement', () => {
     const { prefixes } = floor();
-    if (prefixes.length === 0) return; // floor without a prefix requirement — nothing to assert here
+    if (prefixes.length === 0) return softSkip('blocked', 'precondition not met — `prefixes.length === 0` returned early (floor without a prefix requirement — nothing to assert here) (seam, prior step, or fixture unavailable)'); // floor without a prefix requirement — nothing to assert here
     const rows = witnessedRows().filter((r) => !prefixes.some((p) => r.scenarioId.startsWith(p)));
     const v = verifyBundleV2(bundle(rows));
-    expect(v.evidenceValid).toBe(false);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-non-vacuous.missing-prefix-witness-no-interrupt-scenario-row-and-no-summary-row-rejects-the', 'RFC 0148 §A/§C', 'missing prefix witness: no `interrupt-*` scenario row and no summary row REJECTS the prefix requirement')).toBe(false);
     expect(v.profiles[0]?.rejections.some((r) => r.kind === 'unwitnessed-requirement' && r.requirementId === requirementIdForPrefix(prefixes[0] as string))).toBe(true);
   });
 
@@ -164,7 +165,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     const rows = witnessedRows();
     rows.push({ ...(rows[0] as BundleV2Requirement) });
     const v = verifyBundleV2(bundle(rows));
-    expect(v.evidenceValid).toBe(false);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-non-vacuous.duplicate-requirement-two-rows-for-one-requirement-rejects-exactly-one-dispositi', 'RFC 0148 §A/§C', 'duplicate-requirement: two rows for one requirement REJECTS (exactly one disposition per requirement)')).toBe(false);
     expect(v.rejections.map((r) => r.kind)).toContain('duplicate-requirement');
   });
 
@@ -173,7 +174,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     const b = bundle(rows);
     const tampered = { ...b, results: { ...b.results, totals: { ...b.results.totals, blocked: 0, executedPass: b.results.totals.executedPass + 1 } } };
     const v = verifyBundleV2(tampered);
-    expect(v.evidenceValid).toBe(false);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-non-vacuous.tampered-witness-totals-that-disagree-with-the-rows-reject-a-hand-edited-count-i', 'RFC 0148 §A/§C', 'tampered-witness: totals that disagree with the rows REJECT — a hand-edited count is not a witness')).toBe(false);
     expect(v.rejections.map((r) => r.kind)).toEqual(['totals-mismatch']);
   });
 
@@ -181,7 +182,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     const rows = witnessedRows();
     rows[0] = { ...(rows[0] as BundleV2Requirement), disposition: 'passed' };
     const v = verifyBundleV2(bundle(rows));
-    expect(v.rejections.some((r) => r.kind === 'unknown-disposition')).toBe(true);
+    expect(v.rejections.some((r) => r.kind === 'unknown-disposition'), req('openwop.it.certification-bundle-non-vacuous.tampered-witness-an-invented-disposition-name-rejects', 'RFC 0148 §A/§C', 'tampered-witness: an invented disposition name REJECTS')).toBe(true);
     expect(v.evidenceValid).toBe(false);
   });
 
@@ -189,7 +190,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     const rows = witnessedRows();
     rows[0] = { requirementId: (rows[0] as BundleV2Requirement).requirementId, scenarioId: (rows[0] as BundleV2Requirement).scenarioId, disposition: 'blocked' };
     const v = verifyBundleV2(bundle(rows));
-    expect(v.rejections.map((r) => r.kind)).toContain('reason-missing');
+    expect(v.rejections.map((r) => r.kind), req('openwop.it.certification-bundle-non-vacuous.a-non-pass-without-a-reason-rejects-rfc-0148-a-anything-other-than-executed-pass', 'RFC 0148 §A', 'a non-pass without a reason REJECTS (RFC 0148 §A: anything other than executed-pass says why)')).toContain('reason-missing');
   });
 
   it('blocked-floor: an HONEST blocked row on a required requirement is VALID evidence that does NOT certify', () => {
@@ -197,7 +198,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     rows[0] = { ...(rows[0] as BundleV2Requirement), disposition: 'blocked', detail: 'seam unreachable from this runner (host-callback)' };
     delete (rows[0] as { assertionCount?: number }).assertionCount;
     const v = verifyBundleV2(bundle(rows));
-    expect(v.rejections).toEqual([]);
+    expect(v.rejections, req('openwop.it.certification-bundle-non-vacuous.blocked-floor-an-honest-blocked-row-on-a-required-requirement-is-valid-evidence', 'RFC 0148 §A/§C', 'blocked-floor: an HONEST blocked row on a required requirement is VALID evidence that does NOT certify')).toEqual([]);
     expect(v.evidenceValid).toBe(true);
     expect(v.certified).toBe(false);
     expect(v.profiles[0]?.notCertifiable).toEqual([(rows[0] as BundleV2Requirement).requirementId]);
@@ -207,7 +208,7 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     const rows = witnessedRows();
     rows[2] = { ...(rows[2] as BundleV2Requirement), disposition: 'executed-fail', detail: 'assertion failed against target', assertionCount: 4 };
     const v = verifyBundleV2(bundle(rows));
-    expect(v.evidenceValid).toBe(true);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-non-vacuous.executed-fail-on-a-required-row-valid-evidence-not-certified', 'RFC 0148 §A/§C', 'executed-fail on a required row: valid evidence, not certified')).toBe(true);
     expect(v.certified).toBe(false);
   });
 
@@ -216,14 +217,14 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
     rows[0] = { requirementId: (rows[0] as BundleV2Requirement).requirementId, scenarioId: (rows[0] as BundleV2Requirement).scenarioId, disposition: 'inapplicable', detail: 'profile not advertised in the captured discovery set', assertionCount: 0 };
     rows[1] = { requirementId: (rows[1] as BundleV2Requirement).requirementId, scenarioId: (rows[1] as BundleV2Requirement).scenarioId, disposition: 'skipped', detail: 'operator opted the profile out (OPENWOP_OPTED_OUT_PROFILES)' };
     const v = verifyBundleV2(bundle(rows));
-    expect(v.evidenceValid).toBe(true);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-non-vacuous.inapplicable-skipped-with-a-reason-on-a-required-row-certifies-rfc-0148-a-certif', 'RFC 0148 §A', 'inapplicable / skipped with a reason on a required row certifies (RFC 0148 §A CERTIFIABLE set)')).toBe(true);
     expect(v.certified).toBe(true);
   });
 
   it('a claim the discovery document does not derive is not certified even with perfect rows (RFC 0089 §B(1))', () => {
     const b = bundle(witnessedRows(), { discovery: { document: { protocolVersion: '1.0' } } });
     const v = verifyBundleV2(b);
-    expect(v.evidenceValid).toBe(true);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-non-vacuous.a-claim-the-discovery-document-does-not-derive-is-not-certified-even-with-perfec', 'RFC 0089 §B(1', 'a claim the discovery document does not derive is not certified even with perfect rows (RFC 0089 §B(1))')).toBe(true);
     expect(v.profiles[0]?.derivable).toBe(false);
     expect(v.certified).toBe(false);
   });
@@ -231,19 +232,19 @@ describe('RFC 0148 §A/§C — certification-bundle-non-vacuous (consumer re-der
   it('a claimed profile with NO defined floor is unprovable — floorUnspecified, never certified (G6)', () => {
     const b = bundle(witnessedRows(), { claimedProfiles: ['openwop-not-a-profile'] });
     const v = verifyBundleV2(b);
-    expect(v.profiles[0]?.floorUnspecified).toBe(true);
+    expect(v.profiles[0]?.floorUnspecified, req('openwop.it.certification-bundle-non-vacuous.a-claimed-profile-with-no-defined-floor-is-unprovable-floorunspecified-never-cer', 'RFC 0148 §A/§C', 'a claimed profile with NO defined floor is unprovable — floorUnspecified, never certified (G6)')).toBe(true);
     expect(v.certified).toBe(false);
   });
 
   it('a discovery-only profile certifies on derivation alone (RFC 0155 §A: openwop-discovery-core)', () => {
     const b = bundle(witnessedRows(), { claimedProfiles: ['openwop-discovery-core'] });
     const v = verifyBundleV2(b);
-    expect(v.certified).toBe(true);
+    expect(v.certified, req('openwop.it.certification-bundle-non-vacuous.a-discovery-only-profile-certifies-on-derivation-alone-rfc-0155-a-openwop-discov', 'RFC 0155 §A', 'a discovery-only profile certifies on derivation alone (RFC 0155 §A: openwop-discovery-core)')).toBe(true);
   });
 
   it('a v1 document handed to the v2 verifier is rejected as not-v2 rather than silently read', () => {
     const b = bundle(witnessedRows(), { bundleVersion: '1' });
     const v = verifyBundleV2(b);
-    expect(v.rejections.map((r) => r.kind)).toContain('not-v2');
+    expect(v.rejections.map((r) => r.kind), req('openwop.it.certification-bundle-non-vacuous.a-v1-document-handed-to-the-v2-verifier-is-rejected-as-not-v2-rather-than-silent', 'RFC 0148 §A/§C', 'a v1 document handed to the v2 verifier is rejected as not-v2 rather than silently read')).toContain('not-v2');
   });
 });

package/src/scenarios/certification-bundle-redaction.test.ts

@@ -42,6 +42,7 @@ import {
   type BundleV2Like,
   type BundleV2Requirement,
 } from '../lib/certification-bundle-verify.js';
+import { req } from '../lib/requirement-ids.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED = 'server-free: scrubs and verifies bundle documents built in-process; no host is contacted';
 
@@ -89,7 +90,7 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
     rs[0] = { ...(rs[0] as BundleV2Requirement), disposition: 'executed-fail', assertionCount: 3, detail: `401 body: {"error":"bad key ${API_KEY}"} (canary ${CONFORMANCE_SECRET_CANARY} echoed)` };
     const b = bundle(rs);
     const { value, redactedAt } = scrubEvidence(b, [API_KEY, CONFORMANCE_SECRET_CANARY]);
-    expect(findLiteral(value, API_KEY)).toEqual([]);
+    expect(findLiteral(value, API_KEY), req('openwop.it.certification-bundle-redaction.scrubevidence-replaces-every-occurrence-of-every-secret-in-nested-values-and-rep', 'RFC 0148 §C', 'scrubEvidence replaces every occurrence of every secret in nested values and reports where')).toEqual([]);
     expect(findLiteral(value, CONFORMANCE_SECRET_CANARY)).toEqual([]);
     expect(redactedAt).toEqual(['$.results.requirements[0].detail']);
     const detail = value.results.requirements[0]?.detail ?? '';
@@ -103,7 +104,7 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
   it('scrubs the captured discovery document and host self-description too — evidence is the WHOLE document', () => {
     const b = bundle(rows(), { name: 'h', version: '1', vendor: `acme (token ${API_KEY})` }, { ...DISCOVERY, ['x-host-debug']: { echo: CONFORMANCE_SECRET_CANARY } });
     const { value, redactedAt } = scrubEvidence(b, [API_KEY, CONFORMANCE_SECRET_CANARY]);
-    expect(findLiteral(value, API_KEY)).toEqual([]);
+    expect(findLiteral(value, API_KEY), req('openwop.it.certification-bundle-redaction.scrubs-the-captured-discovery-document-and-host-self-description-too-evidence-is', 'RFC 0148 §C', 'scrubs the captured discovery document and host self-description too — evidence is the WHOLE document')).toEqual([]);
     expect(findLiteral(value, CONFORMANCE_SECRET_CANARY)).toEqual([]);
     expect([...redactedAt].sort()).toEqual(['$.discovery.document.x-host-debug.echo', '$.host.vendor']);
   });
@@ -111,7 +112,7 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
   it('scrubs object KEYS as well as values — a secret used as a map key is still a secret', () => {
     const doc = { ...DISCOVERY, ['x-host-keys']: { [API_KEY]: 'tenant-a' } };
     const { value } = scrubEvidence(bundle(rows(), { name: 'h', version: '1' }, doc), [API_KEY]);
-    expect(findLiteral(value, API_KEY)).toEqual([]);
+    expect(findLiteral(value, API_KEY), req('openwop.it.certification-bundle-redaction.scrubs-object-keys-as-well-as-values-a-secret-used-as-a-map-key-is-still-a-secre', 'RFC 0148 §C', 'scrubs object KEYS as well as values — a secret used as a map key is still a secret')).toEqual([]);
     const keys = Object.keys((value.discovery.document as Record<string, Record<string, unknown>>)['x-host-keys'] ?? {});
     expect(keys).toEqual([redactionMarker(API_KEY)]);
   });
@@ -119,7 +120,7 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
   it('empty and whitespace-only secrets are ignored (scrubbing "" would blank every string)', () => {
     const b = bundle(rows());
     const { value, redactedAt } = scrubEvidence(b, ['', '   ']);
-    expect(value).toEqual(b);
+    expect(value, req('openwop.it.certification-bundle-redaction.empty-and-whitespace-only-secrets-are-ignored-scrubbing-would-blank-every-string', 'RFC 0148 §C', 'empty and whitespace-only secrets are ignored (scrubbing "" would blank every string)')).toEqual(b);
     expect(redactedAt).toEqual([]);
   });
 
@@ -127,12 +128,12 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
     const short = 'abc123';
     const long = 'abc123-longer-secret';
     const { value } = scrubEvidence({ detail: `x ${long} y ${short} z` }, [short, long]);
-    expect(value.detail).toBe(`x ${redactionMarker(long)} y ${redactionMarker(short)} z`);
+    expect(value.detail, req('openwop.it.certification-bundle-redaction.when-one-secret-is-a-prefix-of-another-the-longer-one-is-scrubbed-whole-no-parti', 'RFC 0148 §C', 'when one secret is a prefix of another the longer one is scrubbed whole (no partial marker inside a marker)')).toBe(`x ${redactionMarker(long)} y ${redactionMarker(short)} z`);
   });
 
   it('the redaction marker is stable, non-reversible, and does not contain the secret', () => {
     const m = redactionMarker(API_KEY);
-    expect(m).toBe(redactionMarker(API_KEY));
+    expect(m, req('openwop.it.certification-bundle-redaction.the-redaction-marker-is-stable-non-reversible-and-does-not-contain-the-secret', 'RFC 0148 §C', 'the redaction marker is stable, non-reversible, and does not contain the secret')).toBe(redactionMarker(API_KEY));
     expect(m).not.toContain(API_KEY);
     expect(m).toMatch(/^«redacted:[0-9a-f]{12}»$/);
     expect(redactionMarker('other')).not.toBe(m);
@@ -150,7 +151,7 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
       SOME_OTHER_TOKEN: 'not-ours',
     } as NodeJS.ProcessEnv;
     const secrets = evidenceSecretsFromEnv(env, [API_KEY, undefined, '']);
-    expect(secrets.sort()).toEqual([API_KEY, 'k1', 'p1', 's1', 't1', CONFORMANCE_SECRET_CANARY].sort());
+    expect(secrets.sort(), req('openwop.it.certification-bundle-redaction.evidencesecretsfromenv-selects-openwop-key-token-secret-password-variables-the-h', 'RFC 0148 §C', 'evidenceSecretsFromEnv selects OPENWOP_* key/token/secret/password variables, the handed credential, and ALWAYS the canary')).toEqual([API_KEY, 'k1', 'p1', 's1', 't1', CONFORMANCE_SECRET_CANARY].sort());
   });
 
   it('verifyBundleV2 REJECTS a bundle carrying the conformance canary anywhere, and accepts the scrubbed twin', () => {
@@ -158,7 +159,7 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
     rs[1] = { ...(rs[1] as BundleV2Requirement), detail: `resolved ${CONFORMANCE_SECRET_CANARY} in plain text` };
     const leaked = bundle(rs);
     const v = verifyBundleV2(leaked);
-    expect(v.evidenceValid).toBe(false);
+    expect(v.evidenceValid, req('openwop.it.certification-bundle-redaction.verifybundlev2-rejects-a-bundle-carrying-the-conformance-canary-anywhere-and-acc', 'RFC 0148 §C', 'verifyBundleV2 REJECTS a bundle carrying the conformance canary anywhere, and accepts the scrubbed twin')).toBe(false);
     expect(v.rejections.map((r) => r.kind)).toEqual(['secret-canary']);
     expect(v.rejections[0]?.detail).toContain('$.results.requirements[1].detail');
 
@@ -171,12 +172,12 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
   it('the canary in a discovery-document KEY is still a rejection (keys are evidence)', () => {
     const doc = { ...DISCOVERY, [`x-host-${CONFORMANCE_SECRET_CANARY}`]: true };
     const v = verifyBundleV2(bundle(rows(), { name: 'h', version: '1' }, doc));
-    expect(v.rejections.some((r) => r.kind === 'secret-canary')).toBe(true);
+    expect(v.rejections.some((r) => r.kind === 'secret-canary'), req('openwop.it.certification-bundle-redaction.the-canary-in-a-discovery-document-key-is-still-a-rejection-keys-are-evidence', 'RFC 0148 §C', 'the canary in a discovery-document KEY is still a rejection (keys are evidence)')).toBe(true);
   });
 
   it('the target-configuration digest is a digest: the API key is not a substring of any string in the document', () => {
     const b = bundle(rows());
-    expect((b as unknown as { targetConfigurationSha256: string }).targetConfigurationSha256).toMatch(/^[0-9a-f]{64}$/);
+    expect((b as unknown as { targetConfigurationSha256: string }).targetConfigurationSha256, req('openwop.it.certification-bundle-redaction.the-target-configuration-digest-is-a-digest-the-api-key-is-not-a-substring-of-an', 'RFC 0148 §C', 'the target-configuration digest is a digest: the API key is not a substring of any string in the document')).toMatch(/^[0-9a-f]{64}$/);
     expect(findLiteral(b, API_KEY)).toEqual([]);
   });
 });

package/src/scenarios/certification-bundle-v2.test.ts

@@ -30,6 +30,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import Ajv2020 from 'ajv/dist/2020.js';
 import { SCHEMAS_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
 
 const HEX = 'a'.repeat(64);
 
@@ -74,7 +75,7 @@ describe('RFC 0148 §C — certification bundle v2', () => {
   const validate = validator();
 
   it('a well-formed v2 bundle validates', () => {
-    expect(validate(bundle()), JSON.stringify(validate.errors)).toBe(true);
+    expect(validate(bundle()), req('openwop.it.certification-bundle-v2.a-well-formed-v2-bundle-validates', 'RFC 0148 §C', JSON.stringify(validate.errors))).toBe(true);
   });
 
   it('all five totals are required, including blocked', () => {
@@ -86,8 +87,8 @@ describe('RFC 0148 §C — certification bundle v2', () => {
       delete totals[missing];
       expect(
         validate(bundle({ results: { totals, requirements: bundle().results.requirements } })),
-        `RFC 0148 §C: \`${missing}\` MUST be present — an omitted total reads as zero without ` +
-          'anyone having asserted it',
+        req('openwop.it.certification-bundle-v2.all-five-totals-are-required-including-blocked', 'RFC 0148 §C', `RFC 0148 §C: \`${missing}\` MUST be present — an omitted total reads as zero without ` +
+          'anyone having asserted it'),
       ).toBe(false);
     }
   });
@@ -95,8 +96,8 @@ describe('RFC 0148 §C — certification bundle v2', () => {
   it('the requirement list cannot be empty', () => {
     expect(
       validate(bundle({ results: { totals: bundle().results.totals, requirements: [] } })),
-      'RFC 0148 §C: a bundle with no requirement rows records no execution. An empty evidence set ' +
-        'reading as proof is the defect this section exists to close.',
+      req('openwop.it.certification-bundle-v2.the-requirement-list-cannot-be-empty', 'RFC 0148 §C', 'RFC 0148 §C: a bundle with no requirement rows records no execution. An empty evidence set ' +
+        'reading as proof is the defect this section exists to close.'),
     ).toBe(false);
   });
 
@@ -107,7 +108,7 @@ describe('RFC 0148 §C — certification bundle v2', () => {
           totals: bundle().results.totals,
           requirements: [{ requirementId: 'x', scenarioId: 'y', disposition: 'probably-fine' }],
         },
-      })),
+      })), req('openwop.it.certification-bundle-v2.a-disposition-outside-the-a-vocabulary-is-rejected', 'RFC 0148 §C', 'a disposition outside the §A vocabulary is rejected'),
     ).toBe(false);
   });
 
@@ -127,14 +128,14 @@ describe('RFC 0148 §C — certification bundle v2', () => {
     const rows = (b.results as { requirements: { disposition: string; assertionCount?: number }[] }).requirements;
     expect(
       rows.some((r) => r.disposition === 'executed-pass' && r.assertionCount === 0),
-      'the vacuous shape MUST remain inspectable in the artifact — v1 could not express it at all',
+      req('openwop.it.certification-bundle-v2.a-vacuous-pass-is-representable-and-therefore-visible', 'RFC 0148 §C', 'the vacuous shape MUST remain inspectable in the artifact — v1 could not express it at all'),
     ).toBe(true);
   });
 
   it('claimed profiles use canonical IDs, not deprecated aliases', () => {
     // RFC 0155 §E. A badge substantiated by a name that no longer means what it
     // did is the `openwop-core` ambiguity in bundle form.
-    expect(validate(bundle({ claimedProfiles: ['openwop-core-standard'] }))).toBe(true);
+    expect(validate(bundle({ claimedProfiles: ['openwop-core-standard'] })), req('openwop.it.certification-bundle-v2.claimed-profiles-use-canonical-ids-not-deprecated-aliases', 'RFC 0148 §C', 'claimed profiles use canonical IDs, not deprecated aliases')).toBe(true);
     expect(validate(bundle({ claimedProfiles: ['Legacy Core'] }))).toBe(false);
     expect(validate(bundle({ claimedProfiles: [] }))).toBe(false);
   });
@@ -146,12 +147,12 @@ describe('RFC 0148 §C — certification bundle v2', () => {
     for (const field of ['scenarioManifestSha256', 'targetConfigurationSha256']) {
       const b = bundle() as Record<string, unknown>;
       delete b[field];
-      expect(validate(b), `RFC 0147 §A.4: ${field} MUST be present`).toBe(false);
+      expect(validate(b), req('openwop.it.certification-bundle-v2.provenance-digests-are-required-and-hex-shaped', 'RFC 0148 §C', `RFC 0147 §A.4: ${field} MUST be present`)).toBe(false);
     }
     expect(validate(bundle({ scenarioManifestSha256: 'not-a-digest' }))).toBe(false);
   });
 
   it('bundleVersion is pinned to 2', () => {
-    expect(validate(bundle({ bundleVersion: '1' })), 'a v1 bundle MUST NOT validate as v2').toBe(false);
+    expect(validate(bundle({ bundleVersion: '1' })), req('openwop.it.certification-bundle-v2.bundleversion-is-pinned-to-2', 'RFC 0148 §C', 'a v1 bundle MUST NOT validate as v2')).toBe(false);
   });
 });

package/src/scenarios/chain-compensation-expansion.test.ts

@@ -54,6 +54,7 @@ import {
   type ChainCompensationPolicy,
   type FragmentNodeCompensation,
 } from '../lib/workflow-chain-expansion.js';
+import { req } from '../lib/requirement-ids.js';
 
 function schema(name: string): Record<string, unknown> {
   return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as Record<string, unknown>;
@@ -131,7 +132,7 @@ describe('RFC 0157 — schema: the chain manifest mirrors the compensation shape
       $defs: { FragmentNode: { properties: Record<string, unknown> }; WorkflowChain: { properties: Record<string, unknown> } };
     };
     const wd = schema('workflow-definition.schema.json') as { $defs: { WorkflowNode: { properties: Record<string, unknown> } } };
-    expect(chainSchema.$defs.FragmentNode.properties['compensation'], 'FragmentNode MUST carry `compensation`').toBeDefined();
+    expect(chainSchema.$defs.FragmentNode.properties['compensation'], req('openwop.it.chain-compensation-expansion.fragmentnode-compensation-is-a-byte-mirror-of-workflownode-compensation', 'RFC 0157', 'FragmentNode MUST carry `compensation`')).toBeDefined();
     expect(stripDescription(chainSchema.$defs.FragmentNode.properties['compensation'])).toEqual(
       stripDescription(wd.$defs.WorkflowNode.properties['compensation']),
     );
@@ -140,14 +141,14 @@ describe('RFC 0157 — schema: the chain manifest mirrors the compensation shape
   it('WorkflowChain.compensation is a byte-mirror of compensation-policy.schema.json', () => {
     const chainSchema = schema('workflow-chain-pack-manifest.schema.json') as { $defs: { WorkflowChain: { properties: Record<string, unknown> } } };
     const policy = schema('compensation-policy.schema.json');
-    expect(chainSchema.$defs.WorkflowChain.properties['compensation'], 'WorkflowChain MUST carry the policy').toBeDefined();
+    expect(chainSchema.$defs.WorkflowChain.properties['compensation'], req('openwop.it.chain-compensation-expansion.workflowchain-compensation-is-a-byte-mirror-of-compensation-policy-schema-json', 'RFC 0157', 'WorkflowChain MUST carry the policy')).toBeDefined();
     expect(stripDescription(chainSchema.$defs.WorkflowChain.properties['compensation'])).toEqual(stripDescription(policy));
   });
 
   it('the manifest stays self-contained — no cross-file $ref was introduced', () => {
     const raw = readFileSync(join(SCHEMAS_DIR, 'workflow-chain-pack-manifest.schema.json'), 'utf8');
     const refs = [...raw.matchAll(/"\$ref":\s*"([^"]+)"/g)].map((m) => m[1]);
-    for (const r of refs) expect(r.startsWith('#/'), `cross-file $ref ${r} would break fixed-list validators downstream`).toBe(true);
+    for (const r of refs) expect(r.startsWith('#/'), req('openwop.it.chain-compensation-expansion.the-manifest-stays-self-contained-no-cross-file-ref-was-introduced', 'RFC 0157', `cross-file $ref ${r} would break fixed-list validators downstream`)).toBe(true);
   });
 
   it('a manifest declaring both surfaces validates; a foreign key inside either is rejected', () => {
@@ -155,13 +156,13 @@ describe('RFC 0157 — schema: the chain manifest mirrors the compensation shape
     expect(validate(manifestWith(CHAIN)), JSON.stringify(validate.errors)).toBe(true);
     const badNode = structuredClone(CHAIN) as unknown as { dag: { nodes: Array<Record<string, unknown>> } };
     (badNode.dag.nodes[0]!['compensation'] as Record<string, unknown>)['rollback'] = true;
-    expect(validate(manifestWith(badNode)), 'the mirrored node declaration MUST stay closed').toBe(false);
+    expect(validate(manifestWith(badNode)), req('openwop.it.chain-compensation-expansion.a-manifest-declaring-both-surfaces-validates-a-foreign-key-inside-either-is-reje', 'RFC 0157', 'the mirrored node declaration MUST stay closed')).toBe(false);
     const badPolicy = structuredClone(CHAIN) as unknown as { compensation: Record<string, unknown> };
     badPolicy.compensation['approvalScope'] = 'none';
-    expect(validate(manifestWith(badPolicy)), 'the mirrored policy keeps the escalate-only approval scope').toBe(false);
+    expect(validate(manifestWith(badPolicy)), req('openwop.it.chain-compensation-expansion.a-manifest-declaring-both-surfaces-validates-a-foreign-key-inside-either-is-reje', 'RFC 0157', 'the mirrored policy keeps the escalate-only approval scope')).toBe(false);
     const noTriggers = structuredClone(CHAIN) as unknown as { compensation: Record<string, unknown> };
     noTriggers.compensation = {};
-    expect(validate(manifestWith(noTriggers)), 'a policy without triggers is not a policy').toBe(false);
+    expect(validate(manifestWith(noTriggers)), req('openwop.it.chain-compensation-expansion.a-manifest-declaring-both-surfaces-validates-a-foreign-key-inside-either-is-reje', 'RFC 0157', 'a policy without triggers is not a policy')).toBe(false);
   });
 
   it('FragmentNode.irreversibleEffect (RFC 0151 UQ4) is a sibling boolean, mutually exclusive with compensation — in the manifest and in expansion', () => {
@@ -180,7 +181,7 @@ describe('RFC 0157 — schema: the chain manifest mirrors the compensation shape
     // Both on one node: the schema rejects it AND expansion refuses fail-closed before emitting.
     const both = structuredClone(CHAIN) as unknown as { dag: { nodes: Array<Record<string, unknown>> } };
     both.dag.nodes[0]!['irreversibleEffect'] = true; // node 0 (`reserve`) declares a compensation
-    expect(validate(manifestWith(both)), 'compensation.md §B: irreversibleEffect: true + compensation is contradictory').toBe(false);
+    expect(validate(manifestWith(both)), req('openwop.it.chain-compensation-expansion.fragmentnode-irreversibleeffect-rfc-0151-uq4-is-a-sibling-boolean-mutually-exclu', 'RFC 0151', 'compensation.md §B: irreversibleEffect: true + compensation is contradictory')).toBe(false);
     let thrown: unknown;
     try {
       expandChainWithCompensation(both as unknown as typeof CHAIN, CTX);
@@ -206,7 +207,7 @@ describe('RFC 0157 — expansion carries the declaration and the policy', () =>
     expect(reserve?.compensation?.inputMapping?.['reservationId']).toBe(`\${nodes.${reserve?.id}.output.id}`);
     expect(charge?.compensation?.inputMapping?.['chargeId']).toBe(`nodes.${charge?.id}.output.chargeId`);
     expect(charge?.compensation?.requiresApproval).toBe(true);
-    expect(notify?.compensation, 'a node that declared none gains none').toBeUndefined();
+    expect(notify?.compensation, req('openwop.it.chain-compensation-expansion.the-declaration-survives-verbatim-onto-the-expanded-node-params-substituted-node', 'RFC 0157', 'a node that declared none gains none')).toBeUndefined();
     // the mirrored core is untouched: plain expandChain still knows nothing of it
     const plain = expandChain(CHAIN, CTX);
     expect((plain.nodes[0] as { compensation?: unknown }).compensation).toBeUndefined();
@@ -220,7 +221,7 @@ describe('RFC 0157 — expansion carries the declaration and the policy', () =>
     const out = expandChainWithCompensation(chain, CTX);
     const nodes = out.nodes as ReadonlyArray<(typeof out.nodes)[number] & { compensation?: FragmentNodeCompensation }>;
     const reserve = nodes.find((n) => n.id.endsWith('_reserve'));
-    expect(reserve?.compensation?.inputMapping?.['parentRef']).toBe('${nodes.upstream-in-parent.output.x}');
+    expect(reserve?.compensation?.inputMapping?.['parentRef'], req('openwop.it.chain-compensation-expansion.a-reference-to-a-non-fragment-node-id-inside-inputmapping-passes-through-unchang', 'RFC 0157', 'a reference to a NON-fragment node id inside inputMapping passes through unchanged')).toBe('${nodes.upstream-in-parent.output.x}');
   });
 
   it('an unresolvable compensation.nodeTypeId fails with chain_unresolvable_typeid before any node is emitted', () => {
@@ -231,7 +232,7 @@ describe('RFC 0157 — expansion carries the declaration and the policy', () =>
     } catch (e) {
       thrown = e;
     }
-    expect(thrown).toBeInstanceOf(ChainUnresolvableTypeIdError);
+    expect(thrown, req('openwop.it.chain-compensation-expansion.an-unresolvable-compensation-nodetypeid-fails-with-chain-unresolvable-typeid-bef', 'RFC 0157', 'an unresolvable compensation.nodeTypeId fails with chain_unresolvable_typeid before any node is emitted')).toBeInstanceOf(ChainUnresolvableTypeIdError);
     expect((thrown as ChainUnresolvableTypeIdError).typeId).toBe('vendor.pay.refund');
     expect(String((thrown as Error).message)).toContain('chain_unresolvable_typeid');
   });
@@ -239,12 +240,12 @@ describe('RFC 0157 — expansion carries the declaration and the policy', () =>
   it('the chain policy becomes settings.compensation when the parent has none', () => {
     const out = expandChainWithCompensation(CHAIN, CTX);
     expect(out.settingsCompensation).toEqual(POLICY);
-    expect(out.settingsCompensation, 'a copy, not the same object').not.toBe(POLICY);
+    expect(out.settingsCompensation, req('openwop.it.chain-compensation-expansion.the-chain-policy-becomes-settings-compensation-when-the-parent-has-none', 'RFC 0157', 'a copy, not the same object')).not.toBe(POLICY);
   });
 
   it('a parent policy that is deep-equal (any key order) is accepted; a differing one is refused, never merged', () => {
     const sameOtherOrder: ChainCompensationPolicy = { approvalScope: 'declared', triggers: ['node-failure', 'run-cancel'] };
-    expect(expandChainWithCompensation(CHAIN, CTX, sameOtherOrder).settingsCompensation).toEqual(sameOtherOrder);
+    expect(expandChainWithCompensation(CHAIN, CTX, sameOtherOrder).settingsCompensation, req('openwop.it.chain-compensation-expansion.a-parent-policy-that-is-deep-equal-any-key-order-is-accepted-a-differing-one-is', 'RFC 0157', 'a parent policy that is deep-equal (any key order) is accepted; a differing one is refused, never merged')).toEqual(sameOtherOrder);
     const differs: ChainCompensationPolicy = { triggers: ['node-failure'] };
     let thrown: unknown;
     try {
@@ -262,7 +263,7 @@ describe('RFC 0157 — expansion carries the declaration and the policy', () =>
     for (const n of chain.dag.nodes as unknown as Array<{ compensation?: unknown }>) delete n.compensation;
     const parent: ChainCompensationPolicy = { triggers: ['operator-request'] };
     const withParent = expandChainWithCompensation(chain, CTX, parent);
-    expect(withParent.settingsCompensation).toBe(parent);
+    expect(withParent.settingsCompensation, req('openwop.it.chain-compensation-expansion.a-chain-with-no-policy-inherits-the-parent-policy-or-none-and-carries-no-declara', 'RFC 0157', 'a chain with no policy inherits the parent policy (or none) and carries no declaration it did not make')).toBe(parent);
     const nodes = withParent.nodes as ReadonlyArray<{ compensation?: unknown }>;
     expect(nodes.every((n) => n.compensation === undefined)).toBe(true);
     const withoutParent = carryCompensation(chain, expandChain(chain, CTX), CTX);

package/src/scenarios/chain-produced-var-roundtrip.test.ts

@@ -30,8 +30,7 @@ import {
   ProducedVarProducerUnknownError,
   type WorkflowChain,
 } from '../lib/workflow-chain-expansion.js';
-
-const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
+import { req } from '../lib/requirement-ids.js';
 const SPEC = 'workflow-chain-packs.md §"Produced (run-scoped) variables (RFC 0133)"';
 
 /** `generate` writes `plan`; `decompose` reads it via a variable binding. */
@@ -56,19 +55,19 @@ const PLAN_GEN: WorkflowChain = {
 describe('chain-produced-var-roundtrip: run-scoped variables (RFC 0133 §2, server-free)', () => {
   it('emits declared producedVariables into variables[] (name + type, NO value)', () => {
     const vars = emitProducedVariables(PLAN_GEN);
-    expect(vars, why(SPEC, '§2.3 — one run-scoped variable emitted')).toEqual([{ name: 'plan', type: 'object' }]);
+    expect(vars, req('openwop.it.chain-produced-var-roundtrip.emits-declared-producedvariables-into-variables-name-type-no-value', SPEC, '§2.3 — one run-scoped variable emitted')).toEqual([{ name: 'plan', type: 'object' }]);
     // Run-scoped: NO author-time value rides the emitted entry.
-    expect('value' in (vars[0] as object), why(SPEC, '§2.3 — no author-time value (distinct from parameters)')).toBe(
+    expect('value' in (vars[0] as object), req('openwop.it.chain-produced-var-roundtrip.emits-declared-producedvariables-into-variables-name-type-no-value', SPEC, '§2.3 — no author-time value (distinct from parameters)')).toBe(
       false,
     );
     expect(
       'defaultValue' in (vars[0] as object),
-      why(SPEC, '§2.3 — no default value (a produced var is written during the run)'),
+      req('openwop.it.chain-produced-var-roundtrip.emits-declared-producedvariables-into-variables-name-type-no-value', SPEC, '§2.3 — no default value (a produced var is written during the run)'),
     ).toBe(false);
   });
 
   it('validates a variable read of a DECLARED producedVariables name', () => {
-    expect(() => validateVariableReads(PLAN_GEN), why(SPEC, '§2.2 — declared read is closed-world valid')).not.toThrow();
+    expect(() => validateVariableReads(PLAN_GEN), req('openwop.it.chain-produced-var-roundtrip.validates-a-variable-read-of-a-declared-producedvariables-name', SPEC, '§2.2 — declared read is closed-world valid')).not.toThrow();
   });
 
   it('rejects a variable read of an UNDECLARED name (variable_undeclared)', () => {
@@ -86,14 +85,14 @@ describe('chain-produced-var-roundtrip: run-scoped variables (RFC 0133 §2, serv
         ],
       },
     };
-    expect(() => validateVariableReads(undeclared), why(SPEC, '§2.2 — undeclared read MUST reject')).toThrow(
+    expect(() => validateVariableReads(undeclared), req('openwop.it.chain-produced-var-roundtrip.rejects-a-variable-read-of-an-undeclared-name-variable-undeclared', SPEC, '§2.2 — undeclared read MUST reject')).toThrow(
       VariableUndeclaredError,
     );
     try {
       validateVariableReads(undeclared);
     } catch (e) {
-      expect((e as VariableUndeclaredError).code, why(SPEC, 'wire code variable_undeclared')).toBe('variable_undeclared');
-      expect((e as VariableUndeclaredError).variableName, why(SPEC, 'names the offending variable')).toBe('plan');
+      expect((e as VariableUndeclaredError).code, req('openwop.it.chain-produced-var-roundtrip.rejects-a-variable-read-of-an-undeclared-name-variable-undeclared', SPEC, 'wire code variable_undeclared')).toBe('variable_undeclared');
+      expect((e as VariableUndeclaredError).variableName, req('openwop.it.chain-produced-var-roundtrip.rejects-a-variable-read-of-an-undeclared-name-variable-undeclared', SPEC, 'names the offending variable')).toBe('plan');
     }
   });
 
@@ -104,12 +103,12 @@ describe('chain-produced-var-roundtrip: run-scoped variables (RFC 0133 §2, serv
     };
     expect(
       () => validateVariableReads(badProducer),
-      why(SPEC, '§2.2 — producedBy MUST be a real fragment node'),
+      req('openwop.it.chain-produced-var-roundtrip.rejects-a-producedvariables-whose-producedby-names-a-non-existent-node-produced', SPEC, '§2.2 — producedBy MUST be a real fragment node'),
     ).toThrow(ProducedVarProducerUnknownError);
     try {
       validateVariableReads(badProducer);
     } catch (e) {
-      expect((e as ProducedVarProducerUnknownError).code, why(SPEC, 'distinct wire code')).toBe(
+      expect((e as ProducedVarProducerUnknownError).code, req('openwop.it.chain-produced-var-roundtrip.rejects-a-producedvariables-whose-producedby-names-a-non-existent-node-produced', SPEC, 'distinct wire code')).toBe(
         'produced_var_producer_unknown',
       );
     }
@@ -123,7 +122,7 @@ describe('chain-produced-var-roundtrip: run-scoped variables (RFC 0133 §2, serv
     };
     expect(
       () => validateVariableReads(collide),
-      why(SPEC, '§2.2 — a produced var colliding with a parameter name MUST reject'),
+      req('openwop.it.chain-produced-var-roundtrip.rejects-a-producedvariables-name-that-collides-with-a-parameter-channels-must-be', SPEC, '§2.2 — a produced var colliding with a parameter name MUST reject'),
     ).toThrow(VariableUndeclaredError);
   });
 
@@ -141,12 +140,12 @@ describe('chain-produced-var-roundtrip: run-scoped variables (RFC 0133 §2, serv
     };
     expect(
       () => validateVariableReads(paramRead, new Set(['seed'])),
-      why(SPEC, '§2.2 — a materialized-parameter read validates'),
+      req('openwop.it.chain-produced-var-roundtrip.validates-a-read-of-a-materialized-parameter-name-params-produced-vars-compose', SPEC, '§2.2 — a materialized-parameter read validates'),
     ).not.toThrow();
     // …but still rejects when the name is neither a produced var nor a param.
     expect(
       () => validateVariableReads(paramRead, new Set()),
-      why(SPEC, '§2.2 — same read with no matching param still rejects'),
+      req('openwop.it.chain-produced-var-roundtrip.validates-a-read-of-a-materialized-parameter-name-params-produced-vars-compose', SPEC, '§2.2 — same read with no matching param still rejects'),
     ).toThrow(VariableUndeclaredError);
   });
 });

package/src/scenarios/chain-subchain-cycle-rejected.test.ts

@@ -30,8 +30,7 @@ import {
   DEFAULT_MAX_SUB_CHAIN_DEPTH,
   type WorkflowChain,
 } from '../lib/workflow-chain-expansion.js';
-
-const why = (specRef: string, requirement: string): string => `${specRef} — ${requirement}`;
+import { req } from '../lib/requirement-ids.js';
 const SPEC = 'workflow-chain-packs.md §"Sub-chain composition (RFC 0133)"';
 
 /** A chain node that dispatches a named sub-chain ref. */
@@ -88,14 +87,14 @@ const ctxFor = (siblings: Map<string, WorkflowChain>, maxDepth?: number) => ({
 describe('chain-subchain-cycle-rejected: bounded recursion (RFC 0133, server-free)', () => {
   it('rejects a chain that transitively composes itself (sub_chain_cycle)', () => {
     const siblings = new Map([[selfRef.chainId, selfRef]]);
-    expect(() => expandChainTree(selfRef, ctxFor(siblings)), why(SPEC, 'self-composition MUST reject')).toThrow(
+    expect(() => expandChainTree(selfRef, ctxFor(siblings)), req('openwop.it.chain-subchain-cycle-rejected.rejects-a-chain-that-transitively-composes-itself-sub-chain-cycle', SPEC, 'self-composition MUST reject')).toThrow(
       SubChainCycleError,
     );
     try {
       expandChainTree(selfRef, ctxFor(siblings));
     } catch (e) {
-      expect((e as SubChainCycleError).code, why(SPEC, 'wire code sub_chain_cycle')).toBe('sub_chain_cycle');
-      expect((e as SubChainCycleError).httpStatus, why(SPEC, 'HTTP 400')).toBe(400);
+      expect((e as SubChainCycleError).code, req('openwop.it.chain-subchain-cycle-rejected.rejects-a-chain-that-transitively-composes-itself-sub-chain-cycle', SPEC, 'wire code sub_chain_cycle')).toBe('sub_chain_cycle');
+      expect((e as SubChainCycleError).httpStatus, req('openwop.it.chain-subchain-cycle-rejected.rejects-a-chain-that-transitively-composes-itself-sub-chain-cycle', SPEC, 'HTTP 400')).toBe(400);
     }
   });
 
@@ -105,13 +104,13 @@ describe('chain-subchain-cycle-rejected: bounded recursion (RFC 0133, server-fre
     const { root, siblings } = linearChain(5);
     expect(
       () => expandChainTree(root, ctxFor(siblings, 2)),
-      why(SPEC, 'depth breach MUST reject (bounded recursion)'),
+      req('openwop.it.chain-subchain-cycle-rejected.rejects-nesting-past-maxsubchaindepth-with-a-distinct-sub-chain-max-depth-exceed', SPEC, 'depth breach MUST reject (bounded recursion)'),
     ).toThrow(SubChainDepthExceededError);
     try {
       expandChainTree(root, ctxFor(siblings, 2));
     } catch (e) {
-      expect((e as SubChainDepthExceededError).code, why(SPEC, 'distinct wire code')).toBe('sub_chain_max_depth_exceeded');
-      expect(e instanceof SubChainCycleError, why(SPEC, 'a depth breach is NOT a cycle')).toBe(false);
+      expect((e as SubChainDepthExceededError).code, req('openwop.it.chain-subchain-cycle-rejected.rejects-nesting-past-maxsubchaindepth-with-a-distinct-sub-chain-max-depth-exceed', SPEC, 'distinct wire code')).toBe('sub_chain_max_depth_exceeded');
+      expect(e instanceof SubChainCycleError, req('openwop.it.chain-subchain-cycle-rejected.rejects-nesting-past-maxsubchaindepth-with-a-distinct-sub-chain-max-depth-exceed', SPEC, 'a depth breach is NOT a cycle')).toBe(false);
     }
   });
 
@@ -119,7 +118,7 @@ describe('chain-subchain-cycle-rejected: bounded recursion (RFC 0133, server-fre
     const { root, siblings } = linearChain(3);
     const { children } = expandChainTree(root, ctxFor(siblings, DEFAULT_MAX_SUB_CHAIN_DEPTH));
     // 3 composing links (link.0..link.2 each compose their successor) ⇒ 3 co-registered children.
-    expect(children.length, why(SPEC, 'benign acyclic tree within the bound expands')).toBe(3);
+    expect(children.length, req('openwop.it.chain-subchain-cycle-rejected.expands-an-acyclic-tree-within-the-bound-cleanly-guard-rejects-bombs-not-benign', SPEC, 'benign acyclic tree within the bound expands')).toBe(3);
   });
 
   it('rejects a subChainRef that resolves to no sibling chain (sub_chain_unresolved)', () => {
@@ -135,7 +134,7 @@ describe('chain-subchain-cycle-rejected: bounded recursion (RFC 0133, server-fre
     const siblings = new Map([[orphan.chainId, orphan]]);
     expect(
       () => expandChainTree(orphan, ctxFor(siblings)),
-      why(SPEC, '§1.1 — unresolvable ref rejects distinctly'),
+      req('openwop.it.chain-subchain-cycle-rejected.rejects-a-subchainref-that-resolves-to-no-sibling-chain-sub-chain-unresolved', SPEC, '§1.1 — unresolvable ref rejects distinctly'),
     ).toThrow(SubChainUnresolvedError);
   });
 });