@openwop/openwop-conformance 1.163.0 → 2.0.0-rc.1

package/src/scenarios/wasm-pack-memory-cap.test.ts

@@ -28,6 +28,7 @@ import { driver } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 const CAP_BREACH_FIXTURE = 'conformance-wasm-pack-memory-cap-breach';
 
@@ -41,7 +42,7 @@ describe('wasm-pack-memory-cap: host advertises maxMemoryBytes', () => {
 
     // The cap is REQUIRED to enforce §K. Hosts MUST surface the configured
     // ceiling so clients can size their packs accordingly.
-    expect(typeof wasm.maxMemoryBytes, driver.describe(
+    expect(typeof wasm.maxMemoryBytes, req('openwop.it.wasm-pack-memory-cap.capabilities-nodepackruntimes-wasm-maxmemorybytes-is-a-plausible-number', 
       'RFCS/0008-wasm-abi.md §K',
       'capabilities.nodePackRuntimes.wasm.maxMemoryBytes MUST be advertised as a number when WASM is supported',
     )).toBe('number');
@@ -75,7 +76,7 @@ describe('wasm-pack-memory-cap: positive path via misbehaving pack', () => {
     const runId = (create.json as { runId: string }).runId;
 
     const terminal = await pollUntilTerminal(runId, { timeoutMs: 15_000 });
-    expect(terminal.status, driver.describe(
+    expect(terminal.status, req('openwop.it.wasm-pack-memory-cap.misbehaving-pack-triggers-cap-breached-with-kind-wasm-memory-and-terminal-failed', 
       'RFCS/0008-wasm-abi.md §K',
       'WASM memory-cap breach MUST drive terminal `failed` (RFC 0008 §K: "kill the instance, emit cap.breached")',
     )).toBe('failed');
@@ -83,14 +84,14 @@ describe('wasm-pack-memory-cap: positive path via misbehaving pack', () => {
     const events = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
     const list = (events.json as { events?: Array<{ type: string; payload?: unknown }> }).events ?? [];
     const breachEvent = list.find((e) => e.type === 'cap.breached');
-    expect(breachEvent, driver.describe(
+    expect(breachEvent, req('openwop.it.wasm-pack-memory-cap.misbehaving-pack-triggers-cap-breached-with-kind-wasm-memory-and-terminal-failed', 
       'RFCS/0008-wasm-abi.md §K',
       'host MUST emit cap.breached when a WASM module exceeds its memory ceiling',
     )).toBeDefined();
     // Event detail rides under the canonical `payload` envelope field (per
     // run-event-payloads.schema.json + every other event scenario), not `data`.
     const breachKind = (breachEvent?.payload as { kind?: string } | undefined)?.kind;
-    expect(breachKind, driver.describe(
+    expect(breachKind, req('openwop.it.wasm-pack-memory-cap.misbehaving-pack-triggers-cap-breached-with-kind-wasm-memory-and-terminal-failed', 
       'RFCS/0008-wasm-abi.md §K',
       'cap.breached payload MUST carry kind: "wasm-memory" for memory-ceiling breaches',
     )).toBe('wasm-memory');

package/src/scenarios/wasm-pack-replay-determinism.test.ts

@@ -16,6 +16,7 @@ import { driver } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 const FIXTURE = 'conformance-wasm-pack-roundtrip';
 
@@ -53,7 +54,7 @@ describe('wasm-pack-replay-determinism: same inputs → same output', () => {
     const a = await run();
     const b = await run();
 
-    expect(a, driver.describe(
+    expect(a, req('openwop.it.wasm-pack-replay-determinism.two-independent-runs-with-same-inputs-produce-same-wasm-output', 
       'RFCS/0008-wasm-abi.md §G',
       'WASM-node output MUST be reproducible given the same inputs',
     )).not.toBeNull();

package/src/scenarios/webhook-negative.test.ts

@@ -24,6 +24,8 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { discoverOwnedTenant } from '../lib/webhook-receiver.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 async function isWebhookSupported(): Promise<boolean> {
   const disco = await driver.get('/.well-known/openwop');
@@ -36,7 +38,7 @@ describe('webhook-negative: SSRF guard rejects private destinations', () => {
     if (!(await isWebhookSupported())) {
       // eslint-disable-next-line no-console
       console.warn('[webhook-negative] host does not advertise webhook support; skipping');
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isWebhookSupported())` returned early ([webhook-negative] host does not advertise webhook support; skipping)');
     }
     // Spec-complete except for the private URL, so validation passes and the
     // request reaches the SSRF guard. `{ url }` alone 400s `validation_error`
@@ -59,9 +61,9 @@ describe('webhook-negative: SSRF guard rejects private destinations', () => {
       if (body.subscriptionId) {
         await driver.delete(`/v1/webhooks/${encodeURIComponent(body.subscriptionId)}`);
       }
-      return;
+      return softSkip('blocked', 'precondition not met — `reg.status === 201` returned early ([webhook-negative] host accepts loopback destinations; SSRF guard not enforced) (seam, prior step, or fixture unavailable)');
     }
-    expect(reg.status, driver.describe(
+    expect(reg.status, req('openwop.it.webhook-negative.host-with-ssrf-guard-returns-400-webhook-url-rejected-for-loopback', 
       'webhooks.md + review §"Webhook SSRF guard"',
       'host with SSRF guard MUST return 400 for loopback / RFC1918 / link-local destinations',
     )).toBe(400);
@@ -72,17 +74,17 @@ describe('webhook-negative: SSRF guard rejects private destinations', () => {
 
 describe('webhook-negative: validation errors', () => {
   it('malformed url returns 400 validation_error', async () => {
-    if (!(await isWebhookSupported())) return;
+    if (!(await isWebhookSupported())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isWebhookSupported())` returned early');
     const reg = await driver.post('/v1/webhooks', { url: 'not a url' });
-    expect([400, 422]).toContain(reg.status);
+    expect([400, 422], req('openwop.it.webhook-negative.malformed-url-returns-400-validation-error', 'webhooks.md', 'malformed url returns 400 validation_error')).toContain(reg.status);
     const body = reg.json as { error?: string };
     expect(['validation_error', 'webhook_url_rejected']).toContain(body.error);
   });
 
   it('missing url returns 400 validation_error', async () => {
-    if (!(await isWebhookSupported())) return;
+    if (!(await isWebhookSupported())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isWebhookSupported())` returned early');
     const reg = await driver.post('/v1/webhooks', { eventTypes: ['run.completed'] });
-    expect(reg.status).toBe(400);
+    expect(reg.status, req('openwop.it.webhook-negative.missing-url-returns-400-validation-error', 'webhooks.md', 'missing url returns 400 validation_error')).toBe(400);
     const body = reg.json as { error?: string };
     expect(body.error).toBe('validation_error');
   });
@@ -90,9 +92,9 @@ describe('webhook-negative: validation errors', () => {
 
 describe('webhook-negative: unregister of unknown subscription', () => {
   it('DELETE /v1/webhooks/{unknown} returns 404 subscription_not_found', async () => {
-    if (!(await isWebhookSupported())) return;
+    if (!(await isWebhookSupported())) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!(await isWebhookSupported())` returned early');
     const del = await driver.delete('/v1/webhooks/wh-does-not-exist');
-    expect(del.status).toBe(404);
+    expect(del.status, req('openwop.it.webhook-negative.delete-v1-webhooks-unknown-returns-404-subscription-not-found', 'webhooks.md', 'DELETE /v1/webhooks/{unknown} returns 404 subscription_not_found')).toBe(404);
     const body = del.json as { error?: string };
     expect(body.error).toBe('subscription_not_found');
   });

package/src/scenarios/webhook-receiver-adversarial.test.ts

@@ -44,6 +44,7 @@ import {
   verifyWebhookDelivery,
   SIGNATURE_PREFIX,
 } from '../lib/webhook-receiver.js';
+import { req } from '../lib/requirement-ids.js';
 
 describe('webhook-receiver-adversarial: receiver rejects five canonical attacks', () => {
   const secret = 'test-secret-do-not-use-in-prod';
@@ -65,7 +66,7 @@ describe('webhook-receiver-adversarial: receiver rejects five canonical attacks'
     );
     expect(
       result.accepted,
-      'webhooks.md §"Signature recipe": valid signature + fresh timestamp + correct algorithm MUST be accepted',
+      req('openwop.it.webhook-receiver-adversarial.positive-control-receiver-accepts-a-freshly-signed-valid-delivery', 'spec/v1/webhooks.md', 'webhooks.md §"Signature recipe": valid signature + fresh timestamp + correct algorithm MUST be accepted'),
     ).toBe(true);
   });
 
@@ -86,7 +87,7 @@ describe('webhook-receiver-adversarial: receiver rejects five canonical attacks'
     if (!result.accepted) {
       expect(
         result.reason,
-        'webhooks.md §"Signature recipe": tampered body MUST be rejected with signature_mismatch',
+        req('openwop.it.webhook-receiver-adversarial.case-1-tampered-body-signature-mismatch', 'spec/v1/webhooks.md', 'webhooks.md §"Signature recipe": tampered body MUST be rejected with signature_mismatch'),
       ).toBe('signature_mismatch');
     }
   });
@@ -113,7 +114,7 @@ describe('webhook-receiver-adversarial: receiver rejects five canonical attacks'
       state,
       { nowSeconds: nowSec },
     );
-    expect(result.accepted).toBe(false);
+    expect(result.accepted, req('openwop.it.webhook-receiver-adversarial.case-2-tampered-hmac-signature-mismatch', 'spec/v1/webhooks.md', 'case 2: tampered HMAC → signature_mismatch')).toBe(false);
     if (!result.accepted) {
       expect(result.reason).toBe('signature_mismatch');
     }
@@ -136,7 +137,7 @@ describe('webhook-receiver-adversarial: receiver rejects five canonical attacks'
     if (!result.accepted) {
       expect(
         result.reason,
-        'webhooks.md §"Replay-attack resistance": timestamp older than freshness window MUST be rejected with timestamp_expired',
+        req('openwop.it.webhook-receiver-adversarial.case-3-stale-timestamp-timestamp-expired', 'spec/v1/webhooks.md', 'webhooks.md §"Replay-attack resistance": timestamp older than freshness window MUST be rejected with timestamp_expired'),
       ).toBe('timestamp_expired');
     }
   });
@@ -170,7 +171,7 @@ describe('webhook-receiver-adversarial: receiver rejects five canonical attacks'
     if (!replay.accepted) {
       expect(
         replay.reason,
-        'webhooks.md §"Replay-attack resistance": replay of an already-accepted signature MUST be rejected with duplicate_signature',
+        req('openwop.it.webhook-receiver-adversarial.case-4-replayed-signature-duplicate-signature', 'spec/v1/webhooks.md', 'webhooks.md §"Replay-attack resistance": replay of an already-accepted signature MUST be rejected with duplicate_signature'),
       ).toBe('duplicate_signature');
     }
   });
@@ -191,7 +192,7 @@ describe('webhook-receiver-adversarial: receiver rejects five canonical attacks'
     if (!result.accepted) {
       expect(
         result.reason,
-        'webhooks.md §"Signature algorithm versioning": algorithm other than v1 MUST be rejected with wrong_algorithm by a v1-only receiver',
+        req('openwop.it.webhook-receiver-adversarial.case-5-wrong-algorithm-wrong-algorithm', 'spec/v1/webhooks.md', 'webhooks.md §"Signature algorithm versioning": algorithm other than v1 MUST be rejected with wrong_algorithm by a v1-only receiver'),
       ).toBe('wrong_algorithm');
     }
   });
@@ -208,7 +209,7 @@ describe('webhook-receiver-adversarial: receiver rejects five canonical attacks'
       state,
       { nowSeconds: nowSec },
     );
-    expect(result.accepted).toBe(false);
+    expect(result.accepted, req('openwop.it.webhook-receiver-adversarial.case-6-malformed-signature-header-malformed-signature-header', 'spec/v1/webhooks.md', 'case 6: malformed signature header → malformed_signature_header')).toBe(false);
     if (!result.accepted) {
       expect(result.reason).toBe('malformed_signature_header');
     }

package/src/scenarios/webhook-sig-algorithm.test.ts

@@ -16,6 +16,8 @@
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { discoveryFamilies } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 interface DiscoveryWebhooks {
   webhooks?: {
@@ -33,7 +35,7 @@ describe('webhook-sig-algorithm: host advertises supported algorithm set', () =>
     if (!webhooks?.supported) {
       // eslint-disable-next-line no-console
       console.warn('[webhook-sig-algorithm] host does not advertise webhook support; skipping');
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!webhooks?.supported` returned early ([webhook-sig-algorithm] host does not advertise webhook support; skipping)');
     }
 
     const algos = webhooks.signatureAlgorithms;
@@ -45,10 +47,10 @@ describe('webhook-sig-algorithm: host advertises supported algorithm set', () =>
       console.warn(
         '[webhook-sig-algorithm] host does not advertise webhooks.signatureAlgorithms (pre-v1.1); skipping shape check',
       );
-      return;
+      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!Array.isArray(algos)` returned early ([webhook-sig-algorithm] host does not advertise webhooks.signatureAlgorithms (pre-v1.1); skipping shape check)');
     }
 
-    expect(algos.includes('v1'), driver.describe(
+    expect(algos.includes('v1'), req('openwop.it.webhook-sig-algorithm.discovery-surfaces-a-webhooks-signaturealgorithms-array-including-v1', 
       'webhooks.md §"Signature algorithm versioning"',
       'webhooks.signatureAlgorithms MUST include "v1" when surfaced (canonical baseline)',
     )).toBe(true);

package/src/scenarios/webhook-signed-delivery.test.ts

@@ -108,6 +108,7 @@ import { discoveryFamilies } from '../lib/discovery-capabilities.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { discoverOwnedTenant, resolveRegistrationUrl } from '../lib/webhook-receiver.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DeliveredRequest {
   readonly headers: Record<string, string>;
@@ -116,13 +117,13 @@ interface DeliveredRequest {
 
 async function startReceiver(): Promise<{ server: Server; url: string; received: DeliveredRequest[] }> {
   const received: DeliveredRequest[] = [];
-  const server = createServer((req: IncomingMessage, res: ServerResponse) => {
+  const server = createServer((reqBody: IncomingMessage, res: ServerResponse) => {
     const chunks: Buffer[] = [];
-    req.on('data', (c: Buffer) => chunks.push(c));
-    req.on('end', () => {
+    reqBody.on('data', (c: Buffer) => chunks.push(c));
+    reqBody.on('end', () => {
       const body = Buffer.concat(chunks).toString('utf8');
       const headers: Record<string, string> = {};
-      for (const [k, v] of Object.entries(req.headers)) {
+      for (const [k, v] of Object.entries(reqBody.headers)) {
         if (typeof v === 'string') headers[k.toLowerCase()] = v;
         else if (Array.isArray(v)) headers[k.toLowerCase()] = v.join(',');
       }
@@ -225,7 +226,7 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
       }
     }
 
-    expect(reg.status, driver.describe(
+    expect(reg.status, req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 
       'webhooks.md §"Register"',
       'POST /v1/webhooks MUST return 201 with webhookId + secret on success',
     )).toBe(201);
@@ -240,7 +241,7 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     // what the spec shows. The postgres reference host returns both names, which
     // is why nothing went red here.
     const sub = reg.json as { webhookId: string; secret: string };
-    expect(typeof sub.webhookId, driver.describe(
+    expect(typeof sub.webhookId, req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 
       'api/openapi.yaml registerWebhook 201',
       'the 201 body MUST carry `webhookId` (required) — `subscriptionId` is not in the contract',
     )).toBe('string');
@@ -276,7 +277,7 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     // has a subscriber; if nothing arrived HERE, the delivery went somewhere
     // this process cannot see and every assertion below it would be vacuous.
     // It fails — it must never soft-skip.
-    expect(ourDeliveries.length, driver.describe(
+    expect(ourDeliveries.length, req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 
       'webhooks.md §"Delivery"',
       registration.tunnelled
         ? 'host MUST POST at least one event for THIS run to the registered subscriber. ' +
@@ -289,7 +290,7 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     // Validate the FIRST delivery's signature contract. Other deliveries
     // share the same signing rules; checking one is sufficient.
     const first = ourDeliveries[0]!;
-    expect(first.headers['x-openwop-signature-algorithm'], driver.describe(
+    expect(first.headers['x-openwop-signature-algorithm'], req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 
       'webhooks.md §"Signature algorithm versioning"',
       'every delivery MUST set X-openwop-Signature-Algorithm: v1',
     )).toBe('v1');
@@ -301,26 +302,26 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     // `X-openwop-Signature: sha256={hex}`. (Suite↔spec divergence fixed 2026-08-09.)
     expect(
       first.headers['x-openwop-webhook-id'],
-      driver.describe('webhooks.md §"Delivery headers"', 'X-openwop-Webhook-Id MUST carry the subscription id'),
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', 'X-openwop-Webhook-Id MUST carry the subscription id'),
     ).toBe(sub.webhookId);
 
     const timestamp = first.headers['x-openwop-timestamp'];
     expect(
       typeof timestamp === 'string' && timestamp.length > 0,
-      driver.describe('webhooks.md §"Delivery headers"', 'X-openwop-Timestamp MUST be a Unix-seconds integer string'),
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', 'X-openwop-Timestamp MUST be a Unix-seconds integer string'),
     ).toBe(true);
 
     const signature = first.headers['x-openwop-signature'] ?? '';
     expect(
       signature.startsWith('sha256='),
-      driver.describe('webhooks.md §"Delivery headers"', 'X-openwop-Signature MUST carry the `sha256=` prefix'),
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', 'X-openwop-Signature MUST carry the `sha256=` prefix'),
     ).toBe(true);
     const expected = createHmac('sha256', sub.secret)
       .update(`${timestamp}.${first.body}`, 'utf8')
       .digest('hex');
     expect(
       signature.replace('sha256=', ''),
-      driver.describe('webhooks.md §"Delivery headers"', 'X-openwop-Signature MUST be sha256=HMAC-SHA256(secret, `${X-openwop-Timestamp}.${rawBody}`)'),
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', 'X-openwop-Signature MUST be sha256=HMAC-SHA256(secret, `${X-openwop-Timestamp}.${rawBody}`)'),
     ).toBe(expected);
 
     // RFC 0165 §C.1 — dual emission of the `OpenWOP-*` family. SHOULD-level and
@@ -337,11 +338,11 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
         ['openwop-signature', 'x-openwop-signature'],
         ['openwop-signature-algorithm', 'x-openwop-signature-algorithm'],
       ] as const) {
-        expect(first.headers[neu], driver.describe('RFC 0165 §C.1', `${neu} MUST equal ${old} when the OpenWOP-* family is emitted`)).toBe(first.headers[old]);
+        expect(first.headers[neu], req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'RFC 0165 §C.1', `${neu} MUST equal ${old} when the OpenWOP-* family is emitted`)).toBe(first.headers[old]);
       }
       expect(
         String(dual).replace('sha256=', ''),
-        driver.describe('RFC 0165 §C.1', 'OpenWOP-Signature MUST verify over the same bytes as X-openwop-Signature'),
+        req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'RFC 0165 §C.1', 'OpenWOP-Signature MUST verify over the same bytes as X-openwop-Signature'),
       ).toBe(expected);
     }
 
@@ -404,7 +405,7 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
       }
     }
 
-    expect(reg.status, driver.describe(
+    expect(reg.status, req('openwop.it.webhook-signed-delivery.control-with-a-tunnel-wired-the-host-still-refuses-the-loopback-receiver', 
       'webhooks.md §"SSRF protection"',
       'the server MUST reject loopback subscription URLs at registration time. ' +
         'It was accepted here, so this run cannot attribute the tunnelled test\'s pass to ' +

package/src/scenarios/webhook-tenant-isolation.test.ts

@@ -38,6 +38,8 @@ import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const HTTP_SKIP = !process.env.OPENWOP_BASE_URL;
 
@@ -66,26 +68,26 @@ async function gateOnWebhooks(): Promise<boolean> {
 describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: advertisement shape (webhooks.md)', () => {
   it('the webhooks block is either absent or carries a boolean supported flag', async () => {
     const cap = await readCapabilityFamily<WebhooksCap>('webhooks');
-    if (cap === undefined) return; // host doesn't advertise webhooks — conformant
+    if (cap === undefined) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `cap === undefined` returned early (host doesn\'t advertise webhooks — conformant)'); // host doesn't advertise webhooks — conformant
     expect(
       typeof cap.supported,
-      driver.describe('capabilities.schema.json §webhooks', 'webhooks.supported MUST be a boolean when present'),
+      req('openwop.it.webhook-tenant-isolation.the-webhooks-block-is-either-absent-or-carries-a-boolean-supported-flag', 'capabilities.schema.json §webhooks', 'webhooks.supported MUST be a boolean when present'),
     ).toBe('boolean');
   });
 });
 
 describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: two-tenant proof via the test seam (RFC 0093 §A.3)', () => {
   it('a subscription registered under tenant A is invisible to tenant B', async () => {
-    if (!(await gateOnWebhooks())) return;
+    if (!(await gateOnWebhooks())) return softSkip('blocked', 'precondition not met — `!(await gateOnWebhooks())` returned early (seam, prior step, or fixture unavailable)');
 
     const reg = await seam('tenant-a', 'register', {
       url: SAFE_URL,
       events: ['run.completed'],
     });
-    if (reg.status === 404) return; // host doesn't expose the test seam — soft-skip
-    expect(reg.status, driver.describe('RFC 0093 §A.3', 'seam register under tenant A MUST succeed')).toBe(200);
+    if (reg.status === 404) return softSkip('blocked', 'precondition not met — `reg.status === 404` returned early (host doesn\'t expose the test seam — soft-skip) (seam, prior step, or fixture unavailable)'); // host doesn't expose the test seam — soft-skip
+    expect(reg.status, req('openwop.it.webhook-tenant-isolation.a-subscription-registered-under-tenant-a-is-invisible-to-tenant-b', 'RFC 0093 §A.3', 'seam register under tenant A MUST succeed')).toBe(200);
     const webhookId = (reg.json as { webhookId?: string }).webhookId;
-    expect(typeof webhookId, 'seam register MUST return the new webhookId').toBe('string');
+    expect(typeof webhookId, req('openwop.it.webhook-tenant-isolation.a-subscription-registered-under-tenant-a-is-invisible-to-tenant-b', 'RFC 0093 §A.3', 'seam register MUST return the new webhookId')).toBe('string');
 
     try {
       const listB = await seam('tenant-b', 'list', {});
@@ -94,7 +96,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: two-tenant proof via the t
         .map((w) => w.webhookId);
       expect(
         idsB,
-        driver.describe(
+        req('openwop.it.webhook-tenant-isolation.a-subscription-registered-under-tenant-a-is-invisible-to-tenant-b', 
           'SECURITY/invariants.yaml webhook-cross-tenant-isolation',
           'tenant B MUST NOT see tenant A subscriptions in its list',
         ),
@@ -105,7 +107,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: two-tenant proof via the t
         .map((w) => w.webhookId);
       expect(
         idsA,
-        driver.describe('RFC 0093 §A.3', 'tenant A MUST see its own subscription (same-tenant control)'),
+        req('openwop.it.webhook-tenant-isolation.a-subscription-registered-under-tenant-a-is-invisible-to-tenant-b', 'RFC 0093 §A.3', 'tenant A MUST see its own subscription (same-tenant control)'),
       ).toContain(webhookId);
     } finally {
       await seam('tenant-a', 'unregister', { webhookId });
@@ -115,7 +117,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: two-tenant proof via the t
 
 describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: black-box registration-surface scoping (webhooks.md)', () => {
   it('registering under a tenant the caller is not a member of is refused', async () => {
-    if (!(await gateOnWebhooks())) return;
+    if (!(await gateOnWebhooks())) return softSkip('blocked', 'precondition not met — `!(await gateOnWebhooks())` returned early (seam, prior step, or fixture unavailable)');
 
     const foreignTenant = `openwop-conformance-foreign-${uniqueSuffix()}`;
     const reg = await driver.post('/v1/webhooks', {
@@ -135,7 +137,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: black-box registration-sur
     }
     expect(
       reg.status,
-      driver.describe(
+      req('openwop.it.webhook-tenant-isolation.registering-under-a-tenant-the-caller-is-not-a-member-of-is-refused', 
         'webhooks.md §Endpoints ("the caller MUST be a member of the tenant") + RFC 0093 §A.3',
         'registration under a tenant the caller is not a member of MUST be refused (403/404/400), never 201',
       ),
@@ -143,7 +145,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: black-box registration-sur
   });
 
   it('a held subscription cannot be unregistered through a foreign tenant scope', async () => {
-    if (!(await gateOnWebhooks())) return;
+    if (!(await gateOnWebhooks())) return softSkip('blocked', 'precondition not met — `!(await gateOnWebhooks())` returned early (seam, prior step, or fixture unavailable)');
 
     // Register under the caller's own tenant (host defaults the scope from
     // the API key when tenantId is omitted — the same registration shape the
@@ -159,10 +161,10 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: black-box registration-sur
       console.warn(
         `[webhook-tenant-isolation] could not register a probe subscription (${reg.status}); skipping foreign-unregister leg`,
       );
-      return;
+      return softSkip('blocked', 'precondition not met — `reg.status !== 201` returned early ([webhook-tenant-isolation] could not register a probe subscription (…); skipping foreign-unregister leg) (seam, prior step, or fixture unavailable)');
     }
     const webhookId = (reg.json as { webhookId?: string }).webhookId;
-    expect(typeof webhookId, 'registration MUST return webhookId').toBe('string');
+    expect(typeof webhookId, req('openwop.it.webhook-tenant-isolation.a-held-subscription-cannot-be-unregistered-through-a-foreign-tenant-scope', 'webhooks.md §Unregister (403 non-member / 404 not-in-scope) + RFC 0093 §A.3', 'registration MUST return webhookId')).toBe('string');
 
     try {
       const foreignTenant = `openwop-conformance-foreign-${uniqueSuffix()}`;
@@ -171,7 +173,7 @@ describe.skipIf(HTTP_SKIP)('webhook-tenant-isolation: black-box registration-sur
       );
       expect(
         del.status !== 204 && del.status < 500,
-        driver.describe(
+        req('openwop.it.webhook-tenant-isolation.a-held-subscription-cannot-be-unregistered-through-a-foreign-tenant-scope', 
           'webhooks.md §Unregister (403 non-member / 404 not-in-scope) + RFC 0093 §A.3',
           `unregister through a foreign tenant scope MUST NOT succeed (got ${del.status})`,
         ),