@openwop/openwop-conformance 1.163.0 → 2.0.0-rc.1

package/src/scenarios/workflow-chain-pack-manifest-validation.test.ts

@@ -34,6 +34,8 @@ import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import type { ErrorObject } from 'ajv';
 import { SCHEMAS_DIR, V1_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const SCHEMA_PATH = join(SCHEMAS_DIR, 'workflow-chain-pack-manifest.schema.json');
 // In-repo example pack — proves the schema validates a non-trivial
@@ -100,7 +102,7 @@ describe('category: workflow-chain-pack manifest validation', () => {
       .join('\n');
     expect(
       ok,
-      `Positive sample MUST validate against workflow-chain-pack-manifest.schema.json — got:\n${errs}`,
+      req('openwop.it.workflow-chain-pack-manifest-validation.positive-a-valid-workflow-chain-pack-manifest-validates-cleanly', 'workflow-chain-packs.md', `Positive sample MUST validate against workflow-chain-pack-manifest.schema.json — got:\n${errs}`),
     ).toBe(true);
   });
 
@@ -134,7 +136,7 @@ describe('category: workflow-chain-pack manifest validation', () => {
     };
     const ok = validate(conditionalChain);
     const errs = (validate.errors ?? []).map((e: ErrorObject) => `${e.instancePath || '/'}: ${e.message}`).join('\n');
-    expect(ok, `Object-shaped edge condition MUST validate — got:\n${errs}`).toBe(true);
+    expect(ok, req('openwop.it.workflow-chain-pack-manifest-validation.positive-a-fragmentedge-condition-takes-the-top-level-edgecondition-shape-rfc-00', 'RFC 0013', `Object-shaped edge condition MUST validate — got:\n${errs}`)).toBe(true);
   });
 
   it('negative: a bare-string FragmentEdge condition is rejected (the pre-2026-07-03 shape)', () => {
@@ -160,7 +162,7 @@ describe('category: workflow-chain-pack manifest validation', () => {
         },
       ],
     };
-    expect(validate(stringCondition), 'A string edge condition MUST NOT validate under the corrected schema').toBe(false);
+    expect(validate(stringCondition), req('openwop.it.workflow-chain-pack-manifest-validation.negative-a-bare-string-fragmentedge-condition-is-rejected-the-pre-2026-07-03-sha', 'workflow-chain-packs.md', 'A string edge condition MUST NOT validate under the corrected schema')).toBe(false);
   });
 
   it('negative: manifest mixing chains[] AND nodes[] is rejected (pack_kind_invalid)', () => {
@@ -192,14 +194,14 @@ describe('category: workflow-chain-pack manifest validation', () => {
     const ok = validate(manifest);
     expect(
       ok,
-      'Manifest with both nodes[] and chains[] MUST fail workflow-chain schema validation (pack_kind_invalid at the registry surface).',
+      req('openwop.it.workflow-chain-pack-manifest-validation.negative-manifest-mixing-chains-and-nodes-is-rejected-pack-kind-invalid', 'workflow-chain-packs.md', 'Manifest with both nodes[] and chains[] MUST fail workflow-chain schema validation (pack_kind_invalid at the registry surface).'),
     ).toBe(false);
     const hasAdditionalPropertiesErr = (validate.errors ?? []).some(
       (e: ErrorObject) => e.keyword === 'additionalProperties',
     );
     expect(
       hasAdditionalPropertiesErr,
-      'Expected an `additionalProperties` violation flagging the unexpected `nodes` field.',
+      req('openwop.it.workflow-chain-pack-manifest-validation.negative-manifest-mixing-chains-and-nodes-is-rejected-pack-kind-invalid', 'workflow-chain-packs.md', 'Expected an `additionalProperties` violation flagging the unexpected `nodes` field.'),
     ).toBe(true);
   });
 
@@ -228,7 +230,7 @@ describe('category: workflow-chain-pack manifest validation', () => {
     const ok = validate(manifest);
     expect(
       ok,
-      'Manifest with invalid chainId MUST fail workflow-chain schema validation.',
+      req('openwop.it.workflow-chain-pack-manifest-validation.negative-chain-entry-with-invalid-chainid-is-rejected-pattern-violation', 'workflow-chain-packs.md', 'Manifest with invalid chainId MUST fail workflow-chain schema validation.'),
     ).toBe(false);
     const hasPatternErr = (validate.errors ?? []).some(
       (e: ErrorObject) =>
@@ -236,14 +238,14 @@ describe('category: workflow-chain-pack manifest validation', () => {
     );
     expect(
       hasPatternErr,
-      'Expected a `pattern` violation on the chains[].chainId field.',
+      req('openwop.it.workflow-chain-pack-manifest-validation.negative-chain-entry-with-invalid-chainid-is-rejected-pattern-violation', 'workflow-chain-packs.md', 'Expected a `pattern` violation on the chains[].chainId field.'),
     ).toBe(true);
   });
 
   it('positive: the in-repo example pack at examples/packs/workflow-chain-sample/ validates against the schema', () => {
     if (!EXAMPLE_PACK_PATH || !existsSync(EXAMPLE_PACK_PATH)) {
       // Published-tarball layout doesn't ship examples/; skip cleanly.
-      return;
+      return softSkip('blocked', 'precondition not met — `!EXAMPLE_PACK_PATH || !existsSync(EXAMPLE_PACK_PATH)` returned early (Published-tarball layout doesn\'t ship examples/; skip cleanly.) (seam, prior step, or fixture unavailable)');
     }
     const manifest = JSON.parse(readFileSync(EXAMPLE_PACK_PATH, 'utf8'));
     const ok = validate(manifest);
@@ -252,15 +254,15 @@ describe('category: workflow-chain-pack manifest validation', () => {
       .join('\n');
     expect(
       ok,
-      `examples/packs/workflow-chain-sample/pack.json MUST validate against workflow-chain-pack-manifest.schema.json (closes RFC 0013 Phase 4 in-tree path). Errors:\n${errs}`,
+      req('openwop.it.workflow-chain-pack-manifest-validation.positive-the-in-repo-example-pack-at-examples-packs-workflow-chain-sample-valida', 'workflow-chain-packs.md', `examples/packs/workflow-chain-sample/pack.json MUST validate against workflow-chain-pack-manifest.schema.json (closes RFC 0013 Phase 4 in-tree path). Errors:\n${errs}`),
     ).toBe(true);
     // Spot-check the structural claims the example README makes:
-    expect(manifest.kind, 'example pack MUST declare kind: "workflow-chain"').toBe(
+    expect(manifest.kind, req('openwop.it.workflow-chain-pack-manifest-validation.positive-the-in-repo-example-pack-at-examples-packs-workflow-chain-sample-valida', 'workflow-chain-packs.md', 'example pack MUST declare kind: "workflow-chain"')).toBe(
       'workflow-chain',
     );
     expect(
       Array.isArray(manifest.chains) && manifest.chains.length === 2,
-      'example pack MUST ship exactly 2 chains (1-node + 2-node shapes) per its README contract',
+      req('openwop.it.workflow-chain-pack-manifest-validation.positive-the-in-repo-example-pack-at-examples-packs-workflow-chain-sample-valida', 'workflow-chain-packs.md', 'example pack MUST ship exactly 2 chains (1-node + 2-node shapes) per its README contract'),
     ).toBe(true);
   });
 
@@ -285,7 +287,7 @@ describe('category: workflow-chain-pack manifest validation', () => {
     const ok = validate(manifest);
     expect(
       ok,
-      'Manifest without kind: "workflow-chain" MUST fail this schema (the other path is node-pack-manifest.schema.json).',
+      req('openwop.it.workflow-chain-pack-manifest-validation.negative-omitting-kind-field-rejects-kind-is-required', 'workflow-chain-packs.md', 'Manifest without kind: "workflow-chain" MUST fail this schema (the other path is node-pack-manifest.schema.json).'),
     ).toBe(false);
   });
 });

package/src/scenarios/workflow-chain-pack-signature-verification.test.ts

@@ -30,6 +30,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { generateKeyPairSync, sign, verify } from 'node:crypto';
+import { req } from '../lib/requirement-ids.js';
 
 /** Canonical workflow-chain pack manifest used as the signing target.
  *  Mirrors the spec doc's Positive example, kept tight so the test
@@ -76,7 +77,7 @@ describe('category: workflow-chain pack signature — Ed25519 verification reuse
     const ok = verify(null, manifest, publicKey, signature);
     expect(
       ok,
-      'Per workflow-chain-packs.md §"Expansion semantics" step 2: the signature recipe is IDENTICAL to node-packs (Ed25519 over pack.json bytes). A valid pair MUST verify with the canonical recipe.',
+      req('openwop.it.workflow-chain-pack-signature-verification.valid-manifest-valid-signature-must-verify-positive-path', 'workflow-chain-packs.md', 'Per workflow-chain-packs.md §"Expansion semantics" step 2: the signature recipe is IDENTICAL to node-packs (Ed25519 over pack.json bytes). A valid pair MUST verify with the canonical recipe.'),
     ).toBe(true);
   });
 
@@ -92,7 +93,7 @@ describe('category: workflow-chain pack signature — Ed25519 verification reuse
     const ok = verify(null, tampered, publicKey, signature);
     expect(
       ok,
-      'Per node-packs.md §Signing (reused unchanged for chain packs): Ed25519 verification MUST detect any byte-level tamper to the signed payload.',
+      req('openwop.it.workflow-chain-pack-signature-verification.tampered-manifest-must-fail-verification-sha-level-tamper-detection', 'workflow-chain-packs.md', 'Per node-packs.md §Signing (reused unchanged for chain packs): Ed25519 verification MUST detect any byte-level tamper to the signed payload.'),
     ).toBe(false);
   });
 
@@ -108,7 +109,7 @@ describe('category: workflow-chain pack signature — Ed25519 verification reuse
     const ok = verify(null, manifest, attackerPubKey, signature);
     expect(
       ok,
-      'Ed25519 verification MUST fail when the public key doesn\'t match the private key that produced the signature — the spec\'s trust model depends on this property.',
+      req('openwop.it.workflow-chain-pack-signature-verification.wrong-key-signature-must-fail-verification', 'workflow-chain-packs.md', 'Ed25519 verification MUST fail when the public key doesn\'t match the private key that produced the signature — the spec\'s trust model depends on this property.'),
     ).toBe(false);
   });
 
@@ -130,7 +131,7 @@ describe('category: workflow-chain pack signature — Ed25519 verification reuse
     };
     expect(
       signedManifest.signing.method,
-      'workflow-chain packs MUST accept the same signing block keys as node packs (publicKeyRef + signatureRef + method) per spec design.',
+      req('openwop.it.workflow-chain-pack-signature-verification.chain-pack-manifests-carry-the-same-signing-block-shape-as-node-packs', 'workflow-chain-packs.md', 'workflow-chain packs MUST accept the same signing block keys as node packs (publicKeyRef + signatureRef + method) per spec design.'),
     ).toBe('manual');
     expect(signedManifest.signing.publicKeyRef).toBe('keys/2026-05.pem');
     expect(signedManifest.signing.signatureRef).toBe('pack.json.sig');

package/src/scenarios/workflow-chain-unresolvable-typeid.test.ts

@@ -36,6 +36,7 @@ import {
   ChainUnresolvableTypeIdError,
   type WorkflowChain,
 } from '../lib/workflow-chain-expansion.js';
+import { req } from '../lib/requirement-ids.js';
 
 const CHAIN_WITH_UNKNOWN_TYPEID: WorkflowChain = {
   chainId: 'vendor.acme.someChain',
@@ -66,7 +67,7 @@ describe('category: workflow-chain expansion — unresolvable typeId rejection',
           params: {},
           isTypeIdResolvable: isKnown,
         }),
-      'Per spec §"Expansion semantics" step 3: hosts MUST reject expansion with `chain_unresolvable_typeid` when any fragment node\'s typeId can\'t be resolved by the destination host.',
+      req('openwop.it.workflow-chain-unresolvable-typeid.throws-chainunresolvabletypeiderror-when-chain-references-an-unknown-typeid', 'workflow-chain-packs.md', 'Per spec §"Expansion semantics" step 3: hosts MUST reject expansion with `chain_unresolvable_typeid` when any fragment node\'s typeId can\'t be resolved by the destination host.'),
     ).toThrow(ChainUnresolvableTypeIdError);
   });
 
@@ -79,21 +80,21 @@ describe('category: workflow-chain expansion — unresolvable typeId rejection',
       });
       expect.fail('expandChain MUST have thrown ChainUnresolvableTypeIdError');
     } catch (err) {
-      expect(err, 'expected ChainUnresolvableTypeIdError').toBeInstanceOf(
+      expect(err, req('openwop.it.workflow-chain-unresolvable-typeid.error-carries-the-offending-typeid-and-the-chainid-in-details', 'workflow-chain-packs.md', 'expected ChainUnresolvableTypeIdError')).toBeInstanceOf(
         ChainUnresolvableTypeIdError,
       );
       const e = err as ChainUnresolvableTypeIdError;
       expect(
         e.code,
-        'Per spec §"Error codes": the wire-level error code MUST be `chain_unresolvable_typeid`.',
+        req('openwop.it.workflow-chain-unresolvable-typeid.error-carries-the-offending-typeid-and-the-chainid-in-details', 'workflow-chain-packs.md', 'Per spec §"Error codes": the wire-level error code MUST be `chain_unresolvable_typeid`.'),
       ).toBe('chain_unresolvable_typeid');
       expect(
         e.typeId,
-        'The error MUST surface the offending typeId so the host editor can render an actionable diagnostic.',
+        req('openwop.it.workflow-chain-unresolvable-typeid.error-carries-the-offending-typeid-and-the-chainid-in-details', 'workflow-chain-packs.md', 'The error MUST surface the offending typeId so the host editor can render an actionable diagnostic.'),
       ).toBe('made.up.foo');
       expect(
         e.chainId,
-        'The error MUST surface the chainId so the host editor knows which chain-pack tile triggered the rejection.',
+        req('openwop.it.workflow-chain-unresolvable-typeid.error-carries-the-offending-typeid-and-the-chainid-in-details', 'workflow-chain-packs.md', 'The error MUST surface the chainId so the host editor knows which chain-pack tile triggered the rejection.'),
       ).toBe('vendor.acme.someChain');
     }
   });
@@ -115,7 +116,7 @@ describe('category: workflow-chain expansion — unresolvable typeId rejection',
     }
     expect(
       threw,
-      'Expansion MUST throw before producing any output — host editors rely on the "no partial expansion" guarantee to keep parent workflows clean on rejection.',
+      req('openwop.it.workflow-chain-unresolvable-typeid.rejection-happens-before-any-id-rewriting-or-placeholder-substitution', 'workflow-chain-packs.md', 'Expansion MUST throw before producing any output — host editors rely on the "no partial expansion" guarantee to keep parent workflows clean on rejection.'),
     ).toBe(true);
   });
 
@@ -134,7 +135,7 @@ describe('category: workflow-chain expansion — unresolvable typeId rejection',
           params: {},
           isTypeIdResolvable: isKnown,
         }),
-      'Sanity: when every typeId resolves, expansion MUST proceed without throwing.',
+      req('openwop.it.workflow-chain-unresolvable-typeid.accepts-the-chain-when-every-typeid-is-resolvable', 'workflow-chain-packs.md', 'Sanity: when every typeId resolves, expansion MUST proceed without throwing.'),
     ).not.toThrow();
   });
 
@@ -163,7 +164,7 @@ describe('category: workflow-chain expansion — unresolvable typeId rejection',
       const e = err as ChainUnresolvableTypeIdError;
       expect(
         e.typeId,
-        'When multiple nodes have unknown typeIds, the throw MUST identify the first unknown one encountered in declaration order.',
+        req('openwop.it.workflow-chain-unresolvable-typeid.throws-on-the-first-unknown-typeid-encountered-fail-fast', 'workflow-chain-packs.md', 'When multiple nodes have unknown typeIds, the throw MUST identify the first unknown one encountered in declaration order.'),
       ).toBe('made.up.foo');
     }
   });

package/src/scenarios/workflow-primary-output-annotation.test.ts

@@ -23,6 +23,7 @@ import addFormats from 'ajv-formats';
 import { readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { SCHEMAS_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
 
 function compileWorkflowDefinition(): ReturnType<Ajv2020['compile']> {
   const ajv = new Ajv2020({ strict: false, allErrors: true });
@@ -78,7 +79,7 @@ describe('workflow-primary-output-annotation: outputRole shape (RFC 0065)', () =
       baseNode('b'),
     ]);
     const ok = validate(def);
-    expect(ok, JSON.stringify(validate.errors, null, 2)).toBe(true);
+    expect(ok, req('openwop.it.workflow-primary-output-annotation.accepts-a-workflow-with-one-node-declaring-outputrole-primary', 'RFC 0065', JSON.stringify(validate.errors, null, 2))).toBe(true);
   });
 
   it('accepts primary AND secondary annotations on different nodes', () => {
@@ -88,7 +89,7 @@ describe('workflow-primary-output-annotation: outputRole shape (RFC 0065)', () =
       baseNode('c'),
     ]);
     const ok = validate(def);
-    expect(ok, JSON.stringify(validate.errors, null, 2)).toBe(true);
+    expect(ok, req('openwop.it.workflow-primary-output-annotation.accepts-primary-and-secondary-annotations-on-different-nodes', 'RFC 0065', JSON.stringify(validate.errors, null, 2))).toBe(true);
   });
 
   it('accepts a workflow with the field absent (additive promise)', () => {
@@ -97,7 +98,7 @@ describe('workflow-primary-output-annotation: outputRole shape (RFC 0065)', () =
       baseNode('b'),
     ]);
     const ok = validate(def);
-    expect(ok, JSON.stringify(validate.errors, null, 2)).toBe(true);
+    expect(ok, req('openwop.it.workflow-primary-output-annotation.accepts-a-workflow-with-the-field-absent-additive-promise', 'RFC 0065', JSON.stringify(validate.errors, null, 2))).toBe(true);
   });
 
   it('rejects an unknown outputRole enum value', () => {
@@ -105,7 +106,7 @@ describe('workflow-primary-output-annotation: outputRole shape (RFC 0065)', () =
       baseNode('a', { outputRole: 'tertiary' }),
     ]);
     const ok = validate(def);
-    expect(ok).toBe(false);
+    expect(ok, req('openwop.it.workflow-primary-output-annotation.rejects-an-unknown-outputrole-enum-value', 'RFC 0065', 'rejects an unknown outputRole enum value')).toBe(false);
     expect(validate.errors).toBeTruthy();
   });
 
@@ -114,7 +115,7 @@ describe('workflow-primary-output-annotation: outputRole shape (RFC 0065)', () =
       baseNode('a', { outputRole: 1 }),
     ]);
     const ok = validate(def);
-    expect(ok).toBe(false);
+    expect(ok, req('openwop.it.workflow-primary-output-annotation.rejects-outputrole-set-to-a-non-string', 'RFC 0065', 'rejects outputRole set to a non-string')).toBe(false);
   });
 
   it('permits multiple nodes declaring outputRole="primary" (tooling decides)', () => {
@@ -127,6 +128,6 @@ describe('workflow-primary-output-annotation: outputRole shape (RFC 0065)', () =
       baseNode('b', { outputRole: 'primary' }),
     ]);
     const ok = validate(def);
-    expect(ok, JSON.stringify(validate.errors, null, 2)).toBe(true);
+    expect(ok, req('openwop.it.workflow-primary-output-annotation.permits-multiple-nodes-declaring-outputrole-primary-tooling-decides', 'RFC 0065', JSON.stringify(validate.errors, null, 2))).toBe(true);
   });
 });

package/src/scenarios/workflow-variable-format.test.ts

@@ -48,8 +48,8 @@ import { behaviorGate } from '../lib/behavior-gate.js';
 import { readCapabilityFamily } from '../lib/discovery-capabilities.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { driver } from '../lib/driver.js';
-
-const cite = (section: string, requirement: string): string => `${section} — ${requirement}`;
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
 const WORKFLOW_DEF = join(SCHEMAS_DIR, 'workflow-definition.schema.json');
 // S38 (2026-08-17): `spec/` is NOT in the published package (`files`), so a path built
 // from SCHEMAS_DIR/../spec ENOENTs for every npm consumer — five always-on legs reddened
@@ -83,11 +83,11 @@ describe('workflow-variable-format §A: corpus (RFC 0136, always-on)', () => {
     const wv = defs.WorkflowVariable;
     const props = wv.properties as Record<string, Record<string, unknown>>;
 
-    expect(props.format, cite('§WorkflowVariable', '`format` is declared')).toBeDefined();
-    expect(props.format.type, cite('§WorkflowVariable', '`format` is a string')).toBe('string');
+    expect(props.format, req('openwop.it.workflow-variable-format.a1-workflowvariable-declares-format-as-an-advisory-string', '§WorkflowVariable', '`format` is declared')).toBeDefined();
+    expect(props.format.type, req('openwop.it.workflow-variable-format.a1-workflowvariable-declares-format-as-an-advisory-string', '§WorkflowVariable', '`format` is a string')).toBe('string');
     expect(
       (wv.required as string[] | undefined)?.includes('format') ?? false,
-      cite('§WorkflowVariable', '`format` is OPTIONAL — additive per COMPATIBILITY.md §2.1'),
+      req('openwop.it.workflow-variable-format.a1-workflowvariable-declares-format-as-an-advisory-string', '§WorkflowVariable', '`format` is OPTIONAL — additive per COMPATIBILITY.md §2.1'),
     ).toBe(false);
   });
 
@@ -98,7 +98,7 @@ describe('workflow-variable-format §A: corpus (RFC 0136, always-on)', () => {
     const recognised = { name: 'recipientEmail', type: 'string', format: 'email' };
     expect(
       validate(recognised),
-      cite('§WorkflowVariable', `recognised format validates: ${JSON.stringify(validate.errors)}`),
+      req('openwop.it.workflow-variable-format.a2-an-unrecognised-format-validates-requirement-2-unknown-plain-text-never-an-er', '§WorkflowVariable', `recognised format validates: ${JSON.stringify(validate.errors)}`),
     ).toBe(true);
 
     // OUTSIDE the table. This is the whole point: the property must NOT be an enum, or a
@@ -107,7 +107,7 @@ describe('workflow-variable-format §A: corpus (RFC 0136, always-on)', () => {
     const unrecognised = { name: 'ipAddress', type: 'string', format: 'vendor.acme.ipv4-or-hostname' };
     expect(
       validate(unrecognised),
-      cite('§WorkflowVariable', `unrecognised format validates (RFC 0136 req 2): ${JSON.stringify(validate.errors)}`),
+      req('openwop.it.workflow-variable-format.a2-an-unrecognised-format-validates-requirement-2-unknown-plain-text-never-an-er', '§WorkflowVariable', `unrecognised format validates (RFC 0136 req 2): ${JSON.stringify(validate.errors)}`),
     ).toBe(true);
   });
 
@@ -116,21 +116,21 @@ describe('workflow-variable-format §A: corpus (RFC 0136, always-on)', () => {
     const both = { name: 'notifyAddress', type: 'string', format: 'email', sensitive: true };
     expect(
       validate(both),
-      cite('§WorkflowVariable', `format + sensitive compose: ${JSON.stringify(validate.errors)}`),
+      req('openwop.it.workflow-variable-format.a3-format-and-sensitive-compose-on-one-variable-no-interaction', '§WorkflowVariable', `format + sensitive compose: ${JSON.stringify(validate.errors)}`),
     ).toBe(true);
   });
 
   it.skipIf(CHAIN_DOC === null)('A4 — chain-pack spec documents deferred-mode `format` propagation as mode-scoped', () => {
     const doc = readFileSync(CHAIN_DOC as string, 'utf8');
     const step1 = doc.slice(doc.indexOf('Materialize parameters as variables'));
-    expect(step1.length > 0, cite('§Deferred-parameter expansion', 'step 1 present')).toBe(true);
+    expect(step1.length > 0, req('openwop.it.workflow-variable-format.a4-chain-pack-spec-documents-deferred-mode-format-propagation-as-mode-scoped', '§Deferred-parameter expansion', 'step 1 present')).toBe(true);
     expect(
       /`format`/.test(step1.slice(0, 1400)),
-      cite('§Deferred-parameter expansion', 'step 1 copy-list names `format`'),
+      req('openwop.it.workflow-variable-format.a4-chain-pack-spec-documents-deferred-mode-format-propagation-as-mode-scoped', '§Deferred-parameter expansion', 'step 1 copy-list names `format`'),
     ).toBe(true);
     expect(
       /this mode only|mode only/i.test(step1.slice(0, 1400)),
-      cite('§Deferred-parameter expansion', 'the `format` MUST is scoped to deferred mode, not universal'),
+      req('openwop.it.workflow-variable-format.a4-chain-pack-spec-documents-deferred-mode-format-propagation-as-mode-scoped', '§Deferred-parameter expansion', 'the `format` MUST is scoped to deferred mode, not universal'),
     ).toBe(true);
   });
 
@@ -138,7 +138,7 @@ describe('workflow-variable-format §A: corpus (RFC 0136, always-on)', () => {
     const rfc = readFileSync(RFC_DOC as string, 'utf8');
     expect(
       /configurableSchema/.test(rfc),
-      cite('RFC 0136', 'names the configurableSchema propagation path'),
+      req('openwop.it.workflow-variable-format.a5-the-rfc-forbids-format-participating-in-a-configurable-validation-decision', 'RFC 0136', 'names the configurableSchema propagation path'),
     ).toBe(true);
     // The trap: run-options.md §1 makes validating `configurable` against
     // `configurableSchema` a MUST with `validation_error` on failure. A format-asserting
@@ -147,7 +147,7 @@ describe('workflow-variable-format §A: corpus (RFC 0136, always-on)', () => {
     // closes it: annotation permitted, assertion forbidden.
     expect(
       /requirement 3[\s\S]{0,600}(back door|surface-independent)/i.test(rfc),
-      cite('RFC 0136 req 8', 'states requirement 3 is surface-independent'),
+      req('openwop.it.workflow-variable-format.a5-the-rfc-forbids-format-participating-in-a-configurable-validation-decision', 'RFC 0136 req 8', 'states requirement 3 is surface-independent'),
     ).toBe(true);
   });
 });
@@ -171,7 +171,7 @@ describe('workflow-variable-format §B: host behaviour (RFC 0136, capability-gat
   }
 
   it('B1 — deferred expansion mints `format` onto the WorkflowVariable: string copied (req 7), unknown copied (req 2), non-string omits it (req 1)', async () => {
-    if (!(await deferredParamsGateOpen())) return;
+    if (!(await deferredParamsGateOpen())) return softSkip('blocked', 'precondition not met — `!(await deferredParamsGateOpen())` returned early (seam, prior step, or fixture unavailable)');
 
     // Drive the RFC 0124 deferred-expand seam with a chain whose parameters exercise all
     // three propagation rules in one expansion; assert the minted variables[] carry (or omit)
@@ -190,15 +190,15 @@ describe('workflow-variable-format §B: host behaviour (RFC 0136, capability-gat
     });
     // A host advertising deferredParameters but not yet serving the variables[]-returning
     // seam extension soft-skips (404), as does a host with the seam disabled in this boot.
-    if (res.status === 404) return;
-    expect(res.status, cite('§Deferred-parameter expansion', 'the deferred-expand seam returns 200')).toBe(200);
+    if (res.status === 404) return softSkip('blocked', 'precondition not met — `res.status === 404` returned early (A host advertising deferredParameters but not yet serving the variables[]-returning seam extension soft-skips (404), as does a host with the seam disabled in…');
+    expect(res.status, req('openwop.it.workflow-variable-format.b1-deferred-expansion-mints-format-onto-the-workflowvariable-string-copied-req-7', '§Deferred-parameter expansion', 'the deferred-expand seam returns 200')).toBe(200);
     const variables = (res.json as { variables?: Array<{ name: string; type?: string; format?: string }> }).variables;
-    if (!Array.isArray(variables)) return; // seam present but not returning variables[] yet — soft-skip
+    if (!Array.isArray(variables)) return softSkip('blocked', 'precondition not met — `!Array.isArray(variables)` returned early (seam present but not returning variables[] yet — soft-skip) (seam, prior step, or fixture unavailable)'); // seam present but not returning variables[] yet — soft-skip
     const fmt = (n: string): string | undefined => variables.find((v) => v.name === n)?.format;
 
-    expect(fmt('email'), cite('§WorkflowVariable', 'req 7: a string param\'s recognised `format` is minted verbatim')).toBe('email');
-    expect(fmt('note'), cite('§WorkflowVariable', 'req 2: an UNRECOGNISED `format` is minted verbatim, never dropped')).toBe('vendor.acme.freeform');
-    expect(fmt('count'), cite('§WorkflowVariable', 'req 1: a NON-STRING param mints no `format`')).toBeUndefined();
+    expect(fmt('email'), req('openwop.it.workflow-variable-format.b1-deferred-expansion-mints-format-onto-the-workflowvariable-string-copied-req-7', '§WorkflowVariable', 'req 7: a string param\'s recognised `format` is minted verbatim')).toBe('email');
+    expect(fmt('note'), req('openwop.it.workflow-variable-format.b1-deferred-expansion-mints-format-onto-the-workflowvariable-string-copied-req-7', '§WorkflowVariable', 'req 2: an UNRECOGNISED `format` is minted verbatim, never dropped')).toBe('vendor.acme.freeform');
+    expect(fmt('count'), req('openwop.it.workflow-variable-format.b1-deferred-expansion-mints-format-onto-the-workflowvariable-string-copied-req-7', '§WorkflowVariable', 'req 1: a NON-STRING param mints no `format`')).toBeUndefined();
   });
 
   const B2_FIXTURE = 'conformance-workflow-variable-format-advisory';
@@ -210,13 +210,13 @@ describe('workflow-variable-format §B: host behaviour (RFC 0136, capability-gat
     // endpoint, since registration is "POST /v1/workflows or equivalent" (capabilities.md)
     // and the create path is not a mandated portable surface. Gate on fixture advertisement:
     // req 3 is universal (not deferred-mode-specific), so it rides the host loading the fixture.
-    if (!isFixtureAdvertised(B2_FIXTURE)) return;
+    if (!isFixtureAdvertised(B2_FIXTURE)) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `!isFixtureAdvertised(B2_FIXTURE)` returned early (Portable pre-registered-workflow pattern (cf. agentPackHandoffSchemaValidation): the fixture `conformance-wor…');
 
     const run = await driver.post('/v1/runs', { workflowId: B2_FIXTURE });
-    if (run.status === 404) return; // no run surface — soft-skip
+    if (run.status === 404) return softSkip('blocked', 'precondition not met — `run.status === 404` returned early (no run surface — soft-skip) (seam, prior step, or fixture unavailable)'); // no run surface — soft-skip
     expect(
       [200, 201],
-      cite('POST /v1/runs', 'req 3: a run whose variable value violates its advisory `format` is accepted, not rejected'),
+      req('openwop.it.workflow-variable-format.b2-a-run-whose-variable-value-does-not-match-its-declared-format-is-accepted-and', 'POST /v1/runs', 'req 3: a run whose variable value violates its advisory `format` is accepted, not rejected'),
     ).toContain(run.status);
     const runId = (run.json as { runId: string }).runId;
 
@@ -232,7 +232,7 @@ describe('workflow-variable-format §B: host behaviour (RFC 0136, capability-gat
     }
     expect(
       snap?.status,
-      cite('§WorkflowVariable', 'req 3: the run COMPLETES — `format` is advisory, a value mismatch MUST NOT fail the run'),
+      req('openwop.it.workflow-variable-format.b2-a-run-whose-variable-value-does-not-match-its-declared-format-is-accepted-and', '§WorkflowVariable', 'req 3: the run COMPLETES — `format` is advisory, a value mismatch MUST NOT fail the run'),
     ).toBe('completed');
   });
 });

package/src/scenarios/workload-identity-behavior.test.ts

@@ -37,6 +37,8 @@ import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
+import { softSkip } from '../lib/soft-skip.js';
 
 const PROFILE = 'openwop-workload-identity';
 /**
@@ -88,7 +90,7 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
     const r = await resolve({ identity: { ...IDENTITY, audience: 'openwop-host' } });
     expect(
       r,
-      driver.describe(
+      req('openwop.it.workload-identity-behavior.the-seam-is-wired-or-the-requirement-is-blocked-rather-than-skipped', 
         'spec/v1/host-sample-test-seams.md §20',
         'a host advertising `auth.workloadIdentity` MUST expose the resolution seam. §A\'s ' +
           'requirements — verify, bind, resolve-before-authorize, fail closed — are invisible from ' +
@@ -102,21 +104,21 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
   it('a verified identity resolves to a principal', async () => {
     if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
     const r = await resolve({ identity: { ...IDENTITY, audience: 'openwop-host' } });
-    if (r === null) return;
-    expect(r.status, driver.describe('RFCS/0154 §A', 'a verified identity resolves')).toBe(200);
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
+    expect(r.status, req('openwop.it.workload-identity-behavior.a-verified-identity-resolves-to-a-principal', 'RFCS/0154 §A', 'a verified identity resolves')).toBe(200);
     const principalId = (r.json as { principalId?: string }).principalId;
-    expect(principalId, driver.describe('RFCS/0154 §A', 'resolution yields an OpenWOP principal')).toBeTruthy();
+    expect(principalId, req('openwop.it.workload-identity-behavior.a-verified-identity-resolves-to-a-principal', 'RFCS/0154 §A', 'resolution yields an OpenWOP principal')).toBeTruthy();
   });
 
   it('an identity for another audience is rejected', async () => {
     if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
     const r = await resolve({ identity: { ...IDENTITY, audience: 'some-other-host' }, expectedAudience: 'openwop-host' });
-    if (r === null) return;
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
     // The load-bearing negative. A host that echoes its input passes every
     // positive assertion; only this distinguishes a verifier from a passthrough.
     expect(
       r.status >= 400,
-      driver.describe(
+      req('openwop.it.workload-identity-behavior.an-identity-for-another-audience-is-rejected', 
         'RFCS/0154 §A + RFC 0147 R12',
         'an identity minted for another host, accepted here, is how a credential valid elsewhere ' +
           'becomes a credential valid here — the confused-deputy path this profile prevents',
@@ -140,10 +142,10 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
         },
       },
     });
-    if (r === null) return;
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
     expect(
       r.status >= 400,
-      driver.describe(
+      req('openwop.it.workload-identity-behavior.an-expired-delegation-is-rejected', 
         'RFCS/0154 §B',
         'a delegation without a live expiry is a standing grant, which is not what delegation means',
       ),
@@ -154,13 +156,13 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
   it('a failure is non-retriable and carries a closed reason code', async () => {
     if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
     const r = await resolve({ identity: { scheme: 'spiffe', subject: 'spiffe://example/unknown' } });
-    if (r === null || r.status < 400) return;
+    if (r === null || r.status < 400) return softSkip('blocked', 'precondition not met — `r === null || r.status < 400` returned early (seam, prior step, or fixture unavailable)');
     // canonical flat envelope: code = `error`, retriable = `details.retriable`
     // (the legacy nested `error.{code,retriable}` the §20 catalog prescribed until
     // 2026-08-16 is tolerated by the helpers for the deprecation window)
     expect(
       readRetriable(r.json),
-      driver.describe(
+      req('openwop.it.workload-identity-behavior.a-failure-is-non-retriable-and-carries-a-closed-reason-code', 
         'spec/v1/host-sample-test-seams.md §20',
         'an identity that does not resolve will not resolve on retry. Marking it retriable invites ' +
           'a caller to hammer a failing authorization path.',
@@ -168,19 +170,19 @@ describe('RFC 0154 §A — workload identity resolution (capability-gated behavi
     ).toBe(false);
     expect(
       ['identity_unverified', 'identity_unresolvable', 'audience_mismatch', 'delegation_expired', 'sender_constraint_missing', 'delegation_chain_too_long', 'delegation_chain_cyclic', 'delegation_scope_amplified'],
-      driver.describe('RFCS/0154 §A', 'failures use a closed reason vocabulary'),
+      req('openwop.it.workload-identity-behavior.a-failure-is-non-retriable-and-carries-a-closed-reason-code', 'RFCS/0154 §A', 'failures use a closed reason vocabulary'),
     ).toContain(readErrorCode(r.json));
   });
 
   it('a resolution response carries no credential material', async () => {
     if (!behaviorGate(PROFILE, (await caps())?.supported === true)) return;
     const r = await resolve({ identity: { ...IDENTITY, audience: 'openwop-host' } });
-    if (r === null) return;
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
     const serialized = JSON.stringify(r.json ?? {});
     for (const forbidden of ['-----BEGIN', 'Bearer ', 'eyJ']) {
       expect(
         serialized.includes(forbidden),
-        driver.describe(
+        req('openwop.it.workload-identity-behavior.a-resolution-response-carries-no-credential-material', 
           'RFCS/0154 §A',
           'a verified identity is a fact about a completed verification, not a container for the ' +
             `material that proved it. Found: ${forbidden}`,

package/src/scenarios/workload-identity-chain-bounds.test.ts

@@ -36,7 +36,8 @@ import { readErrorCode, readRetriable } from '../lib/error-envelope.js';
 import { driver } from '../lib/driver.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
-import { seamAbsent } from '../lib/soft-skip.js';
+import { seamAbsent, softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
 
 const DELEGATION_PROFILE = 'openwop-workload-identity-delegation';
 const SEAM = '/v1/host/sample/test/workload-identity/resolve';
@@ -76,10 +77,10 @@ function hop(n: number, scopes?: readonly string[]): Record<string, unknown> {
 }
 
 /** A refusal: 4xx, non-retriable, the named closed reason. */
-function expectRefusal(r: { status: number; json: unknown }, reason: string, why: string): void {
-  expect(r.status >= 400, driver.describe('RFCS/0154 §B', why)).toBe(true);
-  expect(readErrorCode(r.json), driver.describe('spec/v1/host-sample-test-seams.md §20', `closed reason \`${reason}\``)).toBe(reason);
-  expect(readRetriable(r.json), driver.describe('spec/v1/host-sample-test-seams.md §20', 'a chain the host refuses will be refused on retry')).toBe(false);
+function expectRefusal(requirementId: string, r: { status: number; json: unknown }, reason: string, why: string): void {
+  expect(r.status >= 400, req(requirementId, 'RFCS/0154 §B', why)).toBe(true);
+  expect(readErrorCode(r.json), req(requirementId, 'spec/v1/host-sample-test-seams.md §20', `closed reason \`${reason}\``)).toBe(reason);
+  expect(readRetriable(r.json), req(requirementId, 'spec/v1/host-sample-test-seams.md §20', 'a chain the host refuses will be refused on retry')).toBe(false);
 }
 
 describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)', () => {
@@ -88,13 +89,13 @@ describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)',
     if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
     expect(
       caps.maxChainDepth,
-      driver.describe('spec/v1/auth.md §Bounds', 'a host advertising delegation MUST advertise a positive integer `maxChainDepth`'),
+      req('openwop.it.workload-identity-chain-bounds.a-chain-longer-than-the-advertised-maxchaindepth-is-refused', 'spec/v1/auth.md §Bounds', 'a host advertising delegation MUST advertise a positive integer `maxChainDepth`'),
     ).not.toBeNull();
     const depth = caps.maxChainDepth as number;
     const chain = Array.from({ length: depth + 1 }, (_, i) => hop(i + 1));
     const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
-    if (r === null) return;
-    expectRefusal(r, 'delegation_chain_too_long', `a chain of ${depth + 1} hops exceeds the advertised bound of ${depth} — each hop is another party the host trusts transitively`);
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
+    expectRefusal('openwop.it.workload-identity-chain-bounds.a-chain-longer-than-the-advertised-maxchaindepth-is-refused', r, 'delegation_chain_too_long', `a chain of ${depth + 1} hops exceeds the advertised bound of ${depth} — each hop is another party the host trusts transitively`);
   });
 
   it('a chain that revisits a subject is refused as cyclic', async () => {
@@ -106,15 +107,15 @@ describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)',
     // and this leg accepts either reason, saying so.
     const chain = [hop(1), hop(2), hop(1)];
     const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
-    if (r === null) return;
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
     const bound = caps.maxChainDepth ?? Number.POSITIVE_INFINITY;
     if (bound < 3) {
-      expect(r.status >= 400, driver.describe('RFCS/0154 §B', 'a cyclic chain is refused')).toBe(true);
-      expect(['delegation_chain_cyclic', 'delegation_chain_too_long'], driver.describe('spec/v1/host-sample-test-seams.md §20', 'cyclic or too-long — the bound is below the cycle length')).toContain(readErrorCode(r.json));
+      expect(r.status >= 400, req('openwop.it.workload-identity-chain-bounds.a-chain-that-revisits-a-subject-is-refused-as-cyclic', 'RFCS/0154 §B', 'a cyclic chain is refused')).toBe(true);
+      expect(['delegation_chain_cyclic', 'delegation_chain_too_long'], req('openwop.it.workload-identity-chain-bounds.a-chain-that-revisits-a-subject-is-refused-as-cyclic', 'spec/v1/host-sample-test-seams.md §20', 'cyclic or too-long — the bound is below the cycle length')).toContain(readErrorCode(r.json));
       expect(readRetriable(r.json)).toBe(false);
-      return;
+      return softSkip('blocked', 'precondition not met — `bound < 3` returned early (seam, prior step, or fixture unavailable)');
     }
-    expectRefusal(r, 'delegation_chain_cyclic', 'a subject appearing twice is a chain that loops back through authority it already spent — unbounded laundering with a bounded length');
+    expectRefusal('openwop.it.workload-identity-chain-bounds.a-chain-that-revisits-a-subject-is-refused-as-cyclic', r, 'delegation_chain_cyclic', 'a subject appearing twice is a chain that loops back through authority it already spent — unbounded laundering with a bounded length');
   });
 
   it('a later hop claiming a scope the previous hop did not hold is refused', async () => {
@@ -122,8 +123,8 @@ describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)',
     if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
     const chain = [hop(1, ['runs:read']), hop(2, ['runs:read', 'runs:write'])];
     const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
-    if (r === null) return;
-    expectRefusal(r, 'delegation_scope_amplified', 'the effective scopes at any hop MUST NOT exceed the hop before it — a chain is provenance, and provenance cannot mint `runs:write` from `runs:read`');
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
+    expectRefusal('openwop.it.workload-identity-chain-bounds.a-later-hop-claiming-a-scope-the-previous-hop-did-not-hold-is-refused', r, 'delegation_scope_amplified', 'the effective scopes at any hop MUST NOT exceed the hop before it — a chain is provenance, and provenance cannot mint `runs:write` from `runs:read`');
   });
 
   it('a well-formed bounded, acyclic, non-amplifying chain still resolves (the negatives are not a blanket refusal)', async () => {
@@ -131,11 +132,11 @@ describe('RFC 0154 §B — delegation chain bounds (capability-gated behavior)',
     if (!behaviorGate(DELEGATION_PROFILE, caps.supported)) return;
     const chain = [hop(1, ['runs:read', 'manifest:read']), hop(2, ['runs:read'])];
     const r = await resolve({ identity: { ...IDENTITY, delegation: { chain, audience: 'openwop-host', expiresAt: LIVE } }, expectedAudience: 'openwop-host' });
-    if (r === null) return;
+    if (r === null) return softSkip('blocked', 'precondition not met — `r === null` returned early (seam, prior step, or fixture unavailable)');
     // A host that refuses EVERY chain passes the three negatives vacuously; this
     // is the positive that keeps them honest. Scopes narrow hop-to-hop, which
     // is the one direction §B permits.
-    expect(r.status, driver.describe('RFCS/0154 §B', 'a compliant chain resolves; the bounds refuse laundering, not delegation')).toBe(200);
+    expect(r.status, req('openwop.it.workload-identity-chain-bounds.a-well-formed-bounded-acyclic-non-amplifying-chain-still-resolves-the-negatives', 'RFCS/0154 §B', 'a compliant chain resolves; the bounds refuse laundering, not delegation')).toBe(200);
     expect((r.json as { resolved?: unknown }).resolved).toBe(true);
   });
 });