@openwop/openwop-conformance 1.163.0 → 2.0.0-rc.1

package/src/scenarios/workspace-behavior.test.ts

@@ -24,6 +24,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DiscoveryWorkspace {
   supported?: boolean;
@@ -54,26 +55,26 @@ describe('workspace-behavior: §C CRUD round-trip (RFC 0059)', () => {
     const path = 'behavior/CRUD.md';
 
     const created = await driver.put(`${FILES}/${encodeURIComponent(path)}`, { content: 'first body' });
-    expect(created.status, driver.describe('agent-workspace.md §C PUT', 'create MUST return 200')).toBe(200);
+    expect(created.status, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C PUT', 'create MUST return 200')).toBe(200);
     const file = created.json as WorkspaceFile;
-    expect(file.version, driver.describe('agent-workspace.md §File model', 'version MUST start at 1')).toBe(1);
-    expect(typeof file.etag, driver.describe('agent-workspace.md §File model', 'PUT MUST return an etag')).toBe('string');
+    expect(file.version, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §File model', 'version MUST start at 1')).toBe(1);
+    expect(typeof file.etag, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §File model', 'PUT MUST return an etag')).toBe('string');
 
     const got = await driver.get(`${FILES}/${encodeURIComponent(path)}`);
-    expect((got.json as WorkspaceFile).content, driver.describe('agent-workspace.md §C GET', 'GET MUST return the content')).toBe('first body');
+    expect((got.json as WorkspaceFile).content, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C GET', 'GET MUST return the content')).toBe('first body');
 
     const list = await driver.get(FILES);
     const rows = (list.json as { files?: WorkspaceFile[] }).files ?? [];
     const row = rows.find((r) => r.path === path);
-    expect(row, driver.describe('agent-workspace.md §C list', 'list MUST include the created file')).toBeDefined();
-    expect('content' in (row as object), driver.describe('agent-workspace.md §C list', 'list MUST NOT include file bodies (metadata only)')).toBe(false);
+    expect(row, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C list', 'list MUST include the created file')).toBeDefined();
+    expect('content' in (row as object), req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C list', 'list MUST NOT include file bodies (metadata only)')).toBe(false);
 
     const del = await driver.del(`${FILES}/${encodeURIComponent(path)}`);
-    expect(del.status, driver.describe('agent-workspace.md §C DELETE', 'DELETE MUST return 2xx')).toBeGreaterThanOrEqual(200);
-    expect(del.status, 'DELETE MUST be < 300').toBeLessThan(300);
+    expect(del.status, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C DELETE', 'DELETE MUST return 2xx')).toBeGreaterThanOrEqual(200);
+    expect(del.status, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C DELETE', 'DELETE MUST be < 300')).toBeLessThan(300);
 
     const gone = await driver.get(`${FILES}/${encodeURIComponent(path)}`);
-    expect(gone.status, driver.describe('agent-workspace.md §C GET', 'GET after DELETE MUST be 404')).toBe(404);
+    expect(gone.status, req('openwop.it.workspace-behavior.put-creates-v1-get-returns-it-list-omits-content-delete-removes-it', 'agent-workspace.md §C GET', 'GET after DELETE MUST be 404')).toBe(404);
   });
 });
 
@@ -86,14 +87,14 @@ describe('workspace-behavior: §C optimistic concurrency (RFC 0059)', () => {
     const etag = (v1.json as WorkspaceFile).etag!;
 
     const stale = await driver.put(`${FILES}/${encodeURIComponent(path)}`, { content: 'nope' }, { headers: { 'If-Match': '"definitely-stale"' } });
-    expect(stale.status, driver.describe('agent-workspace.md §C PUT', 'a stale If-Match MUST return 409 workspace_conflict')).toBe(409);
-    expect((stale.json as { error?: string }).error, driver.describe('rest-endpoints.md workspace_conflict', 'error code MUST be workspace_conflict')).toBe('workspace_conflict');
+    expect(stale.status, req('openwop.it.workspace-behavior.stale-if-match-409-workspace-conflict-matching-if-match-bumps-version', 'agent-workspace.md §C PUT', 'a stale If-Match MUST return 409 workspace_conflict')).toBe(409);
+    expect((stale.json as { error?: string }).error, req('openwop.it.workspace-behavior.stale-if-match-409-workspace-conflict-matching-if-match-bumps-version', 'rest-endpoints.md workspace_conflict', 'error code MUST be workspace_conflict')).toBe('workspace_conflict');
     const details = (stale.json as { details?: { currentVersion?: number } }).details;
-    expect(typeof details?.currentVersion, driver.describe('agent-workspace.md §C PUT', '409 MUST carry details.currentVersion')).toBe('number');
+    expect(typeof details?.currentVersion, req('openwop.it.workspace-behavior.stale-if-match-409-workspace-conflict-matching-if-match-bumps-version', 'agent-workspace.md §C PUT', '409 MUST carry details.currentVersion')).toBe('number');
 
     const v2 = await driver.put(`${FILES}/${encodeURIComponent(path)}`, { content: 'v2' }, { headers: { 'If-Match': etag } });
-    expect(v2.status, 'a matching If-Match MUST succeed').toBe(200);
-    expect((v2.json as WorkspaceFile).version, driver.describe('agent-workspace.md §File model', 'a successful PUT MUST bump version')).toBe(2);
+    expect(v2.status, req('openwop.it.workspace-behavior.stale-if-match-409-workspace-conflict-matching-if-match-bumps-version', 'agent-workspace.md §C PUT', 'a matching If-Match MUST succeed')).toBe(200);
+    expect((v2.json as WorkspaceFile).version, req('openwop.it.workspace-behavior.stale-if-match-409-workspace-conflict-matching-if-match-bumps-version', 'agent-workspace.md §File model', 'a successful PUT MUST bump version')).toBe(2);
 
     await driver.del(`${FILES}/${encodeURIComponent(path)}`);
   });
@@ -106,8 +107,8 @@ describe('workspace-behavior: §C size ceiling (RFC 0059)', () => {
     const max = typeof cap.maxFileBytes === 'number' ? cap.maxFileBytes : 1_048_576;
     const tooBig = 'x'.repeat(max + 1);
     const res = await driver.put(`${FILES}/${encodeURIComponent('behavior/TOOBIG.md')}`, { content: tooBig });
-    expect(res.status, driver.describe('agent-workspace.md §C PUT', 'oversize content MUST be rejected (4xx)')).toBeGreaterThanOrEqual(400);
-    expect((res.json as { error?: string }).error, driver.describe('rest-endpoints.md workspace_too_large', 'error code MUST be workspace_too_large')).toBe('workspace_too_large');
+    expect(res.status, req('openwop.it.workspace-behavior.content-beyond-maxfilebytes-returns-workspace-too-large', 'agent-workspace.md §C PUT', 'oversize content MUST be rejected (4xx)')).toBeGreaterThanOrEqual(400);
+    expect((res.json as { error?: string }).error, req('openwop.it.workspace-behavior.content-beyond-maxfilebytes-returns-workspace-too-large', 'rest-endpoints.md workspace_too_large', 'error code MUST be workspace_too_large')).toBe('workspace_too_large');
   });
 });
 
@@ -124,10 +125,10 @@ describe('workspace-behavior: §D run-start snapshot (RFC 0059)', () => {
 
     const snap = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
     const ws = (snap.json as { workspace?: Array<{ path: string }> }).workspace;
-    if (ws === undefined) return; // host doesn't expose the snapshot field — skip
+    if (ws === undefined) return softSkip('blocked', 'precondition not met — `ws === undefined` returned early (host doesn\'t expose the snapshot field — skip) (seam, prior step, or fixture unavailable)'); // host doesn't expose the snapshot field — skip
     expect(
       ws.some((f) => f.path === path),
-      driver.describe('agent-workspace.md §D', 'the run snapshot MUST reflect a workspace file present at run start'),
+      req('openwop.it.workspace-behavior.a-run-started-after-a-write-exposes-the-workspace-snapshot', 'agent-workspace.md §D', 'the run snapshot MUST reflect a workspace file present at run start'),
     ).toBe(true);
 
     await driver.del(`${FILES}/${encodeURIComponent(path)}`);

package/src/scenarios/workspace-capability-shape.test.ts

@@ -25,6 +25,7 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DiscoveryWorkspace {
   supported?: boolean;
@@ -52,7 +53,7 @@ describe('workspace-capability-shape: advertisement shape (RFC 0059 §A)', () =>
     if (ws === null) return softSkip('inapplicable', 'optional advertisement — `capabilities.workspace` not advertised by this host (RFC 0059 §A)');
     expect(
       typeof ws.supported,
-      driver.describe(
+      req('openwop.it.workspace-capability-shape.capabilities-workspace-is-either-absent-or-well-formed', 
         'capabilities.schema.json §workspace',
         'capabilities.workspace.supported MUST be a boolean when workspace is advertised',
       ),
@@ -67,7 +68,7 @@ describe('workspace-capability-shape: advertisement shape (RFC 0059 §A)', () =>
       if (v === undefined) continue;
       expect(
         Number.isInteger(v) && v >= 1,
-        driver.describe('RFC 0059 §A', `capabilities.workspace.${field} MUST be an integer >= 1, got: ${v}`),
+        req('openwop.it.workspace-capability-shape.maxfilebytes-maxfiles-maxversions-are-positive-integers-when-present', 'RFC 0059 §A', `capabilities.workspace.${field} MUST be an integer >= 1, got: ${v}`),
       ).toBe(true);
     }
   });

package/src/scenarios/workspace-cross-tenant-isolation-blackbox.test.ts

@@ -28,6 +28,7 @@ import { softSkip } from '../lib/soft-skip.js';
 import { randomUUID } from 'node:crypto';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DiscoveryDoc {
   workspace?: { supported?: boolean };
@@ -55,18 +56,18 @@ describe('workspace-cross-tenant-isolation (black-box): a §C file MUST NOT leak
 
     // Owner A (default credential) writes the file via the NORMATIVE PUT.
     const put = await driver.put(`/v1/host/workspace/files/${path}`, { content: secret });
-    expect(put.status, driver.describe('agent-workspace.md §C PUT', 'the owning workspace MUST create its file (200)')).toBe(200);
+    expect(put.status, req('openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent', 'agent-workspace.md §C PUT', 'the owning workspace MUST create its file (200)')).toBe(200);
 
     try {
       // Owner B (second-tenant credential) MUST NOT read it — fail closed, no existence leak.
       const crossRead = await driver.get(`/v1/host/workspace/files/${path}`, asTenantB);
       expect(
         crossRead.status === 404 || crossRead.status === 403,
-        driver.describe('agent-workspace.md §E WCT-1', `a second-tenant read MUST fail closed (404/403), got ${crossRead.status}`),
+        req('openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent', 'agent-workspace.md §E WCT-1', `a second-tenant read MUST fail closed (404/403), got ${crossRead.status}`),
       ).toBe(true);
       expect(
         !JSON.stringify(crossRead.json ?? '').includes(secret),
-        driver.describe('agent-workspace.md §E WCT-1', 'a second-tenant read MUST NOT surface the owner\'s content'),
+        req('openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent', 'agent-workspace.md §E WCT-1', 'a second-tenant read MUST NOT surface the owner\'s content'),
       ).toBe(true);
 
       // Owner B MUST NOT enumerate it in the list projection.
@@ -74,13 +75,13 @@ describe('workspace-cross-tenant-isolation (black-box): a §C file MUST NOT leak
       if (crossList.status === 200) {
         expect(
           !JSON.stringify((crossList.json as { files?: unknown })?.files ?? []).includes(path),
-          driver.describe('agent-workspace.md §E WCT-1', 'a second-tenant list MUST NOT enumerate the owner\'s path'),
+          req('openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent', 'agent-workspace.md §E WCT-1', 'a second-tenant list MUST NOT enumerate the owner\'s path'),
         ).toBe(true);
       }
 
       // Isolation, not loss: owner A still reads its own file.
       const ownerRead = await driver.get(`/v1/host/workspace/files/${path}`);
-      expect(ownerRead.status, driver.describe('agent-workspace.md §C GET', 'the owning workspace MUST still read its own file')).toBe(200);
+      expect(ownerRead.status, req('openwop.it.workspace-cross-tenant-isolation-blackbox.a-file-written-by-owner-a-is-unreadable-un-enumerable-by-a-second-tenant-credent', 'agent-workspace.md §C GET', 'the owning workspace MUST still read its own file')).toBe(200);
       expect((ownerRead.json as { content?: string } | undefined)?.content).toBe(secret);
     } finally {
       // Best-effort cleanup as owner A.

package/src/scenarios/workspace-cross-tenant-isolation.test.ts

@@ -22,6 +22,7 @@ import { describe, it, expect } from 'vitest';
 import { softSkip } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
+import { req } from '../lib/requirement-ids.js';
 
 interface DiscoveryDoc {
   capabilities?: { workspace?: { supported?: boolean } };
@@ -46,25 +47,25 @@ describe('workspace-cross-tenant-isolation: a workspace file MUST NOT leak acros
     // Owner A writes a file.
     const put = await seam({ tenant: 'wct1-tenant-a', workspace: 'ws-a', op: 'put', path: SEAM_PATH, content: 'A-only secret body' });
     if (put.status === 404) return softSkip('blocked', 'seam unwired — soft-skip the behavioral probe');
-    expect(put.status, driver.describe('agent-workspace.md §C PUT', 'seam put MUST succeed for the owning workspace')).toBe(200);
+    expect(put.status, req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §C PUT', 'seam put MUST succeed for the owning workspace')).toBe(200);
 
     // A DIFFERENT workspace (same tenant) MUST NOT read it.
     const crossWs = await seam({ tenant: 'wct1-tenant-a', workspace: 'ws-b', op: 'get', path: SEAM_PATH });
     expect(
       crossWs.status === 404 || crossWs.status === 403,
-      driver.describe('agent-workspace.md §E WCT-1', `a cross-workspace get MUST fail closed (404/403, no existence leak), got ${crossWs.status}`),
+      req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §E WCT-1', `a cross-workspace get MUST fail closed (404/403, no existence leak), got ${crossWs.status}`),
     ).toBe(true);
     const crossWsBody = JSON.stringify(crossWs.json ?? '');
     expect(
       !crossWsBody.includes('A-only secret body'),
-      driver.describe('agent-workspace.md §E WCT-1', 'a cross-workspace read MUST NOT surface the other owner\'s content'),
+      req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §E WCT-1', 'a cross-workspace read MUST NOT surface the other owner\'s content'),
     ).toBe(true);
 
     // A DIFFERENT tenant MUST NOT read it either.
     const crossTenant = await seam({ tenant: 'wct1-tenant-b', workspace: 'ws-a', op: 'get', path: SEAM_PATH });
     expect(
       crossTenant.status === 404 || crossTenant.status === 403,
-      driver.describe('agent-workspace.md §E WCT-1', `a cross-tenant get MUST fail closed, got ${crossTenant.status}`),
+      req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §E WCT-1', `a cross-tenant get MUST fail closed, got ${crossTenant.status}`),
     ).toBe(true);
 
     // And list MUST NOT enumerate the other owner's path.
@@ -72,14 +73,14 @@ describe('workspace-cross-tenant-isolation: a workspace file MUST NOT leak acros
     const listed = JSON.stringify((crossList.json as { files?: unknown })?.files ?? []);
     expect(
       !listed.includes(SEAM_PATH),
-      driver.describe('agent-workspace.md §E WCT-1', 'a cross-workspace list MUST NOT enumerate another owner\'s file'),
+      req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §E WCT-1', 'a cross-workspace list MUST NOT enumerate another owner\'s file'),
     ).toBe(true);
 
     // Sanity: the owner itself still reads its file (isolation, not loss).
     const ownerRead = await seam({ tenant: 'wct1-tenant-a', workspace: 'ws-a', op: 'get', path: SEAM_PATH });
     expect(
       (ownerRead.json as { content?: string } | undefined)?.content,
-      driver.describe('agent-workspace.md §C GET', 'the owning workspace MUST still read its own file'),
+      req('openwop.it.workspace-cross-tenant-isolation.a-file-written-under-tenant-a-workspace-a-is-not-readable-under-a-different-owne', 'agent-workspace.md §C GET', 'the owning workspace MUST still read its own file'),
     ).toBe('A-only secret body');
   });
 });

package/src/scenarios/x-openwop-form-pack-manifest.test.ts

@@ -38,6 +38,7 @@ import { describe, it, expect } from 'vitest';
 import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import type { ErrorObject } from 'ajv';
+import { req } from '../lib/requirement-ids.js';
 
 /** The §A `x-openwop-form` annotation shape. `kind` is the only required
  *  field; it is an OPEN string (unknown kinds are valid per the forward-compat
@@ -103,11 +104,11 @@ describe('category: x-openwop-form pack-manifest shape (RFC 0066)', () => {
     let validateConfig: ReturnType<typeof ajv.compile> | undefined;
     expect(() => {
       validateConfig = ajv.compile(annotatedConfigSchema());
-    }, 'node-packs.md §x-openwop-form: an annotated configSchema MUST remain a valid 2020-12 schema').not.toThrow();
+    }, req('openwop.it.x-openwop-form-pack-manifest.positive-a-configschema-carrying-x-openwop-form-remains-a-valid-json-schema-2020', 'node-packs.md', 'node-packs.md §x-openwop-form: an annotated configSchema MUST remain a valid 2020-12 schema')).not.toThrow();
     // The annotations do not alter schema semantics: valid config passes…
     expect(
       validateConfig!({ provider: 'anthropic', model: 'claude', temperature: 1 }),
-      'x-openwop-form is advisory — it MUST NOT change what the schema accepts',
+      req('openwop.it.x-openwop-form-pack-manifest.positive-a-configschema-carrying-x-openwop-form-remains-a-valid-json-schema-2020', 'node-packs.md', 'x-openwop-form is advisory — it MUST NOT change what the schema accepts'),
     ).toBe(true);
     // …and a type violation on an annotated field still rejects.
     expect(validateConfig!({ provider: 123 })).toBe(false);
@@ -120,7 +121,7 @@ describe('category: x-openwop-form pack-manifest shape (RFC 0066)', () => {
       if (ann === undefined) continue;
       expect(
         validateShape(ann),
-        `node-packs.md §x-openwop-form: the annotation on "${name}" MUST match the §A shape. Errors: ${JSON.stringify(validateShape.errors)}`,
+        req('openwop.it.x-openwop-form-pack-manifest.positive-each-documented-x-openwop-form-annotation-matches-the-a-shape', 'node-packs.md', `node-packs.md §x-openwop-form: the annotation on "${name}" MUST match the §A shape. Errors: ${JSON.stringify(validateShape.errors)}`),
       ).toBe(true);
     }
   });
@@ -128,28 +129,28 @@ describe('category: x-openwop-form pack-manifest shape (RFC 0066)', () => {
   it('forward-compat: an unknown kind is a structurally valid annotation (renderer falls back per the §A MUST)', () => {
     expect(
       validateShape({ kind: 'unknown-future-picker' }),
-      'node-packs.md §x-openwop-form: an unknown kind MUST validate (kind is an open string, not a closed enum) so future vocabulary is forward-compatible',
+      req('openwop.it.x-openwop-form-pack-manifest.forward-compat-an-unknown-kind-is-a-structurally-valid-annotation-renderer-falls', 'node-packs.md', 'node-packs.md §x-openwop-form: an unknown kind MUST validate (kind is an open string, not a closed enum) so future vocabulary is forward-compatible'),
     ).toBe(true);
   });
 
   it('negative: an annotation missing kind is rejected', () => {
     expect(
       shapeFailsWith({ dependsOn: 'provider' }, 'required').length,
-      'node-packs.md §x-openwop-form: kind is the one REQUIRED sub-field',
+      req('openwop.it.x-openwop-form-pack-manifest.negative-an-annotation-missing-kind-is-rejected', 'node-packs.md', 'node-packs.md §x-openwop-form: kind is the one REQUIRED sub-field'),
     ).toBeGreaterThan(0);
   });
 
   it('negative: a non-string kind is rejected', () => {
     expect(
       shapeFailsWith({ kind: 42 }, 'type').length,
-      'node-packs.md §x-openwop-form: kind MUST be a string',
+      req('openwop.it.x-openwop-form-pack-manifest.negative-a-non-string-kind-is-rejected', 'node-packs.md', 'node-packs.md §x-openwop-form: kind MUST be a string'),
     ).toBeGreaterThan(0);
   });
 
   it('negative: a non-string dependsOn is rejected', () => {
     expect(
       shapeFailsWith({ kind: 'model-picker', dependsOn: ['provider'] }, 'type').length,
-      'node-packs.md §x-openwop-form: dependsOn names a sibling property — it MUST be a string',
+      req('openwop.it.x-openwop-form-pack-manifest.negative-a-non-string-dependson-is-rejected', 'node-packs.md', 'node-packs.md §x-openwop-form: dependsOn names a sibling property — it MUST be a string'),
     ).toBeGreaterThan(0);
   });
 });

package/src/setup.ts

@@ -31,7 +31,9 @@ import { OtelCollector, setCollector } from './lib/otel-collector.js';
 import { McpFakeServer, setMcpFakeServer } from './lib/mcp-fake-server.js';
 import { A2AFakePeer, setA2AFakePeer } from './lib/a2a-fake-peer.js';
 import { afterAll, afterEach, beforeAll, beforeEach, expect } from 'vitest';
-import { basename } from 'node:path';
+import { basename, join } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { PKG_ROOT_PATH } from './lib/paths.js';
 import { recordRequirement, hasRequirement, journalLength, journalSince } from './lib/requirement-ledger.js';
 import { requirementIdForFile, resolveFileRecord, type FileTestState } from './lib/scenario-disposition.js';
 import { softSkipDisposition } from './lib/soft-skip.js';
@@ -243,6 +245,34 @@ function _assertionCalls(): number {
     return 0;
   }
 }
+
+/**
+ * (file, title) → the explicit `req()` id the scenario cites, read from the
+ * generated `requirements.json` that ships with the package. Only ids under
+ * `openwop.requirement.` are returned: a per-`it` id is what the allocator
+ * would mint anyway.
+ */
+let _registry: Map<string, string> | undefined;
+function registeredExplicitId(file: string, title: string): string | null {
+  if (_registry === undefined) {
+    _registry = new Map();
+    for (const root of [PKG_ROOT_PATH, join(PKG_ROOT_PATH, '..')]) {
+      const path = join(root, 'requirements.json');
+      if (!existsSync(path)) continue;
+      try {
+        const doc = JSON.parse(readFileSync(path, 'utf8')) as { records?: Array<{ file?: unknown; title?: unknown; explicitId?: unknown }> };
+        for (const r of doc.records ?? []) {
+          if (typeof r.file === 'string' && typeof r.title === 'string' && typeof r.explicitId === 'string' && r.explicitId.startsWith('openwop.requirement.')) {
+            _registry.set(`${r.file}\u0000${r.title}`, r.explicitId);
+          }
+        }
+      } catch { /* an unreadable registry simply yields no fallback */ }
+      break;
+    }
+  }
+  return _registry.get(`${file}\u0000${title}`) ?? null;
+}
+
 function _fileOf(task: { file?: { filepath?: string; name?: string } } | undefined): string | null {
   const f = task?.file?.filepath ?? task?.file?.name;
   return typeof f === 'string' && f.length > 0 ? basename(f) : null;
@@ -292,11 +322,18 @@ afterEach(({ task }) => {
   // which prove fixtures and helpers, not a host, and must never become bundle
   // evidence (that is why RFC 0163 G5 / RFC 0050 G1 moved them out of scenarios).
   const filepath = (task as { file?: { filepath?: string } }).file?.filepath ?? '';
-  if (!/[\\/]src[\\/]scenarios[\\/]/.test(filepath)) {
+  // Suite 2.0.0: src/coherence/ rows feed the corpus ledger (scripts/check-spec-coherence.mjs), not a host bundle.
+  if (!/[\\/]src[\\/](scenarios|coherence)[\\/]/.test(filepath)) {
     takeExplicitRequirementId();
     return;
   }
-  const explicit = takeExplicitRequirementId();
+  // A leg that soft-skips before its first assertion never calls `req()`, so the
+  // runtime override is empty and the row lands under the per-`it` id instead of
+  // the requirement the leg is about — leaving that requirement with no row in
+  // any bundle, which is the §F Witness gate's subject. The generated registry
+  // already knows (file, title) → explicit id statically, so fall back to it and
+  // the disposition is attributed either way.
+  const explicit = takeExplicitRequirementId() ?? registeredExplicitId(file, task.name);
   const alloc = _itAllocators.get(file) ?? new ItIdAllocator();
   _itAllocators.set(file, alloc);
   const itId = explicit ?? alloc.allocate(file, task.name);
@@ -304,7 +341,8 @@ afterEach(({ task }) => {
   const gate = since.find((e) => e.disposition === 'inapplicable') ?? since.find((e) => e.disposition === 'skipped');
   let disposition: 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
   let detail: string | undefined;
-  if (SPEC_COHERENCE_SCENARIOS.has(file) || SPEC_COHERENCE_SCENARIOS.has(file.replace(/\.test\.ts$/, ''))) {
+  // Suite 2.0.0: under the corpus gate (scripts/check-spec-coherence.mjs sets OPENWOP_CORPUS_GATE) a coherence scenario IS the subject; its rows are real dispositions for evidence/corpus-ledger.json.
+  if (process.env.OPENWOP_CORPUS_GATE !== '1' && (SPEC_COHERENCE_SCENARIOS.has(file) || SPEC_COHERENCE_SCENARIOS.has(file.replace(/\.test\.ts$/, '')))) {
     // Corpus-coherence scenario: it reads spec/v1 and asserts nothing about a
     // host, in any layout. Its rows are `inapplicable` to every host — the same
     // rule `resolveFileRecord` applies to the file in the published layout.
@@ -327,7 +365,7 @@ afterEach(({ task }) => {
     detail = 'vitest skipped the test (ctx.skip / it.skip) without a recorded gate reason';
   }
   try {
-    recordRequirement(itId, disposition, detail, { assertionCount: calls });
+    recordRequirement(itId, disposition, detail, { assertionCount: calls, scenarioFile: file });
   } catch {
     /* never fail a test for bookkeeping */
   }
@@ -374,7 +412,7 @@ afterAll(({}, suite) => {
   // of both now.
   if (!hasRequirement(fileRequirementId)) {
     try {
-      recordRequirement(fileRequirementId, disposition, detail, { assertionCount });
+      recordRequirement(fileRequirementId, disposition, detail, { assertionCount, scenarioFile: file });
     } catch {
       /* never fail a file for bookkeeping */
     }

package/vitest.config.ts

@@ -6,7 +6,11 @@ export default defineConfig({
     // scenarios; `src/lib/**/*.test.ts` are server-free unit tests for
     // suite-internal helpers (e.g., the synthetic OIDC issuer harness)
     // that don't depend on OPENWOP_BASE_URL.
-    include: ['src/scenarios/**/*.test.ts', 'src/lib/**/*.test.ts'],
+    include: ['src/scenarios/**/*.test.ts'],
+    // Suite 2.0.0: the corpus-coherence scenarios (src/coherence/) and the suite
+    // self-tests (src/lib/*.test.ts) are NOT host scenarios; they run under
+    // vitest.coherence.config.ts (scripts/check-spec-coherence.mjs) and
+    // vitest.selftest.config.ts. A host run never executes them.
     testTimeout: 30_000,
     hookTimeout: 30_000,
     globals: true,

package/api/.redocly.lint-ignore.yaml

@@ -1,22 +0,0 @@
-# Scoped, documented exceptions to redocly's `no-ambiguous-paths` rule.
-# The rule stays ENABLED globally (it catches genuinely ambiguous new paths);
-# only the two known-safe occurrences below are exempted.
-#
-# Why these are safe (NOT merely tolerated):
-#   The rule flags the structural template/literal swap between
-#   `/v1/agents/{agentId}/deployments` and the sibling collection routes
-#   `/v1/agents/roster/{rosterId}` + `/v1/agents/org-chart/{departmentId}`
-#   (e.g. `/v1/agents/roster/deployments` could in principle parse two ways).
-#   It is resolved deterministically:
-#     1. `agentId` carries `pattern: '^(?!roster$|org-chart$).+$'` (see the two
-#        `/v1/agents/{agentId}*` paths), so `{agentId}` can NEVER be `roster` or
-#        `org-chart` — a pattern-aware validator/router cannot misroute.
-#     2. OpenAPI 3.x matching is concrete-before-templated, so `/v1/agents/roster/*`
-#        and `/v1/agents/org-chart/*` bind to the literal collection routes first.
-#   The paths are all normative (RFC 0072/0082/0086/0087), so they can't be
-#   renamed without a breaking change; the pattern is the non-breaking fix and
-#   redocly's purely-structural rule can't see it.
-openapi.yaml:
-  no-ambiguous-paths:
-    - '#/paths/~1v1~1agents~1roster~1{rosterId}'
-    - '#/paths/~1v1~1agents~1org-chart~1{departmentId}'